Merge pull request #43 from openagentlock/feat/install-host-side-writes

Feat/install host side writes

Author: RonCodes88

README.md

@@ -52,9 +52,9 @@ Full walkthrough at <https://openagentlock.github.io/OpenAgentLock/guide/getting
 | Surface | Status |
 |---|---|
 | `agentlock detect` | ![shipped](https://img.shields.io/badge/-shipped-16a34a?style=flat-square) |
-| `agentlock install` (Claude Code, Codex CLI) | ![shipped](https://img.shields.io/badge/-shipped-16a34a?style=flat-square) |
+| `agentlock install` (Claude Code, Codex CLI, Cursor) | ![shipped](https://img.shields.io/badge/-shipped-16a34a?style=flat-square) |
 | `agentlock install --tier {unattested,software,totp}` | ![shipped](https://img.shields.io/badge/-shipped-16a34a?style=flat-square) |
-| `agentlock install` (Cursor, OpenCode, Cline, Gemini CLI, Continue, VS Code Copilot) | ![not yet](https://img.shields.io/badge/-not%20yet-f59e0b?style=flat-square) |
+| `agentlock install` (OpenCode, Cline, Gemini CLI, Continue, VS Code Copilot) | ![not yet](https://img.shields.io/badge/-not%20yet-f59e0b?style=flat-square) |
 | Five baseline gates in monitor mode | ![shipped](https://img.shields.io/badge/-shipped-16a34a?style=flat-square) |
 | Tamper-evident Merkle ledger | ![shipped](https://img.shields.io/badge/-shipped-16a34a?style=flat-square) |
 | Local web dashboard | ![shipped](https://img.shields.io/badge/-shipped-16a34a?style=flat-square) |

cli/README.md

@@ -12,7 +12,11 @@ The CLI talks to a local control plane (Go service in Docker, port 7878). Pull a
 
 ```bash
 docker pull ghcr.io/openagentlock/agentlockd:latest
-docker run -d --name agentlock -p 127.0.0.1:7878:7878 ghcr.io/openagentlock/agentlockd:latest
+docker run -d --name agentlock \
+  -p 127.0.0.1:7878:7878 \
+  -p 127.0.0.1:7879:7879 \
+  -v agentlock-state:/var/lib/agentlock \
+  ghcr.io/openagentlock/agentlockd:latest
 ```
 
 Then use the CLI:
@@ -23,6 +27,8 @@ agentlock install           # plan + apply hooks for selected harnesses
 agentlock status            # control-plane health
 ```
 
+For attested install (TOTP, hardware signers) and policies, see [openagentlock.github.io/OpenAgentLock](https://openagentlock.github.io/OpenAgentLock/).
+
 Full documentation: <https://openagentlock.github.io/OpenAgentLock/>
 
 Source: <https://github.com/openagentlock/OpenAgentLock>

cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openagentlock/cli",
-  "version": "0.1.12",
+  "version": "0.1.14",
   "type": "module",
   "license": "SEE LICENSE IN LICENSE",
   "description": "OpenAgentLock CLI — a firewall for AI coding agents. Detects local agent harnesses (Claude Code, Codex CLI, Cursor, OpenCode, Cline, Gemini CLI, Continue, Copilot), gates risky tool calls via a Go control plane, anchors decisions in a Rust Merkle ledger.",

cli/src/commands/install.ts

@@ -32,6 +32,12 @@ import { detectAll } from "../detect/index.ts";
 import type { HarnessId } from "../detect/types.ts";
 import { multiselect } from "../tui/multiselect.tsx";
 import { apiClient, type InstallFileOp } from "../util/api.ts";
+import {
+  checkSafeTarget,
+  executeFileOps,
+  executeUninstallOps,
+  readExistingFiles,
+} from "../util/install-fs.ts";
 import { home } from "../util/paths.ts";
 import { mintAttestedSession, type AttestedTier } from "../util/session-mint.ts";
 
@@ -262,35 +268,16 @@ export async function runInstall(argv: string[] = []): Promise<void> {
   const daemonUrl = flags.daemonUrl ?? api.baseUrl;
 
   // 3.5. Capabilities probe -------------------------------------------
-  // Read-only check against the daemon so we fail fast — before fetching
-  // the plan, before showing y/N — when apply is disabled or when the
-  // daemon's view of the host filesystem won't match the user's. Older
-  // daemons (pre-0.1.10) don't expose this endpoint; treat 404/network
-  // errors as "unknown" and fall through to the existing post-action
-  // error handling.
+  // The daemon no longer writes host files (the CLI does), so there's
+  // no apply / real-home gate to check. We still call the endpoint so
+  // unattested-disabled daemons surface early — but the check above
+  // (createUnattestedSession) already covers that case for tier=unattested.
+  // Older daemons (pre-0.1.10) don't expose the endpoint; ignore.
   try {
-    const caps = await api.installCapabilities();
-    if (!caps.apply_enabled) {
-      process.stderr.write(
-        "\ninstall apply is disabled on this daemon.\n" +
-          "restart the daemon with -e AGENTLOCK_ALLOW_APPLY=1 added.\n" +
-          "see https://openagentlock.github.io/OpenAgentLock/guide/daemon-flags/\n",
-      );
-      process.exitCode = 2;
-      return;
-    }
-    if (caps.container && !flags.configDirOverride) {
-      process.stdout.write(
-        "\nwarning: daemon is running in a container.\n" +
-          "  install will reference your host paths (e.g. ~/.claude). For\n" +
-          "  writes to actually land on the host, the daemon must have\n" +
-          "  same-path bind mounts (e.g. -v $HOME/.claude:$HOME/.claude).\n" +
-          "  see https://openagentlock.github.io/OpenAgentLock/guide/installation/\n",
-      );
-    }
+    await api.installCapabilities();
   } catch {
     // Probe failed — older daemon or transient. Continue; downstream
-    // calls will surface specific errors with the same hints.
+    // calls will surface specific errors.
   }
 
   // 3a. Per-harness uninstall for rows the user just deselected. Runs
@@ -300,12 +287,26 @@ export async function runInstall(argv: string[] = []): Promise<void> {
     process.stdout.write(
       `\nuninstalling deselected harnesses: ${toUninstall.join(", ")}\n`,
     );
+    // Pass the current contents of every per-harness file so the daemon
+    // can compute the post-strip bytes without reading host paths.
+    const uninstallPaths: string[] = [];
+    for (const id of toUninstall) {
+      const dir = hostConfigDirs[id];
+      if (!dir) continue;
+      if (id === "claude-code") {
+        uninstallPaths.push(resolve(join(dir, "settings.json")));
+      } else if (id === "codex" || id === "cursor") {
+        uninstallPaths.push(resolve(join(dir, "hooks.json")));
+      }
+    }
+    const uninstallExisting = await readExistingFiles(uninstallPaths);
     try {
       const u = await api.installUninstallHarnesses({
         session_id: sessionId,
         harnesses: toUninstall,
         config_dir_override: flags.configDirOverride,
         harness_config_dirs: hostConfigDirs,
+        existing_files: uninstallExisting,
       });
       for (const op of u.operations) {
         const note = op.error ? `  ERROR: ${op.error}` : "";
@@ -317,18 +318,13 @@ export async function runInstall(argv: string[] = []): Promise<void> {
         process.stderr.write(
           `\n${u.failures} uninstall op(s) failed; see above. Continuing with install.\n`,
         );
+      } else {
+        // Execute the strip / remove ops on the host now that the daemon
+        // has signed the diff into the ledger.
+        await executeUninstallOps(u.operations);
       }
     } catch (err) {
       const msg = (err as Error).message;
-      if (msg.includes("apply_disabled")) {
-        process.stderr.write(
-          "\nuninstall is disabled on this daemon.\n" +
-            "restart the daemon with -e AGENTLOCK_ALLOW_APPLY=1 added.\n" +
-            "see https://openagentlock.github.io/OpenAgentLock/guide/daemon-flags/\n",
-        );
-        process.exitCode = 2;
-        return;
-      }
       process.stderr.write(`\nuninstall failed: ${msg}\n`);
       // Continue: a failed uninstall shouldn't block re-installing the
       // ones the user kept selected.
@@ -340,6 +336,22 @@ export async function runInstall(argv: string[] = []): Promise<void> {
     return;
   }
 
+  // Read every host file the daemon needs to merge against, so the plan
+  // ops carry the final byte-for-byte content the CLI will write. Missing
+  // files are silently skipped (readExistingFiles drops ENOENT).
+  const claudeSettings = resolve(
+    join(hostConfigDirs["claude-code"], "settings.json"),
+  );
+  const codexHooks = resolve(join(hostConfigDirs["codex"], "hooks.json"));
+  const codexConfig = resolve(join(hostConfigDirs["codex"], "config.toml"));
+  const cursorHooks = resolve(join(hostConfigDirs["cursor"], "hooks.json"));
+  const existingFiles = await readExistingFiles([
+    claudeSettings,
+    codexHooks,
+    codexConfig,
+    cursorHooks,
+  ]);
+
   const planReq = {
     session_id: sessionId,
     harnesses: chosen,
@@ -351,6 +363,7 @@ export async function runInstall(argv: string[] = []): Promise<void> {
     // override (e.g. point at the compiled single-file binary).
     agentlock_binary: process.env.AGENTLOCK_BINARY ?? defaultAgentlockBinary(),
     harness_config_dirs: hostConfigDirs,
+    existing_files: existingFiles,
   };
 
   // 4. Plan dry-run ------------------------------------------------------
@@ -404,7 +417,36 @@ export async function runInstall(argv: string[] = []): Promise<void> {
     }
   }
 
+  // 5.5. Safety check + execute on the host ---------------------------
+  // The plan was returned by the daemon but it never touched disk. We
+  // refuse paths that don't resolve under one of the real harness home
+  // subtrees unless the caller explicitly opted into a dev sandbox via
+  // --config-dir or AGENTLOCK_DEV_HOME.
+  const bypass =
+    !!flags.configDirOverride || !!process.env.AGENTLOCK_DEV_HOME;
+  try {
+    for (const op of plan.operations) {
+      checkSafeTarget(op.path, { bypass });
+    }
+  } catch (err) {
+    process.stderr.write(`\n${(err as Error).message}\n`);
+    process.stderr.write(
+      "use --config-dir ./dev/.claude (or ./dev/.codex, ./dev/.cursor) for dev runs.\n",
+    );
+    process.exitCode = 2;
+    return;
+  }
+  try {
+    await executeFileOps(plan.operations);
+  } catch (err) {
+    process.stderr.write(`\nfile write failed: ${(err as Error).message}\n`);
+    process.exitCode = 2;
+    return;
+  }
+
   // 6. Apply -------------------------------------------------------------
+  // Files are already on disk; this call records the manifest + signs
+  // the install into the ledger.
   process.stdout.write("\napplying...\n");
   try {
     const result = await api.installApply(planReq);
@@ -416,21 +458,7 @@ export async function runInstall(argv: string[] = []): Promise<void> {
     }
   } catch (err) {
     const msg = (err as Error).message;
-    if (msg.includes("apply_disabled")) {
-      process.stderr.write(
-        "\ninstall apply is disabled on this daemon.\n" +
-          "restart the daemon with -e AGENTLOCK_ALLOW_APPLY=1 added.\n" +
-          "see https://openagentlock.github.io/OpenAgentLock/guide/daemon-flags/\n",
-      );
-    } else if (msg.includes("unsafe_target")) {
-      process.stderr.write(
-        "\ndaemon refused to write to a path under real ~/.claude, ~/.codex, or ~/.cursor.\n" +
-          "use --config-dir ./dev/.claude (or ./dev/.codex, ./dev/.cursor) for dev runs, or set\n" +
-          "AGENTLOCK_ALLOW_APPLY_REAL_HOME=1 on the daemon for real installs.\n",
-      );
-    } else {
-      process.stderr.write(`\napply failed: ${msg}\n`);
-    }
+    process.stderr.write(`\napply failed: ${msg}\n`);
     process.exitCode = 2;
     return;
   }

cli/src/util/api.ts

@@ -21,12 +21,16 @@ export interface ApiClient {
   installCapabilities(): Promise<InstallCapabilitiesResponse>;
   installPlan(req: InstallPlanRequest): Promise<InstallPlanResponse>;
   installApply(req: InstallPlanRequest): Promise<InstallApplyResponse>;
-  installUninstall(sessionId: string): Promise<InstallUninstallResponse>;
+  installUninstall(req: {
+    session_id: string;
+    existing_files?: Record<string, string>;
+  }): Promise<InstallUninstallResponse>;
   installUninstallHarnesses(req: {
     session_id: string;
     harnesses: string[];
     config_dir_override?: string;
     harness_config_dirs?: Record<string, string>;
+    existing_files?: Record<string, string>;
   }): Promise<InstallUninstallResponse>;
   listSessions(): Promise<SessionsListResponse>;
   getMode(): Promise<ModeResponse>;
@@ -112,11 +116,15 @@ export interface InstallPlanRequest {
   // makes the install flow honest under Docker, where the daemon's HOME
   // is /home/nonroot but the user expects writes under their real home.
   harness_config_dirs?: Record<string, string>;
+  // Existing host file contents the daemon needs to merge against when
+  // computing ops. Keys are absolute paths; missing keys mean "file does
+  // not exist." The CLI populates this for ~/.claude/settings.json,
+  // ~/.codex/hooks.json, ~/.codex/config.toml, and ~/.cursor/hooks.json
+  // so the daemon never has to read host paths itself.
+  existing_files?: Record<string, string>;
 }
 
 export interface InstallCapabilitiesResponse {
-  apply_enabled: boolean;
-  real_home_allowed: boolean;
   unattested_allowed: boolean;
   container: boolean;
 }
@@ -151,6 +159,10 @@ export interface InstallUninstallOp {
   op: string;
   path: string;
   entries_removed: number;
+  // Post-strip file contents the CLI should write back to `path`.
+  // Empty when the file had no agentlock entries (the CLI then leaves
+  // the file untouched).
+  content?: string;
   error?: string;
 }
 
@@ -420,11 +432,14 @@ export function apiClient(baseUrl?: string, initialToken?: string | null): ApiCl
       return (await res.json()) as InstallApplyResponse;
     },
 
-    async installUninstall(sessionId: string): Promise<InstallUninstallResponse> {
+    async installUninstall(req: {
+      session_id: string;
+      existing_files?: Record<string, string>;
+    }): Promise<InstallUninstallResponse> {
       const res = await fetch(`${url}/v1/install/uninstall`, {
         method: "POST",
         headers: { "Content-Type": "application/json", ...authHeaders() },
-        body: JSON.stringify({ session_id: sessionId }),
+        body: JSON.stringify(req),
       });
       if (!res.ok && res.status !== 207) {
         const body = await res.text();
@@ -440,6 +455,7 @@ export function apiClient(baseUrl?: string, initialToken?: string | null): ApiCl
       harnesses: string[];
       config_dir_override?: string;
       harness_config_dirs?: Record<string, string>;
+      existing_files?: Record<string, string>;
     }): Promise<InstallUninstallResponse> {
       const res = await fetch(`${url}/v1/install/uninstall-harnesses`, {
         method: "POST",