A Space to test what a coding-agent guardrail says about a shell command

Spaces
1

Hi all! I made a small Space where you can paste a shell command an AI coding agent might run and see what a guardrail would answer before it runs: allow, review (ask the user) or block, and which step decided it.

How it’s built, in case it’s useful to anyone doing the same:

  • It’s a ZeroGPU Gradio Space, but the model (Laya, ~322M) runs on CPU at about 0.1–0.3 s per call. ZeroGPU only needs one @spaces.GPU function to exist, so there’s one that is never called and visitors’ GPU quota isn’t touched. That’s how a free account can host a small CPU model now that CPU Basic needs PRO.
  • The page is custom HTML served by gr.Server (a FastAPI subclass): GET /, POST /api/judge. GRADIO_SSR_MODE=false is needed for the custom / route.
  • preload_from_hub pulls the model files at build time, so a woken Space doesn’t download them.
  • Input is capped (4,000 chars, 32 KB body), with 20 requests/min per visitor and 300/min overall; nothing is logged.

The guard itself is laya-guard (MIT), hooks for Claude Code, Codex, Cursor, Gemini CLI and 7 more agents: GitHub - scs0209/laya-guard: Free local guardrail for AI coding agents: every tool_call judged on-device (regex + Laya), allow/review/block · GitHub

Feedback welcome, especially commands it gets wrong.

2

A useful early test: hold what a command does fixed and vary only how it is spelled — plain, wrapped in bash -c, assembled from variables, or decoded from base64 — and require the same verdict for every spelling; the share that flips is a direct measure of whether the guard is judging the effect or the surface text. The paired opposite matters too: near-identical spellings with different effects should reliably split.

3

For the 4,000-character and 32 KB body caps on POST /api/judge, do oversized submissions get an explicit “not evaluated” response, rather than allow/review/block or a verdict on a truncated command?