harshaAI / Alpha CLI
IntentGuard
A staged command-review pipeline combining shell rules, a lightweight classifier, BM25-ranked history, and LiteLLM before an allow, warn, or block decision.
View repository01 / COMPONENTS & DATA FLOW
Inside the system.
- 01Command + user
- 02Rules + classifier
- 03BM25 history + LLM
- 04Risk → execution decision
Local interception
A Typer CLI submits the command and user context to a local review API. Warn decisions require the literal CONFIRM response; block decisions exit before execution.
Layered analysis
The engine short-circuits rules above 0.9 risk, then combines classifier risk, a history anomaly signal, and an LLM assessment. BM25 selects five relevant actions from up to 100 recent records filtered by user.
Recorded decisions
SQLite stores commands, timestamps, risk scores, decisions, user confirmation, intent, and serialized context for the next review.
02 / IMPLEMENTATION DECISIONS
Why it works this way.
Critical signals survive averaging
The scoring function preserves the highest individual rule, classifier, or LLM risk when it exceeds 0.8. Decision thresholds are greater than 0.7 for block and greater than 0.4 for warn.
Context stays bounded
History retrieval uses shell-tokenized commands and BM25 rather than appending the entire command log to every LLM call. LLM contribution scales with its reported confidence.
03 / SCOPE & TRADEOFFS
The implementation boundary.
This is an alpha review tool. The current interceptor allows execution if its local API is unreachable or times out, so it is an advisory layer rather than a mandatory security boundary.
04 / READ THE IMPLEMENTATION