Skip to main content

Fork Around & Find Out

Your agent next action happens in a parallel universe first.

A fail-closed decision gateway for agent tool-calls · TypeScript · built solo at Daytona HackSprint #5.

The problem

Autonomous agents are getting write access to real systems: shells, repos, cloud accounts, payment APIs. The moment an agent can act, one bad tool-call is irreversible. A prompt injection, a hallucinated rm -rf, a secret quietly POSTed to a pastebin. Text-based guardrails try to guess whether an action is dangerous by reading it.

It does not guess. The agent proposes an action, and instead of running it for real, the gateway runs it inside a disposable Daytona sandbox seeded with a representative workspace. It then measures the exact blast radius: files created, modified, and deleted, network egress, and whether the action read a seeded honeytoken, which is caught even when the secret leaves in a request body rather than on stdout. A fail-closed policy engine turns that measurement into ALLOW, QUARANTINE, or BLOCK. Only an ALLOW is cleared to run for real. If the run cannot be measured, the action is blocked, never guessed.

Run the proof yourself

The module self-test suite needs no API keys and no account. It is the fastest way to watch the policy engine decide.

Clone and run the self-tests (No keys required):

git clone https://github.com/OrionArchitekton/fork-around-find-out.git
cd fork-around-find-out
npm install
npm test

Command surface

  • ALLOW: The measured blast radius stayed inside policy. This is the only verdict cleared to run for real.
  • QUARANTINE: The action did something the policy will not clear automatically. It dies in the throwaway world pending review.
  • BLOCK: The measurement tripped a rule outright, or the run could not be measured at all. Fail-closed by construction.

Why this is different

  • A seatbelt, not a crash test: The familiar pattern is agents that test agents, running pre-production. This is a runtime gateway: it sits in front of every action an agent takes, live, and decides per action.
  • Measured, not inferred: The verdict comes from what the action actually did in a throwaway world, not from reading the command string and guessing intent.
  • Decide-only by design: It returns a verdict measured in a disposable world. Wiring an ALLOW to the executor that runs the action for real is the host job. Making that decision safely, on evidence, before anything irreversible happens, is this job.
  • Scored, not asserted: Every run of the labeled attack suite is scored per scenario, and those rows are logged to Braintrust when a key is set, so the catch-rate is a real number rather than a claim.

Links