@burtson-labs/bandit-stealth-cli 1.7.445 → 1.7.449
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +112 -111
- package/dist/cli.js +2159 -2116
- package/package.json +3 -3
package/README.md
CHANGED
|
@@ -10,7 +10,7 @@
|
|
|
10
10
|
|
|
11
11
|
Your code never leaves your machine. Works with any Ollama model.
|
|
12
12
|
|
|
13
|
-
|
|
13
|
+
_Prefer an IDE?_ The sibling Bandit Stealth extension for VS Code / Cursor ships the same runtime, skills, and tool-use loop — install from the [VS Code Marketplace](https://marketplace.visualstudio.com/items?itemName=BurtsonLabs.bandit-stealth) or [Open VSX](https://open-vsx.org/extension/BurtsonLabs/bandit-stealth).
|
|
14
14
|
|
|
15
15
|
[](https://www.npmjs.com/package/@burtson-labs/bandit-stealth-cli)
|
|
16
16
|
[](https://nodejs.org)
|
|
@@ -61,7 +61,7 @@ That's it. No API keys. No cloud services. The agent reads your code, searches,
|
|
|
61
61
|
- **`find_directory`** — cross-repo discovery; ask "open the auth-api repo" and the agent sweeps `~/Documents/GitHub`, `~/GitHub`, `~/Projects`, `~/code`, `~/dev`, `~/repos`, `~/work`, `~/src`, plus the workspace parent — no "where is that repo?" round-trips
|
|
62
62
|
- **MCP both directions** — speaks the Model Context Protocol as a client (`/mcp add github <token>`, `/mcp add slack`, `/mcp add gitlab`, `/mcp add custom <name> <cmd…>`) and as a server (`bandit mcp serve` exposes Bandit's native tool surface over stdio so Claude Desktop / Cursor / Cline / Continue can drive your codebase through it)
|
|
63
63
|
- **Installs CLIs on demand** — ask Bandit to install `ripgrep`, `httpie`, the GitHub CLI, etc. and it picks the right package manager (`brew`, `npm install -g`, `pip install`, `cargo install`, `gem install`, `go install`) and runs it through the permission gate
|
|
64
|
-
- **Interactive scaffolders work** — `create-vite`, `create-react-app`, `ng new`, etc. detect a non-TTY stdin and self-abort. Bandit recognizes the pattern and surfaces a clear
|
|
64
|
+
- **Interactive scaffolders work** — `create-vite`, `create-react-app`, `ng new`, etc. detect a non-TTY stdin and self-abort. Bandit recognizes the pattern and surfaces a clear _"run this with `!`"_ recovery hint so the model doesn't loop on a "command appeared to succeed" misread
|
|
65
65
|
- **Live command output** — `npm install`, `pip install`, `watch_command npm run dev` stream their output to your terminal as it arrives, dimmed, while the spinner keeps animating. No more wondering if a 20-second install is hung
|
|
66
66
|
- **Interrupt + queue** — press **Esc** mid-turn to cancel the agent and clear your queue. Type a follow-up + Enter to queue it (`queued: N · sends after this turn` in the status row). The next turn picks it up automatically
|
|
67
67
|
- **Opt-in notifications** — `/notify on` enables desktop notifications for approvals, failures, background-task completion, and long turns; `/notify sound on` adds a terminal bell
|
|
@@ -75,7 +75,7 @@ That's it. No API keys. No cloud services. The agent reads your code, searches,
|
|
|
75
75
|
- **Project memory** — drop a `BANDIT.md` or `CLAUDE.md` at your workspace root and it's auto-loaded into the system prompt
|
|
76
76
|
- **File + image mentions** — `@path` auto-inlines files; images are either sent multimodally or OCR'd locally (Apple Vision / tesseract)
|
|
77
77
|
- **Clipboard paste** — `Ctrl+V` in the REPL pastes an image straight from your clipboard
|
|
78
|
-
- **Hooks + security guard** — `PreToolUse` / `PostToolUse` / `Stop` shell hooks (global `~/.bandit/settings.json` or per-workspace), plus
|
|
78
|
+
- **Hooks + security guard** — `PreToolUse` / `PostToolUse` / `Stop` shell hooks (global `~/.bandit/settings.json` or per-workspace), plus a default-on built-in guard that blocks catastrophic commands. See [Settings file](#settings-file--hooks-permissions-security-guard)
|
|
79
79
|
- **12 themes** — Stealth Light/Dark, Midnight, Onyx, Charcoal, Dracula, Nord, Tokyo Night, Solarized Dark/Light, Catppuccin Mocha, Sepia. `/theme` to pick
|
|
80
80
|
- **Cross-platform** — macOS, Linux, Windows; Windows `.cmd`/`.bat` shims (npm/npx/pnpm/tsc) resolved correctly
|
|
81
81
|
- **Update-aware** — fire-and-forget npm-registry check at boot; `update vX.Y.Z available` shows in the status bar when a newer CLI is published
|
|
@@ -86,37 +86,37 @@ That's it. No API keys. No cloud services. The agent reads your code, searches,
|
|
|
86
86
|
|
|
87
87
|
Type `?` on an empty prompt for the at-a-glance overlay; `/help` for the full list.
|
|
88
88
|
|
|
89
|
-
| Command
|
|
90
|
-
|
|
91
|
-
| `/help`
|
|
92
|
-
| `/doctor`
|
|
93
|
-
| `/login <key>`
|
|
94
|
-
| `/usage`
|
|
95
|
-
| `/model [name]`
|
|
96
|
-
| `/ollama [url]`
|
|
97
|
-
| `/think on`, `/think off`, `/think auto`
|
|
98
|
-
| `/profile [model]`
|
|
99
|
-
| `/notify status`
|
|
100
|
-
| `/theme [name]`
|
|
101
|
-
| `/skills`
|
|
102
|
-
| `/session list`, `/session resume <id>`, `/session new` | Manage sessions
|
|
103
|
-
| `/memory`
|
|
104
|
-
| `/config`
|
|
105
|
-
| `/clear`
|
|
106
|
-
| `/compact`
|
|
107
|
-
| `/rewind [id]`
|
|
108
|
-
| `/trace`, `/trace list`, `/trace failed`, `/trace <id>` | Inspect turn traces from workspace/global `.bandit/turns`
|
|
109
|
-
| `/tasks`
|
|
110
|
-
| `/plan <goal>`
|
|
111
|
-
| `/init`
|
|
112
|
-
| `/commit`
|
|
113
|
-
| `/review [focus]`
|
|
114
|
-
| `/refactor <target>`
|
|
115
|
-
| `/test <target>`
|
|
116
|
-
| `/explain <target>`
|
|
117
|
-
| `/onboard`
|
|
118
|
-
| `/changelog [range]`
|
|
119
|
-
| `/exit`
|
|
89
|
+
| Command | Does |
|
|
90
|
+
| ------------------------------------------------------- | ----------------------------------------------------------------------------------------------------- |
|
|
91
|
+
| `/help` | Full slash-command list |
|
|
92
|
+
| `/doctor` | Check setup, provider, workspace context, permissions, and next best actions |
|
|
93
|
+
| `/login <key>` | Save a Bandit Cloud API key to `~/.bandit/config.json` (also `/login`, `/login clear`) |
|
|
94
|
+
| `/usage` | Bandit Cloud session + weekly usage limits (`/usage check` for one-line ⚠ flag) |
|
|
95
|
+
| `/model [name]` | Switch model mid-session |
|
|
96
|
+
| `/ollama [url]` | Show or set the Ollama endpoint — `/ollama default` resets to `http://localhost:11434` |
|
|
97
|
+
| `/think on`, `/think off`, `/think auto` | Override per-model thinking-mode default |
|
|
98
|
+
| `/profile [model]` | Show the active model behavior profile (tool protocol, fallback, context budget, known failure modes) |
|
|
99
|
+
| `/notify status` | Configure desktop/bell notifications for approvals, failures, background tasks, and long turns |
|
|
100
|
+
| `/theme [name]` | Pick a color palette (`/theme` lists; saved to global config) |
|
|
101
|
+
| `/skills` | List loaded skills |
|
|
102
|
+
| `/session list`, `/session resume <id>`, `/session new` | Manage sessions |
|
|
103
|
+
| `/memory` | Show auto-loaded `BANDIT.md` / `CLAUDE.md` |
|
|
104
|
+
| `/config` | Show effective config + path (secrets redacted) |
|
|
105
|
+
| `/clear` | Reset conversation (keeps session id) |
|
|
106
|
+
| `/compact` | Trim old tool results to fit the context window |
|
|
107
|
+
| `/rewind [id]` | Restore a file from a per-edit checkpoint |
|
|
108
|
+
| `/trace`, `/trace list`, `/trace failed`, `/trace <id>` | Inspect turn traces from workspace/global `.bandit/turns` |
|
|
109
|
+
| `/tasks` | List background subagent tasks (`/tasks <id>` drill-down, `/tasks cancel <id>`) |
|
|
110
|
+
| `/plan <goal>` | Heuristic plan first, y/N to execute |
|
|
111
|
+
| `/init` | Scaffold `BANDIT.md` from a repo scan |
|
|
112
|
+
| `/commit` | Draft a conventional-commit message from the staged diff |
|
|
113
|
+
| `/review [focus]` | Code review of staged changes or branch-vs-main, ends with 🟢/🟡/🔴 |
|
|
114
|
+
| `/refactor <target>` | Concrete refactor suggestions with before/after snippets |
|
|
115
|
+
| `/test <target>` | Generate tests in the project's existing framework |
|
|
116
|
+
| `/explain <target>` | Plain-English walkthrough of a file or function |
|
|
117
|
+
| `/onboard` | New-developer setup checklist for the repo |
|
|
118
|
+
| `/changelog [range]` | Release notes drafted from `git log` |
|
|
119
|
+
| `/exit` | Quit |
|
|
120
120
|
|
|
121
121
|
---
|
|
122
122
|
|
|
@@ -124,20 +124,20 @@ Type `?` on an empty prompt for the at-a-glance overlay; `/help` for the full li
|
|
|
124
124
|
|
|
125
125
|
The agent activates specialized skills based on your prompt:
|
|
126
126
|
|
|
127
|
-
| Skill
|
|
128
|
-
|
|
129
|
-
| Filesystem
|
|
130
|
-
| Git
|
|
131
|
-
| Code Review
|
|
132
|
-
| Testing
|
|
133
|
-
| Planning
|
|
134
|
-
| Semantic Search | "how is auth implemented"
|
|
127
|
+
| Skill | Trigger | What it does |
|
|
128
|
+
| --------------- | -------------------------- | --------------------------------------- |
|
|
129
|
+
| Filesystem | always | Read, write, search, list, run commands |
|
|
130
|
+
| Git | always | Status, diff, log, commit |
|
|
131
|
+
| Code Review | "review my changes" | Diff + full file context |
|
|
132
|
+
| Testing | "write tests" | Auto-detect runner, generate tests |
|
|
133
|
+
| Planning | "refactor the auth system" | Structured multi-step decomposition |
|
|
134
|
+
| Semantic Search | "how is auth implemented" | Local embedding search |
|
|
135
135
|
|
|
136
136
|
### Custom skills (the agent can make its own)
|
|
137
137
|
|
|
138
|
-
Ask:
|
|
138
|
+
Ask: _"create a skill that runs my linter"_
|
|
139
139
|
|
|
140
|
-
The agent writes `.bandit/skills/linter.md`. Next prompt, it's live. Ask
|
|
140
|
+
The agent writes `.bandit/skills/linter.md`. Next prompt, it's live. Ask _"lint my code"_ and it runs.
|
|
141
141
|
|
|
142
142
|
---
|
|
143
143
|
|
|
@@ -152,26 +152,26 @@ Bandit speaks MCP as a client, so any MCP server you can spawn (filesystem, git,
|
|
|
152
152
|
"mcpServers": {
|
|
153
153
|
"fs-tmp": {
|
|
154
154
|
"command": "npx",
|
|
155
|
-
"args": ["-y", "@modelcontextprotocol/server-filesystem", "/tmp"]
|
|
155
|
+
"args": ["-y", "@modelcontextprotocol/server-filesystem", "/tmp"],
|
|
156
156
|
},
|
|
157
157
|
"github": {
|
|
158
158
|
"command": "npx",
|
|
159
159
|
"args": ["-y", "@modelcontextprotocol/server-github"],
|
|
160
|
-
"env": { "GITHUB_PERSONAL_ACCESS_TOKEN": "ghp_..." }
|
|
161
|
-
}
|
|
162
|
-
}
|
|
160
|
+
"env": { "GITHUB_PERSONAL_ACCESS_TOKEN": "ghp_..." },
|
|
161
|
+
},
|
|
162
|
+
},
|
|
163
163
|
}
|
|
164
164
|
```
|
|
165
165
|
|
|
166
166
|
**Manage** with the `/mcp` slash command:
|
|
167
167
|
|
|
168
|
-
| Command
|
|
169
|
-
|
|
170
|
-
| `/mcp`
|
|
171
|
-
| `/mcp tools <name>`
|
|
172
|
-
| `/mcp connect <name>`
|
|
173
|
-
| `/mcp disconnect <name>` | Close the server's child process (re-spawns lazily on next use)
|
|
174
|
-
| `/mcp reload`
|
|
168
|
+
| Command | What it does |
|
|
169
|
+
| ------------------------ | --------------------------------------------------------------------------- |
|
|
170
|
+
| `/mcp` | List configured servers + status (connected / idle / error) and tool counts |
|
|
171
|
+
| `/mcp tools <name>` | Spawn the server (lazy) and introspect its exposed tools |
|
|
172
|
+
| `/mcp connect <name>` | Explicit warmup so the first invocation isn't slow |
|
|
173
|
+
| `/mcp disconnect <name>` | Close the server's child process (re-spawns lazily on next use) |
|
|
174
|
+
| `/mcp reload` | Re-read the config files from disk after edits — no restart needed |
|
|
175
175
|
|
|
176
176
|
Servers spawn lazily on first invocation, persist for the session, and get cleaned up on REPL exit. Failures are isolated — a broken server logs an error and the rest of the loop keeps running on native tools only. Off by default — no config file = zero behavior change.
|
|
177
177
|
|
|
@@ -181,16 +181,16 @@ Servers spawn lazily on first invocation, persist for the session, and get clean
|
|
|
181
181
|
|
|
182
182
|
Pull one with `ollama pull <model>`. Bandit auto-detects each model's capabilities and takes the native tool-calling path when supported.
|
|
183
183
|
|
|
184
|
-
| Model
|
|
185
|
-
|
|
186
|
-
| `bandit-logic` (cloud)
|
|
187
|
-
| `qwen3.6:27b`
|
|
188
|
-
| `gemma4:26b`
|
|
189
|
-
| `gemma4:e4b`
|
|
190
|
-
| `gemma4:31b`
|
|
191
|
-
| `qwen2.5-coder:7b`
|
|
192
|
-
| `devstral:latest`
|
|
193
|
-
| `bandit-core-1` (cloud) | Bandit gateway (API key)
|
|
184
|
+
| Model | Where | Notes |
|
|
185
|
+
| ----------------------- | ----------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
|
|
186
|
+
| `bandit-logic` (cloud) | Bandit gateway (API key) | **Default for cloud.** Agent-tuned wrapper around Qwen 3.6 27B with thinking mode. Best reliability on multi-step agent tasks — what we recommend trying first. |
|
|
187
|
+
| `qwen3.6:27b` | Local / Mac 48GB+, high-VRAM GPU (~17 GB) | **Best local pick.** Same family as `bandit-logic`, runs offline. Probes the filesystem instead of asking for clarification — real agent behavior. |
|
|
188
|
+
| `gemma4:26b` | Local / Mac 32GB+ (~17 GB) | Solid alternative when Qwen 3.6 is too heavy for your hardware. Multimodal, 128K context. |
|
|
189
|
+
| `gemma4:e4b` | Local / laptop-class (~3 GB) | Lightweight pick that punches above its weight. Validated on real Bandit runs — clean tool sequencing (`ls` → narrow → `read_file`), no hallucinated paths. Right pick when you want a local agent that doesn't pin your fans. |
|
|
190
|
+
| `gemma4:31b` | Local / Mac 64GB+, GPU node | Bigger context, better reasoning for complex refactors. |
|
|
191
|
+
| `qwen2.5-coder:7b` | Local / Mac (~4.7 GB) | Fast lightweight pick. Native tool calling. Best for "given context, do X" tasks rather than autonomous discovery. |
|
|
192
|
+
| `devstral:latest` | Local / Mac 32GB+ | Mistral's agent-tuned model — strong tool use. |
|
|
193
|
+
| `bandit-core-1` (cloud) | Bandit gateway (API key) | Lightweight cloud option. Faster first-token than `bandit-logic`, less reliable on multi-step agent tasks. |
|
|
194
194
|
|
|
195
195
|
### Models we don't recommend (for agent work)
|
|
196
196
|
|
|
@@ -220,9 +220,9 @@ Workspace overrides load from `.bandit/model-profiles.json`:
|
|
|
220
220
|
"protocol": { "preferred": "text-tools", "fallback": null, "envelope": "xml-json" },
|
|
221
221
|
"context": { "safeInputTokens": 12000, "outputBudgetTokens": 2048, "compaction": "early" },
|
|
222
222
|
"prompting": { "template": "qwen-agent", "examples": "strict", "thinking": "off" },
|
|
223
|
-
"reliability": { "maxParallelTools": 1, "knownFailureModes": ["custom parser drift"] }
|
|
224
|
-
}
|
|
225
|
-
}
|
|
223
|
+
"reliability": { "maxParallelTools": 1, "knownFailureModes": ["custom parser drift"] },
|
|
224
|
+
},
|
|
225
|
+
},
|
|
226
226
|
}
|
|
227
227
|
```
|
|
228
228
|
|
|
@@ -238,16 +238,16 @@ Any Ollama model works — capabilities auto-detect via `/api/show`.
|
|
|
238
238
|
|
|
239
239
|
```jsonc
|
|
240
240
|
{
|
|
241
|
-
"provider": "ollama",
|
|
241
|
+
"provider": "ollama", // or "bandit"
|
|
242
242
|
"model": "qwen2.5-coder:7b",
|
|
243
243
|
"ollama": {
|
|
244
244
|
"url": "http://localhost:11434",
|
|
245
|
-
"headers": { "Authorization": "Bearer ..." }
|
|
245
|
+
"headers": { "Authorization": "Bearer ..." }, // optional
|
|
246
246
|
},
|
|
247
247
|
"bandit": {
|
|
248
248
|
"apiKey": "bnd_...",
|
|
249
|
-
"apiUrl": "https://api.burtson.ai"
|
|
250
|
-
}
|
|
249
|
+
"apiUrl": "https://api.burtson.ai",
|
|
250
|
+
},
|
|
251
251
|
}
|
|
252
252
|
```
|
|
253
253
|
|
|
@@ -255,20 +255,20 @@ Workspace config overrides user config. Secrets belong in the user-level file, n
|
|
|
255
255
|
|
|
256
256
|
### Environment variables
|
|
257
257
|
|
|
258
|
-
| Var
|
|
259
|
-
|
|
260
|
-
| `BANDIT_PROVIDER`
|
|
261
|
-
| `BANDIT_MODEL`
|
|
262
|
-
| `BANDIT_API_KEY`
|
|
263
|
-
| `BANDIT_API_URL`
|
|
264
|
-
| `OLLAMA_URL`
|
|
265
|
-
| `BANDIT_MAX_ITERATIONS` | `20`
|
|
266
|
-
| `BANDIT_AUTO_APPROVE`
|
|
267
|
-
| `BANDIT_TELEMETRY`
|
|
268
|
-
| `BANDIT_OTLP_ENDPOINT`
|
|
269
|
-
| `BANDIT_OTLP_TOKEN`
|
|
270
|
-
| `BANDIT_OTLP_MODE`
|
|
271
|
-
| `NO_COLOR`
|
|
258
|
+
| Var | Default | Description |
|
|
259
|
+
| ----------------------- | ------------------------- | -------------------------------------------------------------- |
|
|
260
|
+
| `BANDIT_PROVIDER` | `ollama` | `ollama` or `bandit` |
|
|
261
|
+
| `BANDIT_MODEL` | `gemma4:e4b` | Model ID |
|
|
262
|
+
| `BANDIT_API_KEY` | — | Required when `BANDIT_PROVIDER=bandit` |
|
|
263
|
+
| `BANDIT_API_URL` | `https://api.burtson.ai` | Override Bandit API endpoint |
|
|
264
|
+
| `OLLAMA_URL` | `http://localhost:11434` | Ollama endpoint |
|
|
265
|
+
| `BANDIT_MAX_ITERATIONS` | `20` | Tool-use loop cap |
|
|
266
|
+
| `BANDIT_AUTO_APPROVE` | `0` | `1`/`true` to skip write-approval prompts |
|
|
267
|
+
| `BANDIT_TELEMETRY` | `0` | `1`/`true` to enable OTLP telemetry (opt-in) |
|
|
268
|
+
| `BANDIT_OTLP_ENDPOINT` | `https://otlp.burtson.ai` | OTLP/HTTP collector base URL |
|
|
269
|
+
| `BANDIT_OTLP_TOKEN` | — | Bearer token for the collector (defaults to your Bandit token) |
|
|
270
|
+
| `BANDIT_OTLP_MODE` | `metrics+traces` | `metrics-only` to drop span payloads |
|
|
271
|
+
| `NO_COLOR` | — | Disable ANSI colors |
|
|
272
272
|
|
|
273
273
|
### Settings file — hooks, permissions, security guard
|
|
274
274
|
|
|
@@ -279,45 +279,45 @@ Separate from `config.json`, a **settings** file controls what the agent is allo
|
|
|
279
279
|
|
|
280
280
|
```jsonc
|
|
281
281
|
{
|
|
282
|
-
// Built-in pre-tool security guard.
|
|
282
|
+
// Built-in pre-tool security guard. ON by default. Blocks the
|
|
283
283
|
// handful of tool calls that are almost never legitimate, BEFORE they run —
|
|
284
284
|
// a safety net against the model footgunning (e.g. a hallucinated rm -rf /).
|
|
285
285
|
"security": {
|
|
286
286
|
"guard": {
|
|
287
287
|
"enabled": true,
|
|
288
|
-
"blockCommands": ["npm\\s+publish"],
|
|
289
|
-
"protectPaths": ["/data/prod"]
|
|
290
|
-
}
|
|
288
|
+
"blockCommands": ["npm\\s+publish"], // optional: extra regex patterns to block
|
|
289
|
+
"protectPaths": ["/data/prod"], // optional: extra write-protected path prefixes
|
|
290
|
+
},
|
|
291
291
|
},
|
|
292
292
|
|
|
293
293
|
// Your own shell hooks around the tool loop. A non-zero exit from a
|
|
294
294
|
// PreToolUse hook BLOCKS the tool call. Placeholders: {{name}}, {{primary}},
|
|
295
295
|
// {{duration}} (PostToolUse only).
|
|
296
296
|
"hooks": {
|
|
297
|
-
"PreToolUse":
|
|
298
|
-
"PostToolUse": [{ "match": ".*",
|
|
299
|
-
"Stop":
|
|
297
|
+
"PreToolUse": [{ "match": "write_file", "command": "./scripts/guard.sh {{name}}" }],
|
|
298
|
+
"PostToolUse": [{ "match": ".*", "command": "echo {{name}} took {{duration}}ms" }],
|
|
299
|
+
"Stop": [{ "command": "./scripts/notify-done.sh" }],
|
|
300
300
|
},
|
|
301
301
|
|
|
302
302
|
// Per-tool permission policy (deny > allow > ask > built-in defaults).
|
|
303
|
-
"permissions": { "allow": ["run_command:git *"], "deny": [], "ask": ["run_command"] }
|
|
303
|
+
"permissions": { "allow": ["run_command:git *"], "deny": [], "ask": ["run_command"] },
|
|
304
304
|
}
|
|
305
305
|
```
|
|
306
306
|
|
|
307
307
|
**What the guard blocks when enabled** (high-confidence patterns only, so false positives stay rare):
|
|
308
308
|
catastrophic `rm -rf /` · `~` · `/*` · a remote script piped to a shell (`curl … | sh`) · raw disk writes (`dd of=/dev/sda`, `mkfs`) · fork bombs · recursive `chmod`/`chown` on `/` · writes or redirects into system/credential paths (`/etc`, `~/.ssh`, `~/.aws`, …) · reading a credential file **and** sending it over the network in one command.
|
|
309
309
|
|
|
310
|
-
The guard is **defense-in-depth against the model**, not a sandbox and not protection against a malicious user (who controls this file). It runs **before** your hooks and the approval gate, and behaves identically in the CLI and the IDE extension.
|
|
310
|
+
The guard is **defense-in-depth against the model**, not a sandbox and not protection against a malicious user (who controls this file). It is enabled by default; set `security.guard.enabled` to `false` only in a controlled environment. It runs **before** your hooks and the approval gate, and behaves identically in the CLI and the IDE extension.
|
|
311
311
|
|
|
312
312
|
#### Hooks — any scripted step, not just guardrails
|
|
313
313
|
|
|
314
314
|
Hooks run **your own commands** at three points in the loop. Only `PreToolUse` is a gate; the rest are fire-and-forget side effects — so reach for them for version bumps, formatters, notifications, CI triggers, anything scriptable.
|
|
315
315
|
|
|
316
|
-
| Event
|
|
317
|
-
|
|
318
|
-
| `PreToolUse`
|
|
319
|
-
| `PostToolUse` | after a tool finishes | No — runs for its side effect
|
|
320
|
-
| `Stop`
|
|
316
|
+
| Event | Fires | Blocks the tool? |
|
|
317
|
+
| ------------- | --------------------- | ---------------------------------------------------------------------- |
|
|
318
|
+
| `PreToolUse` | before a tool runs | **Yes** — a non-zero exit aborts the call (this is the guardrail path) |
|
|
319
|
+
| `PostToolUse` | after a tool finishes | No — runs for its side effect |
|
|
320
|
+
| `Stop` | when the turn ends | No |
|
|
321
321
|
|
|
322
322
|
Each rule is `{ "match": "<regex on tool name — omit to match all>", "command": "<shell>", "timeout": 10000 }`. Placeholders are substituted into `command` (shell-escaped): **`{{name}}`** (tool name), **`{{primary}}`** (first arg — path / cmd / pattern / url), **`{{duration}}`** (ms, `PostToolUse` only).
|
|
323
323
|
|
|
@@ -346,10 +346,10 @@ Off by default. When enabled, Bandit emits **OpenTelemetry** over OTLP/HTTP: one
|
|
|
346
346
|
{
|
|
347
347
|
"telemetry": {
|
|
348
348
|
"enabled": true,
|
|
349
|
-
"endpoint": "https://otel.your-company.com",
|
|
350
|
-
"mode": "metrics+traces",
|
|
351
|
-
"headers": { "Authorization": "Bearer ..." }
|
|
352
|
-
}
|
|
349
|
+
"endpoint": "https://otel.your-company.com", // YOUR OTLP collector (otlp.burtson.ai = Bandit Cloud only)
|
|
350
|
+
"mode": "metrics+traces", // or "metrics-only" for stricter privacy
|
|
351
|
+
"headers": { "Authorization": "Bearer ..." }, // your collector's auth (defaults to your Bandit token)
|
|
352
|
+
},
|
|
353
353
|
}
|
|
354
354
|
```
|
|
355
355
|
|
|
@@ -391,11 +391,11 @@ Tear the pod down when you're done. ~$2/hr for an H100 SXM × 15-20 min agent se
|
|
|
391
391
|
|
|
392
392
|
**Recommended models for rented GPU:**
|
|
393
393
|
|
|
394
|
-
| Model
|
|
395
|
-
|
|
396
|
-
| `qwen3.6:27b`
|
|
397
|
-
| `qwen2.5-coder:32b` | ~20 GB | Code-specialist post-train. Strongest on file edits and refactors.
|
|
398
|
-
| `qwen3.6:35b`
|
|
394
|
+
| Model | Size | What it's good at |
|
|
395
|
+
| ------------------- | ------ | --------------------------------------------------------------------------------------------------- |
|
|
396
|
+
| `qwen3.6:27b` | ~17 GB | Same model as `bandit-logic`. Native tool calling, vision, 256K context. Best general-purpose pick. |
|
|
397
|
+
| `qwen2.5-coder:32b` | ~20 GB | Code-specialist post-train. Strongest on file edits and refactors. |
|
|
398
|
+
| `qwen3.6:35b` | ~24 GB | Bigger Qwen 3.6 variant — slower, marginally better reasoning. |
|
|
399
399
|
|
|
400
400
|
**Avoid for agent work:** `gpt-oss:120b` and similar reasoning-tuned models. They're post-trained for OpenAI's harmony tool-call format, not the XML protocol Bandit uses for non-native models — they tend to narrate intent without emitting tool calls. Great for math/proofs in chat, poor for filesystem agent loops.
|
|
401
401
|
|
|
@@ -406,7 +406,8 @@ Tear the pod down when you're done. ~$2/hr for an H100 SXM × 15-20 min agent se
|
|
|
406
406
|
- **Local-first by default** — with `provider=ollama`, nothing leaves your machine.
|
|
407
407
|
- **Approval gate** — all file writes show a unified diff before touching disk (unless `BANDIT_AUTO_APPROVE=1`).
|
|
408
408
|
- **Command allowlist** — `run_command` only executes from an internal allowlist (git, gh, kubectl, helm, brew, standard *nix tools). Arbitrary shell is refused.
|
|
409
|
-
- **
|
|
409
|
+
- **Container sandbox (opt-in)** — `bandit --sandbox` or `BANDIT_SANDBOX=1` runs every agent `run_command` / `watch_command` inside a short-lived Docker or Podman container with the same policy as the Stealth IDE: one workspace mount, no network, no Linux capabilities, read-only root, `no-new-privileges`, bounded CPU/memory/pids/output/time, your uid:gid. Fail-closed once enabled — no runtime means the command is refused, never quietly run on the host. Image: `ghcr.io/burtson-labs/stealth-sandbox` (node, git, ripgrep, python3, C toolchain); override with `BANDIT_SANDBOX_IMAGE`. Enterprise-managed installs should set `BANDIT_SANDBOX=1` in the environment.
|
|
410
|
+
- **Pre-tool security guard** (default-on) — configure `security.guard` in your [settings file](#settings-file--hooks-permissions-security-guard) to extend or explicitly disable blocking of catastrophic commands (`rm -rf /`, `curl … | sh`, disk wipes, credential exfil, writes to `/etc` or `~/.ssh`) before they run. Defense-in-depth against the model, applied in both CLI and IDE.
|
|
410
411
|
- **Custom hooks** — your own `PreToolUse` shell scripts can veto any tool call; configure globally (`~/.bandit/settings.json`) or per-project.
|
|
411
412
|
- **Secret hygiene** — API keys are redacted in `/config` output and never logged. The optional [telemetry](#telemetry-opt-in) exporter never sends prompt/response text and redacts metadata.
|
|
412
413
|
- **Local sessions** — stored as JSONL under `~/.bandit/sessions/`. Inspect at any time.
|
|
@@ -438,4 +439,4 @@ Tear the pod down when you're done. ~$2/hr for an H100 SXM × 15-20 min agent se
|
|
|
438
439
|
- Issues, feature requests, and questions: [team@burtson.ai](mailto:team@burtson.ai)
|
|
439
440
|
- More from Burtson Labs: [burtson.ai](https://burtson.ai)
|
|
440
441
|
|
|
441
|
-
|
|
442
|
+
_Bandit CLI is built by [Burtson Labs](https://burtson.ai). Source for the runtime packages is currently private — open source release planned._
|