@burtson-labs/bandit-stealth-cli 1.7.486 → 1.7.487

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (4) hide show
  1. package/README.md +33 -17
  2. package/TERMS.md +91 -0
  3. package/dist/cli.js +883 -872
  4. package/package.json +2 -1
package/README.md CHANGED
@@ -47,6 +47,19 @@ _Prefer an IDE?_ The sibling Bandit Stealth extension for VS Code / Cursor ships
47
47
 
48
48
  That's it. No API keys. No cloud services. The agent reads your code, searches, runs commands, and writes changes — all locally.
49
49
 
50
+ ### Terms of Use
51
+
52
+ The first time you start `bandit` in a terminal (and again whenever the terms change), it prints a short summary of the [Terms of Use](https://banditailabs.com/terms) and asks you to accept them (`[y/N]`). Your answer is saved in `~/.bandit/terms.json` as `{ "version", "acceptedAt" }`. `bandit terms` prints the URL, the current version and the version you accepted. The full text also ships in this package as `TERMS.md`.
53
+
54
+ Runs that have nobody to ask never wait for an answer: a one-shot prompt (`bandit "…"`), `bandit mcp serve`, input or output that is not a terminal, and CI (`CI` set). In those, accept for the run with the environment variable or the flag; otherwise bandit exits with status 1 and one line saying how:
55
+
56
+ ```bash
57
+ BANDIT_ACCEPT_TERMS=1 bandit "summarize the open TODOs"
58
+ bandit --accept-terms "summarize the open TODOs"
59
+ ```
60
+
61
+ The variable and the flag accept for that run only and write nothing. `--help`, `--version`, `terms`, `upgrade`, `self-update` and `doctor` never ask.
62
+
50
63
  ---
51
64
 
52
65
  ## What it does
@@ -280,23 +293,24 @@ Workspace config overrides user config. Secrets belong in the user-level file, n
280
293
 
281
294
  ### Environment variables
282
295
 
283
- | Var | Default | Description |
284
- | ------------------------ | ------------------------- | ----------------------------------------------------------------------------------------------------------- |
285
- | `BANDIT_PROVIDER` | `ollama` | `ollama` or `bandit` |
286
- | `BANDIT_MODEL` | `gemma4:e4b` | Model ID |
287
- | `BANDIT_API_KEY` | — | Required when `BANDIT_PROVIDER=bandit` |
288
- | `BANDIT_API_URL` | `https://api.burtson.ai` | Override Bandit API endpoint |
289
- | `OLLAMA_URL` | `http://localhost:11434` | Ollama endpoint |
290
- | `BANDIT_MAX_ITERATIONS` | `20` | Tool-use loop cap |
291
- | `BANDIT_AUTO_APPROVE` | `0` | `1`/`true` to skip write-approval prompts |
292
- | `BANDIT_TELEMETRY` | `0` | `1`/`true` to enable OTLP telemetry (opt-in) |
293
- | `BANDIT_OTLP_ENDPOINT` | `https://otlp.burtson.ai` | OTLP/HTTP collector base URL |
294
- | `BANDIT_OTLP_TOKEN` | — | Bearer token for the collector (defaults to your Bandit token) |
295
- | `BANDIT_OTLP_MODE` | `metrics+traces` | `metrics-only` to drop span payloads |
296
- | `BANDIT_NO_UPDATE_CHECK` | `0` | `1`/`true` to skip the npm-registry update check at start (one plain GET; nothing is installed) |
297
- | `BANDIT_NO_BROWSER` | `0` | `1`/`true` to never launch the default browser (`insights`, share links); the path or link is still printed |
298
- | `BANDIT_NO_CLIPBOARD` | `0` | `1`/`true` to leave the clipboard alone when a share link is printed |
299
- | `NO_COLOR` | — | Disable ANSI colors |
296
+ | Var | Default | Description |
297
+ | ------------------------ | ------------------------- | --------------------------------------------------------------------------------------------------------------- |
298
+ | `BANDIT_PROVIDER` | `ollama` | `ollama` or `bandit` |
299
+ | `BANDIT_MODEL` | `gemma4:e4b` | Model ID |
300
+ | `BANDIT_API_KEY` | — | Required when `BANDIT_PROVIDER=bandit` |
301
+ | `BANDIT_API_URL` | `https://api.burtson.ai` | Override Bandit API endpoint |
302
+ | `OLLAMA_URL` | `http://localhost:11434` | Ollama endpoint |
303
+ | `BANDIT_MAX_ITERATIONS` | `20` | Tool-use loop cap |
304
+ | `BANDIT_AUTO_APPROVE` | `0` | `1`/`true` to skip write-approval prompts |
305
+ | `BANDIT_TELEMETRY` | `0` | `1`/`true` to enable OTLP telemetry (opt-in) |
306
+ | `BANDIT_OTLP_ENDPOINT` | `https://otlp.burtson.ai` | OTLP/HTTP collector base URL |
307
+ | `BANDIT_OTLP_TOKEN` | — | Bearer token for the collector (defaults to your Bandit token) |
308
+ | `BANDIT_OTLP_MODE` | `metrics+traces` | `metrics-only` to drop span payloads |
309
+ | `BANDIT_NO_UPDATE_CHECK` | `0` | `1`/`true` to skip the npm-registry update check at start (one plain GET; nothing is installed) |
310
+ | `BANDIT_NO_BROWSER` | `0` | `1`/`true` to never launch the default browser (`insights`, share links); the path or link is still printed |
311
+ | `BANDIT_NO_CLIPBOARD` | `0` | `1`/`true` to leave the clipboard alone when a share link is printed |
312
+ | `BANDIT_ACCEPT_TERMS` | — | `1`/`true` to accept the [Terms of Use](#terms-of-use) for this run without a prompt (same as `--accept-terms`) |
313
+ | `NO_COLOR` | — | Disable ANSI colors |
300
314
 
301
315
  ### Settings file — hooks, permissions, security guard
302
316
 
@@ -468,6 +482,8 @@ Tear the pod down when you're done. ~$2/hr for an H100 SXM × 15-20 min agent se
468
482
 
469
483
  **Stuck approval prompt in CI** — Set `BANDIT_AUTO_APPROVE=1` to skip the diff-approval gate.
470
484
 
485
+ **"accept the Terms of Use first" in a script or CI** — Set `BANDIT_ACCEPT_TERMS=1` or pass `--accept-terms`. See [Terms of Use](#terms-of-use).
486
+
471
487
  ---
472
488
 
473
489
  ## Support
package/TERMS.md ADDED
@@ -0,0 +1,91 @@
1
+ # Bandit Stealth Terms of Use
2
+
3
+ Version 2026-10-06 · Effective date: October 6, 2026
4
+
5
+ These terms apply to the Bandit Stealth desktop IDE ("Stealth IDE"), the Bandit Stealth command-line tool ("Stealth CLI", installed as `bandit`), and the Bandit Cloud services they can connect to (together, the "Software"), as distributed by Burtson Labs LLC ("Burtson Labs", "we", "us"). By installing or using the Software you agree to these terms. If you use the Software for an organization, you confirm you are allowed to accept these terms for it, and "you" includes that organization.
6
+
7
+ ## 1. Open-source license comes first
8
+
9
+ The Software's source code is licensed under the Apache License, Version 2.0. Nothing in these terms takes away any right that license gives you. If you build the Software from source and do not use Bandit Cloud, the Apache license is the only agreement that applies to that code. These terms add the rules for our official builds and for Bandit Cloud, and they repeat, in plain language, the disclaimers the Apache license already contains.
10
+
11
+ ## 2. What the Software can do on your computer
12
+
13
+ The Software includes an AI agent. Depending on the permissions and mode you choose, it can:
14
+
15
+ - read, create, change, move and delete files;
16
+ - run commands, scripts and programs in a terminal;
17
+ - install packages and change project configuration;
18
+ - use git, including creating commits and pushing to remote repositories;
19
+ - connect to the internet, AI model providers and other services you configure;
20
+ - send your prompts, code and file contents to the model provider you select;
21
+ - use paid services (for example a model provider's API) and incur charges on your account.
22
+
23
+ AI models make mistakes. The agent can misunderstand a request, produce wrong or insecure code, act on outdated information, or take an action you did not expect. Approval prompts, permission modes, sandboxes and other safety controls reduce this risk but do not remove it.
24
+
25
+ ## 3. Your responsibilities
26
+
27
+ You are responsible for how you use the Software and for every action you approve or allow it to take. In particular:
28
+
29
+ - **Review before you rely on it.** Review generated code, commands and changes before you run, ship, deploy or depend on them.
30
+ - **Keep backups.** Use version control and keep backups of anything you cannot afford to lose. Do not run the agent with broad permissions on data or systems without a recovery path.
31
+ - **Choose permissions carefully.** Automatic-approval modes let the agent act without asking you first. Use them only where you accept that risk.
32
+ - **Only give access you are entitled to give.** Do not point the agent at systems, accounts, data or credentials you are not authorized to use.
33
+ - **Protect secrets.** Do not paste passwords, keys or tokens into prompts. If the agent can read a file, it may send that file's contents to your model provider.
34
+ - **Watch your costs.** You are responsible for charges from model providers and other services you connect, including charges caused by the agent's actions.
35
+ - **Check third-party terms.** Model providers, extensions, package registries and other services you use with the Software have their own terms, privacy practices and charges. Those terms are between you and them.
36
+ - **Do not use it where failure could cause serious harm.** The Software is not designed or tested for controlling medical devices, vehicles, aircraft, weapons, critical infrastructure, or any system where a mistake could cause death, injury or major damage.
37
+
38
+ ## 4. Acceptable use
39
+
40
+ Do not use the Software or Bandit Cloud to break the law; to access systems or data without permission; to create or spread malware; to harass, defraud or deceive people; to infringe others' rights; or to interfere with Bandit Cloud or other users. Security testing is welcome only on systems you are authorized to test. This section does not limit your rights in the source code under the Apache license.
41
+
42
+ ## 5. Your content and output
43
+
44
+ You keep all rights to your code, prompts, files and other content. As between you and us, output the Software generates for you is yours to use, to the extent we have any rights in it. We do not promise that output is accurate, original, free of third-party rights, or fit for any purpose. You are responsible for checking licences and notices for code the agent brings into your project.
45
+
46
+ When you use Bandit Cloud, we process your content only to provide the service, keep it secure and support you, as described in our Privacy Policy at banditailabs.com/privacy.
47
+
48
+ ## 6. Bandit Cloud accounts
49
+
50
+ Some features need a Bandit Cloud account. Keep your credentials safe and tell us at security@burtson.ai if you think your account has been compromised. You must be at least 18 years old to create an account. We may suspend or end access to Bandit Cloud for misuse, non-payment or to protect the service or other users. Paid plans, if any, are governed by the terms shown when you buy them. Ending a Bandit Cloud account does not affect your rights in the source code.
51
+
52
+ ## 7. Updates and changes to the Software
53
+
54
+ The Software can check for updates and may offer to install them; you can turn automatic update checks off. We may change, add or remove features, and Bandit Cloud features may change or end. Preview and beta features may be incomplete or change without notice.
55
+
56
+ ## 8. No warranty
57
+
58
+ THE SOFTWARE AND BANDIT CLOUD ARE PROVIDED "AS IS" AND "AS AVAILABLE", WITHOUT WARRANTIES OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE AND NON-INFRINGEMENT. WE DO NOT WARRANT THAT THE SOFTWARE OR ITS OUTPUT WILL BE ACCURATE, SECURE, ERROR-FREE OR UNINTERRUPTED, OR THAT IT WILL NOT DAMAGE OR DELETE DATA.
59
+
60
+ ## 9. Limitation of liability
61
+
62
+ TO THE FULLEST EXTENT PERMITTED BY LAW:
63
+
64
+ - BURTSON LABS WILL NOT BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, EXEMPLARY OR PUNITIVE DAMAGES, OR FOR LOST PROFITS, REVENUE, DATA OR GOODWILL, OR FOR THE COST OF RECOVERING OR REPLACING DATA, SYSTEMS OR SERVICES, ARISING FROM OR RELATED TO THE SOFTWARE, ITS OUTPUT, OR ANY ACTION THE SOFTWARE TAKES, EVEN IF WE WERE TOLD SUCH DAMAGES WERE POSSIBLE.
65
+ - BURTSON LABS' TOTAL LIABILITY FOR ALL CLAIMS RELATED TO THE SOFTWARE AND BANDIT CLOUD IS LIMITED TO THE GREATER OF (A) THE AMOUNT YOU PAID BURTSON LABS FOR BANDIT CLOUD IN THE 12 MONTHS BEFORE THE CLAIM AROSE, AND (B) ONE HUNDRED US DOLLARS (US $100).
66
+
67
+ Some places do not allow these exclusions or limits, so some of them may not apply to you. Nothing in these terms limits liability that cannot be limited by law, such as liability for fraud or, where applicable, gross negligence or wilful misconduct.
68
+
69
+ ## 10. Indemnity
70
+
71
+ If someone brings a claim against Burtson Labs arising from content you supplied, your use of the Software in breach of these terms or the law, or systems you directed the agent to access without authorization, you will cover our reasonable costs of defending and resolving that claim. This does not apply to claims caused by our own breach or misconduct.
72
+
73
+ ## 11. Separate agreements
74
+
75
+ If you have a signed agreement with Burtson Labs (for example a statement of work or enterprise agreement), that agreement controls where it conflicts with these terms.
76
+
77
+ ## 12. Changes to these terms
78
+
79
+ We may update these terms. We will post the new version with a new date, keep earlier versions available, and, for material changes, ask you to accept them again in the Software. Changes do not apply retroactively and never reduce rights you already have under the Apache license.
80
+
81
+ ## 13. Governing law
82
+
83
+ These terms are governed by the laws of the State of Missouri, USA, without regard to conflict-of-law rules. Any dispute will be brought in the state or federal courts located in Jackson County, Missouri, and you and we consent to their jurisdiction. If you are a consumer, you keep any rights the law where you live gives you that cannot be waived.
84
+
85
+ ## 14. General
86
+
87
+ If any part of these terms is found unenforceable, the rest stays in effect. Our not enforcing a term is not a waiver. You may not transfer these terms without our consent; we may transfer them with our business. These terms, the Privacy Policy and the Apache License are the entire agreement about the Software, unless you have a separate signed agreement.
88
+
89
+ ## 15. Contact
90
+
91
+ Burtson Labs LLC, 723 E 18th St, Suite 1099, Kansas City, MO 64108, USA · legal@burtson.ai