@burtson-labs/bandit-stealth-cli 1.7.487 → 1.7.489

package/README.md

@@ -64,8 +64,22 @@ The variable and the flag accept for that run only and write nothing. `--help`,
 
 ## What it does
 
-- **Scrolling and copying** — drag to select text, then use your terminal's Copy shortcut (Cmd+C on macOS, usually Ctrl+Shift+C on Linux/Windows). `/copy` lets you choose the latest response or one of its code blocks, preserving the source text without terminal wrapping. `/copy response` copies the whole response directly; `/copy code 2` copies its second code block. `/links` lists recent response and artifact URLs; `/copy link` copies the latest, and `/copy 2` copies the second listed URL. `/copy help` shows the shortcuts.
-- **Optional mouse controls** — set `BANDIT_MOUSE=1` to click question choices, Continue/Submit, permission choices, and follow-up suggestions. This captures mouse events; hold Fn in Terminal.app, Option in iTerm2, or Shift in most other terminals while selecting text. Keyboard controls (including Alt+1–3 for suggestions) remain available with either setting.
+The CLI keeps common coding tools available and loads other tool groups on
+demand to reduce prompt size. `BANDIT_TOOL_EXPOSURE=all` exposes all registered
+tools immediately; it does not restore older tool descriptions. Tool permissions
+and execution checks still apply to deferred tools. If a provider failure
+switches the agent to text tool calling, its prompt retains the groups already
+loaded during that turn. Compact prompts keep the tool-group directory so
+smaller models can discover tools that have not been loaded yet.
+
+After an edit, a failed check or a background job's start does not count as
+completed verification. The agent receives at most one reminder to verify the
+requested result or report what remains unverified. This is a bounded prompt
+guard, not a guarantee of correctness; `BANDIT_VERIFY_BEFORE_DONE=0` disables it.
+
+- **Copying with the mouse** — drag over anything on screen (history, the reply, the prompt) and release: the text is copied to the clipboard and **Copied to clipboard** shows at the lower right for two seconds. Text that wrapped onto several rows copies as one line; real line breaks are kept and colours are dropped. A plain click copies nothing. The copy goes through `pbcopy` / `wl-copy` / `xclip` / `clip`, plus an OSC 52 escape over SSH and in tmux so it reaches your local clipboard; with `BANDIT_NO_CLIPBOARD=1` the notice says **Copy unavailable** instead. `/copy` still lets you choose the latest response or one of its code blocks, preserving the source text without terminal wrapping: `/copy response`, `/copy code 2`, `/copy choose`. `/links` lists recent response and artifact URLs; `/copy link` copies the latest, and `/copy 2` copies the second listed URL. `/copy help` shows the shortcuts.
+- **Clicking prompts** — question choices, Continue/Submit, permission choices (allow once/turn/session, deny, Confirm, Cancel) and follow-up suggestions react to a click. Arrow keys, digits and Enter keep working, and Alt+1–3 still picks a suggestion.
+- **Scrolling and native selection** — the mouse wheel scrolls the terminal's own scrollback as usual: the first wheel tick hands the mouse back to the terminal (that one tick does not scroll), and the next key you type takes it again. While it is handed back, and whenever you hold **Shift** (most terminals), **Option** (iTerm2) or **Fn** (Terminal.app), dragging is the terminal's own selection, copied with its shortcut (Cmd+C on macOS, usually Ctrl+Shift+C elsewhere). Only what is visible on screen can be selected with the in-app drag; for older text scroll up and use the native selection. `BANDIT_MOUSE=0` turns the mouse features off entirely and leaves the mouse to the terminal.
 - **Clickable web links** — labeled links retain their destinations through the live renderer. Stealth opens them in your browser; other terminals use their own link gesture and hyperlink support.
 - **Agentic tool use** — reads files, searches code, runs commands, writes changes
 - **Auditable approval gate** — writes show a colored diff, shell commands show the full command/cwd/risk, and `Allow once` / `Allow session` / `Always for target` scopes are recorded in turn traces
@@ -456,7 +470,7 @@ Tear the pod down when you're done. ~$2/hr for an H100 SXM × 15-20 min agent se
 - **Local-first by default** — with `provider=ollama`, nothing leaves your machine.
 - **Approval gate** — all file writes show a unified diff before touching disk (unless `BANDIT_AUTO_APPROVE=1`).
 - **Command allowlist** — `run_command` only executes from an internal allowlist (git, gh, kubectl, helm, brew, standard *nix tools). Arbitrary shell is refused.
-- **Container sandbox (opt-in)** — `bandit --sandbox` or `BANDIT_SANDBOX=1` runs every agent `run_command` / `watch_command` inside a short-lived Docker or Podman container with the same policy as the Stealth IDE: one workspace mount, no network, no Linux capabilities, read-only root, `no-new-privileges`, bounded CPU/memory/pids/output/time, your uid:gid. Fail-closed once enabled — no runtime means the command is refused, never quietly run on the host. Image: `ghcr.io/burtson-labs/stealth-sandbox` (node, git, ripgrep, python3, C toolchain); override with `BANDIT_SANDBOX_IMAGE`. Enterprise-managed installs should set `BANDIT_SANDBOX=1` in the environment.
+- **Container sandbox (opt-in)** — `bandit --sandbox` or `BANDIT_SANDBOX=1` runs every agent `run_command` / `watch_command` inside a short-lived Docker or Podman container with the same policy as the Stealth IDE: one workspace mount, no network, no Linux capabilities, read-only root, `no-new-privileges`, bounded CPU/memory/pids/output/time, your uid:gid. On a cluster with neither, Apptainer or Singularity run the same image (pulled by digest into a SIF under `$APPTAINER_CACHEDIR/stealth-sandbox` or `~/.bandit/sandbox-apptainer`), as you, with the network namespace checked before every command and the command refused when it cannot be isolated (`sandbox/README.md`, Apptainer). `BANDIT_SANDBOX_RUNTIME=apptainer` (or `docker`, `podman`, `singularity`, comma-separated) picks the runtime. Fail-closed once enabled — no runtime means the command is refused, never quietly run on the host. Image: `ghcr.io/burtson-labs/stealth-sandbox`, chosen from the project's files — the base (node, git, ripgrep, python3, C toolchain) or the dotnet, go, rust or python image built on it; override with `BANDIT_SANDBOX_IMAGE` (a stack name or an image reference). `BANDIT_SANDBOX_INSTALL_NETWORK=1` gives install commands (`npm install`, `pip install`, `dotnet restore`, `go mod download`, …, run on their own) the network; every other command stays offline. Enterprise-managed installs should set `BANDIT_SANDBOX=1` in the environment.
 - **Pre-tool security guard** (default-on) — configure `security.guard` in your [settings file](#settings-file--hooks-permissions-security-guard) to extend or explicitly disable blocking of catastrophic commands (`rm -rf /`, `curl … | sh`, disk wipes, credential exfil, writes to `/etc` or `~/.ssh`) before they run. Defense-in-depth against the model, applied in both CLI and IDE.
 - **Custom hooks** — your own `PreToolUse` shell scripts can veto any tool call; configure globally (`~/.bandit/settings.json`) or per-project.
 - **Secret hygiene** — API keys are redacted in `/config` output and never logged. The optional [telemetry](#telemetry-opt-in) exporter never sends prompt/response text and redacts metadata.
@@ -496,11 +510,13 @@ _Bandit CLI is built by [Burtson Labs](https://burtson.ai). Source for the runti
 ### Clipboard and long commands
 
 Ctrl+V attaches a clipboard screenshot at the idle prompt or while a turn is
-running. Typing during capture stays in the composer. `/copy` opens a scrollable
-selection view of the latest response: drag to highlight, release to copy, and
-look for the confirmation below the text. Escape returns to chat. This view
-preserves code indentation and soft-wrapped text; ordinary terminal scrollback
-selection still uses the terminal's own copy shortcut.
+running. Typing during capture stays in the composer. Dragging over the screen
+copies on release with a "Copied to clipboard" notice at the lower right (see
+the input section above). `/copy` opens a scrollable selection view of the
+whole latest response, including the parts that have scrolled away: drag to
+highlight, release to copy, and look for the confirmation below the text.
+Escape returns to chat. This view preserves code indentation and soft-wrapped
+text.
 
 For downloads, builds and conversions, the agent can use `run_background_command`
 to start one process and return immediately. Its completion or failure wakes the