@burtson-labs/bandit-stealth-cli 1.7.488 → 1.7.489

package/README.md

@@ -64,6 +64,19 @@ The variable and the flag accept for that run only and write nothing. `--help`,
 
 ## What it does
 
+The CLI keeps common coding tools available and loads other tool groups on
+demand to reduce prompt size. `BANDIT_TOOL_EXPOSURE=all` exposes all registered
+tools immediately; it does not restore older tool descriptions. Tool permissions
+and execution checks still apply to deferred tools. If a provider failure
+switches the agent to text tool calling, its prompt retains the groups already
+loaded during that turn. Compact prompts keep the tool-group directory so
+smaller models can discover tools that have not been loaded yet.
+
+After an edit, a failed check or a background job's start does not count as
+completed verification. The agent receives at most one reminder to verify the
+requested result or report what remains unverified. This is a bounded prompt
+guard, not a guarantee of correctness; `BANDIT_VERIFY_BEFORE_DONE=0` disables it.
+
 - **Copying with the mouse** — drag over anything on screen (history, the reply, the prompt) and release: the text is copied to the clipboard and **Copied to clipboard** shows at the lower right for two seconds. Text that wrapped onto several rows copies as one line; real line breaks are kept and colours are dropped. A plain click copies nothing. The copy goes through `pbcopy` / `wl-copy` / `xclip` / `clip`, plus an OSC 52 escape over SSH and in tmux so it reaches your local clipboard; with `BANDIT_NO_CLIPBOARD=1` the notice says **Copy unavailable** instead. `/copy` still lets you choose the latest response or one of its code blocks, preserving the source text without terminal wrapping: `/copy response`, `/copy code 2`, `/copy choose`. `/links` lists recent response and artifact URLs; `/copy link` copies the latest, and `/copy 2` copies the second listed URL. `/copy help` shows the shortcuts.
 - **Clicking prompts** — question choices, Continue/Submit, permission choices (allow once/turn/session, deny, Confirm, Cancel) and follow-up suggestions react to a click. Arrow keys, digits and Enter keep working, and Alt+1–3 still picks a suggestion.
 - **Scrolling and native selection** — the mouse wheel scrolls the terminal's own scrollback as usual: the first wheel tick hands the mouse back to the terminal (that one tick does not scroll), and the next key you type takes it again. While it is handed back, and whenever you hold **Shift** (most terminals), **Option** (iTerm2) or **Fn** (Terminal.app), dragging is the terminal's own selection, copied with its shortcut (Cmd+C on macOS, usually Ctrl+Shift+C elsewhere). Only what is visible on screen can be selected with the in-app drag; for older text scroll up and use the native selection. `BANDIT_MOUSE=0` turns the mouse features off entirely and leaves the mouse to the terminal.
@@ -457,7 +470,7 @@ Tear the pod down when you're done. ~$2/hr for an H100 SXM × 15-20 min agent se
 - **Local-first by default** — with `provider=ollama`, nothing leaves your machine.
 - **Approval gate** — all file writes show a unified diff before touching disk (unless `BANDIT_AUTO_APPROVE=1`).
 - **Command allowlist** — `run_command` only executes from an internal allowlist (git, gh, kubectl, helm, brew, standard *nix tools). Arbitrary shell is refused.
-- **Container sandbox (opt-in)** — `bandit --sandbox` or `BANDIT_SANDBOX=1` runs every agent `run_command` / `watch_command` inside a short-lived Docker or Podman container with the same policy as the Stealth IDE: one workspace mount, no network, no Linux capabilities, read-only root, `no-new-privileges`, bounded CPU/memory/pids/output/time, your uid:gid. Fail-closed once enabled — no runtime means the command is refused, never quietly run on the host. Image: `ghcr.io/burtson-labs/stealth-sandbox` (node, git, ripgrep, python3, C toolchain); override with `BANDIT_SANDBOX_IMAGE`. Enterprise-managed installs should set `BANDIT_SANDBOX=1` in the environment.
+- **Container sandbox (opt-in)** — `bandit --sandbox` or `BANDIT_SANDBOX=1` runs every agent `run_command` / `watch_command` inside a short-lived Docker or Podman container with the same policy as the Stealth IDE: one workspace mount, no network, no Linux capabilities, read-only root, `no-new-privileges`, bounded CPU/memory/pids/output/time, your uid:gid. On a cluster with neither, Apptainer or Singularity run the same image (pulled by digest into a SIF under `$APPTAINER_CACHEDIR/stealth-sandbox` or `~/.bandit/sandbox-apptainer`), as you, with the network namespace checked before every command and the command refused when it cannot be isolated (`sandbox/README.md`, Apptainer). `BANDIT_SANDBOX_RUNTIME=apptainer` (or `docker`, `podman`, `singularity`, comma-separated) picks the runtime. Fail-closed once enabled — no runtime means the command is refused, never quietly run on the host. Image: `ghcr.io/burtson-labs/stealth-sandbox`, chosen from the project's files — the base (node, git, ripgrep, python3, C toolchain) or the dotnet, go, rust or python image built on it; override with `BANDIT_SANDBOX_IMAGE` (a stack name or an image reference). `BANDIT_SANDBOX_INSTALL_NETWORK=1` gives install commands (`npm install`, `pip install`, `dotnet restore`, `go mod download`, …, run on their own) the network; every other command stays offline. Enterprise-managed installs should set `BANDIT_SANDBOX=1` in the environment.
 - **Pre-tool security guard** (default-on) — configure `security.guard` in your [settings file](#settings-file--hooks-permissions-security-guard) to extend or explicitly disable blocking of catastrophic commands (`rm -rf /`, `curl … | sh`, disk wipes, credential exfil, writes to `/etc` or `~/.ssh`) before they run. Defense-in-depth against the model, applied in both CLI and IDE.
 - **Custom hooks** — your own `PreToolUse` shell scripts can veto any tool call; configure globally (`~/.bandit/settings.json`) or per-project.
 - **Secret hygiene** — API keys are redacted in `/config` output and never logged. The optional [telemetry](#telemetry-opt-in) exporter never sends prompt/response text and redacts metadata.