@burtson-labs/bandit-stealth-cli 1.7.488 → 1.7.490

package/README.md

@@ -64,6 +64,19 @@ The variable and the flag accept for that run only and write nothing. `--help`,
 
 ## What it does
 
+The CLI keeps common coding tools available and loads other tool groups on
+demand to reduce prompt size. `BANDIT_TOOL_EXPOSURE=all` exposes all registered
+tools immediately; it does not restore older tool descriptions. Tool permissions
+and execution checks still apply to deferred tools. If a provider failure
+switches the agent to text tool calling, its prompt retains the groups already
+loaded during that turn. Compact prompts keep the tool-group directory so
+smaller models can discover tools that have not been loaded yet.
+
+After an edit, a failed check or a background job's start does not count as
+completed verification. The agent receives at most one reminder to verify the
+requested result or report what remains unverified. This is a bounded prompt
+guard, not a guarantee of correctness; `BANDIT_VERIFY_BEFORE_DONE=0` disables it.
+
 - **Copying with the mouse** — drag over anything on screen (history, the reply, the prompt) and release: the text is copied to the clipboard and **Copied to clipboard** shows at the lower right for two seconds. Text that wrapped onto several rows copies as one line; real line breaks are kept and colours are dropped. A plain click copies nothing. The copy goes through `pbcopy` / `wl-copy` / `xclip` / `clip`, plus an OSC 52 escape over SSH and in tmux so it reaches your local clipboard; with `BANDIT_NO_CLIPBOARD=1` the notice says **Copy unavailable** instead. `/copy` still lets you choose the latest response or one of its code blocks, preserving the source text without terminal wrapping: `/copy response`, `/copy code 2`, `/copy choose`. `/links` lists recent response and artifact URLs; `/copy link` copies the latest, and `/copy 2` copies the second listed URL. `/copy help` shows the shortcuts.
 - **Clicking prompts** — question choices, Continue/Submit, permission choices (allow once/turn/session, deny, Confirm, Cancel) and follow-up suggestions react to a click. Arrow keys, digits and Enter keep working, and Alt+1–3 still picks a suggestion.
 - **Scrolling and native selection** — the mouse wheel scrolls the terminal's own scrollback as usual: the first wheel tick hands the mouse back to the terminal (that one tick does not scroll), and the next key you type takes it again. While it is handed back, and whenever you hold **Shift** (most terminals), **Option** (iTerm2) or **Fn** (Terminal.app), dragging is the terminal's own selection, copied with its shortcut (Cmd+C on macOS, usually Ctrl+Shift+C elsewhere). Only what is visible on screen can be selected with the in-app drag; for older text scroll up and use the native selection. `BANDIT_MOUSE=0` turns the mouse features off entirely and leaves the mouse to the terminal.
@@ -198,24 +211,21 @@ Servers spawn lazily on first invocation, persist for the session, and get clean
 
 ## Recommended models
 
-Bandit auto-detects each model's capabilities and takes the native tool-calling
-path when supported. All four cloud models emit native tool calls reliably —
-that is not what separates them.
+Bandit uses native tool calling when supported by the selected provider.
 
 ### Cloud — Bandit gateway (API key)
 
-| Model            | Notes                                                                                                                                                                                                        |
-| ---------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
-| `bandit-logic-2` | **Start here.** Fastest (1.3–1.7s warm, and steady under concurrent load), 256K context, and the model that handled a one-prompt "write a PDF with a diagram" end to end. Frontier coding model.             |
-| `bandit-core-2`  | Highest score on our 26-fixture agent eval (20/26 vs 19/26), but roughly 3× the wall time for the same suite. Reach for it when quality matters more than latency. 256K context.                             |
-| `bandit-logic`   | Self-hosted. Fast in isolation (~6.5s) but latency degrades sharply when more than one session uses it at once. Agent-tuned, thinking mode, 64K context.                                                     |
-| `bandit-core-1`  | Self-hosted, lightweight. Same concurrency limit as `bandit-logic`, and availability has been uneven — measured between 8s and 112s for the same trivial prompt on the same day. Check before relying on it. |
+| Model            | Notes                                                                                                                                                   |
+| ---------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `bandit-logic`   | Default: Kimi K3 through Ollama Cloud, with vision, reasoning and native tools. Advertised context: 1M; the harness keeps conservative working budgets. |
+| `bandit-logic-2` | Compatibility alias for the same K3 backend. Existing saved sessions continue to work.                                                                  |
+| `bandit-core-2`  | Existing general-purpose cloud model.                                                                                                                   |
+| `bandit-core-1`  | Lightweight self-hosted model.                                                                                                                          |
 
-> **Concurrency matters more than the benchmark.** `bandit-logic` and
-> `bandit-core-1` run on our own hardware and serve roughly one request at a
-> time: two simultaneous sessions are enough to stall both. `bandit-logic-2`
-> and `bandit-core-2` are cloud-backed and hold their latency under load. If
-> you are fanning work out in parallel, use the cloud pair.
+K3 replaces K2.7 Code in the Logic routes. The initial three-task compatibility
+screen passed; that small sample is not a comparative quality or latency claim.
+Cloud Logic uses the existing frontier subscription, usage and credit rules.
+Use an explicit Qwen model with the Ollama provider for local inference.
 
 ### Local — Ollama
 
@@ -223,7 +233,7 @@ Pull one with `ollama pull <model>`.
 
 | Model                    | Where                                     | Notes                                                                                                                                                                                                                          |
 | ------------------------ | ----------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
-| `qwen3.6:27b`            | Local / Mac 48GB+, high-VRAM GPU (~17 GB) | **Best local pick.** Same family as `bandit-logic`, runs offline. Probes the filesystem instead of asking for clarification — real agent behavior.                                                                             |
+| `qwen3.6:27b`            | Local / Mac 48GB+, high-VRAM GPU (~17 GB) | **Best local pick.** Runs offline. Probes the filesystem instead of asking for clarification — real agent behavior.                                                                                                            |
 | `gemma4:26b`             | Local / Mac 32GB+ (~17 GB)                | Solid alternative when Qwen 3.6 is too heavy for your hardware. Multimodal, 128K context.                                                                                                                                      |
 | `gemma4:e4b`             | Local / laptop-class (~3 GB)              | Lightweight pick that punches above its weight. Validated on real Bandit runs — clean tool sequencing (`ls` → narrow → `read_file`), no hallucinated paths. Right pick when you want a local agent that doesn't pin your fans. |
 | `gemma4:31b`             | Local / Mac 64GB+, GPU node               | Bigger context, better reasoning for complex refactors.                                                                                                                                                                        |
@@ -442,11 +452,11 @@ Tear the pod down when you're done. ~$2/hr for an H100 SXM × 15-20 min agent se
 
 **Recommended models for rented GPU:**
 
-| Model               | Size   | What it's good at                                                                                   |
-| ------------------- | ------ | --------------------------------------------------------------------------------------------------- |
-| `qwen3.6:27b`       | ~17 GB | Same model as `bandit-logic`. Native tool calling, vision, 256K context. Best general-purpose pick. |
-| `qwen2.5-coder:32b` | ~20 GB | Code-specialist post-train. Strongest on file edits and refactors.                                  |
-| `qwen3.6:35b`       | ~24 GB | Bigger Qwen 3.6 variant — slower, marginally better reasoning.                                      |
+| Model               | Size   | What it's good at                                                     |
+| ------------------- | ------ | --------------------------------------------------------------------- |
+| `qwen3.6:27b`       | ~17 GB | Native tool calling, vision, 256K context. Best general-purpose pick. |
+| `qwen2.5-coder:32b` | ~20 GB | Code-specialist post-train. Strongest on file edits and refactors.    |
+| `qwen3.6:35b`       | ~24 GB | Bigger Qwen 3.6 variant — slower, marginally better reasoning.        |
 
 **Avoid for agent work:** `gpt-oss:120b` and similar reasoning-tuned models. They're post-trained for OpenAI's harmony tool-call format, not the XML protocol Bandit uses for non-native models — they tend to narrate intent without emitting tool calls. Great for math/proofs in chat, poor for filesystem agent loops.
 
@@ -457,7 +467,7 @@ Tear the pod down when you're done. ~$2/hr for an H100 SXM × 15-20 min agent se
 - **Local-first by default** — with `provider=ollama`, nothing leaves your machine.
 - **Approval gate** — all file writes show a unified diff before touching disk (unless `BANDIT_AUTO_APPROVE=1`).
 - **Command allowlist** — `run_command` only executes from an internal allowlist (git, gh, kubectl, helm, brew, standard *nix tools). Arbitrary shell is refused.
-- **Container sandbox (opt-in)** — `bandit --sandbox` or `BANDIT_SANDBOX=1` runs every agent `run_command` / `watch_command` inside a short-lived Docker or Podman container with the same policy as the Stealth IDE: one workspace mount, no network, no Linux capabilities, read-only root, `no-new-privileges`, bounded CPU/memory/pids/output/time, your uid:gid. Fail-closed once enabled — no runtime means the command is refused, never quietly run on the host. Image: `ghcr.io/burtson-labs/stealth-sandbox` (node, git, ripgrep, python3, C toolchain); override with `BANDIT_SANDBOX_IMAGE`. Enterprise-managed installs should set `BANDIT_SANDBOX=1` in the environment.
+- **Container sandbox (opt-in)** — `bandit --sandbox` or `BANDIT_SANDBOX=1` runs every agent `run_command` / `watch_command` inside a short-lived Docker or Podman container with the same policy as the Stealth IDE: one workspace mount, no network, no Linux capabilities, read-only root, `no-new-privileges`, bounded CPU/memory/pids/output/time, your uid:gid. On a cluster with neither, Apptainer or Singularity run the same image (pulled by digest into a SIF under `$APPTAINER_CACHEDIR/stealth-sandbox` or `~/.bandit/sandbox-apptainer`), as you, with the network namespace checked before every command and the command refused when it cannot be isolated (`sandbox/README.md`, Apptainer). `BANDIT_SANDBOX_RUNTIME=apptainer` (or `docker`, `podman`, `singularity`, comma-separated) picks the runtime. Fail-closed once enabled — no runtime means the command is refused, never quietly run on the host. Image: `ghcr.io/burtson-labs/stealth-sandbox`, chosen from the project's files — the base (node, git, ripgrep, python3, C toolchain) or the dotnet, go, rust or python image built on it; override with `BANDIT_SANDBOX_IMAGE` (a stack name or an image reference). `BANDIT_SANDBOX_INSTALL_NETWORK=1` gives install commands (`npm install`, `pip install`, `dotnet restore`, `go mod download`, …, run on their own) the network; every other command stays offline. Enterprise-managed installs should set `BANDIT_SANDBOX=1` in the environment.
 - **Pre-tool security guard** (default-on) — configure `security.guard` in your [settings file](#settings-file--hooks-permissions-security-guard) to extend or explicitly disable blocking of catastrophic commands (`rm -rf /`, `curl … | sh`, disk wipes, credential exfil, writes to `/etc` or `~/.ssh`) before they run. Defense-in-depth against the model, applied in both CLI and IDE.
 - **Custom hooks** — your own `PreToolUse` shell scripts can veto any tool call; configure globally (`~/.bandit/settings.json`) or per-project.
 - **Secret hygiene** — API keys are redacted in `/config` output and never logged. The optional [telemetry](#telemetry-opt-in) exporter never sends prompt/response text and redacts metadata.