@burtson-labs/bandit-stealth-cli 1.7.489 → 1.7.491

package/README.md

@@ -78,8 +78,8 @@ requested result or report what remains unverified. This is a bounded prompt
 guard, not a guarantee of correctness; `BANDIT_VERIFY_BEFORE_DONE=0` disables it.
 
 - **Copying with the mouse** — drag over anything on screen (history, the reply, the prompt) and release: the text is copied to the clipboard and **Copied to clipboard** shows at the lower right for two seconds. Text that wrapped onto several rows copies as one line; real line breaks are kept and colours are dropped. A plain click copies nothing. The copy goes through `pbcopy` / `wl-copy` / `xclip` / `clip`, plus an OSC 52 escape over SSH and in tmux so it reaches your local clipboard; with `BANDIT_NO_CLIPBOARD=1` the notice says **Copy unavailable** instead. `/copy` still lets you choose the latest response or one of its code blocks, preserving the source text without terminal wrapping: `/copy response`, `/copy code 2`, `/copy choose`. `/links` lists recent response and artifact URLs; `/copy link` copies the latest, and `/copy 2` copies the second listed URL. `/copy help` shows the shortcuts.
-- **Clicking prompts** — question choices, Continue/Submit, permission choices (allow once/turn/session, deny, Confirm, Cancel) and follow-up suggestions react to a click. Arrow keys, digits and Enter keep working, and Alt+1–3 still picks a suggestion.
-- **Scrolling and native selection** — the mouse wheel scrolls the terminal's own scrollback as usual: the first wheel tick hands the mouse back to the terminal (that one tick does not scroll), and the next key you type takes it again. While it is handed back, and whenever you hold **Shift** (most terminals), **Option** (iTerm2) or **Fn** (Terminal.app), dragging is the terminal's own selection, copied with its shortcut (Cmd+C on macOS, usually Ctrl+Shift+C elsewhere). Only what is visible on screen can be selected with the in-app drag; for older text scroll up and use the native selection. `BANDIT_MOUSE=0` turns the mouse features off entirely and leaves the mouse to the terminal.
+- **Clicking prompts and menus** — question choices, Continue/Submit, permission choices (allow once/turn/session, deny, Confirm, Cancel), the MCP trust check, the theme and session pickers, the `/` command list, the `@` file list and follow-up suggestions react to a click. In a choice list a click highlights an option and a click on the highlighted one answers with it (as Enter does), so the default takes one click and any other two; a `/` command or `@` file is inserted with one click. Arrow keys, digits and Enter keep working, and Alt+1–3 still picks a suggestion. Clicks need a terminal with SGR (1006) mouse reporting: the Stealth IDE terminal, VS Code's, iTerm2, Terminal.app, kitty, WezTerm, Alacritty and GNOME Terminal have it.
+- **Scrolling and native selection** — the mouse wheel scrolls the terminal's own scrollback as usual: the first wheel tick hands the mouse back to the terminal (that one tick does not scroll), and the next key you type takes it again. While it is handed back, and whenever you hold **Shift** (most terminals), **Option** (iTerm2) or **Fn** (Terminal.app), dragging is the terminal's own selection, copied with its shortcut (Cmd+C on macOS, usually Ctrl+Shift+C elsewhere). Only what is visible on screen can be selected with the in-app drag; for older text scroll up and use the native selection. `BANDIT_MOUSE=0`, `--no-mouse` or `"mouse": false` in `~/.bandit/config.json` turns the mouse features off entirely and leaves the mouse to the terminal.
 - **Clickable web links** — labeled links retain their destinations through the live renderer. Stealth opens them in your browser; other terminals use their own link gesture and hyperlink support.
 - **Agentic tool use** — reads files, searches code, runs commands, writes changes
 - **Auditable approval gate** — writes show a colored diff, shell commands show the full command/cwd/risk, and `Allow once` / `Allow session` / `Always for target` scopes are recorded in turn traces
@@ -211,24 +211,21 @@ Servers spawn lazily on first invocation, persist for the session, and get clean
 
 ## Recommended models
 
-Bandit auto-detects each model's capabilities and takes the native tool-calling
-path when supported. All four cloud models emit native tool calls reliably —
-that is not what separates them.
+Bandit uses native tool calling when supported by the selected provider.
 
 ### Cloud — Bandit gateway (API key)
 
-| Model            | Notes                                                                                                                                                                                                        |
-| ---------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
-| `bandit-logic-2` | **Start here.** Fastest (1.3–1.7s warm, and steady under concurrent load), 256K context, and the model that handled a one-prompt "write a PDF with a diagram" end to end. Frontier coding model.             |
-| `bandit-core-2`  | Highest score on our 26-fixture agent eval (20/26 vs 19/26), but roughly 3× the wall time for the same suite. Reach for it when quality matters more than latency. 256K context.                             |
-| `bandit-logic`   | Self-hosted. Fast in isolation (~6.5s) but latency degrades sharply when more than one session uses it at once. Agent-tuned, thinking mode, 64K context.                                                     |
-| `bandit-core-1`  | Self-hosted, lightweight. Same concurrency limit as `bandit-logic`, and availability has been uneven — measured between 8s and 112s for the same trivial prompt on the same day. Check before relying on it. |
+| Model            | Notes                                                                                                                                                   |
+| ---------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `bandit-logic`   | Default: Kimi K3 through Ollama Cloud, with vision, reasoning and native tools. Advertised context: 1M; the harness keeps conservative working budgets. |
+| `bandit-logic-2` | Compatibility alias for the same K3 backend. Existing saved sessions continue to work.                                                                  |
+| `bandit-core-2`  | Existing general-purpose cloud model.                                                                                                                   |
+| `bandit-core-1`  | Lightweight self-hosted model.                                                                                                                          |
 
-> **Concurrency matters more than the benchmark.** `bandit-logic` and
-> `bandit-core-1` run on our own hardware and serve roughly one request at a
-> time: two simultaneous sessions are enough to stall both. `bandit-logic-2`
-> and `bandit-core-2` are cloud-backed and hold their latency under load. If
-> you are fanning work out in parallel, use the cloud pair.
+K3 replaces K2.7 Code in the Logic routes. The initial three-task compatibility
+screen passed; that small sample is not a comparative quality or latency claim.
+Cloud Logic uses the existing frontier subscription, usage and credit rules.
+Use an explicit Qwen model with the Ollama provider for local inference.
 
 ### Local — Ollama
 
@@ -236,7 +233,7 @@ Pull one with `ollama pull <model>`.
 
 | Model                    | Where                                     | Notes                                                                                                                                                                                                                          |
 | ------------------------ | ----------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
-| `qwen3.6:27b`            | Local / Mac 48GB+, high-VRAM GPU (~17 GB) | **Best local pick.** Same family as `bandit-logic`, runs offline. Probes the filesystem instead of asking for clarification — real agent behavior.                                                                             |
+| `qwen3.6:27b`            | Local / Mac 48GB+, high-VRAM GPU (~17 GB) | **Best local pick.** Runs offline. Probes the filesystem instead of asking for clarification — real agent behavior.                                                                                                            |
 | `gemma4:26b`             | Local / Mac 32GB+ (~17 GB)                | Solid alternative when Qwen 3.6 is too heavy for your hardware. Multimodal, 128K context.                                                                                                                                      |
 | `gemma4:e4b`             | Local / laptop-class (~3 GB)              | Lightweight pick that punches above its weight. Validated on real Bandit runs — clean tool sequencing (`ls` → narrow → `read_file`), no hallucinated paths. Right pick when you want a local agent that doesn't pin your fans. |
 | `gemma4:31b`             | Local / Mac 64GB+, GPU node               | Bigger context, better reasoning for complex refactors.                                                                                                                                                                        |
@@ -455,11 +452,11 @@ Tear the pod down when you're done. ~$2/hr for an H100 SXM × 15-20 min agent se
 
 **Recommended models for rented GPU:**
 
-| Model               | Size   | What it's good at                                                                                   |
-| ------------------- | ------ | --------------------------------------------------------------------------------------------------- |
-| `qwen3.6:27b`       | ~17 GB | Same model as `bandit-logic`. Native tool calling, vision, 256K context. Best general-purpose pick. |
-| `qwen2.5-coder:32b` | ~20 GB | Code-specialist post-train. Strongest on file edits and refactors.                                  |
-| `qwen3.6:35b`       | ~24 GB | Bigger Qwen 3.6 variant — slower, marginally better reasoning.                                      |
+| Model               | Size   | What it's good at                                                     |
+| ------------------- | ------ | --------------------------------------------------------------------- |
+| `qwen3.6:27b`       | ~17 GB | Native tool calling, vision, 256K context. Best general-purpose pick. |
+| `qwen2.5-coder:32b` | ~20 GB | Code-specialist post-train. Strongest on file edits and refactors.    |
+| `qwen3.6:35b`       | ~24 GB | Bigger Qwen 3.6 variant — slower, marginally better reasoning.        |
 
 **Avoid for agent work:** `gpt-oss:120b` and similar reasoning-tuned models. They're post-trained for OpenAI's harmony tool-call format, not the XML protocol Bandit uses for non-native models — they tend to narrate intent without emitting tool calls. Great for math/proofs in chat, poor for filesystem agent loops.