@burtson-labs/bandit-stealth-cli 1.7.501 → 1.7.502

package/README.md

@@ -43,6 +43,7 @@ _Prefer an IDE?_ The sibling Bandit Stealth extension for VS Code / Cursor ships
    ```bash
    bandit                                     # interactive REPL
    bandit "explain @src/auth/login.ts"        # one-shot with a file mention
+   bandit --read-only                         # start in plan mode: read and plan, change nothing
    ```
 
 The CLI installs two commands that do the same thing: `bandit` and `bandit-agent`. The Python security linter [Bandit](https://github.com/PyCQA/bandit) also installs a `bandit` command; if it comes first on your PATH (common in Python environments and on shared clusters), use `bandit-agent`. `bandit doctor` tells you when that happens.
@@ -60,7 +61,9 @@ BANDIT_ACCEPT_TERMS=1 bandit "summarize the open TODOs"
 bandit --accept-terms "summarize the open TODOs"
 ```
 
-The variable and the flag accept for that run only and write nothing. `--help`, `--version`, `terms`, `upgrade`, `self-update` and `doctor` never ask.
+`--accept-terms` is saved in `~/.bandit/terms.json` like an answer at the prompt, so later runs need neither. `BANDIT_ACCEPT_TERMS=1` accepts for that run only and writes nothing (for CI and containers). `--help`, `--version`, `terms`, `upgrade`, `self-update` and `doctor` never ask.
+
+An option bandit does not know (a typo such as `--read-onyl`) stops with exit status 2 and names the closest one; it is never sent to the model as a prompt. Put prompt text that starts with `-` after `--`: `bandit -- "-v means verbose?"`.
 
 ---
 
@@ -330,11 +333,13 @@ Workspace config overrides user config. Secrets belong in the user-level file, n
 | `BANDIT_NO_MODELS_DEV`   | `0`                       | `1`/`true` to never fetch the models.dev catalogue for an OpenAI-compatible server                                   |
 | `BANDIT_NO_BROWSER`      | `0`                       | `1`/`true` to never launch the default browser (`insights`, share links); the path or link is still printed          |
 | `BANDIT_NO_CLIPBOARD`    | `0`                       | `1`/`true` to leave the clipboard alone when a share link is printed                                                 |
-| `BANDIT_ACCEPT_TERMS`    | —                         | `1`/`true` to accept the [Terms of Use](#terms-of-use) for this run without a prompt (same as `--accept-terms`)      |
+| `BANDIT_ACCEPT_TERMS`    | —                         | `1`/`true` to accept the [Terms of Use](#terms-of-use) for this run only (`--accept-terms` also saves it)            |
 | `NO_COLOR`               | —                         | Disable ANSI colors                                                                                                  |
 
 ### Settings file — hooks, permissions, security guard
 
+Plan mode is read-only: the agent reads files, searches and runs read-only commands (`git status`, `ls`, `grep`), and every edit, file write, state-changing command and network write is refused, so it ends with a plan instead of changes. Start a session in it with `bandit --read-only` (also for one-shot prompts: `bandit --read-only "how would you add caching here?"`), or switch with shift+tab or `/plan`; `BANDIT_PERMISSION_MODE=plan` does the same. `--read-only` cannot be combined with `--auto`.
+
 Terminal `--auto` mode runs routine work immediately and reviews other actions with the selected provider/model. The reviewer considers the raw user requests in the current session, the proposed action and bounded local metadata. Requested cleanup can proceed without a blanket deletion prompt; uncertain effects or missing authorization still ask. External, system and irreversible actions need explicit authorization. Reviews use no tools, have a 12-second deadline, and their decisions appear in the turn log and `/permissions`. Explicit policy rules and security guards remain in force. Targeted edits to existing user-owned temporary helper files can qualify as task-related scratch work when the host verifies file ownership and location; this does not authorize arbitrary temporary-file deletion or replacement. Model review is fallible; `ask` mode remains available when every ungranted action should be reviewed by you.
 
 Interactive sessions expose `monitor_job`, `check_monitor`, and `cancel_monitor`. Ask the agent to monitor a particular run and specify its cadence and authorized response, for example: “Check this run every five minutes; if it fails, collect its logs and diagnose it.” The monitor returns immediately and uses a timer to run the approved status command. A terminal result resumes the agent, including when other jobs are still running. Follow-up actions go through the normal permissions gate.