@burtson-labs/bandit-stealth-cli 1.7.502 → 1.7.503
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +28 -26
- package/dist/cli.js +1737 -1719
- package/package.json +1 -1
package/README.md
CHANGED
|
@@ -311,30 +311,31 @@ Workspace config overrides user config. Secrets belong in the user-level file, n
|
|
|
311
311
|
|
|
312
312
|
### Environment variables
|
|
313
313
|
|
|
314
|
-
| Var | Default | Description
|
|
315
|
-
| ------------------------ | ------------------------- |
|
|
316
|
-
| `BANDIT_PROVIDER` | `ollama` | `ollama` or `bandit`
|
|
317
|
-
| `BANDIT_MODEL` | `gemma4:e4b` | Model ID
|
|
318
|
-
| `BANDIT_API_KEY` | — | Required when `BANDIT_PROVIDER=bandit`
|
|
319
|
-
| `BANDIT_API_URL` | `https://api.burtson.ai` | Override Bandit API endpoint
|
|
320
|
-
| `OLLAMA_URL` | `http://localhost:11434` | Ollama endpoint
|
|
321
|
-
| `OLLAMA_HOST` | — | Ollama's own variable (`node:port`, `http://node:port`); used after `OLLAMA_URL` and config
|
|
322
|
-
| `BANDIT_NUM_CTX` | chosen per model | Context window to request from Ollama (`32768`, `32k`); same as `--num-ctx`
|
|
323
|
-
| `
|
|
324
|
-
| `
|
|
325
|
-
| `
|
|
326
|
-
| `
|
|
327
|
-
| `
|
|
328
|
-
| `
|
|
329
|
-
| `
|
|
330
|
-
| `
|
|
331
|
-
| `
|
|
332
|
-
| `
|
|
333
|
-
| `
|
|
334
|
-
| `
|
|
335
|
-
| `
|
|
336
|
-
| `
|
|
337
|
-
| `
|
|
314
|
+
| Var | Default | Description |
|
|
315
|
+
| ------------------------ | ------------------------- | -------------------------------------------------------------------------------------------------------------------------------------- |
|
|
316
|
+
| `BANDIT_PROVIDER` | `ollama` | `ollama` or `bandit` |
|
|
317
|
+
| `BANDIT_MODEL` | `gemma4:e4b` | Model ID |
|
|
318
|
+
| `BANDIT_API_KEY` | — | Required when `BANDIT_PROVIDER=bandit` |
|
|
319
|
+
| `BANDIT_API_URL` | `https://api.burtson.ai` | Override Bandit API endpoint |
|
|
320
|
+
| `OLLAMA_URL` | `http://localhost:11434` | Ollama endpoint |
|
|
321
|
+
| `OLLAMA_HOST` | — | Ollama's own variable (`node:port`, `http://node:port`); used after `OLLAMA_URL` and config |
|
|
322
|
+
| `BANDIT_NUM_CTX` | chosen per model | Context window to request from Ollama (`32768`, `32k`); same as `--num-ctx` |
|
|
323
|
+
| `BANDIT_SMALL_CONTEXT` | `auto` | `on`/`off`: small-context mode for small windows (with Ollama, on below 16,384 tokens); same as `--small-context`/`--no-small-context` |
|
|
324
|
+
| `BANDIT_HOME` | `~/.bandit` | Where sessions, crash reports and the Apptainer image live; settings stay in `~/.bandit` |
|
|
325
|
+
| `BANDIT_NO_LOGIN_HINT` | `0` | `1` to hide the note shown on what looks like a cluster login node |
|
|
326
|
+
| `BANDIT_MAX_ITERATIONS` | `20` | Tool-use loop cap |
|
|
327
|
+
| `BANDIT_AUTO_APPROVE` | `0` | `1`/`true` to skip write-approval prompts |
|
|
328
|
+
| `BANDIT_TELEMETRY` | `0` | `1`/`true` to enable OTLP telemetry (opt-in) |
|
|
329
|
+
| `BANDIT_OTLP_ENDPOINT` | `https://otlp.burtson.ai` | OTLP/HTTP collector base URL |
|
|
330
|
+
| `BANDIT_OTLP_TOKEN` | — | Bearer token for the collector (defaults to your Bandit token) |
|
|
331
|
+
| `BANDIT_OTLP_MODE` | `metrics+traces` | `metrics-only` to drop span payloads |
|
|
332
|
+
| `BANDIT_NO_UPDATE_CHECK` | `0` | `1`/`true` to skip the npm-registry update check at start (one plain GET; nothing is installed) |
|
|
333
|
+
| `BANDIT_OFFLINE` | `0` | `1`/`true`: offline mode. Only the model server is contacted ([Network and offline mode](#network-and-offline-mode)) |
|
|
334
|
+
| `BANDIT_NO_MODELS_DEV` | `0` | `1`/`true` to never fetch the models.dev catalogue for an OpenAI-compatible server |
|
|
335
|
+
| `BANDIT_NO_BROWSER` | `0` | `1`/`true` to never launch the default browser (`insights`, share links); the path or link is still printed |
|
|
336
|
+
| `BANDIT_NO_CLIPBOARD` | `0` | `1`/`true` to leave the clipboard alone when a share link is printed |
|
|
337
|
+
| `BANDIT_ACCEPT_TERMS` | — | `1`/`true` to accept the [Terms of Use](#terms-of-use) for this run only (`--accept-terms` also saves it) |
|
|
338
|
+
| `NO_COLOR` | — | Disable ANSI colors |
|
|
338
339
|
|
|
339
340
|
### Settings file — hooks, permissions, security guard
|
|
340
341
|
|
|
@@ -487,7 +488,8 @@ bandit-agent --model qwen2.5-coder:32b
|
|
|
487
488
|
```
|
|
488
489
|
|
|
489
490
|
- **Endpoint.** Bandit reads `OLLAMA_HOST` the way Ollama's own client does (`node:port`, `http://node:port`, `0.0.0.0`), after `--ollama-url`, `OLLAMA_URL` and the config file. The line under the banner says which endpoint is in use and where it came from.
|
|
490
|
-
- **Context window.** Ollama's own default is 4,096 tokens on GPUs under 24 GB. Bandit always asks for a window per request (at least 16,384; 24,576 for most 7–14B models, 32,768 for 27B and up; never more than the model's own), so `OLLAMA_CONTEXT_LENGTH` and custom Modelfiles are not needed. Bandit's instructions and tool definitions take about 5,500 tokens before your files.
|
|
491
|
+
- **Context window.** Ollama's own default is 4,096 tokens on GPUs under 24 GB. Bandit always asks for a window per request (at least 16,384; 24,576 for most 7–14B models, 32,768 for 27B and up; never more than the model's own), so `OLLAMA_CONTEXT_LENGTH` and custom Modelfiles are not needed. Bandit's instructions and tool definitions take about 5,500 tokens before your files. Set the window with `--num-ctx`, `BANDIT_NUM_CTX` or `"ollama": { "numCtx": 32768 }`. After the first reply Bandit checks what Ollama loaded and warns when part of the model spilled to the CPU, with a window that would fit. A GPU under 24 GB does not limit you to 4,096: Ollama loads the window Bandit asks for and puts what does not fit on the CPU, which is slower (qwen3:8b at 16,384 on an 8 GB card: about a fifth on the CPU, replies about 5× slower), never a failure. The window is really fixed only when the server ignores the request's: Ollama's OpenAI-compatible `/v1` endpoint, `llama-server -c`, LM Studio or vLLM with a set window, or a gateway that drops options. If the KV cache is what does not fit, `OLLAMA_KV_CACHE_TYPE=q8_0` in the Ollama server's environment halves it (qwen3:8b at 16,384 then fits an 8 GB card); set it where `ollama serve` runs, not in Bandit.
|
|
492
|
+
- **Small windows: small-context mode.** With Ollama below 16,384 tokens (other providers only when forced, since their window for a model Bandit does not list is a guess; or with `--small-context`, `BANDIT_SMALL_CONTEXT=on`, `"ollama": { "smallContext": "on" }`) Bandit switches to a small-context agent and says so at startup: a short prompt and 7 tools (read, search, list, edit, write, run, test) with short definitions, 800–1,200 tokens in all instead of 5,500; tool output cut to a share of the window; older results shortened first; the reply's room reserved; thinking off unless `/think on`. Subagents, git, web, document, memory and artifact tools are off. Measured on 5 public benchmark tasks (one-file bug fixes, a new function with tests, a four-file rename), qwen3.6:27b passed 14/15 at 4,096 (three seeds), 5/5 at 6,144 and 5/5 at 8,192 tokens, where the full agent passed 0/5 and 0/5 (and 4/5 at 8,192, with three runs stopped at the iteration limit); qwen3:8b passed 2/10, 4/10 and 2/10 (full agent 0/5, 0/5, 2/5), so an 8B model fails most tasks at these windows either way. What it cannot do: at 4,096 there is room for about one 40-line file at a time, so a task that needs two files in view at once goes back and forth between them (the Go task ran into the iteration limit in all three 4,096 runs, twice after making the fix); long command output is cut to its start and end; earlier steps are shortened to one line; there are no subagents. At 16,384 and above nothing changes; `--no-small-context` keeps the full agent at any window. It is a different thing from the REPL's `/compact` command, which shortens the current conversation.
|
|
491
493
|
- **Login nodes.** Started over SSH on a Slurm login node (outside a job), Bandit prints a one-line reminder to start an interactive job. It never blocks. `BANDIT_NO_LOGIN_HINT=1` hides it.
|
|
492
494
|
- **Home quota.** `BANDIT_HOME` moves what grows (`sessions/`, `crashes/`, `training/`, and the Apptainer sandbox image when `APPTAINER_CACHEDIR` is unset) to scratch. Settings stay in `~/.bandit` (`config.json`, `settings.json`, `mcp-servers.json`, `lessons.md`, `terms.json`; a few KB) so a scratch purge never signs you out. Each project also gets a `.bandit/` folder with turn logs and checkpoints.
|
|
493
495
|
- **Resume after reconnecting.** Sessions are saved with the directory they started in. `bandit --continue` (or `-c`) resumes the latest session of the current directory from any login; `bandit --resume` lists this directory's sessions first.
|
|
@@ -509,7 +511,7 @@ bandit-agent --model qwen2.5-coder:32b
|
|
|
509
511
|
- **Network** — with `provider=ollama` the conversation goes only to your Ollama server. The other connections Bandit can make, and how to turn each off, are listed under [Network and offline mode](#network-and-offline-mode). Tools that contact another host ask first in the default mode, and `BANDIT_OFFLINE=1` turns all of it off.
|
|
510
512
|
- **Approval gate** — all file writes show a unified diff before touching disk (unless `BANDIT_AUTO_APPROVE=1`).
|
|
511
513
|
- **Command allowlist** — `run_command` only executes from an internal allowlist (git, gh, kubectl, helm, brew, standard *nix tools). Arbitrary shell is refused.
|
|
512
|
-
- **Container sandbox (opt-in)** — `bandit --sandbox` or `BANDIT_SANDBOX=1` runs every agent `run_command` / `watch_command` inside a short-lived Docker or Podman container with the same policy as the Stealth IDE: one workspace mount, no network, no Linux capabilities, read-only root, `no-new-privileges`, bounded CPU/memory/pids/output/time, your uid:gid. On a cluster with neither, Apptainer or Singularity run the same image (pulled by digest into a SIF under `$APPTAINER_CACHEDIR/stealth-sandbox` or `~/.bandit/sandbox-apptainer`), as you, with the network namespace checked before every command and the command refused when it cannot be isolated (`sandbox/README.md`, Apptainer). `BANDIT_SANDBOX_RUNTIME=apptainer` (or `docker`, `podman`, `singularity`, comma-separated) picks the runtime. Fail-closed once enabled — no runtime means the command is refused, never quietly run on the host. Image: `ghcr.io/burtson-labs/stealth-sandbox`, chosen from the project's files — the base (node, git, ripgrep, python3, C toolchain) or the dotnet, go, rust or python image built on it; override with `BANDIT_SANDBOX_IMAGE` (a stack name or an image reference). `BANDIT_SANDBOX_INSTALL_NETWORK=1` gives install commands (`npm install`, `pip install`, `dotnet restore`, `go mod download`, …, run on their own) the network; every other command stays offline. Enterprise-managed installs should set `BANDIT_SANDBOX=1` in the environment.
|
|
514
|
+
- **Container sandbox (opt-in)** — `bandit --sandbox` or `BANDIT_SANDBOX=1` runs every agent `run_command` / `watch_command` inside a short-lived Docker or Podman container with the same policy as the Stealth IDE: one workspace mount, no network, no Linux capabilities, read-only root, `no-new-privileges`, bounded CPU/memory/pids/output/time, your uid:gid. On a cluster with neither, Apptainer or Singularity run the same image (pulled by digest into a SIF under `$APPTAINER_CACHEDIR/stealth-sandbox` or `~/.bandit/sandbox-apptainer`), as you, with the network namespace checked before every command and the command refused when it cannot be isolated (`sandbox/README.md`, Apptainer). `BANDIT_SANDBOX_RUNTIME=apptainer` (or `docker`, `podman`, `singularity`, comma-separated) picks the runtime. Fail-closed once enabled — no runtime means the command is refused, never quietly run on the host. Image: `ghcr.io/burtson-labs/stealth-sandbox`, chosen from the project's files — the base (node, git, ripgrep, python3, C toolchain) or the dotnet, go, rust or python image built on it; override with `BANDIT_SANDBOX_IMAGE` (a stack name or an image reference). `BANDIT_SANDBOX_INSTALL_NETWORK=1` gives install commands (`npm install`, `pip install`, `dotnet restore`, `go mod download`, …, run on their own) the network; every other command stays offline. Enterprise-managed installs should set `BANDIT_SANDBOX=1` in the environment. Inside the sandbox `run_command` also runs programs the workspace itself provides: a binary the agent just built (`./heat`, `build/heat`), a repo script (`tools/dryrun.sh`), a venv interpreter (`.venv/bin/python`), and a shell given such a script (`bash tools/dryrun.sh`; `bash -c` stays blocked). The allow-list exists to keep the agent from running arbitrary code with your files, keys and network; in the container the workspace mount is the only thing a program can change and there is no network, so a workspace program has the same reach as `make`, `npm test` or `python3 script.py`, which the list already allows. On the host (no `--sandbox`) the allow-list applies as before and the model is told to ask you to run the program. Paths must be relative, contain a `/` and stay inside the workspace (no `..`, `~`, absolute paths or drive letters); the blocked-pattern check runs on every command either way.
|
|
513
515
|
- **Pre-tool security guard** (default-on) — configure `security.guard` in your [settings file](#settings-file--hooks-permissions-security-guard) to extend or explicitly disable blocking of catastrophic commands (`rm -rf /`, `curl … | sh`, disk wipes, credential exfil, writes to `/etc` or `~/.ssh`) before they run. Defense-in-depth against the model, applied in both CLI and IDE.
|
|
514
516
|
- **Custom hooks** — your own `PreToolUse` shell scripts can veto any tool call; configure globally (`~/.bandit/settings.json`) or per-project.
|
|
515
517
|
- **Secret hygiene** — API keys are redacted in `/config` output and never logged. The optional [telemetry](#telemetry-opt-in) exporter sends no prompt or reply text, and runs the tool arguments it does send through secret redaction.
|