Bastion AI

Bastion AI is part of 1.1.0, on top of the SSH workspace. This page is the long-form reference; the feature page is the short form.

Status: In 1.1.0. The panel modes are Ask, Fix, and Plan. Fix and Plan show commands and wait for approval before those commands run. Providers are OpenAI, Anthropic, Google Gemini, OpenRouter, and an OpenAI-compatible endpoint. Sections below that describe later waves are design notes.

What "AI-native" means here

Bastion AI is successful when a user can say "Why is this failing?" and the product automatically gathers relevant context (terminal output, recent commands, host metadata, OS, cwd, optional logs) instead of forcing copy-paste into a browser chat.

And when a user says "Restart nginx on all staging servers," the AI plans steps, shows risks and exact targets, and executes only after confirmation. That is the difference between a chat box and an agentic workspace.

Architecture

UI (React)
   ↓
AI Orchestrator
   ↓
Context Builder
   ↓
Model Router
   ↓
LLM (cloud / local / BYOK)
   ↓
Tool Execution (approved only)
   ↓
Terminal / Hosts / Snippets / MCP / History

AI surface

All AI UX lives under one experience:

Bastion AI
├── Ask AI
├── Explain
├── Fix
├── Analyze
├── Generate
├── Compare
├── Search Docs
├── Timeline
├── Incident Report
├── Infrastructure Memory
├── MCP
└── Settings

Trust and safety

Every AI-generated command must:

Explain what it will do.
Highlight risks.
Require explicit approval before execution.
Show exactly which terminal session or server it will affect.
Allow the user to inspect or edit the command before running.

Passwords, private keys, passphrases, and redacted env values never leave the machine or enter prompts by default. The full trust policy is in docs/ai/TRUST_AND_SAFETY.md in the desktop repo.

Providers

Mode	Examples	Notes
Cloud	OpenAI, Anthropic, Google, OpenRouter	BYOK preferred
Self-hosted	Ollama, LM Studio, vLLM	OpenAI-compatible path first
BYOK	Your own API key	Stored in the OS keychain

Waves

Wave	Codename	Outcome
A0	Foundation	Orchestrator, providers, trust shell, Ask / Explain / Fix on active session
A1	Context	Smart Context Engine + safe memory + command builders
A2	Agent tools	Approved command execution, compare sessions, log / error analyzers
A3	Ops	Timeline, incident reports, infrastructure compare packs
A4	MCP	First-party MCP client + curated connectors
A5	Platform	Workspaces, marketplace toolkit model, Enterprise path

Non-negotiables

Local-first: AI settings, memory, and conversation history stay on-device unless you opt into a cloud model.
No secret leakage: passwords, private keys, passphrases, and redacted env values never leave the machine or enter prompts by default.
Trust before execution: every AI-generated command must explain intent, highlight risks, name the target session or host, allow edit, and require explicit approval.
Reuse v1 surfaces: AI builds on existing hosts, sessions, snippets, palette, settings, SQLite, and keychain. It does not fork a second product.
Phase gates: do not start the next AI wave until the current wave's exit criteria pass.

← All docs Back to home