Bastion AI · in 1.1.0

The AI Infrastructure Workspace.

Ask, Fix, and Plan are in 1.1.0. Fix and Plan show proposed commands and wait for approval before those commands run. The other modes on this page are design notes.

Download Read the AI docs Contact
Bastion Terminal · workspace
Harbor GateContabo Server
DeployFilesPort forwardsDisconnectSplitSplitClose pane
SSH · Contabo Serverconnected
Usage of /:            35.8% of 192.69GB
Memory usage:          10%
Swap usage:            0%
Processes:             181
Users logged in:       1
IPv4 address for eth0: 10.2.44.18

59 updates can be applied immediately.
To see these additional updates run: apt list --upgradable

8 additional security updates can be applied with ESM Apps.

Welcome.
This workspace is a local demo. Questions: ops@example.com

Last login: Tue Oct 27 11:24:32 2026 from 10.8.12.4

root@workshop-01:~$
SSH liveDesktop bridge is ready5 hosts2 groups
Conceptual illustration of the workspace and AI panel. Host data is fictional. The mode picker below shows example replies, not a live model.
Modes

One assistant. Many modes.

Every AI surface lives under one experience. The mode picker changes the shape of the response. The trust pipeline, Plan Card, and approval gate stay the same.

  • Ask is the question mode in 1.1.0.
  • Fix and Plan show proposed commands and wait for approval before those commands run.
  • Explain, Analyze, and Compare are design notes. They are not separate modes in the reviewed source.
  • Production targets get step-by-step approval by default, batch only for non-prod.
Bastion AI · fix mode
Bastion AI
Infrastructure copilot
3 secrets redacted·provider: ollama
Why is nginx returning 502 on Harbor Gate?
You
Looking at the last 200 lines of /var/log/nginx/error.log on Harbor Gate. 502s started at 14:02 UTC, upstream connection refused to 127.0.0.1:9000. Likely php-fpm.
Diagnose 502 on Harbor Gate
Low risk
Harbor Gate·session 8c0d44a·3 steps
  1. 1systemctl status php8.3-fpm
  2. 2journalctl -u php8.3-fpm -n 50
  3. 3ss -lntp | grep 9000
Ask about this host, output, or error…
Context: 200 lines, host metadata, distro⌘⏎ to send
Interactive
Click any mode in the panel to see that mode's response shape.
Trust shell
Every response goes through context redaction, plan-card approval, and the same audit log.
No silent runs
If the model can't show you what it wants to do, it doesn't get to do it.
Mode catalog

The full surface.

Build is in the source. Note is a design item.

Ask

Questions with session and host context.

Build

Fix

Propose fixes. Commands wait for approval.

Build

Plan

A proposed command plan. Approval before it runs.

Build

Explain

Explain commands, errors, configs, output.

Note

Analyze

Logs, traces, resource and health analysis.

Note

Generate

Commands, snippets, regex, cron, SQL, K8s, Docker.

Note

Compare

Hosts, configs, packages, containers, env, disk.

Note

Search Docs

Local runbooks and optional remote or MCP docs.

Note

Timeline

Session timeline and replay aids.

Note

Incident Report

Structured RCA, export to MD or PDF, share.

Note

Infrastructure Memory

Per-host and per-workspace durable notes.

Note

MCP

Client code is in the development source. It is not a panel mode, and it was not run in this audit.

Note

Providers

OpenAI, Anthropic, Gemini, OpenRouter, or a compatible endpoint.

Build
Quick command

⌘J. Plain English to a command.

Type what you want in the active session. The AI generates a command, shows the risk, and inserts it on approval. Read-only commands skip the Plan Card.

  • Reads the active session's prompt, scrollback, and host metadata.
  • Generates, then runs only after explicit Insert & run.
  • Edit before run. Regenerate with one click. Copy to clipboard.
Bastion AI · quick command
⌘J
Prompt
"find the top 5 IPs hitting /api/v1/login in the last hour"
Generated
low risk
$ grep -E 'POST /api/v1/login' /var/log/nginx/access.log \
| tail -n 5000 | awk '{print $1}' | sort | uniq -c | sort -rn | head -5
Read-only · 0 secrets detected · target: Contabo Server
Timeline · Harbor Gate
session 8c0d44a
  1. 14:02:11AI · Fix modeapproved
    Plan: 3 steps · target Harbor Gate
  2. 14:02:13Step 1/3
    systemctl status php8.3-fpm
  3. 14:02:14Step 2/3
    journalctl -u php8.3-fpm -n 50
  4. 14:02:15Step 3/3
    ss -lntp | grep 9000
  5. 14:03:02AI · Analyze
    Pulled 1000 lines nginx access log
  6. 14:04:40Incident reportedited
    Generated · 3 sections · 14:04:40
6 events · 12 min window
Timeline

Every action, on the record.

A session timeline, Markdown or PDF export, and permalink sharing are design notes. They were not found as shipped features in the development source.

  • Decisions are tagged approved / edited / rejected for fast skim.
  • Export the timeline to Markdown or PDF for an incident report.
  • Share a permalink to the timeline with a teammate (local share only).
Trust

Trust is the product.

Every AI-generated command must:

  1. 1. Explain what it will do.
  2. 2. Highlight risks.
  3. 3. Require explicit approval before execution.
  4. 4. Show exactly which terminal session or server it will affect.
  5. 5. Allow inspection or editing of the command before running.

The 1.1.0 builds a redacted context pack before a provider call. Redaction has not been independently audited. The question and attached context are sent to the provider you choose.

bastion.ai plan card
Plan: 3 steps · Target: Harbor Gate · Risk: medium

  1. systemctl status php8.3-fpm
  2. journalctl -u php8.3-fpm -n 50
  3. systemctl restart php8.3-fpm

  Approve all   [Edit]   [Step-by-step]   [Reject]
Providers

Cloud, self-hosted, or bring your own key.

Local and BYOK users are first-class, not second-class to a Bastion-hosted cloud.

Cloud

OpenAI, Anthropic, Google, OpenRouter. Opt-in.

Compatible endpoint

An OpenAI-compatible URL is in the source. Named local runtimes are not a separate integration.

BYOK

Bring your own API key, stored in the OS keychain.

Waves

Six ordered waves from foundation to platform.

Each wave has explicit exit criteria. The next wave does not start until the current one passes.

A0 Foundation
In the build

Ask, Fix, and Plan, plus the providers above, are in 1.1.0.

A1 Context
Planned

Smart Context Engine · safe memory · command builders.

A2 Agent tools
Planned

Approved command execution. Compare sessions. Log and error analyzers.

A3 Ops
Planned

Session timeline, incident reports, infrastructure compare packs.

A4 MCP
Planned

First-party MCP client + curated connectors.

A5 Platform
Planned

Workspaces, marketplace toolkit model, Enterprise path.

Be there for the first wave.

Ask, Fix, and Plan are in 1.1.0. Linux and Windows installers are on the download page. Questions are sent to hello@bastionterminal.com. This site does not store the message.

Contact