bailout: a tiny coding agent you install, use, then delete

What bailout is

bailout is an open-source command-line tool on GitHub (repository storozhenko98/bailout). Its README describes it as "the harness meant to be deleted". The idea is simple. You sit at a fresh virtual machine or a new Mac with no GitHub CLI, no configured coding agent and no API key. Or your usual agent has broken, and you need a working one to fix it. bailout gives you a small, independent harness in one command. You use it to bootstrap the machine or repair your setup, you go back to your normal tools, and then you delete it.

The install is two lines: `curl -fsSL https://bailout.dev/install.sh | bash`, then `bailout`. The README says you need no account, no local API key, no Git, no Node, no Python and no existing agent. It lists Apple Silicon macOS, x64 Linux and ARM64 Linux as supported platforms. You bring Bash, curl, internet access and the usual base utilities, including tar and a SHA-256 utility.

Key facts from the README

The README names three situations. The first is a clean slate: boot an EC2 instance, a GCP VM or a new Mac, and ask bailout to inspect the machine, install missing tools, help you sign in to GitHub, clone your repo and get Codex, Claude Code, Pi or OpenCode ready. The second is a broken setup: a config is malformed, a runtime moved, or an update broke something. Then bailout inspects what changed, backs up the config, repairs it and verifies that your main tool works. The third is a quick exit. The useful outcome is your usual setup working again, so bailout has no daemon, no account setup, no persistent conversation store and no project scaffolding. The size is a selling point. The README states that bailout is one native binary of 638.6 KB on Apple Silicon in v0.7.3, and that every release stays under 6,000,000 bytes. Its table of v0.7.3 assets lists 638,592 bytes for macOS ARM64, 844,576 bytes for Linux x64 and 790,784 bytes for Linux ARM64. The downloads are smaller: 318,119, 417,262 and 397,031 bytes as .tar.gz files. Linux releases are statically linked with musl. The project has three direct Rust dependencies: `serde_json`, `libc` and `rustyline`. System curl handles TLS, and Bash does everything the model does. Bash is the only model tool. Commands run automatically with your account's permissions, including file changes, package installation and network access. The README says plainly that this is not a sandbox. The agent is instructed to inspect first, preserve a working setup, back up configuration before repair and verify the result. Inside a session you have a few commands: `/shell` opens a local Bash, `/last` expands the last command's output, `/new` starts a fresh conversation, and `/help` and `/exit` do what they say. Each Bash call starts a fresh shell, so shell state does not persist. Ordinary commands time out after two minutes, interactive ones after ten, and models can ask for up to thirty. The default limit is 50 model steps.

Sign-in stays with you. bailout provides its own free inference, but the tools it sets up use your own accounts and credentials. For sign-in, sudo or key entry, the Bash tool can hand you the real terminal with `interactive: true`, and that command's input and output are not captured for the model. Only the exit status returns. When you are done, `bailout uninstall` removes only the running bailout binary. The tools you installed, the repositories you cloned and the configs you repaired stay in place.

How the free inference works

The README spends most of its length on one claim: "free means zero". A hosted FastAPI service on Cloudflare Python Workers holds the provider keys, and the client never receives them. For every model request, the OpenRouter adapter fetches a fresh catalog, requires an explicit `:free` model with native tool support and zero in every pricing field, checks the model's endpoints for zero prices and at least 95% reported uptime, and sends the request only to the verified endpoints with `allow_fallbacks: false` and a hard zero `max_price`. It also rejects arbitrary routing overrides, provider keys, plugins, multimodal content and any tool other than Bash. The README states that no paid inference fallback exists. It adds that the app depends on OpenRouter honoring its published prices and routing contract.

Models enter production only after they pass the project's own setup-and-repair benchmark: at least 80% success on a ten-task run, native Bash calls and no critical failures. Adapters also exist for Groq, Mistral, Z.AI and Vercel AI Gateway, each with its own free-eligibility rules. The public gateway limits each IP to 60 requests per minute, 600 per hour and 2,000 per day, with a globally shared allowance on top. The README calls free capacity shared and best effort.

Our analysis

The design is a deliberate inversion of the usual agent product. Most coding agents want to become your daily tool. bailout wants to be the tool you reach for when the daily tool is missing or broken, which is a real chicken-and-egg problem: you need an agent to fix your agent. Keeping the binary under one megabyte, avoiding any account and using hosted free inference removes the prerequisites that a broken machine cannot meet. Our reading is that the tiny size is not vanity. It serves the "delete it afterwards" promise, because a small artifact is easy to trust, fetch and discard.

The trade-off is trust. Because inference is hosted, the README says prompts, model-selected file contents and captured Bash output pass through the hosted Worker to the chosen provider. It notes that free does not mean zero data retention and that provider data policies apply. The Worker does not store conversations or log request bodies, but the gateway keeps short-lived daily IP hashes, quota reservations and cooldowns. The README also warns you not to paste credentials into chat or ask the agent to print secret files.

Risks and open questions

Three limits stand out. First, the README itself says commands run automatically and that this is not a sandbox, so a model mistake can change a real machine. Second, the install method pipes a script from the network into Bash. The README describes checksum verification, an atomic install, a size check and no use of sudo, but you still choose to trust the project and its domain.

Third, each launch checks for a newer stable release and, from v0.4.0, updates itself unless you set `BAILOUT_NO_UPDATE=1`. That is convenient, but it means the binary can change between runs. We only read the README. We did not run the tool, so all claims about behavior and benchmarks are the author's.

Practical takeaways

If you manage throwaway cloud machines, this is worth a look as a bootstrap step. Start with a narrow prompt such as the README's example about a tool that stopped launching after a config change. Use `/shell` or the interactive handoff for logins.

Never type secrets into the chat. Read the privacy section before sending anything sensitive, and run `bailout uninstall` when the job is done. If you need a separate quota, the README explains how to host your own router with `BAILOUT_API_URL`, which requires Cloudflare Workers Paid for the Python API or your own server running Uvicorn.