Get in.
Get unstuck.

Install & update

Apple Silicon macOS, x64 Linux, or ARM64 Linux. You need Bash, curl, tar, and a SHA-256 utility. No Node, Python, account, or API key is needed on your machine.

From v0.4.0, bailout checks for a newer stable release at startup, verifies its SHA-256 checksum, installs it atomically, and restarts with the same arguments. A failed update leaves the existing version usable. Run bailout update to check manually, or set BAILOUT_NO_UPDATE=1 to opt out. Older versions need the installer once to gain auto-updates. The same install command also updates an existing installation. The installer verifies the release checksum and replaces the binary atomically. It never uses sudo. If the install directory is missing from PATH, it prints the command to add it.

Prefer to inspect first? Read the installer or download a release. All three native binaries are under 1 MB in v0.4.0.

Tiny, measured.

Sizes from the published v0.4.0 release, verified against its SHA-256 checksums. The native executable is the installed size; the download is a gzip-compressed tar archive. No language runtime is bundled or installed.

Setup & recovery

Fresh machine: boot your VM or open your new Mac, install bailout, and describe the setup you want. It can inspect the machine, install missing dependencies, help you sign in, and get your preferred tools running.

bailout

› this is a fresh Ubuntu VM. set up gh and OpenCode
› help me clone my repo and install its dependencies

Broken main agent: use bailout as an independent way to diagnose and repair it. Ask it to preserve your settings, make a backup, and check that your usual tool starts again.

bailout 'pi stopped launching after a config change. help me repair it'

Ordinary questions get direct answers. When work is needed, Bash runs automatically. Commands and output previews appear as the agent works. Use /new for a fresh conversation; closing bailout discards the session.

Sign in, outside the chat

Bailout needs no local account or API key. The tools you set up still need your own accounts, subscriptions, or keys where applicable.

The agent can run Bash with interactive: true to give a login flow, password prompt, or installer your real terminal. That command’s input and output stay outside the model conversation; only its exit status is returned. You can also type /shell for local Bash, then exit to return.

For example, GitHub CLI’s sign-in flow can run in this handoff. Complete authentication yourself. Don’t paste credentials into the bailout prompt or ask the model to print secret files.

Interactive handoff needs a terminal. For setup involving sign-in, run bailout interactively instead of piping a prompt.

Back to your tools. Then delete it.

Once your normal setup works, launch your usual agent. Remove bailout whenever you’re done:

bailout uninstall

This removes only the bailout executable. Your installed tools, cloned repositories, repaired configuration, and credentials stay in place. There is no bailout daemon or saved conversation directory to clean up. The same curl command brings it back when you need it.

Keys & commands

--model vendor/name:free pins a model. --max-steps 100 changes the default limit of 50 model steps. NO_COLOR=1 disables colors.

Free-only routing

The default, auto, chooses from explicit :free models with Bash tool support and healthy providers. Ranking uses model descriptions, coding specialism, reasoning support, and context length. It is a transparent metadata heuristic, not a benchmark leaderboard.

1. Before every inference, fetch current model prices and require zero in every reported pricing field.
2. Check current provider endpoints: zero prices, tool support, operational status, and at least 95% reported uptime over the last 30 minutes and the last 5 minutes when reported.
3. Send only verified providers, disable upstream fallback, and set a zero-price cap.
4. In auto mode, retry eligible provider failures on at most three separately verified free models. A pinned model stays pinned.

Unknown prices fail closed. No paid fallback exists. Free quotas and availability still apply; the public service is shared and best effort. A rate limit means waiting or using your own backend, not paying to bypass the limit.

Read the routing policy, OpenRouter limits, or the live model list.

Shared capacity, clear limits.

The public service allows 30 API requests per minute, 300 per hour and 1,000 per UTC day per IP address. IPv6 addresses share their /64 limit; people on the same NAT share a limit. Across the service, chat is limited to 18 requests per minute. OpenRouter’s free quotas can be lower.

If hosting capacity is exhausted, bailout stops new model requests and explains when capacity begins returning. It does not charge you or switch to a paid model. The homepage and installer stay available.

HTTP 503
code: budget_exhausted
error: Bailout's shared hosting allowance is exhausted.
retry_after_seconds: …
resets_at: …

Downstream clients should display the error and stop automatic retries. HTTP 429 with client_rate_limited or capacity_busy means waiting for the Retry-After delay. An operator pause uses service_paused. Existing CLI versions display these messages too.

The operator targets $50/month using a $35 conservative processing allowance, $5 plan fee and $10 headroom. Each request reserves its maximum configured processing cost before it runs. The allowance covers a rolling 31 days and returns gradually as reservations expire. This is an application cutoff, not a guaranteed Cloudflare invoice cap; rejected traffic, other account services and taxes can still cost money.

Live capacity status · Full error contract and hosting policy ↗

Just the totals.

The homepage counts binary downloads and model requests, without analytics cookies, installation IDs, location analytics, or extra telemetry calls from the CLI.

Downloads come from GitHub’s public counts for the three supported binary archives across stable releases. They include updates, repeat downloads and testing—not unique users or verified installations. Checksums and source archives are excluded.

Requests processed counts hosted chat requests accepted by the backend. A stream counts when accepted and may still fail later. Client retries count separately; model lists, page views, rejected requests and self-hosted traffic do not. Request counting began on September 17, 2026; earlier requests cannot be recovered. The public endpoint reports the exact starting time as requests.since.

Visible pages refresh every minute; request totals usually lag by up to two minutes, while GitHub counts refresh every 15 minutes and may lag at the source. A green dot means a fresh snapshot, not guaranteed model availability. When data is stale or unavailable, the dot dims; we keep the last known count or show a dash. Hover over a total for its exact number and update time.

The stored statistics are a request total, a starting timestamp, and public download counts. They survive deployments and don’t reset monthly. There is no prompt or per-request event log. Separate abuse protection still uses short-lived daily IP hashes as described below. GitHub and Cloudflare receive normal connection metadata, and model-provider data policies still apply.

View the public totals as JSON · Counter definitions and source ↗

Permissions & privacy

Bailout is full auto. Bash runs immediately with your user’s permissions, including file changes, programs, and network access. It is not a sandbox. For isolation, use a container or disposable environment.

Each Bash call starts a fresh shell in the session directory, unless the model specifies a working directory. Shell variables and cd do not persist across calls. Ordinary commands default to two minutes; interactive commands default to ten. Models can request up to thirty.

Prompts, model-selected file contents, and captured tool output pass through the hosted FastAPI service to OpenRouter and the selected model provider. Their data policies apply. The application does not save conversations or log request bodies. The gateway stores aggregate quota counters and daily IP hashes that expire after the following UTC day; hashes are pseudonyms, not anonymization. Cleanup runs on subsequent traffic, and Worker observability is disabled. The service key stays on the server.

Use Ctrl-C to cancel a running request or kill the Bash process group, including pipelines. Cancellation cannot undo changes already made.

Host your own

The API is real FastAPI on Cloudflare Python Workers. Hosting it yourself separates your OpenRouter quota from the public service. The same free-only policy still applies. You need Python 3.13+, a current uv (0.12.3+), and Node for Wrangler.

On Cloudflare, use Workers Paid: the Python API exceeds the Free plan’s 10 ms CPU allowance, which can cut replies short. Hosting starts at $5/month plus usage, separate from the zero-cost model routing. Check current pricing and CPU limits. You can also run this FastAPI app on an existing server with Uvicorn.

git clone https://github.com/storozhenko98/bailout
cd bailout/api
uv sync
uv run pywrangler login
uv run pywrangler deploy
uv run pywrangler secret put OPENROUTER_API_KEY

Choose a unique Python Worker name in api/wrangler.jsonc and keep it private. Configure your domain and Python service binding in worker/gateway.wrangler.jsonc, then deploy the gateway from worker with npm ci && npx wrangler deploy --config gateway.wrangler.jsonc. Point the website’s API binding at that gateway. Keep Python’s workers.dev and preview URLs disabled. Read the operating instructions before hosting. Enter the key at the secret prompt; never commit it. Then point the client at your API:

export BAILOUT_API_URL=https://api.your-domain.example
bailout

For local development, uv run uvicorn app:app --app-dir src --reload serves FastAPI directly. Set OPENROUTER_API_KEY in your environment. uv run pywrangler dev tests the Cloudflare runtime; it reads a gitignored .dev.vars file.

Interactive API docs ↗ · Source and development guide ↗

When something stops

Free capacity is busy: wait briefly, then try again. Use /model to check availability or choose another model.

Context is full: use /new and describe the remaining work. Long outputs are bounded to keep requests small.

A model stops early: inspect the actual changes, then ask it to continue or switch models. Free models differ in reliability; check that the tool you repaired actually starts and works.

Found a bug? Open an issue with your platform, bailout --version, and a minimal reproduction. Remove secrets from any output you share.