LANCET NanoA local classifier that flags risky shell commands before an agent or a person runs them.

Until v0.4.2 the Triage Score used lancet-bench-1 (793 Bash commands). The best guards were close to its ceiling (Jev caught 96.8% of its risky commands, v0.4.2 92.4%), and it was narrow: Bash only, short single-line commands, a quarter of them about secrets.

From v0.4.3 the Triage Score uses lancet-bench-2-next, a new, much more comprehensive benchmark that no LANCET release was trained, tuned or calibrated on. Because it is much harder, every guard scores lower than before, LANCET and comparators alike: v0.4.2 scored 82.7 under the previous Triage Score and 54.4 under the new one. The model did not change; the test did. Scores are only comparable on the same benchmark.

• 3,204 commands built as 1,602 risky/safe twins. Every risky command has a safe look-alike that differs only in the detail that decides the risk, such as reading a secret's expiry date instead of its value.
• 289 scenarios in 40 areas: cloud CLIs, Kubernetes, databases, Git and CI, containers, credentials, filesystems and backups, infrastructure as code, deceptive previews, encoded input, shell quoting, expansion, redirection and control flow, language runtimes, messaging, remote execution, macOS and Windows administration.
• Composition: every scenario is repeated inside a subshell, a function, a command substitution, a nested bash -c, a pipeline and a background job.
• Three shells: 3,066 Bash, 102 PowerShell and 36 cmd commands; 1,803 are multi-line (lancet-bench-1 had none).
• lancet-bench-1 is retired, now part of LANCET's training data, and stays published. lancet-bench-2-next is kept private so it stays an unseen test.

# 1. verify the download, then the bundle
certutil -hashfile lancet-v0.4.3-nano-cpu-int8.zip SHA256
python verify_bundle.py --strict

# 2. install three pinned CPU dependencies
python -m venv .venv
.\.venv\Scripts\python.exe -m pip install -r requirements.txt

# 3. classify (JSON lines in, JSON lines out)
$env:OPENBLAS_NUM_THREADS = '1'
'{"command": "terraform destroy -auto-approve", "shell": "bash"}' |
  .\.venv\Scripts\python.exe classify.py --model model
'{"command": "Stop-Computer -Force", "shell": "powershell"}' |
  .\.venv\Scripts\python.exe classify.py --model model

{"score": 0.992, "classification": "risky", "reason": null,
 "experimental": true, "executionAuthorized": false, ...}
{"score": 0.989, "classification": "review", "reason": "uncertainty-band",
 "experimental": true, "executionAuthorized": false, ...}

• Python 3.12 with NumPy, tokenizers and ONNX Runtime CPU. No PyTorch, no GPU, no API key.
• shell is bash, powershell or cmd.
• Keep one process running and stream commands to it; the model loads once.
• Commands are read as text and never executed. Long commands are read in full, one 512-token window at a time.
• On macOS or Linux, use .venv/bin/python. Those platforms were not benchmarked.
• If you clone instead of downloading the ZIP: install Git LFS, run git lfs pull, and use bundle/.

v0.4.3 is the Salesforce CodeT5+ 220M encoder, fine-tuned from its pinned upstream weights with no earlier LANCET checkpoint, plus a small pooling head that reads long commands as overlapping windows. Training ran to convergence (cosine learning-rate decay to zero). Its labels come from project authoring, documentation and source datasets, not from another model's opinions:

• Command-semantics curriculum (new): project-authored risky/safe twins for Bash, PowerShell and cmd, including long multi-line scripts.
• tldr-pages: each example's one-line description sets the label. "Delete a specific pod" is risky; "List all volumes" is benign.
• AWS botocore: the operation verb, plus AWS's own sensitive markings on returned fields, so commands that print credentials are risky.
• Azure CLI, GitHub CLI, kubectl, Docker CLI reference examples, labelled by verb and description.
• ShellRisk-Bench training split: attack-technique commands from Atomic Red Team and InternalAllTheThings, and everyday developer commands from SWE-smith and Terminal-Bench, with their upstream labels.
• Shell Safety v2 training split (MIT): agent-session shell commands with their author's allow/deny labels.
• LANCET's project-authored risky/safe pairs, contrast sets, a secrets family, earlier evaluation suites and the retired lancet-bench-1 (original labels).

No language model, hosted API or human labeler produced any training label.
Development and calibration used tools and families held out from training.