Skip to content

Releases

Bobbit v0.22.0

Bobbit v0.22.0 Latest
Latest

Choose a tag to compare

View all tags
@github-actions github-actions released this 17 Sep 16:10
Immutable release. Only release title and notes can be modified.
v0.22.0
6e0ff8d
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Upgrading from v0.21.0. This release protects every gateway with authentication by default, including local-only installations, while preserving an explicit loopback-only escape hatch.

✨ New Features

  • 🛡️ Secure local gateways by default: Gateway token authentication now applies to loopback binds as well as network-accessible hosts, preventing other local processes from reaching Bobbit without credentials. Trusted local development can explicitly opt out with the loopback-only --no-auth flag.

What's Changed

Full Changelog: v0.21.0...v0.22.0

Contributors

SuuBro
Assets 3
Loading

Bobbit v0.21.0

Bobbit v0.21.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 17 Sep 12:02
Immutable release. Only release title and notes can be modified.
v0.21.0
da000ff
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Upgrading from v0.20.0. This release adds explicit approval for project-defined MCP servers and trust confirmations for external locations, while strengthening verification security and package delivery.

✨ New Features

  • 🔌 Approval-gated project MCP servers: Repository-defined MCP processes and endpoints remain inactive until reviewed in Tools → MCP. Approvals track the exact configuration and worktree, reset when definitions change, redact credentials, and keep repository previews isolated from gateway authority.

  • 🛡️ Explicit trust for external locations: Bobbit now shows the exact path and security consequences before onboarding a project location or adding a Marketplace source, requiring deliberate confirmation and re-prompting when a project path changes.

🐛 Bug Fixes

  • ✅ Secure verification results: Verification callbacks are bound to the exact verifier session, late results remain safe during teardown, and HTML reports and workspace images are processed with strict file, size, and containment checks.

  • 📦 Reliable bundled search binaries: Platform packages for fd and rg now use the @gresearch scope, with stronger publish automation and registry-propagation retries to keep installs consistent.

  • 🏷️ Accurate npm package identity: Package metadata, licensing, and install documentation now consistently identify @gresearch/bobbit.

What's Changed

New Contributors

  • @mkb23 made their first contribution in #1313
  • @github-actions[bot] made their first contribution in #1317

Full Changelog: v0.20.0...v0.21.0

Contributors

mkb23, SuuBro, and pavlovic-ivan
Loading

Bobbit v0.20.0

Bobbit v0.20.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 10 Sep 09:04
Immutable release. Only release title and notes can be modified.
v0.20.0
dfe4e31
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Upgrading from v0.19.0. This release adds autonomous performance optimisation, GPT-6 Astra support, richer extension-pack capabilities, and resizable persistent side panels, while strengthening gateway security, responsiveness, tool resolution, and worktree recovery.

✨ New Features

  • ⚡ Autonomous performance optimisation: Install an opt-in optimisation programme with persistent Scanner and Director staff, disposable Ideators, deterministic code coverage, benchmark evidence, structured hypotheses, measured outcomes, and a live control panel for the full improvement loop.

  • 🤖 GPT-6 Astra and Pi 0.85.1: Select OpenAI Codex GPT-6 Astra through the existing OAuth flow, with model and thinking settings preserved across reloads and restarts. Streaming and compaction now use Pi 0.85.1 throughout the host and sandbox runtimes.

  • 🧩 More capable extension packs: Packs can make bounded, authenticated project reads for staff, sessions, goals, tasks, gates, pull requests, and detailed goal metadata. First-party packs can ship target-specific native assets, while dev:pack hot-reloads renderers and panels without losing the active workspace.

  • ↔️ Resizable persistent side panels: Resize side panels on desktop and keep those preferences across reloads. Eligible pack panes remain mounted across collapse, tab changes, and same-project session switches, preserving their live state on desktop and mobile.

🐛 Bug Fixes

  • 📱 Reliable Safari and QR connectivity: Safari and WebKit clients can open authenticated WebSocket sessions without weakening request admission, and Continue on Phone QR codes now load reliably from production bundles.

  • 🛡️ Safer gateway request admission: A single trusted Host, Origin, Fetch Metadata, CORS, and private-network policy now blocks DNS rebinding and malformed cross-origin requests while preserving authenticated clients, previews, extensions, reverse proxies, base paths, and development flows.

  • 🧰 Consistent tool resolution: Tool catalogues and running agents now use the same winning configuration for policies, providers, extensions, renderers, actions, and provenance, preventing scope overrides from producing mismatched or partially activated tools.

  • ⚡ More responsive busy gateways: Role configuration parsing is cached and worktree branch discovery is batched, removing main-thread hot loops that could slow gateways managing many packs, projects, or worktrees.

  • 🌳 Durable worktree pools: Bobbit-owned ready worktrees survive graceful gateway restarts and are safely re-adopted, while repeated shutdowns and project deletion drain pools without claiming external or live-session worktrees.

  • ⚙️ Immediate base-ref saving: Editing a project’s base branch now reveals Save on the first change while retaining validation.

What's Changed

Full Changelog: v0.19.0...v0.20.0

Contributors

ajonkisz and SuuBro
Loading

Bobbit v0.19.0

Bobbit v0.19.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 26 Aug 23:30
Immutable release. Only release title and notes can be modified.
v0.19.0
954e008
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Upgrading from v0.18.0. This release adds durable file attachments, searchable transcript navigation, smoother question handling, and broader enterprise Git host support, while strengthening AI Gateway migration and project-scoped tool routing.

✨ New Features

  • 📎 Attach any browser file: Upload arbitrary files while retaining specialized image and document handling. Large document context stays bounded, agents can read immutable attachment ranges on demand, and attachment identity survives queueing, retries, recovery, history, reloads, and sandbox handoff.

  • 🧭 Searchable transcript navigation: Move between prompts with segmented controls, search and filter conversation history, jump to unresolved questions, and return reliably to the latest message across desktop and mobile layouts.

  • 💬 Durable question handling: Dismiss an entire question card without waking the agent, while answered and unanswered state remains race-safe across reloads and appears consistently in sidebar indicators.

  • 🌐 Credential-aware enterprise PR status: Bobbit can read PR status from structurally valid GitHub Enterprise remotes vouched for by local Git credentials, without broadening destructive merge permissions or exposing ambient credentials.

🐛 Bug Fixes

  • 🤖 Safe AI Gateway migration: Verified legacy Bobbit AI Gateway provider blocks are adopted without rewriting user-owned JSONC. Live discovery and provider provenance are restored, and model-file permissions survive atomic updates.

  • 🧰 Project-correct agent tools: Tool discovery, policy, activation, delegation, replacement, and marketplace invalidation now consistently use the owning project, preventing server or another project’s tool configuration from leaking into a session.

  • 🗄️ Cleaner archived goal output: Agent-facing goal reads no longer include REST-only archived-session enrichment, keeping responses bounded while archived sessions remain available through the dedicated session tools.

What's Changed

Full Changelog: v0.18.0...v0.19.0

Contributors

SuuBro
Loading

Bobbit v0.18.0

Bobbit v0.18.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 24 Aug 12:12
Immutable release. Only release title and notes can be modified.
v0.18.0
0dd0075
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Upgrading from v0.17.0. This release adds in-place session promotion, fresh-context controls, richer Extension Host APIs, independent staff forks, clearer context limits, and stronger startup and team recovery.

✨ New Features

  • 🚀 Promote sessions to goals: Turn an active session into a Team Lead without changing its conversation, checkout, dirty files, branch, or sandbox. Promotion starts reliably after team setup and remains safe across retries and restarts.

  • 🧹 Fresh context with /clear: Start with an empty model-facing conversation while retaining the same session, worktree, configuration, and permissions. Previous messages remain available in expandable read-only history, and staff can clear context before inbox delivery.

  • 🪝 Unified Extension Host hooks: Extension packs can participate in typed lifecycle operations before commit or observe durable session, staff, goal, task, and gate events afterward, including through browser notifications and staff triggers.

  • 💾 Project-local extension data: Schema-2 packs can declare stable read-write directories shared across worktrees, restored sessions, agents, and sandboxes. Data remains intact when a pack is disabled or uninstalled.

  • 👥 Independent staff forks: Forking a staff session now creates a separate persistent staff identity with isolated configuration, triggers, inbox, authorization, and lifecycle ownership.

  • 📊 Clearer context capacity: Context meters distinguish the operating soft limit from the provider’s full model capacity, with a target marker and semantic usage zones without changing compaction behavior.

  • 🎭 Bobbit sprites for extensions: Extension UIs can create canonical animated Bobbit avatars through the Host API, with project-scoped identity resolution and automatic lifecycle cleanup.

🐛 Bug Fixes

  • ⚡ Faster, safer gateway recovery: Startup checkpoints avoid repeating completed migration and historical recovery work, while failed checkpoints and interrupted server-build promotions remain durable and retryable.

  • 🗄️ Archived teams stay archived: Sessions owned by archived goals no longer respawn after restart, and durable worktree ownership prevents premature cleanup or dangling team state.

  • ✅ Atomic goal validation: Goal proposals, edits, acceptance, and child creation now share canonical validation. Invalid or stale candidates leave no partial goals, workflows, gates, worktrees, or draft mutations behind.

  • 🧑‍💻 Promptable read-only delegates: Active read-only delegates can receive prompts while retaining their tool and mutation restrictions. Lifecycle and model-recovery state also remains accurate across refreshes and reconnects.

  • ⌨️ Command history preserves edits: Changes made while browsing previous composer commands are retained as you move backward and forward through history.

What's Changed

Full Changelog: v0.17.0...v0.18.0

Contributors

ajonkisz and SuuBro
Loading

Bobbit v0.17.0

Bobbit v0.17.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 19 Aug 09:59
Immutable release. Only release title and notes can be modified.
v0.17.0
ac079e9
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Upgrading from v0.16.3. This release adds a built-in file explorer, conversation forks, richer sidebar views, durable reviews and state storage, and major improvements to agent-turn reliability.

✨ New Features

  • 🗂️ Built-in file explorer: Browse files with read-only previews, Git decorations, working-tree diffs, editable breadcrumbs, filename search, changed-file filtering, path copying, and navigation to accessible directories.

  • 🧭 Project and status sidebar views: Switch between project and status groupings, pin sessions, filter unread and read work, collapse sections, and reveal the current session even when search, filters, or archived state hide it.

  • 🌿 Fork conversations from history: Copy historic prompts or fork a session immediately before a selected prompt, preserving the applicable transcript, model context, and working directory with an optional fresh worktree.

  • 📝 Grouped and durable Markdown reviews: Open multi-file reviews in one workspace with responsive file navigation. Reviews up to 10 MiB are stored as session-owned artifacts and reopen reliably after reloads and recovery.

  • 🔄 Reliable agent turns: The Pi runtime has been upgraded to 0.84.1 with durable prompt identities, FIFO delivery, restart and reconnect recovery, safer Stop handling, compact streaming, and clear delivery status for pending automation.

  • 🖼️ Session-local Markdown images: Assistant messages can render workspace images referenced by relative, absolute, or file:// paths through authenticated, session-scoped asset requests with traversal and size protections.

  • 💾 Durable SQLite state: Gates, goals, and tasks now use per-project SQLite storage, with transactional migration and recovery for existing JSON state.

  • 🧰 Focused agent read tools: Bobbit read operations now return compact, bounded summaries by default, support exact transcript inspection, and paginate larger gate and maintenance collections.

  • 👥 Improved staff controls: Staff sessions gain standard sidebar actions, while the editor now provides a full avatar preview, role and accessory selectors, named colours, clearer runtime details, and separate prompt and trigger controls.

  • 🏢 Configured Git host support: Hosts configured in gh are trusted consistently across PR status, merges, permissions, browser prompts, and PR Walkthroughs, improving GitHub Enterprise support without reading credentials.

🐛 Bug Fixes

  • ▶️ Safer goal and child-team startup: Paused goals remain paused across restarts, teams wait for verified worktree setup, and failed child starts use bounded retries instead of making the gateway unresponsive.

  • 🖼️ Reliable previews and panel tabs: Previews with spaces, Unicode, emoji, long names, and nested assets reopen correctly. Artifact-backed tabs avoid file races, overflow cleanly, and retain the selected tab after reload.

  • ✅ Explicit update API errors: Resource update endpoints now reject unsupported fields with actionable 400 responses instead of silently returning success without saving the requested change.

  • 📊 Accurate activity and dashboard state: Team-lead uptime, agent counts, session activity, and read state now remain accurate across lifecycle overlap, archival, replacement, and gateway restarts.

  • ⏹️ Force abort completes reliably: Escape and force-abort actions now fall back to persisted transcript state when the agent state RPC hangs, preventing sessions from remaining stuck in aborting.

  • 🔍 Reliable workflow verification dispatch: Verification phases run in a predictable order, reviewer prompts survive busy sessions and restarts, and duplicate or cancelled dispatches are handled exactly once.

  • ☁️ Bedrock-compatible agent tools: read_session, review_open, and MCP meta-tools now expose Bedrock-compatible schemas while retaining strict runtime validation and native argument support.

  • 🤖 Exact model metadata: Host, sandbox, restore, replacement, AI Gateway, and custom-model paths now use the authoritative effective model tuple instead of stale compatibility shims.

What's Changed

Full Changelog: v0.16.3...v0.17.0

Contributors

ajonkisz and SuuBro
Loading

Bobbit v0.16.3

Bobbit v0.16.3

Choose a tag to compare

View all tags
@github-actions github-actions released this 07 Aug 13:49
Immutable release. Only release title and notes can be modified.
v0.16.3
75ecb12
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Upgrading from v0.16.2. This release adds a command-line version flag and completes the automated release workflow fixes.

✨ New Features

  • 🏷️ Command-line version flag: Run bobbit --version or npx @gresearch/bobbit@latest --version to print the installed Bobbit version and exit without starting the gateway or creating configuration state.

🐛 Bug Fixes

  • 📦 Reliable GitHub release creation: The checkout-free release job now targets the repository explicitly, allowing it to create the GitHub release after npm publication and immutable tag creation.

What's Changed

Full Changelog: v0.16.2...v0.16.3

Contributors

SuuBro
Loading

Bobbit v0.16.2

Bobbit v0.16.2

Choose a tag to compare

View all tags
@SuuBro SuuBro released this 07 Aug 10:12
Immutable release. Only release title and notes can be modified.
v0.16.2
b2db2a6
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Upgrading from v0.16.1. This release fixes automated release completion.

🐛 Bug Fixes

  • 📦 Reliable release completion: Automated releases now handle a missing version tag correctly after npm publication, allowing the immutable source tag and GitHub release to be created as intended.

What's Changed

Full Changelog: v0.16.1...v0.16.2

Contributors

SuuBro
Loading

Bobbit v0.16.1

Bobbit v0.16.1

Choose a tag to compare

View all tags
@SuuBro SuuBro released this 07 Aug 09:48
Immutable release. Only release title and notes can be modified.
v0.16.1
718a6da
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Upgrading from v0.15.1. This release adds shared Git and PR status, URL subpath hosting, keyboard steering, clearer workflow guidance, and broad improvements to authentication, recovery, and performance.

✨ New Features

  • 🌐 Host Bobbit under a URL path: Gateways can now serve Bobbit under a path such as /bobbit, including the UI, API, sign-in, previews, and deep links. Use --base-path or BOBBIT_BASE_PATH, for example when adding Bobbit to a command centre.

  • 🔄 Shared Git and PR status: Sessions, goals, sidebar badges, and staff triggers now share the same GitHub state. Duplicate requests are combined and capped to reduce pressure on GitHub and gateway infrastructure. The last known state remains visible during temporary failures, with clear freshness and error indicators.

  • 🧭 Clearer workflow failure guidance: Workflow authors can add guidance for failed verification steps, giving Team Leads practical next steps when a check fails. Built-in workflows also produce more focused review findings and compare options during non-trivial design work.

  • ⌨️ Keyboard steering: Press Ctrl+Enter on Windows/Linux or Cmd+Enter on macOS to steer the active turn. Composer text and attachments are preserved if a session changes or preflight work is still finishing.

  • 🎀 Ponytail accessory: Staff and agent avatars can now use an animated centre-parted ponytail accessory in both full-size and inline views.

🐛 Bug Fixes

  • ▶️ Resume paused goals when starting a team: Starting a team now resumes an eligible paused goal automatically instead of failing. Repeated or simultaneous requests are handled safely.

  • 🔐 More reliable Anthropic sign-in: Anthropic OAuth now handles refresh, cancellation, logout, rejected requests, and concurrent credential access more safely. Renewable host credentials are still kept out of sandboxes unless explicitly enabled.

  • 🖼️ Reopen saved previews reliably: Previews now reopen correctly after a reload or transcript compaction. This also fixes preview files with spaces, Unicode, emoji, percent signs, long names, and nested assets.

  • ⚡ Faster sessions and UI: Search indexing, recovery, streamed replies, installed-PWA checks, and avatar animations now do less repeated work. Pack scans are cached, and the launchers provide a configurable 8 GiB Node memory ceiling for larger workloads.

  • 🔄 Better session and workflow recovery: Workflow drafts and server-created IDs now survive delayed saves. Interrupted prompt queues can resume or show a clear Retry action, and restarted sessions keep provider, model, and thinking selections consistent.

  • 🛡️ Safer background work and configuration: Project and sandbox settings are written atomically and failures are reported clearly. Background jobs and verification steps now recover more reliably after restarts and include their final output before reporting completion.

  • 🌐 Cross-origin saves: Remote gateways and cross-origin reverse proxies now accept authenticated PATCH requests, so side-panel state and other settings save correctly without weakening trusted-origin checks.

  • 🧱 Protect user-managed worktrees: Startup and shutdown no longer repair or remove manually managed worktrees. Cleanup only removes archived session worktrees owned by the current Bobbit instance.

What's Changed

Full Changelog: v0.15.1...v0.16.1

Contributors

ajonkisz, SuuBro, and 2 other contributors
Loading

Bobbit v0.15.1

Bobbit v0.15.1

Choose a tag to compare

View all tags
@SuuBro SuuBro released this 29 Jul 16:29
Immutable release. Only release title and notes can be modified.
v0.15.1
f4f8137
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Bobbit v0.15.1

Upgrading from v0.15.0. This release adds Claude Opus 5 support and dedicated verifiable bug reviews, while improving model-selection and multi-repository Git status reliability.

✨ New Features

  • 🤖 Claude Opus 5 & Pi 0.82.1: Bobbit now exposes Claude Opus 5 through the authoritative Pi model catalog. Provider, model, and thinking-level selections travel together through sessions, delegates, team workers, restarts, and recovery, with safe rollback when a requested runtime tuple cannot be verified.

  • 🔍 Verifiable bug-hunt reviews: Built-in implementation workflows now include a dedicated read-only reviewer focused on reproducible bugs in the current branch diff.

🐛 Bug Fixes

  • 🧩 Accurate polyrepo Git status: Goal and session widgets now retain named component repositories, aggregate partial results conservatively, survive team-lead restart recovery, and avoid hiding valid component status when the project container itself is not a Git repository.

🤖 Generated with Bobbit

Loading