Bobbit v0.16.1

Upgrading from v0.15.1. This release adds shared Git and PR status, URL subpath hosting, keyboard steering, clearer workflow guidance, and broad improvements to authentication, recovery, and performance.

✨ New Features

• 🌐 Host Bobbit under a URL path: Gateways can now serve Bobbit under a path such as /bobbit, including the UI, API, sign-in, previews, and deep links. Use --base-path or BOBBIT_BASE_PATH, for example when adding Bobbit to a command centre.

• 🔄 Shared Git and PR status: Sessions, goals, sidebar badges, and staff triggers now share the same GitHub state. Duplicate requests are combined and capped to reduce pressure on GitHub and gateway infrastructure. The last known state remains visible during temporary failures, with clear freshness and error indicators.

• 🧭 Clearer workflow failure guidance: Workflow authors can add guidance for failed verification steps, giving Team Leads practical next steps when a check fails. Built-in workflows also produce more focused review findings and compare options during non-trivial design work.

• ⌨️ Keyboard steering: Press Ctrl+Enter on Windows/Linux or Cmd+Enter on macOS to steer the active turn. Composer text and attachments are preserved if a session changes or preflight work is still finishing.

• 🎀 Ponytail accessory: Staff and agent avatars can now use an animated centre-parted ponytail accessory in both full-size and inline views.

🐛 Bug Fixes

• ▶️ Resume paused goals when starting a team: Starting a team now resumes an eligible paused goal automatically instead of failing. Repeated or simultaneous requests are handled safely.

• 🔐 More reliable Anthropic sign-in: Anthropic OAuth now handles refresh, cancellation, logout, rejected requests, and concurrent credential access more safely. Renewable host credentials are still kept out of sandboxes unless explicitly enabled.

• 🖼️ Reopen saved previews reliably: Previews now reopen correctly after a reload or transcript compaction. This also fixes preview files with spaces, Unicode, emoji, percent signs, long names, and nested assets.

• ⚡ Faster sessions and UI: Search indexing, recovery, streamed replies, installed-PWA checks, and avatar animations now do less repeated work. Pack scans are cached, and the launchers provide a configurable 8 GiB Node memory ceiling for larger workloads.

• 🔄 Better session and workflow recovery: Workflow drafts and server-created IDs now survive delayed saves. Interrupted prompt queues can resume or show a clear Retry action, and restarted sessions keep provider, model, and thinking selections consistent.

• 🛡️ Safer background work and configuration: Project and sandbox settings are written atomically and failures are reported clearly. Background jobs and verification steps now recover more reliably after restarts and include their final output before reporting completion.

• 🌐 Cross-origin saves: Remote gateways and cross-origin reverse proxies now accept authenticated PATCH requests, so side-panel state and other settings save correctly without weakening trusted-origin checks.

• 🧱 Protect user-managed worktrees: Startup and shutdown no longer repair or remove manually managed worktrees. Cleanup only removes archived session worktrees owned by the current Bobbit instance.

What's Changed

• Harden exact tuple transitions by @SuuBro in #1065
• Require comparative design exploration by @SuuBro in #1066
• Collect the release notes into CHANGELOG.md by @dev-milos in #1067
• Clarify answered question cards by @SuuBro in #1069
• Port caret fix patch by @SuuBro in #1070
• Stabilize test runtime by @ajonkisz in #1071
• Support runtime subpath mounting by @SuuBro in #1072
• Fix Anthropic OAuth by @SuuBro in #1073
• Ctrl/Cmd+Enter steers the active turn by @SuuBro in #1074
• docs: use main / primary branch instead of master by @SuuBro in #1075
• Isolate maintenance command runners by @ajonkisz in #1078
• Consolidate review workflows by @ajonkisz in #1079
• Fix review stage ownership by @ajonkisz in #1086
• Cache TypeScript checks by @SuuBro in #1090
• Fix workflow and session races by @ajonkisz in #1076
• Canonicalize cross-platform path identity by @ajonkisz in #1077
• Guarantee terminal output drain by @ajonkisz in #1080
• Harden exact process ownership recovery by @ajonkisz in #1089
• Stabilize native POSIX cleanup probe by @ajonkisz in #1087
• Surface Hindsight queue persistence loss by @ajonkisz in #1091
• Load extension hook metadata by @ajonkisz in #1081
• Harden project config persistence by @ajonkisz in #1092
• Recover externally aborted prompt queues by @ajonkisz in #1093
• Guard background process spawns by @ajonkisz in #1094
• Stabilize tier-1 unit CI flakes by @ajonkisz in #1095
• Fix Windows verification supervisor completion by @SuuBro in #1097
• Reduce CodeQL PR noise via threat-model-scoped config by @pavlovic-ivan in #1098
• Stabilize Windows base-path unit gate by @SuuBro in #1111
• Expose lifecycle hook scope context by @ajonkisz in #1099
• Harden Hindsight durable reads by @ajonkisz in #1106
• Fix session connection timeouts by @ajonkisz in #1110
• Qualify cross-OS test reliability by @ajonkisz in #1096
• Resume paused goals on explicit team start by @ajonkisz in #1101
• Fix preview reopen snapshot lookup by @ajonkisz in #1112
• Coordinate remote state by @SuuBro in #1109
• Fix remote freshness and PR status display by @SuuBro in #1115
• Fix streaming transcript render storm by @SuuBro in #1116
• Cut PWA animation wakeups by @SuuBro in #1118
• Trustworthy affected test gate by @SuuBro in #1114
• Reduce Windows unit I/O by @SuuBro in #1117
• Fix lossless compact preview reopening by @ajonkisz in #1113
• Restore CI checks and prevent false session errors by @SuuBro in #1121
• Release on merge: publish, tag, and GitHub release from CI by @dev-milos in #1063
• Add workflow failure guidance by @SuuBro in #1119
• Test release validator boundaries by @SuuBro in #1120
• Document immutable release tags by @SuuBro in #1122
• Remove runtime audits from releases by @SuuBro in #1124
• Fix browser release gate races by @SuuBro in #1131
• Stabilize unit release gates by @SuuBro in #1134
• Add ponytail Bobbit accessory by @SuuBro in #1135
• fix(test): remove in-worktree node_modules junction footgun from browser-chaos by @SuuBro in #1136
• docs: prohibit junctioning node_modules into a shared/primary tree by @SuuBro in #1137
• Cache pack manifest scans by @SuuBro in #1140
• Preserve manually managed worktrees by @SuuBro in #1132
• Improve agent guidance and Node memory by @SuuBro in #1142
• Match New Session plus accent by @SuuBro in #1144
• Fix Gateway Event Lag by @SuuBro in #1133
• Revert "Fix Gateway Event Lag" by @SuuBro in #1147
• Make cross-origin PATCH requests work by @ajonkisz in #1123
• chore(release): v0.16.0 by @SuuBro in #1148
• fix(release): recover failed v0.16.0 publish by @SuuBro in #1149
• chore(release): v0.16.1 by @SuuBro in #1151

Full Changelog: v0.15.1...v0.16.1