Bobbit v0.21.0

Upgrading from v0.20.0. This release adds explicit approval for project-defined MCP servers and trust confirmations for external locations, while strengthening verification security and package delivery.

✨ New Features

• 🔌 Approval-gated project MCP servers: Repository-defined MCP processes and endpoints remain inactive until reviewed in Tools → MCP. Approvals track the exact configuration and worktree, reset when definitions change, redact credentials, and keep repository previews isolated from gateway authority.

• 🛡️ Explicit trust for external locations: Bobbit now shows the exact path and security consequences before onboarding a project location or adding a Marketplace source, requiring deliberate confirmation and re-prompting when a project path changes.

🐛 Bug Fixes

• ✅ Secure verification results: Verification callbacks are bound to the exact verifier session, late results remain safe during teardown, and HTML reports and workspace images are processed with strict file, size, and containment checks.

• 📦 Reliable bundled search binaries: Platform packages for fd and rg now use the @gresearch scope, with stronger publish automation and registry-propagation retries to keep installs consistent.

• 🏷️ Accurate npm package identity: Package metadata, licensing, and install documentation now consistently identify @gresearch/bobbit.

What's Changed

• Fix npm package metadata by @SuuBro in #1301
• Secure verification results by @SuuBro in #1302
• test: await ask response persistence by @SuuBro in #1300
• Use scoped Bobbit package name in docs by @SuuBro in #1303
• Harden release script analysis by @SuuBro in #1304
• Require approval for project MCP servers by @SuuBro in #1305
• Migrate/binaries gresearch scope by @pavlovic-ivan in #1307
• Add dispatch workflow to publish binary sub-packages by @pavlovic-ivan in #1308
• Add repository config to each binary package.json by @pavlovic-ivan in #1309
• Sync binary sub-packages to 0.9.1 by @pavlovic-ivan in #1310
• Harden binary publish: registry-propagation retry + fail-loud PR creation by @pavlovic-ivan in #1311
• Update CODEOWNERS by @mkb23 in #1313
• Add exponential npm publish backoff by @SuuBro in #1315
• Add trust warnings for external locations by @SuuBro in #1314
• Patch Vitest security vulnerability by @SuuBro in #1316
• Sync binary sub-packages to 0.9.3 by @github-actions[bot] in #1317
• Add Jim Brown to CODEOWNERS by @SuuBro in #1319
• chore(release): v0.21.0 by @SuuBro in #1318

New Contributors

• @mkb23 made their first contribution in #1313
• @github-actions[bot] made their first contribution in #1317

Full Changelog: v0.20.0...v0.21.0