v2.2.0

What's Changed

• Untracked-aware verifier + npm distribution (2.1.0) by @Joshua-Gilbert in #44
• docs: npm version badge + npx fallback for nvm-for-windows by @Joshua-Gilbert in #45
• feat(worker): --webhook to POST task transitions to Slack/Discord/generic by @Joshua-Gilbert in #46
• Bob 2.0 driver observability: review-findings capture + last_dispatch health signal by @Joshua-Gilbert in #47

Full Changelog: v2.0.2...v2.2.0

v2.0.2

What's Changed

• docs: add PR & commit message convention to CLAUDE.md by @Joshua-Gilbert in #40
• fix(skills): let Bob gather the diff itself; pin dispatch tasks to the live drainer by @Joshua-Gilbert in #41
• chore(release): 2.0.2 — faster completion + Bob-skill correctness by @Joshua-Gilbert in #42
• fix(release): bump the extension manifest to 2.0.2 by @Joshua-Gilbert in #43

Full Changelog: v2.0.1...v2.0.2

v2.0.1

The Bob 2.0 in-process loop never emitted a heartbeat, so board_status.worker_draining read false while it was actively draining — and the skills told you to start a worker that was already running. This makes the board see the loop, recovers tasks it strands on a crash, and gives routing a single source.

• Heartbeat — the 2.0 loop beats like the 1.x worker (shared startHeartbeat()); teardown in try/finally so it can't leak.
• Reclaim — stale in_progress recovered at startup, peer-guarded (live beat + pid) so it can't steal a co-running drainer's task.
• predict_mode — routes from modes.ts; foreman docs call it instead of copying the keyword table (parity test guards drift).
• worker_draining.tags — each worker's --tag pin, so the board shows why a live worker skips a task.

The fixes live in the connector — pull this tag and npm run build. The attached VSIX is the matching 2.0.1 extension (loads the connector dist/ via bobTasks.connectorPath).

v2.0.0

IBM Bob 2.0 support. The companion extension now auto-detects Bob 1.x vs 2.0 and drives each natively from one build. IBM Bob 2.0 removed the node-ipc pipe that all of plugin 1.x dispatch rode; on 2.0 the extension runs the board-drain loop in-process and calls Bob's exported startTask API. The board, CLI, MCP tools, modes, gating, and verification are unchanged — only the Bob transport is new.

Added — Bob 2.0 in-process driver

• In-process dispatch via getExtension('IBM.bob-code').exports.startTask — no child worker, no pipe.
• Completion via the task store (~/.bob/db/bob.db): snapshot + correlate our root by created_at + content, poll the active→running→active lifecycle to a quiet settle; result text + token costs read from the messages/costs columns.
• Config-based auto-approve, gated by bobTasks.autoApproveGlobal (default on) with a one-time first-write notice (it's a user-global, persistent change that disables Bob's command security across every window).
• Carried over to 2.0: defer-while-chatting, verify-and-continue (command-verify + plan-stop + the LLM judge), and the worktree:<name> tag pin + shared board.

Not supported on Bob 2.0 (no IPC reply channel)

Followup auto-answer, dynamic command-classifier approval, and cancel stay Bob 1.x only; the related settings (pipe, commandClassifier, answerFollowups, escalateAll, reviewPlans) are inert on a 2.0 window.

Hardened (DevSecOps review)

• TOCTOU (CWE-377): the settings write uses a random temp-file name, not a predictable .tmp.
• Cross-window task confusion (CWE-284): correlation requires our full prompt in a row's first_message, so a foreign task on the shared bob.db can't be mistaken for ours.
• Log injection (CWE-117): the URI handler strips control characters before logging.

Compatibility

One build, both Bobs (auto-detected). Staying on Bob 1.x? The last pipe-only build is v1.1.0.

Install

Download bob-tasks-2.0.0.vsix below → in Bob, run Extensions: Install from VSIX… → select it → reload.

Full changelog: https://github.com/PounceAI/bob-control/blob/main/CHANGELOG.md

v1.1.0

What's Changed

• docs: install the extension from the released VSIX by @Joshua-Gilbert in #34
• refactor(worker): extract runOne() into named phase helpers by @Joshua-Gilbert in #35
• feat(worktree): run N worktrees of one repo in parallel (1.1.0) by @Joshua-Gilbert in #36

Full Changelog: v1.0.0...v1.1.0

v1.0.0

What's Changed

• feat: LLM-judge verify, review-findings capture, full mode set + specialty skills by @Joshua-Gilbert in #1
• LLM-judge verifier, Bob review-findings capture, full mode set (+ review hardening) by @Joshua-Gilbert in #2
• docs: value-prop intro, positioning, document task dependencies + worker flags by @Joshua-Gilbert in #4
• chore: rename to Bob Control (plugin: Bob Companion) by @Joshua-Gilbert in #5
• Per-session boards + decouple connector path from working dir by @Joshua-Gilbert in #6
• Board safety gates: staging/arming, done-integrity, delete-safety by @Joshua-Gilbert in #7
• Board-native human-input round-trip (needs_input + ask/answer/await) by @Joshua-Gilbert in #8
• docs: README — per-session boards, safety gates, human-input round-trip by @Joshua-Gilbert in #9
• feat: per-task checkpoint / rollback by @Joshua-Gilbert in #10
• fix(checkpoint): make revert recovery snapshot untracked-aware by @Joshua-Gilbert in #11
• fix(router): route review/plan/security tasks to their modes, not write-capable code by @Joshua-Gilbert in #13
• fix(board): enforce dependency eligibility in the db dispatch chokepoint by @Joshua-Gilbert in #12
• chore(repo): CI, ESLint, Prettier, coverage, and test-gap fills by @Joshua-Gilbert in #14
• fix(board): Tier 1 — atomic claims + transactional mutations by @Joshua-Gilbert in #15
• fix(worker): Tier 2 — IPC reconnect + crash-safe worker lifecycle by @Joshua-Gilbert in #16
• fix(security): Tier 3 — path containment + classifier hard deny-list by @Joshua-Gilbert in #17
• fix(logic): Tier 4 — balanced-brace JSON parsing + correct audit counts by @Joshua-Gilbert in #18
• refactor(5a): de-duplicate dependency check + harden IPC boundary by @Joshua-Gilbert in #19
• refactor(5b): split db.ts — extract question + completion subsystems by @Joshua-Gilbert in #20
• feat(worker): resilience guards + non-interactive command permission policy by @Joshua-Gilbert in #21
• docs(readme): document right-sizing + list new worker-resilience modules by @Joshua-Gilbert in #22
• feat: await_task — hook back into your turn when Bob finishes a task by @Joshua-Gilbert in #23
• chore(release): v1.0.0 + slop-audit fixes by @Joshua-Gilbert in #24
• fix(board): converge board path across contexts + idempotent question→dispatch by @Joshua-Gilbert in #25
• fix(worker): never silently drop a Bob followup question by @Joshua-Gilbert in #26
• fix(worker): risk-bounded mode-switch gate so a mid-task switch never wedges by @Joshua-Gilbert in #27
• chore: Apache-2.0 license + open-source prep audit fixes by @Joshua-Gilbert in #28
• feat(modes): define review/refactor/devsecops as Bob custom modes by @Joshua-Gilbert in #29
• fix(ipc): don't let an open Bob chat hang or contaminate a dispatch by @Joshua-Gilbert in #30
• feat(ipc): model orchestrator subtasks as an owned tree by @Joshua-Gilbert in #31
• feat(mcp): fold open_tasks into board_status so dispatch skills make one call by @Joshua-Gilbert in #32
• Extension IPC pre-flight + VSIX release packaging by @Joshua-Gilbert in #33

New Contributors

• @Joshua-Gilbert made their first contribution in #1

Full Changelog: https://github.com/PounceAI/bob-control/commits/v1.0.0