Skip to content

v2.0.0

Choose a tag to compare

View all tags
@Joshua-Gilbert Joshua-Gilbert released this 26 Jun 19:35
v2.0.0
e63de8a
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

IBM Bob 2.0 support. The companion extension now auto-detects Bob 1.x vs 2.0 and drives each natively from one build. IBM Bob 2.0 removed the node-ipc pipe that all of plugin 1.x dispatch rode; on 2.0 the extension runs the board-drain loop in-process and calls Bob's exported startTask API. The board, CLI, MCP tools, modes, gating, and verification are unchanged — only the Bob transport is new.

Added — Bob 2.0 in-process driver

  • In-process dispatch via getExtension('IBM.bob-code').exports.startTask — no child worker, no pipe.
  • Completion via the task store (~/.bob/db/bob.db): snapshot + correlate our root by created_at + content, poll the active→running→active lifecycle to a quiet settle; result text + token costs read from the messages/costs columns.
  • Config-based auto-approve, gated by bobTasks.autoApproveGlobal (default on) with a one-time first-write notice (it's a user-global, persistent change that disables Bob's command security across every window).
  • Carried over to 2.0: defer-while-chatting, verify-and-continue (command-verify + plan-stop + the LLM judge), and the worktree:<name> tag pin + shared board.

Not supported on Bob 2.0 (no IPC reply channel)

Followup auto-answer, dynamic command-classifier approval, and cancel stay Bob 1.x only; the related settings (pipe, commandClassifier, answerFollowups, escalateAll, reviewPlans) are inert on a 2.0 window.

Hardened (DevSecOps review)

  • TOCTOU (CWE-377): the settings write uses a random temp-file name, not a predictable .tmp.
  • Cross-window task confusion (CWE-284): correlation requires our full prompt in a row's first_message, so a foreign task on the shared bob.db can't be mistaken for ours.
  • Log injection (CWE-117): the URI handler strips control characters before logging.

Compatibility

One build, both Bobs (auto-detected). Staying on Bob 1.x? The last pipe-only build is v1.1.0.

Install

Download bob-tasks-2.0.0.vsix below → in Bob, run Extensions: Install from VSIX… → select it → reload.

Full changelog: https://github.com/PounceAI/bob-control/blob/main/CHANGELOG.md

Assets 3
Loading