Release notes: BoB 1.280.0

BoB 1.280.0 — release notes

Released: 2026-10-05 · Tag: v1.280.0 · Previous: 1.279.1 (2026-10-05)

Highlights

BoB Control grows up. The top bar is one row — Now, Projects, Fleet, Costs, then the project, then the tmux session — and every session has its own page named after its tmux session. (#4025, #4034, #4026)
Run and stop sessions from the browser. Each project lists its sessions with host, kind and phase, with Open and Kill; New session starts any kind of run on any host; decompose and do runs get their own screens; a dispatch form runs any bob command. Worktree runs now show under their real project. (#4027, #4028, #4029, #4031, #4030, #4041)
Fleet and Costs pages. Fleet opens with what needs fixing and how, then a card per machine. Costs tells you if you will hit your limit this month and where the money went, and cost alarms reach you once each through bob notify. (#4035, #4036, #4037)
New projects and portfolio from Control. A New project form runs bob ready on the host you pick (with bob ready --vision writing its first docs/vision.md), and a project can be parked, archived or revived, including the sweep’s undecided rows. (#4032, #4033, #4042)
Start a farm project from a laptop browser. Dispatch goes through the owning host’s dashboard server over the tailnet. (#3004)

Fixed

Farm runner: the job-started hook deletes the job’s own working directory, so every job fails at checkout. (#4002)
Runner retention timer is never enabled on farm-01: hygiene takes node from a PATH that has none. (#4003)
Segment handoff attaches two tmux -CC clients to one session — iTerm2 window shows raw control-mode protocol. (#3942)
The forge let one machine send 5,000 GitHub calls in an hour, and GitHub rate-limited it for 40 minutes. (#3978)
An unpushed –now commit in the operator repo breaks the next fast-path add: the PR carries other projects’ changes, PULL fails, later adds pile into a conflicting PR. (#3912)
provision.sh remove/add –now reports success while the operator repo is mid-rebase, and writes nothing. (#3469)
Sweep scrap lists a checkout as a safe delete when its GitHub repo no longer exists. (#3686)
launch.sh start never sends –max-tokens to the run: the window gets scope_flags, the preview shows run_flags. (#3377)
bob warp finalize fails in a worktree when master is checked out elsewhere. (#3543)
Harness-defect: hook:warp-drive-docs-detector:updating_docs→docs_updated did not fire — agent compensated by hand. (#3295)
Dev-up SQL seed passes the whole database_name line to wrangler on macOS (BSD sed has no \s). (#3782)
Decompose testability gate refuses the canonical Docs criterion and gives identical text different verdicts in one run. (#3579)
cred-check.js due files no rotation todo: the ask gate refuses it for naming no source. (#3975)
flightplan.js build –help builds a real flight plan instead of printing help. (#3977)
A flight plan seats a to-do against only the first issue of a multi-issue Blocked by line. (#3932)
Warp-drive: bug evidence from the previous item satisfies the regression gate for the next bug. (#3695)
The item-boundary tick marks a flight-plan item done while its issue is still open and blocked. (#3694)
Handoff for an item skipped on another requirement reads as a human action, with a file path as its command. (#3209)
Warp-drive has no exit for an item that is already satisfied; work_skipped raises a false needs-you handoff. (#3343)
The area-complete brief page the run writes at a boundary is left uncommitted, so the next checkpoint refuses it as in-flight work. (#3735)
test-control-command-bar.sh is flaky: Ctrl-K focus check and browser-run timeout. (#3994)
deploy.sh cloudflare adapter refuses a deploy over BoB-derived files (session ledger, decision log, .codex/). (#3257)
Provision overlay apply crashes in a git worktree: .git is a file, so .git/info/exclude is ENOTDIR. (#3203)
bob doctor reports an undeclared hook that deploy.sh and settings-hooks-reconcile –prune cannot see or remove. (#3610)
bob init prompts are invisible: prompt_yn sends read -p to /dev/null. (#3511)
cap-status.js applies an in-progress label that bootstrap-labels.sh never creates. (#3338)
bob ritual close refuses a finding labelled task. (#3710)
Sweep inventory reports no remote when origin is not GitHub, and misses a second remote. (#3685)
Sweep apply records a stale default branch and archives a repo over unpushed commits. (#3687)
Sweep scrap: the approval is lost once the first machine deletes its share of the list. (#3705)
/retrospective records its output where bob ritual close cannot link it. (#3456)
Area-completion brief filed twice for the same area and version. (#3569)
bob brief –html/–publish/–area/–project still write and publish from the cwd project’s www/bob/briefings. (#3278)
Briefings index links to pages that are not in the published bundle. (#3568)
Workflow-lane swarm workers never see their subtask’s verification command. (#3556)
docs/reference/cli.md is stale against scripts/bob/commands.json: bob control, bob asks and the bob route commands. (#3950)
test-ask-waiting.js fails 2 checks on master: its gh stub opens –body-file - as a file. (#3933)
Test-briefings-page: ‘bob viz –page briefings opens /briefings through the one launcher’ fails on master. (#3846)
Test-cred-check fails on this Mac (Node 25.9): an unparseable JSON store’s reason is redacted instead of the error name. (#3829)
Test-ready-parallel reads a torn projects file under full make test load. (#3781)
Test-viz-service-launch fails while a real dashboard server for the checkout is running (“server count”). (#3683)
The dashboard treats any first argument as a project: make test left 52424/ in the checkout and served it on showcase’s port. (#3677)
[security:low] Bridge hardening (rdb). (#3634)
Test-deploy-pending and test-bob-update fail one assertion each on macOS: expected path carries the double slash from TMPDIR. (#3900)
test-viz-launch-urls.sh fails on macOS: wc -l output is padded, so the –json line-count check never equals 1. (#3833)
test-cli-table.sh fails on macOS: GNU-only sed -i at line 228. (#3668)
test-provision-overlay.sh / test-flightplan.js call the real gh (issue comment 9999) instead of a stub. (#3244)

Upgrade: every machine

Close every Claude Code window on the machine first. A deploy refuses while a session is live (it would switch off the hooks in running sessions); a refused deploy is queued and runs when the last session ends.

A laptop (`dev-laptop`)

bob update --to v1.280.0
bob doctor

A farm worker (`farm-worker`)

bob update --to v1.280.0
bob doctor
systemctl --user list-timers | grep -E 'bob-(tick|snapshot)'

The last command should list both the tick timer and the snapshot timer.

A machine (`utility-host`)

bob update --to v1.280.0
bob doctor

Expected: bob doctor ends green, and its version line names v1.280.0.

Upgrade: every project

In each project checkout on each machine:

cd <project> && bob ready

Expected: READY — <project> is warp-drive-ready on this machine.

Action needed

None — this release needs no one-time step.

Breaking changes

None.

Known issues

None known.

Changes

Full change list — 79 commit(s)

Features

Control’s navigation is one row with the crumbs of where you are (#4025) (36e9173)
Fleet & costs becomes two pages, Fleet and Costs, with no project tiles (#4034) (d640b3b)
a Control session page is addressed by its tmux session name (#4026) (68a3ece)
a worktree’s runs report under their real project (#4041) (3734ff7)
each session row shows its tmux name, host, kind, phase, age and stuck verdict, with Open (#4027) (fdd5e2d)
a session can be killed from its row or its own page, with a graceful stop where the run declares one (#4028) (3160ea2)
a project on another fleet machine is dispatched there through its dashboard server (#3004) (4898b1f)
New session starts any declared kind, named {kind}-{project}-{n}, refusing broken rules first (#4029) (88023d5)
the project page’s New session button starts a session and opens its page (#4029) (14ffe82)
decompose and do session screens show their own figures and lists (#4031) (13d863e)
the action form can build every routed bob command (#4030) (71dc5bd)
a collapsed dispatch form on project and session pages runs any bob command (#4030) (7c298d4)
fleet snapshots carry load, disk, Remote Login and the runner’s process; machines declare session_limit (#4035) (f386796)
the Fleet page opens with what needs attention, then a card per machine, capacity and the health tables (#4035) (dcc9243)
ledger runs carry their kind; the Costs page builder answers will I hit my limit (#4036) (5f9596b)
/control?view=costs and /control/costs.json serve the Costs page (#4036) (601a20d)
cost alarms reach the operator through bob notify, once each (#4037) (3f2e2a2)
bob ready –vision writes the first docs/vision.md (#4033) (f8fb3da)
a draft vision makes /vision the project’s next step (#4033) (60dc4dd)
New project in Control runs bob ready on the chosen host (#4032) (a369b1e)
the project page decides its place in the portfolio (#4042) (6eaaae4)
parked and archived projects step aside, and Revive brings one back (#4042) (b3667b1)
Projects decides the portfolio sweep’s undecided rows (#4042) (d993fec)

Bug Fixes

the job-started hook keeps the job’s working directory (#4002) (eb22896)
the login user’s reap timer runs each runner’s own node (#4003) (1dfa9de)
one owner of the attach at a segment handoff (#3942) (04c0195)
pace gh calls per minute across every caller on the machine (#3978) (2f519e8)
briefing reads once per run, and off switches for brief and tick (#3978) (41e80e1)
config changes are cut from and measured against the remote (#3912) (956d433)
no manifest write while the operator repo is mid-rebase or merge (#3469) (cfcffdd)
sweep scrap asks the forge whether a checkout’s repo still exists (#3686) (28d2ef0)
bob warp start sends –max-tokens to the window it launches (#3377) (dd041c2)
bob warp finalize lands a worktree stream while main is checked out elsewhere (#3543) (7951736)
no docs-hook miss is recorded without an entry snapshot (#3295) (9a76a53)
dev-up passes the bare D1 name to a .sql seed on macOS (#3782) (5622817)
the testability gate passes its own template, one verdict per text (#3579) (910bd04)
cred-check due names its source to the ask gate (#3975) (f5eeaf5)
flightplan.js build –help prints help; an unknown flag is refused (#3977) (82bc636)
a flight plan seats a to-do against every issue on its Blocked by line (#3932) (67ee5a2)
work_selected resets bug evidence for each item (#3695) (853f1a0)
the item-boundary tick holds an open, blocked item (#3694) (1330e9a)
a skip on another work item raises no human handoff (#3209) (9d3b3d6)
an already-satisfied item leaves planning as resolved (#3343) (7ad7c9c)
the checkpoint carries brief pages the run’s boundary wrote (#3735) (c844225)
a late-attaching terminal no longer takes the cursor from the command bar (#3994) (0b7eeb1)
the cloudflare deploy check ignores BoB-derived files (#3257) (e557567)
provisioning resolves info/exclude through git, so worktrees work (#3203) (8e0f101)
bob doctor names a fix that clears an undeclared hook (#3610) (c673d64)
bob init prompts are visible again (#3511) (d3e57da)
bootstrap creates in-progress; cap-status reports a failed apply (#3338) (202f502)
bob ritual close accepts a finding labelled task (#3710) (e64e295)
sweep inventory records an origin off the forge and every remote (#3685) (b14fd16)
sweep apply reads the default branch from the forge and holds archive over local-only work (#3687) (6c5104e)
an approved scrap list stays approved after a machine deletes its share (#3705) (6ff0c3e)
/retrospective records into the ritual run when one is open (#3456) (5eaa275)
two area-completion runs at once file one brief per area (#3569) (3dcaea3)
bob brief writes and publishes every page from the briefings home (#3278) (2ee7e73)
the briefings index never links a page the bundle lacks (#3568) (b951044)
swarm workers run their subtask’s verification command (#3556) (559cb6f)
bob route commands get a job in the CLI reference (#3950) (863b7f0)
test-ask-waiting’s gh stub reads the body from stdin for –body-file - (#3933) (021deb4)
test-briefings-page checks the viz page arm, not its exact literal (#3846) (267bc34)
cred-check names a file store by its reference, not its absolute path (#3829) (73172e8)
test-ready-parallel’s no-lock control counts a torn file as the race (#3781) (1de7e1a)
test-viz-service-launch counts only the servers it started (#3683) (4fb2ba1)
the dashboard refuses a project root that is not a directory (#3677) (1be0ff5)
the RDB clients refuse a plain-http bridge URL (#3634) (ecd48b1)
three suites build their scratch dir without TMPDIR’s trailing slash (#3900) (27eeb86)
test-viz-launch-urls counts lines with grep -c, not padded wc -l (#3833) (3abb564)
test suites edit scratch files with sed that works on BSD and GNU (#3668) (202ed55)
overlay suites stub gh, so the plan comment never reaches the forge (#3244) (a903d25)
decompose and do runs stay live and reach Running now, from any checkout (#4031) (0412048)

Refactoring

one loader builds the costs document for the page and the alarms (#4037) (b71c229)

Tests

e2e — a do session and a new-worktree session started from Control (#4029) (4d012de)
e2e — a decompose run from a Claude session stays live and draws its screen (#4031) (d6449ed)
e2e — the dispatch form runs a read and a dry run from the project page (#4030) (bdf371a)
e2e — the Fleet page with one stale machine and one drifted machine (#4035) (59c2688)
e2e — a route key that projects over budget makes the Costs page answer red (#4036) (3523722)
e2e — over budget, then red, then a runaway run, each noticed once (#4037) (ec88c1c)