theplenkov/bro
v0.2.4MIT
Agent's sidekick: review-debt pipeline, PR review loop, scoped drill frames, and wtf→retrospect self-correction — all mechanics in the bro CLI over gh + beads
0.2.4 (2026-09-30)
🚀 Features
- cli: bro doctor — environment diagnostics command (bro-2vt) (#148)
- core: bd compat check + graceful jsonl degrade (bro-y1b) (#151)
- core: 0.x contract stability — changelog + deprecation seams (bro-7ix) (#153)
- debt: announce stealth .beads init — beads stays a default store (bro-0fc) (#152)
- debt: bro debt trend — burn-down over time (bro-55t) (#157)
- gitlab: second connector — ReviewFacade over glab (bro-00t) (#149)
- next,loop: declared label scope — loops can't bleed across the queue (bro-idk7) (#167)
- plans: versioned plan schemas + bro plan validate (bro-2u5) (#150)
- setup: @broject/bro-pack — capabilities ship as an npm pack (#165)
- site: /debt — bro's own debt dashboard, live from refs/bro/data (#166)
- site: /debt shows harvested findings, not only the status overlay (#168)
🩹 Fixes
- debt batch — bd diagnostics, merge semantics, doc-dispatch namespace (#102)
- ci,cli: release-tag fallback searches ancestry; cleanup degrade-path tests (bro-p1sm, bro-ara7) (#160)
- cli: cleanup treats review-host auth as a warning, not a gate (bro-owg) (#130)
- cli: own-keys check for reserved doc nouns (bro-ff6) (#154)
- cli: memoize filtered doc types — one collision warning per process (bro-zpf) (#155)
- cli: reserve plugin command names in the doc-type guard (bro-e8o) (#156)
- cli: debt watch syncs the ledger to gitref per tick (bro-mtwa) (#162)
- cli: debt watch — fail-fast auth at startup, throw per tick (#161)
- cli: read-only debt commands no longer publish the ledger (#163)
- cli: flag() recognizes --name=value — a missed label scope was fail-open (#171)
- cli: drop argv.includes gates — --label=v never reached flag() (#172)
- debt: sweep security + review findings — axios override, ci permissions, --label repeat (#170)
❤️ Thank You
- Devin @devin-ai-integration[bot]
- Petr Plenkov @ThePlenkov
0.2.3 (2026-09-30)
🚀 Features
- site: one template — minimal landing + docs on TanStack Start + Fumadocs (#119)
🩹 Fixes
- ci: release-tag falls back to second-parent subject on merge commits (bro-zra) (#127)
- cli: gate gh auth before repo resolution in debt commands (bro-5yu) (#131)
- cli: align engines floor with prepack's .ts execution (bro-5ce) (#143)
- core: verify assignee before a .task marker counts as own claim (bro-4xl) (#129)
- core: name the plugin when auth probe breaks the sync contract (bro-5yh) (#132)
- core: memoize connector auto-detect — ambiguity warning prints once (bro-2i8) (#133)
- core: claim ownership follows the serving task store's actor (bro-cwgv) (#144)
- github: throw on MERGED PR with null mergedAt (bro-olj) (#136)
- github: surface batch-wide explicitMergedPrs failures (bro-dv4) (#137)
- github: bound matchRemote to the github.com edge (bro-8l8) (#138)
- github: dedupe explicit mergedPrs ids at the facade (bro-tmk) (#140)
- github: type ThreadPage.line as number | null (bro-o08) (#141)
- loop: pin agent BEADS_DIR to the shared store; honor bd close as a verdict (#128)
- release: match only open PRs before skipping release-PR creation (#126)
🔥 Performance
- core: memoize bdActor probe per dir (bro-l7b9) (#145)
❤️ Thank You
- Devin @devin-ai-integration[bot]
- Devin AI @devin-ai-integration[bot]
- Petr Plenkov @ThePlenkov
0.2.2 (2026-09-29)
Changes in this release predate conventional-commit discipline, so the generator saw no typed commits. Shipped:
- debt: multi-source collectors — dependabot, code-scanning, secret-scanning, stale-prs, failed-ci (#112)
- nx: @nx-devkit/prepare-for-release plugin — npm bootstrap + OIDC trust (#114)
- cli: drop @broject/* devDeps from the published manifest (#115)
- cli: resolve conflict markers committed into package.json (#116)
0.2.1 (2026-09-29)
🚀 Features
- bro drill — scoped descent over beads + agent plugin (#18)
- gitref store backend — artifact sync on refs/bro/data (#45)
- act: bro act merge — gate-enforced merge (#29)
- act: act.ignoreChecks — advisory checks exit the gate (#47)
- act: bound the act loop — act.maxRounds caps inline fix rounds (#54)
- act: plan schema — batch thread verdicts via bro run (#68)
- act: bro act wait — the gate-watcher as a primitive (#72)
- act: merge-slot — serialize merges via bd (#67)
- act: wait auto-updates BEHIND branches — the update-branch button as code (#81)
- cli: bro cleanup — post-merge branch hygiene as mechanics (#33)
- cli: plugin registry — every command as a BroPlugin (#48)
- cli: external plugins via config plugins — bro is a host now (#51)
- cli: bare commands act on context (#57)
- cli: @theplenkov/bro/plugin — typed API for external plugins (#59)
- cli: bro work — parallel-friendly worktree lifecycle (#60)
- cli: bro loop — the autonomous backlog runner as a command (#75)
- cli: clickable PR links — bare #N is dead text (#97)
- config: linked worktrees inherit the main checkout's bro.config (#74)
- convoy: agent-internal molecule execution — bro convoy (#28)
- convoy: plan schema — pour plans for molecule execution (#78)
- core: bro.config.ts support (#44)
- core: plugin-owned config sections via configSchema (#49)
- core: unified plans — kind envelope + bro run (#53)
- debt: beads store on by default — auto bd init, ledger git-excluded (#26)
- debt: plan schema — batch triage via bro run (#66)
- drill: plan schema — declared descent trees via bro run (#70)
- gen-plugins: validate plugin.json shape + sync version with cli (#27)
- hooks: devin lifecycle bridge — rehydrate, stop-gate, self-approve (#21)
- next: bro next — the autonomous backlog scheduler (#61)
- next: plan schema — selection/execution plans via bro run (#79)
- retro: bro wtf + bro retrospect — self-correction over beads (#19)
- site: docs + landing on GitHub Pages (#55)
- sync: orchestrate bd sync — beads state rides along (#73)
- work: submodule lifecycle + bead claim on enter (#80)
🩹 Fixes
- npm 11 for OIDC trusted publishing (#14)
- strip placeholder _authToken so OIDC publishing engages (#15)
- publish dispatch decouples run-ref from publish-ref (#17)
- stale-status gate on non-OPEN PRs + non-object config roots (#30)
- debt batch — push-accurate fixRounds, defer-aware hook, setup .ts guard (#58)
- act: normalize mergeState casing at the fetch boundary (#39)
- act: guard reply comment + finish defer title message (#71)
- act,wtf: policy at the point of use — silent-resolve guardrail + sink escalation (#82)
- config: see through --separate-git-dir for worktree inheritance (#76)
- drill: retry-safe drillUp — idempotent prevention creation (#31)
- drill: fail loud on wrong-shaped bd dep list rows (#35)
- drill: normalize prevention-title dedupe — trim + case-fold (#36)
- drill: keep the original error through drillUp's compensation (#38)
- gen-plugins: slug regex must anchor end on alphanumeric (#40)
- gen-plugins: batch reviewer findings — validation + fs safety (#42)
- hooks: never assume $DEVIN_PLUGIN_ROOT — guard + fallback chain (#22)
- hooks: session-scoped stop gate — ambient state is context, not a block (#34)
- next: scope the queue to issue_prefix — foreign beads never claimed (#87)
🔥 Performance
- drill: batch parent-child edges via bd dep list (#50)
❤️ Thank You
- Devin @devin-ai-integration[bot]
- Petr Plenkov @ThePlenkov
0.2.0 (2026-09-15)
🚀 Features
🩹 Fixes
- harvested review findings — SAST unknown gate, personality validation, atomicWrite perms (#9)
❤️ Thank You
- Devin @devin-ai-integration[bot]
- Petr Plenkov @ThePlenkov
0.1.0 (2026-09-15)
🚀 Features
🩹 Fixes
- ci: build vendored nx plugins before nx targets (422e7fa)
- ci: route build/test through npm scripts for skills-* exclusion (ac00b43)
- cli: drop ./ prefix from bin path (#6)
- debt: review findings from skills#309 (#1, #309)
- debt: never remove debt:skipped from collect path (#2)
- debt: rescan labeled PRs with post-scan activity (#5)
❤️ Thank You
- Devin @devin-ai-integration[bot]
- Petr Plenkov @ThePlenkov