Release v0.2.10

[joshwilhelmi]

Summary

• Fix test suite alignment with production code changes
• Add MCP templates for Codex, Copilot, Cursor, Windsurf
• Deprecate unused workflow files
• Add new meeseeks-box workflows

Test plan

• All 10,040 tests pass
• Coverage at 81%

Summary by CodeRabbit

• New Features

  • Added support for Cursor, Windsurf, and Copilot IDEs alongside Claude Code, Gemini, and Codex
  • Introduced pipelines with sequential execution, data flow, and approval gates for deterministic automation
  • Launched Lobster-to-Gobby pipeline migration support with CLI import/export
  • Added dedicated code review workflow with approval gates and change requests

• Enhancements

  • Improved memory extraction criteria (5-minute decision rule; higher importance threshold)
  • Consolidated skill injection into workflow lifecycle system
  • Enhanced terminal output streaming and PTY management
  • Expanded MCP tool registry with pipeline and discovery tools

• Documentation

  • New guides for pipelines, Lobster migration, and extended hook support
  • Updated CLI installation and hook configuration documentation

[coderabbitai]

Caution

Review failed

The pull request is closed.

Note

.coderabbit.yaml has unrecognized properties

CodeRabbit is using all valid settings from your configuration. Unrecognized properties (listed below) have been ignored and may indicate typos or deprecated fields that can be removed.

⚠️ Parsing warnings (1)

Validation error: Unrecognized key(s) in object: 'tools', 'ignore'

⚙️ Configuration instructions

• Please see the configuration documentation for more information.
• You can also validate your configuration using the online YAML validator.
• If your editor has YAML language server enabled, you can add the path at the top of this file to enable auto-completion and validation: # yaml-language-server: $schema=https://coderabbit.ai/integrations/schema.v2.json

📝 Walkthrough

Walkthrough

This PR introduces a comprehensive pipeline system for deterministic automation with approval gates, support for three new CLIs (Cursor, Windsurf, Copilot), consolidated skill injection into workflows, and Lobster pipeline migration tooling. It significantly expands agent capabilities, improves worktree isolation with unpushed commit detection, and adds streaming support for pipeline events and terminal output. The changes span adapters, workflows, storage, CLI, HTTP routing, and documentation.

Changes

Cohort / File(s)	Summary
New CLI Adapters (Cursor, Windsurf, Copilot) src/gobby/adapters/cursor.py, src/gobby/adapters/windsurf.py, src/gobby/adapters/copilot.py, src/gobby/adapters/__init__.py	Three new adapters translate between CLI-specific hook payloads and unified HookEvent/HookResponse models, with event type mappings and tool normalization for each CLI.
CLI Installer Support src/gobby/cli/install.py, src/gobby/cli/installers/*.py, src/gobby/install/cursor/*, src/gobby/install/windsurf/*, src/gobby/install/copilot/*	New installation/uninstallation flows for Cursor, Windsurf, and Copilot CLIs with hook dispatcher scripts, MCP templates, and hooks templates.
Pipeline System Core src/gobby/workflows/pipeline_executor.py, src/gobby/workflows/pipeline_state.py, src/gobby/workflows/definitions.py, src/gobby/workflows/pipeline_webhooks.py, src/gobby/workflows/lobster_compat.py	Complete pipeline execution framework with support for typed data flow, approval gates, nested pipelines, webhook integration, and Lobster format conversion.
Pipeline Storage & Management src/gobby/storage/pipelines.py, src/gobby/storage/migrations.py, src/gobby/storage/sessions.py	New database tables for pipeline executions/step executions, session step_variables field, and LocalPipelineExecutionManager for CRUD operations.
Pipeline CLI & HTTP Routes src/gobby/cli/pipelines.py, src/gobby/servers/routes/pipelines.py, src/gobby/mcp_proxy/tools/pipelines/*	CLI commands and HTTP endpoints for listing, running, approving, and managing pipelines; MCP tools for pipeline discovery and execution.
Workflow Definition & Loading src/gobby/workflows/loader.py, src/gobby/agents/definitions.py, src/gobby/agents/runner.py	Support for named workflows in agent definitions, pipeline type detection, inline workflow registration, and agent spawning validation against pipeline definitions.
Multi-Workflow Orchestration .gobby/workflows/meeseeks-box.yaml, .gobby/workflows/meeseeks-box-pipeline.yaml, .gobby/workflows/worktree-merge.yaml, .gobby/workflows/code-review.yaml, src/gobby/install/shared/workflows/*	New multi-step orchestration workflows for task discovery, worker spawning, code review, and merge pipelines; removed legacy auto-task-claude workflow.
Agent Spawning & Isolation src/gobby/agents/spawn.py, src/gobby/agents/spawn_executor.py, src/gobby/agents/isolation.py, src/gobby/worktrees/git.py	Enhanced terminal spawn flow with step_variables propagation, unpushed commit detection for base branch selection, and new git helper methods (get_current_branch, has_unpushed_commits).
Session & Memory Management src/gobby/sessions/session.py, src/gobby/storage/sessions.py, src/gobby/storage/memories.py, src/gobby/sync/memories.py, src/gobby/install/shared/prompts/memory/extract.md	Added step_variables field to sessions, memory ID deduplication by content only, updated memory extraction thresholds and criteria (min_importance 0.7→0.8, max_memories 5→3).
Consolidated Skill Injection src/gobby/workflows/context_actions.py, src/gobby/install/shared/workflows/lifecycle/session-lifecycle.yaml, docs/guides/workflows.md	Moved skill discovery from hooks into workflow-based inject_context action with sources for skills, task_context, and memories; removed hook-based skill injection guidance.
Hook Management & Event Handling src/gobby/hooks/events.py, src/gobby/hooks/hook_manager.py, src/gobby/hooks/event_handlers/_session.py, src/gobby/hooks/broadcaster.py	Added CURSOR/WINDSURF/COPILOT session sources, wired pipeline executor into HookManager, removed redundant skill injection from session start hooks.
Streaming & Terminal Output src/gobby/agents/pty_reader.py, src/gobby/servers/websocket.py, src/gobby/llm/claude.py, src/gobby/llm/service.py	New PTYReaderManager for terminal output streaming from agents, WebSocket support for pipeline events and terminal data, LLM streaming events (TextChunk, ToolCallEvent, DoneEvent).
MCP Proxy Enhancements src/gobby/mcp_proxy/tools/spawn_agent.py, src/gobby/mcp_proxy/tools/workflows/_lifecycle.py, src/gobby/mcp_proxy/tools/tasks/_lifecycle.py, src/gobby/mcp_proxy/registries.py	Pipeline executor integration into spawn_agent, workflow type validation (reject pipelines for step-based operations), task lifecycle improvements with UUID resolution and state updates.
Provider Support Expansion src/gobby/mcp_proxy/tools/orchestration/orchestrate.py, src/gobby/mcp_proxy/tools/orchestration/review.py, src/gobby/mcp_proxy/tools/worktrees.py, src/gobby/agents/spawners/command_builder.py	Extended provider support to include cursor, windsurf, copilot across orchestration, review, and worktree tools; updated CLI command building.
Core Infrastructure Wiring src/gobby/runner.py, src/gobby/app_context.py, src/gobby/servers/http.py, src/gobby/config/app.py, src/gobby/install/gemini/hooks/hook_dispatcher.py	Pipeline components initialization (WorkflowLoader, PipelineExecutor, LocalPipelineExecutionManager), bind_host config, WebSocket host binding, Gobby context propagation in hook dispatchers.
Documentation & Planning docs/guides/pipelines.md, docs/guides/lobster-migration.md, docs/guides/workflows.md, docs/plans/completed/lobster-compatible-workflows.md, CLAUDE.md, README.md	New comprehensive pipeline documentation, Lobster migration guide, updated workflow documentation with inject_context sources, README with expanded CLI support.
Configuration & Metadata .gitignore, pyproject.toml, .gobby/tasks_meta.json, .gobby/agents/meeseeks.yaml, .gobby/prompts/import/*	Version bump (0.2.9→0.2.10), pip dependency update, meeseeks agent reconfiguration with multi-workflow support, prompt restructuring.

Sequence Diagram(s)

sequenceDiagram
    participant Client
    participant HTTP as HTTP Server
    participant Executor as Pipeline Executor
    participant LLM as LLM Service
    participant DB as Database
    participant Webhook as Webhook Endpoint

    Client->>HTTP: POST /api/pipelines/run {name, inputs}
    HTTP->>DB: Load pipeline definition
    DB-->>HTTP: PipelineDefinition
    HTTP->>Executor: execute(pipeline, inputs, project_id)
    Executor->>DB: Create pipeline execution (RUNNING)
    DB-->>Executor: execution_id
    
    loop For each step
        Executor->>Executor: Check condition
        alt Step skipped
            Executor->>DB: Update step (SKIPPED)
        else Step approved
            alt Exec step
                Executor->>LLM: Execute command
                LLM-->>Executor: result
            else Prompt step
                Executor->>LLM: Generate with allowed_tools
                LLM-->>Executor: response
            else Nested pipeline
                Executor->>Executor: Recursive execute
            end
            
            alt Approval required
                Executor->>DB: Update execution (WAITING_APPROVAL)
                Executor->>Webhook: notify_approval_pending
                Webhook-->>Client: webhook event
                Client->>HTTP: POST /api/pipelines/approve/{token}
                HTTP->>Executor: approve(token)
                Executor->>DB: Resume execution
                Executor->>Executor: Continue remaining steps
            end
            
            Executor->>DB: Update step (COMPLETED) with output
        end
    end
    
    Executor->>DB: Update execution (COMPLETED) with outputs
    Executor->>Webhook: notify_complete
    Webhook-->>Client: completion webhook
    HTTP-->>Client: {status, execution_id, outputs}

Loading

Estimated code review effort

🎯 4 (Complex) | ⏱️ ~75 minutes

This PR introduces substantial new functionality with high heterogeneity across multiple subsystems: a complete pipeline execution system (executor, state models, webhooks, storage), support for three new CLI adapters with integration points throughout the codebase, significant workflow restructuring (multi-workflow support, consolidated skill injection), and enhanced agent spawning/isolation logic. While many changes follow consistent patterns (adding new CLI sources, installer implementations), the core pipeline system is dense with logic requiring careful validation, and the distributed integration touches hook handling, MCP proxies, HTTP routing, storage migrations, and CLI commands. The workflow and session-lifecycle changes introduce behavioral shifts that require understanding the broader context. However, the scope is well-organized into cohorts with clear responsibilities, and test coverage appears present for critical paths.

Possibly related PRs

• Release v0.2.8 #4: Overlapping changes to agents, workflows, adapters, hooks, and MCP proxy subsystems including meeseeks workflow files, auto-task-claude modifications, adapter enhancements, HookManager activation paths, and spawn/registry tooling—shares the same architectural patterns and integration points.

✨ Finishing touches

• 📝 Generate docstrings

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Post copyable unit tests in a comment
• Commit unit tests in branch dev

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[claude]

Pull Request Review - v0.2.10

Summary

Comprehensive review of 460 changed files with 35k additions. The PR adds three new CLI adapters (Copilot, Cursor, Windsurf), a pipeline execution system, and agent/hook improvements. Overall architecture is solid with good test coverage (81%, 10,040 tests passing).

---

Critical Issues 🔴

1. PTY Reader Missing Test Coverage

File: src/gobby/agents/pty_reader.py (192 new lines, 0 test coverage)

This is a critical component for agent PTY management but has no tests. Missing coverage for:

• Starting/stopping readers
• FD closure during read
• Concurrent reader operations
• Resource cleanup
• Error handling in callbacks
• UTF-8 decode errors

Action Required: Add tests/agents/test_pty_reader.py before merge.

2. File Descriptor Leak Risk

File: src/gobby/agents/pty_reader.py:141-179

The _read_loop method catches FD errors but doesn't explicitly close master_fd. This could leak file descriptors over time.

Recommendation: Add explicit os.close(master_fd) in the finally block or document FD closure responsibility.

---

High Priority Issues ⚠️

3. Session Handler Complexity

File: src/gobby/hooks/event_handlers/_session.py:15-199

The handle_session_start method is 185 lines with deeply nested logic, making it hard to test all paths.

Recommendation: Refactor into smaller methods:

• _find_existing_session()
• _find_parent_session()
• _register_new_session()
• _activate_workflows()

4. Missing Adapter Edge Case Tests

File: tests/adapters/test_new_adapters.py

Good basic coverage but missing:

• Malformed input handling (None, empty dict, wrong types)
• Large payload handling (10MB+ outputs)
• Concurrent request handling
• Error recovery scenarios

Recommendation: Add negative test cases and stress tests.

5. Input Validation Gaps

File: src/gobby/cli/pipelines.py:76-81, 258-266

Pipeline inputs aren't validated for:

• Key name format (special characters allowed)
• Value length limits (DoS potential)
• Content sanitization

Recommendation:

• Validate keys are alphanumeric + underscore only
• Add max length (e.g., 1000 chars per value)
• Document input format constraints

---

Medium Priority Issues

6. Path Traversal in Pipeline Import

File: src/gobby/cli/pipelines.py:586-593

pipeline.name from Lobster files is used directly as filename without sanitization. Could allow path traversal like ../../../etc/passwd.

Fix:

dest_path = workflows_dir / Path(pipeline.name).name  # Strip directory components

7. Missing Input Validation in Adapters

Files: src/gobby/adapters/copilot.py:159-164 (and similar in cursor.py, windsurf.py)

No validation that native_event is a dict or contains required fields. Malformed input could cause exceptions.

Recommendation: Add type checks at start of translate_to_hook_event().

8. Unbounded Memory Growth in Pipelines

File: src/gobby/workflows/pipeline_executor.py:138-141, 230

All step outputs are stored in memory. Long pipelines with large outputs could consume excessive memory.

Recommendation: Add memory limits or document maximum pipeline size.

---

Low Priority Issues ℹ️

9. PTY Reader Race Condition

File: src/gobby/agents/pty_reader.py:88-104

Lock is released before task.cancel() completes. Concurrent start_reader() calls could create duplicate tasks.

Fix: Hold lock until after wait_for() completes.

10. Weak Type Annotations in Installers

Files: src/gobby/cli/installers/*.py

Using dict[str, Any] loses type safety. Prefer TypedDict or dataclass for return types.

---

Excellent Work ✅

1. No command injection vulnerabilities - Proper use of shlex.split() and create_subprocess_exec()
2. Comprehensive adapter documentation - Clear docstrings explaining hook mappings and conventions
3. Consistent adapter architecture - All three CLIs follow same translation pattern
4. Good test coverage overall - 81% coverage with 10,040 passing tests
5. Proper async patterns - Good use of locks and cancellation

---

Overall Recommendation

Approve with changes requested. The architecture is solid and most implementation is high quality, but:

Must fix before merge:

• Add test coverage for PTY reader (critical new component)
• Fix file descriptor leak in PTY reader

Strongly recommended:

• Add input validation to pipeline system
• Fix path traversal in import
• Refactor complex session handler
• Add negative test cases for adapters

The pipeline system and adapter implementations are well-designed. Once PTY tests are added and the FD leak is fixed, this is ready to merge.

---

Test Results Validation: ✅ 10,040 tests passing, 81% coverage
Security Review: ⚠️ Minor issues identified above
Performance: ✅ No major concerns
Code Quality: ⚠️ Some refactoring recommended

Great work on this feature-rich release!