bob-review-diff

bob-review-diff is a command for coding agents from PounceAI/bob-control. It costs 21 tokens per session (1,375 once invoked), scanned A, original, Apache-2.0.

A command that sends a selected Git code difference to IBM Bob for review. A Git diff is the set of changes between two versions of a project.

In plain words
What is it for?
It reviews uncommitted changes or a supplied Git revision range and returns Bob's read-only findings.
Why use it?
It gets a correctness-focused review of recent or specified changes without requiring the user to copy the diff manually.

Command

Part of the bob-companion plugin — 4 skills, 8 commands, 1 agent, 1 MCP server shipped together

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add commands/pounceai/bob-control/bob-review-diff
Clone the repo
git clone --depth 1 https://github.com/PounceAI/bob-control

Or install bob-companion, the plugin that ships this one along with the rest of its 4 skills, 8 commands, 1 agent, 1 MCP server.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for bob-review-diff

README.md
[![agentmods](https://agentmods.dev/badge/commands/pounceai/bob-control/bob-review-diff.svg)](https://agentmods.dev/commands/pounceai/bob-control/bob-review-diff)
Your own site
<a href="https://agentmods.dev/commands/pounceai/bob-control/bob-review-diff"><img src="https://agentmods.dev/badge/commands/pounceai/bob-control/bob-review-diff.svg" alt="Measured on agentmods" height="20"></a>
Per session 21 Only the description is in the session, so the agent can decide to use it. The body loads when it is invoked.
When invoked 1,375 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.00021 $0.01375
Opus 5 $0.00010 $0.00687
Sonnet 5 $0.00004 $0.00275
Haiku 4.5 $0.00002 $0.00137

Measured 3d ago against content hash 6721c35eb092, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

bob-review-diff scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 3d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

claude-plugin/commands/bob-review-diff.md · 71 lines

How it starts

The opening of the file, as written. The whole thing — 71 lines — stays where its author put it; the contents beside it link to each section on GitHub.

You are the foreman. The user wants Bob to code-review the changes that were just made in this repo (typically the ones you made this session). Bob reviews in its read-only review mode — it never edits; it returns a structured findings list. Under headless dispatch the worker parses those findings onto the board (the task result plus a bob-review note), so they come back to you — you don't need Bob's webview panel.

Optional argument (focus note, or an explicit git ref range):

$ARGUMENTS

Do this:

  1. Scope the review — let Bob gather the diff itself. Bob's review mode has the read + command groups and is told to run git diff / git log itself, so don't embed a big diff — hand Bob a scope and let it pull the diff.

    • If $ARGUMENTS has a ref range (.., e.g. main...HEAD), review git diff <range>.
    • Otherwise review the uncommitted changes (the ones just made): from git status --porcelain, name the paths in scope — exclude unrelated in-progress work — and review them via git diff HEAD -- <files> (untracked files by path).
    • If there are none, fall back to branch vs base: git diff @{upstream}...HEAD, or git diff main...HEAD with no upstream.
    • Only embed when there's no git scope to point at (a diff pasted into $ARGUMENTS, or not a repo): a fenced ```diff block, bounded to ~12,000 chars (note any truncation).
    • If there is genuinely nothing to review, say so and stop — don't create an empty task.
  2. File the review task with create_task:

    • mode: review — Bob's native code-review mode. It runs read-only and returns structured findings (severity / location / category, many with a suggested fixed_diff); the worker writes them to the board (task result + a bob-review note), not Bob's webview panel.
    • title: Code review: <short summary of the change> (imperative, specific).
    • tags: ['review'] (the dedup key). If board_status.worker_draining shows a tag-pinned drainer serving this checkout, add its pin tag too — a worker only pulls tasks whose tags include its pin, so a review-only task sits pending under one. Don't pad with tags it won't match (code-review, etc.).
    • priority: high if the user signals urgency, else medium.
    • description: a one-line ask to review for correctness bugs first, then reuse/simplification/efficiency — then the scope (the git command + file list, or the fenced diff only if embedding), then the focus note from $ARGUMENTS if any. (Bob's review mode supplies its own rubric and findings format, so keep this short; don't over-specify.)
  3. Wait for Bob, then surface the findings. Report the new task id and that it routes to {review}. First check board_status (its worker_draining reflects a 2.0 in-process loop as well as a 1.x worker): if worker_draining.draining is false, nothing is draining the board — tell the user it's queued as #id and to start a drainer (open the repo in a Bob 2.0 window, whose in-process loop drains automatically, or run a 1.x worker via launch-worker.cmd), then stop. Otherwise a drainer is live and step 2 tagged the task to its pin, so don't report "queued" for a tag-pinned drainer — call await_task {task_id: id}. It blocks until the drainer runs the task and Bob settles it, so the review comes back this turn:

    • analysis_done (or done) → the full review is in the task result plus a structured bob-review note (severity / location / category, with any fixed_diff). Surface the findings, correctness issues first.
    • waiting (poll window elapsed) → call await_task again; keep waiting while Bob works. If it stays waiting across several calls, nothing is draining the board — tell the user it's queued as #id and to start a drainer (as above) or check /bob-board.
    • needs_input → Bob asked a question (in the response). A 1.x worker parks it on the board — surface it and have the user answer, then await_task again. A 2.0 in-process Bob has no board reply channel, so surface the question for the user to steer in Bob's window. blocked / cancelled → report Bob stopped, with the note reason.

Read the full file on GitHub · 71 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 3d ago First seen · 71 lines · 21 tokens per session scan A 6721c35eb092

Subscribe to this mod's changes

bob-review-diff is a command published in the GitHub repository PounceAI/bob-control (1 stars, last pushed 20d ago), licensed Apache-2.0. It adds 21 tokens to every session and 1,375 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.