bob¶

ID: bob
Home page: https://github.com/MordechaiHadad/bob
Upstream stars: ⭐ 2,136
Last commit: 2026-08-10
Platforms: 🐧 Linux · 🍎 macOS · 🪟 Windows
Operations: installed · search · install · upgrade · upgrade_all · remove
purl types: pkg:bob
CLI name: bob
Issues and PRs: 📦 manager: neovim-based
Source: meta_package_manager/managers/bob.toml

bob is a version manager for Neovim (https://github.com/MordechaiHadad/bob), installing the editor’s own releases from https://github.com/neovim/neovim.

A package is a version token, and every verb agrees on it: install, uninstall, update and use all take exactly one, and the listing prints one per row. Both shapes of token are real packages: a released tag such as v0.12.4, and the rolling nightly. That is the reading rustup settled, where the object the verbs agree on is what counts as a package.

Parsing notes, verified against bob 4.1.7 on macOS:

No installed_version is captured, deliberately, following pyenv and rustup. The token is the identity rather than a version field: nightly is not a version at all, and one pattern has to serve both shapes, so reporting the whole token as a version would be wrong for every rolling channel. mpm treats the installed version as optional throughout.
The listing is a box-drawing table, and its Status column is the anchor that reads it. bob prints exactly two statuses, Used for the active version and Installed for the rest, so requiring one of them is what rejects the header row, whose second column reads Status, along with the three border rows, which open on a different box character. Requiring the token to look like a version would have dropped nightly instead.
Colors are unconditional. bob writes the SGR escapes around its status and around the stable entry of the catalog whether or not it is writing to a terminal, and honors neither NO_COLOR nor TERM=dumb, all three verified. Nothing is forced to suppress them: mpm searches each line rather than anchoring it, so the patterns step over the escapes instead of fighting them.
Both patterns are deliberately insensitive to whitespace and column width. The table widens from seven columns to sixteen when a nightly rollback exists, and upstream removed the padding from the catalog outright in v4.1.4 (bob#333), so alignment is the one thing about this output that has already changed.
The catalog lists released tags alone, and that costs more than a search hit. nightly never appears in it, so mpm, which resolves a package it was handed no manager for by searching the catalog first, refuses to install a channel bob itself installs without complaint. Naming the manager does not help: the lookup is what supplies the candidate. An installed nightly still lists, upgrades and removes normally, since those read the inventory rather than the catalog.
A search here is broader than it looks, because the ids are versions. mpm’s default matching is fuzzy and counts any alphanumeric segment of the query, so 0.12.4 splits into 0, 12 and 4 and matches nearly every tag Neovim ever cut. --exact is what narrows it to one.
No outdated: nothing reports staleness without acting on it, update computing what is behind and installing it in the same pass.
No cleanup: bob erase deletes every installed version along with bob’s own configuration, which is a mass removal rather than reclamation. The same reading left luarocks purge unmapped.

Caution

bob sync is not mpm’s sync and is deliberately left unmapped. It reads a version file from the working directory and installs whatever that names, which is project scope rather than a metadata refresh. Nothing in bob refreshes its catalog without also acting, so no sync is declared at all.

Note

An empty inventory is reported honestly: bob list writes a timestamped There are no versions installed line to standard output and exits zero. It carries no table row, so the pattern yields nothing and mpm reports an empty inventory rather than a failure.

What `mpm` adds to `bob`¶

Through mpm, bob gains --exact and --extended search, to narrow to exact names or match descriptions.

Bigger still, mpm reaches across every manager at once: mpm installed and mpm outdated cover bob alongside every other manager you run in one table, mpm upgrade --all updates them together, and mpm sbom exports the whole machine as one bill of materials.

Every mpm command also gains --dry-run and --plan previews, cross-scheme version comparison and purl identifiers. See manager augmentations for how each one is built.

Your `bob` commands, in `mpm`¶

You already know bob: each operation maps one-to-one onto mpm, in an interface shared by every manager.

To…	With `bob`	With `mpm`
List what’s installed	`bob list`	`mpm --bob installed`
Search for a package	`bob list-remote`	`mpm --bob search list-remote`
Install a package	`bob install <package_id>`	`mpm install pkg:bob/<package_id>`
Upgrade one package	`bob update <package_id>`	`mpm --bob upgrade <package_id>`
Upgrade everything	`bob update --all`	`mpm --bob upgrade --all`
Remove a package	`bob uninstall <package_id>`	`mpm remove pkg:bob/<package_id>`

Prefix any command above with --dry-run to simulate the underlying manager calls without touching the system: the safe way to watch what mpm would do before trusting it.

Operations¶

Operation	Supported	Notes
`installed`	✓
`outdated`
`orphans`
`search`	✓	exact and extended search backfilled by `mpm`
`install`	✓
`upgrade`	✓
`upgrade_all`	✓
`remove`	✓
`sync`
`cleanup`
`doctor`

Selecting and configuring `bob`¶

Deselect bob for a single run with --no-bob, or persist the choice in your configuration:

[mpm]
bob = false

Keep it enabled but tune how mpm drives it with a per-manager override:

[mpm.managers.bob]
timeout = 900

mpm config-template bob prints every overridable attribute as a ready-to-paste block.

Recipes¶

A few jobs you would otherwise script around bob, one mpm command each:

Snapshot and clone a machine: mpm --bob dump bob.toml, then mpm restore bob.toml on the next one.
Export a compliance SBOM: mpm --bob sbom (CycloneDX by default, --spdx for SPDX).

Privilege escalation¶

mpm runs this manager as the current user and never prepends sudo by default. Flip the policy for its privileged operations with --sudo or the per-manager sudo override.

None of its operations needs root.

See privilege escalation for the full policy.

Cooldown¶

State of bob’s release-age gating, from the cooldown support table:

Status: ❌ None (installs Neovim’s own GitHub releases)

A cooldown only pays off where a compromised release can be withdrawn while the clock runs, and can only be emulated where the registry dates its releases. From the retraction table:

Registry: GitHub release assets
Retraction: None: withdrawing a build is the upstream author deleting their own release or tag. Nothing sits between them and the user
Publish date: ✅ server-set published_at on each release (REST API)

With --cooldown set, mpm skips this manager’s install and upgrade operations rather than run them unguarded (fail-closed); --cooldown best-effort opts back in.

Version probe¶

The version is probed by running:

$ bob --version
bob-nvim 4.1.7

and extracted with:

r"bob-nvim[ \t]+(?P<version>\S+)"

Reference traces¶

Raw native outputs captured in the bundled definition: the reference mpm’s parsers were written against. If you know bob well and a transcript below looks wrong, or a newer release changed its output format, report it.

$ bob list
┌───────────┬─────────────┐
│  Version  │  Status     │
├───────────┼─────────────┤
│  nightly  │  [33mInstalled[0m  │
│  v0.12.4  │  [32mUsed[0m       │
└───────────┴─────────────┘

Feed any of these through mpm and the raw output becomes one uniform table, the same shape for every manager: filter it, project columns, or export it (mpm --bob installed --output json, or csv, toml, yaml), each package carrying a purl and a version comparable across managers.

Upstream project¶

Metrics	`MordechaiHadad/bob`
Activity
Popularity
Metadata

Changelog¶

8.0.0.dev0 (unreleased)
- Add bob as a bundled definition, with installed, search, install, remove and upgrade support. It manages Neovim versions, so a version token is what it calls a package, nightly included; no version is reported alongside, the token being the identity. Its listing is a box-drawing table read by anchoring on the Used/Installed status column, colour escapes and all, bob emitting those whether or not it writes to a terminal.