Advanced Topics

This section covers safety, enterprise governance, and automation topics beyond basic command usage.

• Enterprise Hardening: deploying and governing bb across a fleet, in four parts:
  • Release Verification: signatures, build provenance and SBOMs of a release
  • Fleet Controls: system policy, update controls and mirrors, builds without self-update, internal PKI
  • Fleet Deployment: recipes per operating system and for CI, verification, a helpdesk table, day-2 work
  • MCP Server Governance: confining, restricting and auditing the MCP server
• Security Architecture & Threat Model: trust boundaries, threat vectors, mitigations, and honest enterprise gap tracker
• Repository Discovery and Server Switching: remote-based repo inference, precedence, and multi-server workflows
• Dry-Run Planning: what --dry-run checks for each command, and what its verdict means
• Git Authentication: letting plain git authenticate through bb without storing a token in a repository
• Networks, Proxies and TLS: outbound proxies, internal certificate authorities, and diagnosing a connection
• Machine Mode and Diagnostics: JSON contract and supportability patterns
• Shell Completion: completing commands, flags and the values they take, and setting it up in each shell
• Server-Side Hooks: why bb does not manage plugin hooks or hook scripts, and what to use instead
• Webhook Secrets: the shared secret and endpoint credentials — where bb reads them, and what it refuses to print

These guides are aligned with accepted ADRs and generated reference artifacts.