Changelog

Unreleased

0.8.0 — 2026-10-14

• Codex. OpenAI's Codex is a coding agent alongside Cursor, Claude Code, OpenCode and Simasis: connect it under Manage → Coding agents, or pick it for your machine with bugmole agents use codex. It runs in Codex's workspace sandbox.
• Link a project you made in the dashboard. bugmole init lists your projects so a folder can use one whose id differs from the folder's name, and the pairing page for a new machine has Connect this folder to. The project then remembers the folder, so a teammate's init in a clone finds it.
• Your resources first, or Bugmole's. Under the run button, choose whether runs, explorations and AI use your machine and model key first, or Bugmole Cloud and credits first. When the first can't take the work, the other does, and the dashboard says why.
• Monthly limits. Cap AI credits and cloud minutes for the month under Billing → Monthly limits, on any plan, below what the plan includes.
• Sign-in for runs works on your machine too. The sign-in flow and secrets under Settings → Sign-in for runs (it was "Sign-in for cloud runs") now sign in runs and explorations on bugmole serve as well as on Bugmole Cloud. Values reach a worker only for a run or exploration it holds, each release is audited, and a value set on the machine itself still wins.
• The pipeline keeps going. While one flow's task waits for approval or review, the pipeline carries on with the other flows instead of stopping the whole queue.
• What does a plan buy? Pricing and Billing say what each plan's cloud minutes and AI credits roughly cover, and finished tasks are listed newest first.

0.7.3 — 2026-10-13

• serve checks before it starts. It shows which account this folder's key belongs to and fixes a stale saved email, which decided who the dashboard link signed you in as. It shows the coding agent that gets tasks and whether it's signed in, asks which agent to use when none is chosen or the chosen one can't run, holds tasks until it can, and offers to retry tasks that stopped on sign-in. bugmole init --switch-account signs a folder in as another account.
• Simasis and OpenCode sign-in problems are recognised. A missing or rejected Simasis token, and OpenCode with no credentials, stop with the command to fix them instead of being retried. An OpenCode model whose provider isn't set up says so.
• Older task errors read cleanly. Errors stored by earlier versions with the whole prompt in them now show what the agent said.

0.7.2 — 2026-10-13

• A coding agent that isn't signed in says so. When Cursor, Claude Code or OpenCode isn't signed in, bugmole serve says so once, with the command to sign in, stops taking agent tasks until you restart it, and the pipeline waits for you instead of retrying. Agent errors show what the agent said, never the whole prompt. bugmole agents now shows whether each agent is signed in, and use warns when it isn't.
• The pipeline waits for a passing run. When exploration has found flows but none has passed a run yet, the pipeline says to run your tests instead of starting an audit of a flow that doesn't exist.

0.7.1 — 2026-10-13

• Choose a coding agent from the CLI. bugmole agents shows which coding agents this machine has (Cursor, Claude Code, OpenCode, Simasis) and which one gets approved tasks; bugmole agents use claude switches this machine to it, signed in as you. See CLI.
• No more "One more step" loop. People who signed up on Aegis's own page go straight to the setup guide, and the cloud setup confirms you're a person on the page instead of sending you through sign-in again.

0.7.0 — 2026-10-13

• bugmole init asks only what it needs. It asks for the project's name and whether to keep results on this computer or in Bugmole; everything else takes a default. With a machine key it offers your real workspaces (or links to the project's own when it already exists) instead of asking for a workspace id. -y takes every default, --advanced asks about everything, and running it again in a project you're already in links to it. See Getting started.
• Always the latest CLI. Before a command, Bugmole checks npm for a newer version and offers to use it, because npx kept running an old cached copy. Without a terminal or with -y it only mentions it. bugmole --version prints the version; BUGMOLE_SKIP_UPDATE_CHECK=true turns the check off.
• The CLI says what to do next. bugmole on its own shows where the folder stands and the next step, --help groups commands starting with Get started, init ends with the command to run next, and serve leads with the dashboard link and how to stop it.
• A welcome page for new people. The dashboard's /welcome walks through init, serve and exploring a local address, and is where new Free accounts start.
• Exploration tries things. It fills and submits forms and presses buttons, marking what it types with a fingerprint and listing every request that changed something, so you can clean up. It never deletes, signs out, pays or sends to people; those are listed as blockers with how to test them. --read-only (or an environment's Exploration only looks here) keeps it to looking. Pages it couldn't open are listed with why.
• Coding agents per workspace. Connect Cursor, Simasis, Claude or OpenCode under Manage → Coding agents; agents on any worker, including Bugmole Cloud, get Bugmole's tools.
• Flows act like a person. A tap goes to what's visible, not a hidden match, selectOption works with custom drop-downs as well as native ones, and exploration reads a page once it has loaded.
• Linked, for every tracker. Issues → In GitHub is now Issues → Linked: bugs linked to an issue in GitHub, GitLab or Jira, or a Trello card, on one board, each card with its tracker's logo. A bug links to any connected tracker from Link issue, and Jira, GitLab and Trello issues move to Closed when they're done there. See Jira, Trello and project management tools.
• Trello. Connect a board under Settings → Trello with an API key and token, which are encrypted and never shown again.

0.6.1 — 2026-10-05

• Email is sent. Invitations and spending alerts weren't reaching anyone: every email failed before it left. They're delivered now, and if an invitation's email can't be sent, the members page says so and shows the link to share instead of "Invitation sent".
• Explorations go where you choose. Projects on Bugmole storage run in Bugmole Cloud by default. An exploration still waiting for your machine moves to Bugmole Cloud when you choose it, instead of staying on "Digging…".
• Typing is never lost. Saving a secret, role or persona clears the form before saying it's saved, so what you've started typing for the next one stays. The cloud sign-in flow editor waits until your saved flow has loaded before you can type.
• Flows read like a person. assertVisible and assertNotVisible match a sentence across bold text, links and code (Runs in **Bugmole Cloud**); text only a screen reader gets still doesn't count. Taps wait for the page to settle, and a tap within a row never reaches into another row. A failing flow records which requests failed (404 GET https://…/path, without the query). Email steps find a link by its address even when the email service rewrites links for click tracking, and wait out the inbox service's rate limits.
• Agent tasks. A failed task can be cancelled, and a cancelled task leaves the board instead of sitting in Blocked.
• The dashboard opens on the project in the link, instead of loading another project first. An edit page for something deleted says so instead of showing an empty form, and What isn't covered yet says when there are no tests yet instead of "every test passes".
• Longer sign-ins. A dashboard sign-in lasts 8 hours.
• Confirm dialogs work in flows. A flow now answers confirm, alert and prompt dialogs like a person clicking OK (a prompt gets its default value), so confirm-guarded buttons really act; each answer is in the run's log. dialogs: dismiss in the flow's header clicks Cancel instead. See Sample tests.
• Cancel a run. Cancel run on a queued or running run stops it, on your machine or on Bugmole Cloud. Cancelled runs don't count as failures.
• Delete projects, apps and environments; leave or delete a workspace. Each is on the item's page under Settings. Deleting a project cancels its runs and deletes its data and stored evidence; you type its ID to confirm. A workspace can be deleted once it has no projects and no plan that renews. See Using the dashboard.
• Archive stale blockers. A card on Issues → Blockers can be archived for everyone on the project, and restored from the archived list below the board. If the problem happens again, the card comes back.
• Cloud runs sign in too. With a sign-in flow under Settings → Sign-in for cloud runs, every cloud run signs in first and each browser starts signed in, so the flows exploration found behind your sign-in page pass in the cloud.
• Free workspaces are for one person. Inviting teammates now needs Team or Business; a Free workspace has only its owner. People already in a Free workspace keep their access, but an invitation can't be accepted while the workspace is on Free.

0.6.0 — 2026-10-02

• Credentials for your flows. bugmole secrets set NAME keeps a value in this machine's encrypted store, and bugmole secrets lists the {{secret.NAME}}s your flows use and where each comes from. Flows can also read from your own vault (gcpsm:// Google Secret Manager, awssm:// AWS Secrets Manager, keychain://, env://) under secrets: in the config, mixed freely with environment variables. Bugmole Cloud reads Google and AWS vaults without stored keys: you trust Bugmole as an identity provider for one project, and each job gets a short-lived token. See Credentials.

• Is every scenario covered? Test cases now say which kind of scenario they cover (happy path, invalid input, error or empty state, permissions, edge case), and each journey shows what's missing, or why a kind doesn't apply. Coverage also counts the routes in your code that nothing has opened, and the Release report shows each run's results with a ship-or-wait summary.

• Plans run. --mode plan (and bugmole_plan) writes a runnable flow from the journey at spec/flows/journeys/<plan>.yaml, so --mode run executes it. A draft journey can be planned; when its run passes, mark it stable with that run's ID.

• Explore any web app. --mode explore crawls the running app when its code has no route files Bugmole knows (Express, Fastify, a plain Node server), and keeps the transitions you recorded by hand.

• Secrets stay off screen. A secret typed into a plain text field is hidden in screenshots and video, flows that start from a saved session record no trace, and saved sessions are readable by you only.

• Smoother CLI. bugmole init writes a config that works for every mode with no AI key and adds .bugmole.env to .gitignore; --help lists every mode and flag; --grep 404 and other number-like values work; --mode suite finds flows in spec/flows or flows; discover --sign-in keeps the sign-in flow with the flows it found and prints the command to run them.

• One app, one project. A project is now tied to the app it tests: an app on the internet by its domain, an app you run locally by its git repository and the app's folder in it. When a teammate runs bugmole init in their clone of the same repository, or adds the same site, they join the project that's already in the workspace instead of creating a duplicate. Each app in a monorepo is its own project; bugmole init tells you which app it found, and asks for --app-path when a repository has several. Credentials in a git remote are never sent or stored.

• Free workspaces can't share an app. On Free, an app that's already a project in someone else's Free workspace can't be added to another Free workspace: ask the project's owner to invite you, or upgrade. Paid workspaces aren't restricted.

• Inactive projects pause on Free. A Free project with no activity for 30 days (no runs, tasks, exploration, CLI or MCP calls, or dashboard changes) is paused. It stays readable with nothing deleted, doesn't run tests or tasks, and doesn't count toward your project limit. Activate on the project brings it back if the workspace has room. bugmole serve prints the link when a project is paused. Paid plans never pause projects. See Plans and limits.

• What Bugmole tests. Bugmole tests web apps and mobile apps (Android and iOS); data and AI projects are out of scope, and bugmole init says so when it finds no web or mobile app.

• Keep my plan. Cancelled by mistake, or changed your mind about a downgrade? Until the paid period ends, Keep my plan on Billing & usage undoes it. PayPal can't restart a cancelled subscription, so you approve a new one for the same plan that starts when the current period ends; you're never charged twice.

• Manage payment in PayPal. Billing links straight to PayPal's automatic payments page to change the card or bank your subscription charges, and so do the failed-payment banner and email.

• Read-only projects are visible, and you choose which stay active. Projects over your plan's limit are marked Read-only — over your plan's project limit in the project picker and on the project itself, with Upgrade and Choose which projects to keep. The choice is remembered across plan changes. Nothing is deleted.

• Plan limits say what to do next. Adding a project over your plan's limit, from the dashboard or from bugmole init, now names the plan that allows more and links to it; the CLI prints the message and the billing link instead of an error. bugmole init also can't create a second Free workspace: it adds the project to the Free workspace you already have.

• One way to show what a plan doesn't include. Device clouds, pull request and merge request checks, Slack and Teams alerts, single sign-on, SCIM, the full audit log and AI test fixes all say Available on Team and Business (or the plan that has it) with See plans.

• Run history follows your plan everywhere. Runs older than your plan's history are hidden from the run page and its evidence too, not only from the runs list.

• See what your plan includes. Settings marks the features your plan doesn't include with the plan that does (for example, Single sign-on shows Business), and hides features that aren't available to your workspace yet. The dashboard and the server now read one answer for every feature and limit, so what you see is what you can use. Enterprise contracts can set their own limits and features, and a feature can be switched on for a workspace for a trial.

• What isn't covered yet. Overview lists every coverage gap Bugmole can see, with the reason and a next step. Gaps include pages and journeys with no tests, tests never run, and tests failing or blocked in their latest run. Journeys whose test cases were all retired are listed, as is what exploration couldn't reach: a sign-in page, pages that didn't open, skipped links, or its page limit.

• How Bugmole finds what to test. A new help page (Help → How Bugmole finds tests, and in the docs) explains how scenarios are found and how tests, test cases and audits are written. It also covers what counts as covered. Overview and Tests have a short How Bugmole found these panel, and each test case says whether it's an Assumption or Checked by a run.

• Estimated time before you start. Run tests and Explore this URL say how long they usually take before you press them. The estimate comes from that test's recent runs, then its step count, and otherwise says there's no estimate yet.

• Jira Cloud. Connect a Jira project under Settings → Jira with an Atlassian API token, which is encrypted and never shown again. Propose test plan to Jira on the Tests page posts the proposed test cases as one Jira task. Each test you approve gets its own ticket, with no duplicates. After every run, passed tickets move to Done; failed tickets move to Blocked (or get a bugmole-blocked label), with the assignee and reporter mentioned. After a fix, mention Bugmole in a comment and it retests just that ticket's test. Cloud runs now also record each test case's result. See Jira and project management tools, which also covers how Asana, ClickUp and Monday.com would fit.

• Roles: Bugmole suggests, you confirm. Discovery and agents suggest the roles a journey runs as (guest, member, admin) from sign-in walls, role-gated routes and menus, spec/roles.yaml and discovered journeys, each with the evidence behind it. Settings → Roles lists them as Suggested: confirm, rename or reject each one, or add your own. Only confirmed roles are used to plan test cases and runs; agents can suggest (bugmole_role_propose, bugmole roles suggest) but never confirm. See Roles.

• Review finished agent tasks. When an AI worker finishes a task, the project's approval mode decides whether a person reviews it first: Manual reviews every task, Auto (the default) reviews code and UI tasks, Extreme none. Agent tasks gains an In review column with Accept and Send back; a task sent back returns to the queue with your note for the agent. Tasks that already finished are unchanged. See Reviewing finished tasks.

• Boards for runs, agent tasks and issues. Runs, Agent tasks and Issues (Blockers and In GitHub) are now boards with a column per status, and every card shows the same four things: its type (Run, Task, Test case, Issue or Audit finding, each with its own icon and colour), its status, its owner (the machine or cloud that holds it, or Unassigned) and one next action such as Approve, Resume, Retry, Open evidence, Ask the agent or Open in GitHub. Each page also says in one line what its cards are. Long columns show their first few cards and Show more.

• Step status in the journey graph. Every step shows its status in words: Not checked, Discovered, Verified, Failed or Blocked, with the reason on hover and in the step's detail, and a legend above the graph.

• Test case history. Recording test case results no longer loses the previous ones: each set of results is kept. The Tests page shows each case's last ten results and flags flaky cases, which pass and fail across runs.

• Propose changes to test cases. Agents (bugmole_propose_test_case), developers (bugmole propose <file>) and people on the Tests page propose adding, changing or retiring a test case. Accepting follows the project's approval mode. An accepted change becomes the next revision and makes the old one obsolete; obsolete revisions keep their results but no longer run or count. Results record which revision they judged.

• Sign-in for cloud runs. Bugmole Cloud can now explore behind your sign-in page. Save a sign-in flow and the secrets it types under Settings → Sign-in for cloud runs: cloud exploration signs in first, and cloud runs can type the same {{secret.NAME}} values. Secrets are encrypted per project, write-only (nobody can read one back, not even through the API), and released only to the cloud runner running that project's job. Secret values are replaced with [secret] in every log, result and manifest, and a flow that types a secret records no trace.

• Approve agent tasks. Each project has an approval mode: Manual (every task waits for a manager's approval), Auto (the default: code changes wait, explorations and investigations start by themselves) or Extreme (nothing waits). Agent tasks gains an Approved column and Approve on queued tasks. bugmole serve --approval <mode> makes a worker stricter than its project.

• Fixed: Resume on a cloud project put a task that only your machine can run back in the queue, where nothing would ever pick it up. Now it says the task runs on your machine and to start npx bugmole serve; an exploration can be resumed on Bugmole Cloud instead. Resumed cloud tasks start straight away, and queued tasks waiting for a machine say Waiting for your machine. See Where agent tasks run.

0.5.0 — 2026-09-29

• MIT license. @bugmole/cli and the bugmole launcher are now MIT licensed.
• Install with npx bugmole. npx bugmole init runs the CLI without installing it, and npm install -g bugmole installs it; both install @bugmole/cli. Installing now also downloads Chromium, Firefox, WebKit and ffmpeg. CI skips the download unless BUGMOLE_PLAYWRIGHT_INSTALL=true; skip it anywhere with BUGMOLE_SKIP_PLAYWRIGHT_INSTALL=true.
• A dashboard that matches the site. The sidebar reads Overview, Tests, Runs, Issues and Devices. Agent tasks and App Audit fold under Advanced. Blockers, visual bugs and GitHub-linked issues are tabs of one Issues page, and Settings in the account menu leads to every settings page. A glossary explains every term.
• Runs page. Every kept run with its result, what started it (dashboard, pull request or commit) and a link to its GitHub check. Each test shows its last ten results, and flaky tests are flagged.
• When will it be done? Runs, explorations and agent tasks show roughly how long they have left and when to come back.
• Read your tests. Select a test to see the plan and flow it runs, and a test case to see its steps and checks.
• A new project starts with its URL. Overview leads with Paste your app's address and what happens next.
• Discovery is honest about sign-in. When all it can reach is a sign-in page, it says so and skips AI. AI journeys that use buttons or pages discovery never saw are set aside, with the reason.
• Proven flows in the journey graph. A test that passes draws the flow it proved; explored flows used to stay hidden as drafts.
• Readable test names instead of plan ids, with their step counts, and coverage that counts tests.
• Fixed: a cloud project's Explore this app waited forever for a local worker; environments could be duplicated when pairing a machine or exploring a URL.

0.4.0

• Bugmole's new home. Install @bugmole/cli; the commands are bugmole and bm. The dashboard lives at app.bugmole.com and the API at api.bugmole.com (the old addresses redirect). Existing workspaces keep working unchanged: configuration files and environment variables under their earlier names are still read when the new ones aren't present. MCP tools are now named bugmole_*, so update any prompts that call them by name.

• Discover an app from its URL. A real browser explores the app like a first-time visitor — following links, noting pages and forms, never submitting anything — and you watch it live. Every page and form becomes a runnable flow and test plan.

• Debug failed runs. Each browser's result opens to Overview, Logs, Screenshots, Trace (with a downloadable Playwright trace), and AI Analysis: the cause, the evidence, and a suggested fix. Your configured AI model explains it in plain words.

• Apply fix re-runs the failed browser with the suggested change written to the flow.

• Parallel runs across browsers and devices. A run now executes on Chrome, Firefox, Safari (WebKit), and Edge, plus emulated phones such as iPhone 15 and Pixel 7, all at once. Each browser reports its own status, steps, duration, and screenshot.

• Run against the environment you choose. Runs use the selected environment's URL, and flows written against another address follow it.

• Run tests from the dashboard with a browser, device, and environment picker, and see each browser's result live, with its duration.

• CLI: --browsers, --devices, and --base-url for bugmole --mode run and bugmole --mode suite.

• Cloud worker images include Chromium, Firefox, WebKit, and (on amd64) Edge.

• A browser that isn't installed is reported as blocked with the command to install it, instead of failing the run.

• Local storage without an explicit folder now uses runtime.artifacts_dir, so the dashboard finds every screenshot.

• Secrets in flows: type passwords with {{secret.NAME}} (read from BUGMOLE_FLOW_SECRET_NAME). Everything typed is now masked in logs and step results, email links are logged without their tokens, and a suite's shared session is deleted when it ends.

• Security: the dashboard no longer accepts identity headers from the browser; only a verified session or API key identifies a request.

• Fixed --plan-id being ignored by bugmole --mode run.

• Fixed restarting bugmole serve failing with "device already claimed".

0.3.0 — 2026-09-15

• GitHub issues: link findings to GitHub issues through a project's own GitHub App installation.
• Web-flow suites: run a folder of flows deterministically with bugmole --mode suite, including real email for sign-up journeys.
• Devices: mirror and drive USB-attached Android devices and iPhones from the dashboard, watch several devices in a dockable drawer, record iOS and Android runs, and get notified when a device is unplugged or comes back.
• Cloud workers: run dashboard web runs on a headless cloud worker and read their evidence from Bugmole.
• Runs record real verdicts, so the pipeline finishes and test cases show their true status.
• Bounded run retries, and a human can resume a task that ran out of attempts.
• The dashboard says when it isn't connected instead of reporting 0% coverage.

0.2.0 — 2026-08-29

• Graph-first dashboard with journeys, real per-step evidence, and Devices.
• Understand the app before crawling it, starting where users start, with route inference.
• Pipeline: shows what each stage is doing, keeps going after exploration, and pauses for an answer instead of silently retrying a stuck stage.
• Test case assumptions, project-scoped audits, Storybook scanning, and a parity bug list.
• Dashboard upgraded to Next.js 16.
• Fixed the task queue spinning and long stages being stopped early.

0.1.5 — 2026-07-18

• The Bugmole CLI and MCP server are published as @bugmole/cli: explore, plan, run, and report.