Configuration

Bugmole reads bugmole.config.yaml from the project. Environment substitutions use ${NAME:-default}.

Runtime

runtime:
  env: sandbox
  workspace_id: default
  artifacts_dir: ./qa/bugmole-runs
  spec_dir: ./spec

Use sandbox for isolated data. If an environment cannot be classified confidently, treat it as staging and do not perform destructive actions.

LLM

llm:
  provider: manual
  api_key: ${LLM_API_KEY}
  model: ${LLM_MODEL:-manual-review}
  base_url: ${LLM_BASE_URL}

Provider credentials belong in environment variables. Do not put provider keys in registry records, manifests, logs, or dashboard responses.

MCP

mcp:
  enabled: true
  host: 127.0.0.1
  port: 3187

Keep the MCP server on loopback for local project execution unless you have explicitly secured the deployment boundary.

Browser execution

execution:
  playwright:
    base_url: http://localhost:3010
    headless: true
    browsers: [chromium, firefox, webkit, msedge]
    devices: ["iPhone 15", "Pixel 7"]
    parallel: 4
  retries:
    step: 2
    journey: 1

Set PLAYWRIGHT_BASE_URL when the application runs at another local address. Retries are for transient failures; they must not turn invariant, permission, or destructive-action failures into passes.

Browsers and devices

A web run executes once per target, and targets run in parallel:

browsers — any of chromium (Chrome), firefox, webkit (Safari), and msedge (Edge). Each runs at desktop size. Defaults to [chromium].
devices — Playwright device names such as iPhone 15 or Pixel 7. Each device is emulated on the engine it ships with: WebKit for Apple devices, Chromium for the rest.
parallel — how many targets run at once. Defaults to the number of targets, up to 4. BUGMOLE_TARGET_CONCURRENCY overrides it.

A run passes only when every target that ran passed. A target whose browser isn't installed is reported as blocked with the install command, and doesn't fail the others. Firefox can't emulate mobile devices, so that pairing is reported as blocked too.

Choosing browsers and devices in the dashboard's Run tests control, or passing --browsers and --devices to the CLI, overrides the configuration for that run.

Which URL a run hits

The environment selected for the run (dashboard), or --base-url (CLI). Absolute URLs in the flow are moved onto this origin, keeping their paths, so a flow recorded against staging runs against the environment you picked.
The plan's target base_url.
The flow's own url: header.

Secrets in flows

Flows reference passwords and other secrets as {{secret.NAME}} in inputText. Bugmole reads them from BUGMOLE_FLOW_SECRET_NAME on the machine running the flow; no other environment variable is readable from a flow. Typed text is masked in playwright.log and step results. See Sample tests.

Machine credentials

The CLI reads machine identity from .bugmole.env, not the dashboard's private .env:

BUGMOLE_REGISTRY_URL=https://api.bugmole.com
BUGMOLE_API_KEY=bm_live_...
BUGMOLE_AEGIS_EMAIL=you@example.com

API keys are bearer credentials. Store them locally as secrets, scope them to the required project and permissions, and never publish their plaintext in documentation or logs.