---
url: https://docs.ogmabox.com/changelog.md
description: Ogma release notes, from the first public release to the latest version.
---

# Changelog

Release notes listed newest first. Published releases are available on [GitHub Releases](https://github.com/ogmabox/ogma/releases).

## v0.3.1

This entry combines the changes introduced in v0.3.0 and the release fixes in v0.3.1.

### Languages and Accessibility {#v0-3-1-languages-and-accessibility}

* Added application translations in 24 languages, covering the interface, desktop dialogs, browser controls, workflow feedback, and exported security reports.
* Added a first-run language prompt, bilingual language names, and language-specific plural and number formatting.
* Added right-to-left layouts for supported languages while keeping URLs, protocol syntax, and technical viewers readable left to right.
* Improved keyboard navigation, modal focus handling, visible focus indicators, and translated layouts.

### HTTP History, Search, and Scope {#v0-3-1-http-history-search-and-scope}

* Added seek-based pagination, bounded table caches, and visible-page prioritization to reduce memory use and unnecessary work in large histories.
* Removed the loaded-row ceiling from filtered history browsing; additional results are fetched as needed rather than retained together in memory.
* Stabilized row selection, inspected requests, column sizing, and scroll position while new traffic arrives or background refreshes complete.
* Improved live reconciliation when responses change whether a request matches the active filter, including requests outside the currently loaded window.
* Fixed stale scope settings, show-all scope behavior, and manual HTTPQL queries being overwritten by header filters.
* Added the HTTPQL `is_null` operator for missing-response filters and corrected short Unicode body searches.
* Added pinned Search queries, HTTPQL field suggestions, and pagination controls for results beyond the first page.
* Added saved-filter import and export, and improved selected-request exports and history context actions.

### Replay, Automate, and WebSocket Testing {#v0-3-1-replay-automate-and-websocket-testing}

* Added project cookie jars with per-session selection in Replay.
* Made Match & Replace application optional for Replay requests and sequences, and added controls for preserving or recalculating Content-Length.
* Added per-session undo, request search, request-file saving, a GET/POST toggle, and target synchronization when pasting raw requests.
* Improved Replay tab shortcuts, request-draft preservation, and attempt selection when opening sessions.
* Added redirect following, response-side Match & Replace processing, payload alignment, a column picker, and bulk deletion in Automate.
* Added placeholder creation from selected request text and hexadecimal payload support.
* Improved WebSocket interception and browser message sending, prevented reconnects after an intentional disconnect, and bounded transcript rendering.
* Improved live SSE history refreshes, filtering, deletion, and WebSocket connection highlighting.

### Embedded Browser and Proxy {#v0-3-1-embedded-browser-and-proxy}

* Fixed the blank embedded-browser pane caused by an Electron rendering regression and updated Electron to 44.4.5.
* Added website HTTP authentication prompts and proxy-aware handling for authenticated WebSocket upgrades.
* Preserved connection-bound NTLM and Negotiate authentication and native popup contexts used by SSO flows.
* Added TLS client-certificate selection and ensured configured identities are presented to upstream targets and specialized probes.
* Added browser authentication controls and passkey account selection, with credential use restricted to trusted domains.
* Added optional per-instance proxy username and password authentication, with automatic credential handling in the embedded browser.
* Added a network-interface picker for proxy listener addresses and Linux transparent HTTP/HTTPS proxying gated on the required privileges.
* Preserved HTTP/2 request trailers during upstream forwarding and expanded HPACK regression coverage.

### Workflows and AI Assistant {#v0-3-1-workflows-and-ai-assistant}

* Added workflow creation and testing through AI assistant conversations.
* Added cross-workflow node copy and paste, HTTPQL preset filters, a resizable node configuration panel, and a full URL-encoding mode.
* Allowed structurally incomplete workflows to be saved while keeping validation feedback available for testing and execution.
* Reduced repeated graph serialization and polling updates, and improved node configuration and run-comparison state handling.
* Fixed project switching so Replay drafts are saved and Automate results, workflow execution details, Sitemap, and Search do not retain stale project state.

### MCP and Agent Workflows {#v0-3-1-mcp-and-agent-workflows}

* Added durable assessment checkpoints and a recovery timeline so agents can resume work after losing context.
* Added bounded tool discovery, exact contract lookup, compact Replay contracts, and actionable follow-up information while keeping the full tool list available.
* Updated MCP tool listings to preserve the protocol-required result type supplied by rmcp.
* Improved background-tab input, active-tab synchronization, browser snapshots, JavaScript dialogs, storage operations, and download metadata.
* Preserved primary finding evidence when linking supporting requests and added persisted WebSocket conversations for evidence workflows.
* Improved Match & Replace tool contracts, request-body searches, scope declaration, sitemap results, and long-running passive scan progress.
* Reduced redundant project lookups and browser health probes, and retained execution receipts across uncertain sends and session recovery.

### Project Data and Interface Reliability {#v0-3-1-project-data-and-interface-reliability}

* Improved project activation so stale list responses cannot restore the wrong active project.
* Added local-filesystem paths for saving and importing project backups, and a backup-management interface.
* Added Markdown and fullscreen finding descriptions, complete-project finding exports, and project-prefixed export filenames.
* Improved Sitemap navigation, path display, persisted expansion state, and endpoint details.
* Added collapsible navigation groups, additional appearance themes, shortcut import/export, and a CodeMirror editor for custom JavaScript and CSS.
* Reduced unnecessary allocations, repeated list refreshes, local-storage writes, and heavy syntax highlighting across the interface.
* Fixed stale plugin commands, file-upload and deletion state, export polling, scanner settings, and generated finding notifications.
* Improved startup progress, desktop window geometry, quit dialogs, and recovery from partially migrated databases.

### Build and Release {#v0-3-1-build-and-release}

* Migrated application metadata to OgmaBox and updated compatible frontend and Rust dependencies.
* Bounded generated release notes so the first release in a new repository cannot exceed GitHub's description limit.
* Fixed retries to reuse existing draft releases instead of attempting to create them again.
* Restricted Linux capability helpers to Linux production builds while retaining cross-platform unit-test coverage, fixing the macOS and Windows compilation errors found during the v0.3.0 build.

## v0.2.20

[GitHub release](https://github.com/ogmabox/ogma/releases/tag/v0.2.20)

### HTTP History and Scope {#v0-2-20-http-history-and-scope}

* Restore cached rows and scroll position immediately when returning to a long HTTP history, without waiting for background refresh requests.
* Add persistent controls for URL truncation and inline query display, while preserving table row heights and column widths.
* Add a request-to-scope preset menu directly in HTTP history.
* Apply ordered scope rules consistently and refresh active history when scope settings change.

### Workflows {#v0-2-20-workflows}

* Keep passive workflow execution and run logs tied to the project that captured the request.
* Stop downstream workflow nodes when an HTTPQL condition does not match, while preserving explicit true/false branches and conditional joins.

### MCP and Browser Automation {#v0-2-20-mcp-and-browser-automation}

* Fill individual inputs or multiple form fields using snapshot element references, with submission kept explicit.
* Add focused browser snapshots, text search, bounded output, and changes-only snapshots that include updated values and states.
* Let browser actions optionally wait for an expected outcome and return a compact observation.
* Support consistent explicit and snapshot-derived tab targeting across browser actions, waits, and dialogs, and report the tab used.
* Unify request editing inputs across direct sending and replay, including compatible request identifiers, header formats, and text, JSON, or base64 bodies. Preserve duplicate headers and exact raw HTTP bytes.
* Add tools to read paginated WebSocket replay transcripts and disconnect replay sessions.
* Return compact structured results with output schemas for commonly used tools, while retaining compatibility text and optional detail.
* Return browser screenshots as native MCP images, preserve form validation and submit handlers, and include controls beneath ignored accessibility nodes.
* Honor navigation and wait timeouts, improve browser logs, report missing selectors and unavailable resources correctly, and retain bounded API error diagnostics.

### Replay and Proxy {#v0-2-20-replay-and-proxy}

* Preserve edited raw HTTP framing end to end, including malformed CRLF sequences, and retain raw requests in replay attempts.
* Expose diagnostic details when a WebSocket replay handshake is rejected or returns an invalid accept value.
* Decode complete multi-member gzip bodies and repeated Content-Encoding headers.
* Keep plugin-modified request targets and Host headers consistent, and preserve zero Content-Length headers through upstream proxies.

### Application Fixes {#v0-2-20-application-fixes}

* Preserve environment editor values after saving.
* Keep plugin tabs tied to the selected plugin and prevent cleared logs from reappearing through stale responses.
* Recover export polling after transient API failures and discard stale pagination results after refreshing the export list.
* Return saved OAST settings when changing listener ports.
* Clear MCP loading state after superseded status requests.

## v0.2.19

Released 2026-09-08 · [GitHub release](https://github.com/ogmabox/ogma/releases/tag/v0.2.19)

### WebSocket Replay

* Added managed connection modes for Socket.IO 3/4, GraphQL graphql-transport-ws, and legacy graphql-ws.
* Added configurable Socket.IO namespaces, authentication payloads, and GraphQL connection parameters.
* Added protocol initialization, acknowledgement handling, heartbeat responses, and clearer authentication and initialization errors.
* Start independent Socket.IO connections without reusing captured browser session IDs.
* Fixed plain ws:// connections to use the standard HTTP Upgrade handshake.
* Prevent stalled sends from blocking other sessions and keep disconnect operations cancellable.
* Fixed connection-status synchronization and missing final messages when connections close.
* Corrected API limits that rejected otherwise valid large text and binary messages.
* Added indexed, gap-free transcript pagination to prevent missing messages during active capture.

### HTTP/2

* Enabled browser-facing HTTP/2 negotiation with HTTP/1.1 fallback.
* Stream responses without waiting for the entire body, improving handling of long-lived responses and concurrent streams.
* Forward large responses completely while limiting the amount retained for capture.
* Preserve partial captures when responses are cancelled.
* Reject oversized requests instead of forwarding an empty request body.
* Correctly combine split HTTP/2 cookie headers when forwarding to HTTP/1.1.
* Preserve response trailers in stored Replay attempts and expose them in response inspection.

### HTTP History

* Added independent desktop windows for inspecting captured requests and responses.
* Preserve scroll position when navigating between HTTP History and Replay.
* Fixed single-request actions and Shift-click range selection.
* Added progress feedback while deleting all history entries.
* Give request URLs a full-width row for easier reading and selection.
* Made hexadecimal display independent of the headers/body section selection.
* Fixed compressed body previews by decoding content before applying byte ranges.

### HTTP Replay

* Added an expandable JSON tree view for responses.
* Extended hexadecimal editing to the request line, headers, and body.
* Made control characters visible and editable in Raw mode, with corresponding clipboard handling.
* Preserve attempt status information after loading saved sessions.
* Keep Replay statistics isolated to the selected session.

### Workflows and Match & Replace

* Restored workflow execution across header, path, query, request-line, response-line, and status-code transformations.
* Added HTTPQL-based matching previews with total counts and query-error feedback.
* Prevent saved rules from being unintentionally changed when loaded into the editor.
* Correctly parse complete header lines when applying Add Header rules.
* Decode compressed response bodies before passing them to conversion workflows and update body-related headers after transformation.

### Findings and Endpoints

* Added Delete All for findings across the current project, independent of visible-page limits.
* Refresh finding totals, severity counts, and sidebar badges without reloading.
* Retain HTTP evidence referenced by findings and endpoints after clearing HTTP History.
* Added individual and project-wide endpoint deletion.
* Added individual and project-wide WebSocket history connection deletion.

### Notes and Scanner

* Added direct sidebar access to Notes, in-note search, and Markdown formatting and save shortcuts.
* Isolated persisted notes between projects within the same workspace.
* Added workspace-wide controls for endpoint generation, scanner findings, and OAST listeners.
* Added persistent controls for individual passive rules and default active checks.

### Build and Release

* Pinned Rust to 1.98.1, refreshed compatible Rust and frontend dependencies, and upgraded electron-builder to 26.15.3.
* Fixed strict pnpm installation failures caused by the unused electron-winstaller build script.
* Corrected Linux container PATH handling, macOS packaged-resource detection, and the shutdown smoke-test assertion.

### Regression Coverage

* Expanded coverage for HPACK decoding, HTTP/2 streaming, WebSocket compression, TLS fallback, managed protocols, and transcripts containing 25,000 messages.
* Added regression checks for the affected interface behavior and direct release publishing.
* Verified Linux dependency installation in native x64 and emulated ARM64 containers.

## v0.2.13

Released 2026-09-01 · [GitHub release](https://github.com/ogmabox/ogma/releases/tag/v0.2.13)

### New

* Added 18 standard application themes, including dark, light, Solarized, high-contrast, Arctic, Forest, Ember, Mist, and system-controlled themes.
* Added expanded UI and code font selection with bundled JetBrains Mono, Fira Code, and Source Code Pro fonts.
* Added live syntax highlighting and font previews in Appearance settings.
* Added managed background MCP execution without opening a terminal window.
* Added recent MCP stdout and stderr diagnostics to the MCP settings page.
* Added authenticated desktop lease monitoring to detect and terminate orphaned backend processes.
* Added graceful backend shutdown covering proxy listeners, terminals, MCP processes, and other runtime resources.
* Added lifecycle smoke testing for native Linux, macOS, and Windows builds.
* Added multi-architecture updater metadata for Windows, macOS, and Linux.

### Replay

* Replay sessions now retain independent request templates when created from HTTP History.
* Replay sessions continue working after their original HTTP History entries are deleted.
* Deleting HTTP History now detaches Replay sources without deleting Replay sessions.
* Selecting a Replay attempt now displays the exact request and body used for that attempt.
* Re-selecting an attempt reliably refreshes its request and response details.
* Truncated captured request bodies now produce a clear Replay error instead of sending incomplete data.

### Workflows

* response.getBody().toText() now transparently decodes compressed response bodies, including Brotli content.
* Chunked and encoded web assets can now be written to disk in their decoded form.
* Raw encoded bytes remain available through response.getRaw() when the original representation is required.
* Added coverage for large decoded workflow responses without silently truncating their contents.

### HTTP History

* Full request URLs now wrap instead of being truncated with ellipses.
* Partial URL selections can now be copied without replacing the clipboard with the complete URL.
* Copying selected request or response content no longer triggers the table-level copy handler.
* Added safe handling when clipboard events have no target element.
* Response headers now have an independent scrollable area.
* Resizing a table column no longer accidentally sorts that column.

### Desktop Reliability

* Fixed orphaned ogma-server and MCP processes after closing Ogma on Windows.
* Windows shutdown now terminates the complete backend process tree when graceful shutdown is unavailable.
* Fixed the Linux quit dialog failing to appear or leaving the application blocked.
* Added a native fallback when the custom quit dialog cannot load.
* The embedded browser now discovers and uses the proxy port selected by the backend.
* Improved cleanup of active TCP sockets and stable UI proxy listeners.
* Portable Windows builds no longer incorrectly offer installer-based in-place updates.
* Restored the correct Ogma application icon for Windows installers and executables.
* Standalone browser windows and quit dialogs now follow the selected Ogma theme.

## v0.1.9

Released 2026-08-24 · [GitHub release](https://github.com/ogmabox/ogma/releases/tag/v0.1.9)

### HTTP history, intercept, and replay

* Improved HTTP history persistence, filtering, notes, request selection, and large-project performance.
* Fixed navigation cases where captured history could appear to disappear after changing views.
* Improved “Send to Replay” so the newly created replay request is selected immediately.
* Expanded replay editing, templates, placeholders, payload processing, and request execution reliability.
* Improved intercept behavior, request handling, custom rules, exports, imports, and project data consistency.
* Added database indexes and migrations to keep history, findings, replay, workflows, and project operations responsive as data grows.

### WebSocket testing

* Improved WebSocket history and replay workflows end to end.
* Expanded replay session handling, message editing, timing, connection lifecycle handling, and error reporting.
* Added `permessage-deflate` compatibility for compressed WebSocket traffic.
* Improved WebSocket replay persistence and project isolation.

### Browser and certificate setup

* Improved the built-in Ogma Browser experience and proxy integration.
* Added stronger local CA handling for HTTPS interception in the built-in browser.
* Reworked the certificate experience with a dedicated installation guide.
* Added platform-specific certificate instructions for Android, Chrome, Firefox, iPhone/iPad, Linux, macOS, and Windows.
* Added branded platform icons, copyable command blocks, and consistent Ogma branding in browser and certificate screens.

### Projects and sessions

* Added in-app save-location selection for projects and session backups.
* Improved Save Session As, open-project, backup-and-quit, and restoration workflows.
* Improved recovery of temporary sessions and persisted assessment data.
* Expanded project export/import behavior and session consistency across HTTP, WebSocket, replay, findings, and workspace state.

### MCP and AI-assisted testing

* Expanded MCP capabilities and reliability for AI-driven penetration testing.
* Improved MCP configuration, endpoint management, persistent state, transport handling, and error recovery.
* Improved automation, workflow execution, authentication journeys, active/passive scanning, OAST, discovery, and environment-variable handling.

### Interface and desktop experience

* Improved navigation responsiveness, workspace warm-up, loading states, and theme consistency.
* Improved browser navigation, menu behavior, modal layout, quit flow, and startup behavior.
* Updated branding across Ogma Browser, certificate guidance, About Ogma, and inspection interfaces.
* Added a refined session save interface and improved accessibility of larger desktop dialogs.

### Desktop packaging and releases

* Improved Linux, macOS, and Windows release packaging.
* Fixed architecture isolation so each CI job packages only its intended CPU architecture.
* Fixed macOS DMG packaging conflicts.
* Made code signing explicitly opt-in and prevented empty certificate values from breaking unsigned builds.
* Replaced shell-dependent release-version handling with a cross-platform Node script, fixing Windows release JSON corruption.

## v0.1.5

Released 2026-08-15 · [GitHub release](https://github.com/ogmabox/ogma/releases/tag/v0.1.5)

### HTTP History

* Fixed selected rows collapsing columns during inspection.
* Kept rows anchored during live updates and retained inspected rows at the window limit.
* Improved batch update handling for sustained traffic.
* Preserved bulk selections during capture.
* Reconciled missed live updates.
* Stabilized paginated request ordering and corrected paged statistics.
* Expanded the table to use the available container width.

### Replay

* Added structured request pretty rendering.
* Preserved edits when switching between request views.
* Synchronized query parameter editing correctly.
* Accepted valid header spacing during replay editing.

### Settings and Appearance

* Added more font customization presets and font previews.
* Improved editor font fallback behavior.
* Hardened custom JS settings save/reset flows.
* Cancelled pending CSS apply timers on reset.
* Restored community links in About.
* Fixed log path handling across platforms.

### Findings, Exports, Files, and Search

* Kept findings pagination valid after deletions and preserved filters after visible bulk updates.
* Fixed findings badge sync across project switches and imports.
* Improved export validation and filename handling.
* Cleared stale file edit buffers when switching files.
* Prevented redundant Search remounts and kept route query updates stable.

### Environment and Scope

* Fixed environment variable interpolation and scope isolation per project.
* Restored workspace-scoped global env vars.
* Kept utility query state when switching tabs.

### UI and Plugins

* Kept request icons colorful and trimmed noisy request metadata.
* Improved plugin metadata links and duplicate command dispatch handling.

## v0.1.4

Released 2026-08-11 · [GitHub release](https://github.com/ogmabox/ogma/releases/tag/v0.1.4)

### Authenticated Browser Journeys

* Added reusable authenticated browser journey profiles.
* Record and replay login sequences.
* Verify authentication using URLs, DOM state, cookies, or HTTP requests.
* Automatically refresh expired sessions.
* Support manual MFA checkpoints.
* Maintain multiple identities for authorization and IDOR testing.
* Persist journey configuration across application restarts.
* Improve recovery when selectors, navigation targets, or authentication state change.

### Schema-Aware API Imports

* Expanded OpenAPI 3 support with:
  * Request bodies and examples.
  * Path, query, header, and cookie parameters.
  * Local references and reusable components.
  * Security schemes and authentication metadata.
  * Server variables.
  * Schema-derived values and insertion points.

* Added GraphQL introspection import and operation generation.

* Added SOAP/WSDL operation and request generation.

* Improved Postman variable, URL, body, and authentication handling.

* Added schema metadata for type-correct request mutation and automated testing.

* Improved format detection and rejection of unsafe external references.

### Plugin SDK 1.1

* Completed frontend SDK contracts for:
  * Request retrieval, raw access, and search.
  * Findings.
  * Scope.
  * Projects.
  * Navigation and sidebar integration.
  * Backend communication.
  * Theme and UI lifecycle.

* Added reliable asynchronous SDK initialization.

* Added compatibility declarations for Ogma and SDK versions.

* Improved plugin permission handling and installation review.

* Exposed runtime limits and plugin validation information.

* Strengthened plugin runtime isolation and callback failure handling.

* Improved Community Marketplace package and registry validation.

* Existing unsigned plugins remain fully compatible.

* Published @kaijinlab/ogma-sdk@1.1.0 to npm.

### Workflow Improvements

* Workflows are now shared across projects in the same workspace by default.
* Project-specific workflows remain supported.
* Restored workflow node details after navigating away and returning.
* Improved workflow selection and editor state restoration.
* Moved workflow action controls below workflow names for a more compact studio layout.
* Increased the usable workspace available to the node editor.

### HTTP History Accuracy

* Replaced the misleading inspected state with accurate modification tracking.
* Requests altered by Match & Replace or interception are now identified as modified.
* Corrected HTTPQL filtering when selecting traffic state indicators.
* Improved visual distinction between traffic sources and modified entries.

## v0.1.3

Released 2026-08-10 · [GitHub release](https://github.com/ogmabox/ogma/releases/tag/v0.1.3)

### Run Workflows from HTTP History

* Run active workflows directly from the HTTP History context menu.
* Process single or multiple selected entries.
* Choose from currently enabled active workflows.

### HTTPQL-Powered Match & Replace

* Added HTTPQL filters to Match & Replace rules.
* Filter using request and response fields together.
* Response rules can evaluate the associated request method, path, headers, and body.
* Improved named-header matching accuracy and case handling.

### Replay Improvements

* Rename sessions using F2 or the context menu.
* Create sessions directly inside collections.
* Move sessions between collections.
* Reorder sessions using drag and drop.
* Move sessions to the top or bottom.
* Send HTTP History entries directly to a Replay collection.
* Delete individual replay attempts.
* Fixed session deletion from the context menu.
* Replaced misleading left/right actions with above/below actions.
* Prevented redundant moves to the current collection.

### Workflow Improvements

* Convert workflow executions now appear in Runs and Logs.
* Improved JavaScript line and column diagnostics.
* Added Clear All for workflow run history.
* Workflow connections can be selected and deleted.
* Fixed workflow node renaming.
* Fixed errors when enabling or disabling workflows.
* Testing automatically saves pending workflow changes.
* Test fixtures persist while navigating between views.
* Run history refreshes after test and batch executions.

### HTTPQL Fixes

* Named-header substring searches now match values at any position.
* Named-header operators only inspect the selected header.
* Header names are matched case-insensitively.
* Negative operators correctly handle duplicate headers.
* Improved named-header existence checks.

### Plugin SDK Fixes

* Fixed sdk.path.join() base-path handling.
* Request paths beginning with a separator no longer replace the base path.
* Added normalization for current-directory and parent-directory segments.
* Preserved platform-specific separators across Windows, Linux, and macOS.

### Project Experience

* Removed redundant backup prompts when switching persistent projects.
* Removed redundant backup prompts when closing persistent projects.
* Temporary sessions still warn before closing because their data will be discarded.
* Manual backup and export remain available.

### Reliability

* Prevented stale Replay and Workflow context-menu updates.
* Fixed a workflow save timing race.
* Response filters now receive the effective request after interception or modification.
* Improved migration registry validation.
* Added regression coverage across Replay, HTTPQL, Match & Replace, workflows, and plugin path operations.

## v0.1.2

Released 2026-08-08 · [GitHub release](https://github.com/ogmabox/ogma/releases/tag/v0.1.2)

### Workflow Testing

* Added editable HTTP request and response fixtures for active and passive workflows.
* Tests execute through the production workflow engine.
* Test results, step output, and errors are available under **Runs** and **Logs**.
* Temporary test fixtures are automatically removed from HTTP history.
* Added **Run on history** support for active and passive workflows.
* Added `Ctrl+S` / `Cmd+S` workflow saving.

### Plugin Filesystem and Path APIs

* Added sandboxed `fs` and `path` module support.
* Added compatibility methods including:
  * `readFile` / `readFileSync`
  * `writeFile` / `writeFileSync`
  * `appendFile`
  * `exists` / `existsSync`
  * `mkdir`, `list`, and related path helpers
* Added destructured imports from `"fs"` and `"path"`.
* Added protection against directory traversal and symbolic-link escapes.

### Match & Replace

* Workflows can now receive and transform the complete HTTP response body.
* Added full-body workflow transformations without forcing literal matching.

### Project Management

* Recent projects can now be opened directly from the startup dashboard.
* Added project deletion with an irreversible-action confirmation.
* Projects can be created and imported across different filesystem roots and drives on Windows, macOS, and Linux.

### Sitemap

* Background updates no longer unmount or reset the sitemap graph.
* Zoom, pan, collapsed sections, and manually positioned nodes remain stable during refreshes.
* Failed background refreshes preserve the last usable sitemap.

## v0.1.1

Released 2026-08-08 · [GitHub release](https://github.com/ogmabox/ogma/releases/tag/v0.1.1)

### New Features

* Browser MCP automation expanded with a full browser automation layer (214 MCP tools).
* MCP runtime now supports filesystem and path modules (`sdk.fs`, `sdk.path`) for richer automation workflows.
* Added new MCP tools for extended AI-driven testing and workflow interoperability.
* WebSocket replay UI improvements:
  * explicit replay lifecycle handling in frontend,
  * support for replaying first captured message,
  * support for replaying captured WebSocket sequences.
* Decoder/utility state is now preserved across navigation:
  * input text and recipe draft persistence improvements.

### Fixed

* Fixed instance CA download behavior.
* Fixed HTTP history live-update reliability.
* Fixed WebSocket replay disconnect handling and diagnostics.
* Fixed ws replay URL parsing edge cases.
* Fixed ws replay task lifecycle races (connect/disconnect/cleanup/selection flows).
* Fixed duplicate/invalid connect handling in ws replay.
* Fixed oversized inbound frame handling in ws replay.
* Added protection against duplicate reconnect behaviors and stale state.
* Fixed ws replay handshake-cancel race conditions.
* Fixed ws replay send failures and timeline replay action execution.
* Fixed ws replay keepalive behavior:
  * default keepalive behavior hardened,
  * ping handling improved,
  * keepalive timeout handling hardened.
* Fixed desktop temporary session workspace cleanup behavior.
* Fixed desktop session data handling regressions by clearing stale temp workspace state where needed.
* General bug-fix and refactor pass with improved internal stability.
* UI/runtime adjustments to better reflect WS replay connection/state transitions.

### Notes

* Focus of this release is primarily WebSocket replay reliability + MCP/browser automation capabilities.
* Packaging/CI behavior has also been corrected to reduce release inconsistencies and improve artifact handling.

## v0.1.0

Released 2026-07-19 · [GitHub release](https://github.com/ogmabox/ogma/releases/tag/v0.1.0)

Initial public alpha release.

### Core proxy

* HTTPS MITM proxy with CA certificate management
* HTTP/1.1, HTTP/2, and WebSocket capture
* HTTPQL query language for filtering history
* Intercept, inspect, edit, forward, and drop requests
* Match & Replace rules with regex, header, body, and query support
* Scope presets with HTTPQL and wildcard support

### Replay and automation

* Replay editor with raw HTTP editing and parallel send
* Automate (Sniper, Pitchfork, Cluster Bomb) with payload extractors and matchers
* Race condition testing
* HTTP request sequences with variable chaining

### Scanning

* Passive scanner
* Active scanner (SQLi, XSS, SSRF, CMDi, SSTI, path traversal, open redirect)
* Content discovery with 9,300 path wordlist
* Custom passive rules

### Utilities

* Decoder/encoder (base64, hex, URL, JWT, hash, crypto)
* Sitemap and extracted endpoints view
* OAST (out-of-band testing) with HTTP, HTTPS, DNS, SMTP listeners
* Compare, Notes, Payloads, Reverse Shell generator

### Data and organization

* Project management with named projects and temporary sessions
* HAR import/export, Burp XML import, OpenAPI/Postman import
* Findings panel with CVSS scoring and evidence links
* Exports (CSV, JSON, Markdown, HTML report)

### AI and automation

* Integrated AI assistant with 36 built-in tools
* MCP server with 160+ tools for external AI clients
* Headless pentest CLI: `ogma pentest <url>`
* Visual workflow builder

### Plugin system

* JavaScript/TypeScript plugin SDK (`@kaijinlab/ogma-sdk`)
* Sandboxed backend and frontend plugin execution
* Plugin marketplace with SHA-256 verified installs
* `sdk.events`, `sdk.findings`, `sdk.requests`, `sdk.storage`, `sdk.matchReplace`, `sdk.workflows`, `sdk.fs`

### Desktop

* Electron desktop app (Linux, macOS, Windows)
* Built-in Chromium browser (auto-proxied)
* Auto-updater