Ogma v0.2.13

New

• Added 18 standard application themes, including dark, light, Solarized, high-contrast, Arctic, Forest, Ember, Mist, and system-controlled themes.
• Added expanded UI and code font selection with bundled JetBrains Mono, Fira Code, and Source Code Pro fonts.
• Added live syntax highlighting and font previews in Appearance settings.
• Added managed background MCP execution without opening a terminal window.
• Added recent MCP stdout and stderr diagnostics to the MCP settings page.
• Added authenticated desktop lease monitoring to detect and terminate orphaned backend processes.
• Added graceful backend shutdown covering proxy listeners, terminals, MCP processes, and other runtime resources.
• Added lifecycle smoke testing for native Linux, macOS, and Windows builds.
• Added multi-architecture updater metadata for Windows, macOS, and Linux.

Replay

• Replay sessions now retain independent request templates when created from HTTP History.
• Replay sessions continue working after their original HTTP History entries are deleted.
• Deleting HTTP History now detaches Replay sources without deleting Replay sessions.
• Selecting a Replay attempt now displays the exact request and body used for that attempt.
• Re-selecting an attempt reliably refreshes its request and response details.
• Truncated captured request bodies now produce a clear Replay error instead of sending incomplete data.

Workflows

• response.getBody().toText() now transparently decodes compressed response bodies, including Brotli content.
• Chunked and encoded web assets can now be written to disk in their decoded form.
• Raw encoded bytes remain available through response.getRaw() when the original representation is required.
• Added coverage for large decoded workflow responses without silently truncating their contents.

HTTP History

• Full request URLs now wrap instead of being truncated with ellipses.
• Partial URL selections can now be copied without replacing the clipboard with the complete URL.
• Copying selected request or response content no longer triggers the table-level copy handler.
• Added safe handling when clipboard events have no target element.
• Response headers now have an independent scrollable area.
• Resizing a table column no longer accidentally sorts that column.

Desktop Reliability

• Fixed orphaned ogma-server and MCP processes after closing Ogma on Windows.
• Windows shutdown now terminates the complete backend process tree when graceful shutdown is unavailable.
• Fixed the Linux quit dialog failing to appear or leaving the application blocked.
• Added a native fallback when the custom quit dialog cannot load.
• The embedded browser now discovers and uses the proxy port selected by the backend.
• Improved cleanup of active TCP sockets and stable UI proxy listeners.
• Portable Windows builds no longer incorrectly offer installer-based in-place updates.
• Restored the correct Ogma application icon for Windows installers and executables.
• Standalone browser windows and quit dialogs now follow the selected Ogma theme.

Ogma v0.1.9

HTTP history, intercept, and replay

• Improved HTTP history persistence, filtering, notes, request selection, and large-project performance.
• Fixed navigation cases where captured history could appear to disappear after changing views.
• Improved “Send to Replay” so the newly created replay request is selected immediately.
• Expanded replay editing, templates, placeholders, payload processing, and request execution reliability.
• Improved intercept behavior, request handling, custom rules, exports, imports, and project data consistency.
• Added database indexes and migrations to keep history, findings, replay, workflows, and project operations responsive as data grows.

WebSocket testing

• Improved WebSocket history and replay workflows end to end.
• Expanded replay session handling, message editing, timing, connection lifecycle handling, and error reporting.
• Added permessage-deflate compatibility for compressed WebSocket traffic.
• Improved WebSocket replay persistence and project isolation.

Browser and certificate setup

• Improved the built-in Ogma Browser experience and proxy integration.
• Added stronger local CA handling for HTTPS interception in the built-in browser.
• Reworked the certificate experience with a dedicated installation guide.
• Added platform-specific certificate instructions for Android, Chrome, Firefox, iPhone/iPad, Linux, macOS, and Windows.
• Added branded platform icons, copyable command blocks, and consistent Ogma branding in browser and certificate screens.

Projects and sessions

• Added in-app save-location selection for projects and session backups.
• Improved Save Session As, open-project, backup-and-quit, and restoration workflows.
• Improved recovery of temporary sessions and persisted assessment data.
• Expanded project export/import behavior and session consistency across HTTP, WebSocket, replay, findings, and workspace state.

MCP and AI-assisted testing

• Expanded MCP capabilities and reliability for AI-driven penetration testing.
• Improved MCP configuration, endpoint management, persistent state, transport handling, and error recovery.
• Improved automation, workflow execution, authentication journeys, active/passive scanning, OAST, discovery, and environment-variable handling.

Interface and desktop experience

• Improved navigation responsiveness, workspace warm-up, loading states, and theme consistency.
• Improved browser navigation, menu behavior, modal layout, quit flow, and startup behavior.
• Updated branding across Ogma Browser, certificate guidance, About Ogma, and inspection interfaces.
• Added a refined session save interface and improved accessibility of larger desktop dialogs.

Desktop packaging and releases

• Improved Linux, macOS, and Windows release packaging.
• Fixed architecture isolation so each CI job packages only its intended CPU architecture.
• Fixed macOS DMG packaging conflicts.
• Made code signing explicitly opt-in and prevented empty certificate values from breaking unsigned builds.
• Replaced shell-dependent release-version handling with a cross-platform Node script, fixing Windows release JSON corruption.

Ogma v0.1.5

HTTP History

• Fixed selected rows collapsing columns during inspection.
• Kept rows anchored during live updates and retained inspected rows at the window limit.
• Improved batch update handling for sustained traffic.
• Preserved bulk selections during capture.
• Reconciled missed live updates.
• Stabilized paginated request ordering and corrected paged statistics.
• Expanded the table to use the available container width.

Replay

• Added structured request pretty rendering.
• Preserved edits when switching between request views.
• Synchronized query parameter editing correctly.
• Accepted valid header spacing during replay editing.

Settings and Appearance

• Added more font customization presets and font previews.
• Improved editor font fallback behavior.
• Hardened custom JS settings save/reset flows.
• Cancelled pending CSS apply timers on reset.
• Restored community links in About.
• Fixed log path handling across platforms.

Findings, Exports, Files, and Search

• Kept findings pagination valid after deletions and preserved filters after visible bulk updates.
• Fixed findings badge sync across project switches and imports.
• Improved export validation and filename handling.
• Cleared stale file edit buffers when switching files.
• Prevented redundant Search remounts and kept route query updates stable.

Environment and Scope

• Fixed environment variable interpolation and scope isolation per project.
• Restored workspace-scoped global env vars.
• Kept utility query state when switching tabs.

UI and Plugins

• Kept request icons colorful and trimmed noisy request metadata.
• Improved plugin metadata links and duplicate command dispatch handling.

Ogma v0.1.4

Authenticated Browser Journeys

• Added reusable authenticated browser journey profiles.
• Record and replay login sequences.
• Verify authentication using URLs, DOM state, cookies, or HTTP requests.
• Automatically refresh expired sessions.
• Support manual MFA checkpoints.
• Maintain multiple identities for authorization and IDOR testing.
• Persist journey configuration across application restarts.
• Improve recovery when selectors, navigation targets, or authentication state change.

Schema-Aware API Imports

• Expanded OpenAPI 3 support with:

  • Request bodies and examples.
  • Path, query, header, and cookie parameters.
  • Local references and reusable components.
  • Security schemes and authentication metadata.
  • Server variables.
  • Schema-derived values and insertion points.

• Added GraphQL introspection import and operation generation.

• Added SOAP/WSDL operation and request generation.

• Improved Postman variable, URL, body, and authentication handling.

• Added schema metadata for type-correct request mutation and automated testing.

• Improved format detection and rejection of unsafe external references.

Plugin SDK 1.1

• Completed frontend SDK contracts for:

  • Request retrieval, raw access, and search.
  • Findings.
  • Scope.
  • Projects.
  • Navigation and sidebar integration.
  • Backend communication.
  • Theme and UI lifecycle.

• Added reliable asynchronous SDK initialization.

• Added compatibility declarations for Ogma and SDK versions.

• Improved plugin permission handling and installation review.

• Exposed runtime limits and plugin validation information.

• Strengthened plugin runtime isolation and callback failure handling.

• Improved Community Marketplace package and registry validation.

• Existing unsigned plugins remain fully compatible.

• Published @kaijinlab/ogma-sdk@1.1.0 to npm.

Workflow Improvements

• Workflows are now shared across projects in the same workspace by default.
• Project-specific workflows remain supported.
• Restored workflow node details after navigating away and returning.
• Improved workflow selection and editor state restoration.
• Moved workflow action controls below workflow names for a more compact studio layout.
• Increased the usable workspace available to the node editor.

HTTP History Accuracy

• Replaced the misleading inspected state with accurate modification tracking.
• Requests altered by Match & Replace or interception are now identified as modified.
• Corrected HTTPQL filtering when selecting traffic state indicators.
• Improved visual distinction between traffic sources and modified entries.

Ogma v0.1.3

Run Workflows from HTTP History

• Run active workflows directly from the HTTP History context menu.
• Process single or multiple selected entries.
• Choose from currently enabled active workflows.

HTTPQL-Powered Match & Replace

• Added HTTPQL filters to Match & Replace rules.
• Filter using request and response fields together.
• Response rules can evaluate the associated request method, path, headers, and body.
• Improved named-header matching accuracy and case handling.

Replay Improvements

• Rename sessions using F2 or the context menu.
• Create sessions directly inside collections.
• Move sessions between collections.
• Reorder sessions using drag and drop.
• Move sessions to the top or bottom.
• Send HTTP History entries directly to a Replay collection.
• Delete individual replay attempts.
• Fixed session deletion from the context menu.
• Replaced misleading left/right actions with above/below actions.
• Prevented redundant moves to the current collection.

Workflow Improvements

• Convert workflow executions now appear in Runs and Logs.
• Improved JavaScript line and column diagnostics.
• Added Clear All for workflow run history.
• Workflow connections can be selected and deleted.
• Fixed workflow node renaming.
• Fixed errors when enabling or disabling workflows.
• Testing automatically saves pending workflow changes.
• Test fixtures persist while navigating between views.
• Run history refreshes after test and batch executions.

HTTPQL Fixes

• Named-header substring searches now match values at any position.
• Named-header operators only inspect the selected header.
• Header names are matched case-insensitively.
• Negative operators correctly handle duplicate headers.
• Improved named-header existence checks.

Plugin SDK Fixes

• Fixed sdk.path.join() base-path handling.
• Request paths beginning with a separator no longer replace the base path.
• Added normalization for current-directory and parent-directory segments.
• Preserved platform-specific separators across Windows, Linux, and macOS.

Project Experience

• Removed redundant backup prompts when switching persistent projects.
• Removed redundant backup prompts when closing persistent projects.
• Temporary sessions still warn before closing because their data will be discarded.
• Manual backup and export remain available.

Reliability

• Prevented stale Replay and Workflow context-menu updates.
• Fixed a workflow save timing race.
• Response filters now receive the effective request after interception or modification.
• Improved migration registry validation.
• Added regression coverage across Replay, HTTPQL, Match & Replace, workflows, and plugin path operations.

Ogma v0.1.2

Workflow Testing

• Added editable HTTP request and response fixtures for active and passive workflows.
• Tests execute through the production workflow engine.
• Test results, step output, and errors are available under Runs and Logs.
• Temporary test fixtures are automatically removed from HTTP history.
• Added Run on history support for active and passive workflows.
• Added Ctrl+S / Cmd+S workflow saving.

Plugin Filesystem and Path APIs

• Added sandboxed fs and path module support.
• Added compatibility methods including:
  • readFile / readFileSync
  • writeFile / writeFileSync
  • appendFile
  • exists / existsSync
  • mkdir, list, and related path helpers
• Added destructured imports from "fs" and "path".
• Added protection against directory traversal and symbolic-link escapes.

Match & Replace

• Workflows can now receive and transform the complete HTTP response body.
• Added full-body workflow transformations without forcing literal matching.

Project Management

• Recent projects can now be opened directly from the startup dashboard.
• Added project deletion with an irreversible-action confirmation.
• Projects can be created and imported across different filesystem roots and drives on Windows, macOS, and Linux.

Sitemap

• Background updates no longer unmount or reset the sitemap graph.
• Zoom, pan, collapsed sections, and manually positioned nodes remain stable during refreshes.
• Failed background refreshes preserve the last usable sitemap.

Ogma v0.1.1

New Features

• Browser MCP automation expanded with a full browser automation layer (214 MCP tools).
• MCP runtime now supports filesystem and path modules (sdk.fs, sdk.path) for richer automation workflows.
• Added new MCP tools for extended AI-driven testing and workflow interoperability.
• WebSocket replay UI improvements:
  • explicit replay lifecycle handling in frontend,
  • support for replaying first captured message,
  • support for replaying captured WebSocket sequences.
• Decoder/utility state is now preserved across navigation:
  • input text and recipe draft persistence improvements.

Fixed

• Fixed instance CA download behavior.
• Fixed HTTP history live-update reliability.
• Fixed WebSocket replay disconnect handling and diagnostics.
• Fixed ws replay URL parsing edge cases.
• Fixed ws replay task lifecycle races (connect/disconnect/cleanup/selection flows).
• Fixed duplicate/invalid connect handling in ws replay.
• Fixed oversized inbound frame handling in ws replay.
• Added protection against duplicate reconnect behaviors and stale state.
• Fixed ws replay handshake-cancel race conditions.
• Fixed ws replay send failures and timeline replay action execution.
• Fixed ws replay keepalive behavior:
  • default keepalive behavior hardened,
  • ping handling improved,
  • keepalive timeout handling hardened.
• Fixed desktop temporary session workspace cleanup behavior.
• Fixed desktop session data handling regressions by clearing stale temp workspace state where needed.
• General bug-fix and refactor pass with improved internal stability.
• UI/runtime adjustments to better reflect WS replay connection/state transitions.

Notes

• Focus of this release is primarily WebSocket replay reliability + MCP/browser automation capabilities.
• Packaging/CI behavior has also been corrected to reduce release inconsistencies and improve artifact handling.

Ogma v0.1.0

Initial public alpha release.

Core proxy

• HTTPS MITM proxy with CA certificate management
• HTTP/1.1, HTTP/2, and WebSocket capture
• HTTPQL query language for filtering history
• Intercept, inspect, edit, forward, and drop requests
• Match & Replace rules with regex, header, body, and query support
• Scope presets with HTTPQL and wildcard support

Replay and automation

• Replay editor with raw HTTP editing and parallel send
• Automate (Sniper, Pitchfork, Cluster Bomb) with payload extractors and matchers
• Race condition testing
• HTTP request sequences with variable chaining

Scanning

• Passive scanner
• Active scanner (SQLi, XSS, SSRF, CMDi, SSTI, path traversal, open redirect)
• Content discovery with 9,300 path wordlist
• Custom passive rules

Utilities

• Decoder/encoder (base64, hex, URL, JWT, hash, crypto)
• Sitemap and extracted endpoints view
• OAST (out-of-band testing) with HTTP, HTTPS, DNS, SMTP listeners
• Compare, Notes, Payloads, Reverse Shell generator

Data and organization

• Project management with named projects and temporary sessions
• HAR import/export, Burp XML import, OpenAPI/Postman import
• Findings panel with CVSS scoring and evidence links
• Exports (CSV, JSON, Markdown, HTML report)

AI and automation

• Integrated AI assistant with 36 built-in tools
• MCP server with 160+ tools for external AI clients
• Headless pentest CLI: ogma pentest <url>
• Visual workflow builder

Plugin system

• JavaScript/TypeScript plugin SDK (@kaijinlab/ogma-sdk)
• Sandboxed backend and frontend plugin execution
• Plugin marketplace with SHA-256 verified installs
• sdk.events, sdk.findings, sdk.requests, sdk.storage, sdk.matchReplace, sdk.workflows, sdk.fs

Desktop

• Electron desktop app (Linux, macOS, Windows)
• Built-in Chromium browser (auto-proxied)
• Auto-updater