Naughty 2, Naughty Boy

🚀 DAWG 0.2.3-naughty — Portable Artifacts & Persistent Catalog

0.2.3-naughty makes DAWG artifacts easier to identify, keep, move, and replay. This release adds a persistent local artifact catalog, secure .dawg archive import and export, readable capture names, desktop drag-and-drop import, and better artifact discovery throughout the application.

It also fixes an export-path collision that could ignore the destination selected in the desktop save dialog and create a file named json in the DAWG working directory.

Application and schema version: 0.2.3-naughty
Desktop application version: 0.2.3
Desktop npm package version: 0.2.3-naughty
Browser extension version: 0.2.3 (version_name: 0.2.3_naughty)
Bundled Node.js version: 22.14.0
Bundled mitmproxy version: 12.2.3

---

✨ Highlights

Portable .dawg Artifacts

• Added a portable .dawg archive format for moving captured artifacts between DAWG installations.

• Added engine commands for managing local artifacts:

  dawg artifacts list
  dawg artifacts export <artifact-directory> --output <file.dawg>
  dawg artifacts import <file.dawg>

• Export validates the source OCI artifact before creating the archive.

• Import validates the archive before publishing it to the local artifact store.

• Imported artifacts are installed under ~/.dawg/artifacts/ and immediately become available to the desktop application.

• Direct CLI export remains non-destructive by default and requires --force to replace an existing destination.

Persistent Artifact Catalog

• Added ~/.dawg/artifact-catalog.json to persist artifact source and location metadata.
• Captured artifacts are registered automatically after packaging completes.
• Imported artifacts retain their original archive source and import timestamp.
• Existing valid artifacts that are not yet registered are discovered and classified as legacy/local artifacts.
• Artifact listing now validates local OCI layouts and sorts results by creation time, newest first.
• The desktop application loads saved artifacts at startup instead of relying on temporary React state.
• Artifact lists refresh automatically after capture and import operations.

Desktop Import & Export

• Added native .dawg file dialogs through the Tauri dialog plugin.
• Added an Import action to the dashboard.
• Added drag-and-drop import for .dawg archives.
• Added an Export action for each artifact.
• Export filenames are generated from the artifact title and creation time.
• Added shared execution-log messages for import and export success or failure.
• Fixed desktop export incorrectly appending a second --output json argument.
  • The duplicate argument previously replaced the selected destination.
  • On affected systems, this created an unwanted file named json in the DAWG working directory.
  • Export now preserves the exact path selected in the save dialog.

Readable Capture Names

• Added an optional artifact title to the desktop capture workflow and the engine CLI:

  dawg capture --url https://example.test --title "Checkout timeout"

• Captured artifact directories now use readable timestamped names such as:

  20260912-143025-checkout-timeout
  

• Untitled captures derive a readable title from the target hostname and capture time.

• Name collisions are handled with numeric suffixes instead of replacing an existing artifact.

• Artifact titles are written into the manifest and displayed throughout the desktop application.

Improved Artifact Browsing

• Added origin labels for:
  • captured locally
  • imported archives
  • registry pulls
  • legacy/local artifacts
• The dashboard now displays readable titles, artifact paths, creation times, target URLs when available, and origin metadata.
• Added Replay-page search across artifact title, digest, target URL, and local path.
• Added Replay-page filtering by artifact origin.
• Improved artifact selection labels with readable names and localized timestamps.
• Improved responsive behavior for the Run Replay and Stop Replay controls.

Secure Archive Validation

• Added staged extraction so an imported artifact is not published until all validation succeeds.
• Added protection against malicious or malformed archives, including:
  • path traversal entries
  • backslash-based archive paths
  • symbolic links
  • archives larger than 512 MiB
  • extracted content larger than 1 GiB
  • archives containing more than 10,000 entries
  • compression ratios greater than 100:1
• Added OCI validation for:
  • oci-layout
  • index.json
  • image manifests
  • configuration descriptors
  • layer descriptors
  • SHA-256 blob digests
  • declared blob sizes
  • DAWG manifest schema and layer metadata
• Failed imports are removed from staging without leaving partial artifacts in the local store.

Schema & Version Updates

• Updated the application and artifact schema from 0.2.0-naughty to 0.2.3-naughty.
• Updated desktop Cargo and Tauri package metadata to 0.2.3.
• Updated the browser extension to Chrome install version 0.2.3 with display label 0.2.3_naughty.
• Updated generated configuration, environment lockfile, manifest validation, and doctor diagnostics references.
• Extended the version synchronization tool to support labeled extension versions that include a patch component.

---

🛠 Fixes

• Fixed artifact history disappearing whenever the desktop application restarted.
• Fixed completed captures being represented only by synthetic in-memory entries.
• Fixed imported artifacts not appearing until application state was recreated.
• Fixed desktop export writing to a local file named json instead of the user-selected path.
• Fixed the engine bridge passing conflicting meanings for the --output argument.
• Improved artifact metadata consistency between the Go engine, Tauri IPC bridge, and React desktop application.
• Improved empty and filtered artifact states in the Replay view.

---

🧪 Tests

• Added an engine export/import round-trip test for portable .dawg archives.
• Added archive path-traversal rejection coverage.
• Added Rust regression tests for destination-style --output arguments, including:
  • --output <path>
  • --output=<path>
  • commands without their own output destination
• Updated manifest, environment snapshot, packager, and CLI fixtures for schema version 0.2.3-naughty.

---

⚠️ Upgrade Notes

• Reload the unpacked DAWG browser extension from chrome://extensions after upgrading.
• Chrome or Chromium 116 or newer is required by the extension manifest.
• The default engine schema is now 0.2.3-naughty. Artifacts using the older 0.2.0-naughty schema are not automatically migrated and may be omitted from listing or rejected during import.
• Existing valid 0.2.3-naughty artifact directories under ~/.dawg/artifacts/ are discovered automatically and registered as legacy/local artifacts.
• Import copies an archive into the DAWG-managed artifact store; it does not replay directly from the source archive.
• The browser extension capture workflow is unchanged in this patch, apart from its version update.

---

🔍 Quick Verification

cd engine
npm run check:versions
go test ./...
go build -o dawg.exe ./cmd/dawg
.\dawg.exe --version

Expected engine version:

0.2.3-naughty

To test an artifact round trip:

.\dawg.exe artifacts list
.\dawg.exe artifacts export "<artifact-directory>" --output "C:\temp\sample.dawg"
.\dawg.exe artifacts import "C:\temp\sample.dawg"
.\dawg.exe artifacts list

For desktop verification:

1. Start and stop a capture with an optional artifact title.
2. Confirm the captured artifact appears with a readable title and Captured locally origin.
3. Export it to a user-selected .dawg path.
4. Confirm no unwanted file named json is created in the DAWG directory.
5. Import the archive using the file picker or drag-and-drop area.
6. Find the imported artifact using Replay search or the Imported archives filter.
7. Run the replay and confirm the execution log and final screenshot output.

---

📦 Build

Windows

.\desktop\build-bundle.ps1

For already cached or staged runtime assets:

.\desktop\build-bundle.ps1 -SkipDownload

Linux

chmod +x ./desktop/build-bundle.sh
./desktop/build-bundle.sh

---

🙌 Contributors

Thanks to:

• @REZ3X

for the artifact portability, persistent catalog, desktop integration, capture naming, replay browsing, validation, and packaging improvements in this release.

Naughty Boy is Here, Finally

🚀 DAWG 0.2-naughty — Replay Reliability & Extension Capture

0.2-naughty focuses on making the full capture-to-replay workflow reliable on desktop: extension-driven browser capture, cancellable replay, safe background-process cleanup, and replay-safe sanitization.

Generated application/schema version: 0.2.0-naughty
Desktop package version: 0.2.0
Browser extension version: 0.2.0 (version_name: 0.2_naughty)

---

✨ Highlights

Browser Extension Capture

• Added the DAWG Manifest V3 browser extension for extension-first capture.
• Capture now records rrweb events, user actions, and frontend request metadata from the desktop-selected tab.
• Added an engine streaming server with session-token validation and extension start/stop handshakes.
• The extension focuses an existing matching tab or opens the requested target URL.
• Playwright and bundled Chromium are now dedicated to artifact replay rather than capture.

Reliable Replay

• The Replay page now executes real engine replays through the Tauri IPC bridge.
• Added Stop Replay to interrupt a running replay.
• Cancelling a replay terminates the associated DAWG engine, Node.js, Chromium, and mitmproxy process tree.
• Closing the desktop application now cleans up DAWG-owned background processes, including active replay and capture daemon processes.
• Improved replay lifecycle handling, cleanup ordering, timeout behavior, and Windows process management.
• Added replay diagnostics to Execution Logs:
  • rrweb event-type counts
  • captured URL and viewport metadata
  • iframe/replayer status
  • in-page console and runtime errors
  • visible text length after replay

Replay-Safe Sanitization

• Fixed a critical sanitizer issue where rrweb <!DOCTYPE html> metadata could be incorrectly treated as PII.
  • This previously changed the structural doctype name to a value such as User 7DF37326.
  • Chromium then rejected the malformed doctype and rendered a blank replay page.
• Preserved SVG viewBox and points geometry attributes during sanitization.
  • Numeric SVG data could previously be mistaken for phone numbers or sensitive data.
  • This caused noisy replay logs and malformed icon/diagram rendering.
• Added regression coverage for rrweb doctype and SVG geometry preservation.

Desktop & Bundle Improvements

• Improved Windows background execution so DAWG subprocesses avoid unwanted visible console windows.
• Updated bundle staging and health verification for:
  • DAWG engine
  • mitmdump
  • portable Node.js
  • Playwright dependencies
  • bundled Chromium
  • replay script
  • schema and OPA policy
  • installable browser extension
• Fixed the Windows NSIS packaging invocation to call the local Tauri CLI directly.

Centralized Version Management

• Added root-level version.json as the source of truth for:

  • application version
  • desktop package version
  • browser extension version
  • bundled Node.js version
  • bundled mitmproxy version

• Added synchronization commands:

  npm run sync:versions
  npm run check:versions

• Supports convenient release labels:

  {
    "appVersion": "0.2-naughty",
    "desktopVersion": "0.2",
    "extensionVersion": "0.2_naughty"
  }

  These are normalized automatically where strict SemVer is required.

---

⚠️ Important Notes

Recapture Older Artifacts

Artifacts captured before this release may contain sanitized rrweb structural fields that cannot be restored later.

If an older artifact replays as blank or reports errors such as:

Failed to execute 'createDocumentType' ...

or SVG warnings involving viewBox / points, create a new capture with 0.2-naughty.

Reload the Browser Extension

After updating DAWG:

1. Open chrome://extensions
2. Enable Developer mode
3. Find DAWG Browser Extension
4. Click Reload

This ensures the installed extension uses the current manifest and recorder scripts.

---

🧪 Quick Test Guide

1. Launch DAWG Desktop and confirm the engine status is ready.
2. Open Engine Doctor and verify bundled resources are healthy.
3. Load or reload the DAWG Browser Extension.
4. Open Capture and enter a target URL.
5. Click Start Capture, reproduce a browser issue, then click Stop Capture.
6. Wait for sanitization and OCI artifact packaging to complete.
7. Open Replay, choose the new artifact, and click Run Replay.
8. Confirm:
   • Chromium reconstructs the captured page.
   • Execution Logs show one rrweb FullSnapshot and positive visible text length.
   • Stop Replay correctly closes Chromium when used mid-replay.
9. Start another replay, then close DAWG via the window close button; confirm DAWG background processes do not remain running.

---

📦 Build & Packaging

Windows

.\desktop\build-bundle.ps1

For already cached/staged runtime assets:

.\desktop\build-bundle.ps1 -SkipDownload

Linux

chmod +x ./desktop/build-bundle.sh
./desktop/build-bundle.sh

---

🙌 Contributors

Thanks to:

• @REZ3X
• @AkuSeorangManusia
• @mamatqurtifa

for the capture, extension, replay lifecycle, diagnostics, sanitization, and packaging improvements in this release.

v0.1.3-1/alpha

🚀 Alpha Version of DAWG 0.1.3-alpha Ready for Testing

---

🌟 What's New in v0.1.3-alpha

1. Fixing:

• Engine subprocesses (mitmdump, Playwright/node, the capture
  daemon, and doctor version probes) no longer pop up a visible
  console window on Windows; they now run fully in the background
  for the duration of a capture or replay session.
• The desktop Replay Engine view now actually triggers replay via
  the engine bridge instead of only logging a placeholder message.
• Removed the incorrect "Sandbox requires Linux / WSL2" blocker in
  the Replay Engine view; bare Windows hosts now see accurate
  status describing the engine's native-compatibility replay mode
  (no container isolation / no DB fixture restore, but functional).

2. Add Auto Build & Bundle Deployment Base Configuration

---

📥 Download & Installation

Platform	Format	Description
Windows 10 / 11 (x64)	DAWG_0.1.3_x64-setup.exe	Single-click Windows NSIS Installer
Linux (All Distros)	Not yet published	Build from source yourself
Debian / Ubuntu	Not yet published	Build from source yourself

---

🧪 Quick Test Guide

1. Launch DAWG Desktop: Notice the green Engine Ready [Bundled] status light in the header.
2. Run Diagnostics: Click the status pill to open the 🩺 DAWG Engine Doctor modal and inspect embedded runtime health.
3. Capture a Glitch:
   • Enter your local or remote target web app URL (e.g. https://example.com or http://localhost:3000).
   • Click Start Capture, interact with the page to reproduce the issue, and click Stop Capture.
4. Inspect Artifact:
   • View your packaged OCI artifact in .dawg/artifacts/<session-id>.
   • Run verification checks with dawg verify .dawg/artifacts/<session-id>.

---

Full Changelog: https://github.com/Slaviors-Group/dawg/commits/v0.1.3-1/alpha

Thanks to @REZ3X and @AkuSeorangManusia for the update!

v0.1.2-1/alpha

🚀 Alpha Version of DAWG 0.1.2-alpha Ready for Testing

---

🌟 What's New in v0.1.2-alpha

1. Major Desktop UI Revamp

2. Fixing Access Denied while Creating DAWG Artifacts Folder Store & Standardized Control Paths

---

📥 Download & Installation

Platform	Format	Description
Windows 10 / 11 (x64)	DAWG_0.1.2_x64-setup.exe	Single-click Windows NSIS Installer
Linux (All Distros)	Not yet published	Build from source yourself
Debian / Ubuntu	Not yet published	Build from source yourself

---

🧪 Quick Test Guide

1. Launch DAWG Desktop: Notice the green Engine Ready [Bundled] status light in the header.
2. Run Diagnostics: Click the status pill to open the 🩺 DAWG Engine Doctor modal and inspect embedded runtime health.
3. Capture a Glitch:
   • Enter your local or remote target web app URL (e.g. https://example.com or http://localhost:3000).
   • Click Start Capture, interact with the page to reproduce the issue, and click Stop Capture.
4. Inspect Artifact:
   • View your packaged OCI artifact in .dawg/artifacts/<session-id>.
   • Run verification checks with dawg verify .dawg/artifacts/<session-id>.

---

Full Changelog: https://github.com/Slaviors-Group/dawg/commits/v0.1.2-1/alpha

Thanks to @mamatqurtifa for the update!

v0.1.1-1/alpha

🚀 Alpha Version of DAWG 0.1.1-alpha Ready for Testing

---

🌟 What's New in v0.1.1-alpha

1. Dynamic Path Integration Enhancement in Windows

2. Depecrate MSI Bundler Distribution and Focus in NSIS Bundle Distribution for Windows

3. Enhance Engine Command

---

📥 Download & Installation

Platform	Format	Description
Windows 10 / 11 (x64)	DAWG_0.1.1_x64-setup.exe	Single-click Windows NSIS Installer
Linux (All Distros)	Not yet published	Build from source yourself
Debian / Ubuntu	Not yet published	Build from source yourself

---

🧪 Quick Test Guide

1. Launch DAWG Desktop: Notice the green Engine Ready [Bundled] status light in the header.
2. Run Diagnostics: Click the status pill to open the 🩺 DAWG Engine Doctor modal and inspect embedded runtime health.
3. Capture a Glitch:
   • Enter your local or remote target web app URL (e.g. https://example.com or http://localhost:3000).
   • Click Start Capture, interact with the page to reproduce the issue, and click Stop Capture.
4. Inspect Artifact:
   • View your packaged OCI artifact in .dawg/artifacts/<session-id>.
   • Run verification checks with dawg verify .dawg/artifacts/<session-id>.

---

Full Changelog: https://github.com/Slaviors-Group/dawg/commits/v0.1.1-1/alpha

Thanks to @REZ3X and @mamatqurtifa for the update!

0.1.0-1/alpha

🚀 Alpha Version of DAWG 0.1.0-alpha Ready for Testing

We are excited to announce the initial alpha preview of DAWG (Digs Any Web-app Glitch)!

DAWG eliminates the friction of manual bug reproduction by capturing full-stack web-app glitch sessions, running automated privacy sanitization, and packaging them into deterministic, replayable OCI reproduction artifacts.

---

🌟 What's New in v0.1.0-alpha

📦 1. Self-Contained Monolithic Desktop App (Zero-Config)

No need to manually install Python, Go, Node.js, or mitmproxy. The desktop installer embeds all required runtime environments (mitmdump, node, Playwright scripts, JSON schemas, and OPA policies) into a single standalone bundle.

• Double-click to install — ready out of the box.
• Supports Windows (.exe / .msi) natively for this release; Linux support is source-buildable (see note below).

🩺 2. Built-in dawg doctor Diagnostics

• Comprehensive pre-flight health probe accessible from both the CLI (dawg doctor) and the Desktop UI.
• Instantly verifies runtime readiness, bundled script paths, and schema validation with human-readable and structured JSON outputs.

🎥 3. Full-Fidelity Capture Engine

• DOM & Visual Trace: High-density visual audit recording powered by rrweb.
• Executable Browser Action Trace: Normalized Playwright action stream (actions/browser.jsonl) for faithful automated replay.
• Frontend & Backend HTTP Interception: Synchronous capture of client network requests and third-party API interactions via embedded mitmdump.

🛡️ 4. OPA-Driven Privacy Sanitization

• Hard-gated PII redaction and synthetic value substitution governed by Open Policy Agent (OPA) Rego rules.
• Generates detailed sanitize-report.json with deterministic redactions before export.

🔄 5. Standardized OCI Packaging & Replay Sandbox

• Assembles reproduction sessions into standard OCI Image Layouts with SHA-256 digest-pinned layers and zstd compression.
• Includes preflight sandbox verification and native browser replay engine (dawg run / dawg verify).

---

📥 Download & Installation

⚠️ Note on this release: Only NSIS (.exe) and MSI Windows binaries are included in this alpha. Linux/GNU builds (.AppImage / .deb) are not provided as prebuilt binaries yet — Linux users will need to build from source for the moment. Prebuilt Linux packages are planned for a future release.

Platform	Format	Description
Windows 10 / 11 (x64)	DAWG_0.1.0_x64-setup.exe	Single-click Windows NSIS Installer
Windows Enterprise	DAWG_0.1.0-alpha_x64_en-US.msi	Windows MSI Package
Linux (All Distros)	Not yet published	Build from source yourself
Debian / Ubuntu	Not yet published	Build from source yourself

---

🧪 Quick Test Guide

1. Launch DAWG Desktop: Notice the green Engine Ready [Bundled] status light in the header.
2. Run Diagnostics: Click the status pill to open the 🩺 DAWG Engine Doctor modal and inspect embedded runtime health.
3. Capture a Glitch:
   • Enter your local or remote target web app URL (e.g. https://example.com or http://localhost:3000).
   • Click Start Capture, interact with the page to reproduce the issue, and click Stop Capture.
4. Inspect Artifact:
   • View your packaged OCI artifact in .dawg/artifacts/<session-id>.
   • Run verification checks with dawg verify .dawg/artifacts/<session-id>.

---

💬 Feedback & Known Scope Limitations

• Linux/GNU Builds: Not distributed as prebuilt binaries in this alpha. Linux/GNU developers can build DAWG themselves from source for the moment; prebuilt .AppImage/.deb packages are planned for an upcoming release.
• Bare Windows Replay Sandbox: Replay Docker sandboxing requires WSL2 with Rootless Docker. On bare Windows hosts, browser replay runs in native mock sandbox mode.
• Reporting Issues: Please report reproduction quirks, UI feedback, or environment edge cases on our GitHub Issues.

Full Changelog: https://github.com/Slaviors-Group/dawg/commits/0.1.0-1/alpha

Thanks to @REZ3X for the update