- Add query subcommands (vulns, runs, steps) with JSON output and flexible filtering
- Enhance assets command with --where, --search, --value filters (fuzzy matching)
- Expand asset searchable columns (status_code, content_type, title, dns_records, tls, tech)
- Add run status and run cancel subcommands with process termination
- Support control-plane and PID-based cancellation with database updates
- Implement fuzzyFilters in GetTableRecords for case-insensitive substring matching
- Add OSM_IGNORE_REGISTRY env var to skip auto binary installation and health checks
- Update health check to display warning when binary folder is empty but OSM_IGNORE_REGISTRY is set
- Update installRequiredBinaries to skip installation when OSM_IGNORE_REGISTRY=true
- Enhance DownloadFile with retry logic and wget/curl fallback for resilient downloads
- Refactor download function to validate content length and handle transient failures
- Refactor test code to use switch statements instead of if-else chains
- Implement agent-acp step type for spawning external ACP agent subprocesses via Agent Communication Protocol
- Add ACPExecutor with validation, field rendering, and subprocess lifecycle management
- Integrate agent-acp field rendering in StepDispatcher (batch and sequential modes)
- Add run_agent() utility function for workflows to execute ACP agents from steps and JS context
- Add osmedeus agent CLI command for interactive agent execution with --agent, --cwd, --timeout, --stdin, and --list flags
- Add /osm/api/agent/chat/completions REST endpoint with OpenAI-compatible chat format and concurrency control
- Support agent selection via: built-in names (claude-code, codex, opencode, gemini) or custom acp_config.command
- Add step-level configuration: cwd, allowed_paths, acp_config (command, args, env, write_enabled)
- Add comprehensive E2E tests for agent-acp workflows (basic, minimal, config, codex variants)
- Add test workflows in test/testdata/workflows/agent-and-llm/
- Update AGENTS.md documentation with agent-acp examples, CLI usage, and API endpoints
- Add tracking of trigger input variables and recognize their availability at runtime
- Downgrade undefined variable warnings to info-level when variables come from event trigger inputs (both new and legacy syntax)
- Add event envelope variables (EventTopic, EventSource, EventTimestamp, etc.) as recognized built-ins when workflow has event triggers
- Include comprehensive test coverage for trigger input scenarios, event triggers, and mixed variable definitions
- Add platform variables (PlatformOS, PlatformArch, PlatformInDocker, PlatformInKubernetes, PlatformCloudProvider) to linter's built-in variables list
- Extract checkStepFieldsForUndefinedVars and collectReferencedVarsFromStep helper functions to support comprehensive scanning of all template-renderable fields including parallel_functions, speed_args, config_args, agent fields, HTTP headers, LLM messages, decision cases/conditions, and memory paths
- Add recursion for nested steps (foreach inner steps and parallel_steps) with proper variable scoping and support for loop-specific variables (_id_, foreach variable)
- Enhance message formatting with highlightQuoted() to make quoted terms bold+yellow in error output
- Enable UndefinedVariableRule by default in GetDefaultRules()
- Add comprehensive test coverage for newly supported fields and nested step types (TestUndefinedVariableRule_*, TestUnusedVariableRule_ReferencedInNewFields)
- Add test fixture and E2E test (TestWorkflow_Validate_UndefinedVarsComprehensive) validating detection across functions and foreach
- Add stripTemplateVarsForJS() to convert {{var}} outside quotes to bare JS variable names, enabling direct param/export access in condition expressions
- Add normalizeBoolStringsForJS() to convert string 'true'/'false' to actual booleans for correct JS truthiness evaluation
- Auto-classify asset types in db_import_asset_from_file() and default source to 'web' when empty
- Improve table display with terminal auto-width detection via term.GetSize(), custom column weights, and display name aliases (status_code → status)
- Change default --width to 0 (auto-detect) with weighted column distribution and minimum header-based sizing
- Add comprehensive tests for param-based conditions and JSON asset imports
- Update test data to use direct param references in conditions instead of exports
- Add cut_to_file() and cut_space() utility functions for file processing and field extraction
- Add comprehensive E2E tests for decision condition routing with function/command execution
- Add test workflows for decision conditions and inline decision execution
- Add short-mode skip guards to all cloud E2E tests to allow quick test runs
- Register new functions in constants and goja runtime
- Refactor table display using tablewriter with box-drawing characters and proper Unicode width handling
- Add --as-cron flag to register cron schedules instead of executing immediately
- Implement new 'osmedeus assets' command for asset querying with filtering and statistics
- Enhance workflow parameter display with categorization and per-module summaries
- Improve column width handling and parameter documentation
- Add jsonl_rename_key() function to rename keys in JSONL files with mapping syntax 'old1:new1,old2:new2'
- Implements fast JSON parsing with fastjson and efficient buffered I/O for large files
- Include comprehensive test coverage with 7 test cases for edge cases and valid mappings
- Remove unused tablewriter dependency from go.mod/go.sum and internal/terminal/table.go
- Refactor printResultSummary() to use markdown table printing instead of tablewriter
- Add test data file ffuf-result.jsonl for integration testing
- Fix function list width default calculation in function.go
- Add sudo_auth() function for TTY prompts and credential management with optional 4-minute keepalive loop
- Add --sudo-aware CLI flag to detect workflows with sudo commands and offer authentication guidance
- Add sudo step scanner to detect sudo usage across all step types (bash, parallel, foreach) and nested structures
- Add parse_url_file() function to batch-process URLs with format directives, supporting bare IPs and CIDR notation
- Add portscan test data with realistic nmap JSONL samples
- Rename {{Workspace}} to {{TargetSpace}} in function examples for clarity
- Add sudo E2E tests covering tip message, flag acceptance, and non-sudo workflows
- Update workflow engine title from all caps to title case ('Osmedeus Orchestration Engine')
- Fix trailing whitespace consistency in architecture diagram
- Add warning emoji to security warning link for better visibility
- Reorganize features into 8 concise categories with expanded descriptions covering the key capabilities
- Consolidate 20+ individual feature bullets into grouped themes (declarative workflows, distributed execution, function library, scheduling, agentic LLM, cloud infrastructure, CLI, and API)
- Emphasize workflow components (hooks, decision routing, module exclusion) and distributed capabilities (master-worker pattern, queue system, webhook triggers)
- Highlight 80+ utility functions including nmap, tmux, SSH, TypeScript/Python, SARIF, and classification tools
- Improve readability and SEO by grouping related features and focusing on use-case benefits
- Implement cloud provider infrastructure (DigitalOcean, AWS, GCP, Linode, Azure) with Pulumi integration for distributed scanning
- Add nmap and tmux utility functions for port scanning results processing and long-running background session management
- Introduce webhook-triggered run execution with unique UUID and authentication key support for external integrations
- Auto-populate HostIP from host field when IP is detected
- Set default vulnerability confidence to 'firm' if not specified
- Skip API logging for Next.js static routes (_next prefix)
- Add QueuePoller for dual-source (DB + Redis) task polling with concurrent execution
- Add worker queue subcommands (list, new, run) for managing queued tasks
- Add uninstall command to safely remove Osmedeus installation
- Add input validation to prevent command injection via dangerous shell characters
- Add queue run support via --queue and --queue-run flags in osmedeus run
- Add queue polling to server with --no-queue-polling flag to disable it
- Support queuing tasks from both CLI and API with deduplication across sources
- Add exec_ts() and exec_ts_file() utility functions for inline and file-based TypeScript execution via Bun
- Implement CDN/WAF detection system with is_cdn, is_cloud, is_waf boolean fields for assets
- Enhance Python execution to prefer uv package manager with fallback to python3/python
- Update roadmap with cloud integration step, clarify security warning, improve documentation
- Add worker eval command for distributed function execution with Redis hooks registration
- Add worker set command to update worker fields (alias, public-ip, ssh-enabled, ssh-keys-path)
- Enhance worker status with JSON output, search filtering, and column selection (--columns, --exclude-columns, --search)
- Add --keep-setting flag to install base/validate commands to preserve osm-settings.yaml after base installation
- Fix binary installation in Nix: replace CopyInstalledBinaryToFolder with SymlinkInstalledBinaryToFolder
- Add --clean-ws flag to db clean command for removing workspace data
- Add HooksEnabled field to Run records when creating runs from CLI and API
- Add comprehensive test coverage for hook execution (pre/post hooks, execution order, failure handling)
- Add test coverage for worker commands (eval, set, status with JSON) and db clean operations
- Improve usage documentation for worker subcommands and db operations
- Add Docker Compose distributed-e2e.yaml with Redis, master, and worker services
- Add Make targets: distributed-e2e-up, distributed-e2e-run, distributed-e2e-down
- Replace zap logger with terminal printer for consistent CLI output in master/worker
- Add Redis connection info and task details to startup and lifecycle logs
- Fix DNS records field: use 'dns_records' key with backward compat for 'a' key
- Add optional asset_type and source parameters to db_import_custom_asset
- Update Swagger docs for LLM embeddings schema
- Set run_uuid tracking in worker task execution for distributed runs
- Register distributed database hooks and ensure external binaries in PATH
- Improve terminal formatting with colors for worker/master IDs and log messages
- Add skip() function to terminate remaining steps in current module while continuing to next module, with optional message parameter
- Implement isFuzzyModuleExcluded() for substring-based module filtering in ExecuteFlow
- Add fuzzy_exclude_modules CLI flag (-X) to both run and scan commands for flexible module exclusion
- Handle ErrSkipModule sentinel error throughout executor (executeStep, executeStepsDAG, ExecuteModule, ExecuteFlow) with proper status propagation
- Update function registry and Goja runtime to register skip() function
- Add comprehensive unit tests for skip() behavior, SkipModuleError, and fuzzy module matching
- Update snapshot tests to use generic example.com instead of shopee.vn
- Add auto-generated _<variable>_ path-friendly variables for foreach loops that sanitize unsafe filesystem characters (/, :, etc.) and deterministically truncate long values
- Refactor asset and vulnerability import/merge logic to preserve existing non-empty fields instead of full overwrite on conflict
- Add mergeAssetFields() and mergeVulnFields() helper functions for consistent field-level merge behavior across all import methods
- Add comprehensive unit tests for merge functions and path-friendly variable behavior in foreach loops
- Add E2E test module (test-foreach-path-friendly) validating sanitization, directory creation, truncation, and variable coexistence
- Add replayDBOperations to reinitialize databases from imported workspaces, with proper parameter resolution and pre-condition skipping
- Implement ISO 8601 timestamp format for snapshots (2026-02-13T18-20-34Z) instead of Unix epoch
- Add --include-heavy flag to include large fields (raw_response, screenshot, blob_content) in database queries
- Fix asset table default columns (url, status_code, content_length, title) for better UX
- Skip heavy initialization for lightweight commands (help, version, completion) to avoid ~50MB overhead
- Optimize database function execution via lazy config initialization
- Fix binary installation via Nix to copy already-installed binaries to binaries folder
- Add ssh_exec() and ssh_rsync() functions for remote command execution and file transfer with connection pooling
- Add db_import_dns_asset() to import DNS zone records and group by domain with A/AAAA records stored separately
- Add db_import_custom_asset() for flexible JSONL asset import with direct field mapping, supporting tags and custom asset types
- Extend Asset model with ExternalURL, Remarks (string array), Language, Size, and LOC fields for better metadata tracking
- Add backward compatibility layer for legacy JSON formats (string remarks, tags array merging)
- Register new functions in function registry with proper documentation and usage examples
- Add test-canary-general command to CLAUDE.md for domain-list-recon testing on hackerone.com subdomains (~40min)
- Update HACKING.md with TestCanary_General documentation and increase total suite time estimate from 60-90min due to additional test scenario
- Clean up canary test fixtures by removing invalid/malformed domain entries (a\]\]b\]c\]d.hackerone.com and o1.email.hackerone.com)
- Add WorkflowHelp struct with Usage and ExampleTargets for CLI documentation
- Add Optional field to Artifact model and database schema with migration support
- Implement workflow search functionality by name, description, and tags in CLI list command
- Add --usage and --search flags to workflow list command with multiple filtering options
- Display workflow usage info in show command when Help is defined
- Support help inheritance in workflow extends/inheritance resolver
- Update vulnerability counters from database after SARIF imports
- Add comprehensive Help unit tests covering parsing, cloning, and mutation isolation
- Improve test helpers with streaming output, diagnostics, and file validation utilities
- Add fourth general canary test for domain-list-recon flow with artifact validation
- Extract 'owner__repo' slugs from code hosting platforms (GitHub, GitLab, Bitbucket, Codeberg) for workspace naming preference
- Implement magic byte detection for archive formats in extractTo() function to support headerless archives
- Implement GetRunSteps() and GetRunArtifacts() API endpoints with database queries
- Format code for consistency in constants, type mappings, and test files
- Convert main Dockerfile to multi-stage build: compile from source in builder stage, runtime on minimal debian-slim image
- Replace remote install.sh with local source binary compilation using Go 1.25
- Pre-install SAST tools (trivy, semgrep, kingfisher, bearer) in both Dockerfile and canary variant
- Fix semgrep installation on Debian by adding --break-system-packages flag to pip install
- Simplify canary Dockerfile by copying pre-built binary and adjusting install order for clarity
- Replace curl-based installation with 'osmedeus install base --preset' command
- Add explicit binary installation for trivy, semgrep, and kingfisher for SAST testing
- Comment out original install script line for reference
- Add docker-compose.canary.yaml with multi-stage Dockerfile to build osmedeus from source and layer onto toolbox base, ensuring canary tests exercise current code not released binaries
- Implement three canary test scenarios (repo SAST scan, domain-lite reconnaissance, CIDR IP scanning) with lifecycle management (container startup/cleanup) and comprehensive assertions on filesystem artifacts and API records
- Add Makefile targets (test-canary-all, test-canary-repo, test-canary-domain, test-canary-ip, canary-up, canary-down) for granular test execution with configurable timeouts (20-60 minutes)
- Add extract_to() utility function for auto-detecting archive formats (.zip, .tar.gz, .tar.bz2, .tar.xz, .tgz) and extracting with automatic destination cleanup
- Refactor Dockerfile to use slim debian base with install script, reducing image complexity and improving build reproducibility
- Update Dockerfile.dev to match production environment (Go 1.25 with full toolchain) while adding preset workflow initialization
- Update trivy binary registry metadata from v0.69.0 to v0.69.1 with direct platform-specific download URLs replacing dual curl installation script
- Update last_update_at timestamp to 2026-02-10T06:59:38.808177+00:00
- Add 'optional' tag to secrets tool in registry
- Add bearer (v2.0.0) SAST security scanner with Linux and Darwin support
- Add sarif_functions.go with SARIF format parsing and vulnerability extraction (parse_sarif, extract_sarif_results, count_sarif_by_level)
- Add comprehensive sarif_functions_test.go with 239 lines of test coverage
- Add SARIF-sourced vulnerabilities to seed database including findings from Semgrep, Trivy, Kingfisher, and Bearer tools
- Add Bearer API key detection SARIF sample for test data
- Support asset_type='repo' for code-level findings from static analysis tools
- Integrate sarif functions into goja_runtime and function constants
- Test data includes real-world SARIF reports demonstrating container, dependency, and secret detection findings
- Implemented detect_language() function that analyzes directory structure to identify dominant programming language
- Detects language by file extension mapping (26+ supported languages: Go, Python, JS, TS, Rust, Java, etc.)
- Falls back to shebang detection for extensionless files (e.g., shell scripts)
- Intelligently skips non-source directories (node_modules, vendor, test, .git, etc.)
- Includes comprehensive test coverage for pure/mixed projects, edge cases, and shebang patterns
- Updated function registry and goja runtime to expose detect_language to workflows
- Update registry metadata timestamp to 2026-02-10
- Remove kingfisher binary (v1.76.0) from registry
- Update trivy version from 0.69.0 to 0.69.1
- Remove 'optional' tag from rsync package
- Add is_file, is_dir, is_git functions for type validation
- Add is_compress function to detect compressed file extensions
- Implement pure Go wget with parallel segmented downloads (>1MB files)
- Add git_clone_subfolder with ZIP fallback for GitHub repos
- Add helper utilities: ZIP extraction, directory/file copying
- Add SkipWorkspace option to skip output dirs in empty-target mode
- Fix workflow preference loading order for --module-url flag
- Add 20+ comprehensive tests for all new functions
- Update README disclaimer to reference the Security Warning documentation page
- Fix homebrew release workflow to run from the homebrew-tap directory context
- Improve CLI/API security guidance by linking to comprehensive security documentation
- Fix spacing in Makefile run-github-action target
- Add run-homebrew-action target to Makefile for workflow orchestration
- Detect explicit local paths (./foo.yaml, ../foo.yaml) and prevent fallback to workflows directory when file not found
- Add debug logging when workflow not found at relative path before trying workflows directory
- Add comprehensive test for explicit local path handling with error cases
- Add lock-free ResultCollector for parallel execution with atomic operations, eliminating mutex contention for pre-allocated slices
- Implement circuit breaker pattern (internal/retry/circuit_breaker) with configurable thresholds and half-open recovery state for fault tolerance
- Introduce json-iterator replacement (internal/json) for 2-6x faster JSON operations while maintaining stdlib compatibility
- Add lazy template rendering (RenderLazy) with variable reference caching for 50-80% faster rendering on large contexts
- Implement memory-efficient buffer pooling (bufpool) with 10MB pre-allocated reusable buffers for reduced GC pressure
- Add LoadFlowWithModules for parallel module pre-loading using errgroup, improving startup time for complex flows
- Add VarRefCache with LRU eviction for variable extraction caching
- Add streaming output support for foreach loops to process large datasets without memory accumulation
- Fix json import compatibility in llm_executor and db_functions
- Update test fixtures with correct YAML field names (call→function, run→command)
- Add empty_target preference to allow running workflows without explicit target
- Implement FlowName template variable for module context awareness
- Optimize cdnDelete, SyncUpload, SyncDownload with worker pool concurrency
- Load workflow preferences early for --empty-target CLI flag support
- Add unit tests for preferences and E2E tests for FlowName functionality
- Update linter to recognize ModuleName and FlowName as built-in variables
- Add inline module support to ModuleRef allowing modules to be defined directly in flows without external files
- Implement IsInline() and ToWorkflow() methods to convert inline ModuleRef definitions to executable workflows
- Update ModuleRef.Clone() to properly duplicate all fields including Steps, Runner, RunnerConfig, and Description
- Add field alignment formatting and make path optional for inline modules
- Enhance parser validation to allow omitting path for inline modules while requiring at least one step
- Update executor's preloadModules() and ExecuteFlow() to handle inline modules during flow execution
- Improve version command output with JSON format support via --json flag and enhanced colored terminal output
- Add RunClient for submitting runs to server with priority support (low, normal, high, critical)
- Implement --run-priority and --server-url CLI flags for server submission mode
- Add RunPriority and RunMode fields to database Run model for persistence
- Update CreateRunRequest with priority and run_mode validation
- Implement runServerSubmission() to submit workflows with priority to server API
- Comprehensive E2E tests for run endpoints with priority validation and multiple targets
- Add foreach-preprocess test workflow with variable_pre_process support
j3ssie