v0.11.0

[0.11.0] - 2026-06-19

Flow Editor — your repository keywords are first-class

• A dedicated, top-pinned "Your resources" section groups the keywords from
  your repo's .robot/.resource files (file glyph + relative-path subtitle),
  separate from the library list; the imports panel now splits into distinct
  Resources and Libraries lists.
• Inserting a resource keyword shows a localized import-confirmation toast
  (the auto-Resource-import is no longer silent) and pre-fills the node's
  required argument slots from the keyword's [Arguments] signature.
• Long keyword names get a hover tooltip (full name) and stay legible; a new
  sort control (Most used / A–Z / Imported first) and a "what's shown"
  filter with an adaptive default (hides not-installed example libraries for
  repos that already have an environment and a non-trivial test file) let you
  shape the palette. All choices persist.
• Fixed a duplicate where a repo's resource keywords appeared both under
  "Your resources" and again as a library group.

Explorer — quiet, repo-scoped keyword loading

• Keyword data is now cached per repository: switching files no longer
  re-invalidates and refetches the whole keyword set every time (it only
  refreshes on real changes — imports added, package installs, saves).
• The "Loading keywords…" indicator is now a subtle slim line instead of a
  prominent bar, and only appears on first repo open.

Deployment governance (Epic GOV)

• Operators can lock down feature areas per deployment — first up, package
  management. Flags resolve ENV > DB > default-on; enforcement is
  per-endpoint (a disabled feature returns 403 even for admins) and audited.
  A token-guarded useFeatureFlags() gates the UI; an env override locks the
  matching Settings toggle.

Robot Framework execution config (Epic EXEC)

• The New Run dialog exposes Include/Exclude tags, threaded to the existing
  robot --include/--exclude runner.

AI provider & output (Epic AIX)

• Added a LiteLLM provider type (gateway to many models) and a
  verbosity control for AI failure analysis.

Security

• Cleared all open Dependabot advisories: cryptography → 49.0.0,
  PyJWT → 2.13.0, starlette → 1.3.1 (with fastapi → 0.137.2 and
  robotframework-roboview → 1.0.0), and dompurify → 3.4.11
  (GHSA-cmwh-pvxp-8882).

CI / Docs

• New i18n & docs consistency gate keeps EN/FR/ES documentation subsections
  in lockstep so a section can't ship in one language but not the others.

v0.10.0

RoboScope 0.10.0.

Flow Editor — control-structure authoring

• Added EXCEPT and FINALLY palette items, and adding a TRY now scaffolds TRY → EXCEPT → END, so a TRY block is valid Robot Framework the moment it's added (a bare TRY … END is a syntax error and couldn't be completed via the UI before). New Playwright E2E builds IF/ELSE and TRY/EXCEPT through the UI and asserts they land cleanly in the Code tab, on disk, and across a reload.

AI failure analysis — localized output + one-click fixes

• The analysis now runs in the frontend's current language (EN/DE/FR/ES/ZH); prose is translated while code, keywords, and patches stay verbatim.
• Suggested unified-diff patches can be applied automatically with one click — applied context-first, refusing (HTTP 422) when hunks no longer match, so a stale patch can never corrupt a test.
• The analysis is scoped to its execution/report and no longer lingers when switching runs.

Statistics

• The success-rate-over-time chart renders one slot per calendar day: days without executions keep their width (no bar) so the time axis is continuous and evenly spaced.

Internationalization

• Complete Simplified Chinese (中文) translation — every section of the UI is now translated (previously most fell back to English).

Security & CI

• Bumped fastmcp to >=3.2.4,<4 and cleared all remaining open Dependabot advisories (closes #35).
• Added a Windows online-install smoke gate (#49).

---

🤖 Generated with Claude Code

RoboScope 0.9.0

Headline: a substantial round of UX polish + stabilization driven
by hands-on user testing — Flow Editor, Recorder, Reports, Repos
and Dashboard all touched.

Security

• New SECURITY.md documenting the disclosure process, supported
  versions, and known third-party advisories. Three open Dependabot
  alerts on fastmcp 2.14.x (transitive via rf-mcp) are
  documented as not exploitable in RoboScope's usage — none of
  the vulnerable APIs (OpenAPIProvider, OAuthProxy,
  gemini-cli) are reached. Tracked for the bump in #35.
• picomatch advisory (GHSA-3v7f-55p6-f55p) closed via top-level
  override pinning >= 4.0.4; follow-redirects advisory closed
  by the axios 1.16 bump merged from main.

Dashboard rebuild

The landing page is now a card grid pointing into every navigable
section of the app (Repos, Explorer, Runs, Stats, Recorder,
Environments, Docs, Settings) plus a "Tip of the day" card that
rotates through 30 RoboScope-specific tips daily. The previous
KPIs / recent-runs / repo-grid layout is retired — KPIs and
recent-runs live under their dedicated views (Stats, Runs).

Default "Robot Framework Examples" git project

First-time users get a ready-to-use reference suite seeded on
startup: https://github.com/raffelino/robot-framework-examples
— public repo, Apache-2.0, 61 headless tests covering BuiltIn,
Collections, String, DateTime, OperatingSystem, Process,
RequestsLibrary, Browser (headless), DatabaseLibrary plus
control-flow + templates + setup/teardown + variables-file +
custom-library concepts. Auto-sync is off by default; manual sync
button still works.

Recorder — visibility-aware selector verification

The Story S.3 verifier evolved beyond uniqueness:

• LocatorFactory now returns MatchInfo(total, visible, actionable)
  rather than a plain count. Playwright resolves each candidate's
  visibility + enabled state in one evaluate_all round-trip per
  candidate (was N×2 RPC calls before — pushed e2e budgets past
  30 s).
• Candidates rank by actionable_rank (0 = gold, 1 = visible-only,
  2 = hidden, 3 = unverified-multi) then quality_score — gold
  candidates always sort before disambiguated multi-match ones.
• Penalty schedule: visible-but-disabled −5; total ≥ 1 visible 0
  −25 (kept as fallback for auto-heal but always loses to a
  visible alternative).
• Page-level scrolls (no element captured) are dropped — Browser
  library's Scroll To Element requires a selector and crashed
  replay with "expected 1 argument, got 0".
• Targeted-keyword-without-selector lines are now emitted as pure
  RF comments (# RBSCOPE: dropped …) instead of
  <Keyword> # WARNING: (which RF parsed as a zero-arg call
  and crashed at replay).

Reports — clickable HTML report + Detailbericht merge

• Run-Detail panel and standalone /reports/<id> view now ship
  the keyword tree (formerly the "Detailbericht" tab) inside the
  summary tab so the deep view is one scroll away rather than a
  tab click. HTML Report keeps its own tab.
• The HTML report's iframe loads from
  /api/v1/reports/{id}/assets/report.html?at=<token> (302 from
  the legacy /html endpoint) so JS-driven navigation
  (location.href = "log.html#xxx") lands at the right path.
• HTML files served by the asset endpoint get a <base href>
  injection carrying a freshly minted asset token + a
  fragment-fix script for <a href="#…"> clicks. Clicking on a
  test row now opens its log, no more "authentication required".
• Two new "↗ open in new tab" affordances: one on the
  Detailbericht header (opens /reports/<id>/detailed, a minimal
  layout that renders ONLY the keyword tree), one on the HTML
  Report tab (pops the iframe URL out).

Repos — UX and stability

• Clicking a repo name or URL/path in the Repos card now jumps
  straight into the Explorer for that project.
• New (i) info pills next to Sync / Auto-Sync / Pre-Run-Sync
  with click-toggle popovers explaining each term.
• Auto-recovery for stale sync_status='syncing' rows: the
  5-min auto-sync tick now scans for rows with
  updated_at < now − 10 min and resets them to error with a
  clear message so the user is no longer stuck waiting for a
  backend restart.

Flow Editor — many small fixes

• Backspace (Mac) / Delete (Win/Linux) on a selected node deletes
  it.
• Library palette categories sort by usage in the current file —
  the libs you use most bubble to the top.
• Project: category for the currently-open file is pinned to the
  top of the palette and badged "this file".
• Switching files auto-collapses the palette; explorer keyword
  refresh re-collapses too — palette always opens condensed.
• Selected element gets a thicker primary-color outline + halo +
  10 % tint background.
• "+" palette add inserts directly after the selected node, not
  at the bottom.
• Adding the first return-variable to a keyword step
  auto-promotes it to assignment syntax (${var}= Keyword …);
  removing the last var flips it back.
• Detail panel spans the full canvas height; left-edge resizer
  lets the user widen it for keywords with many arguments.
• Library auto-imports trigger after save (not before), and the
  RF-bundled set (Collections, String, DateTime, …) is no longer
  filtered from libdoc introspection — explicitly imported
  bundled libs now show their full keyword surface, not the
  curated 10-keyword "(examples)" subset.
• Keyword doc modal renders libdoc HTML output directly; doc cap
  raised from 200 → 4000 chars; doc_format field now flows
  through search-keywords schema → router → store → modal.

Code Editor

• \# is now treated as a single escape token; the inline
  comment regex no longer eats the rest of the line after a
  backslashed hash.

Stats / Heal-rate

• Heal-rate KPI card moved from the top of Overview to the bottom
  (under Flaky Tests). Lila gradient and accent border replaced
  with the standard card chrome — the card reads as one of N
  stats rather than a hero metric.

Navigation

• Identity Providers and Teams entries are marked preview in
  the sidebar (small accent pill) — features are still in active
  development.

---

Older work that landed during the same release window
(feat/recorder-and-bmad branch) follows.

Recorder quality (loop session 2026-04-29 evening)

Landed as 14 commits all driven by hands-on user testing on
heise.de. The flow:

1. Stuck-recorder reset button (b8fb5ff) — new "Reset stuck
   recordings" panic button on the launcher view. Idempotent
   POST /recordings/sessions/reset cleans up any DB rows in
   RECORDING for the current user (graceful stop signals + force
   to CANCELLED). For the case where the recorder thread crashed
   but the DB and orphan Chromium are still around. 5 backend tests.
2. Cross-origin iframe capture (feb0029) — Sourcepoint /
   OneTrust / TCF consent banners live in cross-origin iframes; the
   capture script aborted in non-top frames and silently dropped
   every cookie-accept click. Now runs in every frame, tags payloads
   with frame_url, emitter wraps the active selector with
   iframe[src*="<host>"] >>> <inner> (Browser-library cross-frame
   piercer). 12 tests.
3. Iframe-origin chip in RecordingLiveView (c1b0feb) — small
   ⇣ <host> badge next to each command from a non-top frame so the
   user can tell at a glance which clicks came from the consent
   widget vs. the page under test.
4. Ad/tracker iframe deny-list (3a39e1d) — server-side
   suppression of events from doubleclick / criteo / taboola / 17
   total well-known ad networks. Conservative — Sourcepoint /
   OneTrust / Stripe / reCAPTCHA / OAuth iframes pass through. 7
   tests.
5. Per-step delete in RecordingLiveView (92d5b1f) — small ✕
   button per row for noise the deny-list misses. Local prune; saved
   sidecar excludes pruned rows. Visually subdued (40% opacity until
   hover). 5 tests.
6. wait_until=domcontentloaded in recorded New Page
   (4648b9d, earlier) — the Playwright default wait_until="load"
   waits for every ad/tracker subresource and reliably exceeds the
   Browser-library 10s timeout on real sites (run 32 hit this on
   heise.de). Both emitters write the explicit form. 26 tests.
7. ${HEADLESS} is defined under *** Variables ***
   (dce2ced, earlier) — the recorder referenced ${HEADLESS} in
   its bootstrap but never declared it; RF refused to start with
   "Variable not found." Now emits a Variables block with default
   ${HEADLESS} false.
8. verify_candidates actually wired into capture
   (d339584) — the Story-S.3 verifier (run each candidate against
   page.locator(...).count(), mark unique, demote multi-match) was
   implemented months ago but never called by the v2 recorder; every
   sidecar shipped with verified_unique=False on every candidate.
   Now plumbed through _verify_command_candidates in
   v2_recorder_task.on_capture, scoped to the originating frame
   (not the top page) so iframe selectors verify in their own
   document.
9. Multi-match disambiguation for text/aria/testid via
   >> nth=0 (af43856) — the verifier already disambiguated CSS
   / xpath / pw_locator with :nth-match(1) / [1] / .first, but
   text / aria / testid passed through unchanged with
   verified_unique=False. On heise.de's Sourcepoint banner
   text=Zustimmen matched 3 elements (paragraph + 2 buttons),
   strict-mode rejected the click, replay failed. Playwright's
   chained-locator <base> >> nth=0 now disambiguates these too.
10. Exact-match text="..." instead of substring text=...
    (57f58bb) — substring match caught the paragraph "Unter
    Einstellungen können Sie zustimmen" together with the actual
    button on heise.de. Exact match scopes to elements whose
    textContent equals the recorded string after trim. Tests with
    embedded " in the value drop the text candidate and fall back
    to CSS / testid (escape complexity i...

v0.8.2

[0.8.2] - 2026-03-26

Features

• YouTube Demo Videos on Landing Page — Embedded YouTube demo videos (DE/EN) on the landing/login page for new users

Fixes

• Windows Offline Build — Split Windows build to native PowerShell script (build-windows.ps1) running on Windows host, fixing missing tzdata and other Windows-conditional dependencies that could not be resolved when cross-building on Linux CI
• Fix test venv directory creation in rfbrowser tests for CI

Build

• New scripts/build-windows.ps1 and scripts/test-install-windows.ps1 for native Windows builds
• CI workflow now runs Windows offline build on windows-latest instead of ubuntu-latest
• build-mac-and-linux.sh simplified to only handle Linux/macOS platforms

v0.8.1

[0.8.1] - 2026-03-26

Features

• Browser Library Variant Support — Support for robotframework-browser-batteries (self-contained, no Node.js needed) as alternative to standard robotframework-browser. Conflict detection prevents installing both variants simultaneously. Dockerfile generation skips Node.js/rfbrowser init for batteries variant.
• rfbrowser init Status in Environments — Browser packages now show initialization status: ✅ "Browser initialized" or ⚠️ "rfbrowser init required" with a manual trigger button. POST /environments/{id}/rfbrowser-init endpoint for manual init.
• Default Environment Auto-Assignment — Explorer auto-assigns the "default" environment to projects that have none. Environment badge displayed next to the project selector with link to configuration.
• Keyword Autocomplete from All Installed Libraries — rf_knowledge now discovers all RF-related packages in the venv (not just explicitly imported ones), providing broader keyword autocomplete coverage.
• Keyword Cache Invalidation — POST /ai/rf-knowledge/keywords/invalidate endpoint to force re-scan of keywords when environment packages change.
• Browser-Batteries as Default — setup-default environment now installs robotframework-browser-batteries instead of robotframework-browser.

Fixes

• Fix keyword search wildcard * not returning any results (preloadKeywords was broken)
• Fix stuck package installations showing perpetual spinner — packages in pending/installing without an active task are auto-reset to failed
• Fix package install retry failing when venv doesn't exist — auto-creates venv before pip install
• Fix E2E test flakiness for explorer run overlay (handle all intermediate dialogs)

Tests

• 885 backend tests passing (up from 865)
• New tests for browser variant conflict detection, auto-create venv on retry
• E2E test robustness improvements for execution run overlay

v0.8.0

What's New in v0.8.0

Features

• Visual Flow Editor — Node-based graphical editor as third tab "Flow" in RobotEditor. Vue Flow with custom nodes (Keyword, Control, Start/End), keyword palette with drag & drop, dynamic loading from rf-mcp and .resource files.
• CI/CD Integration — API Tokens with SHA256 hash and role scoping, outbound webhooks (6 events, HMAC-SHA256 signed), git webhook triggers for GitHub/GitLab.
• Audit & Compliance — Full audit log with automatic middleware, CSV export, filterable UI. Retention enforcement via APScheduler. Secrets encryption at rest (Fernet).
• Demo Video Recording — Playwright-based automated demo with overlay text injection and OpenAI TTS voice-over (EN/DE).
• Branch Fallback — Graceful handling when a configured branch doesn't exist, with suggestion dialog.

Fixes

• Fix Google Fonts CDN links for offline compatibility
• Fix auth redirect loop in Safari (stale token + HMR reload)
• Fix Flow Editor detail panel staying open on arg add/reorder

Tests

• 865 backend tests, 113 frontend tests, 267 E2E tests — all passing

Docs

• In-app documentation updated for all new features (EN/DE/FR/ES)
• CHANGELOG, README updated

Full Changelog: v0.7.0...v0.8.0

v0.7.0 — Docker UX, Branch Switching, Run Cancel, 136 New Tests

What's New in v0.7.0

Features

• Docker Build Terminal Output — Live WebSocket-streamed build logs with terminal component (pulsing dot, auto-scroll, show/hide toggle)
• Docker Image Staleness Detection — Amber warnings when Docker image is outdated after package changes, with "Rebuild" button
• Docker Build Robustness — Playwright base image, pre-build disk space check, large base image hint, dangling image cleanup
• Persistent Docker Build Status — docker_build_status/docker_build_error on Environment model
• RobotEditor Visual Improvements — Section colors, variable highlighting, expand/collapse, lazy keyword loading
• Run Cancellation — Actually kills spawned subprocess via runner registry pattern
• Branch Switching — Dropdown on project cards, POST /repos/{id}/checkout endpoint
• Auto-Sync Toggle — Checkbox on project cards to enable/disable periodic Git sync
• rfbrowser Init Visibility — Post-install node_modules verification, pre-run check, "initializing" UI status
• Execution View — Project name + duration columns in runs table

Fixes

• Report Tree — Fix XPath .//tag → tags/tag (keyword tags no longer appear as test tags); fix CSS connector lines
• Explorer Editor Chain — Fix no-environment banner blocking RobotEditor from rendering
• Startup Cleanup — Reset stuck Docker build and package statuses on app start

Tests

• 136 new backend tests (656 → 792 total): task_executor, encryption, LLM client, WebSocket manager, execution tasks, repos branches
• All 267 E2E tests passing

Docs

• In-app documentation updated in all 4 languages (EN/DE/FR/ES)

Downloads

• roboscope.zip — Online install (requires internet, smaller download)
• roboscope_offline_version.zip — Offline install (includes all dependencies + uv binaries)

Full changelog: https://github.com/viadee/roboscope/blob/main/CHANGELOG.md

v0.6.0

Features

• RoboView Code Quality KPIs: 6 new Deep Analysis KPIs integrated from robotframework-roboview — keyword reuse rate, unused keywords, keyword duplicates, keyword similarity, documentation coverage, Robocop violations (#11)
• Private Registry Support: index_url / extra_index_url per environment for custom PyPI registries (#6)
• RF Keyword Library Scan + SpecEditor help text (#7)
• Python Version Validation: normalize patch versions (3.12.5→3.12), reject unsupported versions, warn on pre-release (#5)

Security

• Remove default SECRET_KEY — require explicit configuration (startup error if unset)
• Move JWT tokens from URL query params to Authorization headers for report HTML/ZIP endpoints
• Global API rate limiting via slowapi (1000/min default, stricter on expensive endpoints)
• Upload size limits: Nginx 500m + FastAPI 500MB (HTTP 413)
• Subprocess resource limits (RLIMIT_AS 2GB) on Linux/macOS
• Thread-safe WebSocket manager
• Structured JSON logging with request-ID correlation (X-Request-ID header)
• PostgreSQL pool_recycle (3600s)

Fixes

• Hardened private registry: validation, credential masking, migrations (#9)
• AI ProviderConfig: curated model dropdowns with current model IDs
• Makefile: make install now creates .venv automatically; 3-step install works on fresh clones

Tests

• 13 new security E2E tests (API auth, WebSocket auth, request-ID, health, rate limiting)
• 4 new code quality KPI E2E tests
• 40 backend tests for RoboView compute functions
• CI: SECRET_KEY for all test workflows

Docs

• In-app documentation updated for security hardening, code quality KPIs (EN/DE/FR/ES)

Full Changelog: v0.5.0...v0.6.0

v0.5.0

RoboScope v0.5.0

Changes

• Version bump from 0.1.0 to 0.5.0 reflecting project maturity
• Distribution rename: online build is now the default roboscope.zip; offline build renamed to roboscope_offline_version.zip
• Makefile: make build-dist runs the online build; new make build-dist-offline for offline variant
• Dependency fix: added colorama as explicit dependency for Windows offline builds
• Refactor: removed legacy Celery naming references (renamed to task_executor)

RoboScope v0.1.0

RoboScope v0.1.0 — Initial Release

Web-based Robot Framework Test Management Tool with Git integration, GUI execution, report analysis, environment management, and container runtime.

Highlights

• Project Management — Clone Git repos or link local folders, branch management, auto-sync
• Test Explorer — Browse test files, parse Robot Framework keywords/tests, library dependency check
• Test Execution — Run tests via subprocess or Docker, live WebSocket status updates, scheduling
• Environment Management — Create Python virtual environments with uv, install/manage packages
• Report Analysis — Parse output.xml, compare runs, view embedded HTML reports
• AI-Powered Analysis — LLM-based failure root-cause analysis (OpenAI, Anthropic, OpenRouter, Ollama)
• Statistics & KPIs — Pass rate trends, flaky test detection, heatmaps, deep analysis (15 KPIs)
• AI Code Generation — Generate .robot files from .roboscope YAML specs
• Role-Based Access — Four roles: Viewer, Runner, Editor, Admin
• Multi-Language UI — English, German, French, Spanish
• In-App Documentation — Searchable docs with print/PDF export
• Offline Deployment — Standalone ZIP with bundled dependencies for air-gapped environments

Downloads

File	Size	Description
roboscope.zip	~224 MB	Offline — includes all Python wheels + uv binaries for Windows, macOS, Linux. No internet required during install.
roboscope-online.zip	~1.1 MB	Online — lightweight, downloads dependencies from PyPI during install. Requires internet.

Quick Start

unzip roboscope.zip && cd roboscope
./install-mac-and-linux.sh    # or install-windows.bat
./start-mac-and-linux.sh      # or start-windows.bat

Open http://localhost:8145 — Default login: admin@roboscope.local / admin123

Requirements

• Python 3.10+ (3.12+ recommended)
• No Redis or external services required
• uv is bundled (offline) or auto-installed (online)

Tech Stack

• Backend: FastAPI, SQLAlchemy 2.0, Python 3.12+
• Frontend: Vue 3, TypeScript, Pinia, Vite
• Package Management: uv (replaces pip/venv)
• Database: SQLite (default) or PostgreSQL
• Tests: 555 backend tests, 243 E2E tests (all passing)