NPM retirement + Docker migration + AI selector fix
Release history
figranium releases
Build complex browser workflows visually and execute them via API.
All releases
50 shown
- Ollama SSRF hardening with strict settings and API target validation
- Cron next-run calculation optimization
- Sandbox proxy optimization for extraction flows
- Block editing interaction improvements
- Extraction scripts must be migrated to use data.html() instead of $$data.html().
- Explicitly enable ALLOW_PRIVATE_NETWORKS if internal network access via Docker bridges is required.
- ALLOW_PRIVATE_NETWORKS is now disabled by default, which may block access to internal networks.
- Extractor scripts migrated to use data.html() instead of $$data.html().
- Blocked host.docker.internal in SSRF protection via url-utils.js to prevent internal network probes via Docker bridges.
- Global AI model settings for OpenAI, Anthropic, Gemini, etc.
- Get Content action to extract full page content and store it as a variable
Added Ollama integration for local LLM support in CSS selector and script generation. Overhauled DOM context cleaning by stripping non-essential tags/attributes to reduce token usage. Introduced HTTP Request action blocks for API interaction. Implemented CSP headers, SSRF protection, and WeakMap caching.
- SSRF via webhook redirects and Baserow output provider
- Sandbox escape via getPrototypeOf
- Session security hardening with httpOnly cookies and HSTS
- Dashboard task search with keyboard shortcuts
- Performance improvements including 70x table detection speedup
- Sandbox escape in extraction scripts via unproxied this
- Sticky notes with markdown rendering and colors
- Editor performance (23x speedup)
- Agent execution optimization (32% reduction)
- Cross-Site WebSocket Hijacking (CSWSH)
- IP spoofing in auth bypass
- Removed vulnerable openssl package
- FigClaw programmatic execution backend
- Execution concurrency limiter
- Webhook support for task completion
- Protocol validation bypass in validateUrl
- SSRF protection for IPv6 and private networks
- Login timing-safe comparison
- Questrial font replacement
- Auto-enable inspect mode
- Larger page headings
- SSRF protection via URL validation and credential sanitization
- Session security hardening with regeneration and inactivity timeouts
- Sliding session TTL
- Headful storage state sync on close
- Tab focus standardization
- Path traversal vulnerability in agent start action
- Timing-safe login comparison
- Stealth plugin and persistent browser profiles
- Baserow output provider
- O(1) execution lookup via Map cache
- Security headers implementation
- Protected static asset access
- JSON payload limit reduction to 2mb
- Task scheduling with visual and cron modes
- Real-time scheduling monitoring
- Conditional DOM fetching optimization
- IPv6 SSRF bypass prevention
- Authentication bypass in development environments
- Proactive cookie injection for cross-domain SSO
- In-memory API key caching (32x speedup)
- Keep-alive SSE heartbeats
- Drag-and-drop block reordering
- Bulk context menu operations
- Top 5 selector highlights
- API keys configuration in editor
- Dashboard redesign with dark aesthetic
- Action palette as 2-column grid
- Standalone CLI for scrape/agent/headful modes
- GitHub Actions auto-deployment to NPM
- Improved editor grid visibility
- Infinite canvas with pan/zoom
- Task settings cabinet consolidation
- Version history and variable management tabs
- randomizeClicks option
- Cursor glide on all movements
- Cursor Glide: smooth Bezier curve mouse movement with ease-in/ease-out and distance-scaled speed (15–60 steps)
- Click Retry: automatic click verification via elementFromPoint with up to 3 retries and Playwright fallback
- AI Selector extended to Scroll action blocks
Full changelog
Cursor Glide
A new Cursor Glide option in Behavior Config makes the mouse move at a natural, human-like pace instead of teleporting between targets. When enabled:
- Cursor follows a smooth Bezier curve with ease-in/ease-out
- Movement speed scales with distance (15–60 steps)
- Position is tracked across actions — no jumps between clicks
Off by default. Enable it in Behavior Config → Cursor Glide.
Click Retry
Clicks are now automatically verified using elementFromPoint. If a click misses the target (e.g. due to layout shift), the agent will:
- Re-resolve the element's position
- Retry up to 3 times
- Fall back to a forced Playwright click if all retries fail
Retry attempts are logged for visibility.
AI Selector for Scroll
The AI selector finder (magic wand icon) is now available on Scroll action blocks, matching the existing behavior for click, type, and hover actions.
Performance
- Memoize ResultsPane state to prevent flickering and network spam
UI/UX
- Executions Refresh UX improvement
- Remove Reset Keys and Toggle Caps buttons from noVNC viewer
- Add ARIA labels to icon-only buttons in API Keys Panel
Full Changelog: https://github.com/mnemosynestack/doppelganger/compare/v0.8.0...v0.8.1
- AI selector generator via Gemini
- Smart locational interactions
- Multiple API keys support
- CGNAT IP range blocking (100.64.0.0/10)
- Task undo/redo support
- Ctrl+K Action Palette shortcut
- Rotating proxy pool configuration
- Multi-selection and bulk deletion with Shift-Click
- Environment variable leak in extraction worker
- Task export selection modal
- File downloads with ZIP bundling
- PostgreSQL database support
Material Icons added to editor, settings, and dashboard screens. General UI improvements across all screens for visual consistency.
- 0.0.0.0/8 IP range blocking
- Hardened API key loading process
- Disk I/O caching for loadTasks
- Visual loading indicators and ARIA busy states
- Wait for Selector block
- Clipboard utility component
- PBKDF2-hardened API key storage
- Double HMAC timing attack prevention
- Navigate To action block
- HTML template variable support
- Password visibility toggle
- Action palette keyboard navigation
- Discord release notifications
- Save version button for manual checkpoints
- Autosave implementation
- Manual version creation
- Text input blur-save
- SSRF vulnerability mitigation
- IP range validation improvements
- Native ARM support
- Modular architecture refactoring
- Dashboard enhancements
- Server-side code injection (RCE) in scrape.js
- Extraction script execution RCE
- Event loop blocking prevention
- Disable automated recording switch
- Stateless execution toggle
- SSRF hardening via localhost-only agent calls
- Rate limiting on auth endpoints
- Secure cookies in production
Exposed `APP_VERSION` via `src/utils/appInfo.ts` to enable version display within the application. Added `VersionPanel` to the system tab to allow users to/from copy the running package version.
Implemented unsaved-task protection by tracking serialized task state, disabling the "Save" button when no changes are detected, and adding a `beforeunload` hook to warn users of pending edits. Updated `App.tsx` and `EditorLoader` to manage and propagate the propagate `hasUnsavedChanges` flag and dirty flag resets.
Added AGENTS.md for contributor guidance and compliance. Refreshed README with updated Docker/npm instructions. Enhanced editor features with type block Mode dropdown (replace vs append) and Press block modifier checkboxes and key dropdowns. Updated Action.typeMode definition and agent runtime to support new modes. Added npm-publish.yml workflow for automated publishing.
Implemented `react-window` virtualization in captures screen, settings panel, executions history, and capture modal to improve scrolling performance and prevent UI freezes during long history loads. Introduced `CaptureCard` component and `caputreEntry` type to unify the UI.
Updated Playwright base image to v1.57.0-jammy and hardened APT installs. Improved Docker recording reliability via --disable-dev-shm-usage, explicit video sizing, and EXDEV-safe moves. Polished dashboard scroll with a top fade overlay and updated proxy rotation tooltip guidance.
Introduced automatic webm screen recordings, a dedicated Captures screen, and an API endpoint (/api/data/captures) for managing captures. Added proxy rotation mode configuration, User Agent settings, and a task-level viewport rotation toggle. Updated the While block editor to use structured fields.
Fixes three bugs in the Start Task block: it now calls the local server at the correct host and port, stores the server's returned data in {$block.output} for use by downstream blocks, and correctly populates the dropdown with other available tasks.
Added proxy import from text files via bulk add host:port:user:rass, and a backend endpoint for proxies. The Proxies UI now includes an Import button.
Added NoVNC support to the headful viewer with a fullscreen toggle and updated the Docker image to include NoVNC tooling and VNC entrypoint. Disabled proxy rotation when only the host IP is available to prevent invalid settings. Updated sidebar logo sizing.
Updated headful viewer to default to native browser windows and use NoVNC only in containers. Disabled proxy rotation toggle when only host IP is available to prevent invalid settings. Applied minor UI polish to sidebar logo sizing.
Added a CLI entry point and postinstall script to streamline setup, fixed headful noVNC proxying, and reduced production log noise by gating auth and setup debug logging behind NODE_ENV.
Added live action status borders in the editor, a stop button for agent runs, and noVNC controls for stuck keys. Improved agent extraction with CSV support and script handling, implemented session persistence via long/long-lived cookies, and added port auto-fallback.
Added execution detail view, execution history routing, and task snapshots for history playback and 'run snapshot' functionality. Introduced 10 new agent blocks: If/Else, While, Repeat, For Each, Stop Task, On/Error, On Error, Set Variable, CSV, Start Task, and Merge. Added CSV output support with table view, export, and copy options. Improved toast notifications, ResultsPane, and shadow DOM capture. Fixed JSON editor issues and UI layout/panel updates.