Changelog

Release notes for covdbg.

v1.4.0

Measures code in shared libraries: DLLs your tests link against or load at run time. Signing in now picks the team your runs are licensed for.

Shared library coverage: select DLLs under modules in .covdbg.yaml, with the same patterns as files, matched against the DLL's path. covdbg instruments a selected library as soon as Windows maps it, before any of its code runs, whether the executable imports it or loads it later with LoadLibrary. A library unloaded before the process exits keeps its coverage, and each library is written to the output database as a module of its own. Target-specific extend and override apply to modules too, and with follow_children the selection covers every followed process. See Shared Library Patterns.
Sign in for one team: covdbg login ends with a team step in the browser, or takes the team up front with --team <slug> (--team personal for personal use). It prints Signed in as <email> for <team>. covdbg whoami asks the service who the machine is signed in as and for which team, falls back to the stored sign-in when the service cannot be reached and says so, and covdbg whoami --json prints the answer as one object for scripts and tools. See the sign-in commands.

Libraries are opt-in: without modules.include, covdbg measures only the executable, as before.
When libraries are selected, an executable with nothing of its own to measure, such as a test host or python.exe, runs unmeasured instead of stopping the run with "no functions to track". A run that measures nothing at all fails with "Nothing was measured".
List a DLL under baseline to have it reported at 0% when no test loads it; when a run does measure it, its hits are merged into the same module.
The covdbg mcp guide has a new libraries topic.
A seat licenses your runs in the team you signed in for. To use another team, run covdbg login --team <slug>.
A refused run names the sign-in it was decided for, as in "signed in as for ". When the account holds no seat in that team, the console shows the service's explanation.

covdbg no longer leaks a file handle for every DLL the target loads.
A sign-in or project token the license service rejects is now refused, with a message to run covdbg login, instead of running on the offline grant. An unreachable service still uses the cached decision as before.

Read the 1.4.0 announcement for examples and upgrade steps.

Adds coverage tools for AI coding agents, portable HTML reports, child-process coverage, and a new sign-in and seat-based licensing system.

MCP server: covdbg mcp lets coding agents discover executables, start and monitor coverage runs, merge results, rank uncovered files, read source context, and query coverage with read-only SQL. The built-in guide helps configure a useful measurement. The agent makes test edits with its own tools; coverage success does not mean the tests passed. See MCP setup.
HTML reports: covdbg convert -i coverage.covdb -f HTML -o coverage-html exports a report you can open locally or publish to a static host. Browse files and functions, inspect execution counts, and navigate uncovered lines in light or dark mode. Assets are bundled, and readable file pages remain available without JavaScript. See HTML reports.
Child-process coverage: opt in with --follow-children, COVDBG_FOLLOW_CHILDREN, or settings.follow_children in .covdbg.yaml. Coverage from instrumented descendants is merged into the same output database. Target-specific settings let you enable it only for the test runners that need it.
Sign-in replaces license files: use covdbg login, covdbg whoami, and covdbg logout for local development. CI uses COVDBG_PROJECT_TOKEN. Sign-in credentials and cached licensing decisions are stored in Windows Credential Manager. See licensing and migration guidance.

Signed-in developers can measure public repositories for free and use one private repository at a time under personal use. A team seat covers local work across repositories; the team's CI project token covers commit authors with seats in that team. Cached decisions can keep runs working while the license service is temporarily unavailable, until the decision expires.
A run without --output now writes .covdbg/coverage.covdb in the working directory. Application data and logs also use that directory.
The console keeps the target program's output, a start line, and the coverage summary. covdbg errors go to stderr. --log-level controls the categorized log file, with DEBUG as the default and NONE to disable it. Gated reports explicitly identify the restriction to the ten most-hit files.
Configuration discovery checks the working directory before the target executable's directory. If no .covdbg.yaml is found, the error lists the searched locations.
The Windows installer installs for the current user without requiring administrator rights.
Run telemetry reports version, Windows version, duration, and exit code for the account dashboard. Set COVDBG_TELEMETRY=off or settings.telemetry: false to disable it. Telemetry service failures do not affect a run.

Corrected repository detection for Git worktrees and CI attribution to the commit author, including pull-request merge checkouts.
Fixed launching relative executable paths containing forward slashes and passing target arguments that share names with covdbg options.
Fixed lost trailing output from fast-exiting targets and coverage loss when a target crashes. Handled exceptions no longer terminate the target prematurely.
Failed database saves now report failure instead of success. Incompatible database schemas are rejected explicitly, and stored coverage summaries remain consistent after gating or clearing coverage.
Reduced repeated source-file pattern matching when analyzing functions, improving runs that follow child processes.

Removed --license, --license-file, --fetch-license, --demo, --plugin-name, and --plugin-ver, plus COVDBG_LICENSE, COVDBG_LICENSE_FILE, COVDBG_ACTIONS_TOKEN, and COVDBG_ACCOUNT. Update scripts to use covdbg login locally or COVDBG_PROJECT_TOKEN in CI.
Removed --appdata, COVDBG_APPDATA, and license_status.json. Application data stays in the working directory's .covdbg folder; use covdbg whoami to check sign-in.
Removed the --dll override and the EntrypointPatch injector. Run mode uses the bundled agent DLL and APC injection.

Read the 1.3.0 announcement for examples and upgrade steps.

Added baseline coverage support in .covdbg.yaml for both global settings and target-specific overrides.

Run mode can analyze baseline executables before the main target and merge those zero-hit baselines into the final .covdb output.
Target-specific baseline entries now support both extend and override behavior.
Baseline configuration is documented in the CLI and configuration reference, with integration coverage for the new flow.

Expanded licensing and local demo workflows for the VS Code extension integration.

Added --demo support for auto-fetching plugin demo licenses, plus --plugin-name and --plugin-ver metadata options.
Extended license fetch and validation metadata to support richer demo and plugin scenarios.

Initial public release of covdbg with full Windows support.