Upgrade Bravos from 1.4.x

Update the machine’s CLI and tools, then refresh each repository’s skills and hooks. These pages describe Bravos 1.5.3, published on npm.

Before you start

• Node.js 20 or newer and an existing Bravos installation.
• Access to each repository you want to update.
• A Team licence or trial for the analyzer and code graph. Free can update the research-loop tools and repository integrations without those bundles.

Update the machine

npm install -g @bugb-technologies/bravos
bravos --version

1.5.3

Truncated to the version check, captured on 12 November 2026. Check which executable your terminal resolves if another installation takes precedence.

bravos setup --tools -y

This checks the pinned GuardLink 2.6.0 and cxg 1.8.0 interfaces and installs them with their package managers when needed. The flag does not fetch the licensed bundles. On a Team machine, also run:

bravos setup
bravos setup --check

The release pins analyzer 0.6.2 and code graph 0.1.1. Setup now replaces an older staged bundle without requiring -y. The check names a bundle behind the pin. If an upgrade download fails, setup keeps the old bundle working and says what happened. A graph built with 0.1.0 can be read by 0.1.1 without a rebuild.

Setup no longer runs cxg’s pentest pipeline installer. The first probe scan installs or refreshes the pipeline itself; browser probes still need its Python requirements and Playwright Chromium where they run.

Refresh each repository

From its root:

bravos sync

Sync refreshes the installed skills, hooks and MCP wiring. It keeps edited skill files unless you explicitly force their replacement. Existing annotation mode is preserved. For new repositories, Bravos leaves the choice to GuardLink, whose default is external .gal sidecars; select --guardlink-mode inline during initialization if needed.

An explicit --agent list is exact: only those agents get integration files. Old joseph installations also migrate under agent-selected sync and guided start. If an unselected agent still points at removed .joseph/hooks scripts, the diagnostic names that agent and its repair command. Fix the named host’s registration before starting its next session.

For managed CI files, see Run Bravos in CI/CD.

Account for the changed workflow

• Proof uses plain scans. Bravos runs reviewed, in-session probes with cxg scan; it does not drive cxg pentest orchestration or model generation. Test login capture still uses cxg pentest auth. A no-login probe must declare that it needs zero identities; otherwise cxg expects a captured login. See the verification loop.
• Coverage counts your code. Sync removes Bravos’s own shipped annotations from installed scripts, so reported coverage may drop without a change to your application. A fresh unannotated repository starts at 0%.
• Free starts with free steps. The banner, briefing and next-step guide state Free or Team, and a graph without entitlement says graph locked. The briefing also names the annotation mode. Skills ask before the first commit of a session unless commits were already requested.
• The dashboard is a fresh build. Review the dashboard for the threat model and Team Code graph tab. Missing or stale graphs are refreshed first; the saved page and briefing report its age.
• Busy means ask again. The 1.5.3 release notes describe the graph waiting for another session, then reporting graph_busy if it is still held. This is not a reason to rebuild. See graph busy handling.

To enable Team, bravos account activate starts the 30-day trial with no card. See licensing for machine activation and expiry.