Filters
We redesigned the code review settings and a large part of the app. Previously, each page mapped to a key in kodus-config.yml. If you wanted to make Kody less noisy in a repository, for example, you had to know that the severity threshold lived on a page called Suggestion Control. Now, each setting lives on the page that answers the question you have when you go looking for it.
Each setting now lives on the page that answers the question you have when you go looking for it:
Switching scopes keeps you on the same page, so comparing the global configuration with a repository configuration takes two clicks. Each scope and page shows how many settings override the global defaults. At repository and directory scope, a badge shows whether kodus-config.yml was applied, not found, or unavailable.
Each rule shows its severity, source, status, and last update. The source tells you whether the rule came from a repository file such as CLAUDE.md, analysis of previous reviews, the library, the CLI, or someone on the team.
On plans with Cockpit, the table also shows how many times each rule has triggered and a health label based on the last 30 days: healthy, noisy, ignored, stale, or not enough data. Clicking a row opens a panel with the rule’s instructions, examples, and impact. You can move between rules with J and K. Rules and memories generated by Kody appear in an approval section at the top of the page.
The top navigation is gone. Everything now lives in a left sidebar with five destinations:
Organization settings now live in a collapsible group. Members and PR licenses are now tabs under Subscription.
Search for any page, setting, MCP plugin, Kody Rule, or repository. Typing a number such as #123 opens that pull request. Old terms still work: searching for “byok” takes you to AI providers, and “git settings” takes you to Repositories.
Features outside your plan now remain visible in the sidebar with a lock icon and open a preview using data from your own workspace, such as the number of PRs reviewed in the last 30 days or how many rules are being ignored.
Previously, the interface only made the limitation clear on the free plan. Workspaces with a canceled, expired, or failed license could still see the normal rules list with no warning, even though those rules were being ignored.
The pull request list now includes a Kody skipped view, showing PRs that requested a review but were skipped because of configuration. The suggestions column also separates what was actually posted to the PR from what your settings prevented Kody from posting.
Previously, a review that failed to check out the repository, had to switch to a fallback model, or dropped some findings still ended with a successful status. It looked the same as a complete review, and those losses were only visible in our logs. Now each of those situations is recorded in the run. When you expand a row in Reviews, you can see whether the review:
None of this is posted to the pull request. But if you are investigating why a review missed something, you can now see which context or capability was missing from that run.
Important: suggestion grouping and per-severity suggestion limits no longer have a UI. The keys still exist under suggestionControl and are still applied, but they can now only be changed through kodus-config.yml. If your team uses either of them, make sure the file defines the values you expect.
kodus-config.yml, make sure the repository badge says the file was applied.When you reply in a thread started by Kody, you no longer need to write @kody to get a response. Kody determines whether the message is directed at her: she responds when it is and stays quiet when you are talking to someone else on the team.
There are limits on replies to other bots and on the number of replies per thread to prevent conversations from getting stuck in a loop. Available on GitHub, GitLab, Bitbucket Cloud, and Azure Repos.
Self-hosted. In addition to checking installation configuration, Doctor now analyzes reviews from the last 7 days. It shows:
When Kody revisits a suggestion from an earlier round, the new comment now links back to the original. She also reads the latest suggestions across the entire PR instead of only a subset per file, so she has a better memory of what she has already said.
When a review loses part of its context, that is now recorded in the run. Examples include an unavailable repository checkout, switching to a fallback model, or dropped findings.
When you expand a review on the Reviews page, you can see whether it ran on the fallback provider, with less context, or with reduced fidelity to fit within a smaller context window. None of this is posted to the PR, but if you are investigating why a review missed something, you can now see what it did not have access to.
For OpenAI-compatible providers, the model list loads as soon as you enter the base URL. For OpenAI, the list now shows only models that support chat.
As long as a rule’s text does not change, Kodus reuses its reference detection results. Saving or syncing rules no longer triggers repeated model calls for the same content.
When a rule file is rejected, the error now tells you which field failed validation.
While a page is loading, you now see a preview of its actual layout instead of a blank screen or spinner. Kody Rules notifications also take you directly to the affected rule or repository.
No duplicate suggestions across review rounds: Kody no longer flags the same issue again after already posting it on the PR, even when a new commit changes the surrounding code.
Kody Rule violated in multiple places: when the same rule is violated in multiple locations within a file, the “Also found in” list with the additional locations now appears again in the comment.
Duplicate replies to the same comment: if a Git provider delivered the same webhook more than once, Kody could reply multiple times. Now each comment gets only one reply. On GitLab, duplicate Kodus webhooks are also removed the next time the repository is saved.
Trial reviews and Kodus-managed model reviews: Fireworks retired DeepSeek V4 Flash, which was the default model, causing these reviews to fail. The default is now DeepSeek V4.1 Flash, and configurations saved with the old model automatically use the new one.
BYOK configurations pointing to the retired Fireworks model: configurations that call Fireworks directly using the old DeepSeek V4 Flash ID no longer fail every review with a “model not found” error.
More reliable fallback when a provider is down: if a provider keeps returning temporary errors after all retries are exhausted, the review now switches to the organization’s fallback model instead of failing.
Better compatibility with reasoning models: Kody ignores reasoning blocks sent before the JSON response. Models that always use reasoning, such as GLM and Kimi, no longer receive the parameter for enabling or disabling reasoning, which some providers reject. If a provider rejects an unsupported reasoning parameter, Kodus retries the request without it. Advanced settings written in the provider’s native format are now passed through to the request.
Empty responses from MiniMax-M3: Kodus now requests structured output in a format MiniMax-M3 can return correctly. Previously, the model could return an empty response.
PR summaries for large PRs: if a PR does not fit within the model’s context window, the summary now processes the files in chunks and continues instead of failing.
Deprecated managed integrations: integrations that are no longer supported have been removed from the MCP connections list.
Cross-organization isolation: routes for members, permissions, CLI keys, issues, integrations, and Kody Rules now only accept resources belonging to the organization making the request. Invitations, organization joins, and team member changes no longer trust IDs provided in the request.
Action required for MCP users: the Kodus MCP server now requires authentication. External clients such as Cursor or Claude Desktop must send a Team CLI key, and creating or editing Kody Rules requires the kodyRules:manage permission.
Provider account IDs in failure comments: some providers include account and key identifiers in billing errors. Those IDs are now hidden from the comments Kody posts when a review fails, including on public PRs.
Doctor incorrectly reporting that reviews were not running: Doctor no longer shows “NOT RUNNING” on installations where reviews are working. It now ignores old incidents outside the analysis window, reevaluates seat warnings, skips the model test for organizations with no repositories, and reads the license from the organizations that are actually running reviews.
Activity logs: opening the activity logs no longer throws an error when the organization has no records yet or when a filter returns no results.
All seats in use: assigning a seat when all seats are occupied now opens an explanatory modal, and a rejected request shows a message. On self-hosted installations, the modal points to the license key, and the number of seats in use is updated when a seat is released.
Unsaved changes that did not exist: the SSO and General pages no longer show pending changes after you toggle an option on and then back off.
Edits lost when leaving What to review: unsaved category instructions are now protected when leaving the page, just like on the other configuration pages.
Plan buttons for users without billing access: locked features no longer show “See plans” or “Activate a license” to users who cannot access billing. Instead, they are told to contact an organization admin.
False paused-reviews warning: a zero Kodus credit balance no longer shows the paused-reviews banner for organizations that do not use the Kodus provider for reviews.
Routing changes lost when switching tabs: on the AI providers page, switching tabs no longer discards unsaved routing changes.
PR details for failed or skipped reviews: the PR page now shows the run status instead of “Nothing to flag.”
Creating a rule from a suggestion: the “Create rule” button now becomes enabled after you select a suggested rule.
Locked Cockpit: failed or skipped runs no longer count as reviewed. Organizations with older reviews are also no longer redirected to “Connect a repository.”
Issues and plan selection copy: fixed broken counts such as “Showing of 0 issues” and inconsistent PR estimates when models do not have pricing information.
Sidebar on smaller screens: the current page item is no longer cut off, and opening the app on mobile no longer causes a page error.
When connecting Amazon Bedrock, the model list now includes supported text models beyond Anthropic’s inference profiles. This makes more of the models available in your Bedrock account selectable during BYOK setup.
Kody Rules using context beyond the diff: Rules that depended on code elsewhere in a file or in a related file could produce incorrect findings. Repository lookups could report an existing file as missing, and a finding could still be published after its claim had been disproved. Kody now handles that context and those checks consistently before posting the finding.
Contradictory reviews after new commits: As a PR evolved, Kody could lose track of earlier findings and suggest reversing a change the team had already made in response to her review. Review findings now reach the PR summary, and later review rounds receive previous suggestions and their implementation status as context. This helps Kody stay consistent across commits.
BYOK in implementation checks: Checks that validate whether suggestions were implemented now use the organization’s configured model. Previously, these calls could bypass its BYOK configuration.
Findings with unusable code fixes: If Kody produces a valid finding but its proposed replacement is empty, unchanged, or incomplete, she now keeps the finding and posts it without the unusable code block. Previously, the entire finding could be discarded.
Marking notifications as read: Marking one notification or all notifications as read works again. Both actions had been returning a server error.
Removing a Kody Rule source: Deleting a source file, or marking it to be ignored, now removes every rule associated with that path. Previously, duplicate rule records could leave a deleted rule active and still firing.
The wrong issue used as review context: When a PR already identifies an issue, Kody’s fallback now looks for that issue instead of selecting an unrelated result from an issue search. If it cannot retrieve the referenced issue, it does not substitute another one.
Documentation search failures: Kody now distinguishes an unavailable documentation search from a successful search with no results. A search failure no longer tells the review that documentation does not exist.
OpenCode Go reviews: BYOK requests to OpenCode Go now include its required session header. Without it, the provider could reject review requests.
Bedrock connection tests: Testing or saving a Bedrock connection with a selected model no longer fails while handling the credentials. The model picker also loads for a new Bedrock connection instead of waiting for an API key field Bedrock does not use.
Editing Kody Rules and Custom Prompts: The editors no longer lose keystrokes while you type or delete. Formatting in Kody Rule instructions, including line breaks and lists, is also preserved when you save and reopen them.
Saving Custom Prompts: The Save button now becomes available when a valid Custom Prompt has been edited.
Settings for organizations without repositories: Saving code review settings no longer fails when the organization has no connected repositories.
Self-hosted SAML sign-in: Sign-in links now use the installation’s public API address. Previously, they could point the user’s browser to an internal service address that it could not reach.
PR-level Kody Rule findings: A finding that cannot be anchored to a file and changed line is now posted on the pull request. Previously, some of these findings were silently discarded.
Credit balances: The production web deployment now has the credential required for billing requests. Without it, a failed balance request could incorrectly appear in the interface as a zero balance.
BYOK calls rejected for empty system messages: Kodus no longer sends an empty system message to providers that reject it, allowing affected validation calls to complete.
Findings returned outside the expected format: Kody can now recover findings returned as prose when an OpenAI or compatible provider requires JSON response mode. Previously, the recovery request itself could be rejected.
Findings with unusual confidence values: An out-of-range confidence value no longer discards an otherwise valid review finding.
Organization-wide conversations: Conversations no longer fail when the request has no selected team, which is valid for an organization-wide conversation.
Trial reviews: Trial reviews no longer fail while trying to find an integration for the trial’s placeholder organization.
Concurrent settings updates: Simultaneous changes to the same team setting no longer collide and return an error.
GitHub review comment placement: Kody now handles another line-validation error GitHub can return when she tries to attach a finding to a changed line.
Requests for changes: An incomplete, unpublished critical comment no longer stops Kody’s request-changes step. The step can continue without a link or summary that the comment does not have.
Legacy Azure GPT model settings: Azure model IDs such as gpt-35-turbo are no longer mistaken for reasoning models. Kodus keeps request settings compatible with those models.
GPT-6 Astra model settings: Kodus now recognizes GPT-6 Astra as a reasoning model and uses its correct context-window information. This fixes incompatible request parameters and avoids splitting reviews according to a much smaller default window.
No changelog entries for this filter yet.
Kody now takes a more proactive role when you talk to her in a PR. When you explain a team convention, clarify why a suggestion doesn’t apply, or share context worth keeping, she can suggest creating a memory or creating or updating a Kody Rule, without waiting for you to ask.
This helps turn everyday feedback into knowledge that can guide future reviews. Kody proposes the action and asks for your confirmation before saving changes.
You’re no longer tied to a single AI provider. You can now mix providers and models across repositories and specific agents, choosing the setup that best fits each task. This gives your team more flexibility to balance review quality and cost, using more capable models where they matter most and more economical options elsewhere.
We also rebuilt the configuration experience around that flexibility. Setup adapts to each provider’s credentials and advanced settings, and supported integrations fetch available models directly from the provider’s API. You can configure primary and fallback models and fine-tune their settings from the updated flow.
Reasoning settings now respect the selected model: We fixed how the configured reasoning level is applied across different providers and model families, including compatibility with temperature settings.
Review sizing now respects model capacity: We improved context-window handling so reviews are split according to the available capacity of the selected model.
OpenRouter provider preferences: You can now enter multiple providers without commas disappearing as you type. Saved preferences also remain intact when you reopen and edit the configuration.
Existing BYOK configurations remain intact: We fixed migration cases that could remove Bedrock configurations, setups containing only fallback models, or OpenRouter options. We also restored fallback model references affected by the migration.
More reliable model fallback: Tool compatibility now takes both the primary and fallback models into account. Reviews also correctly switch to the fallback model when rate-limit retries are exhausted.
Stalled model calls no longer wait indefinitely: We added timeouts to operations that could previously get stuck, including review processing and BYOK connection checks.
Clearer handling of unavailable models: Reviews that cannot obtain an available BYOK model are now reported as failed instead of appearing to complete successfully. We also prevent duplicate notifications for the same model-exhaustion failure.
Fewer unnecessary retries after provider billing errors: Errors that require changes to the provider account or payment setup no longer trigger repeated retries that cannot resolve the issue.
Better recovery from unexpected model responses: We improved how reviews handle responses that contain useful content in an unexpected format, reducing failures caused by response structure.
More complete suggestion formatting: We fixed cases where the formatting step could leave suggestions out of the final review.
Cleaner review comments: Internal labels used during generation and auxiliary numbered structures are now removed more consistently before suggestions are published, without rewriting normal explanatory text.
Manual review requests are preserved: When you request a review while the PR is already being processed, the request is deferred to a new attempt instead of being silently dropped.
Correct branch selection for reviews: Reviews now consistently take the repository’s default branch, configured branch patterns, and explicit exclusions into account when deciding whether a PR should be reviewed.
Bitbucket repository configuration: We fixed how Kodus reads configuration files from Bitbucket repositories, ensuring repository settings are loaded during reviews.
More reliable task context retrieval: We fixed cases where issue identifiers were sent to integration fields that only accept predefined options, causing task-context requests to fail.
More reliable reaction counts: We fixed reaction synchronization to prevent stale counts and reduced the number of simultaneous requests sent to Git providers.
Cache write costs are easier to identify: Usage related to cache writes now appears separately in token charts and cost breakdowns.
Token usage is recorded even when operations fail: We fixed cases where an error could prevent token usage from being saved, leaving consumption reports incomplete.
Notifications follow the selected organization: The notification feed, unread count, and mark-as-read actions now consistently apply to the organization you are currently viewing.
Dashboard pagination no longer skips records: We fixed how subsequent pages resume loading results, preventing records from being missed between pages.
Cockpit cards respect the selected date range: We fixed analytics cards that were using their own date ranges instead of the dashboard’s shared filter.
Date filters remain accurate after midnight: Date-picker presets and the current-day selection now remain correct when the page stays open across midnight.
Faster access to review findings: Clicking the suggestion count in the PR list now takes you directly to the first finding.
Easier workspace selection: The workspace selection screen now supports scrolling through longer lists and uses less space at the top of the screen.
Clearer Git integration errors: Repository connection and selection flows now show more useful error messages, making it easier to understand why an integration could not be completed.
Better keyboard navigation: We improved focus visibility and made interactive table rows accessible using Enter and Space.
Reduced-motion preferences are respected: Interface animations now reduce motion when that preference is enabled on your device.
More reliable self-hosted startup: We updated the MongoDB versions used in Docker Compose to avoid an identified kernel compatibility issue. Dependent services now wait for the database to become healthy before starting.
No changelog entries for this filter yet.
Self-hosted installations can now authenticate with Vertex AI using the identity already provided by the cloud infrastructure. This reduces the need to store sensitive credentials and simplifies setup in environments such as GKE, EKS, and Cloud Run.
Jira task context: Kody now correctly identifies the Atlassian environment when fetching Jira issues used as review context. This allows it to access the right task information and use it when evaluating the pull request.
More reliable GitLab clones: we fixed clone failures that could occur when a project was renamed or moved to another GitLab group. We now also cache this information for a period of time, reducing API calls and speeding up the start of reviews.
Conversations with Kody in Azure DevOps: questions asked with @kody directly in a new Azure DevOps thread now receive a response as expected. Previously, Kody could only find comments that were already replies within an existing conversation.
Safer license management: we improved seat management to prevent licenses from being removed incorrectly and make assignment based on Git identity more reliable. Bot accounts are now handled correctly in this flow as well.
Clearer reviewer selection: we refined the loading states and buttons in the reviewer selection step. The flow now makes it clearer when an action is being processed and prevents inconsistent clicks or navigation.
Centralized Kody Rules sync: rules being changed through a configuration PR no longer disappear during synchronization. They remain visible while waiting for the PR to be merged and return to the correct state once the change is complete.
More resilient business rule validation: we improved the handling of MCP integration failures and parameters with predefined options. This prevents integration errors or valid argument formats from incorrectly interrupting a validation.
Kody Rules in the organization’s language: comments generated from Kody Rules now respect the organization’s configured language. Teams configured to use Portuguese, for example, will receive rule explanations and guidance in the expected language.
Safer interpretation of Kody Rules: we added a validation step to make sure examples used internally by Kody do not reverse the intended meaning of a rule. This reduces the risk of suggesting a change that conflicts with the policy defined by the team.
More predictable selection lists: selection menus now use the browser’s native scrolling behavior. This makes interactions more stable, especially in longer lists.
Conversations with Kody in GitLab and Bitbucket: we fixed Kody’s reply flow in pull request conversations on GitLab and Bitbucket, ensuring that questions posted in comments receive the expected response.
Bitbucket Data Center webhooks: pull requests from Bitbucket Data Center and Server are now correctly recognized when a webhook is received. Previously, some of these events could be ignored and fail to trigger an automatic review.
No changelog entries for this filter yet.
.agents/rulesSome AI development tools let teams keep engineering instructions in the .agents/rules/ directory, including architecture standards, coding conventions, and constraints for changes to specific parts of a repository.
We fixed how Kodus discovers these files. Previously, rules stored in this format could be missed during import and would not appear as a source for Kody Rules. Kody now recognizes files under .agents/rules/\*\*, allowing these instructions to be discovered and used in the rules and review workflow.
Reasoning configuration for Anthropic BYOK models: we fixed compatibility between reasoning effort options and different generations of Anthropic models. The interface and runtime now apply only the settings supported by the selected model.
More reliable Centralized Configuration: we fixed four scenarios related to syncing and exporting centralized configurations:
Plan-restricted rules update after an upgrade: when an organization changes plans, Kody Rules that were previously unavailable are recalculated and synced again. This ensures the status shown for each rule reflects the organization’s current eligibility.
Protection against database connection pool exhaustion: we made several related fixes to reduce pressure on the database connection pool:
Automatic retries when GitHub rate limits are reached: when a review hits the GitHub API rate limit, the job now fails as a transient error and is requeued for another attempt instead of waiting silently, making recovery more predictable.
Pull request cards refresh after suggestion validation: the “Needs attention” and “Awaiting” counters now update when suggestion implementation checks finish, so the interface no longer shows stale numbers until the next manual refresh.
Seats from former members are removed correctly: we added cleanup for seats assigned to people who are no longer part of the organization. This keeps the license list and available seat count consistent.
More actionable CLI errors: the CLI no longer shows only generic messages such as Request failed with status 403. For permission errors, oversized payloads, or large reviews, it now explains the likely cause and suggests next steps, such as narrowing the scope or using --branch, --commit, or --fast.
No changelog entries for this filter yet.
Kody can now reference linked repositories while reviewing a pull request. This gives it better context for changes that depend on contracts, shared libraries, internal APIs, or standards maintained outside the current repository.
In practice, suggestions can now more accurately account for how the code connects to the rest of your organization’s ecosystem.
The Kodus CLI now offers a more complete review experience. In addition to inline comments, you can now view a sidebar with findings grouped by severity and jump directly between them.
The update also improves navigation through large diffs and expands support for reviewing branches, commits, and specific files from the same interface.
Deduplication now considers suggestions generated by both Kody and Kody Rules together, with an additional semantic layer. In practice, when both flows identify the same issue, the PR is more likely to receive a single useful comment instead of repeated feedback.
Fragmented @file references in Kody Rules: we fixed how @file references are loaded during fragmented reviews. External files are now properly considered even when a rule is processed in multiple parts.
Slow reviews no longer appear as “no review”: we improved how long-running reviews and LLM rate-limiting scenarios are handled. PR status now more accurately reflects a review that is still running or temporarily constrained, rather than suggesting that no review took place.
Recovery after hitting GitHub rate limits: when the integration hits a GitHub API rate limit, the job now fails fast and is requeued instead of silently getting stuck. This makes review execution and recovery more predictable.
BYOK status now accurately reflects your configuration: the subscription screen now correctly detects whether an organization has a valid BYOK key connected, including locally managed configurations. This prevents conflicting messages about the key’s status.
Large tool outputs no longer break agent execution: we improved compression for large JSON responses returned by agent tools. The data structure is preserved, and execution remains stable even with large outputs.
More stable event processing: we fixed a pool exhaustion and event amplification scenario that could affect asynchronous processing. The pipeline now uses resources more safely under load.
Deduplication remains stable with BYOK: the embeddings used to prevent duplicate suggestions are now pinned to the correct provider, even when an organization uses BYOK or a custom endpoint.
No changelog entries for this filter yet.
Organizations on the Teams plan can now configure repositories as sources for Global Rules. This allows teams to keep their review rules version-controlled directly in Git, alongside the project's technical context, while Kody automatically syncs those rules for use during reviews.
This release also introduces a new interface under Code Review settings where users can select, save, and manage source repositories, monitor import status, and manually trigger a new sync when needed.
In practice, this makes it easier to adopt shared standards across teams and repositories. Instead of manually creating rules in each configuration, organizations can centralize conventions, best practices, and internal policies in dedicated repositories, with greater visibility and control over when those rules were last synced.
We now run a preliminary analysis on every Kody Rule to better understand its intent before it is used in a review.
When a rule is too broad or covers multiple behaviors, it can be broken down into atomic rules: smaller, more specific rules that can either be validated deterministically with regex or evaluated by an LLM when contextual interpretation is required.
In practice, this helps Kody apply complex rules more accurately. Instead of treating a long rule as a single block, the agent works with smaller validation units, reducing ambiguity while better preserving the rule's original intent.
The agent now uses the full PR diff when applying Kody Rules instead of relying only on file names. This gives Kody more meaningful context about the actual changes being reviewed.
With this improvement, rules that depend on modified content have a stronger basis for evaluation. This is especially relevant for rules that verify implementation patterns, contract changes, internal API usage, or sensitive changes in specific parts of the code.
When a repository is used exclusively as a source for Global Rules, Kody now skips reviews in that repository. This prevents repositories created solely to store rules from generating unnecessary reviews.
In addition to reducing noise for the team, this also avoids consuming resources on a workflow that provides no practical value. The source repository can now serve its purpose as a configuration source without being treated like a regular product repository.
The agent's token and context management has been strengthened with stricter per-request limits, a real tokenizer, and more accurate overhead accounting. This makes the agent's behavior more predictable on large PRs or when a significant amount of context has accumulated.
In practice, this reduces the risk of context overflow and makes executions more stable. The agent can operate within more reliable limits, improving both review quality and the rate of intermittent failures.
We improved the messages displayed when failures occur involving LLMs or BYOK keys. Instead of returning generic errors, the system now makes it clearer whether the issue is related to configuration, quota, billing, or communication with the provider.
This makes troubleshooting easier for administrators and technical users. In BYOK environments, where the provider key and account are managed by the customer, clearer messages reduce investigation time and help teams resolve issues without relying on trial and error.
Langfuse telemetry has been updated to work correctly with AI SDK 7, including improved handling of cache, reasoning, and token usage fields.
This improvement increases the accuracy of observability data for AI calls. With more reliable metrics, it becomes easier to monitor costs, model behavior, and the impact of changes to the review pipeline.
Pagination has been improved across Bitbucket flows and repository lists in the frontend. This makes the experience more robust for organizations with a large number of repositories or paginated responses from the integration.
With this improvement, the system can handle larger volumes of data more reliably, preventing incomplete lists and reducing failures during onboarding or integration setup.
Centralized Config sync now avoids deleting configurations when discovery fails or returns an empty result. Previously, a failure during the discovery process could create a risk of incorrect reconciliation.
With this safeguard, the system now handles partial failures more conservatively. This reduces the risk of accidentally losing rules or configurations and improves the reliability of a sensitive workflow for organizations that depend on centralized configuration.
Fixed GitLab Suggestions: we fixed suggestion creation in GitLab so comments are only added to newly added lines, preventing phantom suggestions.
Support for Draft/WIP Merge Requests in GitLab: we now correctly respect Merge Requests marked as draft or work in progress in GitLab.
Custom Bot Usernames in GitLab: we fixed support for review commands when the GitLab bot uses a custom username.
Fixed getCommits Timeouts: transient getCommits failures, such as Undici timeouts, are now handled correctly and rethrown when necessary.
Fixed the Needs Attention State: we fixed an issue that could leave a review stuck in the needs attention state.
Fixed Onboarding and Member Telemetry: the onboarding flow received fixes to prevent it from getting stuck during member lookups and telemetry processing, especially in scenarios involving suspended users or slow API responses.
Fixed the Invitation Flow: the invitation page and flow were updated to prevent failures when new users join.
Fixed GitHub Webhook Creation: webhook creation and listing now correctly use the repository owner, preventing failures when the repository owner differs from the primary account.
Fixed Repository-Level Configuration: we fixed the function used to delete repository-specific configurations.
Fixed Rule Creation and Import: the logic for adding global or repository-level rules was fixed, along with improvements to the search field.
Fixed the BYOK Switching Button: the model and provider switching experience in BYOK was updated to prevent confusion during editing.
Fixed Language Flash in Settings: we fixed the visual language flash that appeared on settings pages after a reload.
Fixed Progress Bar Text: we updated the text displayed in the progress bar to improve interface clarity.
Fixed API Errors for Invalid Parameters: Postgres 22P02 errors, such as invalid UUIDs or integers, now return a 400 error instead of a 500.
Sandbox Lease Fixes: we fixed race conditions and leaseCount leaks in sandbox management, including cleanup, invalidation, and superseded lease scenarios.
RabbitMQ and Workflow Queue Fixes: workflow queues now use centralized arguments and are correctly declared and bound with a DLX, reducing inconsistencies during initialization.
No changelog entries for this filter yet.
Kody Rules can now take selected reviewers into account during the configuration flow. This gives teams greater control when directing specific rules to the people or groups best suited to the context of a review.
This update helps reduce noise and improves rule governance, especially in organizations with multiple teams, domain areas, or repositories with clearly distributed ownership.
We simplified the review setup by removing the preset step and adding severity-level configuration. Teams can now define the level of criticality that reviews should consider directly during onboarding.
We also fixed the enabled and disabled states of several buttons, making the setup flow more predictable and reducing confusion during initial configuration.
Custom messages written by the team are now also included in code review error comments.
This allows Kody's communication to preserve the tone, context, and instructions defined by each organization, even when an analysis identifies an issue. The improvement helps standardize the developer experience and makes comments better aligned with each team's internal processes.
We improved the process responsible for cleaning up sandboxes by introducing controlled concurrency. This prevents spikes in simultaneous operations and makes cleanup more stable in high-volume environments.
We also now correctly handle cases where a sandbox no longer exists in E2B, preventing unnecessary errors and making the sandbox lifecycle more resilient.
We refactored some of the product's heavier screens, particularly areas containing lists, filters, and analytics, to improve performance and responsiveness.
The work includes improvements to queries, rendering, data loading, and the overall visual experience in workflows that handle large amounts of information. The expected result is smoother navigation, less frontend overhead, and more reliable presentation of the displayed data.
Rules Generated from Past Reviews: fixed the generation of Kody Rules from previous reviews, improving the reliability of the rule-learning and creation flow.
Use the Correct Queue Names for the RabbitMQ Health Check: fixed the queue names used by the RabbitMQ health check. Previously, the check could fail to accurately reflect the state of the queues used by the application. It now checks the expected queue names, improving the accuracy of the system's health signals.
Harden Local Sandbox readFile/writeFile Path Validation: strengthened path validation for readFile and writeFile operations in the local sandbox. The change prevents unauthorized access outside the permitted directory and reinforces execution-environment isolation. This improves the security and reliability of file read and write operations within the sandbox.
Fix Bitbucket Requests to Avoid 429 Errors: adjusted how requests are made to Bitbucket to reduce the occurrence of 429 rate-limit errors. The fix improves integration stability, especially for organizations with a high volume of repositories, pull requests, or simultaneous operations.
Close Parent Directory Swap TOCTOU Vulnerability in Local Sandbox writeFile: fixed a time-of-check to time-of-use race condition in the local sandbox's writeFile operation. The flow now performs stronger validation of the actual path before writing, preventing changes to the parent directory from redirecting the operation outside the expected location. This strengthens isolation and reduces risks during write operations.
Change @Kody resume to @Kody start-review in the Cadence Message: updated the cadence message to correctly instruct users to use @Kody start-review instead of @Kody resume. This reduces ambiguity and prevents incorrect commands from being suggested during the review flow.
Resolve CLI Sandbox Clone Platform from the Connected Integration: fixed how the platform used to clone repositories inside the CLI sandbox is resolved. The platform is now determined based on the integration connected to the repository, preventing inconsistencies in environments using GitLab, Bitbucket, or other self-managed integrations.
Fix LLM Compression Message: fixed the compression message generated by the LLM during the code review flow. This step is used when the context needs to be compressed so the analysis can continue. The fix makes the communication clearer and prevents incorrect or confusing messages during processing.
Remove Repository from Integration Configuration When Removed from Repository Settings: fixed synchronization between repository-level settings and integration settings. When a repository is removed from the repository-level configuration, it is now also correctly removed from the integration configuration, preventing inconsistent states and unexpected review behavior.
Business Rules Validation: fixed the business rules validation flow. This change improves the reliability of business-rule-based analysis, helping Kody interpret and apply these validations more consistently during code review.
No changelog entries for this filter yet.
The Token Usage page has been redesigned to provide a more complete view of consumption.
It is now easier to track costs by area, model, and review activity, as well as filter the data and drill down into more specific analyses. This helps teams better understand where tokens are being used and how they can optimize costs.
Organizations that created Kody Rules before this release can also benefit from the new architecture. We created an automated process that analyzes existing rules and, whenever possible, generates mechanical detectors for them.
The process is incremental, safe, and does not interfere with the normal execution of rules. When a rule cannot be converted into a detector, it continues to work through the traditional semantic review flow.
We restructured how Kody applies custom rules during code reviews. Instead of relying solely on a more open-ended agent analysis, rules are now evaluated deterministically by file and PR scope.
In practice, this improves rule coverage in large PRs, reduces cases where an applicable rule is overlooked, and makes Kody Rules behave more consistently across different models.
We also introduced mechanical detectors for certain rules. When a rule can safely be converted into an objective check, Kody can apply it without making an LLM call, reducing costs and improving predictability.
This release includes a major upgrade to the review agent runtime. We migrated important parts of the execution flow to a new agent harness foundation, making the system more modular, observable, and ready for future improvements.
We also improved the engine used to search for evidence in the codebase, with a focus on finding more relevant cross-file references and increasing the quality of generated suggestions.
We adjusted the format of Kody's review comments to prevent internal reasoning structures from appearing in the output and to make suggestions more natural, concise, and easier to understand.
We also fixed issues involving aliases and internal prompt references following recent refactors.
We improved BYOK support across different parts of the product, including configuration, model fallback, and per-model cost calculations.
We also introduced a clearer experience for viewing BYOK settings and understanding how each model affects token consumption.
We improved the observability of LLM calls to ensure token usage is attributed correctly, especially within the new Kody Rules and agent workflows.
This increases the accuracy of usage reports and prevents undercounting in more complex review scenarios.
We improved tenant isolation for MCP connections, enhanced connection sorting and testing, and removed legacy integrations that had already been deprecated.
These changes increase the reliability of the plugins and integrations experience.
We applied fixes to Dockerfiles, provisioning scripts, and local configuration to make self-hosted environments more stable.
We also fixed an issue involving pnpm on macOS and adjusted the API hostname configuration used during provisioning.
We fixed excessive memory consumption in the Mongo observability exporter and improved logging behavior across different environments.
We also removed outdated references to the previous internal framework, simplifying the observability codebase.
We added new end-to-end scenarios and evaluations to validate Kody Rules, model recall, suggestion adherence, and prompt regressions.
These validations help ensure that changes to models, prompts, or the underlying architecture do not reduce review quality.
We updated the documentation for BYOK, custom messages, and focused reviews. We also revised the README and added new pages explaining how to guide Kody during a review.
Safer Rule Execution: we added protections against potentially unsafe regex patterns in Kody Rules detectors. This prevents malformed or computationally expensive rules from affecting review performance. We also fixed cases where outdated detectors could remain associated with a rule after an edit changed the rule's intended behavior.
License and Billing Improvements: we fixed issues involving trial creation, the listing of inactive users or users removed from the Git organization, and active seat counts. These changes make the license page more consistent and reduce discrepancies between the organization's actual users and the users displayed in billing.
No changelog entries for this filter yet.
You can now ask Kody to pay special attention to something specific during a review, without changing any configuration.
In a PR, use @kody review \. In the CLI, use kodus review --focus.
Examples:
@kody review focus on security@kody review focus on performancekodus review --focus "edge cases"This is especially useful for larger PRs or sensitive changes, where you want the review to go deeper on a specific area, such as security, performance, edge cases, a business rule, or a team standard.
Focus works as a priority, not a filter. Kody pays closer attention to the context you provide, but still reports other concrete issues it finds in the diff.
Learn more in the Steer a Review (Focus) documentation.
We added an option to generate a single PR comment containing all prompts and suggestions, so an external agent or AI tool can apply the fixes in one pass.
In the add repositories modal, we added select all and clear selection buttons. For teams connecting dozens of repositories, this removes the need to select each one manually and significantly reduces setup time.
Teams using Bring Your Own Key now have a detailed view of LLM usage by model on the costs screen. Instead of seeing only the total amount, you can identify exactly which providers and models are driving most of the usage and make clearer decisions about what to keep, replace, or limit.
We reorganized the code review agents to run on a unified infrastructure. Previously, parts of the flow were spread across different places, which could lead to duplicated suggestions and inconsistent behavior. With this consolidation, the pipeline is more predictable, easier to maintain, and less likely to repeat suggestions in the same PR.
We improved the deduplication algorithm so distinct bugs are not grouped as if they were the same issue. The content guard now better considers the actual content of each suggestion, reducing false-positive deduplication and making sure separate issues continue to be reported individually.
We fixed unstable behavior in prose finding generation and restored strict mode for Gemini. We also updated the Anthropic SDK, keeping compatibility with newer models and improving response stability.
We updated the permissions documentation, including the OrganizationSettings scope and the restriction that only the organization Owner can configure BYOK. This makes it clearer who can do what inside the workspace.
Review comments with broken formatting: fixed cases where Kody comments appeared with unexpected formatting in pull requests.
Retry errors with BYOK providers: added preventive adjustments to avoid retry failures when a BYOK provider returns an empty response body.
Sandbox tool errors: the agent now handles errors better when running tools in the sandbox environment, without breaking the review.
Normalized user IDs: standardized how author, reviewer, and assignee IDs are handled, preventing PRs from breaking because of type differences, such as string vs. number.
@kody conversation crashing on JSON wrapped in prose: fixed a crash that happened when Kody responded to mentions and the output came back as text containing embedded JSON.
IDE sync config now respects approval settings: IDE rule synchronization now respects the approval configuration.
Rules with multiple directories: adjusted Kody Rules validation to correctly handle rules that apply to multiple path groups.
Automatic code review config creation: when a repository did not have a code review configuration, creating a Kody Rule could fail silently. The configuration is now created automatically.
Diff re-review in the agent: improved how the agent detects diffs from new commits during re-reviews.
MCP Manager OAuth disconnect: fixed an issue with disconnecting OAuth credentials in MCP Manager that could cause inconsistent behavior.
MCP Manager production build: the MCP Manager production build now correctly passes the GitHub token.
Orphaned users in the license list: users removed from the GitHub organization now appear correctly in the license list.
Skipped review email: the notification email sent when a review is skipped now includes the author's name/email and no longer breaks when the user does not have a license.
No changelog entries for this filter yet.
We updated Kody's review pipeline to improve analysis accuracy and reduce cases where important issues could slip through unnoticed.
The engine now identifies problematic patterns more effectively, better understands changes that span multiple files, and can review code regions with more flexibility when the context is not fully obvious.
We also optimized processing and reduced the average cost per review by around 30%.
Filters applied in Cockpit are now saved in the URL, including time range, repositories, severity, and status.
This means you can copy the link and share it with your team on Slack, for example. Anyone who opens the URL will see Cockpit with the same filters applied, without having to manually recreate the view.
This makes it easier to share specific analyses, such as what changed over the past week or an increase in security suggestions in a repository.
We unified the Kody Rules flow into a single lifecycle, regardless of where the rule was created: the library, manual creation, or inheritance from the organization to the repository.
With this change, activating, editing, disabling, and approving rules now follow the same path inside the product. We also migrated older rules to the new format and centralized the control of rules pending approval.
This makes the system more consistent, reduces unexpected states, and ensures that an active rule is actually applied in Kody reviews.
We removed the dependency on Composio as an external MCP broker and moved to our own implementation for GitHub Issues, now integrated with Kodus Issues.
This reduces an external point of failure, improves call reliability, and gives us more control over authentication, rate limits, and retries.
As part of the migration, we also removed low-usage integrations that depended on Composio, such as ClickUp and CloudId.
When you enable or disable rule inheritance from the organization to a repository, the UI now shows the new state immediately, without waiting for the API response.
If the call fails, for example because of a connection issue, the state is automatically reverted and we show an error toast. Before, users would click, wait, and not get clear feedback about what had happened.
We also improved the rules cache update. Now we only invalidate the rules affected by that inheritance change, avoiding unnecessary reloads for rules that did not change.
We added an explicit origin to all Kody Rules: LIBRARY, MANUAL, INHERITED, and SUGGESTED.
This fixes an issue where some rule creation scenarios could fail silently because the backend expected an origin value that the frontend was not sending.
Now the contract between frontend and backend is clearer, and the rule origin is validated before reaching the creation flow.
Rovo is an Atlassian AI agent that generates code and edits files automatically. When it creates commits, it includes specific metadata, such as message prefixes and custom headers.
Previously, our review engine identified those commits as human-written code and could suggest changes on them.
Now we detect Rovo commits and skip those changes both in the code review logic and in the MCP business-rule validation preflight.
We fixed the OAuth flow for connecting MCPs, such as GitHub and Jira.
Previously, users who had already completed onboarding could be blocked when trying to add a new MCP. Now the callback works at any time, as long as the state parameter is valid.
Pending rules, which need approval before entering the review pipeline, now have a dedicated section with improved UX.
The section shows a status badge, who suggested the rule, when it was suggested, and inline actions to approve or reject it.
Previously, these rules appeared mixed together with active rules, which made it easy to miss that something needed attention.
GitHub Integration GitHub App post-onboarding: we fixed an issue where some GitHub integration pages returned a 404 after the user completed onboarding. This affected routes such as /github/integration and /github/organization-name when the GitHub App installation state was not updated correctly. We also adjusted the redirect after installation and added route validations to make the integration flow more reliable across different states.
Severity slicer colors: the severity control for low, medium, high, and critical used inconsistent colors. In some places, red meant critical; in others, it meant high. We standardized it to a semantic scale: gray for low, yellow for medium, orange for high, and red for critical. This affects Cockpit filters, suggestion badges, and notification settings.
No changelog entries for this filter yet.
Review comments, commit statuses, force-push detection, and webhook coverage now work consistently for Forgejo repositories. If you self-host with Forgejo, Kody behaves just like on any other major platform.
Eliminated duplicate API calls when syncing Kody Rules from changed files. PRs with many files now close noticeably faster.
Platform settings that don't apply to your current Git provider, such as GitHub-specific options when you're on GitLab, are now hidden automatically. Less clutter, fewer misconfigurations.
Reconnecting a Git provider after disconnecting: previously, disconnecting a provider left stale integration configs behind, causing reconnects to fail. Now stale rows are properly cleaned up.
Kody conversation replies with empty responses: resolved an issue where Kody occasionally replied with blank content in PR comment threads when using Claude Sonnet.
NaN deduplication indices: added three-layer protection against NaN values appearing in suggestion deduplication indices, preventing rare but confusing duplicate suggestions.
Forgejo prompt field always empty: the formatPromptForLLM function was reading a non-existent field on Forgejo PRs, causing the prompt section to be blank. Now it reads the correct field.
Self-hosted AST graph reliability: the kodus-graph CLI was installed but not available to the runtime user in self-hosted worker images. Fixed PATH and install order so graph indexing works out of the box.
Orphaned agent trace records: prevented a race condition in chunked review mode that could leave orphaned IN\_PROGRESS trace records in the database.
Platform settings not scoped to Git tool: settings incompatible with your current Git provider were still visible. Now they're properly filtered based on the connected tool.
No changelog entries for this filter yet.
Track the health of your review pipeline in real time. Throughput, queue, and processing time metrics are now available in Cockpit.
The review tab has been redesigned with a cleaner interface and more direct actions. You can now analyze and act on suggestions without leaving the PR screen.
We migrated the backend from Yarn 1 to pnpm. This makes builds faster, improves lockfile consistency, and reduces cache issues across environments.
The token usage screen has been redesigned to make consumption by organization and period easier to understand. It is now simpler to track usage and see how tokens are being consumed over time.
Self-hosted analytics: we fixed the analytics integration for self-hosted deployments. Usage metrics now appear correctly in the dashboard.
Issue cache: the issue count in the sidebar could sometimes become outdated. The cache is now invalidated correctly after changes.
GitHub rate limit: we fixed a rate limit issue in cloud E2E tests. We now use round-robin across multiple bot accounts to better distribute requests.
Notification routing: we fixed the behavior of targeted notifications when combined with audience settings. Notifications now reach the right people without duplicates.
Centralized config sync: we fixed issues in the centralized sync of Kody Rules configurations across repositories. Sync now correctly handles multiple scopes, stale configurations, and merge-triggered updates.
No changelog entries for this filter yet.
We added support for Moonshot as a provider, compatible with the Anthropic API.
You can now use the Kimi Coding Plan model in BYOK setups. To configure it, set the API\_MOONSHOT\_API\_KEY key and select the model in the organization preferences.
See the Moonshot (Kimi) documentation for more setup details.
Organizations can now set monthly token consumption limits per model.
Usage is shown in real time in the interface, with a progress bar. When usage reaches 80% of the limit, the team receives an email alert. If the limit is reached, additional reviews can be blocked automatically.
See the Monthly Spend Limit documentation for more setup details.
The review engine now handles empty or malformed LLM responses better.
This reduces loops in edge cases and helps ensure valid suggestions continue to be delivered even when the provider returns an unexpected response.
On-premise installations now automatically report health metrics, such as heartbeat, and usage data.
The goal is to make diagnosis and support easier without exposing sensitive customer data.
We improved the loading and synchronization of custom rules.
We also fixed the count of orphaned rules and made partial updates safer against race conditions.
GitHub: suspended users no longer appear in the member list for license assignment.
Update Connection: integration reauthentication now correctly clears the previous configuration.
Integration reset: Kody Rules linked to the repo/directory are now removed automatically.
Release Freeze: eligibility notifications only appear when the freeze is active.
No changelog entries for this filter yet.