## kodustech/kodus-ai — web-1.2.5…web-1.2.6

_266+ commits._

### Features
- **feat(code-review): record on the run what a review gave up (#2066) (#2071)** (2eab553)
- **feat(doctor): say whether the reviews of the last 7 days ran in full (#2066) (#2072)** (47e990f)
- **feat(code-review): give scanner findings their own category** (dcb713b)
- **feat(code-review): tell the agent what the scanners already found** (48dcf6b)
- **feat: Add beta badge to deterministic checks** (cfa0d04)
- **feat(observability): link usage rows and Langfuse traces both ways** (799853a)
- **feat(web): settings section for the deterministic checks** (70698ef)
- **feat(web): gate events that can be read without a database** (0383ef9)
- **feat(telemetry): emit the events from the use-cases that own the change** (89d5c6a)
- **feat(telemetry): a method per business event, for the moments we were blind to** (015e475)
- **feat(web): locked screens argue from what the workspace already has** (4ae2b64)

### Fixes
- **fix(code-review): never repost an earlier suggestion; link revisions to it (#2074)** (311a289)
- **Merge pull request #2057 from kodustech/fix/cross-org-member-isolation** (914e467)
- **fix(sandbox): run git on the sandbox's own clone, never the caller's (#2069)** (c3434ad)
- **fix(web): guard category edits; no plan CTA for roles without billing (#2073)** (17bc04b)
- **fix(mcp): accept only the /mcp path for the first-party endpoint** (047246c)
- **fix(web): self-hosted sweep — activity log 500, seats, unsaved changes (#2068)** (6d7a96d)
- **fix(web): QA sweep bugs in PR detail, rule form, Cockpit and sidebar (#2062)** (cff64fa)
- **fix(mcp): derive the issues endpoint from the resolved MCP path** (763b368)
- **fix(e2e): send BYOK v2 config from the matrix runner (#2034)** (d31d46c)
- **fix(doctor): stop false ✘ on installs whose reviews run (#2066) (#2067)** (c6507c7)
- **fix(mcp): accept only an MCP path for the first-party endpoint** (a3e500f)
- **fix: address review on domain lookup, MCP endpoint and member upserts** (47552ba)
- **fix: skip invites outside the organization and list rules of empty orgs** (327705b)
- **fix(api): reject cross-organization identifiers across tenant routes** (d35d6cb)
- **fix(mcp): authenticate MCP endpoints and scope tool calls to the caller** (cea23c6)
- **fix(mcp): validate endpoint before connection creation** (7991dd0)
- **fix(mcp): route internal credentials to canonical endpoint** (710f13b)
- **fix: authenticate MCP rule deletion and preserve sync batches** (2635fcd)
- **fix: address tenant isolation review feedback** (8bafaba)
- **fix(api): enforce organization isolation for resource access** (66795d7)
- **Merge pull request #2056 from kodustech/fix/byok-retired-fireworks-model** (14439a9)
- **fix(llm): run a retired Fireworks id saved in a direct BYOK slot as its replacement** (75d1655)
- **Merge pull request #2048 from kodustech/fix/conversation-duplicate-webhook-delivery** (393bdb7)
- **fix(gitlab): prefer an executable duplicate hook over a disabled one** (579853d)
- **fix(gitlab): keep the duplicate hook that can deliver, not just the oldest** (aed4227)
- **Merge pull request #2029 from kodustech/fix/llm-error-classify-json-keyword-rule-schema** (6f5903c)
- **fix(llm): an unclosed reasoning block means no answer only at the very start** (d9a01e7)
- **fix(llm): skip reasoning blocks in one pass and keep an answer behind an unclosed one** (34a52e5)
- **fix(llm): skip a reasoning block only before the JSON starts** (8af80ad)
- **fix(kody-rules): log findings on unchanged lines instead of dropping them** (c97da55)
- **fix(llm): let a pasted reasoning override use the vendor's spelling** (320be38)
- **fix(llm): ask again without a reasoning field the upstream refuses** (994e6d7)
- **fix(llm): do not tell an always-thinking model to think** (794dfc8)
- **fix(code-review): name the review when an agent fails** (7319aa3)
- **fix(llm): ask MiniMax-M3 for JSON in text, not through a forced tool** (4a2386e)
- **fix(llm): skip reasoning written before the JSON answer** (d4a0926)
- **fix(workflow): release per-attempt claims on shutdown, and complete only as holder** (d8d2d99)
- **fix(conversation): per-attempt claim holder, and release on every failed delivery** (2103bad)
- **fix(conversation): release a comment claim only while holding it, and on missing integration** (95540cb)
- **fix(conversation): answer each comment once when several webhooks deliver it** (6fdce8a)
- **fix(gitlab): keep one Kodus webhook per project** (a9c38a6)
- **fix(kody-rules): compare a finding's fix byte for byte** (3e0aea4)
- **fix(kody-rules): drop diff-only findings that cite only unchanged lines** (3a720a1)
- **fix(kody-rules): drop shard findings that rewrite the code into itself** (66beae2)
- **Merge pull request #2035 from kodustech/fix/deterministic-comments** (bcbbe4c)
- **fix(code-review): bound how wide a restatement can be, and list the new category in cockpit** (849b770)
- **fix(code-review): guard the location-merge path against absorbing a scanner finding** (b3b94fb)
- **fix(code-review): never merge two scanner findings into one comment** (9ad3b71)
- **Merge remote-tracking branch 'origin/main' into fix/deterministic-comments** (8ed6a50)
- **fix(code-review): keep dedup grouping scanner and model findings together** (245aa20)
- **Merge pull request #2030 from andyst-dev/fix/2015-kody-rule-other-locations** (298adae)
- **fix(code-review): stop the severity filter and dedup guard from dropping scanner findings** (23ff312)
- **fix(code-review): let deterministic findings survive dedup and formatting** (710de0b)
- **fix(code-review): name every package and location in deterministic comments** (86e9ef5)
- **fix(kody-rules): clear the context reference pointer with null** (5fc776b)
- **fix(code-review): carry merged locations into the LLM prompt copy too** (9910797)
- **fix(code-review): keep a merged Kody Rule's other locations after the formatter** (487ad15)
- **fix(kody-rules): clear a synced rule's pointer when it references nothing** (adc3885)
- **fix(observability): open a Langfuse observation only for traced calls** (add5fbf)
- **fix(code-review): never run a scan with no target** (2379a48)
- **perf(code-review): only fetch the raw diff when an analyzer will use it** (c1e0b34)
- **fix(ai-engine): pass the revision limit through ContextReferenceService.find** (6566c74)
- **fix(platform): read diff headers git had to quote** (2c7efd3)
- **fix(code-review): recover withheld hunks before routing decides** (e2ff181)
- **fix(code-review): stop inlining a lockfile into a shell command** (30aeed1)
- **perf(ai-engine): read the latest context revision as one row** (823331e)
- **fix(code-review): never scan or publish a path the review ignores** (89057fc)
- **fix(code-review): scan only the manifests the base tree actually holds** (8c7db60)
- **fix: fix generated features snapshot** (c8846b8)
- **fix(platform): recover collapsed merge request diffs on GitLab** (9c3bf9c)
- **fix(mcp-manager): leave retired managed integrations out of connection listings** (a4d56b6)
- **fix(byok): list openai_compatible models live and tighten list-models credentials** (ddaaa3e)
- **fix(centralized-config): say which field makes a rule file invalid** (99ff97f)
- **fix(kody-rules): reuse the reference-detection answer for unchanged rule text** (63880cc)
- **fix(code-review): split the PR summary when the model rejects its size** (984fd31)
- **fix(llm): put the json keyword in the user turn on json_object calls** (116d72e)
- **fix(llm): classify an exhausted retry by its last attempt and trace harness runs again** (305ffb1)
- **fix(code-review): recover the lockfile hunks GitHub withholds** (691775b)
- **fix(code-review): compare against what the branch forked from** (a11137d)
- **fix(code-review): only stand down for a check that really scanned dependencies** (6c30f4e)
- **fix(code-review): keep analyzers out of paths the review ignores** (664c670)
- **fix(code-review): scan the changed manifests and fail when the scanner does** (21f5fa1)
- **fix(code-review): say when the dependency baseline could not be built** (f04dd7f)
- **fix(sandbox): build the submodule base ref from the normalized name** (9b685f4)
- **fix(code-review): assert a tool that still exists, key the file lookups** (3ff9c69)
- **fix(sandbox): normalize the base branch wherever it enters a sandbox** (b4da4fd)
- **fix(code-review): never report a whole tree as newly vulnerable** (e1f3c79)
- **fix(env): stop the coverage check reading the benchmark corpus as our code** (c51cf95)
- **fix(web): hide the deterministic checks section outside the beta** (9f4394a)
- **fix(code-review): deliver analyzer findings on ignored paths** (2ab3dbf)
- **fix(code-review): keep a finding on the path its host reports** (baa2ba7)
- **fix(code-review): hand the scanners repository-relative paths** (334ad6f)
- **fix(sandbox): fetch a base branch that is named as a full ref** (2280fab)
- **fix(code-review): read CI checks on hosts with no owner/name pair** (95cce51)
- **fix(platform): forward check evidence to the Bitbucket implementation** (2e00b36)
- **fix(platform): carry the head commit when a PR is fetched by API** (3a0ac27)
- **fix(platform): report the head commit on every code host** (94d2d9d)
- **fix(platform): name the credential that can read check runs** (7f203a6)
- **fix(platform): say what unreadable check runs cost the review** (0d939ed)
- **fix(code-review): build the baseline inside the sandbox** (4cc3a14)
- **fix(sandbox): a reconnected sandbox keeps its base branch** (2cb7157)
- **fix(code-review): read the dependency baseline from the base branch** (acf260a)
- **fix(code-review): report an analyzer run that found nothing** (f1489dd)
- **fix(code-review): a vulnerable dependency must not fail the scan** (d6e6e3e)
- **fix(code-review): let the analyzers read files the review ignores** (10e8768)
- **fix(web): the date range in the URL only reached the cockpit** (863034c)
- **fix(byok): two gateways of the same provider are two credentials** (829f64e)
- **fix(web): /review-suggestions threw instead of showing its gate** (6307364)
- **fix(runo): tell next dev which origin the self-hosted preview is opened from** (7308dd1)
- **fix(web): phrase availability the way each edition sells it** (9465373)
- **fix(web): a self-hosted install has no plan chooser to send people to** (51e7503)
- **fix(web): show the rule and plugin caps to every org the API caps** (334a464)

### Backend
- **revert: derive the issues endpoint from the origin again** (b76dfa8)
- **Merge pull request #2025 from kodustech/feat/ci-check-evidence** (1df08e5)
- **Merge remote-tracking branch 'origin/main' into feat/ci-check-evidence** (a58c767)
- **Merge pull request #1936 from kodustech/malinosqui/rules-ui** (b782e77)
- **Merge remote-tracking branch 'origin/main' into feat/ci-check-evidence** (8e303d2)
- **Merge branch 'main' into malinosqui/rules-ui** (3d8f2f3)
- **Merge pull request #2014 from kodustech/docs/changelog-2026-09-25** (fc19f4d)
- **Merge remote-tracking branch 'origin/main' into feat/ci-check-evidence** (a7108cd)
- **Merge remote-tracking branch 'origin/main' into malinosqui/rules-ui** (4cb61a0)

### Tests
- **test(gitlab): correct the edit-failure spec comment** (7c33ee1)
- **test(gitlab): pin a transient edit failure, and scope the survivor docstring** (9921d8a)
- **test(kody-rules): pin that a detected reference id is persisted** (a9784a5)
- **test(evals): score kody-rules on what the review publishes** (8e1c1b6)

### Docs
- **docs(readme): say what Kodus is and who self-hosting is for (#2041)** (9eca331)
- **docs(evals): give the security-analyzers eval the standard header** (288f09e)
- **docs(build): describe the analyzers the images actually carry** (cd55aaf)
- **docs(changelog): add September 25, 2026 release notes** (1f0eece)

### Chore
- **refactor(code-review): make deterministic tool modes boolean** (f6b474f)
- **chore(ai-engine): log the tenant on clean reference-detection saves** (e59e3fd)
- **chore(platform): trace a failed patch read to its organization** (20d5cd9)
- **style: format the files this branch touched** (c3f325b)
- **chore(code-review): drop naming left over from the rule pack** (77a10fc)
- **chore: drop the opengrep env var and rule-pack copy step** (c88dee7)
- **chore(config): drop defaults for the analyzers we removed** (b2db489)
- **chore(runo): the self-hosted profile carries the plugins surface** (51c9036)
- **chore(runo): a self-hosted profile, so both editions can run at once** (59cfcca)
- **style(web): one amber region per gate card, per the design system** (454c05e)

_Recap by [Repo Wrapped](https://repowrapped.com/gh/kodustech/kodus-ai?utm_source=github-action)._