Crogl 2.5.0 Release Notes

We're excited to announce the release of Crogl 2.5.0. Amazon Bedrock now authenticates with an AWS identity the host already holds, so there is a credential-free path onto Bedrock alongside the existing API key, and a new command reports exactly where a language model connection fails rather than leaving you to guess. Every ticket comment an investigation posts can now carry a link back to the full report, the Investigations list shows whose work each report is, and how many scheduled runs go at once is a setting instead of a compiled-in number.

What's New

• Connect Bedrock with an AWS Role
• Test a Language Model Connection
• A Link to the Report in Every Ticket Comment
• See Who Owns an Investigation
• Set How Many Scheduled Runs Go at Once

Detailed Changes

Connect Bedrock with an AWS Role

The Amazon Bedrock providers can now authenticate with an AWS identity the host already holds, storing no credential in Crogl at all. Three options join the existing Bedrock API key:

• EC2 instance role signs requests with the instance's own IAM role, read from instance metadata and nothing else. AWS rotates the credential. Grant the role bedrock:InvokeModel, and bedrock:InvokeModelWithResponseStream for streaming.
• Assume a role assumes a role you name, authenticating with the host's own identity and renewing before the credentials expire. Use it where Bedrock access lives in a separate or cross-account role. Supply the role ARN, and an external ID if its trust policy requires one.
• Host identity uses whichever AWS identity Crogl runs as, covering ECS task roles and EKS service accounts as well as EC2.

None of the three stores a credential, so there is nothing to rotate or leak. Bedrock now also takes the region separately from the endpoint URL, because a FIPS or PrivateLink endpoint name does not always carry one. See the Language Models page for what each option needs.

Test a Language Model Connection

crogl test-lm-connection reports which step of the connection fails, so a model that will not connect no longer means guessing between the endpoint, the credential, and the account's model access. For Bedrock with an AWS role it also reports which credential source was used, and separates a credential that could not be obtained from a request Bedrock refused. The second points at the role's permissions or the account's model access rather than at Crogl. The CLI Reference covers the command's options and output.

A Link to the Report in Every Ticket Comment

Tell Crogl the address analysts reach it at, and the comment an investigation posts into a ticket links back to the full report:

crogl set-app-config platform.origin=https://crogl.example.com

You can also enter it as the Crogl URL on the Platform screen in Settings. The value is an https address with no path. It is unset by default, and until you set it Crogl posts the same comments without a link rather than a broken one. The Operations page covers it under changing how people reach Crogl.

See Who Owns an Investigation

The Investigations list now shows each report's owner. It reads You on your own reports, Crogl on the ones autonomous runs produce, and names the analyst otherwise, so an administrator can tell whose report a row is before acting on it. The owner also appears on the report itself.

Set How Many Scheduled Runs Go at Once

How many scheduled runs execute concurrently is now the scheduler.max_concurrency setting rather than a compiled-in number, so pacing a deployment no longer needs a new build:

crogl set-app-config scheduler.max_concurrency=10

Crogl reads it on every dispatch tick, so a change applies to the next one with no restart. Lowering it stops new runs from starting and cancels nothing already going. The limit is 6 until you set it, and it caps one server rather than a cluster. Size it to the host: every concurrent run holds an agent container, so raising the limit spends memory and CPU.

Bug Fixes

• A conversation no longer stalls after you do the part the agent cannot. When Crogl asks you to register a connector draft, connect a credential, or create a sandbox, finishing that step now resumes the agent. Previously the nudge that resumes it often never arrived, leaving a registered connector and a conversation that had stopped, after a skill had promised the agent would carry on by itself.
• A tool that was running when a turn failed no longer spins indefinitely. The card kept its in-progress state and could not be expanded until the page was reloaded, even though the turn had ended.
• Investigations choose where to look using what Crogl already knows about your environment, rather than working it out again each time, so a run reaches the right connector for the question sooner.
• Microsoft Log Analytics columns whose values are structured are now read into what Crogl knows about your environment, so the fields inside them can be matched against fields in your other tools.
• Correlating Jira tickets is anchored on the field Crogl scanned, so a ticket whose content sits in a different field is no longer missed.
• The Crogl UI is served with a Content Security Policy, which restricts what a browser will load and run on the page.
• Outstanding npm and Go dependency vulnerabilities are remediated.