Crogl 2.7.0 Release Notes

Crogl 2.7.0 makes an exported investigation report searchable and small enough to send, opens and works tickets in Jira and ServiceNow end to end, and reports what an investigation could not cover as plainly as what it found.

What's New

• Search and Copy From an Exported Report
• See Known-Exploited Findings in the Vulnerability Summary
• Open and Work a Jira Issue End to End
• Open and Work a ServiceNow Record End to End
• Know That a Host Resource Recovered
• Watch How Long a Turn Has Been Running
• Read a Long Run of Tool Calls as One Line
• See Why a Model Provider Refused a Turn

Detailed Changes

Search and Copy From an Exported Report

An exported report PDF is now built from the report itself rather than captured from your screen, so every word in it is text. You can search the file, copy from it, and paste a query or an indicator straight out of it. The file is far smaller too — a six-page report that ran to 78 MB now exports at about 52 KB, small enough to attach to a ticket or mail to a stakeholder.

See Known-Exploited Findings in the Vulnerability Summary

The vulnerability summary now reflects what your scanner reported, including something it used to leave out. A finding your scanner flagged as known-exploited in CISA's catalog is counted on its own, because a vulnerability attackers are already using cuts across severity.

Open and Work a Jira Issue End to End

Crogl now creates a Jira issue, where before it could only work one you pointed it at. Before it creates anything it reads your project's live field requirements and fails with the exact field names when something required is missing, so a create does not half-succeed. Crogl can also add labels, set severity, link issues to each other, look up a user, read an issue's change history, and attach a file or read one back. Reading an issue's comments now takes them all, past the first hundred.

Open and Work a ServiceNow Record End to End

Crogl now creates a ServiceNow record and reports the number the server assigned it. Crogl can also add work notes, set severity, read back the journal it writes into, count the records matching a query, and attach a file or read one back. Security incidents are covered alongside incidents, problems, changes, requests and tasks.

Know That a Host Resource Recovered

When a host resource that was running short recovers, Crogl says so and names what works again — that investigations will run at their usual pace, that agent containers are no longer at risk of being stopped before they finish, or that new agents can start. A partial recovery keeps warning you about what is still short.

Watch How Long a Turn Has Been Running

While Crogl works on a turn, it reports how long the turn has been going and how many tokens have come back. The figures stay with you through the tool calls the turn makes, which are the turns whose length is worth watching.

Read a Long Run of Tool Calls as One Line

A run of tool calls now reads as one line — 8 tool calls, or 8 tool calls, 1 failed — rather than a line for each. Every call is still recorded underneath with what it did, so a long stretch of work no longer buries the answer that came out of it.

See Why a Model Provider Refused a Turn

When your model provider refuses a turn — a drained balance, a revoked key, a model your key cannot reach — Crogl now reports the refusal in the conversation. The turn used to end as a blank answer, which left the cause to be guessed at while every following turn failed the same way. The provider's own reason is what you see, so you can go fix it.

Bug Fixes

• A Crogl deployment on macOS no longer warns that a disk is filling up when it is not. Disk readings now count the space macOS holds back and releases on demand, which a Mac could report as tens of gigabytes already spent.
• An investigation report is now refused if it accounts for a host Crogl could not scan without saying so, so a coverage gap reaches the report rather than passing as a finding-free host.
• An investigation report can no longer be saved without a title.
• Crogl records a technique as not detected only after a search whose scope covers the claim comes back empty, rather than treating one it never looked for as absent.
• An upgrade that preserves your existing data now restores it correctly, including when Crogl is installed under a directory owned by root and on hosts running SELinux. An upgrade that cannot safely start against the data it finds stops instead of proceeding.
• The installer checks each container image it ships against a recorded checksum before loading it, so a damaged download is caught before the install writes to your host.
• An upgrade no longer stops partway through on an out-of-order database migration. Crogl repairs that state and completes the upgrade.
• crogl get-userinfo now says plainly that a machine-to-machine credential has no identity-provider profile to fetch, instead of failing with a token error that pointed at the identity provider.
• The identity service is upgraded to Rauthy 0.36.2, which closes session state mixing between users during a passkey ceremony, token minting across clients during a refresh, and a denial of service reachable without signing in.
• Outstanding npm advisories in the web interface are remediated.