Release Notes

New Features

• Agentic Jobs can now be granted access to specific MCP (Model Context Protocol) servers, with per-job control over which tools are available.
• Organizations can now publish their approved MCP servers as a registry that GitHub Copilot can enforce, so the same approved tool set governs both.
• Follow-up chat messages are no longer dropped while the AI is responding — they're queued and sent automatically as soon as the current turn finishes.
• Migration Assistant rewire prep findings can now be exported to CSV or Excel, making it easy to share results with teams outside CodeCargo.

Improvements

• Workflow Troubleshoot now pulls the actual failing workflow file into context, so the assistant starts from the real definition instead of an empty session.
• Org Settings "Agents" has been renamed to "Prompts" to avoid confusion with the newer self-service Agentic Jobs feature.
• Self-service workflow and agent cards show distinct colors again, the remediation workspace link now uses a clearer icon, and ghost buttons no longer show a dashed border.
• Azure DevOps imports now report clearer, more actionable errors — including distinguishing an invalid access token from other failures — and show per-project progress and an entity breakdown before pushing.
• Migration Assistant imports now prefer confirmed repository mappings over name-based guesses, and no longer overwrite a manual link when a reference can't be resolved.
• Agentic job runs stopped by a budget cap now show a clear badge and banner on the run detail view and in the editor chat, so it's obvious when a run was blocked by cost limits.
• Performance, reliability, and security improvements across the platform.

Bug Fixes

• Fixed an issue where an AI agent's work could be silently lost if it committed changes directly during a turn instead of leaving them staged.
• Fixed an issue where managers could lose the ability to manage an Agentic Job once its target repository was deactivated or removed.
• Fixed an issue where a compliance evaluation could spin indefinitely if it never received a result, and hardened service-catalog scanning against duplicate detection runs.
• Fixed an issue where the Azure DevOps rewire scanner could bypass manual review for repository URLs containing embedded credentials.

New Features

• Agentic Jobs now support granular GitHub permissions: grant read-only GitHub browsing separately from the ability to open pull requests, and a job that finishes with staged changes can automatically open a pull request for review, linked right from the run report.
• Agentic Job schedules now use a frequency-and-time picker instead of requiring raw cron syntax, with an "Edit cron directly" option for advanced cases.
• Migration Assistant Azure DevOps imports can now be scoped to a specific set of repositories using a CSV file, making it possible to migrate large organizations without importing everything at once.

Improvements

• Workspace syncs started by Agentic Jobs, guardrail remediation, and migration batches now show up in the header Activity pill with live status and history.
• Org-scoped Agentic Jobs can now use prompt inputs, and switching between organization and project scope no longer leaves an invisible repository selected on the job.
• Agentic Job thread titles now reflect your actual prompt instead of a generic workspace-setup name.
• Migration Assistant no longer shows a "Preview" badge, and Azure DevOps-hosted pipelines now correctly link to their repository during import instead of appearing unconfigured.
• Azure DevOps imports now back off proactively when Azure DevOps signals it's approaching a rate limit, improving reliability for large imports.
• CargoWall now automatically retires event and workflow-run history older than 90 days to keep run history performant at scale.

Bug Fixes

• Fixed an issue where CodeCargo could open duplicate pull requests for GitHub Actions updates or CargoWall installation during a deploy.
• Fixed a crash in Migration Assistant discovery for large organizations that could trigger a false "Job Failed" alert.
• Fixed an issue where the Azure DevOps rewire scan could create phantom repository references from malformed text near repository URLs.
• Fixed a false guardrail finding on the CargoWall action's id-token: write permission.

New Features

• Agentic Jobs (Preview) let you configure repeatable, automated AI agent tasks — a prompt, a granted tool set, and a target repository — that run on a schedule or trigger (starting with GitHub releases) and stage their changes in a workspace for review. Runs show up alongside your other agent activity.
• You can now share Building Blocks across organizations: a provider org grants named consumer orgs read-only access to a source, and shared blocks appear in the catalog with provider details and a link back to the original.
• Building Block sources can now expose an entire repository as a Repository building block — useful for infrastructure-as-code, Terraform, and templates — with the root README.md rendered as its documentation.
• Migration Assistant mappings now support an explicit Use existing / Use planned / Create new choice, so an element can reference a Building Block or reusable workflow that already exists instead of always creating a new one.
• Migration Assistant can now find and fix lingering Azure DevOps references left behind after an ado2gh migration, reporting them per repository and opening a pull request with the fixes.
• The agent pill and notification bell are now combined into a single Activity control, showing live agent runs and your notifications together, with guardrail evaluation runs now visible alongside remediation runs.

Bug Fixes

• Fixed an issue where workspace syncs could fail to open a pull request due to a stale internal lock file.
• Fixed overlapping column headers in the Actions Insights Split view.
• Fixed duplicate LLM budget alerts when a plan is shared across multiple organizations.

New Features

• The new Agent Console gives you a live view of AI agent runs. Migration Assistant, discovery, and guardrail remediation runs all appear together, with a header pill showing what's in flight and an expandable timeline for each run.
• The org and project Workflows lists now show guardrail pass/fail results, with a combined filter for compliance status and specific failing rules, so you can track rollout of a new guardrail across every workflow. Remediation now runs in the background as well — kick off a fix and keep working, with progress visible right from the compliance table.
• You can now set personal notification frequency and severity overrides for guardrail and CargoWall alerts, taking precedence over your organization's defaults.
• CargoWall run details now show the full CNAME chain behind a connection that was allowed via a CNAME redirect, so you can see exactly which hostnames were involved.

Improvements

• The AI editor is now aware of what you're working on. Empty-chat suggestions adapt to the task at hand, and an ambiguous request like "update the workflow" targets the file you have open rather than a same-named file in another repository — and the editor always names the file it acted on.
• Opening a file from a guardrail remediation or a deep link now takes you straight to that file instead of the alphabetically-first one, and code view is the default editor view.
• Workflow Troubleshoot now pulls in the repositories behind any reusable workflows a workflow calls, so the assistant can read and fix issues across the full call chain.
• Pull requests opened by CodeCargo now include a structured, reviewer-focused description tailored to the kind of change — a normal sync, a guardrail remediation, or a migration.
• Migration Assistant can now register a migrated reusable pipeline element as a Building Block Action, not just a Workflow, completing the loop when you map it to an action target.
• Notifications are easier to triage: emails now use a branded, categorized subject line, and Slack messages include an action button, a divider, and a severity footer.
• Settings are consolidated. Profile emails now live on a single General settings page, the user menu shows one Settings link instead of every profile sub-page, and per-organization email routing has been replaced by your notification preferences.
• Self-service cards now show the attached workflow and git branch as footer icons, so you can see what's configured without opening Update.
• Performance, reliability, and security improvements across the platform.

Bug Fixes

• Fixed an issue that could interfere with YAML validation and autocomplete when editing workflow files.
• Fixed a crash when editing a Building Block source with discovered actions or workflows.
• Fixed an issue where a duplicate background job could interrupt an in-progress organization workflow sync and trigger a false failure alert.
• Fixed assorted display issues, including Migration Assistant selection checkmarks, the Workspaces page header, and self-service page layout.
• Additional bug fixes across the platform.

New Features

• Notifications are now generally available. You can connect Slack through a proper OAuth integration — an org admin adds it from Settings → Notifications, then anyone subscribes a channel by running /codecargo subscribe — and CodeCargo now sends email too, with purpose-built templates for organization sync, CargoWall, compliance, account, and system alerts. Subscribed channels and inboxes appear alongside your other destinations for per-event routing.
• Migration Assistant (Preview) can now run migrations for you as background agents. Start a batch and CodeCargo works through your jobs automatically — respecting dependencies and concurrency limits, opening pull requests when items are ready for review, and rolling work up to "Migrated" once you merge. When an agent needs a decision, the item shows Needs input and you answer right in chat to resume the run.
• The Service Catalog graph now offers a packed grid layout with multiple layout modes and view toggles, making large dependency graphs easier to read.
• You can now search, filter, and sort the Compliance and Guardrails tables.

Improvements

• CargoWall data can now be filtered by repository permission, so you only see the repositories you have access to.
• Bell notifications now deep-link straight to the relevant page, and the notification bell is now scoped to your active organization.
• CargoWall run detail hyperlinks are back, and check results now deep-link into the Policy Manager.
• Table pagination now persists in the URL, so the back button returns you to the page you were on.
• Standing nudges for outstanding issues now recheck hourly, so alerts clear promptly once you resolve the underlying problem.
• Migration Assistant now catalogs Azure DevOps pipeline tasks during discovery, highlights pipeline files, unifies entity dependencies into a single view, and auto-activates repositories as you move through migration flows.
• Operator detail pages now stay within the Org Settings navigation, and Settings and Profile breadcrumbs are now consistent.
• More reliable handling of organization syncs and GitHub webhooks, including revoked access grants and membership changes.
• Performance, reliability, and security improvements across the platform.

Bug Fixes

• Fixed an issue that could prevent workspace setup from completing on certain repositories.
• Fixed assorted display issues, including dashboard activity avatars, a broken CargoWall link, and light-mode styling.
• Fixed on-demand Service Catalog scans not always updating their status.
• Fixed several issues with the Migration Assistant Add to batch dialog and table layout.
• Commits opened on your behalf now use the GitHub bot identity for authorship.

New Features

• The app has a major visual redesign across both light and dark modes.
• The Org Dashboard has been redesigned, projects now have a dedicated Project Dashboard as their landing page, and a new Workflows page gives you a dedicated view of all workflows across your organization.
• Projects are now first-class navigation containers. Every entity — workflows, repositories, and Building Blocks — has a project-scoped route, so you stay oriented in your project context as you navigate. Project-rooted breadcrumbs show where you are at all times. Switching projects from a detail page takes you to the same view in the new project, with automatic fallback to the list if the entity doesn't exist there. You can also exit project scope at any point to see the organization-wide equivalent of whatever page you're on. Projects also now have a dedicated CargoWall tab with runs, policy assignments, and baselines scoped to that project's repositories.
• You can now configure notification destinations for Slack, webhooks, and email, with subscriptions that control which events trigger notifications, at what severity, and whether they're delivered immediately or in digest batches. Organization admins can set defaults, and individual users can configure personal overrides from their profile.
• CargoWall tag rules let you organize network destinations into labeled groups using hostname patterns (with wildcard support) or IP address ranges, making it easy to filter destinations and apply policies in bulk.

Improvements

• CodeCargo now automatically sends nudges for important events — outstanding compliance issues, CargoWall alerts for new destinations or blocked egress, and repositories not enforcing policies — through your configured notification channels.
• Self-Service Workflows that become unavailable — because the underlying workflow file was moved, deleted, or lost its workflow_dispatch trigger — now show a clear explanation instead of a generic error page.
• Performance, reliability, and security improvements across the platform.

Bug Fixes

• Service Catalog repository scans that get stuck now show a Retry scan button instead of spinning indefinitely. Failed scans display the reason in a tooltip, and manual retries are also available from the repository list actions menu.
• Additional bug fixes across the platform.

New Features

• Migration Assistant (Preview) now has its own management permission, so Architects can run migrations without needing full organization admin access.

Improvements

• Workflows that use workflow_dispatch are now detected correctly and appear in Actions Insights.
• Organization syncs are faster — team membership now syncs only for teams that are actually used for permissions.
• Repository pages now show clearer messaging when you don't have any active repositories yet.
• Performance, reliability, and security improvements across the platform.

Bug Fixes

• Fixed an issue that could leave users stuck during their initial repository sync.

New Features

• You can now create and manage Migration Batches — curated, cross-source collections of migration entities with centralized progress tracking and status management.
• Onboarding now lets you search and select your repositories, with a cap on the initial selection so setup stays fast even for organizations with thousands of repositories.

Improvements

• Migration Assistant (Preview) now opens on the Overview page by default, with Batches available as a peer tab.
• Organization sync is faster and more reliable.
• Improved deployment reliability and tightened platform security.

New Features

• You can now configure DNS search domains in CargoWall policies at the organization, repository, workflow, and job levels, with settings merged across the hierarchy so agents get the complete search list.
• Azure DevOps Pipelines is now available as a Migration Assistant (Preview) source alongside Jenkins — import and migrate Azure DevOps YAML pipelines, Classic Builds, variable groups, service connections, and templates.
• Migration Assistant now groups your source systems by CI platform on a new Overview page, showing progress and job counts in each platform's own vocabulary.

Improvements

• The CargoWall destinations page now loads in seconds instead of minutes, even on large deployments.
• Migration Assistant now uses each source platform's own terminology throughout — Jenkins shows "Controllers" and "Shared Libraries," while Azure DevOps shows "Pipelines" and "Task Groups."
• The "Create the Building Block first" and "Include Building Block repositories" flows now work correctly when jobs map to Building Blocks you're still planning.
• The Migration Mappings editor now correctly saves "Not Mapped" selections, so you can remove existing mappings across all entity types.
• Jenkins multibranch pipeline jobs now default to Jenkinsfile as their source path on import, so pipeline content appears in your workspace.
• The Migration Assistant mapping editor now filters target types by source type, preventing invalid mappings such as a job to a GitHub Secret.
• CargoWall now recognizes additional network destination types, including cloud metadata and GitLab service connections.
• GitHub integration is faster and more reliable when syncing repositories and organization data.

Bug Fixes

• Fixed CargoWall destinations display issues that prevented the page from loading on large deployments.

Improvements

• The CargoWall destinations dashboard now loads instantly, even for organizations with large deployment histories.
• The chat experience across the Editor, Migration Assistant (Preview), and CargoWall is more polished, with copy-message buttons, clearer send states, keyboard hints, and indicators that show when the assistant is thinking.
• Choosing a Building Block Workflow mapping in Migration Assistant now responds the moment you click.
• Slack notifications for unlinked marketplace subscriptions now use a friendly, informational tone, since this is an expected state for GitHub purchases.

Bug Fixes

• Selecting a Building Block Workflow as a target type in Migration Assistant now works on the first click.
• Fixed chat interface layout and positioning issues.
• Fixed light mode display issues in the chat interface.

New Features

• You can now manage CargoWall baselines directly from the Policy Manager and recompute network baselines without leaving the page.
• CargoWall checks now show whether they're in "Enforce" or "Audit" mode right in their names, so policy status is clear at a glance.

Improvements

• CargoWall policies are simpler: assign hosts and sudo permissions directly at the organization, repository, workflow, and job levels — no more policy groups to manage.
• CargoWall check results now include clearer links to view runs and "Add Rule" buttons that pre-fill the form for quick policy updates.
• Repository maintainers can now assign hosts, sudo permissions, and policies at the repository, workflow, and job levels without needing organization admin approval.
• Different AI features can now use different models and providers independently, so tuning one feature won't affect the others.

Bug Fixes

• Fixed CargoWall check dialogs that could close too early when adding rules through deep links.
• Fixed sync failures that could occur with mirrored repositories.
• CargoWall checks now correctly show as passed when you update policy rules to allow a previously denied action.

New Features

• You can now install the CargoWall action across compatible repositories with a single button, making policy enforcement faster to set up.
• Added deterministic guardrails that give you immediate pass/fail compliance results without waiting for AI evaluation.
• AI features now work with OpenAI-compatible models in addition to Anthropic, with automatic model detection for better performance and lower cost.

Improvements

• Workflows that use either secrets: inherit or explicit secret mappings now appear correctly in Actions Insights.
• Faster, more reliable workspace setup and workflow runs.

Bug Fixes

• Fixed guardrail policies that weren't enforcing correctly.

New Features

• CargoWall now adds a PR check that automatically fails when denied network connections are detected, with detailed results linked right from the GitHub PR status.

Improvements

• CargoWall has reached v1.0.0 with improved stability and performance.
• If you're logged in but not yet part of an organization, you'll now see "Continue to CodeCargo" instead of a login button that could send you in a loop.
• Faster page loads, with less redundant data fetching when you open the app.
• Improved the cookie consent banner.
• Upgraded core platform components for better performance and reliability.

New Features

• You can now add GitHub organizations directly from the organization switcher using the + icon, with a streamlined dialog that also appears on your profile's organizations page.
• Free plan limits are now enforced across organizations.
• CargoWall network isolation is now available for self-hosted operator deployments, adding an extra layer of security.

Improvements

• The onboarding and sync flow has a refreshed, consistent layout with CodeCargo branding, bordered cards, and a "Logged in as" profile bar with logout.
• The "Install GitHub App" page now matches the marketing site design for a cohesive experience.
• Navigation is more consistent, with "Return to CodeCargo" buttons used throughout the interface.

Bug Fixes

• Fixed the sudo lockdown setting toggle not working.
• Fixed CargoWall incorrectly showing project workflows for free plan users.
• Fixed redirect loops that could occur when accessing a deleted organization.
• Fixed several small CargoWall interface issues.

New Features

• You can now view public CargoWall run pages for repositories where the CodeCargo app isn't installed, giving visibility into workflow network activity for public repositories.
• CargoWall now automatically activates repositories when workflow jobs are ingested, streamlining onboarding.
• Added a free plan with access to roles and permissions, AI features, projects, and Building Blocks.

Improvements

• The CargoWall interface now has separate Repositories and Workflows views for easier navigation.
• Workflow links in Actions Insights dependency graphs now include hover popovers with extra context.
• Workspace improvements include action tooltips, merged/closed PR indicators, sync completion status, and a Done button after a successful sync.
• Clearer error messages when you don't have access to a repository for a changeset.
• Improved loading performance with shorter transitions between pages.

Bug Fixes

• Fixed GitHub App installation navigation to properly route you through the org sync flow.
• Fixed a CargoWall edit-port dialog layout issue where options could extend off-screen.
• Fixed public CargoWall run pages to avoid redirect loops for users not in the organization.
• Fixed incorrect policy enforcement states.
• Fixed organization re-linking to properly trigger the initial repository sync.
• Security and dependency updates.

New Features

• You can now explore CargoWall baseline policies that automatically calculate the network egress your jobs, workflows, and repositories need.
• Added a guided tour for CargoWall to help new users learn policy management and workflow visualization.
• Organization admins can now enable support access in advanced settings, letting CodeCargo support help with troubleshooting when needed.

Improvements

• The Actions Reference Explorer now supports expand/collapse for version nodes, with searchable aggregation views for navigating large numbers of references.
• Service Catalog author filtering now shows all co-owners when you filter by a specific owner.
• The AI assistant now edits files more reliably and shows clearer diffs of its changes.
• The code editor handles binary files more gracefully, falling back to a directory listing when appropriate.
• Service Catalog deep links now preserve URL parameters and filter states across page reloads.
• The dashboard now loads without content flicker.

Bug Fixes

• Fixed broken organization icons and user avatars.
• Fixed the AI chat task overlay lingering after all tasks finished.
• Fixed the organization selector keeping a border after switching organizations.
• Improved AI chat reliability during long conversations.
• Fixed assorted UI issues, including icon spacing and layout inconsistencies.
• Fixed workflow visualization issues with reusable workflows.

New Features

• You can now use the GitHub CLI directly from the code editor for repository operations and GitHub API interactions without leaving your workspace.
• Added an Architect role that lets users create and manage Building Blocks and projects without full admin permissions.
• You can now choose which repositories to include when syncing a workspace; unchecked ones show "Skip" in the action column.
• Added individual service dependency pages, reachable by clicking Service Catalog nodes and table titles.
• The code editor visualizer now has a "Jump to Code" button that takes you straight to the selected location.

Improvements

• Actions Insights charts no longer show decimal values on the axis for small usage counts.
• The Actions Explorer now shows which actions each workflow uses, with version and job details, right in the dependency graph.
• Workflow dependency graphs now show same-repository reusable workflows as dependents.
• The Actions Explorer now displays workflows from Building Block source repositories on the default branch.
• The Service Catalog now shows only active repositories, avoiding errors when opening content for a deactivated repository.
• Added suggestion cards to Service Catalog empty states when filters return no results.
• The back button now returns you to the right place across different flows.
• Building Block sources now hide management options from users without the right permissions.
• Team org-level roles are now enforced for project access.

Bug Fixes

• Fixed Actions Explorer rows disappearing after clicking a row in split view with active search filters.
• Fixed workflow links in Actions Insights to open the dependencies page, with untracked workflows marked by a question mark.
• Fixed Self-Service Workflow run history links not returning to the previous page.
• Fixed settings page display issues after changing role permissions.
• Fixed an issue that could cause repository syncs to fail.
• Security and dependency updates.

New Features

• You can now view CargoWall statistics and enforcement metrics in a new overview dashboard showing blocked connections, policy violations, and run summaries.
• Added Service Catalog operations to the Dev Tools dialog, so you can scan repositories for services, rescan existing ones, and manage detection from one place.
• You can now view pull request history for a workspace, including each PR's status and repository.
• Added network destination icons across CargoWall views, so you can identify external services at a glance.

Improvements

• Clicking an action name in the Actions Insights overview now opens it in the Actions Explorer instead of GitHub in a new tab.
• The Actions Explorer table now truncates long action and workflow names with tooltips.
• Fullscreen graph mode now uses the full viewport, with improved positioning across all graph views.
• CargoWall workflow visualization now handles matrix and strategy-based jobs.
• Clearer, consistent "Allow/Deny" terminology and improved policy inheritance in CargoWall.
• Repository syncing now runs in the background so onboarding stays responsive, with automatic retries for failed syncs.
• Added Building Block tooltips to repository nodes in the Actions Explorer graph.
• Improved responsive design and color consistency across CargoWall.

Bug Fixes

• Fixed an issue that could cause repository syncs to fail.
• Removed the confusing "Cancel" button that appeared after a workspace sync completed.
• Improved CargoWall network event accuracy.
• Fixed Service Catalog loading states when selecting components in the graph view.
• Fixed an issue that could leave users stuck on the sync screen.
• Fixed pull request failures after workspace merges.
• Fixed markdown table rendering in Building Block documentation.
• Fixed left-navigation highlighting for repository and project subpages.
• Fixed assorted editor UI issues.

New Documentation

• New Actions Insights page covering the overview dashboard, the Actions Explorer and Workflows Explorer, dependency graph visualization, and version pinning practices.
• New CargoWall page covering the overview dashboard, policies, assignments, runs, and workflow visualization.
• New Access Control page covering organization roles, teams, project permissions, and personal access tokens.
• New Operators & Settings page covering self-hosted cargo operators, organization settings, and agent configuration.
• Expanded Self-Service Workflows with run execution details, status states, run history, and filtering.
• Expanded Workspaces with the sync flow, multi-repo PR creation, and workspace management.

New Features

• You can now configure Self-Service Workflows to run as the GitHub App instead of requiring each user's permissions, opening up broader access across your organization.
• Added Actions Insights, with an overview dashboard showing version distribution, top-used actions, and version sprawl across your repositories.
• You can now view dependency graphs and detailed usage information for both actions and workflows in the new Actions and Workflows Explorers.
• Added a CargoWall policy management UI for configuring network policies on workflow jobs.
• Self-Service Workflows now include organization-wide views of all workflows and runs across projects.

Improvements

• You can now keep editing a workspace after opening a pull request, with automatic rebasing to keep your changes in sync.
• The dashboard now greets you with "My Dashboard" for a more personal experience.
• Added a quick "Remediate" action to compliance findings for faster issue resolution.
• Self-Service Workflows now support filtering by steps and show your own runs.
• Workspace usability improvements, including PR indicators in the file tree, better sync behavior, and more management options.
• Added tour journeys and welcome cards to help new users get started.
• Upgraded to Claude Sonnet 4.6 for better AI-powered code suggestions and analysis.

Bug Fixes

• Fixed line numbers reappearing in the code editor after reopening.
• Fixed the right workspace panel not showing on wider screens.
• Fixed breadcrumb navigation not updating on organization self-service pages.
• Fixed authentication issues with CargoWall reporting.
• Fixed workspace step visibility when the workspace panel is open.
• Fixed binary file handling when switching branches.
• Pull request failures now show a clear error message during changeset sync.