Say whether a terminal is working or waiting for its member
Every terminal in the listing now carries `state`: busy, or waiting. It is the one question somebody asks of a window they cannot see, and it is what a minimize...
Pick the model and effort before starting a coder session, once
Send To AI dialog has, and the two are the SAME choice rather than two. Somebody who has settled on Sonnet at High has settled on it. Re-picking in the other p...
Carry the member's model and effort to a coder session
and deliberately not examined here. `coder_flags` on the agent is the one thing that decides what a session runs with — its own comment calls it "the security ...
Let a coder session run at the model and effort the member picked
for a new session and for a resumed one alike, since `--model` and `--effort` are per-session flags either way. They are the ONLY part of the command a caller ...
Name a hexhead after the window it stands for
A hexhead's tooltip read "User w12" — the head id, which is the window id, in a string written for member avatars. A dock of six minimized windows was six ident...
Refuse a sign-in whose host names no organization
Such a host could sign in until now. It fell through to the workspace-choice path and succeeded on membership alone, which made it a door where none of the tena...
A coder terminal wears the name coder gave the conversation
running had long since been titled "Startup fee implementation and Harmony account adjustment". Two separate things were swallowing that name. **The listing.**...
Show the sign-in lockout as a rule that cannot be switched off
SecurityService now applies a progressive sign-in lockout to every organization whether or not a row exists for it — five free attempts, then five seconds, then...
Show the progressive lockout, so a held sign-in explains itself
The server now refuses sign-ins on a ladder — five free attempts, then five seconds, then locks of five, fifteen and thirty minutes, then a permanent block. Wit...
Progressive sign-in lockout, escalating to a permanent IP block
A wrong password now costs something, and the cost climbs. Counted since the subject's last successful sign-in: the first five failures are free, the sixth and ...
Show a member the redirect URI on their own domain
This is the screen the whole change is for. A member setting up Google Workspace with their organization's own OAuth app comes here to find the address to paste...
Serve each org the callback URL on its own domain
This endpoint is where a member finds the string they paste into Google's console, so it is the endpoint that was wrong: it returned only the redirect the org h...
Fall back to the org's own hostname for the Teams redirect
A redirect the org typed into its own registration still wins outright — Microsoft requires the URI replayed on the token exchange to match the authorization by...
Send an org's own hostname as the meeting OAuth redirect
The same rule the mailbox flow now follows, for Zoom and Teams meetings: an organization on its OWN app registered that app against api.<its own domain>, so tha...
Send an org's own hostname as the mailbox OAuth redirect
An organization that brought its own Google or Entra app registered that app in its own account, under its own brand, and is now told on its settings screen to ...
Address an org's OAuth callbacks to its own domain
An OAuth redirect URI is held by a third party. A member pastes it into Google's or Microsoft's console, and from then on the value the service sends on the aut...
User-account details belong to their owner, or to an operator
One rule, in one place, for the three endpoints that write a USER account: the profile's member update, the profile's personal address, and the platform Users t...
A detection rule an org cannot switch off, and the letter it sends
PROGRESSIVE_LOGIN_LOCKOUT joins DetectionRuleType. Every other value on that enum describes something a tenant opts into; this one describes a control SecurityS...
An operator may set a personal address, and ask about the right account
Two changes to the member profile, both about the same confusion: which person a question is being asked about. The personal email card is no longer self-only....
Let a god operator and the System User set somebody's address
The personal address was self-only. It is also the address an administrator has to be able to correct — a member who has lost the mailbox on their account canno...
Budget the last four services to gain a second replica
BillingService, EmailService, KamoLOS and SecurityService now run two pods, each having put its shared-effect scheduled sweeps behind a distributed lease first....
Lock the shared sweeps, and run two pods
Sixteen of SecurityService's seventeen scheduled sweeps have a shared effect and now take a named distributed lease before running. There is no ShedLock anywher...
Lock every cron job that moves money, and run two pods
KamoLOS ran one pod and its ten cron jobs were correct only because of it. There is no ShedLock anywhere on this platform, so a second replica would have run ea...
Lock the shared sweeps, and run two pods
Nine of EmailService's ten scheduled sweeps have a shared effect and now take a named lease before running. The most consequential is CampaignDispatcher: at two...
Lock every money-moving sweep, and run two pods
BillingService ran one pod and its seven scheduled sweeps were correct only because of it. There is no ShedLock anywhere on this platform, so a second replica w...
Budget the six services that just gained a second replica
AIService, KBService, ESigService, VOIPService, DocsService and TranslateService now run two pods, so a drain of either node must evict them one at a time rathe...
Run two pods
The one @Scheduled method here, **************** populates a map held in this pod's own memory. It is supposed to run on every pod, there is nothing shared for ...
Lock the shared sweeps, and run two pods
Every @Scheduled sweep here whose effect is shared now takes a named distributed lease through SingletonTaskRunner before it does anything, so it runs once acro...
Lock the shared sweeps, and run two pods
Every @Scheduled sweep here whose effect is shared now takes a named distributed lease through SingletonTaskRunner before it does anything, so it runs once acro...
Lock the shared sweeps, and run two pods
Every @Scheduled sweep here whose effect is shared now takes a named distributed lease through SingletonTaskRunner before it does anything, so it runs once acro...
Lock the shared sweeps, and run two pods
Every @Scheduled sweep here whose effect is shared now takes a named distributed lease through SingletonTaskRunner before it does anything, so it runs once acro...
Lock the shared sweeps, and run two pods
Every @Scheduled sweep here whose effect is shared now takes a named distributed lease through SingletonTaskRunner before it does anything, so it runs once acro...
coder sessions beside the running shells, and a scrollbar that reaches both ends
## Terminals is now two views of one machine Sub-tabs rather than two top-level tabs, because they are not two destinations: a terminal is a shell that may be ...
List a member's coder sessions, and open one in a terminal
Two endpoints beside the terminal ones, and they follow the same rule those do: the Linux account is resolved from the CALLER'S OWN SESSION and no account name ...
Measure whether a deploy actually costs anyone a request
Every fix in this programme is a claim about what happens during a rollout. Until now those claims were untested: MediaService shipped with strategy Recreate at...
coder sessions on the dev machine, listed and resumable
is here, because the machine is the only thing that knows any of it. ## The session index home, exactly as their terminals are whatever tmux is running. No ta...
Budget every drain, and fail a deploy that regresses rollout safety
PodDisruptionBudgets for the 25 Deployments that now genuinely run two replicas. minAvailable: 1 lets a drain evict one pod and wait for its replacement instead...
Share the indexing consumers, and run two pods
RAGService binds two JetStream durables of its own — rag-note-consumer and rag-kb-consumer — and a durable push consumer with no deliver group admits exactly ON...
Run two pods
replicas 1 -> 2. This service runs no @Scheduled work and binds no exclusive NATS durable, so a second pod duplicates nothing — it is stateless request serving,...
Run two pods
replicas 1 -> 2. This service runs no @Scheduled work and binds no exclusive NATS durable, so a second pod duplicates nothing — it is stateless request serving,...
Run two pods
replicas 1 -> 2. This service runs no @Scheduled work and binds no exclusive NATS durable, so a second pod duplicates nothing — it is stateless request serving,...
Answer a readiness probe, and run two pods
This deployment had no readiness probe, so a pod counted as Ready the instant its container process started. With maxUnavailable 0 Kubernetes reads that as "the...
Drain on SIGTERM, and run two pods
Next handles SIGTERM with a bare process.exit(143), so every deploy severed whatever this pod had in flight — a form post, a server action, a streamed RSC paylo...
Run two pods
replicas 1 -> 2. Server-side state lives in Redis, not in the pod, and there is no scheduled work to duplicate, so a second replica changes nothing except that ...
Drain on SIGTERM, answer a readiness probe, and run two pods
Next handles SIGTERM with a bare process.exit(143), so every deploy severed whatever this pod had in flight — a form post, a server action, a streamed RSC paylo...
Drain on SIGTERM, answer a readiness probe, and run two pods
Next handles SIGTERM with a bare process.exit(143), so every deploy severed whatever this pod had in flight — a form post, a server action, a streamed RSC paylo...
Drain on SIGTERM, and answer a readiness probe
Next handles SIGTERM with a bare process.exit(143), so every deploy severed whatever this pod had in flight — a form post, a server action, a streamed RSC paylo...
A distributed lock, so a scheduled sweep can survive a second replica
There is no ShedLock anywhere on this platform and there never has been. All 97 @Scheduled sweeps across 18 services are correct only because each service runs ...
Paint every logo on the sign-up site in the org's overlay colour
The org chooses "Register Site Logo Overlay" in kamo-internal beside the home page and loading screen overlays. One setting for the whole site: every step of th...
Paint every logo on the sign-in site in the org's overlay colour
The org chooses "Login Site Logo Overlay" in kamo-internal beside the home page and loading screen overlays. One setting for the whole site: the sign-in form, t...
Like what you see shipping?
All of it arrives in your workspace on its own. Start on the free plan and read this page again in a month.