Carry the member's model and effort to a coder session
and deliberately not examined here. `coder_flags` on the agent is the one thing that decides what a session runs with — its own comment calls it "the security ...
Let a coder session run at the model and effort the member picked
for a new session and for a resumed one alike, since `--model` and `--effort` are per-session flags either way. They are the ONLY part of the command a caller ...
Name a hexhead after the window it stands for
A hexhead's tooltip read "User w12" — the head id, which is the window id, in a string written for member avatars. A dock of six minimized windows was six ident...
Point the integrations proxy at the path EmailService serves
The Manage Sources dialog forwarded to /api/settings/integrations, which EmailService does not map — its controller is at **************** Every request from th...
Drop the /api/settings forward, which pointed at nothing
EmailService serves the sync-integration controller at **************** not /api/settings/integrations — so that forward reached a path the service does not map...
Say why a mailbox sync failed, and what key is on file
Two silences that made a working Google Workspace connection read as broken. The mailbox sync caught the provider's rejection and dropped it. Google refuses th...
Stop a provider config save from discarding another form's fields
Every config panel posts only the fields it owns, flat, alongside the provider type -- the Google Workspace panel sends nothing but serviceAccountJson. PUT /api...
Route /api/contacts, /api/calendar and /api/settings to EmailService
KamoMobile's contacts and calendar screens 404'd on every request. Neither path was routed at the api host, so nothing reached EmailService and the service logg...
Send To AI must not open a tab in sage's editor
A Send-to-AI hand-off is hosted in a Remote Terminal the operator is already watching in the console. On top of that, the agent also handed the session to VS Co...
Refuse a sign-in whose host names no organization
Such a host could sign in until now. It fell through to the workspace-choice path and succeeded on membership alone, which made it a door where none of the tena...
Restarting the agent must not kill every member's shells
mid-work today, and would have taken every other member's terminals with it. systemd's default is KillMode=control-group: on stop or restart it SIGKILLs every ...
A coder terminal wears the name coder gave the conversation
running had long since been titled "Startup fee implementation and Harmony account adjustment". Two separate things were swallowing that name. **The listing.**...
Show the sign-in lockout as a rule that cannot be switched off
SecurityService now applies a progressive sign-in lockout to every organization whether or not a row exists for it — five free attempts, then five seconds, then...
Name the constructor Spring should use, or the context will not start
My own regression, and the second context-startup break on this service today: Error creating bean with name 'terminalTicketRegistry': Failed to inst...
Let Spring pick the terminal registry's constructor
SecurityService has been crash-looping on every new pod since the shared handoff store landed: "No default constructor found" for TerminalTicketRegistry, which ...
Show the progressive lockout, so a held sign-in explains itself
The server now refuses sign-ins on a ladder — five free attempts, then five seconds, then locks of five, fifteen and thirty minutes, then a permanent block. Wit...
Rebuild — the previous run never produced an image
f0edd01 was pushed with the rest of the fleet-wide rollout-safety work and is the only one of that batch whose image never appeared: the deployment is still run...
Progressive sign-in lockout, escalating to a permanent IP block
A wrong password now costs something, and the cost climbs. Counted since the subject's last successful sign-in: the first five failures are free, the sixth and ...
Tell the server which organization the resend is for
The verification screen's Resend button has been reporting success and sending nothing for every organization except the platform's own. `host` already rides i...
Resend the verification e-mail under the organization the member is actually on
Nobody at a white-labelled organization has been able to ask for a second verification e-mail. The screen said the letter was on its way every time, and no lett...
Say out loud when a registrant is left with no verification token
The register endpoint caught a failed verification send and logged warn(e.getMessage()). For the fault it kept hitting — EmailService raising a Yugabyte read re...
Stop a Yugabyte read restart from silently killing a transactional send
EmailTemplateService.sendToUser is the endpoint behind every service-to-service transactional email on the platform, and it was @Transactional over three reads:...
Share terminal tickets across pods, or half of them are refused
Opening a terminal fails about half the time with "The server refused the terminal connection. Your ticket may have expired", and the log says: Terminal ha...
Show a member the redirect URI on their own domain
This is the screen the whole change is for. A member setting up Google Workspace with their organization's own OAuth app comes here to find the address to paste...
Stop a password reset asking the operator to type ERASE
ConfirmationDialog described every action as a deletion. Left to itself it picked the type-to-confirm word at random from DELETE, REMOVE, DESTROY and ERASE, dre...
Serve each org the callback URL on its own domain
This endpoint is where a member finds the string they paste into Google's console, so it is the endpoint that was wrong: it returned only the redirect the org h...
Fall back to the org's own hostname for the Teams redirect
A redirect the org typed into its own registration still wins outright — Microsoft requires the URI replayed on the token exchange to match the authorization by...
Send an org's own hostname as the meeting OAuth redirect
The same rule the mailbox flow now follows, for Zoom and Teams meetings: an organization on its OWN app registered that app against api.<its own domain>, so tha...
Send an org's own hostname as the mailbox OAuth redirect
An organization that brought its own Google or Entra app registered that app in its own account, under its own brand, and is now told on its settings screen to ...
Address an org's OAuth callbacks to its own domain
An OAuth redirect URI is held by a third party. A member pastes it into Google's or Microsoft's console, and from then on the value the service sends on the aut...
User-account details belong to their owner, or to an operator
One rule, in one place, for the three endpoints that write a USER account: the profile's member update, the profile's personal address, and the platform Users t...
A detection rule an org cannot switch off, and the letter it sends
PROGRESSIVE_LOGIN_LOCKOUT joins DetectionRuleType. Every other value on that enum describes something a tenant opts into; this one describes a control SecurityS...
An operator may set a personal address, and ask about the right account
Two changes to the member profile, both about the same confusion: which person a question is being asked about. The personal email card is no longer self-only....
Answer "who owns this account" about the member, not the reader
The member payload now carries accountOwnedByThisOrg. The console used to work this out for itself by comparing the READER's securityOrgId to the current organi...
Restore the @Lazy that stops the context depending on itself
Every SecurityService pod built since 4bd25e7 fails to start: The dependencies of some of the beans in the application context form a cycle: ┌──->──┐ ...
The rollout-safety settings had to go where CI actually reads them
kamo-register is the only service on the platform whose CI generates its Deployment inline, with a heredoc, instead of applying k8s/deployment.yaml. Two consequ...
Stop redirecting kubelet's probe into a port nothing serves
This service exists to redirect, and a redirect is exactly what a health check must never get. kubelet probes the pod IP, so the Host header is something like ...
Share the delivery consumer, so a second pod is not refused
Caught in production the moment services went to two replicas on 2026-09-04. Every pod carrying this class logged, once, at boot: [Webhook] Failed to subscri...
The operator write must answer in the same shape it was asked in
The console adopts this response as its new state. It returned the address and `canChange` but not `mode` or `isSelf`, so after a successful operator write `mod...
A god may fix their own address from any workspace
The tenancy rule refused a god-eligible caller on their OWN record whenever their session was in an organization other than the one that owns the account. That ...
Let a god operator and the System User set somebody's address
The personal address was self-only. It is also the address an administrator has to be able to correct — a member who has lost the mailbox on their account canno...
A budget must not be able to deadlock a node drain
Switches every PodDisruptionBudget from minAvailable: 1 to maxUnavailable: 1. On a two-replica Deployment the two are identical — one pod evictable at a time. ...
Make a System User session terminal, so entry cannot chain
The System User is god by construction, so every session minted for it carries GD and offers break glass. That is fine only because the identity does not compos...
Budget the last four services to gain a second replica
BillingService, EmailService, KamoLOS and SecurityService now run two pods, each having put its shared-effect scheduled sweeps behind a distributed lease first....
Lock the shared sweeps, and run two pods
Sixteen of SecurityService's seventeen scheduled sweeps have a shared effect and now take a named distributed lease before running. There is no ShedLock anywher...
Lock every cron job that moves money, and run two pods
KamoLOS ran one pod and its ten cron jobs were correct only because of it. There is no ShedLock anywhere on this platform, so a second replica would have run ea...
Stop asking for logos that were never uploaded
/network built each org's logo URL from its alias and requested it for every org on the page. An org whose theme folder was never provisioned has no img/logo.sv...
Say whether an org HAS a logo instead of guessing a URL for one
Every "which networks can I reach" row carried logoUrl and logoSimpleUrl derived from the org's alias alone, for any org whose alias was path-safe — which is al...
Lock the shared sweeps, and run two pods
Nine of EmailService's ten scheduled sweeps have a shared effect and now take a named lease before running. The most consequential is CampaignDispatcher: at two...
Lock every money-moving sweep, and run two pods
BillingService ran one pod and its seven scheduled sweeps were correct only because of it. There is no ShedLock anywhere on this platform, so a second replica w...
Like what you see shipping?
All of it arrives in your workspace on its own. Start on the free plan and read this page again in a month.