What's new in klickops

Apps & projects

• Blocked calls to your own app suggest its direct address.

  When something in a project calls one of its apps by the public domain and is blocked, the Network view shows the app's in-project address to use instead of allowing the detour.

Databases & backups

• Database backups warn before their bucket fills up.

  A full backup bucket stops backups and, later, the database. Data & backups now warns once a bucket with a size limit is 70% full, and backup destinations set up from now on store compressed snapshots.

Web app & notifications

• The unused admin-path allow list is gone from the install.

  It guarded an address nothing serves any more. Platform administration stays in the operator console, behind a superuser check.

Apps & projects

• Invalid autoscaling limits are refused up front.

  A minimum of 0, a maximum below the minimum or a CPU target outside 1-100 now fails with a message naming the field instead of leaving a half-saved setting.

• A migration command set when creating an app is kept.

  It used to be dropped without a warning. It now runs before every later version change, and before the first build of an app deployed from a repository.

• Apps mounting configuration as files start on first deploy.

  A secret or config file mounted when the app is deployed no longer leaves it waiting for storage that never arrives, and storage marked for file backups is backed up from the first deploy.

Builds & deploys

• Repos with only a Containerfile build.

  A repository whose build file is named Containerfile or dockerfile was offered as buildable, then failed with "no Dockerfile". It now builds.

• Previews never touch apps or certificates that aren't theirs.

  An app named like a preview keeps its branch, an uploaded certificate named like one is kept, and deploying from a repository never reuses a connection to a different URL.

• Pull request previews no longer run your database migrations.

  A preview skips the app's release command, so an unreviewed pull request never changes your live data. The command runs once the change is merged and deployed.

• A push builds apps that follow any branch.

  An app set to build from a branch other than the repository's default now builds and deploys on every push to that branch, not only after "Build now".

• Repositories connected with an SSH key work again.

  Loading branches and commits failed for every repository using a deploy key. When a repository cannot be reached, the message now says why: a rejected key or token, a wrong URL or branch, or an unreachable server.

• Static sites deployed from a repository start again.

  The deploy screen shows the detected build and start commands as suggestions and only uses the ones you type, so a Vite or React site is served from its built files instead of a guessed command.

Databases & backups

• Backup schedules set outside the web app run as asked.

  A daily database backup set from klops or an AI assistant ran every hour instead. Existing schedules are corrected automatically, and a custom schedule in the web app now takes the usual five fields.

• A restored database keeps backing up.

  It archives to the same bucket as the database it came from, counts toward your plan's database limit, and a restore to a taken name or a future time is refused with a clear message.

Account & organization

• Error messages say organization, not team.

  Permission, "already exists" and "not found" messages for organizations and their channels now use the same word as the rest of the product.

Web app & notifications

• App lists show the address of apps routed through Domains.

  The project overview and the Apps list left the address blank for any app whose domain was added under Domains. They now show its first domain, and "+N" when it has more.

• A new app's address is called live once HTTPS works.

  The deploy screen used to offer the https link as soon as the app was healthy, while its certificate was still being issued. It now says it is securing the address and shows the link when the certificate is ready.

Command line & AI tools

• AI tools set ports, volumes and health checks on apps.

  When an AI assistant deploys or changes an app through the klickops tools, it can now also set project secrets and configuration, env from domains, and image updates, as the web app can.

Apps & projects

• CPU alerts fire for apps without a CPU limit.

  Apps on paid plans have no CPU limit, so the CPU alert could never fire for them. It now compares usage with the app's CPU request when there is no limit.

Command line & AI tools

• AI tools can keep a certificate's CA chain.

  Replacing an uploaded certificate through the klickops tools removed its CA chain, because the tools could not send one. They can now.

Billing & plans

• Changing a bucket's size keeps to your plan's limit.

  Creating a bucket already capped its size at your plan's limit; changing the size afterwards did not.

Account & organization

• Account settings stay reachable without an organization.

  After deleting your last organization, the setup screen links to your account settings, so you can delete your account instead of creating a new organization.

Web app & notifications

• The bucket size dialog offers only what your plan allows.

  On a plan that caps a bucket, it no longer offers "No limit" or sizes past the cap, and it says what the cap is.

• Notification filters refuse event names that never arrive.

  A channel's event filter matches exact names, so a typo or a wildcard stored fine and silenced the channel. Such a name is now refused, with the list of valid ones.

Account & organization

• You can delete your own account.

  Settings, Account lists what goes (sign-in methods, tokens, memberships) and what your organizations keep, then signs you out everywhere. An organization's only owner is told which one to delete or hand over first.

Command line & AI tools

• Scheduled jobs work fully from the command line.

  klops scheduled-jobs runs lists each run with its status and duration, logs shows the newest run unless you name one, and jobs can read project secrets and keep their image updated, from klops and your AI tools.

Account & organization

• API tokens stay with your organization.

  A token keeps working after the person who created it leaves or deletes their account. The token list shows who created each one, so you can review them when someone leaves.

Web app & notifications

• Security fixes say what was at risk.

  Release notes list each closed hole under Security with its severity, what was at risk, what was checked for misuse and what, if anything, you need to do.

Web app & notifications

• Alerts on a scheduled job's run open that job.

  When a run kept crashing, whether started by hand or on schedule, the project overview linked its alert to an app named after the run, which showed "App not found".

Command line & AI tools

• Manage scheduled jobs from the command line, and read past logs.

  klops scheduled-jobs now creates, changes and deletes scheduled jobs, sets and removes their config values and secrets, and shows the logs of a single run. klops logs <app> --since 6h reads an app's earlier logs, including those of pods that no longer exist. The AI tools (MCP) gained the same log reads and a single call that gathers a project's recent events with an app's settings, pods and recommendations.

• Read your support requests from the terminal and your AI assistant.

  klops support list shows the requests you filed and klops support get prints one with its whole conversation; your AI assistant can read them through the MCP server too. Asking for help and replying still happen in the web interface, where your screenshots and the page you were on come along.

Command line & AI tools

• Retired names are gone from the command line and the AI tools.

  klops no longer accepts --team; use --org. The AI tools klickops_patch_scaling, klickops_list_builds, klickops_get_build and klickops_trigger_build are removed; klickops_set_scaling, klickops_list_app_builds, klickops_get_app_build and klickops_trigger_app_build do the same. klops config set-team, klops use-team and klops quota apply-team-defaults still work but now warn that they will be removed: use the org names instead.

• Two calls that never did what they said are gone from klops and the AI tools.

  klops apps networking set and klickops_set_app_networking could not change a domain and stored settings nothing used: change a domain under Domains or with klops domains apply. klickops_create_restore skipped everything the project still had, so a restore over a running project brought nothing back: klickops_restore_project_recovery restores the project the way the Backups page does, optionally only named apps and volumes. klops apps networking get now reports the class and certificate issuer of the app's actual domain.

Billing & plans

• Clearer billing charts.

  Every meter on the Billing page has its own colour, tuned for light and dark mode and easier to tell apart with colour blindness. Build usage no longer shares the grey of backups and the month-end forecast.

• Your billing timeline shows corrections made on your behalf.

  When usage is taken off your bill or your included credit is changed for you, the Statements timeline now says what changed and by how much, instead of your figures moving with no explanation.

Web app & notifications

• Cleaner buttons, borders and loading spinners.

  Icon and text buttons no longer draw a grey box around themselves, warnings and highlighted cards show their intended border colour, and loading spinners visibly turn.

• Every form field has a working label.

  Clicking a field's label now focuses the field, and screen readers announce what each field is for, in every form from deploying an app and creating a database to domains, scheduled jobs, certificates and organization settings. Choice buttons such as the builder, backup frequency or weekday pickers announce which option is selected.

• Icon buttons are announced by screen readers.

  Buttons that show only an icon, such as removing a secret, resetting the terminal or jumping to the newest log line, now say what they do and to what. Copy buttons that show a value, like a domain or a certificate fingerprint, now say they copy it.

• The same words everywhere.

  Database cards, status bars, restart messages and firewall policies now talk about copies and projects, the way app cards already did, instead of switching to infrastructure terms from one screen to the next.

• Log views and terminals have a fair-use limit.

  Each person can keep up to 20 log, live view or terminal sessions open at once, and a log view starts from at most the last 5,000 lines.

• Support answers show up in your notification channels.

  When your platform administrator replies to one of your organization's support requests, your Slack, Teams, webhook and email channels now say so, next to deploys and alerts; the answer itself stays in the conversation for the person who asked. Feature requests from the Roadmap page now reach the platform team the moment you send them.

• Release notes arrive once a week.

  Instead of a mail for every release, you get one summary of the previous week's releases.

• What's new waits for you instead of popping up.

  A new release is announced by the What's new button at the top: it names what shipped for a few seconds, then shows how many releases you have not read until you open them. The notes now open on everything since your last visit, not only the newest release, with a timeline of every release beside them. A tab left open through an update says "Update ready", and one click reloads it straight into what changed.

Apps & projects

• An app's internal address now works when you copy it.

  The address other apps use to reach an app, shown on its Overview and Networking tabs, pointed at a location that does not exist. Both tabs now show the address the app actually answers on.

• A cloned project's apps use the clone's own domain addresses.

  An app setting bound to a domain's address kept the original project's address after a clone, and later changes to the clone's domain never reached it. It now names the clone's domain and follows it; a setting bound to a domain the clone does not copy is removed.

• Apps in a cloned project keep their settings.

  A cloned app lost its volumes, configuration keys, database connections, Git repository, update checks and icon, and its next edit could remove environment variables it still used. The copy now keeps all of it; only the results of past update checks start fresh. An app cloned into another organization leaves its Git repository behind, because the repository belongs to the original organization, and the clone says so.

• Saving the same setting twice at once no longer fails one of the saves.

  Two saves of an app's configuration, a volume, a firewall rule or a project's capacity that arrived together could answer one of them with an error; both now succeed and the later one wins. Cloning a project now also lists what could not be copied apart from what it leaves out on purpose, and klops projects clone fails when the clone is incomplete.

• Apps and scheduled jobs can use spare CPU again.

  Automatic sizing could cap a mostly idle app at a fraction of a core, so a long import or export crawled. On paid plans CPU is no longer capped; memory still is. An existing app picks this up the next time you restart it or save a change.

• "Open in Grafana" is back on the Metrics tab.

  Where your platform administrator connected Grafana, the Metrics tab of an app, a database and a bucket had lost its button. It opens the matching dashboard again, for the same time range.

Builds & deploys

• Builds deploy only the app they were started for.

  Build now, an app's first build and a watched repository's new commit now build just that app, where they also rebuilt every other app on the same repository and branch. Two projects with an app of the same name each get their own build, a build that finishes late never replaces a newer version that is already running, and an app set to only record new commits is no longer deployed by a push.

• A build that cannot start says so.

  Build now answers with an error instead of reporting a build that never began, a push is retried by your Git host, and a watched repository tries the commit again on its next check. Your plan's limit on builds running at once now holds for every build, and a build is stopped after 45 minutes or about 20 GB of disk, so a stuck build no longer holds your organization's build slot.

• Connecting GitLab works again.

  Signing in with GitLab to pick projects always came back with an "invalid state" error, so no GitLab project could be connected that way.

• Detecting a very large repository fails fast with a clear message.

  The deploy wizard now says the repository is too large to inspect and suggests setting the subpath to the app's directory, which inspects only that directory. Before, one large repository could slow detection, branch and commit listing down for everyone. Apps that watch their repository for changes also no longer wait behind one unreachable repository.

• Webhooks you set up by hand now work.

  When a repository's webhook could not be registered automatically (an SSH key, or a token without webhook permission), the secret the webhook needs was never shown, so every push was refused and the repository said no events had arrived. Connecting now shows the secret once, next to the webhook URL, with a copy button, and klops repos add prints it. For a repository connected earlier, open it and rotate the webhook secret to get a new one. The AI tools never see it.

• Rotating a webhook secret keeps pushes building.

  When klickops set up the webhook on GitHub or GitLab itself, rotating its secret now updates that webhook too, so there is nothing to paste. Before, the provider kept the old secret and every push after the rotation was refused. If the provider does not accept the change, the new secret is shown once to paste by hand.

• Pushes build what they should, even across an update.

  Pushing or deleting a tag, or deleting a branch, no longer starts a build. A push that arrived while the platform was restarting is now built once it is back, a preview whose pull request was closed in that window is removed within the hour, and a preview that could not be removed is retried when the delivery is sent again.

Databases & backups

• Volumes in a cloned project come up.

  Cloning a project with its volumes created volumes that never became ready, so the apps using them stayed stuck starting. A cloned volume is now created fresh and empty, as the clone promises, and its apps start.

• Changing a database's version always runs the upgrade checks.

  Setting a version while editing a database from the CLI or an AI assistant now refuses an older version, and a new major PostgreSQL version waits for a completed backup from the last 24 hours, exactly like the Upgrade action. Asking the Upgrade action for an older version now says it was refused instead of reporting an upgrade that never happened.

• Installing a database extension and applying a recommended fix report the right result.

  Installing an extension through the API or the MCP server without naming a database answered with an error although the extension was installed, and applying a recommended fix that was already in place showed an error instead of the app's current recommendations. Error messages from connected repositories and bucket storage were also hardened.

• Deleting a project removes its backups.

  The backup schedule kept running after a project was deleted, and its recovery points stayed in storage. Both now go with the project. Backup schedules set through the CLI or the API run at most once an hour, and recovery points are kept for at most 365 days.

• Backups pages no longer offer Restore on a recovery point without data.

  Recovery points that appeared while the page was open were always shown as holding volume data, even when they held none. A restore now also stops the apps and scheduled jobs that are not running at that moment, so none of them starts using a volume while it is being restored.

Command line & AI tools

• The AI tools say what a call will do.

  Deleting an app, a database or a volume now spells out what goes with it, calls that replace a whole list or cannot be undone are flagged so your editor can ask you first, database queries are marked as read-only, and tools only your platform administrator may use are no longer offered. Changing a project's quota without that permission now tells you who can reset it, instead of pointing at a request form that no longer exists.

• Adding a sidecar or init container through the AI tools works.

  The tool (MCP) never passed the container's name on, so every call failed; it now takes the app and the container name separately, and a command and arguments too. The usage tool can also report a period other than the current month.

• Fewer AI tool calls fail on a field klickops does not accept.

  Through the AI tools (MCP), adding a pull credential always failed, and so did setting an organization's SSO groups, rotating a repository's webhook secret, marking a build registry as insecure, queueing a rebuild with new build settings, replacing a bucket's lifecycle rules, skipping database updates, editing a database's access rules, and scaling an app or cloning a project with options klickops never had. The tools now offer only what klickops accepts, in the shape it expects.

• The klops command line asks before it destroys something.

  Commands that delete, revoke, restore over or roll back something now ask for a yes on a terminal, and name what they are about to remove and in which project. Scripts and CI have no one to answer, so they need --yes (or -y) and otherwise stop with exit code 2 before anything changes. Applying a domain from a file also reports why an update was refused, instead of claiming the domain already exists.

• Switching contexts with klops works.

  klops config use-context, current-context, list-contexts, set-org and set-project could not be reached, because the commands for configuration values had the same name. Those are now klops configmaps list, set and delete; the old klops config list, set and delete keep working for two more releases and print a note naming the new command.

Billing & plans

• Bigger apps deploy after you leave the free plan.

  Projects created on the free plan kept its limit of 1 vCPU and 1 GB per container after an upgrade or a promo code, so a larger app was refused. Upgrading now lifts that limit on existing projects too, and a promo code redeemed after your projects exist raises their capacity right away.

• Running out of project room now says what actually helps.

  A database that could not start, or a disk that would not fit, told you to raise the project quota or request more room, which you could not do yourself. It now points at a bigger plan, or, on a self-hosted install, at your platform administrator. The API token dialog also no longer claims an admin token can manage members: no token can manage members or other tokens.

• Projects get the full memory their plan includes.

  A project could run out of memory capacity at about half of what its plan includes. Your plan's CPU and memory now count only what your apps reserve.

• The plan page no longer says a promo raised your limits when it didn't.

  If your plan already includes higher limits than your promo code, the page used to claim the code had raised them to its lower tier. It now only mentions the promo when it actually gives you more room.

• Signing up with a promo code is clearer.

  A valid code on the website now takes you straight to sign-in, and error messages there follow the page language. When a code can't be used, you're told why: it expired, it's used up, it isn't valid, or it only covers another email domain. If the code is for a different address than the one your GitHub or Microsoft account shares, you're asked for that address and sent a sign-in code. After you create your organization, the credit is only reported as added once it has actually landed.

• Running out of project room no longer offers plans on a self-hosted install.

  The dialog said your plan was at its limit and pointed at plans that do not exist there. It now says the project is out of room, leaves raising it to your platform administrator, and only closes.

Account & organization

• Removing someone from your organization takes effect right away.

  A removed member could keep opening the organization's projects for up to half a minute. Their access now ends on their next click.

• Your new organization shows up right away.

  After naming your organization on first sign-up, the organization switcher showed a bare address with nothing to pick until you reloaded the page. It now shows your organization's name immediately.

• You can edit and delete a project you created outside any organization again.

  On a self-hosted install, whoever created a project with no organization was refused as if they were not its creator when they tried to rename or delete it.

Web app & notifications

• The status page reports a platform outage while it happens.

  When the platform's infrastructure stopped answering, project pages failed while the status page still said everything was operational. It now shows the platform as degraded until the outage ends.

Account & organization

• Choose which emails you get.

  Settings now lists getting-started tips, release notes and incident mail with a switch each, and names the mails that always arrive because you have to act on them or should know: invitations, security notices, billing and support. Every optional mail also carries a one-click link to turn that kind off.

• Nobody joins an organization without accepting.

  Adding a member now always sends an invitation, and the person joins only after they accept it under Invitations in the sidebar, or on the page they land on when they belong to no organization yet. Signing in never adds you anywhere by itself, and someone on an organization's "Allowed to join" list now gets an invitation too instead of being added. Inviting answers the same way for every address, so it no longer tells you who already has an account.

• Leave an organization yourself.

  Members now have Leave organization under Your membership on the Members page. You lose access to its projects right away and need a new invitation to come back. An organization's only owner can't leave until someone else is an owner too.

Web app & notifications

• Getting-started emails after you sign up.

  A welcome with the three steps to a running app, a reminder two days later if nothing is deployed yet, the next things most teams set up once your first app is live, and a note in the first week about deploying from Git, the CLI and your editor. Four mails at most, each sent once, and only while they still apply.

• You hear about a broken app even without a notification channel.

  The owners and admins of an organization are emailed when an app keeps crashing or cannot start, when a domain still has no certificate an hour after you added it, or when a backup fails. At most one mail per incident per day, with a link to the app, domain or backup. Turn it off for the whole organization under Settings, or just for yourself.

• A short email when a new version of klickops is out.

  It carries the same release notes the what's-new dialog shows, once per release, and never a digest of things you already saw.

Apps & projects

• On the hosted platform, projects leave through Export.

  GitOps mode (externally managed) is no longer offered here, and deleting a project always removes everything in it. To take a project elsewhere, export its manifests from project settings. A project already in GitOps mode can still be switched back to normal editing.

Builds & deploys

• Builds from your repository run in an isolated sandbox.

  Every build now runs in its own sandbox, walled off from other customers' builds and apps.

Command line & AI tools

• Approving a CLI sign-in shows who is asking.

  After you type the code from your terminal, the approval page shows the IP address, the device and when the sign-in started, and lets you deny it. The code is no longer filled in from the link, and a denied sign-in stops the CLI right away with a clear message.

Account & organization

• Deleting an organization now asks you to remove its projects first.

  An organization that still has projects can't be deleted; delete or move them, then delete the organization. The message tells you how many are left.

Web app & notifications

• Emails read like letters, not like alerts.

  Every mail addressed to a person, from an invitation to the monthly statement, now arrives with a plain subject, a short message and one button that takes you where the mail is about. The machine-readable prefix and the trailer of internal details are gone from these, and stay only on the mails your organization routes to a channel. Replies reach a person instead of bouncing.

• The interface uses its own typeface everywhere.

  Resource names, codes, logs and the terminal no longer fall back to a typewriter-style font on computers that don't have the klickops fonts installed.

Apps & projects

• A cloned project gets its own addresses.

  Your own domains are not copied and can be added to the clone again.

• Firewall rules for a domain name can only allow traffic.

  A deny rule for a domain could end up blocking every destination on its ports instead of just that domain. The firewall editor no longer offers a domain on a deny rule and saving one is refused. To block a domain, leave it out of your allow rules.

• Platform integrations in the Networking tab now only show the ones your platform administrator made available.

  An app that had one switched on that is no longer offered has it switched off automatically, which restarts that app once.

• A project always stays in an organization.

  Removing a project from its organization is no longer possible on the hosted platform; to change who owns a project, move it to another organization instead.

• Existing sign-in protected domains pick up the latest hardening automatically.

  A domain protected by single sign-on used to keep its old protection settings until someone saved it again. It now gets the current ones when the platform is updated, and nothing else about the domain changes.

Billing & plans

• A suspended or restricted organization can no longer create projects.

  Creating or copying a project into an organization that is on hold for billing now stops with the same message as every other change, until the hold is lifted.

Account & organization

• Only the owner finishes setting up an organization.

  Naming a new organization on first sign-in is now the owner's step and happens once; an invited admin or member goes straight to the dashboard. After that, the owner renames the organization in its settings, as before.

Web app & notifications

• Support requests have fair-use limits.

  You can have up to ten open requests at once, send up to twenty messages a day on each, and attach up to 20 MB of screenshots a day. Over a limit, the message says which one and when it frees up. Messages without screenshots are never held back by the screenshot limit.

Databases & backups

• Creating a bucket works again.

  The Add a bucket form refused every attempt with a technical message, so buckets, and database backups that need one, could not be set up.

• New buckets start within your plan.

  On plans with a per-bucket size limit, Add a bucket opened with a size above that limit, so it showed a limit warning and a disabled Create button before you had changed anything. The size now starts at your plan's limit.

Account & organization

• Links into an organization use that organization.

  Opening a page by its address, reloading it, or following a bookmark could load details, such as plan limits, from the organization you had open before.

Command line & AI tools

• klops apps get tells you when a release command is holding a deploy back, and how to retry or clear it.
• YAML output spells fields the way the API does, so a value read with -o yaml matches one read with -o json.

Apps & projects

• Images that name their user now start.

  Ending a Dockerfile with USER app is the recommended way to build a container, but klickops added a rule Kubernetes cannot check against a name, and every such image sat in Pending forever. Those images now run as the user they declare, and keep the rest of their hardening. klops apps deploy|update --run-as-user sets the user ID explicitly when you want to.

• Shared file storage works again.

  An app with a volume on a shared (RWX) storage class crashed the moment it started, with a kernel error nobody could act on: that storage cannot be combined with the extra process isolation klickops applies. klickops now notices the combination and drops the isolation instead of shipping an app that cannot start.

• Giving an app a hostname through the wrong door no longer looks like it worked.

  Setting a hostname under an app's networking settings reported success, kept the value, and created nothing. It now points you at Domains, and reading the setting back reports the app's real hostname.

Builds & deploys

• Rebuilding at a shortened commit works.

  The build list shows commits shortened, and pasting one back in queued a build that failed minutes later deep in the build log. It is now resolved for you, or refused immediately with a clear reason.

Command line & AI tools

• The MCP server stops asking you to sign in again.

  It refreshed its session without saving the result, so it eventually failed with "unauthorized" while the command line kept working. It now saves what it refreshes, and says the session expired instead of looking like a permissions problem.

Apps & projects

• Leftover evicted copies no longer make a healthy app look broken.

  When a copy is moved off an overloaded machine, the old one can linger in the cluster for weeks. klickops counted every one of them as a live problem, so an app that was running fine showed "Needs attention", a row of red copy badges, and inflated restart counts. Those leftovers are now treated as history: they no longer affect status, restarts, or the copies list. The eviction itself stays visible under Events.

• A failed release command no longer blocks the screen for good.

  The "Deploy blocked" banner stayed up after you removed the release command, and after the version it complained about had gone live anyway. In that state Retry deploy did nothing. The banner now clears itself as soon as there is nothing left to retry, and Retry deploy starts a fresh run when there is.

• View log opens the failed release run.

  The button used to switch tabs and stop there. It now jumps to the release command card and opens the output of the failed run without a second click.

Apps & projects

• Domains with guest links can be edited again.

  Saving such a domain failed with a message about a setting that is not allowed, and would have removed its guest links. Saving works and the links stay.

• Sign-in protection holds up under load.

  The check behind protected apps could slowly run out of memory, and a burst of sign-ins could be mistaken for "not signed in".

• Setup:

  the public address of the sign-in gateway now defaults to the platform address when it is not set separately, as documented.

Builds & deploys

• Deploying from a repository links the repository you just connected

  , even when klickops had to adjust its name.

Billing & plans

• Promo codes land where they belong.

  A code typed on the landing page is applied once you own an organization, never to one you were merely invited to, and codes cannot be redeemed through API tokens. Campaign figures for your platform administrator no longer count expired credit as spent.

Apps & projects

• A public page for every blueprint.

  Each one has a shareable page listing what it installs, so you can send a colleague the link before they have an account.

• Projects wear their blueprint's logo.

  A project started from a blueprint shows that app's mark in the project switcher, its header and the project list.

Databases & backups

• The overview shows your data again.

  In a project holding a database and a bucket with the same name, the data section on the overview stayed empty.

• Instances and activity now attach to the right service.

  Two services sharing a name in one project could show each other's instances and recent activity.

• Adding a pull credential now asks who it is for.

  klops registries create requires either --org <organization> or an explicit --global. Leaving the scope out used to share the credential with every organization on the cluster without saying so, and the confirmation it printed did not mention the scope at all, so the mistake was invisible. Scripts that relied on the old default need the flag added.

• A command that does not exist now fails.

  Mistyping a command used to print the help text and report success, so a typo in a script did nothing at all and the script carried on as if it had worked. Unknown commands now exit with an error. Anything in your automation that was quietly doing nothing will start failing, which is the point, but it is worth a look before you upgrade.

• You can see which settings a database type accepts.

  klops databases available lists the tuning options for each type, with an example for each, so asking for more storage than the size tier gives you no longer means guessing. The size tiers are deliberately conservative; --param storage=20Gi is how you go bigger.

• Login users on a database can be listed.

  They could be created and deleted but not listed, so a script had no way to check its own work.

• Importing from a database that is not on the internet has an answer.

  Most databases worth moving sit on a private network, and the import refused them for good security reasons without saying what to do instead. It now shows you the one-line command that streams the data in.

• Apps that use a private image now start.

  A pull credential could be added and listed correctly while every app using it failed to start, because nothing connected the credential to the app. klickops now picks the credential that matches the image's registry automatically, and klops apps deploy --registry names one explicitly when you have several.

• Database usernames can contain underscores again.

  Names like orders_app were rejected, and so was every other separator, so a database user carried over from another system had to be renamed to make it in.

• The AI tools stopped rejecting valid requests.

  Creating a database, updating an app or running a query through the AI tools could fail with "request body is malformed" on input that was completely correct. Requests that are genuinely wrong now say which field is the problem.

• The AI tools notice when you sign in.

  Signing in after the tools were already running left them unauthorized for the rest of the session, with no hint that reconnecting would fix it. They now pick up a new sign-in on their own.

• A missing detail in an AI tool call says what is missing.

  Leaving out something the tool needed produced an internal error that read like the tool itself was broken.

• Creating a database confirms what it accepted.

  It used to print nothing at all, which was indistinguishable from having done nothing.

• Queries can reach any database on the server.

  klops db query and klops db shell take --database, so a database created alongside a user is reachable without going around klickops.

• The help for choosing a database type points at a command that exists.

  It named one that was renamed some time ago, and the suggestion was garbled on the way out.

• You can ask for help from inside the product.

  "Get help" opens a composer that stays out of your way: it tucks into the corner while you go and fetch the error text or take a screenshot, and your draft is still there when you come back. A request remembers what you were looking at, so you don't have to describe it. The same menu lists every request you have made and the replies on it, and points you at the handbook page for what you were doing.

• Creating a project works when you belong to more than one organization.

  Being invited into someone else's organization was enough to make every project creation fail outright. The organization you pick is now the one the project is created in.

• Credit from a promo code lands in your own organization.

  If you were a member of someone else's organization as well as your own, parked credit could be redeemed into theirs. It now goes to an organization you own, and the organization shown by default stops reshuffling between page loads.

• A small database now fits alongside an app on the free plan.

  The plan advertises room for both, but a small PostgreSQL claimed the project's entire allowance on its own, so the database was accepted and then never started. A small database now takes half the allowance, leaving the other half for an app. Medium and large are unchanged.

• A database or bucket held back by the project's limits says so.

  When there was not enough room left in a project, a new managed service sat at "Provisioning" forever with no explanation anywhere. It now tells you the limit was reached and what to do about it.

• A coupon code can be typed in on the sign-in screen.

  Scanning the printed link still works, but the code is no longer the only way in: there is now a field for it above the sign-in options, and it shows what the code grants before you sign in. Checking a code never uses it up.

• Connecting a repository no longer traps you on someone else's account.

  If a colleague had already set up access on a shared account, that was the only account offered. You can now install on your own account or a different organization from anywhere in the connect flow, and the "Manage on GitHub" link points at the right place for organization-owned setups.

• Repository names containing dots can be connected.

  A name like example.info silently left the Connect button disabled. Dots and other unsupported characters are now folded to hyphens as you type, and the rule is spelled out inline when the result still isn't usable.

• klickops has a new face.

  The gondola replaces the old mark and runs through the whole product: the logo, the sign-in screen, the loading state and the browser tab. The interface moved to a lighter, paper-like surface at the same time.

• Usage is now broken down per workload.

  Every metered hour is attributed to the app, database, bucket or scheduled job that caused it, so you can see what each thing costs instead of one number for the whole project. Anything that cannot be placed under a workload is still shown, rather than quietly folded into the total.

• One usage explorer instead of six cards.

  Usage has its own page, separate from Billing, where you pick a period and drill from your organization down to a project and then to a single workload, charting any level.

• Asking to spend more goes to a person.

  Upgrading to a paid plan or adding credit is now a request that a platform administrator confirms once the payment has arrived. You can see your pending requests and withdraw one you no longer want.

• Configuration is one surface with two lenses.

  Plain values and sensitive values live on one page instead of two, with a clear separation between them, and the page no longer asks the same question twice.

• Rows answer the question you opened the page for.

  An app row shows whether it is actually doing any work, a domain shows which of its three stages it has reached, a database offers its connection string, and a disk can be resized without leaving the list.

• Backups separate what is protected from whether it ran

  , so a schedule that exists but has not run yet no longer reads like a successful backup.

• API tokens were rewritten.

  Creating, reviewing and revoking tokens is clearer, and a newly created token can be copied straight from the screen.

• The roadmap has a home in the navigation

  , with a tidier board.

• Navigation follows one rule: the sidebar owns where you are, the top bar owns what you are looking at.

  One scope control replaces the two stacked switchers, and every destination now appears in exactly one place. Quotas moved out of Settings, and the three separate registry screens became a single Registries page.

• A project opens on its workloads

  rather than a wall of cards.

• The network view shows the whole conversation at once

  instead of one side at a time.

• Scheduled jobs show when they run

  in plain language.

• Empty states teach instead of apologising

  , and pages got their short introductions back.

• Capacity is now part of your plan.

  Asking for a quota increase separately is gone: if you need more, the answer is a larger plan, which makes the limit you get predictable from the plan you chose.

• An hour of usage could be counted twice.

  While the per-workload breakdown was being rolled out, the hour in progress could be recorded in both the old and the new shape, so that hour's reserved capacity and cost were doubled. It was visible as an unattributed line carrying almost the same figures as the workloads beside it. Affected hours have been corrected, and an hour is now written once no matter how often it is measured. The same fix stops a project being billed for a workload that has since been deleted.

• Promo credit that went missing during signup now arrives on its own.

  A code accepted while your organization was being created could end up not applied; it is now picked up on the next page load rather than needing support.

• Statements showed the entire billing page

  instead of just your statements, and spending details sometimes disappeared from the usage page.

• Hardened how klickops determines a caller's network address

  , which is used for rate limiting and recorded against promo redemptions and terms acceptances. Self-hosted operators behind more than one proxy can set KLICKOPS_TRUSTED_PROXY_HOPS; the default suits the shipped setup.

• Build containers can be pinned to a sandboxed runtime

  with KLICKOPS_BUILDS_RUNTIME_CLASS, for operators who want builds further isolated from the rest of the cluster.

• A long tail of interface corrections: the active tab is no longer clipped by its own scroller, breadcrumbs size and compress consistently, dropdowns share one spacing scale, the organization switcher stays put on account pages, and status now appears once rather than twice on an empty overview.

• Getting started is one step.

  Name your organization, tick the terms, done — the multi-step wizard and the separate terms popup are gone. A promo code from our website is applied automatically and shows as a credit badge, so you never have to type it twice. Inviting your team moved to where it belongs: the Members page, once there is something to show them.

• Billing opens with two numbers.

  This month's spend against your included credit, and your balance — with promo credit folded in and its expiry date right next to it. The charts and the per-meter, per-project, and per-workload breakdowns are one click away under "Spending details", and the Plan tab is now purely about choosing a plan.

• One billing message at a time.

  The most urgent thing about your account shows as a single banner instead of a stack of warnings.

• "Upgrade your plan" now takes you to the plans.

  Every upgrade link in the product lands directly on the plan ladder instead of the cost overview.

• Small amounts show exact figures.

  Costs under one franc display with four decimals on the billing page, matching your PDF invoices instead of rounding to 0.00.

• Quota decisions come with a reason.

  When your quota request is approved or denied, the email now includes the reviewer's note.

• Late-settled statements bill the right plan.

  A month that was settled after you changed plans could be priced at the new plan instead of the one you were on. Statements now freeze with the plan that was actually in effect.

• Promo codes behave at the edges.

  Entering the same code twice no longer shows an error after the credit was already granted, a code scoped to your company address now tells you to sign in with that address instead of a generic message, and an organization suspended for billing can redeem a code to get its workloads running again.

• Resuming a suspended organization is reliable.

  A sequence of suspend-and-restrict actions could leave apps stopped even after access was restored; they now come back up as expected.

• Hardened the closed-beta signup gate and month-close billing.

• Apps are hardened automatically.

  klickops now reads your container image and applies the right protection on its own: images that run as a normal user are fully locked down, and images that need root are isolated so root inside the container has no power on the platform (on clusters that support it). The deploy wizard no longer asks security questions — it simply shows what will apply, and overrides live on the app's Advanced tab.

• Health checks are on by default.

  New apps get a connection check on their port with zero setup, so a crashed app is restarted automatically. Switch to an HTTP path check in the same control if you have a health endpoint.

• Scaling has its own tab

  on the app page — it was previously tucked away at the bottom of Metrics.

• The Network page is now the one place for connectivity.

  Rules, live traffic, and creating new rules all live together; allowing a blocked connection drafts the rule right there, and old Firewall links redirect. Creating and editing a rule now use the same editor at the same size.

• One name per thing.

  Buckets are "Buckets" everywhere (previously also "Object Storage"), running app instances are "copies" throughout, Secrets and plain config appear as one "Configuration" concept, and the Alerts page is titled Alerts.

• Tidier app pages.

  Tabs for features your cluster doesn't offer (backups without a backup engine, firewall without a network layer) no longer render as dead ends, and crowded tab strips now show when there's more to scroll.

• Roadmap and What's new moved into your user menu

  , freeing sidebar space. A dot on your avatar tells you when release notes are waiting.

• Empty pages now point you to the next step instead of dead-ending, and each secret key has a page showing where it's used, one click from Configuration.

• Scaling an app to 0 now actually stops it.

  Previously the value silently became 1 while the UI confirmed success. Stopping all copies now asks first, and the save button says what it will do.

• Deleting a database or bucket requires typing its name

  , matching app and volume deletion — it destroys data and deserved the same guard.

• Removing a firewall rule now asks for confirmation and reports errors instead of failing silently.
• Database tuning that requires a restart now says so and asks — no more silent restarts after applying tuning values.
• Many pages no longer show up blank or claim "nothing here yet" when loading actually failed; they now say what went wrong and offer a retry.
• Revoking a guest link or a pending invitation asks first — both cut off access irreversibly.
• The "view all events" button on the app overview works again.

• Preview environments announce themselves to your app.

  Every preview now runs with KLICKOPS_ENVIRONMENT=preview and KLICKOPS_PREVIEW_PR set, so your app can skip schedulers, outgoing email, and other side effects when it's running as a pull-request preview instead of production.

• A built-in API reference.

  The full REST API is now documented on its own reference page, generated from the same definitions the product runs on.

• Switching between organizations or projects no longer briefly shows data from the one you just left.
• The command palette's jump-to-tab entries now always match the tabs the page actually has.
• Quota request emails pointed reviewers at a page that no longer exists.

• The roadmap is easier to find.

  It now sits in the sidebar right next to What's new, in the command palette, and as a link from the release-notes dialog.

• Invitation and access emails now name the sign-in provider and make clear that the invited address must be the email on that account.
• Emails consistently say "organization" (a few footers still said "team").

• The what's-new dialog opened far too narrow; it now has room to breathe.

• See what's new after every update.

  klickops now tells you what changed: a short summary pops up once after each platform update, and the full release history is always one click away in the sidebar.

• A roadmap you can steer.

  The new Roadmap page shows what we're considering, planning, and building. Vote for what matters to you, request features you're missing, and watch shipped items close the loop.

• Email notifications can now be delivered through Resend as an alternative to an SMTP relay.

• Images built from source in the built-in registry are now stored per organization, so two organizations can build same-named apps without conflicts.

• Name your organization at signup.

  Onboarding now asks for your organization's name instead of auto-creating one for you.

• Platform administrators can remove an organization together with everything in it.

• Membership changes (new role, new org) apply immediately, no sign-out and back in needed.
• The members list role dropdown works reliably again, and access refreshes when you return to the tab.
• Single sign-on in front of your own apps now resolves access by the app's hostname, fixing false "access denied" responses for some projects.

• Hardened the GitHub connection flow: authorization redirects can no longer be influenced by request headers, and every OAuth callback is strictly validated.
• Connecting a repository when the GitHub App was already installed now lands you back in the right place.
• A clear warning is shown when a GitHub App is configured without OAuth credentials.