- Shipped
- August 25, 2026 at 1:25 AM UTC
- Author
- Kamo
- Commit
- a26b480
SignInCompletionService returned a relative /validate?otk=. That resolves against the host that served the SIGN-IN — login.<apex> — and kamo-login has a /validate page of its own: it spends the one-time key and router.push('/')s back to the sign-in screen. The member never reaches their workspace, and the key is single-use so retrying does not help. It would have hit every sign-in on the platform host, not only members of several organizations, because a member of one is auto-selected through the same completion path. The comment claiming a relative path was right because "the workspace is reached on whichever origin served the sign-in" was simply wrong: the sign-in is kamo-login, the workspace is kamo-internal, and they are different hosts even on the platform. Both completion paths now name the workspace host, derived the way the host-resolved path always did — swap the leading label for "internal" — so all three land in the same place. A host with no leading label yields null and falls back to the relative path, which is correct only for a caller already served from the workspace origin. Found by tracing the flow before turning the picker on; the flag was reverted in a34b8f8 and can go back on now. Tests pin the destination. Verified on a clean clone: 955 tests pass.