Forward the Hosted Computer agent path, and only that path
/api/hosted-computers/agent/** -> ComputeService. A Hosted Computer's network policy denies the cluster entirely — no database, no service, not even cluster DN...
One query for an organization's whole reporting graph
findMemberAndManagerIds returns every (memberId, managerId) edge in one organization, for Hosted Computers' ACCESS_SUBORDINATE_COMPUTERS right — which reaches t...
Shared-mailbox **************** need a management right
**************** on /api/email/shared-mailboxes needed only a session — any authenticated member could create a shared mailbox, delete one, or grant themselves ...
Apply the per-party/issued/trashed checks everywhere byte-adjacent paths need them
**************** applied the issued-document check but not the per-party (ACCOUNT_MEMBER_VAULT/LOAN) or trashed-row checks that /download, /stream and the sibli...
Verify RingCentral webhooks before trusting them
RingCentral's inbound call/SMS webhooks were processed with zero verification: WebhookController routed telephony/message-store events straight into ***********...
An OAuth state token is a server-side record, not a blob the browser hands back
/api/email/oauth/callback and **************** are public and sessionless (the provider redirects the browser here with no Kamo session), so `state` was the onl...
A document share now actually reaches its recipient, and edit is gated
**************** matched an ImgShare by ImgShare.member — the SHARER, who created the row so they can list what THEY shared (getSharesByImage) — instead of ImgS...
A social inbox's quote of an older message names its author with their card
The quote now takes its author from the server (@kamo/chat-core's quote.senderMemberId), which withholds a social contact's id since mediaservice ceee73e — a co...
The card shows the member id to those who manage members
HR and support read a member's id off a tooltip on the HR rosters, which the member card replaced (the tooltip sat where the card opens). The card's details now...
The member card spec, as built
Corrects what changed on the way — the card's layer is 1305 (over MUI modals), useHoverCard stayed where it was, the header wears the desktop wallpaper, calenda...
A reply quoting a contact names the contact, not the connection owner
A social contact has no member row, so everything they send is stored under the connection owner's member. The history read already names such a row as the cont...
Re-check clearance when rendering a binder's document items
BinderItem pins the Img row it was built from at assembly time. BinderRenderer.renderItem handed that Img straight to **************** with no check at all for ...
A From override must be an address the caller may send as
POST /api/email/send took request.getFromAddress() straight into the header From and the SMTP envelope sender **************** -> EmailSmtpService.send, and the...
Bound and stream the byte-heavy imaging paths
/download loaded the whole file into a byte[] through ImageService.downloadDocument before serving it; /bulk-download built the whole ZIP (or merged PDF) as one...
Cap upload size and concurrent conversions on the unauthenticated pipeline endpoints
POST /convert-vector and WS /ws/pipeline take no auth (see this commit's companion report for why that is not fixed here) and, until now, read a caller's whole ...
The SOCIAL read gate refused every social session, not just cross-org ones
Regression in f7b2bd5, live on kamowsmedia. canReadSession (MediaController, copied into SessionFacesController and ChatSessionMembersController) admitted a mem...
Stop trusting any https://api.<anything> as a Docs WOPI host
k8s/Docs-deployment.yaml's aliasgroup1 was 'https://api\..*'. Docs's alias matcher (RegexUtil::getValue, std::regex_match) requires only that the WHOLE candidat...
The app, three rights, tier/state enums and the entities
ServiceType.HOSTED_COMPUTERS at id 37, TESTING rather than COMPLETED. The stage is carrying weight here rather than describing progress: AppCatalogService resol...
Don't load content_json to build the public tree index, and stop loading it twice
buildPublicTreeIndex builds a small structural index (parent/child, slug path, ancestors) from every public article in the org, but it was loading full KbArticl...
A media presigned URL was not scoped to the caller's org
GET /api/kb/media/{mediaId}/url looked the row up by uid alone (KbMediaService.getPresignedUrl -> **************** unlike every other media read here (presignAl...
WebRTC signaling, webinar management and Canva schedules stop trusting the caller's say-so
Three more of the same shape. - WebRTCSignalingController relayed **************** straight to **************** using only the payload's own sessionGuid, w...
Gate chat attachments, voicemails and call recordings by more than org+clearance
MediaService/telephony store chat attachments (CHAT_ATTACHMENT) and voicemail/call recordings (VM_RECORDING, CALL_RECORDING) at ACCESS_LEVEL 0. Every generic im...
A reply to an older message names its author with their card too
Moves @kamo/chat-core to 0.1.19, whose reply quote carries senderMemberId: the server's parentSenderMemberId when it sent one (null for a web-chat visitor, whos...
The member card can be reached from the keyboard
The card is portalled to the end of <body>, so in document order it follows the whole page: a member who opened it from a name with Enter or focus and pressed T...
Per-org VM islands, suspend-to-disk, and a white-labeled golden image
A member's own Linux computer, running as a KubeVirt VM in its organization's namespace and opened from the browser. Separate from desktop/ in every way that ma...
No job overlaps itself, and no HTTP call can hang a worker forever
Quartz here runs 10 in-memory worker threads on one replica. 17 of the 24 jobs had no @DisallowConcurrentExecution, so a run that overran its interval started a...
The lead-intake counters join the ledgers the daemon folds and recounts
The intake endpoints' received / imported counters are now a ledger (securityservice create_lead_intake_ledger.sql, applied 2026-09-22): a trigger on lead_intak...
Intake endpoints show exact received/imported counts from the intake ledger
The Lead Intake settings list showed total_received / total_processed / last_received_at straight off the endpoint row, where they were bumped once per payload ...
Intake endpoint counters come from a ledger and stop losing updates
**************** / total_processed / last_received_at were bumped on the endpoint row itself: once per inbound payload (~5/s during a farm import) and once per ...
Refuse to spawn STDIO for an unlisted config, and refuse to connect an SSE/HTTP one to the cluster network
Defense in depth alongside the AIService commit that closes AiMcpController's missing right checks and STDIO refusal at the source: this service is the one that...
MCP configs need MANAGE_AI_SETTINGS, provider/MCP urls can't reach the cluster, quota policies are enforced
Three independent findings, fixed together because the first two share files and a class. 1. AiMcpController had zero right checks on create/update/delete/test...
Session reads, ticket mutations and public keys stop trusting the caller's say-so
Four related holes, all the same shape: a request carried an authenticated member, and that was treated as enough. - **************** SessionFacesController.fa...
Let a caller resolve a MediaObjImg by the Img id alone
DocsService's imaging endpoints (download/stream/list/delete) know an Img's id but have no reason to hold the MediaObj it was attached to — until they need to h...
Fold the lead ledgers every 30 s and recount them nightly; the job trigger needs the cluster secret
The lead ledgers (securityservice create_lead_ledgers.sql, applied 2026-09-22) replace COUNT(*) over a 796k-lead pool and over lead_credits with maintained tota...
Manage-Credits and Leads-Available read the lead ledgers once instead of counting per row
/leads/credits (GET /api/security/credits/manage) counted the lead pool once per allotment row — ~8 s apiece against one org's 796k-lead pool — then once more g...
Leads available and credit balances read a ledger instead of counting rows
"Leads available" was COUNT(*) over the assignable pool, and one org's pool holds ~796k leads: ~7.8 s per (market, product) count and ~11 s for the grouped one ...
Bind every WOPI endpoint to the document its token was minted for
CheckFileInfo was the only WOPI endpoint that both compared the access token's document against the request path and re-checked live access; GetFile, PutFile, P...
The card on reply quotes, hand histories, ticket events and bug-thread authors
The last four surfaces that named a member with nothing to open, now that MediaService sends the ids (fa25989): - Reply quotes: the quoted author's name opens t...
The session path searches the caller's own org, never the request body
RagSearchController read orgId/memberId/memberType from the JSON body on every path, including requests authenticated by a *** session rather than X-Internal-Au...
Show JustCall callback URL before credentials exist
Generates a phone-server UUID when JustCall is selected and shows the webhook URL immediately. That same id is sent on create so the URL the member pasted into ...
Pre-assign JustCall phone server id for callback URL
The new-phone form generates a UUID before create so the member can paste the webhook callback URL into JustCall while requesting API credentials. Create accept...
Retrigger build after JustCall i18n dictionary update
The prior image build failed check-i18n-keys; the English strings now live in kamo-translation-dictionary.
Serve JustCall callback URL for phone server setup
Adds GET /api/voip/setup so the settings UI can show the exact per-instance webhook URL without hardcoding the deployment host.
Show JustCall webhook callback URL on new-phone setup
Surfaces the per-instance callback URL on the JustCall new-phone and overview tabs so members know what to give JustCall when configuring APIs and webhooks. The...
Give the postbuild compression probe more time to start the server.
Docker builds can still be settling after prerender workers finish; extend upstream and probe waits and surface child stderr when startup fails.
Lower the floating logo by 3px.
Reduce NAV_LOGO_RISE from 10 to 7 so the mark sits slightly lower while keeping shared chrome math in sync.
Stop double-counting banner height on secondary pages.
Body already reserves the preview strip; main padding now clears only the nav row and logo overhang so inner pages do not stack a second chrome band.
Move the floating logo outside the header containing block.
backdrop-filter on the header trapped position:fixed children so top and margin offsets never moved the mark; pin it to the viewport instead.
Move the floating logo up with marginTop instead of top calc.
The dynamic top calc was not shifting the mark; mirror nav-row flex centring and pull it up 10px with marginTop.
Pin the floating logo top edge for a reliable vertical offset.
Stop relying on translateY(-50%), which was not moving the rendered mark, and place the logo 10px above nav centre explicitly.
Like what you see shipping?
All of it arrives in your workspace on its own. Start on the free plan and read this page again in a month.