Gate the nine Service Work endpoints on a right
They shipped checking only that the caller had a session, so any member of an org could read and mutate every work order in it regardless of role. ASSIGN_SERVI...
Drop the nine Service Work endpoints from the unguarded baseline
They are gated as of e6e1d02, so their baseline entries no longer match an unguarded endpoint and **************** fails on the stale lines. Requiring the remov...
Stop the customer **************** rights reading every tenant's rows
Every endpoint that accepted a VIEW_OWN_* right as an OR-alternative loaded its record by primary key alone, never checking who it belonged to: getSubscription,...
The org reference belongs in proxy.ts, not a second middleware file
Next 16 replaced middleware with proxy, and this repo already had proxy.ts — so adding middleware.ts alongside it failed the build outright: "Both middleware fi...
Mirror the Service Work rights into TypeScript
VIEW_SERVICE_WORK, VIEW_OWN_SERVICE_WORK, MANAGE_SERVICE_WORK, ASSIGN_SERVICE_WORK and COMPLETE_SERVICE_WORK land at ids 268-272, not the 265-269 the plan assum...
Bulk export, C-CDA, and one accounting that covers every channel
BULK EXPORT. Kickoff answers 202 with a Content-Location and no body; polling answers 202 while running and 200 with the manifest when done. Returning a friendl...
Theme assets come from a host that resolves
The sign-in screen paints an organization's branding from theme.<its own domain>. That domain may not resolve: an org can exist and be signed into before its DN...
One tab, one tenant — stop resolving the org from the shared cookie
Open KamoCRM in one tab and another organization in a second, refresh the first, and it rendered as the second. Close that tab, refresh again, and it came back....
Serve a tenant's assets from a host that resolves, and stop deleting its backgrounds
Two faults found while working out why a new org opened with no logo and no colours. THEME DELIVERY. Assets were requested from theme.<the org's own domain>. A...
Give Service Work its first five rights
ServiceType.SERVICE(28) shipped with zero rights, so its nine endpoints were gated only by whether the caller had a session. Ids start at 268 rather than the p...
Bulk FHIR export and C-CDA, and the rights that gate them
Two things a practice cannot operate without, and neither is a bigger version of reading a chart. BULK EXPORT (clinical/bulk). The FHIR Bulk Data model: a job,...
Notification-spine follow-ups, triaged
Deferred items from the 33-task plan, all raised by review and all non-blocking. The whole-branch review's four must-fix findings were fixed and are not listed....
Stop standing workload from flashing the browser tab forever
TabAttention fed navGrandTotal into a 1100ms title flasher. Four of its eight addends are queue depth that never reaches zero when a member reads something: sup...
Wire markSmsRead/markAiRead/social mark-read to their windows
Final review found markSmsRead and markAiRead had zero callers, and SocialChatWindow never called markAsRead/beginViewing at all — three of five conversation su...
Gate the voicemail nav count on VIEW_VOICEMAIL
**************** handed any authenticated member holding a MemberVoipConfig row the instance-wide unread-voicemail count with no rights check at all, even thoug...
Route getChatSessions' unread ambiguity through OwnAuthorshipAmbiguity
MediaController.getChatSessions hand-rolled the pre-extraction version of the "was this written by somebody else?" rule (rowVisitor != null && callerId ********...
Ship Geist as WOFF2
Both faces are preloaded on every route, so the format is paid on every first visit. 134,132 B of WOFF became 112,252 B of WOFF2 — 21,880 B, a 16% cut. That is...
Take the softphone measurements instead of waiting for them
38 calls in the entire history of PHONE_CALL_LOG, 26 in the last 30 days. The drop-then-redial fingerprint finds 4 pairs, all provisioning test calls from April...
Give the web media path a TURN relay
The browser SIP path built its peer connection with one hardcoded public STUN /api/voip/turn/credentials for as long as that endpoint has existed — TurnControll...
Plan Service Work's first rights and the commerce permission gap
Corrects two spec assumptions against real code: no RoleRightType uses **************** (all 36 commerce rights use POS, and the editors filter on exact equalit...
Pin down bucketOf and unreadForRow against a repeat
This file just shipped four silent defects in one review round — an AI row that fell through to the wrong bucket, a title that was never read off the row, a buc...
A retail market should not download the mortgage tabs
The market settings page imported all 24 tabs statically, so every market shipped every tab — a retail market carried the seven mortgage tabs, the four personal...
Show the first wallpaper without waiting for the slowest
The slideshow preloaded every wallpaper behind a single Promise.all, so nothing painted until the LAST image in the set had settled. On a tenant with a dozen ba...
Stop the app tree's rails putting a scrollbar on the viewport
/settings/account?tab=apps scrolled the whole window, down into empty space below the shell, while the apps column it was supposedly scrolling had its own scrol...
Show one call once in a rollup, and stop 500ing on unworked leads
Two fixes the account rollup made visible. A phone number can be a contact point on more than one owner at the same time, and two leads on one account sharing ...
Count DISTINCT events across a rollup's owners
A phone number can be a contact point on more than one owner at once, and two leads on one account sharing one is the ORDINARY case — they are commonly the same...
Mark the line window executed
All eight tasks shipped across four repos, with the four deliberate deviations recorded — most importantly that Task 6's call surface was written fresh rather t...
Gate the line window per member, and show which mode you are in
The rollout control. Default off, opt-in per member from Phone Settings, nested under the VOIP switch because it means nothing for a member with no line. One h...
Every context and hook now reads user-info through the coalescer
Seven independent /api/user-info calls fired on a cold authenticated load, each one asking for the member id a sibling was already asking for at the same moment...
Read and write the line-window gate
GET surfaces lineWindowEnabled; PUT accepts it as a nullable Boolean so that absent means "not mentioned" and preserves the stored value. Every existing caller ...
Map LINE_WINDOW_ENABLED on MemberVoipConfig
The per-member gate for the dedicated softphone line window. Version pin stays at 1.6.0 — adding a field needs no bump, and a split pin would break CI for every...
DDL for the per-member line-window gate
Adds **************** defaulting to false. A column rather than a feature flag because there is no flag system here and MemberCapabilities is a closed, fail-cl...
One refresh timer for the whole app, not one per useUserInfo()
useUserInfo has 194 call sites, roughly a dozen of them mounted for the entire session — the nav, the shell providers, the launchpad. Each instance armed its ow...
Keep the decision record — 18 rulings and what each costs if wrong
The plan records what shipped; this records why it differs from the plan. Three rulings were themselves corrected by a later review (the Stripe write count went...
Server-render the authenticated app, and fix the fallback org that 500s
MemberListProvider returned null until its mount effect ran, and it sits above NavTop AND {children} — so that one line kept the ENTIRE authenticated applicatio...
An AI sub-tab in the Interaction Center
AI sessions live in AIService and are not MediaSessions, so this bucket gets its own loader in front of the /api/media/sessions/chat fetch the other four share,...
The dedicated line window
The call now lives in a window a refresh of the workspace cannot touch. SoftphoneProvider becomes owner-or-follower. Only the owner REGISTERs and opens the STO...
Close the webhook idempotency gap BL0's final review found
Finding 1 (Critical): a losing claim on a redelivered Stripe event only proved a row existed, not that the prior attempt finished. A claimed row left behind by ...
A communications tab that rolls up the account's leads
The level most people mean when they say "this customer's calls". Several leads commonly hang off one account precisely because they are the same person enquiri...
Map the account timeline beside the account's other things
Everything belonging to an account already lives under **************** — its leads, orders, members, notes and history. Communications was the one at a plural ...
The KamoDesktop link is single-use now
The comment claimed a reload re-submits ?data= and restores the session. It no longer does: the link is spent the moment the tab opens it, so it is worthless af...
Bounce a bare visit to the Kamo login, and end the session on tab close
Closing the KamoDesktop tab left a live session sitting on the machine. Guacamole keeps its auth token in localStorage (GUAC_AUTH), which survives closing the t...
Make the KamoDesktop SSO link redeemable exactly once
The link is delivered as a URL, so it lands in browser history and in the reopen-closed-tab list, where it long outlives the session it was minted for. Until no...
The account rollup must not widen what a reader may see
The account timeline I added last commit was a way around the per-lead read gate. A member refused a lead's messages on the page that names the lead could open ...
Carry the assignee into the account rollup, over a LEFT join
Reading a lead's communications is gated on who it is assigned to. A rollup that returned uids alone could not apply that gate, so the account timeline built on...
Thump the first real message, not just the second
shouldThump(undefined, n) meant "first render" — but a spawned head's unread starts genuinely undefined, and applyUnreadToHeads's own undefined-vs-0 guard never...
Line ownership, the bridge, and the no-yank handover rule
Three pure modules with no consumers yet, so this ships inert. lineOwnership elects exactly one SIP registrar per browser via Web Locks. That is mandatory here...
Stop the plan instructing the money-path bug it was corrected on
Task 8 Step 4 still told the reader to key update/cancel/detach/del with "the current intent in the key". That is the Critical defect the final review reversed:...
The tab title counts everything waiting, not just chat
The tab strip has room for one number, and 'chat and support only' stopped being what a member is waiting on once SMS, AI, missed calls and unreviewed reports e...
Like what you see shipping?
All of it arrives in your workspace on its own. Start on the free plan and read this page again in a month.