Serve an org's branding to a screen with no session
Login, registration and the meeting lobby paint an organization's colours before any session exists. They knew which one from the hostname, which is exactly wha...
Restore CRLF on the two theme files
Both files are uniformly CRLF and my previous commit rewrote them through Python in text mode, which reflowed every line: Theme.tsx showed 237 changed lines and...
Paint the branding of the org in the tab, not the host
getThemePath() derived the theme base from window.location.hostname. That answered the right question while every organization had a hostname of its own — and f...
Clear the cloned session in the enter-as tab
Entering an org opens a tab with window.open('', '_blank') and points it at /validate. That was cross-origin until now, so nothing was shared. It is same-origin...
Ratchet that a blocked capability with no app has a call-site guard
Splitting an app from the capability inside it is what lets a clinic hold a phone system and a video room at all, but it moves the enforcement burden. PhiModule...
Refuse meeting recording for a tenant that handles PHI
The capability split made ServiceType.MEET permitted — a live conference on self-hosted Meet never leaves the cluster — while MEETING_RECORDING stayed blocked, ...
The blocked capability now outranks the right, and god mode
PhiPlaybackAuthorizer gated PHI call playback on VIEW_CALL_LOGS. That was the whole check because ServiceType.VOIP mapped to the blocked VOIP_RECORDING module, ...
Regenerate the ServiceType mirrors after the stage correction
The five pre-existing commerce verticals are COMPLETED, EHR is PLANNING.
The five pre-existing verticals must ship available
Shipping all six children PLANNING was wrong for five of them. RETAIL, RENTAL, SERVICE, SUBSCRIPTION and PROCUREMENT are not new functionality — they are what C...
Read the session from the tab, not the shared cookie jar
46 client modules read the *** id out of document.cookie and sent it as X-***-Token. sessionStorage is per-TAB; a cookie is per-ORIGIN. While every organization...
Refuse an alias that names more than one organization
byAlias took LIMIT 1 over orgs.alias, which has no uniqueness constraint: the create path checks it per security provider and PUT /org/{id} does not check it at...
The scheduled-support presenter picker offered nobody
The Presenters tab dropdown was empty for every organization, and always had been. GET **************** answers with { teamMembers, total }; the tab read data.m...
Serve the app tree, and fix the unguarded auto-enable
FeatureController now sends parent/children/isParent on every serialized app so the client can render children nested under their parent. Served rather than mir...
Mirror the six commerce child apps, and stop the mirrors drifting
Both TS mirrors are now GENERATED from ServiceType.java rather than hand-maintained. They had drifted badly from Java and from each other: stale "RAG integratio...
Task 7 needed no new migration, and top-level orgs must be included
The app-tree backfill turned out to already exist as **************** restricted to isGated() verticals. Dropping that restriction is the whole change. Records...
One scrollbar, three times as wide, down every conversation
The bar beside the messages was 8px in the member chat and SMS, 6px in support tickets and social, and in the AI chat it was nothing at all: that list declared ...
Resolve the domain on /org/current server-side
internal.kamocrm.com failed to render with "Invalid organization data: missing 'id' or 'domain'". Organization has no `domain` field -- it has a `domains` colle...
Give /api/org/current the domain the client requires
internal.kamocrm.com failed to render with "Invalid organization data: missing 'id' or 'domain'". Organization.fromJSON refuses a record without a domain, and t...
Move jump-to-newest in with the toolbar's other actions
Search now owns the whole left track of the toolbar, because the empty part of that track is exactly the room the field opens into. The scroll-to-bottom control...
Refresh the favicon and drop the unused blueleven logos
public/favicon.ico now carries 48x48 and 32x32 layers instead of 32x32/16x16. The five logo-blu*/logo-blueleven* PNGs are referenced from nowhere in the app, so...
Extend market grandfathering into the app-tree backfill
grandfatherExistingGatedMarkets already walked each org's active markets, resolved getRequiredService() and enabled the missing app — it was just restricted to ...
Entitlement-check every vertical, not just the gated two
Every CommerceType now names its own child app under POS, so the isGated() short-circuit that waved retail, rentals, service, subscriptions and procurement stra...
Give the workspace path the same post-login work as the host path
Two gaps found by re-reading the original login tail against the new one, before enabling the picker. The form-encoded /login endpoint built its LoginRequest w...
The toolbar's search is a glyph that opens into a field
The member chat carried a permanent search box across the top of the window — the width of the whole toolbar, spent on a control that is empty almost all of the...
A sent message animates in once, not twice
The message list keyed each row on the message id, and a sent message's id changes exactly once — the optimistic row is appended under a local id, and the STOMP...
Every vertical names its own child app
requiredService becomes total now that each vertical has a child app under ServiceType.POS, which deletes the "null means POS alone is enough" special case and ...
Name rooms after the org id, not the hostname
getOrgToken() took the first label of the current host, and its own comment said why: "so identically-named rooms cannot collide across orgs". On the shared hos...
Let the public config be addressed by org id, not only by host
The meet sidecar looks up an org's meet config to decide whether a guest needs a meeting password. It asked by hostname, which on the shared meet host resolves ...
Cascade feature enable/disable across the app tree
Enabling a child enables its parent; disabling a parent disables every child; disabling the last child disables the parent. Enabling a parent leaves children al...
Add PhiCapabilityGuard for call-time capability checks
PhiTenantGuard runs at feature-enable time and nowhere else — three call sites, all in FeatureService. Now that PhiModule is capability-grained, an app whose co...
Split PhiModule from app-grained to capability-grained
POS mapped to ECOMMERCE_SYNC (BLOCKED_NO_BAA) and the whole commerce surface hangs off POS, so an org with handlesPhi=true could not switch commerce on at all —...
Land inside a newly created org instead of at DNS setup
Creating an org routed the creator to /setup/dns, and the reason was real: entering meant an OTK redirect to internal.<new-domain>, and a brand-new org has no D...
Give ServiceType a two-level parent/child tree
Six commerce children at new ids 26-31, wired to POS in a static block on the RoleRightType pattern (an enum constant cannot reference another from its own cons...
Implementation plan for SP1, the app catalog parent/child tree
12 tasks across kamo-shared-library, KamoInitializerService, SecurityService, MediaService, VOIPService, kamo-internal and the translation dictionary. Ordering...
Make the auto-login cross-tenant guard actually run
The guard read the host org's id with /"id"\s*:\s*(\d+)/ -- a bare digit straight after the colon. SecurityService's JsSafeLongSerializer writes any Long above ...
Stop handing an alias row over as the org's domain
**************** walked org.getDomains() filtering only on isActive. That collection holds the org's root domain AND its alias rows -- api, login, theme and the...
Correct the sign.pink finding
The inventory called SignLinkBuilder's sign.sign.pink fallback a "foreign apex" and I recorded it as one. It is not: sign.pink is a Kamo-owned organization (id ...
Design the EHR/EMR vertical and the parent/child app catalog
Two specs from the pre-build analysis of ~30 repos and the 2026 ambulatory EHR market. The program design records the six decisions that bind every sub-project...
Make an org without a domain enterable
Entering an org meant navigating to **************** With no domain that URL rendered as the literal **************** so Enter was disabled and owners were rout...
Let the shell fetch its org from the session, not the host
kamo-internal's root layout reads the Host header, strips "internal." and fetches /org/domain/<that>. On a host serving one tenant that is the same question as ...
Write a scheduled-support description as rich text
The description on **************** was a three-row textarea. It is the /kb/new writing surface now, minus pictures and the media library — those upload into KB...
Add the workspace picker
A sign-in that names no organization now comes back with a list instead of a session. This is the client half: /api/login passes that payload through (before th...
Carry the type description in both of its shapes
The description is a Lexical document now, so the service stores the plain-text mirror the client sends alongside it and hands readers whichever shape they can ...
Rich-text description columns on webinar_type
Mirrors the shared-lib entity change. Two things the table needs before MediaService maps them. The description column has to be unbounded: it holds a Lexical ...
Store the type description as rich text
The description on **************** is a Lexical editor state now rather than a line of prose, so the column has to be an unbounded TEXT bound as a long varchar...
Let a member sign in without a host naming their org
Adds the second half of the split: a sign-in that names no organization authenticates the user, then asks which workspace. POST /api/security/session/select tur...
Take the chat-core that stops a sent message showing twice
@kamo/chat-core 0.1.6. The conversation reducer now adopts the pending optimistic row when the member's own message comes back over STOMP, instead of appending ...
Remember the last workspace a member signed in to
users.last_org_id backs the workspace picker. An organization is no longer named by the hostname, so a member who belongs to several chooses one after signing i...
Separate the credential check from org authorization
Signing in was two questions fused into one query. "Are these credentials good" is answered by the users row -- the password lives there, so it was never org-sc...
Like what you see shipping?
All of it arrives in your workspace on its own. Start on the free plan and read this page again in a month.