Make the KamoDesktop SSO link redeemable exactly once
The link is delivered as a URL, so it lands in browser history and in the reopen-closed-tab list, where it long outlives the session it was minted for. Until no...
The account rollup must not widen what a reader may see
The account timeline I added last commit was a way around the per-lead read gate. A member refused a lead's messages on the page that names the lead could open ...
An account-level communications timeline
The level most people mean when they say "this customer's calls". The spine is already keyed on an owner, so the account endpoint is the same merged, component ...
A patient's calls, texts and email — on the platform's own spine
Not a second timeline. LeadCommunicationsService now takes a CommsSubject and the lead overload delegates to it, so /leads keeps its exact behaviour drift. A pa...
The sign-in response carries each workspace's logo
The picker drew two letters per row because the response held a name and an alias and no image. A list of workspaces is read by mark long before it is read by n...
Pin kamo-shared-library 1.6.0
The library moved to 1.6.0 while consumers stayed on 1.5.0. Consumer CI builds the library from a fresh clone into a cold ~/.m2 and ci-settings.xml mirrors Mave...
The visit and its documentation — the loop a practice runs on
Starting a visit is what grants the clinician the chart, and that is the design rather than a side effect. A clinician about to see a patient has no relationshi...
The FHIR R4 endpoint, with the same access rules as the chart
An interoperability endpoint is where a system is most likely to acquire a quiet bypass: it is machine-to-machine, nobody watches it, and "the integration needs...
/org/current stops depending on a live Hibernate session
This endpoint is what the workspace shell loads before it renders, and the client refuses a record it cannot read — Organization.fromJSON throws without a domai...
The revenue cycle worklists, and the one restriction that outranks them
Every list here exists because its failure mode is a MISSING row rather than a wrong one, which is why none of them show up in an ordinary report. A claim a cl...
A failed workspace selection no longer destroys the sign-in
Reported as being thrown back to the email field with "Your sign-in timed out. Please sign in again." after clicking Continue. The timeout had not happened — th...
Stop the logo pass starving backgrounds, and read <picture>
Diagnosed against a real site that returned six logos, brand colours and zero background images. Three separate causes, all ours. The logo pass could eat the e...
Seed MANAGE_WEBINAR_SCHEDULES from MANAGE_SUPPORT_SETTINGS
Until availability moved onto the member, MANAGE_SUPPORT_SETTINGS holders were the one group who set it — they authored the dated slots on each webinar type, wh...
Keep room for the compact mark among a pile of lockups
A straight "best six by score" is the wrong cap for this, and the reason is the shape of real sites: a company's wide lockup appears in the header, in JSON-LD a...
The clinical API — patients, schedule, chart, and the gate in front
The access rule is the part worth reading. Being logged in is not a reason to see a chart. The overwhelming majority of real HIPAA enforcement is not outside at...
Baseline the desktop probe, which is guarded where the scan cannot see
**************** has been failing on main since ba3f85c. DesktopProbeController#probe is not unguarded — it checks X-Internal-Auth through authorized(auth), con...
An unfinished domain picks a different host, not a refusal
Entering an org was refused outright unless its own custom domain had finished DNS and SSL. That was right while entering meant navigating to https://internal.<...
Expose the scan on /api/security/org/brand-scan
Its own controller rather than a method on OrganizationController, which already takes 25 constructor dependencies. The path still lands under the same prefix, ...
Orchestrate the scan behind one cached, budgeted call
One response rather than three endpoints because it is one scan: the logo must be downloaded before its pixels can contribute a colour, and the colours are want...
Take hero imagery, falling back to carousel slides
The fallback is conditional by design. A site with a hero has already chosen one picture to represent itself; sweeping its carousel too would bury that choice i...
Reconcile brand colours from five independent sources
Five because each is authoritative on a different kind of site and silent on the rest: a design system states everything in CSS variables, a PWA in its manifest...
Find a site's logo from twelve independent signals
Twelve rather than one because there is no single place a logo lives. A Shopify store declares it in JSON-LD; WordPress puts it in a header img; a React app ren...
Index a site's CSS and parse its page once
A declaration scanner rather than a CSS grammar: the scan has three questions (custom properties, background images, colours) and none needs the cascade resolve...
Start the 3-day trial on first entry into the org, not at creation
Creating an org and opening it are different events. An org can be created and left sitting, and one nobody has walked into must not have spent its evaluation —...
Rank colours perceptually rather than by RGB frequency
Counting RGB values across a stylesheet elects the site's off-white page background every time -- it is the most-used colour on almost every site ever built. Wh...
Read real image dimensions from the bytes
Nothing here trusts the page. An HTML width attribute is a layout instruction, not a fact about the file -- a 2400px logo is routinely declared width="180" and ...
Ask for different work for a bug and an enhancement
A bug says 'find out why and fix it' and points at the logs; an enhancement says 'this already works, build the better version' and points at the current behavi...
Guarded outbound fetching for the website brand scan
The member types the URL, so every request this issues is an SSRF primitive, and there is no egress NetworkPolicy and no forward proxy in this cluster -- Redis ...
Remind the dispatched session to push its work
A session that fixes a bug and leaves the change sitting on the dev machine has not fixed anything anybody else can see. The sentence is split out of the entit...
Start the 3-day trial when the org is created
The trial was seeded pending and started on the owner's first sign-in, because an org was unreachable until its DNS verified — starting the clock at creation wo...
Internal probe endpoint so the access canary tests the real path
The KamoDesktop canary needs a link minted the way the icon mints one. It holds the same signing key, so it could build its own — and would then be testing itse...
Rebuild now the shared library has AiDispatchRequest
The previous build failed on a class that had not been pushed to kamo-shared-library (fa243ae). Nothing to change here; this just re-runs the build against a li...
Answer whether a web alias is still free
The org-creation wizard is eleven steps long and the alias was only checked when the form was submitted, so someone who picked a name another organization alrea...
Stop the SSO token expiry from emptying a live desktop session
"The requested connection does not exist. Please check the connection name and try again." on a KamoDesktop reconnect was not a missing connection. It was the S...
Send To AI, gated on MANAGE_SYSTEM_BUGS
The class carries @RequirePlatformRight, so the interceptor resolves the caller and refuses before any handler runs — a per-method check would have been one for...
Turn the workspace picker on
A member of several organizations now chooses which one to open after their password, instead of it being chosen for them by the hostname. This is the switch th...
Send the member to the workspace host, not a relative path
SignInCompletionService returned a relative /validate?otk=. That resolves against the host that served the SIGN-IN — login.<apex> — and kamo-login has a /valida...
Turn the workspace picker back off
The redirect is wrong. SignInCompletionService returns a relative /validate?otk=, which resolves against the host that served the sign-in -- login.<apex> -- and...
Turn the workspace picker on
A member of several organizations now chooses which one to open after their password, instead of having it chosen for them by the hostname. This is the switch t...
Accept an explicit org, not only the host
Registration bound the account to whatever organization the host resolved to. On register.kamocrm.com — the signup page for every organization with no register ...
Delete the "first organization in the database" fallbacks
Seven blocks across five controllers ended their org-resolution with, in effect: if the server name is localhost or a bare IP, return whichever organization the...
Keep an alias unique platform-wide, on both write paths
Creation checked the alias only within one security provider, and PUT /org/{id} checked nothing at all — it applied whatever it was given. Both were reasonable ...
Refuse the AI training corpus exports for PHI tenants
ANALYTICS_EXPORT is blocked because exports leave the boundary with no de-identification. Both training exports already had a fail-closed audit — there IS a rec...
Send the tree on the app-catalog endpoint too
Branch Types → Allowed Apps builds its editor from /features/app-catalog, not from the tenant features listing, so it was the one surface that could not see whi...
Rebuild against the Affiliate Sales Scoreboard rights
No source change here. SecurityService is what enumerates RoleRightType.values() to serve the rights editor (SecurityRoleController) and to populate a grant-all...
Serve an org's branding to a screen with no session
Login, registration and the meeting lobby paint an organization's colours before any session exists. They knew which one from the hostname, which is exactly wha...
Refuse an alias that names more than one organization
byAlias took LIMIT 1 over orgs.alias, which has no uniqueness constraint: the create path checks it per security provider and PUT /org/{id} does not check it at...
Serve the app tree, and fix the unguarded auto-enable
FeatureController now sends parent/children/isParent on every serialized app so the client can render children nested under their parent. Served rather than mir...
Resolve the domain on /org/current server-side
internal.kamocrm.com failed to render with "Invalid organization data: missing 'id' or 'domain'". Organization has no `domain` field -- it has a `domains` colle...
Entitlement-check every vertical, not just the gated two
Every CommerceType now names its own child app under POS, so the isGated() short-circuit that waved retail, rentals, service, subscriptions and procurement stra...
Like what you see shipping?
Every one of these updates lands in your workspace automatically. Start free and watch it grow week after week.