Carry a referral code through to the register link
The referral code normally travels in the apex cookie the marketing site sets (kdsc_src on .<apex>), which register.<apex> reads for itself, so this link does n...
Prove the deploy by digest, not by tag
The preceding commit stops `set image` being a silent no-op. This asserts the outcome: after the rollout, the tag is resolved to a digest at the registry and th...
A rebuild of the same commit deployed nothing and reported success
The image is tagged with the commit SHA, so rebuilding the same commit produces an identical image reference. `kubectl set image` then changes nothing, the Depl...
Make the strike meter agree with its own caption, and read aloud
Three things the screen was getting wrong, all found by looking at it rather than by running it. The bar was a TALLY of failures, wrapping every five segments....
Never show a status phrase to somebody who clicked a link
Rendering the page against an unreachable backend put "Internal Server Error" on screen as the explanation. That is a status phrase written for an operator read...
Give the rollout room for the 15s minReadySeconds now costs
progressDeadlineSeconds was 60. That is the window a rollout has to show progress before Kubernetes gives up and marks it failed, and the previous commit added ...
Let a rollout finish what the old pod was doing
Deploys replaced the only pod of each service with nothing to catch the requests in flight. Three settings, applied across the fleet: - preStop sleeps 10s befo...
Paint a white-label sign-in screen from the host's organization
Every image and colour was missing on login.<customer domain> for any organization created after the 2026-08-26 alias migration. getThemePath() resolves an exp...
Brand the sign-in screen from the org's alias, not the host
login.kamocrm.com is the sign-in screen for every organization that has no host of its own. The theme base was derived from that hostname, so all of them were p...
Theme assets come from a host that resolves
The sign-in screen paints an organization's branding from theme.<its own domain>. That domain may not resolve: an org can exist and be signed into before its DN...
Continue stays disabled once a workspace is opening
The button already carried disabled={!selected || submitting}, but submitting was only true for the duration of the request. On success the page sets redirectin...
Only a spent token sends the member back to the start
Every non-ok status fell back to "Please sign in again", which is only true of 401 — the one status that means the selection token is really gone. SecurityServi...
Make the auto-login cross-tenant guard actually run
The guard read the host org's id with /"id"\s*:\s*(\d+)/ -- a bare digit straight after the colon. SecurityService's JsSafeLongSerializer writes any Long above ...
Hold the token's int64 ids as digits, not as numbers
KToken could not verify a real token. The four ids it carries are int64s, and the Java signer (kamo-shared-library KToken#canonicalForMac) appends each as a raw...
Accept starter/enterprise plan handoff, carry promo code, target www /subscribe
kamo-register now whitelists starter|business|enterprise and stashes sp_checkout_code; the old pro|business filter silently dropped Starter buyers, and the apex...
Harden the kubectl download against flaky egress [skip ci]
dl.k8s.io over the runner's egress intermittently drops mid-transfer: curl: (56) OpenSSL SSL_read: decryption failed or bad record mac which fails the deploy ...
Stop viewport shaking on browsers with classic scrollbars
On machines whose Chrome uses layout-consuming (non-overlay) scrollbars, the login/recover pages fidgeted with both scrollbars flickering. Root cause: the root ...
Drop background images that 404 instead of showing a broken frame
Track failed background image loads and filter them out of the Swiper carousel, so an incompletely provisioned theme (e.g. optionone, whose bg/2.webp was never ...
Proxy password-reset to SecurityService internal DNS
The /api/recover proxy defaulted to api.kamocrm.com, which Traefik routes to APIService (no recover controller) → 404 → "Something went wrong" on /reset-passwor...
Resolve subdomain-tenant org bucket to its own MinIO folder
getThemePath() was reducing the hostname to apex+tld for both the themed host and the bucket folder, so subdomain tenants like gnosia.demo.kamocrm.com loaded th...
Refuse when session orgID does not match host org
auto-login accepted any *** and minted an OTK pointing back at it, regardless of which org the destination internal.* host belongs to. A stale or cross-org *** ...
Reload ThemeLogo after config and cache-bust logo URL
ThemeLogo read kamo-logo-full-ext from sessionStorage before DynamicMetaLoader finished fetching config.json, so logo-full often used the wrong extension until ...
Properly clean up Capcha event listeners on step transition
The removeEventListener calls were inside the setTimeout callback's return value, which JavaScript ignores. This caused handlers to accumulate on every user→pas...
Update redirect from /resend-verification to /verification on register site
Set Host/X-Forwarded-Host so APIService resolves correct org
APIService overwrites X-Forwarded-Host with request.getServerName(), which reads from the Host header. Without an explicit Host header the K8s internal service ...
Resend verification using email not userId, forward X-Forwarded-Host
SecurityService /register/resend-verification expects email in the body, not userId (which the login error response never includes). Also forward X-Forwarded-Ho...
Backlink target to www.kamocrm.com (canonical host)
The PoweredByKamo component shipped pointing at apex https://kamocrm.com/ but the canonical kamo-marketing host is https://www.kamocrm.com/. Updating all three ...
Proxy *** challenge through login server for multi-domain support
Replaces direct cross-origin fetch to capcha.{domain}/api/challenge with a same-origin proxy at /api/capcha/challenge. The previous approach required a valid TL...
Attach widget event listeners when password step renders, not on initial mount
Listen for both statechange and verified events, remove payload requirement from login gate
Use identical explicit pixel spacing on both username and password option rows
Context-aware *** error messages, tighten spacing between fields and options
Swap spacing on username/password views, label to 'I am Human', update error message
Use widget's CSSVariables type instead of React.CSSProperties for style prop
Remove duplicate Capcha-widget JSX type declarations (widget ships its own)
Vendor kamo-capcha-widget locally instead of git URL (Docker can't resolve k0m1)
Block login until *** verified, remove all Capcha branding via shadow DOM, use onfocus auto mode
Remove Capcha branding and upgrade to PBKDF2/SHA-256 with deterministic effort
Like what you see shipping?
Every one of these updates lands in your workspace automatically. Start free and watch it grow week after week.