Live Change Log

Two letters standing in for a logo was a workaround for the response not carrying one. It does now, resolved server-side from the folder the org's theme was pro...

The button already carried disabled={!selected || submitting}, but submitting was only true for the duration of the request. On success the page sets redirectin...

Every non-ok status fell back to "Please sign in again", which is only true of 401 — the one status that means the selection token is really gone. SecurityServi...

login.kamocrm.com is the sign-in screen for every organization that has no host of its own, so the hostname cannot say which one is signing in. ?org= does: it n...

The guard read the host org's id with /"id"\s*:\s*(\d+)/ -- a bare digit straight after the colon. SecurityService's JsSafeLongSerializer writes any Long above ...

The inventory called SignLinkBuilder's sign.sign.pink fallback a "foreign apex" and I recorded it as one. It is not: sign.pink is a Kamo-owned organization (id ...

A sign-in that names no organization now comes back with a list instead of a session. This is the client half: /api/login passes that payload through (before th...

Six phases, each independently shippable, because pushing deploys: the host path keeps working until Phase 6 removes it. Phase 1 is the crux and is additive --...

Org identity comes from the hostname today: OrgHostResolver.resolveByFqdn turns <alias>.<domain> into (orgId, providerId), and its SQL requires od.is_dns_verifi...

The left column was a generic headline, a security platitude and a pile of ambient decoration (dot grid, floating orbs, a pulsing dash). Replace it with one sha...

KToken could not verify a real token. The four ids it carries are int64s, and the Java signer (kamo-shared-library KToken#canonicalForMac) appends each as a raw...

The inline sign-in messages ("Login successful! Redirecting...", "Invalid username and/or password.") used MUI's default Alert, whose pastel fill plus matching ...

config.json now carries backgroundOrder alongside backgroundImageCount. Shuffle re-randomises on every advance and never repeats the frame on screen; an absent ...

Build 21 failed in puppeteer postinstall fetching chrome-headless-shell — an SSL "decryption failed or bad record mac", the same flaky-transfer class that took ...

ServiceType.LOS became MLOS (mortgage, id 14 retained because ORG_FEATURES persists the id) and the freed LOS key is now the Personal Loan Origination System on...

Password recovery now accepts a member's primary mailbox address, which only names an account within one org. This proxy reaches SecurityService over cluster DN...

SecurityService now gates login on a second factor (§164.312(d)). When one is owed it creates the session but withholds its one-time key, returning a short-live...

kamo-register now whitelists starter|business|enterprise and stashes sp_checkout_code; the old pro|business filter silently dropped Starter buyers, and the apex...

- Mount analyticsAnalytics client component in the root layout: next/script loader for analytics.kamocrm.com scoped via data-domains to login.kamocrm.com on...

Staged and committed as-is so nothing is left uncommitted in the working tree. 26 files changed, 7894 insertions(+), 8 deletions(-)

dl.k8s.io over the runner's egress intermittently drops mid-transfer: curl: (56) OpenSSL SSL_read: decryption failed or bad record mac which fails the deploy ...

Self-fetches /api/trial-status (proxy to SecurityService public trial-status endpoint, resolved by login host) and renders an amber pill above the Powered-by pi...

- DynamicMetaLoader: read software identity + auth selectors from config.json, set tab title from resolved name (authNameBrandSource), persist auth-logo state...

When register links an existing account to a new org, it redirects here with ?linked=1. Show "You already have a Kamo account — we've added this organization to...

On machines whose Chrome uses layout-consuming (non-overlay) scrollbars, the login/recover pages fidgeted with both scrollbars flickering. Root cause: the root ...

Track failed background image loads and filter them out of the Swiper carousel, so an incompletely provisioned theme (e.g. optionone, whose bg/2.webp was never ...

Drop showIntro/introComplete state, the 2s intro timer effect, and the branded early-return loading screen. The page now renders straight into the background + ...

- Welcome/recover panel now extends --welcome-bleed (16rem) off the left edge with its right edge still pinned to --welcome-w; inner content padding is comp...

Wait for the first background image (onLoad, with a 3s safety fallback), then spring-bounce the welcome/recover panel in from off-screen left (physics spring, s...

Both layers drift with the pointer at different rates and opposite directions via framer springs. Background is scaled 1.12 and the welcome panel is oversized 1...

PoweredByKamo gains an optional logoSlot rendered centered directly above the pill within its fixed bottom-right anchor (other pages unaffected). The animated l...

Welcome/Recover panel now full-height, flush to the left edge, on top of the background image with a translucent wash and square corners; hidden on mobile. Anim...

The /api/recover proxy defaulted to api.kamocrm.com, which Traefik routes to APIService (no recover controller) → 404 → "Something went wrong" on /reset-passwor...

After successful auth (manual or auto-login), consume the apex-domain sp_checkout_plan cookie left by kamo-register and redirect the buyer to the brand /subscri...

getThemePath() was reducing the hostname to apex+tld for both the themed host and the bucket folder, so subdomain tenants like gnosia.demo.kamocrm.com loaded th...

auto-login accepted any *** and minted an OTK pointing back at it, regardless of which org the destination internal.* host belongs to. A stale or cross-org *** ...

Workflow-level concurrency serialized the whole pipeline (including kubectl rollouts). Move the group to the build job only so deploy jobs from different runs c...

DynamicMetaLoader now sets document.title to "Login - {siteNameShort}" and writes the org description into the meta description tag. Static layout.tsx fallback ...

ThemeLogo read kamo-logo-full-ext from sessionStorage before DynamicMetaLoader finished fetching config.json, so logo-full often used the wrong extension until ...