Mailbox list API returns UI-shaped ****************
GET /api/email/mailboxes returned the raw entity (providerStatus, lastSyncedAt, no member count). The settings UI reads **************** so status was always un...
Carry impersonation audit trail across org jumps
When the caller is already an impersonation session (a god admin acting as another member, carrying SUDO_MEMBER_ID), entering another org from /network minted t...
Authorize privilege-based mailbox access for read + send-as
resolveForMailbox only granted access via a direct MemberMailbox assignment, so mailboxes surfaced through **************** rights threw NoSuchElementException ...
Stop gating pages on the *** cookie in proxy middleware
proxy.ts (Next middleware) redirected every page request with no *** cookie to /logout. Since the session id now lives in sessionStorage — which a document requ...
Stop touching cookies; send token explicitly on auth calls
Rip out all the legacy-cookie clearing/migration. The token lives in sessionStorage (key ***) and travels as the X-***-Token header, which the backend already p...
Don't adopt the legacy *** cookie; clear it instead
Right after the sessionStorage switch ships, every browser still has its old *** cookie. The migration adopted that value into sessionStorage (and the server co...
Fall back to my-networks when all-networks 403s
hasPlatformAdminAccess is derived client-side (owner-of-session-org AND host-org-is-top-level). A child-org owner whose session lands on the top-level host is m...
Gate KamoUniverse launcher on ACCESS_KAMOWORLD right alone (drop org games flag)
Backup verified working — DB-scoped backup, MinIO region us-west-ca-s-1, EXTERNALIOIMPLICITACCESS grant in bootstrap
Drop WITH revision_history from backup (enterprise-only); core BACKUP is OSS
Loki 6.x SingleBinary needs zeroed scalable targets; crdb exec via localhost (cert SANs)
Register esign repositories for the meter submission bean
EsignMeterSubmissionService needs EsignUsageRecordRepository, but @EnableJpaRepositories didn't scan com.kamo.z.shared.esign.repos, so the context failed to sta...
Back metered add-on prices with a Billing Meter
Stripe (>= 2025-03-31.basil) rejects the legacy usage_type+aggregate_usage metered model ('metered prices must be backed by meters'), so USAGE_BASED add-on pric...
Select the SUBSCRIPTION market for platform setup
KamoCRM owns several markets **************** so resolveProductMarket must pick the SUBSCRIPTION-type (platform-access) market rather than the first active one....
Product root = owns SUBSCRIPTION market, not any market
A customer org (e.g. BluEleven) owns its OWN business markets (RETAIL/MORTGAGE) to run its company while remaining a customer of the KamoCRM platform — its memb...
Keep org list on background refetch; dedupe session calls
/network re-fired fetchNetworks on every background session refresh and hid the whole list on any fetch error, so a transient blip or a stale hasPlatformAdminAc...
Revert email link click handlers, isolate cause
User reports email-preview link clicks still do nothing AND text selection is killed mid-drag. Right-click and hover both work, so the anchor element is intact ...
Regenerate favicons on labeling save; sniff real logo type
provisionUpdate (run on every custom-labeling save) wrote config/css/manifest but never regenerated favicons — those were only produced by provisionFull. An org...
Seed globals.css from template when org folder lacks it
provisionUpdate (run on every color save) rewrote the org's css/globals.css in place, but that object only exists once provisionFull has copied it from the defa...
Show full logo with its real extension, not hardcoded .svg
The branding tab built logoFullUrl as logo-full.svg on mount, ignoring the org's logoFullExt. Full logos uploaded as png/jpg/etc. live at logo-full.{ext} in Min...
Refresh TLSStore every loop so newly-issued certs get served
update_tls_store() only ran at startup and on shared-storage imports, so a cert freshly issued by cert-manager (HTTP-01) was Ready with a tls-* secret but never...
Give redirect-only route a backend so Traefik v3 enables it
Traefik v3 disables an IngressRoute router with services: [] when allowEmptyServices is off (as it is here), so the domain-agnostic HTTP->HTTPS redirect router ...
Redirect all HTTP hosts to HTTPS + gate auto-cert to real org domains
Custom org domains (e.g. login.sign.pink) returned Traefik's bare "404 page not found" over plain HTTP: the only port-80 redirect router was hardcoded to *.kamo...
Persist conversion_error instead of failing silently
Both the template and regular upload conversion pipelines swallowed Docs conversion failures (logged only), leaving is_converted=false with no recorded reason —...
Install turbo via npm in Docker pruner stage; pin pnpm; add .dockerignore
The pruner stage ran `pnpm add -g turbo` before any package.json existed, so corepack grabbed pnpm 11 and failed with "global bin directory /pnpm/bin not in PAT...
Default empty STRIPE_CONNECT_WEBHOOK_SECRET so KamoLOS boots
The configmap referenced **************** without a default, so Spring's placeholder resolver threw before reaching the Java-level **************** which alread...
Track shared-lib LoanRepository → PersonalLoanRepository rename
Updates every import and field type from LoanRepository to PersonalLoanRepository across 20 KamoLOS source files + 1 test (Lombok-injected field names stay as l...
Rename LoanRepository → PersonalLoanRepository
Spring Data JPA derives the repository bean name from the interface's simple class name, not from the @Repository("...") qualifier value, so the prior workaroun...
Add /commerce/personal-loans/new entry + polish market-scoped offer page
The QuickActionsBar "New Loan Offer" action pointed at /commerce/personal-loans/new but no such page existed, so Next.js routed to the dynamic [loanId] page wit...
Avoid Loan / LoanRepository collision with mortgage app
KamoInitializerService failed to boot because two @Entity classes named 'Loan' and two repository classes named 'LoanRepository' both wanted to register the sam...
Tier 1 critical correctness pass
T1.1 Stripe disbursement strategy: TREASURY (stub — requires SDK upgrade or raw HTTP) / CONNECTED_ACCOUNT (Transfer.create — works in SDK 28.2.0) / MA...
Force email link clicks via capture-phase navigation
Reports show clicks on email-preview links silently doing nothing — hover shows the URL, no console errors, but the navigation never fires. That fingerprint poi...
Let native target=_blank open the new tab, drop window.open
The previous fix intercepted the click and called window.open() — but popup blockers and extensions can block window.open even from a direct click handler, so t...
Email-preview links open in a new tab again
The sanitizer already sets target="_blank" on every link, but the document-level click handler in NavigationInterceptor was firing for every link click — includ...
Add /api/security/mortgage-apps catch-all proxy — 404 root cause
The kamo-internal app proxies every Java backend path through an explicit Next.js route handler (one per top-level segment: /commerce-markets, /pos, /leads, …)....
/pipeline/{vertical}/{x} 404s — namespace was renamed to /commerce/
The /pipeline namespace has no routes in this app — every link going to /pipeline/applications/{x}, /pipeline/orders/{x}, /pipeline/engagements/{x}, /pipeline/s...
Detach before replacing features collection in /org/domain
The previous fix wired the applied-model projection into **************** but called org.setFeatures(projected) on the still-managed entity. The Organization.fe...
Remove standalone Applications icon — LOS lives under Commerce
The mortgage application pipeline is one vertical of the commerce system, not a top-level nav. Loan officers, processors, and underwriters reach it via Commerce...
Resolve ambiguous /org/domain handler — Commerce nav was disappearing
SecurityController had a second **************** that collided with **************** Spring rejected the request with "Ambiguous handler methods mapped" → 500 →...
Flatten add-item menu so Generated Docs are reachable
The "Add Generated Doc" submenu approach didn't work: clicking the menu item closed the parent menu, which unmounted the MenuItem before the nested Menu could a...
Drive journey sky from SkyToggle, unstack from personality chip
- Move SkyToggle to its own top-right row at top-14 so the slider stops overlapping LoGuideChip, which is positioned at right-14 assuming it only needs to c...
Stop double-appending render query string; add share + meta dialogs
Render fix: - **************** was manually appending ?inline=true to apiPath, but forwardToApi already preserves the incoming query string. The duplicated quer...
Include com.kamo.z.shared.binder in @EnableJpaRepositories
DocsService boots with an explicit basePackages list, not classpath scanning, so BinderRepository wasn't being discovered — startup failed with "No qualifying b...
Lift home CTA cluster above the LenderFooter
Buttons at bottom-12/sm:bottom-14 were clipped by the lender attribution footer (~76px tall on desktop). Bumped offsets so the cluster clears it.
Stop personality chip overlapping the SoundToggle
LoGuideChip was absolutely positioned at top-3/right-3 in JourneyHero and JourneyApplyLayout, the same spot as the global SoundToggle in app/layout.tsx. Shifted...
Stop racing hydration with a 404 — render the logo URL that actually exists
The tenant MinIO bucket holds logo-full.svg / logo.svg as canonical names; nobody uploads the -on-dark variants. We were trying the dark-mode URL first, 404'ing...
Unwrap SecurityService's nested color wire-format so tenant brand vars actually populate
SecurityService returns Organization with colors nested inside an EmbColorPalettePair ({ colors: { colorPri: { colorPri, colorLight, ... } } }) and stores hex w...
Render the logo img on the SSR pass — no more wordmark-only flash
ThemeLogo's empty-string initial logoSrc + useEffect-to-fill pattern meant the SSR render returned the wordmark fallback, then hydration populated the src. If a...
Kill fake-tenant defaults, render the actual org's branding only
Removes the Apex Mortgage demo I should never have added and the Kamo "default" fallback I replaced it with. Both were just papering over a missing-tenant condi...
Like what you see shipping?
Every one of these updates lands in your workspace automatically. Start free and watch it grow week after week.