I18n the LabelManager software-identity labels via next-intl
Replace literal strings with **************** keys (added to the translation dictionary). English fallback covers locales pending translation.
Add install-QR (self-hosted APK) to Setup Mobile App tab
Install/Sign-in toggle: "Install" shows a QR to the signed release APK on the new phone can download+sideload it; "Sign in" keeps the password-gated OTK flow.
Web Chat Integration design customizer + live preview
Adds a Customize dialog to the Web Chat Integration tab: an editor form (colors, copy, layout, behavior, AI prompt) on the left and an instant, non-interactive ...
Web Chat Integration tab — list, create, snippet (BFF + UI)
Phase 2 core of the Web Chat Integration settings tab: BFF routes proxying to the Phase-1a MediaService CRUD, a typed client, and the /settings/features/chat ta...
Kamo-register honors software auth logo + name
- DynamicMetaLoader: read software identity + auth selectors from config.json, resolve tab title, persist auth logo/name state to sessionStorage - brand.ts + ...
Kamo-login honors software auth logo + tab title
- DynamicMetaLoader: read software identity + auth selectors from config.json, set tab title from resolved name (authNameBrandSource), persist auth-logo state...
LabelManager software identity UI + internal tab title
- Company Info: software name/short-name + login/register name + tab-title selectors - Branding: software full/simple logo uploads, override toggles, and per-su...
3-stage org onboarding guidance (create → finish DNS → enter)
Generalize the first-org hero into a single stage-aware guidance panel keyed on the member's owned-org count + DNS status (from /api/security/org/my-networks): ...
Dual company/software resolver + delivery + consumption
- Organization.ts: deliver software identity + per-surface selectors via OrgContext - brand.ts: **************** (+ vitest, 8 cases) - ThemeLogo: logoSoftware/l...
Software logo upload types + config.json bake
- uploadLogo: explicit object-key switch **************** with rejecting default so a software upload can never clobber the company logo.svg - copyFolder: pre...
Persist software branding fields via patchOrganization whitelist
First-org CTA hero for members on the platform org
Show an onboarding hero at the top of the home launchpad inviting a KamoCRM-platform member (not a team member) who hasn't yet created a child org to spin up th...
TURN-REST credentials endpoint for the mobile softphone
GET /api/voip/turn/credentials mints ephemeral coturn creds (HMAC-SHA1 over "<expiry>:<memberId>" with the shared static-auth-secret) so native/cellular WebRTC ...
Expose per-org primaryColor + logo URLs on /my-networks
Each org row now carries primaryColor (Organization.colors.colorPri, '#'-prefixed to match config.json) and derived logoUrl/logoSimpleUrl (theme.<domain>/public...
Make WebChatIntegration create() @Transactional (no orphaned key on integration-save failure)
Snapshot web-chat integration id on support visitor + ticket
Resolves the WebChatIntegration by creatingKeyHash (enabled-filtered, consistent with bootstrap()/AI-prompt resolution) once in createSupportSession and stamps ...
Per-integration public AI prompt + session attribution
Upgrade the public-chat system-prompt waterfall from per-org to per-integration: PublicAiChatController now reads the X-Public-Chat-Key-Hash header (nullable) f...
GET /api/public-chat/bootstrap gateway route
Add bootstrap endpoint that reuses the existing proxyWithAuth pipeline (key validation + opt-in origin + PUBLIC_CHAT scope + rate-limit + X-Public-Chat-Key-Hash...
Public-chat bootstrap config resolver
Adds an internal GET **************** that resolves a WebChatIntegration by X-Public-Chat-Key-Hash and returns its resolved design/behavior config (default-fill...
Wire optional mediaservice-push secret for FCM/APNs credentials
Mounts the FCM service-account JSON + APNs .p8 from an optional `mediaservice-push` secret at /etc/kamo/push and sets the APNs key-id/team-id from the same secr...
Tightly-cropped Copilot icon + bare NavPri entry
Added a trimmed icon.png (glyph fills ~82% of the frame) and pointed the home pill, NavPri entry, Interaction Center tab, and QR center at it. Stripped the NavP...
WebChatIntegration CRUD (mints key + integration, org-scoped)
Org-facing management API for the Phase-2 web-chat settings tab. On create, mints the underlying PublicChatApiKey (same key-gen approach as PublicChatKeyControl...
Add WEB_CHAT_INTEGRATION_ID attribution columns to visitor/ticket/ai-session
WebChatIntegration entity + repo + DTO + default design config
Add "Access Copilot Mobile App" entry points on home + NavPri
Both surfaces dispatch an `open-interaction-center` event that NavTop listens for to open the Interaction Center on the Setup Mobile App tab. Home shows a label...
Rename tab to Setup Mobile App; even full-height spacing; logo centered on title with description beneath
Password-gate the QR, single-line tab, logo-left header, 10-min code
- Member must re-enter their password (server-verified via /api/mobile-access-otk, which mints the OTK only on success) before the QR is revealed — prevents s...
POST **************** — gate Mobile Copilot QR
Verifies the caller's own password (passwordEncoder.matches against their session's user) without changing anything. Used by the mobile-access-otk BFF route so ...
Rebuild against shared-lib for ALLOW_MOBILE_ACCESS right
RoleRightsSyncService backfills the new general right to all roles on boot.
Setup Mobile Access tab — QR to install + auto-configure Mobile Copilot
New 3rd tab in NavTopPanel (gated by ALLOW_MOBILE_ACCESS right): shows a branded QR encoding a short-lived OTK deep link (kamocopilot://configure) that signs th...
Add ALLOW_MOBILE_ACCESS (167) general right for Mobile Copilot
New RoleRightType (serviceType=null → General group) gating the 'Setup Mobile Access' interaction-center tab. RoleRightsSyncService backfills it to all roles on...
Defer mandatory-origin to Phase 1 — OriginMatcher opt-in (empty allow-list / missing Origin allowed)
Phase-0 widgets still call via their server-side proxy, so origin-locking has no benefit yet and every live public-chat key has an empty allow-list. Strict enfo...
Don't cache-invalidate keys on transient downstream errors (only on definitive invalid)
Per-org public prompt, human-handoff on no provider, anon daily message cap
Only cache-invalidate genuinely-invalid keys, not origin-denied (prevents valid-key DoS)
On a cold Redis cache, a valid public-chat key with a wrong/absent Origin was cached as INVALID for 60s, denying the correct origin's requests for that window. ...
Bind WS relay handshake to Origin + add cold-cache key validation fallback
Extracts PublicChatController's private validateViaDownstream() into a shared PublicChatKeyResolver bean so PublicChatWebSocketHandler can reuse the same downst...
Verify *** PoW at the edge on public session create (enforced when payload present)
Make public-chat origin allow-list mandatory (deny on missing Origin / empty list)
Bust APIService key cache immediately on public-chat key toggle/delete
Persist creating key hash on public-chat visitor + ticket for attribution
Resolve public-chat system member per-org (drop hardcoded snadjafinia alias)
createSupportSession, createPublicTicket, and the owner notification helpers all resolved the org's "system member" via a hardcoded usernameAlias="snadjafinia" ...
Add publicDailyMessageCap to AiOrgSettings for anon web-chat quota
Add creating-key-hash attribution columns to PublicChatVisitor + SupportTicket
Add findOrganizationOwners for per-org public-chat system member
Mobile push dispatch (FCM data + direct APNs) with presence gate
chat incoming (MediaController), support ticket (SupportNotificationService), SMS/voicemail (VoipStompRelayController), social **************** Presence-gated l...
Expose AIService /ws/ai-chat via api.* hosts for mobile clients
IngressRoute (priority 100, websecure, ws-upgrade middleware sans compress) routes wss://api.<domain>/ws/ai-chat to kamowsai-service:80 — same pattern as the me...
Like what you see shipping?
Every one of these updates lands in your workspace automatically. Start free and watch it grow week after week.