Captivo Access changelog — 2026 · Page 11 of 13

What changed

• New: Add-site and add-connector open in a modal (declutter list pages)
• New: Show upgrade commands in CommandBlock (server + connector)
• New: Enable header-auth SSO by default (auto-login vendors into Guacamole)

What changed

• New: Edit sites in an in-place modal (standalone page kept as fallback)
• New: SiteForm supports onDone (in-place close on modal save)

What changed

• New: Show connector install/update/repair commands in CommandBlock
• New: CommandBlock terminal primitive + theme-independent styles

What changed

• New: Load Fraunces serif + accept resend theme pre-paint
• New: Resend token block + white primary button + login glow
• New: Theme-switcher accepts the resend preference

What changed

• New: Surface directoryLastVerifiedAt in the users list
• New: Admin UI for group mappings + dry-run resolve preview
• New: Enforce AD group sync at passkey + OIDC login
• New: SyncUserAtLogin reconcile engine (provision/deprovision + audit, fail-open)
• New: ResolveDirectoryUser client + GroupMapping CRUD lib
• New: ResolveUser LDAP lookup + /ldap-resolve endpoint
• New: Pure reconcile core (role precedence, grant diff, DN normalize)
• New: Schema for AD group sync (GroupMapping + provenance fields)

What changed

• New: Manager DirectoryConfig + /admin/directory config UI + save/test routes (dataplane /ldap-test) [s0 stage 3]
• New: Data-plane LDAP client over the connector relay + /ldap-test endpoint (go-ldap) [s0 stage 2]
• New: Tunnel ldap frame + connector raw-relay handler (egress-guarded) [s0 stage 1]

What changed

• New: Custom Site logo upload (DB blob) with initial-letter fallback; served with a sandboxing CSP

What changed

• New: Opt-in per-session recording consent gate (RECORDING_CONSENT_REQUIRED), audited acknowledgement

What changed

Fixes and refinements — see the changelog below for details.

What changed

• New: Split brand-panel layout for the sign-in/setup/recover/invite screens

What changed

• New: Default compact Variant-C cards with a List toggle on the vendor My-access page
• New: Full-width content area + cleaner Variant-B admin Site cards
• New: Make Guacamole SSO opt-in (off by default) with the logout/navigation trade-off documented

What changed

• New: Show Site avatars in the vendor My-access lists
• New: Card/list view toggle for the admin Sites list (default cards, persisted) with avatars
• New: Deterministic initial-letter Site avatar helper + component

What changed

• New: Enable Guacamole header-auth (X-Captivo-User) for Captivo SSO + document trust boundary
• New: Inject trusted X-Captivo-User for gateway Sites (Guacamole SSO); strip client-supplied copies
• New: Internal APIs return vendor email + site accessMode for gateway SSO

What changed

• New: Serve styled error pages for all browser-facing proxy failures
• Fixed: Use html/template's default auto-escaping for all error-page fields
• New: Styled HTML error-page renderer + complete deny reasons; restyle denyPage

What changed

• Fixed: Note on /admin/updates directing gateway-host connectors to the network-aware command on Connectors
• New: Shared external captivo-gateway network so connector membership survives updates
• New: Per-connector gateway-aware update/re-pair command + gateway toggle on the connectors page
• New: PATCH gatewayHost + toggle button to flag a gateway host
• New: Connector command joins GATEWAY_NETWORK when gatewayHost (durable across updates)
• New: Add Connector.gatewayHost flag (additive schema)
• Fixed: Single atomic fetch on filter/page change with debounce + stale-response guard
• New: Filterable, paginated recordings list with per-row delete
• New: Delete-recording button with confirm dialog
• New: GET recordings list API (filter + pagination + display names)
• New: DELETE recording endpoint (ADMIN) that audits the deletion
• New: Add listRecordings query (filtered, paginated, with total)

What changed

• Fixed: Swallow async fetch rejections (.catch) so recorder network blips never surface as unhandledrejection in the proxied app
• Fixed: Show an incomplete-recording notice instead of a blank player when the FullSnapshot is missing
• Fixed: Send batches via plain fetch (uncapped) + flush snapshot immediately; persist key+seq per tab for one recording per visit
• Fixed: Drop oversize recording batches instead of truncating; raise cap to 8 MiB
• New: Add hasFullSnapshot event-stream guard
• New: Setup.sh all-in-one (PAIR_CODE runs the connector too) + download-2-files flow; robust .env
• New: One-command setup.sh + configurable GUAC_PORT; simplified README
• Fixed: Serve Guacamole at ROOT so it publishes cleanly as a Site (no /guacamole/ path)

What changed

• New: Hide the rrweb toggle for gateway sites (Guacamole records those)
• Fixed: A gateway site never persists rrweb recordSessions=true

What changed

• New: Show a Gateway badge on gateway sites
• New: AccessMode selector (transparent vs gateway) in the Site form + API
• New: Site.accessMode (TRANSPARENT | GATEWAY)

What changed

• New: Delete button (non-admin, non-self) with confirm
• New: DELETE endpoint (admin-only; not self; not an admin user)
• New: SetNull invite/grant creator+approver so a user can be deleted
• New: Opt-in Guacamole session gateway pack (RDP/SSH/VNC recording)

What changed

• Fixed: Destroy the rrweb player on unmount
• New: Replay page with rrweb-player
• New: Admin recordings list + sidebar nav
• New: AssembleEvents helper + admin events API

What changed

• Fixed: ASCII-safe injection offset, runtime capability gate, skip compressed HTML
• New: Inject rrweb recorder into recorded-Site HTML (CSP-stripped, identity-encoded)
• Fixed: Cache recorder bundle only on success so failures retry
• New: RecordSessions plumbing + /__captivo recorder+collect endpoints
• Fixed: Guard recorder route against an empty dataplane secret
• New: Rrweb recorder bundle + ingest API
• New: Capability flag, per-Site toggle, site/by-host exposes recordSessions
• New: Site.recordSessions + SessionRecording + RecordingChunk

What changed

• Fixed: Use a clean crescent for the dark-theme moon icon

What changed

• New: Header switcher + system-aware boot; drop sidebar theme toggle
• Fixed: Apply resolved theme on mount so the switcher is self-correcting
• New: ThemeSwitcher (light/dark/system) with live OS follow
• New: Distinct Updates icon and a clearer Settings cog

What changed

• New: Block inviting an email that already has an account
• Fixed: Store emails lowercased so unique catches case variants
• New: NormalizeEmail helper (trim + lowercase)

What changed

• Fixed: Modal keeps focus stable while open; light themeColor matches new bg
• New: Update and Re-pair open in a modal, not inside the row
• Fixed: One-line cells, truncate long values, never break words
• New: Light theme is now the default (dark stays a toggle)
• Fixed: Truncate the request cell with tooltip + copy
• Fixed: Wrap/truncate long cell values so tables fit (css + sites)