Captivo Access changelog — 2026 · Page 9 of 13

Improved

• Live view now shows the current screen the moment you start watching — even when the vendor is idle. Previously the viewer started black and only filled in as the vendor moved things. The viewer now joins the session's engine directly, which sends the current display state on join, then live updates. Take-control and the vendor's 'being monitored' notice are unchanged.

Data-plane only — no schema change; nothing to re-run on connectors.

What changed

• Fixed: Chown the guacd log volume so guacd (uid 1000) can write it

New

• Gateway (guacd) logs on the connector detail page. For connectors that run remote-desktop sessions, the connector page now shows a Gateway logs card beside the connector's own recent logs — the last lines from guacd (the RDP/SSH/VNC engine). Troubleshoot connection, auth, and TLS problems from the console instead of SSHing to the host. Captured over a shared volume (no Docker socket); level is a sensible default.

Upgrading: re-run the gateway-host connector command once so guacd starts writing its log to the shared volume and the connector mounts it. Non-gateway connectors are unaffected.

Fix

• Native (RDP/SSH/VNC) recordings now actually play. The player fed the recording to the Guacamole player as a Blob, which is broken in the bundled guacamole-common-js 1.5.0 (it throws on construction). It now streams the recording over the standard tunnel mechanism instead. Play/pause and the seek bar work.

What changed

Fixes and refinements — see the changelog below for details.

Fix

• Native (RDP/SSH/VNC) recordings now play back. The player called a method that doesn't exist on the recording object, so every native recording failed with "Couldn't play this recording." It now loads and plays correctly, with working play/pause and a seek bar. (Web recordings were unaffected.)

Fix

• The 'Record sessions' toggle now works on remote-desktop (RDP/SSH/VNC) sites. It was previously hidden and forced off for gateway sites throughout the stack, so native session recording could never be enabled from the console. Turning it on now records the remote-desktop session and makes it replayable under Recordings.

Fixes

• Live view no longer shows a black screen. A viewer joining an in-progress session was never sent the session's start signal or screen size, so nothing rendered. The viewer is now bootstrapped on attach and renders the session as it changes. (Showing a fully static/idle screen the instant you attach is a separate future enhancement — live view currently fills in with on-screen activity.)
• The 'monitored live' banner no longer blocks clicks. It's now a compact top-center indicator that lets clicks pass through to the session, so the target's own window controls (e.g. the close button) stay reachable.
• Remote-desktop sessions render at 100% scale. On high-DPI displays (e.g. a Retina Mac) the session was rendered at 200%, making icons and text oversized.

Fix

• Installing or re-pairing a connector now pulls the latest connector image first. docker run <image>:latest reuses a locally-cached latest and won't fetch a newer build, so a host that had run an older connector could silently start a stale image (it showed up as "Outdated" in the console even on a fresh install). Install and re-pair commands now docker pull before running; the update command already did.

Fix

• Sites are now always listed on the Sites page, even when the only connector is revoked. Previously a revoked connector's sites were hidden behind the "add a connector first" message, so they could be neither edited nor deleted — and the connector couldn't be removed either (it still had sites attached). The empty-state message now only appears when there genuinely are no sites.

Live view of active remote-desktop sessions

Watch an in-progress RDP/SSH/VNC session in real time from the console, and take control when you need to step in.

What's new

• Live sessions page. A new Live sessions view (under Monitoring) lists every in-progress remote-desktop session — who, which site, protocol, and how many people are watching.
• Watch live. Click Watch to see the vendor's screen as it happens, from the moment you join (no history — the screen fills in as they work). Read-only: admins and auditors can watch.
• Take control (admins). An admin can take over an active session — the vendor's input pauses and the admin drives the screen — then release control back. Every watch, take, and release is written to the tamper-evident audit trail.
• Transparency banner. The vendor is shown a clear notice while their session is being monitored, and a stronger notice when an administrator has taken control.

Notes

• Watching requires a console role (Admin/Operator/Auditor); taking control requires Admin.
• No screen buffer is kept — live view starts from the moment you attach. Start-to-finish playback with a seek bar is the separate Recordings feature.
• No schema change. The shipped Caddy front proxy now routes the gateway WebSocket endpoints to the data-plane out of the box (native gateway + live view work without extra proxy tweaks).

Native remote-desktop session recording

Remote-desktop (RDP/SSH/VNC) sessions can now be recorded and replayed in the console — no external recorder, no separate storage. When a site has Record sessions on (and recording is enabled), the session is captured as it happens and appears under Admin → Recordings alongside web recordings.

What's new

• Native session capture. The manager tees the live remote-desktop stream and stores it, so recordings work even when the gateway runs on a remote connector host — nothing is stranded on the far side.
• In-console replay. Open a recording and play it back with a seek bar and duration, right in the browser. The recordings list now shows a type badge (RDP / SSH / VNC / WEB) so console and web sessions are easy to tell apart.
• Encrypted at rest. Native recordings are encrypted (AES-256-GCM) in the database with your existing ENCRYPTION_KEY.
• Recording-consent gate. If Require recording consent is on, vendors see a one-screen "this session is recorded — continue?" notice before connecting, and the acknowledgement is written to the tamper-evident audit trail.
• Reused controls. Retention (recordingRetentionDays) and admin deletion (audited) already cover the new recordings — nothing extra to configure.

Notes

• Gated by RECORDING_ENABLED + the per-site Record sessions toggle. A new optional RECORDING_MAX_BYTES (default 500 MiB) caps a single recording; past the cap, capture stops but the session continues.
• Live viewing of an in-progress session is a separate upcoming release; this one replays sessions after they end.

Schema change — the deploy runs access-migrate and updates the manager and data-plane.

Native remote-desktop gateway — one command, no separate pack

Remote-desktop access (RDP/SSH/VNC) is now fully native. The old Guacamole web-app pack (deploy/gateway/ — the Guacamole UI, its Postgres, header-auth and json-auth handoff) is retired. There is nothing extra to stand up and no second login for vendors.

What changed

• Bundled session engine. When you flag a connector as a gateway host, its install/update command now also deploys the session engine (guacd) on that host, creates the shared captivo-gateway network, and provisions the recording volume — one command deploys both the connector and the gateway.
• Native Open. Opening a Remote desktop site from My access goes straight to the in-Captivo session — streamed in the browser, recorded natively. No Guacamole interface, no password prompt.
• Simpler site model. Sites are either a Web app (transparent proxy) or a Remote desktop (native RDP/SSH/VNC configured right in the manager: protocol, host, port, and vault credentials).

Upgrading an existing gateway host

Re-run the gateway-host connector command once from Admin → Connectors — it brings up captivo-guacd and rejoins the network. The manager's GUACD_ADDR default is now captivo-guacd:4822; existing installs that pin another guacd address keep working unchanged. The old cap-guacamole / gateway Postgres containers and any GUAC_JSON_SECRET_KEY env can be removed by hand.

No schema change in this release.

What's new in v0.17.2

Add a remote desktop as easily as a web app. The site form now asks for a type:

• Web app — proxy an internal web app (public hostname + internal address), as before.
• Remote desktop — a native RDP/SSH/VNC target: just pick the protocol and enter the host, port, username, and password. No Guacamole to configure, no public hostname. The vendor lands in the session inside Captivo and never sees the password (it's stored encrypted and injected server-side).

The target credential is now part of the remote-desktop site form itself (the separate 'Vault credential' section is gone). Editing a site opens the full-page editor.

What's new in v0.17.1

Native HTML5 gateway (Pro — off by default). Isolated RDP/SSH/VNC sessions now render directly inside Captivo — no separate Guacamole login, no Guacamole UI. A vendor clicks Open on a gateway site and lands full-screen in the session; the target credential is injected into the connection server-side and never reaches the browser.

• Powered by our own guacd tunnel (the browser speaks to Captivo's data-plane, which drives the guacd handshake and relays the session).
• Reuses the credential vault for the target credential and time-boxed grants + audit for access control.
• Enable with NATIVE_GATEWAY=1 (plus GUACD_ADDR pointing at guacd through the connector). With it off, gateway sites use the existing flow.

Site editing opens the full-page editor (which also surfaces the Vault credential section) instead of a modal.

What changed

• New: Native session page + guacamole-common-js client + NATIVE_GATEWAY gate
• New: Data-plane guac-tunnel (auth + descriptor + handshake + relay)
• New: Manager descriptor API + data-plane client
• New: Guacamole protocol encode/parse + connect builder (VERSION echo)
• New: Connector guacd raw relay + tunnel frame

What's new in v0.16.0

Credential vault for gateway sessions (Pro — off by default). For isolated RDP/SSH/VNC gateway sites, you can now store the target credential encrypted in Captivo and have it injected into the session automatically — the vendor connects without ever seeing the password and without logging into the gateway.

• On a Gateway site, set the target protocol/host/port/username/secret under Vault credential (write-only — the stored secret is never shown again).
• The vendor's Open drops them straight into the recorded session.
• Enabled with VAULT_ENABLED=1 plus a shared key between Captivo and the gateway (GUAC_JSON_SECRET_KEY). With it off, gateway sites work exactly as before (manual login). See the gateway README.

Nothing changes for existing deployments until you turn it on.

What's new in v0.15.0

Choose which notification emails you get. Under Policy → Email notifications, each notification type now has an on/off switch:

• Site up / down — email admins when a site becomes unreachable or recovers
• New access requests — email admins when a vendor requests access
• Access decisions — email the vendor when their request is approved or declined

All are on by default. Turning one off stops those emails; the in-console notification bell and the outbound webhook are unaffected.

Vendors now hear back by email. When you approve or decline an access request, the vendor who asked is emailed the outcome — closing the loop instead of leaving them to check the console.

What's new in v0.14.0

External anchor for the audit log (RFC 3161). You can now have Captivo timestamp your audit log's tamper-evident chain with an external Time-Stamp Authority once a day. This pins the log's history to an independent, signed timestamp — so it can't be back-dated even by someone with full database access.

• Turn it on under Policy → External anchor and point it at any RFC 3161 TSA (a public one like https://freetsa.org/tsr, a commercial one, or your own). Off by default.
• On the Audit page, see the last anchor, verify all stored timestamps against the live chain, and download each proof as a .tsr file to verify independently with standard tools (openssl ts -verify).
• Runs daily via a background job and never blocks anything — failures are retried on the next run.

What's fixed in v0.13.51

Long verification errors stay inside the card. On the Directory (and other Last verified panels like SMTP and SSO), a long failure message now wraps neatly below the status instead of spilling outside the card.

What's new in v0.13.50

Favorite your sites. On My access, click the star on any site to pin it to a new Favorites section at the top of the page — handy when you have access to many sites. Your favorites are remembered in your browser.

Tidier filters. The Audit log and Recordings filters now sit in a single compact row instead of a tall vertical stack, freeing up screen space so you see more results.

Page header icons. Every console page now shows an icon next to its title, for a cleaner, more professional look that's easier to scan.

Clearer directory errors. When a domain controller doesn't have LDAPS/StartTLS enabled, the directory connection test now says so in plain language and tells you how to fix it — instead of the cryptic "TLS handshake failed: EOF".

What changed

• Fixed: Kill mobile horizontal overflow via overflow-x:clip (no more pinch-zoom; sticky header stays intact)

What changed

• New: CA cert import for secure LDAPS, UPN/DOMAIN bind, group match by name

What changed

• Fixed: Pin sidebar footer via scrollable nav (long nav no longer cuts off identity); new mark on auth panel
• New: Modernize connector detail (card subtitles, defrow overview, teal telemetry), sites (card hover), form polish
• Fixed: Sidebar footer identity block (avatar + name/role + icon logout) on navy
• Fixed: Stacked setting rows lay the control below the label (webhook, allowlist)
• New: Modern setting-row primitives + Policy page refactor
• New: Enterprise-security reskin (navy shell, verified-teal accent, new mark)

Rolls up the v0.13.33 → v0.13.46 series: a full build-out of the console Policy page, Zero-Trust access controls, connector observability, cron automation, and a batch of reliability fixes. Every operational setting that used to require an environment variable is now managed from the UI (the env var stays as an initial default; the UI value wins).

Added

Policy page (/admin/policy) — console-wide, live-editable

• Session limits — idle timeout, maximum lifetime (now also governs the login cookie), and a concurrent-session cap.
• Zero-Trust source-IP allowlist — restrict vendor access to published sites to specific networks (IPv4/IPv6 CIDRs). Evaluated against the real client IP from your front proxy, so it can't be bypassed by forging X-Forwarded-For; the admin console itself is never gated.
• Maximum grant duration — every grant must have an end date and can't exceed the cap: no standing, never-expiring vendor access.
• Retention — audit log and session recordings are auto-trimmed by scheduled jobs (each deletion is audited).
• Recording consent gate, notification webhook, invitation-link lifetime, and a fleet default connector log level.
• Settings that used to be environment variables — AUDIT_RETENTION_DAYS, INVITE_TTL_HOURS, NOTIFICATION_WEBHOOK_URL, RECORDING_CONSENT_REQUIRED, SESSION_TTL_HOURS — now live here.

Connector observability & control

• Live telemetry and a recent-log tail on each connector's detail page.
• Log level set from the console and pushed live — per-connector, plus a fleet default with "Use default" / override / "Reset all connectors". Turn on per-request debug logging to troubleshoot, then back off, without a redeploy.
• Request-level logging — egress denials, upstream errors, and slow dials (rate-limited so a broken site can't flood the log).
• Per-connector egress policy that can only further tighten a connector's local ALLOWED_TARGETS.

Other

• Per-site clipboard control — block copy-out, paste-in, or both on a transparent site.
• Automatic cron setup — deploy/setup.sh now schedules the maintenance jobs (health checks + retention) for you, and the Policy page warns if a scheduled job appears to have stopped, so a retention policy can't silently do nothing.

Fixed

• Admin action buttons — revoke / delete / edit on Grants, Sites, Connectors, Recordings, Sessions, and Users were unresponsive; fixed (and guarded against recurrence).
• Connector fail-fast — a site addressed as http:// on a TLS-only port (e.g. Proxmox 8006) now fails quickly with a clear error instead of hanging ~30s, and the Sites form warns about the mistake up front.
• Session cookie length now follows the session policy, not just the environment default (a short "max lifetime" no longer left a longer-lived cookie behind).
• Quieter connector logs — removed a benign but noisy idle-connection message.