Captivo Access sürüm notları — 2026 · Sayfa 8 / 13

Clipboard for remote-desktop sessions

Copy and paste text between your machine and an RDP / SSH / VNC session.

• Automatic (Chrome/Edge): copy in the remote app and paste locally, or copy locally and paste into the session — it just works, like a native remote desktop.
• Manual panel (any browser, incl. Firefox): press Ctrl+Alt+Shift to open a clipboard panel. Paste text into it and click Send to session, or read the remote clipboard from it and copy it out. No browser permission needed.
• Respects each resource's clipboard policy — Block copy out and Block paste in are enforced in both directions.
• Text only; to move images or files, use file transfer.

Fixes — remote-desktop file transfer

• Uploads no longer corrupt large files. Files sent to a remote-desktop session over ~12 KB could arrive with a 6 KB block missing from the middle, silently corrupting images, archives and other binaries. Files now transfer byte-for-byte intact.
• Downloads now work. Dropping a file into the session's Download folder now reliably downloads it in your browser (previously the transfer started but the file never arrived).

Fix — file transfer

• Upload — uploaded files are no longer truncated (the transfer stream is now properly finalised, so the whole file arrives intact).
• Download — hardened the browser download trigger for files pulled from a remote-desktop session.

Fix

On remote-desktop (RDP/SSH/VNC) resources the Clipboard control now lives under Advanced (Guacamole) — where it belongs, since it's enforced by the session engine. Web-app resources keep it as a top-level field (an in-browser deterrent).

Console polish

• Policy page — settings are now grouped under clear section headings (Access & grants, Session recording, Audit log, Network & security, Notifications, Connectors) instead of one long list.
• Resources — the "← Back" link on a resource edit page now reads "Back to resources", and the Clipboard hint explains that on remote-desktop resources the restriction is enforced by the session engine (a real control), while on web apps it's an in-browser deterrent.
• Fixes: the file download that was cancelled before it started now completes (remote-desktop sessions).

What changed

Fixes and refinements — see the changelog below for details.

What changed

• Fixed: Defer download blob URL revoke so the browser download isn't cancelled

File transfer for remote-desktop sessions

Vendors can now move files in and out of a remote-desktop session:

• Upload — drag a file onto the session window and it lands on the remote drive (RDP) or over SFTP (SSH).
• Download — a file placed in the session's Download folder (RDP) or fetched over SFTP streams straight to the vendor's browser.
• Controls — enable file transfer, and optionally block upload and/or block download, as a Policy default and per-resource override.
• Isolation — each RDP session gets its own private drive folder; one vendor never sees another's files, and old folders are cleaned up automatically.

VNC has no file transfer (unsupported by the protocol). No configuration or data migration is needed.

> Gateway hosts: re-run your connector's Update command (from its detail page) to pick up the new connector image and the file-transfer drive volume.

Configurable Guacamole connection parameters (remote desktop)

Remote-desktop (RDP/SSH/VNC) resources can now be tuned with a curated set of Guacamole connection parameters, set as global defaults on the Policy page and overridden per-resource (the resource value wins):

• Keyboard layout (RDP) — e.g. Turkish-Q, German, French — so the remote session matches the vendor's keyboard.
• Colour depth (RDP/VNC) — 8 / 16 / 24-bit, to trade quality for bandwidth.
• RDP visual toggles — desktop wallpaper, window theming, font smoothing, full-window drag (off by default for bandwidth).

Each field can be left on Default to inherit the Policy value.

Also: the Clipboard control (Allow / Block copy-out / Block paste-in / Block both) now applies to remote-desktop resources too, not just web apps.

Only a curated allowlist of parameters is accepted — arbitrary values can't be injected. This is a manager + data-plane update with an additive schema migration (applied automatically on deploy).

Gateway session fixes

• RECORDED badge now stays visible on remote-desktop (RDP/SSH/VNC) sessions. It was being cleared when the session display initialised; it now has its own layer.
• Recording consent is asked once per browser session for remote-desktop resources, matching how web-app sessions already behaved — instead of prompting on every connection. (Still gated by the Require recording consent Policy setting; cleared when the browser closes.)

Fix

The RECORDED badge now stays visible on remote-desktop (RDP/SSH/VNC) sessions — it was being cleared when the session display initialised.

Recording indicator on remote-desktop sessions

Recorded remote-desktop (RDP/SSH/VNC) sessions now show an always-on ● RECORDED badge in the session window — the same visible indicator web-app sessions already had. This makes the "recording in progress" cue consistent across both session types.

Note: whether the vendor also sees a one-time "This session is recorded" acknowledgement before connecting is still controlled by the Require recording consent setting on the Policy page.

Fix

Renamed the last few user-facing "Sites" → "Resources" labels missed in the earlier rename: the connector revoke notice, the Recordings/Audit filters, the directory group-mapping label, and the "Resource health" panel link.

Fix

Restored Gateway logs capture with guacd 1.6.0 — the engine's new startup wrapper had bypassed our log collection, leaving the connector's "Gateway logs" card empty.

Remote-desktop engine updated

The bundled gateway engine (guacd) was upgraded to 1.6.0. To pick it up on an existing gateway host, re-run that connector's Update command from its detail page.

Fixes

• Recording playback — web-app session replays now scale to fit their card instead of overflowing the page.
• Resources list — remote-desktop (gateway) resources now show their internal target (host:port), matching how web apps display their internal address.

Fix

Fixed a crash that made the admin dashboard fail to load ("Something went wrong") after v0.25.0. The interactive chart drill-down now works correctly.

Interactive dashboard charts

The dashboard charts are now interactive:

• Drill-down — click a Top vendor or Top resource bar to open the audit log pre-filtered to that vendor or resource; click a day on the Access trend to see that day's audit entries.
• Rich heatmap hover — hovering a cell on "When vendors connect" now shows a styled tooltip (day, hour, and access count) and highlights the cell.
• Interactive sparklines — hovering the Denials / Active-vendors sparklines shows the value at that point.
• Polish — charts animate in, and the hovered bar or donut slice highlights.

Wording/behaviour only — no configuration or data change, and everything adapts to light and dark themes.

"Sites" is now "Resources"

Captivo Access started as a way to reach internal web apps, but it now also brokers remote desktops (RDP/SSH/VNC). To match, the console and docs now call these Resources instead of "Sites":

• The left-nav Resources section, the page title and headings, and the "Configured resources" list.
• Every cross-reference — the Resource column on Grants, Audit, Live sessions, Recordings, Notifications, and a connector's detail page; the "Resource health" dashboard panel; the command palette; and the directory group-mapping "Resource access" option.
• All labels, hints, empty states, and confirmation prompts that mentioned a "site".
• The README and docs (how-it-works, quickstart, install).

This is a wording change only — the same feature, same setup, same URLs. No configuration or data is affected.

Also in this release

• Fixed the spacing between the dashboard charts and the Resource-health / Recent-activity panels below them.

Redesigned dashboard — interactive charts

The admin dashboard has been rebuilt around a cleaner KPI strip and a bento of interactive charts:

• KPI strip — Connectors, Resources, Active grants, Sessions now (with the longest-running), Denials (30d) and Active vendors (30d), the last two with inline sparklines.
• Access — 30 days — a stacked allowed-vs-denied bar chart. Hover any day for exact counts, and click a legend item to toggle a series (e.g. hide Denied to focus on allowed traffic).
• When vendors connect — the day × hour heatmap, now with hover detail.
• Deny reasons and Access type mix (Web vs Remote) — donut charts.
• Top resources and Top vendors — interactive bar charts.
• Session activity — recordings, hours captured, and average length over 30 days.
• Attention — IP-diversity flags, grants expiring in 7 days, and the top denied vendors.

Everything is real data from existing tables — no schema change, manager-only update. Charts adapt to both light and dark themes.

Dashboard Insights

The admin dashboard now shows a visual Insights section below the stat cards, turning your audit trail into at-a-glance security and operations analytics (last 30 days):

• Access (30 days) — a daily allowed-vs-denied bar chart, so a spike in denials is obvious at a glance.
• When vendors connect — a day × hour heatmap (UTC) that lights up where access actually happens, making off-hours activity easy to spot.
• Top resources and Top vendors — which apps get reached most, and who reaches them most.
• Attention panel — total denials with the top reasons, IP-diversity flags (vendors seen from an unusually high number of distinct IPs — a possible account-sharing signal), grants expiring in the next 7 days, and how many sessions are active right now (with the longest-running one).

All server-rendered, no new dependencies. Manager-only update — no schema change.

What changed

• New: Auto-fill the default port per protocol + rename Type to 'Remote session'

What changed

• Fixed: Move the Type selector above the type-specific fields

Improved

• Remote-desktop (RDP/SSH/VNC) sites now show real reachability. Their target is TCP-probed through the connector, so the Sites page shows Reachable/Unreachable and the dashboard "Sites reachable" count includes them correctly — no more false warning from gateways that were previously never checked. "Test connection" works on gateway sites too, and site up/down alerts now cover them.

Fix

• Console actions now record the client IP (and user agent) in the audit log. Live-view watch, take/release control, recording deletion, and recording consent previously showed no IP on the audit page. They now capture the requester's address from the front proxy.