Product update: what gets re-checked, and what gets written down

A token's reach follows its owner's current permissions, revoking a sign-in closes the terminals it opened, and the workspace writes up each period's activity.

Access is granted once and used many times after. The trouble lives in the gap: a token still carrying a role its owner lost, a shell still running behind a credential that is already dead.

Two of the changes below close that gap. A third writes down what happened, period by period. Alongside them are improvements to the terminal, session sharing, file transfers and the CLI.

A token cannot reach further than the person who issued it

Every time an API token is used, its permissions are worked out against what its owner is allowed to do at that moment. Take away someone's role and their tokens narrow on the next call. No reissue, no waiting period. The owner is told which access went away.

A new token starts from the access whoever issued it holds, not from a blanket set of permissions.

Widening an existing token's scope raises an approval request. The wider scope applies only once someone approves it.

Each workspace sets a maximum lifetime no API token can exceed, under Policies > Server access. Your own tokens are under Profile menu > My API tokens, where each one lists the scopes it carries, with the actions granted on each resource, alongside the commands and servers it is allowed to reach. Creating and rotating tokens is Essentials or higher; managing the ones you already have stays on Free.

The workspace writes up what happened

Sessions are recorded as they happen, one work unit at a time. Audit > Activity reports adds the view across a period: commands, sessions and AI usage summarized for a day, a week or a month, with anything worth attention raised as a finding.

Reports arrive on a cadence rather than on request, generated just after the window closes. Filter the list by period and by whether anything happened in it. Each report says how many findings came out of it and how many still wait on a reviewer.

The numbers are fixed when the report is made. The screen says so in as many words: every value on it is what the report was generated with, and nothing is recalculated when you open it. Commands verified, approved and rejected, how many an access rule would have matched, the servers touched, the spread across risk levels, all of it stays as it was.

Ending a sign-in ends the terminals it opened

Revoking a sign-in now reaches the session it opened, not only the credential. A revoked sign-in, a password change or a deleted MFA factor closes the browser terminals and file transfers that sign-in started, so cutting off an account and closing what it had open are one action.

Only those: a colleague working in the same shared session stays connected.

The person cut off is told why. A work session that expired, completed or was revoked, and a deactivated account, are each named instead of all reading as an administrator closing the session.

Sign-ins are listed under Profile menu > Security. On the hosted service, revoking one signs the account out on every device rather than the one you picked.

Also shipped

• A browser terminal survives a restart on our side. It hands over to the replacement, reconnects on its own, and replays the output it missed. The command-line terminal has no handover and ends cleanly instead.
• Shared sessions put participants in a panel over the terminal. Select one for their permission, join time, client and IP address, and the owner can switch them between Read only and Writable without ending the session. Session sharing is Essentials or higher.
• Websh has an in-terminal settings panel. Theme, clipboard behavior, Ctrl-C handling, multi-line paste confirmation, Option-as-Meta, scrollback, and the terminal bell are saved to your account and follow you across workspaces.
• Live activity is now a table, with each session's risk band, the last thing that happened, and a badge saying whether the requester is a person or an agent.
• From Alpamon v2.5.1, file transfers run under the requesting user's own account. A folder download can only contain what that user is allowed to read, and everything an upload creates belongs to them.
• Windows servers reachable through a tunnel now accept terminal and console sessions.
• Alpacon CLI updates itself with alpacon update, and alpacon update --check only reports whether an update exists. Where a package manager installed the binary, the command tells you how to upgrade there instead of overwriting it.
• alpacon exec --wait now watches the approval on the command it already submitted rather than resubmitting it every few seconds.
• This release includes security improvements. We recommend that customers with self-hosted deployments update.

Behavior changes

Changing your password or deleting an MFA factor now closes the browser terminals and file transfers opened by the sign-ins it revokes. On the hosted service that reaches every device, because a password change or a removed factor signs you out everywhere. Finish or hand off long-running work first.

Self-hosted deployments should take the proxy update before the server one. On an older proxy a revocation closes the whole session rather than only the channels that sign-in opened.