Bastillion Files

🎬 Session audit & replay — now a first-class feature, on by default

Every terminal session is now recorded and can be replayed from Audit Sessions in the UI — who ran what, where, and when, side by side for sessions that spanned multiple hosts, with a text filter to jump straight to the lines that matter.

This feature existed behind enableInternalAudit but was experimental: reviewing a session loaded its entire output into the browser in one shot, which hung the tab on any session with real output. That's fixed properly:

• Output streams from the database to the browser and renders incrementally — sessions with hundreds of megabytes of terminal output replay without breaking a sweat
• Fixed a server-side cleanup loop that was quadratic in session size and could spin a request thread forever when output contained a backspace at the start of a line
• Full ANSI/VT100 control sequences (colors, cursor movement, screen modes, window titles) are now stripped from replayed output — no more [?1049h noise from top and friends

Practically every compliance framework has a privileged-access audit-trail requirement somewhere — PCI DSS, HIPAA, SOC 2, ISO 27001 — and this checks that box without a commercial PAM product.

Upgrade note: enableInternalAudit now defaults to true on fresh installs; existing installs keep whatever their persisted config says. Retention is deleteAuditLogAfter (90 days by default); disable recording entirely with ENABLE_INTERNAL_AUDIT=false. If you scripted against the old getJSONTermOutputForSession.ktrl endpoint, it's replaced by the streaming streamTermOutputForSession.ktrl (plain text, one line per record).

🔒 Hardening

• CSRF token comparison is now constant-time

📦 Dependencies

• Bouncy Castle bcprov-jdk18on 1.84 → 1.85
• JUnit Jupiter 6.1.1 → 6.1.2