Changelog

    New features, improvements, and fixes shipped to ActiveLens.

    Summary Templates, Teams, and Playbook engine

    • •Summary Templates: system/client/user-tier templates driving summary generation, dedicated Templates area in sidebar, prompt preview for admins, All/Shared tabs and tier grouping.
    • •Teams: user grouping for assignment and reporting, Users/Teams tabs, team-scoped GET /teams endpoint.
    • •Playbook Engine: server-side CRM auto-execute, enlarge control and AI-refine for prompt fields.
    • •Fixes: transcript editing improvements, notes popper in Meeting Hub table view, Board summary cleanup.

    Meeting participants and live participants

    • •Meeting participants: calendar-source badges, email/source in model, current-meeting recognition endpoint.
    • •Live participants: authoritative roster from calendar invitees, in-call row alignment with post-call view.
    • •Transcript editing localised for English and Hebrew.
    • •Fireflies-style speaker-to-participant matching moved to post-processing.

    Playbook CRM auto-execute and Teams hardening

    • •Playbook CRM: server-side auto-execute on playbook boards.
    • •Teams: GET /teams hardened to admin-only.
    • •Wizard creator: client admins (not only sysadmins) can create wizards.
    • •Live Call button restored to in-call board so actions tab shows the active call.
    • •Call info persisted as board document for finished calls.

    Structured transcripts and Board summary

    • •Structured transcripts: JSON source-of-truth with speaker blocks.
    • •Board summary: repointed server readers to the document, Call status + regenerate + stale-generation guard.
    • •Fixed-header transcript view.
    • •Cleanup of orphaned counterpart objects on format switch.
    • •Pause off-screen CircleSpinner animation to cut idle CPU.

    Playbook engine polish and styles system

    • •Playbook engine: sysadmin Actions page polish, Client/User scope split, fork-on-first-edit fix.
    • •Styles system Phase 2: admin CRUD UIs and auto-generated style menu.
    • •Email and summary step UI rework.
    • •General logs endless scroll with loaded/total badge.
    • •Board polling-driven refetch.

    Calendar integration and Playbook engine

    • •Calendar integration Phase 1–4: CalendarManager provider abstraction, preferences storage with Google OAuth, calendarService orchestrator, provider-agnostic API routes.
    • •Google Contacts integration and invitee suggestions in SET_MEETING.
    • •Playbook engine Phase 11 in-call mode for desktop board tab.

    Playbook engine Phase 1–3 launch

    • •Playbook Engine Phase 1: schema additions.
    • •Phase 2: system-level playbookEngine flag.
    • •Phase 3: playbook-engine lambda with generateDraft worker mode.
    • •New "My Actions" experience for client-scoped playbook page.
    • •Prettier reformat across playbook files.

    CRM UI polish

    • •CRM substep UI polish, sync card status on partial completion.
    • •Hold CRM UI on completed FIND substep so record card stays visible.
    • •Fan out CRM search across profiles with unified display-field policy.
    • •Refactored playbook engine to UUID schema IDs.
    • •Confidence-gated server auto-execute for CRM UPDATE.

    CRM Profiles and Salesforce provider

    • •CRM Profiles + Registry admin UIs.
    • •Monday adapter for CRM engine.
    • •Salesforce CRM provider with OAuth2 auth handler.
    • •Per-profile CRM executionPlanOverride.
    • •OPERATION substep type for non-field CRM verbs.
    • •Text-based manual search and display field auto-discovery.
    Security

    April 2026 security hardening

    • •Scheduled security-hardening release closing all High and Medium severity findings from the 2025 external security review by our independent reviewer, Analyst LTD. No service disruption, no customer action required.
    • •Prompt-injection detection: input-classification layer before every LLM call to detect and reject prompt-injection patterns; every rejection audit-logged.
    • •Session management: HttpOnly and SameSite=Strict on session cookies.
    • •Content Security Policy: tightened frame-ancestors and inline execution.
    • •HTTP security headers: HSTS, X-Content-Type-Options, Referrer-Policy, Permissions-Policy applied consistently.
    • •Middleware: redirect-URL validation to prevent open-redirect abuse.
    • •Cognito: event-payload logging trimmed to prevent sensitive attribute leakage.
    • •PII handling: additional redaction before third-party LLM calls.
    • •Audit log: additional coverage for LLM calls (provider, model, outcome, latency).
    • •Rate limiting: per-tenant throttling refinements on high-cost endpoints.
    • •Access control: additional tenant-isolation test coverage.
    • •Customer data handling, sub-processor list, and privacy commitments unchanged.

    Data retention, audit logging, CRM engine

    • •Data retention: customers can now configure per-tenant retention windows for conversation transcripts, summaries, and recordings through tenant settings. Defaults unchanged (90d transcripts, 30d recordings).
    • •Audit logging: authentication events, user-management actions, and sensitive endpoints now write to a dedicated audit log with tenant identifier, actor, action, and outcome.
    • •CRM engine refactored to per-operation provider architecture.
    • •Meeting Hub active-worker setting surfaces the currently-relevant conversation on incoming calls.
    • •Security & compliance: system-admin password expiration configurable per-tenant, three-layer XSS/HTML-injection prevention across API routes, sensitive endpoints migrated from GET to POST, manager role removed in favour of finer-grained per-permission model.

    Cognito hardening and Amplify updates

    • •Cognito: temporary debug logging added to trigger for password expiration investigation.
    • •Password expiration policy with per-client configuration.
    • •Amplify.yml: CLOUDWATCH_LOGS_REGION and CSP_ALLOWED_FRAME_ORIGINS added.
    • •Meeting Hub phone search: single-row display for popper.
    • •Fix for macOS appcast XML not updating on re-upload.
    • •XSS/HTML injection prevention across API routes.

    Manager role, RBAC and Amplify config

    • •Added canViewOtherUsersData permission and made user-role cookie httpOnly.
    • •Data retention: minimum days lowered to 1, app_id added to log.
    • •Audit logging added to API routes and to authentication/user-management actions in middleware.
    • •Security headers implemented in middleware with redirect URL validation.
    • •Added and later removed manager role after evaluation.

    Style templates and admin features

    • •Ability to see style templates of other users for admins.
    • •Summary step reset button visibility fix.
    • •Temperature setting for desktop activity analyzer.
    • •Timezone selector per wizard flow.
    • •Added contacts phone number to wizard additional context.
    • •Meeting Hub search: default behaviour for system admins now shows all clients.

    MFA and Cognito improvements

    • •Multi-factor authentication: mandatory MFA logic for administrative accounts.
    • •Password recovery: forgot-password workflow with temporary password (shorter validity, first-login change required).
    • •Fix for mandatory/optional MFA logic that occasionally asked accounts to re-enrol unnecessarily.
    • •Cognito Setup MFA via email code/secret logic.
    • •Google OAuth page fix.

    Salesforce and monday integration

    • •Salesforce integration: basic setup and OAuth flow with consent screen.
    • •monday integration: pushing notes to linked items with mirrored fields view.
    • •Coach me reply logic enabled via client-level settings.
    • •Small monday and salesforce integration updates.
    • •Wizard link table view with notes support and MUI X Data Grid Pro.

    Bulk wizard delete and full-screen wizards

    • •Bulk wizards delete UI.
    • •Full-screen wizards in search results on desktop.
    • •Meeting Hub phone-number search improvements.
    • •Tiptap extensions packages for email step HTML tables support.
    • •Trello auth flow fix, icon update.
    • •Meeting Hub search scroll fix.
    • •Salesforce integration basic setup.

    monday.com integration launch

    • •monday.com integration: client-level configuration is now available with per-client credentials and board mappings.
    • •Additional field types supported; suggested values appear for status fields during item creation.
    • •Google OAuth sign-in: edge case where callback occasionally failed after idle session resolved.
    • •Added copy buttons to summary, email and meeting steps.
    • •Salesforce integration added OAuth flow.