v1.6.6

v1.6.6: Zombie WebSocket fix, smarter Reconnect

Zombie WebSocket fix

When a mid-path TCP drop killed the WebSocket, the Guacamole client stayed stuck in CONNECTED forever. Tab looked frozen, no overlay, mouse moved locally but clicks went into a closed socket. Upstream Client.js doesn't subscribe to tunnel.onerror / onstatechange; the Apache webapp wires those externally. Our lean client.html missed that glue. Fixed.

Reconnect actually reconnects

The Reconnect button on the disconnected overlay used to just reload the dead session URL, which walked straight back into the same overlay. It now POSTs a fresh /connect against the original Connections entry and navigates to the new session. Ad-hoc and shareToken paths fall back to /connections.html. Bonus: client.onerror now clears the thumbnail upload interval, so the secondary leak of XHR 404s against a dead session id stops the moment the overlay shows.

Other polish

• OIDC discovery errors: trailing-slash mismatches now produce a single actionable line instead of raw openidconnect Debug output. Generic provider, not just JumpCloud.
• contrib/setup-xrdp-gfx.sh now adds xrdp to ssl-cert and normalises key.pem perms, fixing the FreeRDP MAC-checksum failure after a sid rebuild.
• Aurora theme now applies when [theme] is absent in config.toml, not just when it's present-but-empty.
• New docs/reverse-proxies.md covering nginx / Caddy / Apache / Traefik, including the %2F-decoding gotcha that 404s nested folder paths. Thanks @mauroparente (#105).

Dependencies

• rustls-webpki 0.103.13 (RUSTSEC-2026-0104: CRL-parse panic + URI excluded-subtree fix)
• rustls 0.23.39, russh 0.60.1, libc 0.2.186

RustCrypto batch (aes 0.9, cbc 0.2, hmac 0.13, pbkdf2 0.13) and rand 0.10 deferred to v1.6.7 (#117).