- CLI properly forwards tunnel revoke to the daemon instead of treating it as an unknown command
- tunnel revoke command now works as documented and properly revokes remote agents
- revokeToken now deletes all tokens matching an agent's name instead of only the first one
- spent setup keys are no longer prioritized in deletion, preventing leftover unspent keys from creating new sessions for revoked agents
- DELETE /token/ now correctly returns an error status when the token cannot be deleted instead of returning 200 for failed revocations
From gstack
The documented kill switch is real: tunnel revoke deletes, then proves it. Revoking a remote agent was broken twice over. revokeToken deleted only the first token matching the agent's name, and the spent setup key kept for connection retries always sat first in line. So DELETE /token/ returned 200 while the live session kept working, a leftover unspent setup key could mint a brand-new session for a revoked agent (inside the key's 5-minute validity), and a second DELETE returned 200 again. Meanwhile the documented way out, $B tunnel revoke, did not exist: the CLI forwarded it to the daemon as an unknown command. The pairing docs also promised a read+write sandbox three releases after pairing deliberately switched to full page access.