# gstack 1.68.2.0 — Revoking a paired agent now revokes everything it holds

- Product: gstack (https://whatsnew.fyi/product/gstack)
- Vendor: gstack
- Date: 2026-08-20
- Version: 1.68.2.0
- Original notes: https://raw.githubusercontent.com/garrytan/gstack/main/CHANGELOG.md
- Permalink: https://whatsnew.fyi/product/gstack/releases/1.68.2.0

What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog.

Reuse: the summaries, labels and curation here are © What's New. Quote freely with attribution and a link back; wholesale republication of the corpus is not permitted — terms: https://whatsnew.fyi/terms. The vendors' own release notes remain their publishers'.

---

- **fixed** — Revoking a paired agent now revokes everything it holds
- **fixed** — RevokeToken deletes ALL tokens for a client id including the session and spent and pending setup keys
- **fixed** — DELETE /token with a pending setup key now deletes all 3 tokens instead of the session surviving
- **fixed** — Revoked agent reconnecting via leftover key now returns 401
- **fixed** — tunnel revoke now works and verifies against /agents
- **fixed** — Second DELETE for the same agent now returns 404 instead of 200
- **fixed** — Bare --restrict now errors with hard error exit 1 instead of silent FULL access
- **added** — GET /agents lists pending unexchanged setup keys marked pending
- **added** — DELETE /token responses carry tokens_deleted and the daemon logs the count
- **changed** — The CLI always sends an explicit scopes list and both CLI and server reference one exported DEFAULT_PAIR_SCOPES constant
- **changed** — Scope-denied 403 hint now recommends re-pairing without --restrict or with --control

Revoking a paired agent now revokes everything it holds, and the documented kill switch is real: tunnel revoke deletes, then proves it.
RevokeToken deletes ALL tokens for a client id: the session plus spent and pending setup keys.
DELETE /token with a pending setup key now deletes all 3 tokens instead of the session surviving.
Revoked agent re-connects via leftover key now returns 401.
$B tunnel revoke now works and verifies against /agents.
Second DELETE for the same agent now returns 404 instead of 200 again.
Bare --restrict now errors with hard error exit 1 instead of silent FULL access.
GET /agents lists pending unexchanged setup keys marked pending.
DELETE /token responses carry tokens_deleted and the daemon logs the count.
The CLI always sends an explicit scopes list; both CLI and server reference one exported DEFAULT_PAIR_SCOPES constant.
Scope-denied 403 hint recommends re-pairing without --restrict or with --control.
Pair-agent/SKILL.md, REMOTE_BROWSER_ACCESS.md, and ARCHITECTURE.md document the real default, --restrict, and the tunnel allowlist nuance.