- Root is now a reserved client name
- Revoke now frees the agent's tabs
- POST /pair no longer leaves the agent's original full-access session alive after pairing with restrictions
- Revocation now releases tab ownership so re-paired agents do not inherit the previous agent's authenticated tabs
- Prevent --client root from minting a scoped token that skips scope, domain, rate, and tab checks
From gstack
Revoke frees the agent's tabs, and root is a reserved client name. Tightening a paired agent is supposed to be one re-pair away. It wasn't. POST /pair minted a fresh setup key but never touched the agent's live session, so pair-agent --client codex --restrict read against an agent that had already connected (or whose new 5-minute key simply expired unexchanged) left the original full-access session, eval included, alive for up to 24 hours. Revocation also never released tab ownership, so an agent re-paired under the same name inherited the previous one's authenticated tabs. And because root is the sentinel the scope, domain, rate, and tab checks use for the omnipotent caller, --client root minted a scoped token that skipped all of them.