- Re-pairing a browser agent to narrow its access now revokes the old access immediately
- Revoking an agent releases the tab ownership it held
- DELETE /token runs the release unconditionally and reports tabs_released
- A reducing re-pair revokes the client's live session and releases its tabs before minting the new key, with the response carrying superseded
- Non-reducing re-pairs keep the session and only drop stale pending setup keys
- A narrowing re-pair issued before the agent connects invalidates the earlier, broader setup key
- root is rejected as a clientId at every token writer to prevent a scoped token from carrying the sentinel that bypasses scope, domain, rate, and tab checks
From gstack
Re-pairing a browser agent to narrow its access now revokes the old access on the spot, revoke frees the agent's tabs, and root is a reserved client name. A reducing re-pair revokes the client's live session and releases its tabs before minting the new key; the response carries superseded. Non-reducing re-pairs keep the session and only drop stale pending setup keys. A narrowing re-pair issued before the agent connects invalidates the earlier, broader setup key. Revoking an agent releases the tab ownership it held; DELETE /token runs the release unconditionally and reports tabs_released. root is rejected as a clientId at every token writer, so a scoped token can never carry the sentinel that bypasses scope, domain, rate, and tab checks.