# gstack 1.68.3.0

- Product: gstack (https://whatsnew.fyi/product/gstack)
- Vendor: gstack
- Date: 2026-08-20
- Version: 1.68.3.0
- Original notes: https://raw.githubusercontent.com/garrytan/gstack/main/CHANGELOG.md
- Permalink: https://whatsnew.fyi/product/gstack/releases/1.68.3.0

What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog.

Reuse: the summaries, labels and curation here are © What's New. Quote freely with attribution and a link back; wholesale republication of the corpus is not permitted — terms: https://whatsnew.fyi/terms. The vendors' own release notes remain their publishers'.

---

- **changed** — Re-pairing a browser agent to narrow its access now revokes the old access immediately
- **changed** — Revoking an agent releases the tab ownership it held
- **changed** — DELETE /token runs the release unconditionally and reports tabs_released
- **changed** — A reducing re-pair revokes the client's live session and releases its tabs before minting the new key, with the response carrying superseded
- **changed** — Non-reducing re-pairs keep the session and only drop stale pending setup keys
- **changed** — A narrowing re-pair issued before the agent connects invalidates the earlier, broader setup key
- **security** — root is rejected as a clientId at every token writer to prevent a scoped token from carrying the sentinel that bypasses scope, domain, rate, and tab checks

Re-pairing a browser agent to narrow its access now revokes the old access on the spot, revoke frees the agent's tabs, and root is a reserved client name.
A reducing re-pair revokes the client's live session and releases its tabs before minting the new key; the response carries superseded. Non-reducing re-pairs keep the session and only drop stale pending setup keys.
A narrowing re-pair issued before the agent connects invalidates the earlier, broader setup key.
Revoking an agent releases the tab ownership it held; DELETE /token runs the release unconditionally and reports tabs_released.
root is rejected as a clientId at every token writer, so a scoped token can never carry the sentinel that bypasses scope, domain, rate, and tab checks.