v1.68.3.0 fix(pairing): re-pair to narrow revokes the old grant on the spot

POST /pair minted a new setup key but never touched the agent's live
session, so re-pairing --client X --restrict read while X was connected (or
whose 5-min key expired unexchanged) left the original full-access session,
eval included, alive up to 24h.

A reducing re-pair (fewer scopes, tighter domains, lower rate, stricter tab
policy) now revokes the live session and releases its tabs before minting
the new key (grantReducesAccess + revokeClientFully; superseded in the
response). Non-reducing re-pairs keep the session and only drop stale PENDING
setup keys, so a broaden/refresh never strands a working agent and a
narrowing re-pair issued before the agent connects can't leave the old broad
key exchangeable. Revoke happens before mint (revokeToken deletes all of a
client's tokens). CLI prints a version-skew-safe supersede notice and warns
when a re-pair-shaped call omits --client. Docs + CHANGELOG + VERSION.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

pair-agent/SKILL.md

@@ -1102,6 +1102,13 @@ With --restrict (`--restrict read`, `--restrict "read,write"`):
   a trusted agent can be prompt-injected by pages it reads, and scope caps the
   blast radius (eval works over the tunnel).
 - `--restrict` never grants `control`; that scope stays behind --control.
+- To tighten an agent that is ALREADY paired, re-pair it with the **same
+  `--client` name** and the narrower `--restrict`/`--domain`. A reducing re-pair
+  revokes the previous session immediately and releases its tabs — the agent
+  must reconnect with the new key, so the old wide access does not linger.
+  Re-pairing without `--client` mints a brand-new agent and leaves the old one
+  untouched. Broadening or refreshing keeps the working session (no outage).
+- `root` is a reserved `--client` name (it would bypass all scope enforcement).
 
 With --control (--admin is the legacy alias):
 - Everything, plus browser-wide destructive ops (stop, restart, disconnect)
@@ -1112,8 +1119,9 @@ With --control (--admin is the legacy alias):
 **"Tab not owned by your agent"** — The remote agent tried to interact with a tab
 it didn't create. Tell it to run `newtab` first to get its own tab.
 
-**"Domain not allowed"** — The token has domain restrictions. Re-pair with broader
-domain access or no domain restrictions.
+**"Domain not allowed"** — The token has domain restrictions. Re-pair with the
+same `--client` name and broader (or no) `--domain`. A broadening re-pair keeps
+the working session; a narrowing one revokes it immediately.
 
 **"Rate limit exceeded"** — The agent is sending > 10 requests/second. It should
 wait for the Retry-After header and slow down.

pair-agent/SKILL.md.tmpl

@@ -287,6 +287,13 @@ With --restrict (`--restrict read`, `--restrict "read,write"`):
   a trusted agent can be prompt-injected by pages it reads, and scope caps the
   blast radius (eval works over the tunnel).
 - `--restrict` never grants `control`; that scope stays behind --control.
+- To tighten an agent that is ALREADY paired, re-pair it with the **same
+  `--client` name** and the narrower `--restrict`/`--domain`. A reducing re-pair
+  revokes the previous session immediately and releases its tabs — the agent
+  must reconnect with the new key, so the old wide access does not linger.
+  Re-pairing without `--client` mints a brand-new agent and leaves the old one
+  untouched. Broadening or refreshing keeps the working session (no outage).
+- `root` is a reserved `--client` name (it would bypass all scope enforcement).
 
 With --control (--admin is the legacy alias):
 - Everything, plus browser-wide destructive ops (stop, restart, disconnect)
@@ -297,8 +304,9 @@ With --control (--admin is the legacy alias):
 **"Tab not owned by your agent"** — The remote agent tried to interact with a tab
 it didn't create. Tell it to run `newtab` first to get its own tab.
 
-**"Domain not allowed"** — The token has domain restrictions. Re-pair with broader
-domain access or no domain restrictions.
+**"Domain not allowed"** — The token has domain restrictions. Re-pair with the
+same `--client` name and broader (or no) `--domain`. A broadening re-pair keeps
+the working session; a narrowing one revokes it immediately.
 
 **"Rate limit exceeded"** — The agent is sending > 10 requests/second. It should
 wait for the Retry-After header and slow down.