v0.8.7-beta.5

Account sharing

• Revoking a share now takes effect on running sessions. Before, account.revoke removed the share, but the recipient's running sessions kept the owner's login until someone stopped them. Now each of those sessions moves to another account its launcher may use. If it can't move (no other account can run the agent, fallback is off, or the session is paused), it stops and shows the reason: account share revoked: <owner> revoked access to their account; .... Retained sessions can't reopen on a revoked account. (#724)
• Recipients can get a login copy without the owner's refresh token. Opt in per account with aether-server serve --session-login-accounts <member-id>,... or aether-server config set session-login-accounts .... A recipient's claude or codex session on a listed account mounts a read-only copy that holds the access token but never the refresh token, so the session can't copy, log out or overwrite the owner's login. The server refreshes the owner's login centrally and updates every copy, and a revoke signs the copies out. Nothing changes for an account you don't list, and the owner's own sessions keep the real login. See docs/security.md. (#725)

Android

• Push notifications through UnifiedPush. The Android app can now notify you when a session needs you. Install a UnifiedPush distributor such as ntfy, then turn on Settings → Notify this device when a session needs me. Assistant cards get Review…, and in Tailscale mode Decline (Android 12+, after an unlock). The distributor must be reachable at a public address. See docs/networking.md. (#730)

Fixes

• A card's notification is now replaced with the right text when the card is decided shortly after a server start. Before, the replacement could lose the card's summary. (#794)

CI and test hardening: Windows desktop build and update smoke (#791, #792, #793), dashboard end-to-end tests (#788, #789, #790).

Full changelog: v0.8.7-beta.4...v0.8.7-beta.5