Voltius v0.26.0

Added

• Share a terminal with anyone, not just teammates. The share menu's new People
  tab finds teammates as you type, and anyone else by their @handle or full
  email address. The invite is the request: the person gets a notification
  with Join, Decline and Block permanently, and joining is one tap. A host can
  withdraw a pending invite — which frees the guest seat instead of holding it
  until the session ends — and the guest cap is visible while inviting. People
  you invited recently are remembered across your devices, carried in your
  encrypted sync blob rather than stored on the server.
• Every account has an @handle. It shows in the account menu with a copy
  button, avatars fall back to two-letter initials from it, and Settings can
  claim or rename a custom one — all it takes is a verified email address.
  Choosing a custom handle is what makes you findable by people outside your
  teams; the handle you start with already works for anyone you give it to. A
  toggle controls whether people outside your teams may invite you at all.
• The MCP server gained the settings, account, plugin-management and
  marketplace domains: an agent can read and change settings, read your
  subscription, install and manage plugins, browse marketplace sources, export
  and import vault objects, and read a team's server-side audit log. Each
  domain sits behind its own permission and writes audit rows. The ssh-config
  sync is now exposed as an MCP tool.
• Terminal appearance gained line-height, cursor-style and cursor-blink
  settings, and they sync across devices.

Removed

• The display-name editor is gone. A handle is the single name Voltius shows
  for a person, everywhere.

Fixed

• Sharing a local shell relayed nothing — guests joined a permanently blank
  terminal. Input and output now flow both ways.
• Your email address is no longer sent over the session WebSocket, where every
  participant could read it; a stranger admitted by a knock previously learned
  everyone's real address.
• A stranger sees no session name until they accept, so a mis-aimed invite
  leaks a handle rather than a hostname, and a knock is labelled from the
  server's record of who sent it rather than a name the sender chose.
• Session and vault keys are wrapped to the recipient's current public key,
  fixing invites that failed for someone who had signed in on another device.
• A rate-limited sign-in reported "Account not found", sending people off to
  create a second account they did not need.
• Settings pulled from another device no longer bounce straight back as a push.
• Closing the window during a shutdown sync could cancel the exit, or close a
  window you had just reopened.
• The cursor keeps blinking under persistent tmux and screen sessions, and the
  GNU screen fallback gets TrueColor.
• The account dropdown no longer waits on a network handle lookup before it
  opens, and signing out clears the cached handle.
• The session guest cap is applied consistently — in the invite-to-session
  menu, in the direct-invite roster, and across the setup-to-active flip.
• Numerous MCP corrections: tighter permission gates on the settings, account
  and team-audit surfaces, audit rows that no longer carry more than they
  should, and stores refreshed before an export reads them.