nightly-20261025

What's Changed

• chore: update LATEST.json for nightly-20261024 by @github-actions[bot] in #4132
• feat(secret,store): versioned value cipher and database encryption policy fence by @ptone in #4128
• util: build readRegularFilePrefix on Windows by @ptone in #4134
• tunnelclient: read and count the current session under one lock by @ptone in #4137
• project storage phase 4: attachments on artifact transport; scratchpad projection through the authority by @ptone in #4092
• fix(apiclient): always execute the initial request by @Ravshan04 in #4053
• fix(apiclient): close request bodies when prepare fails by @Ravshan04 in #4060
• fix(apiclient): reject non-2xx JSON responses by @Ravshan04 in #4057
• test(keyring): build the FIFO refusal test only on unix by @ptone in #4136
• Chat: open a conversation with unread messages at the New messages divider by @ptone in #4135
• hub: route the attachment projection source scan through the guarded scan helper by @ptone in #4140
• util: describe the identity check in openLstatVerified precisely by @ptone in #4142
• uploads: read collected files through the shared transfer helper by @ptone in #4143
• agent, runtime: refuse metadata block mode under host networking on cloud hosts by @ptone in #4124
• config, agent: configuration papercuts by @ptone in #4141
• cli: templates sync and push accept a template directory path by @ptone in #4146
• Template cache clones authenticate through the scoped credential helper by @ptone in #4144
• test(web/e2e): agent-owned artifact access journey (R1-B) by @ptone in #4153
• cli: start and resume name the environment values sent to the hub by @ptone in #4148
• fix(hub): delete the run the broker holds on a run-mismatch delete by @ptone in #4058
• Chat: star messages privately and list them per conversation (phase 1) by @ptone in #4149
• Tear down the shared worktree and sharer entry on a hosted agent delete by @ptone in #4020
• remotefetch: leave the log time out of the URL masking test checks by @ptone in #4154
• chat-app: return an error for a Secret Manager response with no payload by @ptone in #4162
• runtime/cloudrun-sandbox: watch restored sandboxes, log failed execs, name the requested image on run failure by @ptone in #4059
• Hub Runtime Broker records by @ptone in #4163
• remotefetch: report a fetch that runs out of time as a timeout by @ptone in #4164
• util: test that host git runs no hooks on Windows by @ptone in #4155
• fix/hub-chat-participant-fixes by @ptone in #4161
• docs: follow-through for 2026-10-23 changelog by @ptone in #4152
• gh:// skills: read files and modes from the git tree (ptone#5781) by @ptone in #4150
• feat(hub): delegated grant lifecycle cascades and message attribution (ptone#2132) by @ptone in #4166
• feat(sciontool): delegated credential exchange and socket helper (ptone#2132) by @ptone in #4167
• hub: admit the delivery credential through a recorded-chain admission walk by @ptone in #4169
• release: weekly preview roll-forward workflow by @ptone in #4123
• fix(release): pick highest patch then preview number in bump/promote scripts by @ptone in #4126
• single-node-vm: bind the bootstrap hub start to loopback on fresh deploys by @ptone in #4172
• runtimebroker: check a forced move's rollback by the delete's sharer key by @ptone in #4158

Full Changelog: nightly-20261024...nightly-20261025