v1.0.3

v1.0.3 — Bug fixes

Fixed

• WSS transport port conflict — Removed StartWSServer call in server.go that tried to bind on the same port as the TCP control listener (9090). WSS is now correctly served through the HTTP/HTTPS proxy (8080).
• -tags notunnel was non-functional — registerTunnelCommands was defined but never called. Tunnel/exec/noise-keygen commands are now properly excluded from transfer-only builds via cli_tunnel.go (//go:build !notunnel).
• MCP server version always showed vdev — Makefile build-mcp used -X cli.Version=... but the MCP binary reads main.Version. Fixed to target main.Version.
• skink exec produced empty output — The execCmd function lost the 2-byte big-endian length prefix when moved to cli_tunnel.go. The server's handleDataStream expected [2-byte len][payload] but received raw EXEC|cmd, reading EX (0x4558) as a bogus length. Fixed to match the data stream protocol.

Changed

• src/cli/cli.go — Removed tunnel/exec/noise-keygen command definitions and handler functions (moved to cli_tunnel.go). Removed unused imports (os/signal, syscall, yamux).
• src/cli/cli_tunnel.go — New file (//go:build !notunnel). Contains tunnel client commands + handlers.
• src/cli/cli_notunnel.go — Updated registerTunnelCommands signature to single arg.
• src/tunnel/server.go — Removed conflicting StartWSServer call.
• src/tunnel/AGENTS.md — Documented WSS transport architecture.
• Makefile — Fixed build-mcp ldflag target.

Verified

• 248 tests pass (16 packages)
• Cross-compile: linux/darwin/windows × amd64/arm64 (6 targets)
• Live relay: TCP, HTTP, UDP, SOCKS5, Private, QUIC tunnels all established
• skink exec correctly returns error: exec disabled on this relay (exit 255)
• MCP server builds with correct version string
• -tags notunnel binary shows only send + relay (no tunnel/exec/noise-keygen)