v1.3.168

New Features

feat(relay): staggered reconnect — host 10s, mobile 30s on relay restart (3b863483)
- Relay shutdown now sends role-specific retry_after_ms: host gets 10s, mobile gets 30s. Ensures host reconnects first to rebuild room state from SQLite before mobile tries to resume. Host's relay_client parses retry_after_ms from WebSocket close reason and honors it as first reconnect delay.

fix(mobile): snapshot_reset overlay — missing _resumeCompleted guard (e8e5a01a)
- snapshot_reset from relay reconnect triggered full-screen overlay after resume. Third and final trigger path for the per-message sync overlay bug.

fix(tui): sysIDCounter data race (a023ae4c) — non-atomic increment from concurrent goroutines, changed to atomic.AddInt64
fix(lanchat): UDP path passes wrong callback args + bypasses @agent approval (4aa2b511) — handleNickChangeData passed wrong oldNick/newNick; UDP message path bypassed @agent approval flow entirely
fix(config): keys.env read-modify-write race (5220c1f9) — concurrent WebUI API key updates overwrote each other, added file lock
fix(webui): handleMCP GET handler races with POST/DELETE (3c4be86e) — early RUnlock before iterating MCPServers slice
fix(auth): issuerURL data race + JWT exp bypass (ad1a44da) — validateOpaqueToken read issuerURL without lock; validateJWT skipped expiry check when exp missing
fix(plugin): ForceReauth nested RLock deadlock (0f9c77fe) — Info() re-acquired RLock causing deadlock when writer waiting

fix(tunnel): Close() doesn't stop active share session (b2b49632) — relay WebSocket goroutine leaked on desktop close during active share
fix(stream): resize recreates encoder causing concurrent broadcaster pipe reads (f115127f) — terminal resize orphaned old broadcaster which read from new encoder's stdout
fix(harness): merge conflict leaves repo stuck + retry doesn't clean old worktree (0b8d5b5b)

fix(agent): speculator cache serves stale content after file edits (5aa71c32) — pre-executed read_file results cached before edit served as stale after edit
fix(hooks): matchTool slice out of range panic on malformed pattern (1168f991) — pattern "edit_file(" caused panic
fix(diff,extract): OOM/stack overflow/decompression bomb protection (d0b1e523) — LCS table O(m*n) memory capped; nested archive recursion depth tracked; tar decompression bomb limited to 200MB; EPUB total output capped at 50MB

fix(util): StripANSI regex misses CSI sequences with intermediate bytes (67fabf96) — DECSTR soft reset and cursor style sequences leaked into command output

fix(plugin): gRPC plugin loses env vars (0f9c77fe) — cmd.Env set without os.Environ() base, child process lost PATH/HOME