diff --git a/.release-please-manifest.json b/.release-please-manifest.json
index dd32f2b9..b4f0aee9 100644
--- a/.release-please-manifest.json
+++ b/.release-please-manifest.json
@@ -1,3 +1,3 @@
 {
-  ".": "0.1.32"
+  ".": "0.1.33"
 }
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 6c7015dc..e1a52dc3 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,339 @@
 # Changelog
 
+## [0.1.33](https://github.com/langwatch/kanban-code/compare/v0.1.32...v0.1.33) (2026-10-08)
+
+
+### Features
+
+* **activity:** keep a card working while its subagents are ([4319c7d](https://github.com/langwatch/kanban-code/commit/4319c7d0d6939b73e4316fd5dd854a4798838c7c))
+* **agents:** a codex session carries the agent's name ([56a02c0](https://github.com/langwatch/kanban-code/commit/56a02c07cd65b05223529e8e54960cd993a9ceca))
+* **agents:** a codex session carries the agent's name ([1eb32a3](https://github.com/langwatch/kanban-code/commit/1eb32a38a4df2faae0819fbcef14b28cdf63aea2))
+* **agents:** name sessions in LangWatch, and stagger boot launches off the credential race ([143a23e](https://github.com/langwatch/kanban-code/commit/143a23e254efa0f32d3ecd66b98623356ca6537f))
+* **agents:** name sessions in LangWatch, and stagger boot launches off the credential race ([3d54f35](https://github.com/langwatch/kanban-code/commit/3d54f3598163674934fdc20fd432270dd014c9d2))
+* **app:** boxd mode in settings, launch dialogs and card lifecycle ([cfeaa51](https://github.com/langwatch/kanban-code/commit/cfeaa516a3f59f047ece5abe244f895a3290fe4e))
+* **app:** title first in the new task dialog and a note on the boxd worktree ([adf870f](https://github.com/langwatch/kanban-code/commit/adf870fb99bbbb50ee93b29929d8e99321e41320))
+* **attention:** a rush session blocked on a tool call raises a permission request, from the needs rush reports ([d67156d](https://github.com/langwatch/kanban-code/commit/d67156d484e624db00ea8e32c8b4e803ded8949f))
+* **attention:** AttentionRequest entity, state and reducer actions ([51e3e4f](https://github.com/langwatch/kanban-code/commit/51e3e4fc49a37561736fed01a44cb9468af821af))
+* **attention:** detect pending decisions and escalate them Mac first, phone later ([88a1441](https://github.com/langwatch/kanban-code/commit/88a1441b2dd7f8be7e4dc4d5e37f815f269d173a))
+* **attention:** raise decisions from sessions and deliver them on the Mac, the phone and the API ([c36ac5d](https://github.com/langwatch/kanban-code/commit/c36ac5db7d9655b6be3e2ecb73e09b055061afb2))
+* **boxd:** bring a machine back on focus, and keep the others in standby ([7a00170](https://github.com/langwatch/kanban-code/commit/7a00170db0030285dba12e7936e493f47d99d587))
+* **boxd:** keep the assistant logins of the Mac and the machines in sync ([b2e220d](https://github.com/langwatch/kanban-code/commit/b2e220df15bf5187f9f341a8a4e1900240e0db6d))
+* **boxd:** leave the machines running on quit and sleep, and keep the Mac awake for local sessions only ([736de8c](https://github.com/langwatch/kanban-code/commit/736de8cd16ea9432b81faf442872d72da971124c))
+* **boxd:** machines park themselves, every pause becomes a stop ([fbf3298](https://github.com/langwatch/kanban-code/commit/fbf3298dd344ee35398ff84a0085c713b5fb57fd))
+* **boxd:** one action to bring a paused machine back, over the transcript ([cea1d15](https://github.com/langwatch/kanban-code/commit/cea1d15bfcb34ec670212aa0f566f6ae4b51b8be))
+* **boxd:** one idle window of 30 minutes for every machine ([742bc80](https://github.com/langwatch/kanban-code/commit/742bc80b0cae6cfa8dcdafc86c35bcda9d256702))
+* **boxd:** open the card of a machine from the pill, and pay only for a look ([544dabd](https://github.com/langwatch/kanban-code/commit/544dabd18eed2f0fcbb16e8202ef671926cecf38))
+* **boxd:** report transcript push progress ([4846938](https://github.com/langwatch/kanban-code/commit/48469384fdd4fe937b4ad5ad7eecdb0ff853ab7d))
+* **boxd:** show a notice when a machine is destroyed ([429f4ee](https://github.com/langwatch/kanban-code/commit/429f4eef22c60906a18e760bd997fa34f9fb6254))
+* **boxd:** stop the machine when the terminal tab is closed ([3601812](https://github.com/langwatch/kanban-code/commit/36018121496b80741eacfb1b696806e1b87f37af))
+* **boxd:** tell an account switch and a login taken from a machine ([56bd3d0](https://github.com/langwatch/kanban-code/commit/56bd3d0a84920dd8fcd81c3f2d9fe6815fb65448))
+* **boxd:** tell the terminal that the machine is coming back ([d2907b8](https://github.com/langwatch/kanban-code/commit/d2907b8e1c4a994cc32d64e8914133fd0b048c7c))
+* **chat:** /btw and /catchup side chat panel on the Mac and iOS ([5795431](https://github.com/langwatch/kanban-code/commit/57954310c216fc499da03ce9075e3addcaa604af))
+* **chat:** /catchup reopens the last catch-up while the session has nothing new ([6f3fe5a](https://github.com/langwatch/kanban-code/commit/6f3fe5a7905830b400715f0e2c7460b8cca5669e))
+* **chat:** jump through history without parsing or mounting it ([a106871](https://github.com/langwatch/kanban-code/commit/a1068711db818f20bb78e92a1a0e474e2e409241))
+* **chat:** side chat engine for /btw and /catchup, and the record of what the human typed ([3a2c57b](https://github.com/langwatch/kanban-code/commit/3a2c57ba02366e95e15edff04ee845fa865992ca))
+* **chat:** slash command list in the chat composer on the Mac and iOS ([44250b1](https://github.com/langwatch/kanban-code/commit/44250b13c66d91e76fb16c50d005b896827afc1e))
+* **chat:** stand a finished run of tool calls behind one line ([95d5cc2](https://github.com/langwatch/kanban-code/commit/95d5cc2319412da69b4be7963993ec6590c45cc3))
+* **cli:** agents.yaml host: rush runs a Claude agent on a rush host that moves between signed-in accounts ([53cf853](https://github.com/langwatch/kanban-code/commit/53cf853af53e8602d3999669ef673fd9c2d55f52))
+* **cli:** kanban export prints a whole session as the app's Markdown ([201fcee](https://github.com/langwatch/kanban-code/commit/201fceeffe6a1c2eb8b040ee950747299f725fa7))
+* **cli:** kanban remote drives a Mac's Kanban Code from other machines and agents ([a36cf00](https://github.com/langwatch/kanban-code/commit/a36cf002f7764bcbb4452dc8f8232f753bf2ac7d))
+* **cli:** kanban vault runs kv with the same arguments and exit code ([dc10dfb](https://github.com/langwatch/kanban-code/commit/dc10dfbc02741857de8e99f40788d1eba56103ea))
+* **cli:** kv owner and kv audit check, with the owner-only vault docs and the cleanup script ([98cc0db](https://github.com/langwatch/kanban-code/commit/98cc0dbb574484e4ff56f59600d016f1f1cf716f))
+* **cli:** route rush cards through rush, falling back to agtop ([4debecc](https://github.com/langwatch/kanban-code/commit/4debecc2ccdc11977600c1628f3095a77344eac5))
+* **cli:** run channel commands on the channels home and hand foreign cards to their master ([d1ef9f6](https://github.com/langwatch/kanban-code/commit/d1ef9f6570628ff4fccbc0e664bcc09ba63b5ffe))
+* **cli:** subagent and parent DMs go to the channels home on a paired machine ([6bef5d9](https://github.com/langwatch/kanban-code/commit/6bef5d91140d6e6604cb804108bda6bf7da25041))
+* **discovery:** headless runs in a globally excluded folder are not tracked ([394c6df](https://github.com/langwatch/kanban-code/commit/394c6df97dcfc995696523ec37355c9efb7b5b9b))
+* **ios:** a Needs you list to answer agents' questions, plans and approvals ([a026028](https://github.com/langwatch/kanban-code/commit/a0260281ff6d74bc117d4b7a56d08c8cb728ee33))
+* **ios:** apply board deltas from /v1/events and collapse long columns ([377837a](https://github.com/langwatch/kanban-code/commit/377837a221e3f834a6aade03ed1ffffef1481a4f))
+* **ios:** Kanban Code for iPhone, a remote control for the Mac app ([4ab2f08](https://github.com/langwatch/kanban-code/commit/4ab2f088cbcae000f8a75462ed41223942f6db79))
+* **ios:** Live section on top, project filter per Mac, compact PR badges ([b13e684](https://github.com/langwatch/kanban-code/commit/b13e684f2342770f6eb07582c540e46b8fb8a12c))
+* **ios:** markdown tables in chat messages show as a grid ([71aeca5](https://github.com/langwatch/kanban-code/commit/71aeca53b117eeafc0fb821dce3030f460eafe62))
+* **ios:** new composer, drafts, images, queued prompts, selectable chat, terminal scroll ([bb0a4c9](https://github.com/langwatch/kanban-code/commit/bb0a4c9e9ad83e92231888638a5adc4286b8b959))
+* **ios:** one board over every paired master, with a primary, per-card routing and a machine picker ([a902852](https://github.com/langwatch/kanban-code/commit/a90285219fe3485a7e3c58912dd401973af239f4))
+* **ios:** queued prompt menu and composer stash ([c14b289](https://github.com/langwatch/kanban-code/commit/c14b2898b61babcf13c0d4f34e9fd85ff306ecc3))
+* **ios:** reinstall the app on a connected iPhone when it expires or changes ([c2bf803](https://github.com/langwatch/kanban-code/commit/c2bf803c6abf4b462d70a8cc9a6819a862710029))
+* **ios:** search finds archived and older cards on the masters, and the archived cards screen has a search field ([5a8c73e](https://github.com/langwatch/kanban-code/commit/5a8c73e0f33a004541b6f74ebbcac78399a623de))
+* **ios:** the refresh job also installs over Wi-Fi when the phone is awake ([832498c](https://github.com/langwatch/kanban-code/commit/832498c9c43688b8164b99c13459ae8bf34f8036))
+* **ios:** touch and hold a card for its actions ([9f146cf](https://github.com/langwatch/kanban-code/commit/9f146cf8102754d400f587cd61c144edde0cb79f))
+* **kv:** kv add and kv tier take --every-use-asks and --leases ([8524bdb](https://github.com/langwatch/kanban-code/commit/8524bdbb65235e34f226e46909669e5397956f9d))
+* **kv:** refuse reasons a human cannot read on a phone, teach agents to write one plain sentence, and add secret labels ([fc4008c](https://github.com/langwatch/kanban-code/commit/fc4008c2af5e3c3253d3e9f816509197e495a8c9))
+* **master:** every master answers subagent commands, one keeps the channels and one polls pull requests ([b67590a](https://github.com/langwatch/kanban-code/commit/b67590a7c34c3956d9c13ed16f1152f1bbe089a9))
+* **master:** master engine in Core, box-owned cards and handovers between masters ([921f933](https://github.com/langwatch/kanban-code/commit/921f933818ec95e5e7be8c2bef9a9c6e3f270873))
+* **palette:** offer every card action of the card menus for the open card, read from one catalog the menus render too, and add Unarchive ([b33125e](https://github.com/langwatch/kanban-code/commit/b33125ee60f27d0f509f5c169339df55ee9e38ef))
+* **remote:** a card used from the phone keeps the Mac awake for 10 minutes, and the phone's side chat says when the machine is offline ([6defbfa](https://github.com/langwatch/kanban-code/commit/6defbfaf21ca3e32e47cfd40f65dd933cd0f8b8c))
+* **remote:** agtop cards queue and send through agtop ([427c8b6](https://github.com/langwatch/kanban-code/commit/427c8b6248829c1d6c85b86d5c39312bb2c81544))
+* **remote:** an ssh machine that runs a paired master is one machine, and cards run there are owned by it ([0f27121](https://github.com/langwatch/kanban-code/commit/0f27121dd694f8a1fedbf6c04b52daedb50144fb))
+* **remote:** board and events default to the working set, all=1 for every card ([9381c69](https://github.com/langwatch/kanban-code/commit/9381c698af16ed158bc6a0d08712a62cac874e19))
+* **remote:** boxd machine core, bridge, mirror and supervisor ([4bb27ca](https://github.com/langwatch/kanban-code/commit/4bb27ca0d154b5b47c71d70d45c11060aa2b9cf3))
+* **remote:** cards and boards name the master that owns them ([8d6da17](https://github.com/langwatch/kanban-code/commit/8d6da176efdd280dd041015ae45eb935a1ee0dd4))
+* **remote:** cards on an ssh machine run on its agtop, in truecolor ([7ae46b7](https://github.com/langwatch/kanban-code/commit/7ae46b71016e116b46d0e1a7e92f5da4a876789b))
+* **remote:** contract for driving Kanban Code from a phone and other agents ([58c026b](https://github.com/langwatch/kanban-code/commit/58c026bb04ded29835a392bba8658f58b47e31e6))
+* **remote:** events send card deltas after the first board, resync on request ([6bfcbb7](https://github.com/langwatch/kanban-code/commit/6bfcbb7f0cb10123b0d87409720ceeb6c0c4705b))
+* **remote:** gzip responses over 8 KB for clients that accept it ([0b178b0](https://github.com/langwatch/kanban-code/commit/0b178b016d5135f26948d3d45e62976265e24642))
+* **remote:** HTTP and WebSocket server for remote control ([4641d24](https://github.com/langwatch/kanban-code/commit/4641d24b615a6f89547c3959628cb1ba73c876f1))
+* **remote:** images on prompts and tasks, queued prompt actions, terminal scroll ([0b2adce](https://github.com/langwatch/kanban-code/commit/0b2adcef2adbdd340180e8877e5c2475d9b30036))
+* **remote:** kanban remote show names the machine that runs the card ([ffcb2fb](https://github.com/langwatch/kanban-code/commit/ffcb2fbaee4e9dea5eb55624fb9de49555824706))
+* **remote:** kanban remote task --machine picks the master that runs the card ([5242ae9](https://github.com/langwatch/kanban-code/commit/5242ae96342c3e8d0f13f6c912174bea4b80e486))
+* **remote:** kanban-code-remote-demo dev server over a fake board ([ba1c5da](https://github.com/langwatch/kanban-code/commit/ba1c5da161f6e126b5cfc1ea98d57bca1023dd42))
+* **remote:** native boxd integration with a per-card cloud machine ([6ac38cb](https://github.com/langwatch/kanban-code/commit/6ac38cbbc5a5db8a371039af7e7c02edbc17040e))
+* **remote:** PATCH /v1/cards/{id} renames, moves and archives a card on any master ([57a590f](https://github.com/langwatch/kanban-code/commit/57a590f693d02e7174118d4f74cbc73399348f52))
+* **remote:** pin, unarchive and delete cards over the remote API ([ccb0ed0](https://github.com/langwatch/kanban-code/commit/ccb0ed0030587a4dc8f699bae2e47fd4a742914f))
+* **remote:** RemoteClient for the remote control API and pair links ([c9461ec](https://github.com/langwatch/kanban-code/commit/c9461ec4171a3e785e40d23bc0157e5fce9e6c75))
+* **remote:** run cards on always-on ssh machines, with a Run on picker and moves between Mac and machine ([1ceb59c](https://github.com/langwatch/kanban-code/commit/1ceb59cefd6c4a63caabf9220b74c053fd43a9ae))
+* **remote:** search every card on the masters, archived and old ones too, and a card brought back stays on the board ([917fb39](https://github.com/langwatch/kanban-code/commit/917fb3966a7b536444fdbb9e1bf69ab2a6268a17))
+* **remote:** the app serves remote control from Settings > Remote Control ([0198c09](https://github.com/langwatch/kanban-code/commit/0198c09b8e69f9ff07f1477f33a88173f14ec22c))
+* run Claude sessions on agtop instead of tmux ([727fc38](https://github.com/langwatch/kanban-code/commit/727fc383e7acdea82f15be50f182cb7573d90445))
+* **rush:** rename the agtop runtime to rush, new hosts are rush-<id> and get claude's absolute path ([f507219](https://github.com/langwatch/kanban-code/commit/f50721915de48cad585e484ab5ab51738be4484f))
+* **rush:** run cards on rush, the renamed agtop, falling back to agtop where only it is installed ([16fba4e](https://github.com/langwatch/kanban-code/commit/16fba4e93ad4a1304335a87e62ba07b7e757abdb))
+* **server:** Linux build of Core and a headless kanban-code-server ([60e58db](https://github.com/langwatch/kanban-code/commit/60e58db6a0de30583643bcf5a67f87a2055ffa57))
+* **settings:** SSH machines is the first remote mode, and each mode shows only its own settings ([844f370](https://github.com/langwatch/kanban-code/commit/844f370ac2ecc7ae22af4b0a83ab9f897449a159))
+* **shortcuts:** archive the open card with cmd+shift+A ([878160b](https://github.com/langwatch/kanban-code/commit/878160b15764c3e7ae6f20636253521d82a0136e))
+* **shortcuts:** rename the open card with cmd+R ([a65f9e8](https://github.com/langwatch/kanban-code/commit/a65f9e8ba993da146ebf131689869826edd57b7a))
+* **slack:** kanban slack post --file attaches files to the message ([51f70bd](https://github.com/langwatch/kanban-code/commit/51f70bd52b17465e61612fe8d9b3adf29301f20d))
+* **subagents:** 5-minute prompt cache and no channel access for children ([4d8b02d](https://github.com/langwatch/kanban-code/commit/4d8b02d69186ef1dfc526fc1935982c82d07aa79))
+* **sync:** hand edits of sync.json apply without a restart, and a clone a peer names starts at once ([88ceabf](https://github.com/langwatch/kanban-code/commit/88ceabf95836a572f9c704e9c8b1f0a420cf8a97))
+* **sync:** peer sync of cards between masters ([81cdf8f](https://github.com/langwatch/kanban-code/commit/81cdf8f9e3ae13cbe7cac77624535fcc94af55bf))
+* **sync:** per-field last writer wins for shared card fields ([356b940](https://github.com/langwatch/kanban-code/commit/356b9404ab8c783fa48860be2b982bc2931f5ac3))
+* **sync:** Settings > Sync keeps git clones, agent files and the OptMem memory the same on every master ([10c7233](https://github.com/langwatch/kanban-code/commit/10c72332f91e2301dbc2284dfa30fd2d0b3fcb4d))
+* **sync:** Settings > Sync keeps named keys of a JSON settings file the same on every master, and an entry can live at another path on a machine ([28c05eb](https://github.com/langwatch/kanban-code/commit/28c05eb815c0462a3ab7b5e066b75c8f1f07094c))
+* **toolbar:** move the card tabs into the actions menu ([33a228f](https://github.com/langwatch/kanban-code/commit/33a228f7226abcc59f9f3a88b4834a058f09093d))
+* **ui:** keep open PR pills next to the card title ([7476232](https://github.com/langwatch/kanban-code/commit/7476232ac84970e436219b7ba5f4e39c68f19c2a))
+* **ui:** let the sidebar grow to 720pt ([77969b6](https://github.com/langwatch/kanban-code/commit/77969b63f5ff6dfbd672de5497dbaf2b55ad2e67))
+* **vault:** a card gets its project's own development secrets without Jev, and Jev is asked once per rules text ([4e6712c](https://github.com/langwatch/kanban-code/commit/4e6712c29acd12d30069895537e5be35eb8aa62a))
+* **vault:** a card session token places processes that left the session's process tree ([1acfbda](https://github.com/langwatch/kanban-code/commit/1acfbda2f6510d37fba61e741db38fa12bebd983))
+* **vault:** a card that runs a command on the other master over ssh is that card there ([79b81ca](https://github.com/langwatch/kanban-code/commit/79b81ca9fcae913ca25ee12fe154eb9d20a07b91))
+* **vault:** a lease time per secret, and the audit log keeps what each use ran ([e4b826b](https://github.com/langwatch/kanban-code/commit/e4b826bf3e0c333d1eb7883f4c8f557c4c2ff40a))
+* **vault:** a linked worktree without its own .env.vault uses the main checkout's ([02c96c0](https://github.com/langwatch/kanban-code/commit/02c96c0c5714e807742b222d7f4ada5bf81057b6))
+* **vault:** a process outside a card gets open secrets with no question and judged ones through Jev, and an approval waits 12 hours ([efdb965](https://github.com/langwatch/kanban-code/commit/efdb965ab12cb0c9001168d159eeee954b3ef5c3))
+* **vault:** age-encrypted vault store, decision engine, Jev judge, broker and STS client ([2e2ccd1](https://github.com/langwatch/kanban-code/commit/2e2ccd16c34772fd617b9cdbd2146b46bd09452c))
+* **vault:** approval notifications say who wants what in plain words, the body is only the agent's reason, and a click opens the card with a detail sheet on the Mac and the phone ([9695369](https://github.com/langwatch/kanban-code/commit/969536919b13cc3885b0bc151c79536083ab7736))
+* **vault:** broker routes on both masters, replica sync, kv CLI, Bash hook and import planner ([62353aa](https://github.com/langwatch/kanban-code/commit/62353aacea7eed98cdec63222cdca363d00569d6))
+* **vault:** daily secret scrubber for transcripts, and a peer scope for paired masters ([3c70e8f](https://github.com/langwatch/kanban-code/commit/3c70e8f5b22e003851bcb2fe7e9df43339a92a87))
+* **vault:** detect secrets pasted into a prompt, ported from LangWatch's redaction rules ([2c254e6](https://github.com/langwatch/kanban-code/commit/2c254e6abb73094614acdd318a3b4a627797042d))
+* **vault:** Jev also reads up to 20 older prompts of the card, shortened, so an early instruction still counts ([b264039](https://github.com/langwatch/kanban-code/commit/b264039421544bcb24b8c8178b3328bb3747141b))
+* **vault:** Jev reads what Rogerio asked the card, apart from the agent's reason and other senders ([d5bca97](https://github.com/langwatch/kanban-code/commit/d5bca97709c643ec7118b605c84963fe2ad2ef70))
+* **vault:** kanban send, subagent send, self-compact follow-ups and agent-scope remote prompts carry a sender marker ([e77873e](https://github.com/langwatch/kanban-code/commit/e77873e610c232a1095455bbb3fb3aeac2ea94a2))
+* **vault:** kanban-vault rush plugin lives in Kanban Code, with make rush-plugins to install it ([7c8902d](https://github.com/langwatch/kanban-code/commit/7c8902d3c895d0c94ebdc540721209c6b34d16a0))
+* **vault:** kv asks and Settings > Most asked count how often each secret asked you, and why ([444104c](https://github.com/langwatch/kanban-code/commit/444104c655bdfea47c77193ac6ec799705dad5a3))
+* **vault:** kv import --only writes .env.vault files under chosen folders ([4e46dfd](https://github.com/langwatch/kanban-code/commit/4e46dfddc5729dbc361d223f235c48776ef3dcf4))
+* **vault:** kv import --secrets-only adds secrets without writing .env.vault files ([00910e1](https://github.com/langwatch/kanban-code/commit/00910e1a74d852c6bf5740b47787522d93ad326a))
+* **vault:** kv scrub --once runs one time in another patterns mode, with vendors left out ([70322e8](https://github.com/langwatch/kanban-code/commit/70322e810caea6548fd60394bdc5f53de9722b3c))
+* **vault:** log each Jev verdict with the prompt evidence it read ([c89d9e3](https://github.com/langwatch/kanban-code/commit/c89d9e3be5853fd0fbf67d68eb2418d17998f67c))
+* **vault:** one approval changes many secrets, picked by name or by a value prefix the master matches (kv tiers) ([a5971f1](https://github.com/langwatch/kanban-code/commit/a5971f1499e4cce79016e47b97838dced43640e4))
+* **vault:** OpenClaw agents get card tiers and leases as openclaw:<agent>, found by the gateway's systemd cgroup, and kv exec-provider serves OpenClaw SecretRefs ([4b3e2a1](https://github.com/langwatch/kanban-code/commit/4b3e2a14301c80a4389c50fc00a89daacd3ece38))
+* **vault:** owner-only secrets sealed to Secure Enclave keys and a recovery key ([91aa56c](https://github.com/langwatch/kanban-code/commit/91aa56cd4e6b761bbeb2477a2b7311d4e25688b2))
+* **vault:** scrubber typed mode saves only the keys the human typed, and replaces them everywhere ([147beba](https://github.com/langwatch/kanban-code/commit/147bebaf6bff163668f2e15cd2bf86646c4b6400))
+* **vault:** secrets have a project and an environment, kv env loads the project's group ([921c970](https://github.com/langwatch/kanban-code/commit/921c9704c11fb5154e6b34d87b6178ee26819164))
+* **vault:** Settings > Vault tab, card vault releases, kv installed beside kanban ([0e15114](https://github.com/langwatch/kanban-code/commit/0e1511483b935cf938f50131c9560db93a295c2a))
+* **vault:** Settings shows the approvals you gave recently, with their lease end ([a7d2246](https://github.com/langwatch/kanban-code/commit/a7d2246d1a4607109b0f7edc72d76595ffcc3576))
+* **vault:** the Bash hook also wraps Codex commands, installed and trusted in ~/.codex ([2981387](https://github.com/langwatch/kanban-code/commit/2981387c28d6e4bda84c83189b6ca755cbcbce3e))
+* **vault:** the chat composer and queued prompt editor offer to save a pasted secret to the vault ([6ee9c3b](https://github.com/langwatch/kanban-code/commit/6ee9c3bb0e04852574ec8d568a0ec8cecdda9984))
+* **vault:** the iPhone composer offers to save a pasted secret through the remote vault API ([fe5c1ce](https://github.com/langwatch/kanban-code/commit/fe5c1cea920600de51a0989576d1e6c4de22deca))
+* **vault:** the rush plugin asks whether to save a secret, then for its name in a line you edit ([ea2f5fa](https://github.com/langwatch/kanban-code/commit/ea2f5fa24eca840a0c0807155c4886e7c0c7be6c))
+
+
+### Bug Fixes
+
+* **activity:** feed hook events to the detector in file order ([3d0fad4](https://github.com/langwatch/kanban-code/commit/3d0fad468221ca035edd565bb4a74cbb6def8ee6))
+* **activity:** keep spinners live through slow reconciles, and survive timed-out shell commands ([2f42982](https://github.com/langwatch/kanban-code/commit/2f429825ab708c7fc376456224d32f7019283f90))
+* **activity:** keep subagent tracking through a compaction ([bba2870](https://github.com/langwatch/kanban-code/commit/bba28701e5c0b36e811f312bdc2e66e833a4e76f))
+* **agents:** a codex agent starts in a workspace it has never seen ([09d9ca2](https://github.com/langwatch/kanban-code/commit/09d9ca2fec1a0671ab1b2f8baf27eabed5369d35))
+* **agents:** a codex agent starts in a workspace it has never seen ([b0f24d2](https://github.com/langwatch/kanban-code/commit/b0f24d22560d1a9dcb628143f03d72a804bc7d7a))
+* **agents:** read the composer before deciding a name was taken ([4fbeb39](https://github.com/langwatch/kanban-code/commit/4fbeb39a343e47f2d3b59b9726f7a746b1634831))
+* **agtop:** a rush session asleep between turns keeps its card's terminal ([7d7cc21](https://github.com/langwatch/kanban-code/commit/7d7cc211adfd9d7d95078de544a6d87314a1ccae))
+* **app:** build the services once so the boxd supervisor reaches the real store, and let an early terminal find its machine ([a9e7372](https://github.com/langwatch/kanban-code/commit/a9e7372277610864d93311b4429ccc7789fcdf71))
+* **app:** dismiss the dialogs with Escape and show every settings tab ([c995687](https://github.com/langwatch/kanban-code/commit/c995687e5c33f18994873bf3335f25f6310d4240))
+* **app:** drop the agent session variables an app launched from a card's shell inherits ([f9e38ef](https://github.com/langwatch/kanban-code/commit/f9e38ef23de6eaa2ee42a89ed53f4796023bfc7d))
+* **app:** keep the launch overlay inside the terminal area, not under the toolbar ([8a47175](https://github.com/langwatch/kanban-code/commit/8a47175bed7aae16f2f244d7dcca7e8ea0f96597))
+* **attention:** a permission prompt for AskUserQuestion or ExitPlanMode raises no second request ([e1b9ccb](https://github.com/langwatch/kanban-code/commit/e1b9ccba2dda2bed3f11ac50210bd610422aefc5))
+* **attention:** a vault approval on the card on screen opens its detail sheet in the app ([d0aa357](https://github.com/langwatch/kanban-code/commit/d0aa3570750bf54e0d3b08cfc05ec4485d2d49c9))
+* **attention:** a vault approval whose sheet is open in front gets no Mac notification on top ([f249a64](https://github.com/langwatch/kanban-code/commit/f249a64b77feb5196b32e15b5f9a74ef3c321ac9))
+* **attention:** a vault sheet closes once its request settles, escalates to the phone after the delay, and the Dock counts every open request ([54e7bbc](https://github.com/langwatch/kanban-code/commit/54e7bbc60de03bdb8b8c381ec1031df222d881ec))
+* **attention:** answers reach rush sessions through rush session answer, the chat's answer buttons use it, and a restart keeps what was delivered ([1ad9051](https://github.com/langwatch/kanban-code/commit/1ad9051152dcfca2a74ffbd57ceeda0d1a6cff39))
+* **attention:** approvals stay seen on the Mac and reach the phone once, with every delivery step logged ([19e1758](https://github.com/langwatch/kanban-code/commit/19e1758f9681770fec89b7c78abbf86133334142))
+* **attention:** carry the open list on board and cards frames, and resolve permissions on conversation lines only ([a103b1c](https://github.com/langwatch/kanban-code/commit/a103b1c702adaf5012b0d0034a8f5a41278ebb60))
+* **attention:** Kanban counts as in front while a dialog has the key window ([ed6c1b9](https://github.com/langwatch/kanban-code/commit/ed6c1b9c6fc99c9b51a403a96ce264d31e02370d))
+* **board:** a card started on another master opens here right away, as a local start does ([e9be575](https://github.com/langwatch/kanban-code/commit/e9be57580682555bfb772138c5847d89de7d8bf5))
+* **board:** a card whose session runs offers no Start, and a turn in it lifts a backlog placement ([a27e612](https://github.com/langwatch/kanban-code/commit/a27e6127722cda26ca2e1f69318fd27e9095f398))
+* **board:** a tall pinned rail scrolls instead of lifting the board ([dcc99d7](https://github.com/langwatch/kanban-code/commit/dcc99d73d24ab089e799fcc77789d326784f2efb))
+* **board:** only a live tmux session revives an archived card ([f63dc72](https://github.com/langwatch/kanban-code/commit/f63dc72126acf5de2d00f53a52d98ec7fca5c328))
+* **boxd:** a changed file in the checkout no longer blocks every launch ([f139cbe](https://github.com/langwatch/kanban-code/commit/f139cbe793336451be61fb2e7fa0a4f9b2c8bd52))
+* **boxd:** a machine that cannot start no longer blocks the card ([1a48eb8](https://github.com/langwatch/kanban-code/commit/1a48eb8fc8171705adf5d895676321731caa6bf8))
+* **boxd:** an account switch made on a machine is kept, the Mac's login no longer replaces it ([1d9789f](https://github.com/langwatch/kanban-code/commit/1d9789f27f859cb6d3081b628ad7f72688aaa076))
+* **boxd:** archiving a card on an ssh machine no longer offers to destroy the machine ([06fec0d](https://github.com/langwatch/kanban-code/commit/06fec0de1b95f29b0be6fdba2ed53449e9dd87c5))
+* **boxd:** attach the terminal through boxd machine connect, create the worktree on the machine only, and stop the spinner of a paused machine ([5987772](https://github.com/langwatch/kanban-code/commit/5987772910bb0c97fe9b6ba5aec7591551f6c514))
+* **boxd:** find the files to copy through git status, open new terminals on the machine, and keep a local resume off the machine ([0419f3f](https://github.com/langwatch/kanban-code/commit/0419f3fbc731c284e855dced2509d10cd63112c2))
+* **boxd:** halt parked machines at Mac sleep and on quit ([c3a221f](https://github.com/langwatch/kanban-code/commit/c3a221f11668012c69d9d6eacc71d8a1fbbb14cd))
+* **boxd:** keep a long launch alive, wait for the remote session, bound the quit pause and sweep orphan machines ([d209e16](https://github.com/langwatch/kanban-code/commit/d209e162b23fb10ca55ea42f97a6ec46986fa86c))
+* **boxd:** keep isLaunching on a card on a machine until its launch reports, and leave an existing remote worktree alone on resume ([4ad33e2](https://github.com/langwatch/kanban-code/commit/4ad33e2e6c2db099910cc16234ed43ee4ef0e072))
+* **boxd:** keep the launch on screen and get the CLI upload through ([8de9e42](https://github.com/langwatch/kanban-code/commit/8de9e42b90d478da5bd5f0e4c4d23378b7deec18))
+* **boxd:** keep the terminal and retry while a machine is out of reach ([db338db](https://github.com/langwatch/kanban-code/commit/db338dbe66480b881db37355b598b862fe14af1f))
+* **boxd:** keep the terminal from waking a paused machine, and follow a machine resumed elsewhere ([f1569ed](https://github.com/langwatch/kanban-code/commit/f1569edd1fa348acfd3a470adb988ca51fccf6d7))
+* **boxd:** keep the transcript skin inside the detail, not under the sidebar ([4d3d4e1](https://github.com/langwatch/kanban-code/commit/4d3d4e188255907f27a0b9398b07c7db5d2dbd8c))
+* **boxd:** leave scroll mode with Esc and paste images into a session on a machine ([ea93bb5](https://github.com/langwatch/kanban-code/commit/ea93bb5f03ba34ee278977a3e54881e811fccee7))
+* **boxd:** map hook event paths before the transcript arrives ([92729c0](https://github.com/langwatch/kanban-code/commit/92729c0fef67016bc684223182d34fc471137445))
+* **boxd:** mirror a rewritten file whole and stamp the CLI with a digest of the bundle ([59d4008](https://github.com/langwatch/kanban-code/commit/59d40088d440091837e9281579d895f15cd1b589))
+* **boxd:** open a new shell tab of a card on its machine ([6262d0a](https://github.com/langwatch/kanban-code/commit/6262d0a49ce5ef3ed8cb2f67b5dbe8b0600f9e12))
+* **boxd:** open the launch dialog with the choice of the last run ([2bb2ab7](https://github.com/langwatch/kanban-code/commit/2bb2ab76e228dcfa7a877a66c870f9bcb69e5466))
+* **boxd:** paste the image path after the upload, keep the native selection, and reconnect a running machine on paste or scroll ([fb63b10](https://github.com/langwatch/kanban-code/commit/fb63b105708543e16348257976b916da113fdd30))
+* **boxd:** push transcript deltas, survive resume races, stop idle machines ([3abeffb](https://github.com/langwatch/kanban-code/commit/3abeffb568d7d79fdd7d1956baf9620fb1d1f891))
+* **boxd:** random worktree name for an unnamed launch and pause on failed preparation ([0ce0757](https://github.com/langwatch/kanban-code/commit/0ce075725613234baa788ed0d543401e64ca09d3))
+* **boxd:** read the pause marker before the terminal connects to a machine ([473cb24](https://github.com/langwatch/kanban-code/commit/473cb2459e0145aee33ce00f60346b72a3f5ad66))
+* **boxd:** resume a card with a large transcript on its machine ([9d5a3b7](https://github.com/langwatch/kanban-code/commit/9d5a3b7c5f39a269084b9642f00860189243aeaf))
+* **boxd:** resume machine also resumes the assistant when the session is gone ([2285607](https://github.com/langwatch/kanban-code/commit/228560741f6e83c06a732a6e35fd26baf5eb551e))
+* **boxd:** retry the remote attach until the tmux session exists ([87f1352](https://github.com/langwatch/kanban-code/commit/87f135286adb927d81b9429f4158eb65bee1d10f))
+* **boxd:** route CLI keys locally for local cards, drop stale compact steers ([813cb01](https://github.com/langwatch/kanban-code/commit/813cb015647a98c40a126c12a037cf19cb78c16b))
+* **boxd:** scroll a session on a machine with the wheel ([41c58f8](https://github.com/langwatch/kanban-code/commit/41c58f8511c55bdcb11781499d0a7e5ebb12b3ee))
+* **boxd:** stop a parked machine once, record outside tmux kills ([44bb5fd](https://github.com/langwatch/kanban-code/commit/44bb5fd2043351c0bf4548e7f4e6b05ed2dfc942))
+* **boxd:** the login sync never takes another account's login over the Mac's ([4371761](https://github.com/langwatch/kanban-code/commit/4371761da557950b847887a6699903c289d19d28))
+* **boxd:** the login sync tells accounts apart by who owns the tokens ([cd22c2c](https://github.com/langwatch/kanban-code/commit/cd22c2ca8a7c51f528e7bb87cc7ea4af6785833b))
+* **boxd:** the token owner lookup builds on Linux ([8ee52cf](https://github.com/langwatch/kanban-code/commit/8ee52cf18def8e15d60cdfe8b84d7726539244c1))
+* **build:** make app builds for the machine's architecture ([893f21e](https://github.com/langwatch/kanban-code/commit/893f21e343b2b3c02bb2a2fe687c18f093d09ac6))
+* **build:** make app registers the build as the only Kanban Code, so notification clicks open it ([3a0a99e](https://github.com/langwatch/kanban-code/commit/3a0a99ee3bf5cac1866a37204908e48231397316))
+* **card:** hide the queued prompts bar while the rush terminal shows the queue ([b369ab0](https://github.com/langwatch/kanban-code/commit/b369ab0a84b0173bcec797da1de50ff053ce6a03))
+* **cards:** a card is never named after text the assistant CLI injects ([c79d509](https://github.com/langwatch/kanban-code/commit/c79d509586adcb1860a66078a04920e0a97f7220))
+* **channels:** the mirror only removes files the home sent, and a first pairing merges both sides ([18c1bca](https://github.com/langwatch/kanban-code/commit/18c1bca0ad78e90f0dcbe6d28728372764f8e591))
+* **chat:** draw a link in the link colour when the message has no block markdown ([15e32fd](https://github.com/langwatch/kanban-code/commit/15e32fd1cceb0780df61995e790adcf3cf5f02d9))
+* **chat:** keep the whole clicked message on a checkpoint restore ([e0da045](https://github.com/langwatch/kanban-code/commit/e0da0452047ff3c0256e0132936d041d1d1a008c))
+* **chat:** land a jump below the floating pill, not underneath it ([c8af904](https://github.com/langwatch/kanban-code/commit/c8af904d54709ae3a75e49d732a57545c18b65f6))
+* **chat:** pay for each history load with a real scroll ([e9b692c](https://github.com/langwatch/kanban-code/commit/e9b692c06e003decc4f873555937a3df636f4878))
+* **chat:** sending a side chat follow-up to the main chat no longer hangs the phone, and a compaction shows as a note ([105e152](https://github.com/langwatch/kanban-code/commit/105e152c3a6d85410a5e7d871c1fcd45dbf44801))
+* **chat:** show a queued prompt once after Claude delivers it ([1ea806d](https://github.com/langwatch/kanban-code/commit/1ea806deb44cce82647945557b530452027ed0ec))
+* **chat:** stop a slow transcript read from replacing the next card's history ([5a98ca0](https://github.com/langwatch/kanban-code/commit/5a98ca0c2fe91ef1f9ba302026a77b51036da114))
+* **chat:** stop an expanded message drawing over the one below it ([b4b2582](https://github.com/langwatch/kanban-code/commit/b4b258212da76aa765e3fac8be8eb9f8b1dd0615))
+* **chat:** stop history loads a card switch triggers on its own ([b460718](https://github.com/langwatch/kanban-code/commit/b460718d24c752e333c92f2de7eca2257b7f4aac))
+* **chat:** stop sizing probes from freezing the chat feed ([9e90725](https://github.com/langwatch/kanban-code/commit/9e90725a19241811b19817ca3d3c18a94e6de4d3))
+* **chat:** stop the idle blink and the load that stops at the top ([4cda740](https://github.com/langwatch/kanban-code/commit/4cda740a1fb0ec234bc26d81b55d3b92c1032dba))
+* **cli:** align kanban remote cards, clearer 409 and 401, Mac name in pair link ([01928e2](https://github.com/langwatch/kanban-code/commit/01928e2610c838bc5ce5cb8ae88f0d621c1cb5af))
+* **cli:** kanban open takes a card id or an existing folder, never makes a project from a card id ([ea96b66](https://github.com/langwatch/kanban-code/commit/ea96b66af689580a1a5cce8854dfe2fee13f8a9a))
+* **cli:** kv and kanban run from a program whose PATH has no node ([5e0a159](https://github.com/langwatch/kanban-code/commit/5e0a159759624e0838ecff2e62c0c32311fe2f9a))
+* **cli:** remote attach keeps LF as LF and sends the terminal size once connected ([ea31ad9](https://github.com/langwatch/kanban-code/commit/ea31ad95781daa972e9bd54ccbfce16db71df841))
+* **cli:** stop scheduled prompts from concatenating in the composer ([a75a8dc](https://github.com/langwatch/kanban-code/commit/a75a8dc11cc757c2fbc2a9dbc444f9908414751d))
+* **cli:** subagent commands on a Linux master wait for kanban-code-server instead of opening an app ([34eea99](https://github.com/langwatch/kanban-code/commit/34eea99f612ce087cf72dd8f52dfa81ead00fb34))
+* **detail:** drop the link property rows from the card header ([1d74928](https://github.com/langwatch/kanban-code/commit/1d74928a68551a7be374f1a9d1877167ad4b682f))
+* **diag:** notice tmux mass deaths across app restarts ([a17f1d9](https://github.com/langwatch/kanban-code/commit/a17f1d9095fb4995109d0a01bca2cc68a58c9c5b))
+* **discovery:** find the pull requests a card worked on but never pushed ([09b5e1e](https://github.com/langwatch/kanban-code/commit/09b5e1ebf91dcf17350417a59d520556fd45dc36))
+* **handover:** a card moving between masters waits for its adoption and shows the move everywhere ([9f3e002](https://github.com/langwatch/kanban-code/commit/9f3e0021d47407d3785b274451f039b4cbe267be))
+* **ios:** a sent prompt's waiting bubble goes away when the session re-spaced its text ([21618a2](https://github.com/langwatch/kanban-code/commit/21618a265483ef864056f43038e4fe73a8b920c6))
+* **ios:** approvals unlock with Face ID instead of the passcode ([f78fe99](https://github.com/langwatch/kanban-code/commit/f78fe99be3b316a287a63733a89e6e8a958c63f9))
+* **ios:** card rows keep to the screen width, with the machine in grey beside the project ([cb11a7f](https://github.com/langwatch/kanban-code/commit/cb11a7f03f7a0613f902caf195af4a7300acf0a6))
+* **ios:** cards name their machine when one master lists cards of several ([8ca75e7](https://github.com/langwatch/kanban-code/commit/8ca75e78b8142989f90a122ca2d454ee97267721))
+* **ios:** commit the device refresh script under Scripts/ ([60465b9](https://github.com/langwatch/kanban-code/commit/60465b989dbbf5f0df28857003be96f35be49fc4))
+* **ios:** composer above the suggestion bar, [Image #N] markers, chats open at their end ([f2457c9](https://github.com/langwatch/kanban-code/commit/f2457c9665363b6b929616a2a4e9e83b3423f00a))
+* **ios:** opaque app icon, hide terminal on stopped cards, UI tests for older pages and agent scope ([09f2c03](https://github.com/langwatch/kanban-code/commit/09f2c03f10c3a1fd6f27a03294db6500e69fd77f))
+* **ios:** stop three crashes: PR badges off the main thread, an emptied machine menu, huge chats ([545bf55](https://github.com/langwatch/kanban-code/commit/545bf551aeadf1f410a49eb1e5f26937f589fe7d))
+* **ios:** the attach menu no longer crashes when the composer's selection outlived its text ([c3c7ab5](https://github.com/langwatch/kanban-code/commit/c3c7ab5d5ea315e6898fa288b51e90cc20d3cd84))
+* **ios:** the composer keeps its last line above the buttons when the pane is short ([7bccc95](https://github.com/langwatch/kanban-code/commit/7bccc9593e0886b343cf9d8bb02df849103178c3))
+* **ios:** the composer no longer shows the queue hint above the message ([771c7ab](https://github.com/langwatch/kanban-code/commit/771c7abde642f5cb58e4c0ae4f2d24634ca3c120))
+* **kv:** a Jev denial says Jev denied it and the rules it read, not how to write a reason ([e6e1b41](https://github.com/langwatch/kanban-code/commit/e6e1b413e1fca0ae5e001da18d7a747f11ff2627))
+* **master:** a card moving between masters stays as released until adopted ([b799a93](https://github.com/langwatch/kanban-code/commit/b799a93b0db42647eb580db4b0488dc444288ac1))
+* **master:** a handover diffs uncommitted work in a copy of the index ([5660f1c](https://github.com/langwatch/kanban-code/commit/5660f1cedb790d23aa2df36d05ea6e4d173386bf))
+* **notify:** notify only when a session needs a decision, never on stop or idle ([a457352](https://github.com/langwatch/kanban-code/commit/a45735279633cf6110c49ac5a81a4febbf27e6a5))
+* **pr:** refresh a pull request in the repository it lives in ([87db565](https://github.com/langwatch/kanban-code/commit/87db565ba16393a41b5fbb089ad0035724390d56))
+* **reconcile:** a launch takes only the session it started ([c73fe97](https://github.com/langwatch/kanban-code/commit/c73fe9757919af0d3c4a9934fd93cb61fb50d4b0))
+* **reconcile:** keep unclaimed headless claude -p sessions off the board ([c31ac50](https://github.com/langwatch/kanban-code/commit/c31ac500cac4d46fc2806bb8d9e9de586aad7a09))
+* **reconciler:** stop the board from re-rendering every pass ([39f63ef](https://github.com/langwatch/kanban-code/commit/39f63efe71749a74631f9e027d1a0fdfff0f87ee))
+* **remote:** a card search with several words works from form-encoding clients ([dd64e3a](https://github.com/langwatch/kanban-code/commit/dd64e3a7fb8b23e116679f3dfdee304a6c761a66))
+* **remote:** a resume right after a start does not start the session over ([87082f2](https://github.com/langwatch/kanban-code/commit/87082f2a76a523c478e952b7029361770495d8ed))
+* **remote:** host name from the computer name, without a DNS lookup ([9d184e2](https://github.com/langwatch/kanban-code/commit/9d184e240d5bde9b14e48e9901a909b531dc02fc))
+* **remote:** log a call refused by the token's scope ([f2ab4cd](https://github.com/langwatch/kanban-code/commit/f2ab4cdd84d7c8779d03d1ce803595735d6e0c05))
+* **rush-plugin:** a pasted secret named as one the vault holds asks to replace its value ([d5f02fa](https://github.com/langwatch/kanban-code/commit/d5f02fa6c3ee014a0d8f2a4616c93d61e4293f81))
+* **search:** hide sessions from globally excluded paths in the search palette ([8093a31](https://github.com/langwatch/kanban-code/commit/8093a314e9aa0a2a20e5e8da02212d1d22117db7))
+* **self-compact:** drop a context warning the agent no longer needs ([f33e875](https://github.com/langwatch/kanban-code/commit/f33e875d99319f19d6ae995e313e03b7b779e7f5))
+* **server:** deploy kanban-code-server from the committed tree ([03c63be](https://github.com/langwatch/kanban-code/commit/03c63befcd2eb5c1f6c266bdf14695f4940ce842))
+* **server:** deploy waits for the server to answer before checking it ([c5c01f4](https://github.com/langwatch/kanban-code/commit/c5c01f4e9aa7b0dd325fefc8946aedb97517220e))
+* **server:** sessions the server starts survive its restarts, with room for their open files ([931273a](https://github.com/langwatch/kanban-code/commit/931273a52b5981c149d9a2404d4ea3f0c10d72f8))
+* **server:** spawn commands with posix_spawn on Linux, root sessions run with IS_SANDBOX, peers over plain http ([660bbe6](https://github.com/langwatch/kanban-code/commit/660bbe6bd82cb8f0c4d89b01bda93b00ccf59f50))
+* **server:** spawned commands keep only stdin, stdout and stderr on Linux ([b6e0514](https://github.com/langwatch/kanban-code/commit/b6e05147734b32978657404d6e4905addbf18991))
+* **sessions:** a card keeps its chat when its session moves into a worktree ([5d08b89](https://github.com/langwatch/kanban-code/commit/5d08b89cc70400ab9cd30319fb184167881d78fd))
+* **settings:** atomic settings writes, so a racing read never resets Remote Control ([0206dde](https://github.com/langwatch/kanban-code/commit/0206ddebffe56bff01a4af49b2206696cf8affbe))
+* **settings:** the ssh machine rows show one header line instead of a label per field ([fcf9986](https://github.com/langwatch/kanban-code/commit/fcf9986dda5df7e9f5dea750847a1b261559dcdf))
+* **settings:** widen the settings window so all 11 tabs fit in the tab bar ([1cdbb3c](https://github.com/langwatch/kanban-code/commit/1cdbb3c611dd7f29ed25f169d90b72437075d974))
+* **shell:** child processes get the interactive shell PATH, so claude under nvm is found however the app was launched ([b9a84a8](https://github.com/langwatch/kanban-code/commit/b9a84a874be0f75e7e3bd4c2c49e2383e18f2f7a))
+* **store:** atomic links and channel writes, so a racing read never sees an empty board ([7af75c2](https://github.com/langwatch/kanban-code/commit/7af75c220b028f5881f5df1a78d8f2af59fc7672))
+* **subagents:** resumed and forked children follow their parent's machine ([ded8968](https://github.com/langwatch/kanban-code/commit/ded89687c241e61c64e08c0aa75497830849f760))
+* **sync:** a card another master runs shows under the project here with the same repository ([f0302c3](https://github.com/langwatch/kanban-code/commit/f0302c3e9b78a3a603297e519d285267b7af462e))
+* **sync:** a card archived on another master ends its sessions on the master that runs it ([548c512](https://github.com/langwatch/kanban-code/commit/548c5129eb9f8b9ab7d4aa7d530aa3e5cdea6480))
+* **sync:** a deletion reaches the machine that made the file, and a peer pulls back after taking changes ([132d529](https://github.com/langwatch/kanban-code/commit/132d52969f4b9323f96696532191eea6b508e27e))
+* **sync:** a master merges peer pages only after it reads its own links ([fb8336a](https://github.com/langwatch/kanban-code/commit/fb8336a5ded1f649116336dbe63b3fac4636ac8d))
+* **sync:** each named key of a JSON settings file is a version of its own ([1272050](https://github.com/langwatch/kanban-code/commit/1272050cb5141b21da22babb13fa22d6704adfbb))
+* **sync:** mirrors never carry the assistants' login files ([e6ab737](https://github.com/langwatch/kanban-code/commit/e6ab7372cbf2e2ee740d13f51381e5ead3c57192))
+* **sync:** Settings > Sync says when no peer is online and shows only the excludes that differ from the defaults ([1c69e85](https://github.com/langwatch/kanban-code/commit/1c69e854b98155ba29fbc22de8257554b822b18d))
+* **terminal:** a card another master owns attaches to it once its owner is known ([05de205](https://github.com/langwatch/kanban-code/commit/05de205dfc899e0d7eb123997ee65f047d0df6f7))
+* **terminal:** a cmd+click on a link keeps the press from the program too, so rush opens it no second time ([d12e6b5](https://github.com/langwatch/kanban-code/commit/d12e6b55a18fa28cb6128fb84a2f3a49c082eaf7))
+* **terminal:** agtop copies on cmd+c, not when a drag ends ([25f1127](https://github.com/langwatch/kanban-code/commit/25f1127721ac329e82107748b5a9e53aa5e39a5b))
+* **terminal:** agtop terminals never drop output ([6e544f8](https://github.com/langwatch/kanban-code/commit/6e544f88da315797d8295dc760f7d49e306c4ab6))
+* **terminal:** an image pasted or dropped on the terminal of a card another master runs reaches the assistant there ([163e40b](https://github.com/langwatch/kanban-code/commit/163e40b091717fa64aadc6a93447c3f6c63318a1))
+* **terminal:** cmd+c keeps what agtop copied ([8940ca8](https://github.com/langwatch/kanban-code/commit/8940ca835eb65dfacb2948d2b9d131dcbbc087fc))
+* **terminal:** Copy stays enabled while agtop has the mouse, so cmd+c reaches it ([a3bd93c](https://github.com/langwatch/kanban-code/commit/a3bd93ca52534a6d95b164414140a0b277aba008))
+* **terminal:** make a link written by an agent clickable ([abfa2ab](https://github.com/langwatch/kanban-code/commit/abfa2abd1d9c84479119d6e941e1ff9ebb462916))
+* **terminal:** OSC 52 copies from the program reach the clipboard ([6dc6e1a](https://github.com/langwatch/kanban-code/commit/6dc6e1a0add22c6d0c86a50665286ca44d2e4154))
+* **terminal:** rush gets the wheel and sees the pointer hover ([bd3e6f6](https://github.com/langwatch/kanban-code/commit/bd3e6f6b0c5ba6ca2adae3bf2743a0368db7b04f))
+* **terminal:** scroll down moves whole lines inside a scroll region ([98afa7a](https://github.com/langwatch/kanban-code/commit/98afa7a5c4c43f1b6c3f647f4dd6311de8200312))
+* **terminal:** SwiftTerm builds for iOS again (attribute cache keyed by render key) ([e2c16c0](https://github.com/langwatch/kanban-code/commit/e2c16c0fa991f6cf317c5f2c9577dd7c1c418957))
+* **tmux:** drop an agent's session variables from the tmux server before creating a session ([d65ed96](https://github.com/langwatch/kanban-code/commit/d65ed96d719388bba0ba784303c0c305da5e5fb7))
+* **toolbar:** the sidebar's buttons do not double the detail's ([b92f647](https://github.com/langwatch/kanban-code/commit/b92f6475d9e1c092a5b8adf517b76ae8022870eb))
+* **ui:** keep the machine banner off cards resumed locally ([d1140c3](https://github.com/langwatch/kanban-code/commit/d1140c3f674bc9a4ac6cdf3e58990b77c7106f65))
+* **ui:** let Return confirm the destroy machine and remove worktree dialogs ([56217c0](https://github.com/langwatch/kanban-code/commit/56217c01c26fe7d85307001668ea68d8d2a3994c))
+* **ui:** show a stop icon for stopped boxd machines ([b340a1b](https://github.com/langwatch/kanban-code/commit/b340a1b48e4b671291cd70757b70c1aac707c73f))
+* **vault:** a card's recent session tokens stay valid, so a long-running rush host is still its card ([b5a1c86](https://github.com/langwatch/kanban-code/commit/b5a1c86e0df694bd7f3dc371844db8b3f2aefd48))
+* **vault:** a hook-wrapped command's withheld secrets log as skipped, not denied ([f35d7cf](https://github.com/langwatch/kanban-code/commit/f35d7cfdf865f92faa90f4deb8e7c76b80b92b1b))
+* **vault:** a manifest folder gets its own project's group only, a submodule is a subfolder of its repository, kv env --names sends the mode ([7cde20c](https://github.com/langwatch/kanban-code/commit/7cde20c8a208440637c15a4e6bbb920b2354ab2f))
+* **vault:** a pasted secret saved under a stored name asks to replace its value ([79ca490](https://github.com/langwatch/kanban-code/commit/79ca4903cc8c5e9495b5c14850f6b47fb2f6559d))
+* **vault:** a resting rush host of a card with no token on file gets one without waiting for a turn ([46b57c0](https://github.com/langwatch/kanban-code/commit/46b57c0e6ccba187463a427dae2e1c70201718d3))
+* **vault:** a rush host is its card's whenever the links map it, whoever started it; --meta is still never read ([ecc26e5](https://github.com/langwatch/kanban-code/commit/ecc26e58fed98f9ab433cf911b9bffa953f81df8))
+* **vault:** an agtop/rush host is a card's only through Kanban's links and a host the master started, never its own --meta kanban_card ([609f325](https://github.com/langwatch/kanban-code/commit/609f3251435b39fc99390089752091abd2c773cc))
+* **vault:** an open approval survives a master restart, and kv waits up to 2 min for a restarting master ([b2cd43f](https://github.com/langwatch/kanban-code/commit/b2cd43fe729e6e0da7ad7e31a07b496cea56b9d9))
+* **vault:** approvals wait 60 minutes before denying, and kv says how long it waits ([e671e18](https://github.com/langwatch/kanban-code/commit/e671e18c52e41417b7de6211740167c737473b1a))
+* **vault:** denying a request asks for no Touch ID, Face ID or device key ([4deeb6e](https://github.com/langwatch/kanban-code/commit/4deeb6eb33e4b213b031b02b0e160d16406d6caf))
+* **vault:** every rush host of a card carries a session token the vault knows, and a remote resume starts a rush host that is not running ([2cebac3](https://github.com/langwatch/kanban-code/commit/2cebac37ef493a476b5db6ba1d46d0cee4c207ec))
+* **vault:** hook-wrapped env loads stay out of the rate limit ([0cc7c7f](https://github.com/langwatch/kanban-code/commit/0cc7c7f7717403e70fc9187af909cc276d5c1dcd))
+* **vault:** import skips worktree copies and names duplicates by project ([336a3d3](https://github.com/langwatch/kanban-code/commit/336a3d31214c80cfeb96b8fa61a2db8646784571))
+* **vault:** Jev allows a judged secret used as its rules allow without needing the exact command in the prompts ([824b401](https://github.com/langwatch/kanban-code/commit/824b401a6e7f569316dbe6fb4d15cb8234d711be))
+* **vault:** judge secrets in parallel, wrapped commands run when the master is down, deploys take a lock ([b9d4004](https://github.com/langwatch/kanban-code/commit/b9d4004b90a4082826632e5030ea081b231bfe93))
+* **vault:** kv flushes stdout before exiting, so piped kv ls --json is no longer cut at 64 KiB ([193db41](https://github.com/langwatch/kanban-code/commit/193db41797d51ce50a2d56497636bfed39159299))
+* **vault:** log when a loopback caller's process cannot be found ([2af97b8](https://github.com/langwatch/kanban-code/commit/2af97b80a5f85bc28e087f9b27e4f2a3d72fc203))
+* **vault:** one question per thing asked, AWS credentials reused per card, and a live phone approval list ([c7f92f9](https://github.com/langwatch/kanban-code/commit/c7f92f9257bbae59a6ea8bf980103279c350f2e4))
+* **vault:** read /proc tables to their end on Linux, so box callers are found, and kv status says who the master takes you for ([d881379](https://github.com/langwatch/kanban-code/commit/d8813797cc37fcafdffcf89a456ed73548e3cad4))
+* **vault:** scrubber backup is an APFS clone on a Mac, and a gzip needs free disk ([c2e1457](https://github.com/langwatch/kanban-code/commit/c2e1457ffaae41993c44e8c98a22375f8c9a7b2e))
+* **vault:** scrubber backup records the replaced bytes, with a restore, and compressed transcripts stay compressed ([2075318](https://github.com/langwatch/kanban-code/commit/20753182bb749f19c3a424df60f96b77d23e5332))
+* **vault:** scrubber index outlives owner-only sealing, and a first run waits for its time ([2605f93](https://github.com/langwatch/kanban-code/commit/2605f937aae71083eafcf98f9624ae88e4db82b2))
+* **vault:** scrubber takes extra paths from settings, keeps made up keys out, and shows less in Settings ([41041f8](https://github.com/langwatch/kanban-code/commit/41041f807791cb5402485fb49a7a2bfbdfb83aee))
+* **vault:** scrubber typed mode counts only the records of the human's messages ([3518ff7](https://github.com/langwatch/kanban-code/commit/3518ff7d175029829382637b73efa9c7492967d7))
+* **vault:** scrubber writes only the bytes of a value, and never takes the disk below 1 GB ([6761586](https://github.com/langwatch/kanban-code/commit/67615865be717d10e676ddb7307c80a65dbe6153))
+* **vault:** the owner keys sheet names any password manager ([c2fb4f3](https://github.com/langwatch/kanban-code/commit/c2fb4f3cf3b7fb71db25b3573d3ce605cce12588))
+* **vault:** the rate limit counts other callers, a lease beats it, and leases cover the subagent tree ([4ae7266](https://github.com/langwatch/kanban-code/commit/4ae726614bc2c8cc444c57869cad0975298f1469))
+* **vault:** the rush token keeper skips hosts whose folder is gone and restarts at most 3 per pass ([f55b544](https://github.com/langwatch/kanban-code/commit/f55b544a802adce9ce55228ae1b944e5d04a1d75))
+* **vault:** value checks are audited and rate limited per caller ([7a855b9](https://github.com/langwatch/kanban-code/commit/7a855b96513161e3c399841981624d8fde8aee90))
+* **worktree:** remove a card's worktree where the card lives: on its owner master, over ssh on its machine, never for a disposable boxd machine ([8eb8746](https://github.com/langwatch/kanban-code/commit/8eb8746e0346975e8bf6c2e3894152545b3f2ff5))
+
+
+### Performance
+
+* **board:** keep reconcile and card rebuilds off the main thread's hot path ([4951eb5](https://github.com/langwatch/kanban-code/commit/4951eb5ff643770ce4de739a04925898e9efd435))
+* **board:** rebuild the cards once per action, after sync stamps ([03ca0a7](https://github.com/langwatch/kanban-code/commit/03ca0a77e0f3dee05a48f6f2f4006aaa8ef3607b))
+* **boxd:** gzip uploads and send them in 4 MB parts ([48cfb6a](https://github.com/langwatch/kanban-code/commit/48cfb6af262c160bfd6e21138d99c43d9b2366eb))
+* **links:** cards whose session holds the prompt keep a short preview of it ([6b89824](https://github.com/langwatch/kanban-code/commit/6b898242f68e7c97248bcf1d054c49307091d002))
+* **remote:** card JSON leaves out false, zero and empty fields ([fa0c237](https://github.com/langwatch/kanban-code/commit/fa0c237209b7e26758236f54162e0c086cbb92c7))
+* **terminal:** agtop frames are drawn as they arrive ([404e7b3](https://github.com/langwatch/kanban-code/commit/404e7b35d31be59855f301bab7bba6e669b3c90f))
+
+
+### Refactoring
+
+* **agents:** name sessions through claude's own --name, drop the env var ([5321a81](https://github.com/langwatch/kanban-code/commit/5321a81bba50949ffda11bd2c59ca6e3079b97ec))
+* **boxd:** name the machines kanban-<repo>-<card> and drop a needless await in the bridge reader ([f8a1c72](https://github.com/langwatch/kanban-code/commit/f8a1c72c8d1cee0336f058e792e437e94257f3d8))
+
+
+### Documentation
+
+* **cli:** name the Settings > Remote Control pane ([bbbec65](https://github.com/langwatch/kanban-code/commit/bbbec6540f6cb8e615ff24582f0347c6e30541c3))
+* **remote:** describe PATCH /v1/cards/{id} in the OpenAPI document ([64522c5](https://github.com/langwatch/kanban-code/commit/64522c5f3f8c37947e44e7dea99722ee873e0772))
+* **vault:** a shared ssh connection from before the sshd reload drops the card variables ([36636f1](https://github.com/langwatch/kanban-code/commit/36636f1abbd47afea2451ac30d1b00e44a145a90))
+* **vault:** commented env lines and worktree backups are cleaned, Stripe CLI config stays ([bf54800](https://github.com/langwatch/kanban-code/commit/bf54800a40012f5f4c07e2130a22f3d2c1b21486))
+* **vault:** pasted secrets in composers ([0a69554](https://github.com/langwatch/kanban-code/commit/0a69554e1b1025b382ac89459a858ca8b3a13903))
+* **vault:** projects, environments, the manifest, the own-project policy and session tokens ([7f3953b](https://github.com/langwatch/kanban-code/commit/7f3953b25c91578b3a51eea156d8b27b780e2589))
+* **vault:** where secrets live after the migration and what stays in plaintext ([e25819d](https://github.com/langwatch/kanban-code/commit/e25819defea31213b1f6b8213a8f9d9584fb830d))
+
 ## [0.1.32](https://github.com/langwatch/kanban-code/compare/v0.1.31...v0.1.32) (2026-08-09)
 
 
diff --git a/Sources/KanbanCodeServer/Version.swift b/Sources/KanbanCodeServer/Version.swift
index b20dab98..2a28fe76 100644
--- a/Sources/KanbanCodeServer/Version.swift
+++ b/Sources/KanbanCodeServer/Version.swift
@@ -1,4 +1,4 @@
 /// Release version of kanban-code-server, bumped by release-please.
 enum KanbanCodeServerVersion {
-    static let current = "0.1.32" // x-release-please-version
+    static let current = "0.1.33" // x-release-please-version
 }