One set of Agent Skills, linked into every client.

Added

• Skills. Settings → Skills links Agent Skills from folders you choose into ~/.agents/skills (Codex, Cursor, VS Code Copilot, Gemini CLI and others) and every Claude Code config folder, or, per workspace, into each repository's .claude/skills and .agents/skills. Bastion only ever creates symlinks and never writes into a source; anything it did not create is left alone and shown, a repository link another tool made into a source included, and broken links it owns are removed. Repository links are kept out of git through .git/info/exclude. A description over the Agent Skills standard's 1,024 characters but within Claude Code's 1,536 is still linked, with a warning that clients reading ~/.agents/skills may skip it. Claude Desktop's pane lists the account skills synced to this Mac and exports a ZIP for any that are missing. Five new tools on Bastion's own server manage the same.

• Yahoo Finance is in the catalog: prices, fundamentals, financial statements, holders, options, news and analyst ratings, with no account or key, and nothing it can change. Apple Ads is listed too, marked not published until its package is.

Fixed

• -autoWireClients YES now turns automatic wiring back on in a Debug build; it was ignored.

• A store file that will not decode is kept, not emptied. The server list, profiles, skills and workspaces each keep a .unreadable copy and refuse to save over it, and client wiring stands down until it reads again, so one bad edit no longer costs the whole list.

• A rewire changes only what Bastion owns. It replaces the keys Bastion writes in its own entries and leaves the rest of each entry alone, writes through a symlinked config instead of replacing the link, reads a config that is empty mid-write again, and never replaces a client token the Keychain failed to read. A Codex config.toml shape the splice would corrupt is refused rather than rewritten. -trustProfilesForStaleEntries YES is now read.

• Supervised servers. A child that fails its handshake, or is stopped, is sent SIGKILL if it outlives a grace period, so none is left running; a server that keeps crashing is restarted with a growing backoff after one immediate retry; frames from concurrent clients no longer interleave on a child's stdin; a client's cancel reaches the child under the id the child was given; stderr is redacted line by line; and a streamed reply sends no progress after its result.

• Writes off holds on a fresh server. A tools/call that arrives before the server's tool list was ever fetched is judged against the catalog, and refused when the catalog cannot be read.

• Remote servers refuse a reply whose peer address was never observed, and one that was stopped no longer starts a request.

• Bastion's own server. add_custom_server refuses a catalog id, or an id profiles already hold credentials for, and server_stats totals count only the servers asked about.

• The audit log verifies as truncated, not tampered, once retention has pruned its oldest segments. Retention applies at launch and when the setting changes, a torn last record no longer breaks the chain, a reply that arrives late is still recorded, queued records are written before quit, and the export is the text that was hashed.

• Skills. Repository links are kept out of git in submodules and worktrees too, a link to a skill that became invalid is kept and shown instead of removed, a link another tool re-pointed while Bastion was applying a change is put back rather than replaced, and a skill's ZIP leaves .git, .env and other hidden entries out.

• A licence key a mail client wrapped across lines is accepted, an OAuth sign-in keeps waiting when a stray request reaches its callback, the Log pane follows new entries, the chat drops whole turns when it trims its history, a stuck update check clears, and relaunching to update stops the gateway first.