Restores the grok-web (#5350) and cli-serve HTTPS (#5242 Bug 1C) bullets
eaten by sequential squash-merges, and dedups the duplicate '### Bug Fixes'
header. All code landed correctly; additive restore — single header, 11 bullets.
The sequential squash-merges of #5351/#5349/#5347 onto release/v3.8.41
auto-resolved the CHANGELOG and progressively ate sibling bullets — the
section was left with only the oauth (#5326) bullet + a duplicate
'### Bug Fixes' header, dropping routing/cli/dashboard/rerank (batch 3) and
opencode (#5217) / chatgpt-web (#5240). All code landed correctly; this
restores every bullet verbatim under a single header. Additive restore.
Integrated into release/v3.8.41 — Antigravity Token Expired badge: set tokenExpiresAt at creation + surface no-refresh-token as expired (#5326). Tests green (2 + 3).
Integrated into release/v3.8.41 — wire tool/function calling into chatgpt-web via shared webTools shim (#5240). Test: chatgpt-web-tools-5240 green (4/4).
Integrated into release/v3.8.41 — suppress </think> close marker for clients that render it verbatim (OpenCode), opt-out by UA allowlist; #4633 preserved for Claude Code/Cursor. Test: think-close-marker-suppress-5245 green (3/3). Thanks @wild-feather.
The squash-merges of #5346/#5345/#5344 onto release/v3.8.41 auto-resolved the
CHANGELOG and dropped the routing (#5239), cli (#5238) and dashboard-badge (#5264)
bullets — only the rerank (#5343) bullet survived. The code for all three landed
correctly; this restores the matching CHANGELOG entries verbatim. Additive only.
Integrated into release/v3.8.41 — dead-code baseline ratchet 346→310 (verified DEAD_TOTAL=310 on the release tip after the granular cleanup + this batch landed). Thanks @JxnLexn.
Integrated into release/v3.8.41. Accepts direct LAN/loopback-IP host as a valid mutation origin (#5340); origin trust gated on the server-stamped peer, not the spoofable Host. 6 security-boundary tests incl. DNS-rebinding.
Integrated into release/v3.8.41. Service-console fixes + Tailscale CGNAT LAN range; dropped the regressive context/page.tsx stub (release version retained).
Verified dead-code removal: merged result passes typecheck:core + 194 affected unit tests + ESLint clean. Integrated into release/v3.8.41. Thanks @JxnLexn for the cleanup!
Verified dead-code removal: merged result passes typecheck:core + 194 affected unit tests + ESLint clean. Integrated into release/v3.8.41. Thanks @JxnLexn for the cleanup!
Verified dead-code removal: merged result passes typecheck:core + 194 affected unit tests + ESLint clean. Integrated into release/v3.8.41. Thanks @JxnLexn for the cleanup!
Verified dead-code removal: merged result passes typecheck:core + 194 affected unit tests + ESLint clean. Integrated into release/v3.8.41. Thanks @JxnLexn for the cleanup!
Verified dead-code removal: merged result passes typecheck:core + 194 affected unit tests + ESLint clean. Integrated into release/v3.8.41. Thanks @JxnLexn for the cleanup!
Verified dead-code removal: merged result passes typecheck:core + 194 affected unit tests + ESLint clean. Integrated into release/v3.8.41. Thanks @JxnLexn for the cleanup!
Verified dead-code removal: merged result passes typecheck:core + 194 affected unit tests + ESLint clean. Integrated into release/v3.8.41. Thanks @JxnLexn for the cleanup!
Verified dead-code removal: merged result passes typecheck:core + 194 affected unit tests + ESLint clean. Integrated into release/v3.8.41. Thanks @JxnLexn for the cleanup!
Verified dead-code removal: merged result passes typecheck:core + 194 affected unit tests + ESLint clean. Integrated into release/v3.8.41. Thanks @JxnLexn for the cleanup!
Verified dead-code removal: merged result passes typecheck:core + 194 affected unit tests + ESLint clean. Integrated into release/v3.8.41. Thanks @JxnLexn for the cleanup!
v3.8.40 cycle integration → main. All test gates green (Unit/Integration/Coverage/Node-compat/Quality-Ratchet). The only red check, 'PR Test Policy', is the test-masking heuristic firing on the cumulative ~57-commit release diff (legitimate assert consolidations already reviewed per-PR — Gemini CLI removal #5246, retired GPT models #5280, provider catalog refreshes); overridden with --admin per the documented release-PR convention. CodeQL/SonarQube advisory scans non-blocking; #5278's code already passed CodeQL on main. Homologated on VPS 192.168.0.15 (v3.8.40 healthy).
