Restores the grok-web (#5350) and cli-serve HTTPS (#5242 Bug 1C) bullets
eaten by sequential squash-merges, and dedups the duplicate '### Bug Fixes'
header. All code landed correctly; additive restore — single header, 11 bullets.
The sequential squash-merges of #5351/#5349/#5347 onto release/v3.8.41
auto-resolved the CHANGELOG and progressively ate sibling bullets — the
section was left with only the oauth (#5326) bullet + a duplicate
'### Bug Fixes' header, dropping routing/cli/dashboard/rerank (batch 3) and
opencode (#5217) / chatgpt-web (#5240). All code landed correctly; this
restores every bullet verbatim under a single header. Additive restore.
Integrated into release/v3.8.41 — Antigravity Token Expired badge: set tokenExpiresAt at creation + surface no-refresh-token as expired (#5326). Tests green (2 + 3).
Integrated into release/v3.8.41 — wire tool/function calling into chatgpt-web via shared webTools shim (#5240). Test: chatgpt-web-tools-5240 green (4/4).
Integrated into release/v3.8.41 — suppress </think> close marker for clients that render it verbatim (OpenCode), opt-out by UA allowlist; #4633 preserved for Claude Code/Cursor. Test: think-close-marker-suppress-5245 green (3/3). Thanks @wild-feather.
The squash-merges of #5346/#5345/#5344 onto release/v3.8.41 auto-resolved the
CHANGELOG and dropped the routing (#5239), cli (#5238) and dashboard-badge (#5264)
bullets — only the rerank (#5343) bullet survived. The code for all three landed
correctly; this restores the matching CHANGELOG entries verbatim. Additive only.
Integrated into release/v3.8.41 — dead-code baseline ratchet 346→310 (verified DEAD_TOTAL=310 on the release tip after the granular cleanup + this batch landed). Thanks @JxnLexn.
Integrated into release/v3.8.41. Accepts direct LAN/loopback-IP host as a valid mutation origin (#5340); origin trust gated on the server-stamped peer, not the spoofable Host. 6 security-boundary tests incl. DNS-rebinding.
Integrated into release/v3.8.41. Service-console fixes + Tailscale CGNAT LAN range; dropped the regressive context/page.tsx stub (release version retained).
Verified dead-code removal: merged result passes typecheck:core + 194 affected unit tests + ESLint clean. Integrated into release/v3.8.41. Thanks @JxnLexn for the cleanup!
Verified dead-code removal: merged result passes typecheck:core + 194 affected unit tests + ESLint clean. Integrated into release/v3.8.41. Thanks @JxnLexn for the cleanup!
Verified dead-code removal: merged result passes typecheck:core + 194 affected unit tests + ESLint clean. Integrated into release/v3.8.41. Thanks @JxnLexn for the cleanup!
Verified dead-code removal: merged result passes typecheck:core + 194 affected unit tests + ESLint clean. Integrated into release/v3.8.41. Thanks @JxnLexn for the cleanup!
Verified dead-code removal: merged result passes typecheck:core + 194 affected unit tests + ESLint clean. Integrated into release/v3.8.41. Thanks @JxnLexn for the cleanup!
Verified dead-code removal: merged result passes typecheck:core + 194 affected unit tests + ESLint clean. Integrated into release/v3.8.41. Thanks @JxnLexn for the cleanup!
Verified dead-code removal: merged result passes typecheck:core + 194 affected unit tests + ESLint clean. Integrated into release/v3.8.41. Thanks @JxnLexn for the cleanup!
Verified dead-code removal: merged result passes typecheck:core + 194 affected unit tests + ESLint clean. Integrated into release/v3.8.41. Thanks @JxnLexn for the cleanup!
Verified dead-code removal: merged result passes typecheck:core + 194 affected unit tests + ESLint clean. Integrated into release/v3.8.41. Thanks @JxnLexn for the cleanup!
Verified dead-code removal: merged result passes typecheck:core + 194 affected unit tests + ESLint clean. Integrated into release/v3.8.41. Thanks @JxnLexn for the cleanup!
v3.8.40 cycle integration → main. All test gates green (Unit/Integration/Coverage/Node-compat/Quality-Ratchet). The only red check, 'PR Test Policy', is the test-masking heuristic firing on the cumulative ~57-commit release diff (legitimate assert consolidations already reviewed per-PR — Gemini CLI removal #5246, retired GPT models #5280, provider catalog refreshes); overridden with --admin per the documented release-PR convention. CodeQL/SonarQube advisory scans non-blocking; #5278's code already passed CodeQL on main. Homologated on VPS 192.168.0.15 (v3.8.40 healthy).
Centralizes browser-mutation origin validation into `src/server/origin/publicOrigin.ts` and wires it through the authz pipeline, replacing the per-route same-origin-only check that 403'd dashboard mutations when served behind a reverse proxy on a different public origin. The new module resolves the allowed public origin from configured base-URL env vars or trusted forwarded headers (only when OMNIROUTE_TRUST_PROXY is set AND the peer is loopback/LAN via peer-stamp), validates Sec-Fetch-Site metadata, and sanitizes Host/Forwarded inputs (rejects control chars, userinfo, path/query in Host).
Reviewed sound; validated locally: authz/public-origin + pipeline suites 27/27 green (incl. invalid-origin reject + configured-origin accept), typecheck clean. Maintainer fix-up: moved the new test from tests/unit/server/ (not collected by any runner — orphan-test gate fail) into tests/unit/authz/. Remaining red CI shards are the pre-existing #4076 Dockerfile heap base-red on `main` (unrelated; de-brittled in the v3.8.40 release line).
Co-authored-by: Thinkscape <Thinkscape@users.noreply.github.com>
The advisory Trivy image scan uploaded every HIGH/CRITICAL into the
Security tab without ignore-unfixed, flooding it with ~150 unfixable
base-image OS CVEs (Debian trixie packages with no upstream patch,
overwhelmingly local-only and not reachable from the proxy request
surface). Operators cannot act on those, so they are pure noise.
Add ignore-unfixed:true to the advisory step so it mirrors the existing
CRITICAL blocking gate and surfaces only actionable, fixable
vulnerabilities. Wire trivyignores to a new repo-root .trivyignore that
documents the accepted-risk policy and is the single auditable home for
the rare fixable CVE we must temporarily accept (none at present).
Takes effect on the next release image build (Trivy only runs on tag
builds, not main pushes); fixed CVEs drop out of the SARIF and GitHub
auto-resolves the corresponding alerts.
