Restores the grok-web (#5350) and cli-serve HTTPS (#5242 Bug 1C) bullets
eaten by sequential squash-merges, and dedups the duplicate '### Bug Fixes'
header. All code landed correctly; additive restore — single header, 11 bullets.
The sequential squash-merges of #5351/#5349/#5347 onto release/v3.8.41
auto-resolved the CHANGELOG and progressively ate sibling bullets — the
section was left with only the oauth (#5326) bullet + a duplicate
'### Bug Fixes' header, dropping routing/cli/dashboard/rerank (batch 3) and
opencode (#5217) / chatgpt-web (#5240). All code landed correctly; this
restores every bullet verbatim under a single header. Additive restore.
Integrated into release/v3.8.41 — Antigravity Token Expired badge: set tokenExpiresAt at creation + surface no-refresh-token as expired (#5326). Tests green (2 + 3).
Integrated into release/v3.8.41 — wire tool/function calling into chatgpt-web via shared webTools shim (#5240). Test: chatgpt-web-tools-5240 green (4/4).
Integrated into release/v3.8.41 — suppress </think> close marker for clients that render it verbatim (OpenCode), opt-out by UA allowlist; #4633 preserved for Claude Code/Cursor. Test: think-close-marker-suppress-5245 green (3/3). Thanks @wild-feather.
The squash-merges of #5346/#5345/#5344 onto release/v3.8.41 auto-resolved the
CHANGELOG and dropped the routing (#5239), cli (#5238) and dashboard-badge (#5264)
bullets — only the rerank (#5343) bullet survived. The code for all three landed
correctly; this restores the matching CHANGELOG entries verbatim. Additive only.
Integrated into release/v3.8.41 — dead-code baseline ratchet 346→310 (verified DEAD_TOTAL=310 on the release tip after the granular cleanup + this batch landed). Thanks @JxnLexn.
Integrated into release/v3.8.41. Accepts direct LAN/loopback-IP host as a valid mutation origin (#5340); origin trust gated on the server-stamped peer, not the spoofable Host. 6 security-boundary tests incl. DNS-rebinding.
Integrated into release/v3.8.41. Service-console fixes + Tailscale CGNAT LAN range; dropped the regressive context/page.tsx stub (release version retained).
Verified dead-code removal: merged result passes typecheck:core + 194 affected unit tests + ESLint clean. Integrated into release/v3.8.41. Thanks @JxnLexn for the cleanup!
Verified dead-code removal: merged result passes typecheck:core + 194 affected unit tests + ESLint clean. Integrated into release/v3.8.41. Thanks @JxnLexn for the cleanup!
Verified dead-code removal: merged result passes typecheck:core + 194 affected unit tests + ESLint clean. Integrated into release/v3.8.41. Thanks @JxnLexn for the cleanup!
Verified dead-code removal: merged result passes typecheck:core + 194 affected unit tests + ESLint clean. Integrated into release/v3.8.41. Thanks @JxnLexn for the cleanup!
Verified dead-code removal: merged result passes typecheck:core + 194 affected unit tests + ESLint clean. Integrated into release/v3.8.41. Thanks @JxnLexn for the cleanup!
Verified dead-code removal: merged result passes typecheck:core + 194 affected unit tests + ESLint clean. Integrated into release/v3.8.41. Thanks @JxnLexn for the cleanup!
Verified dead-code removal: merged result passes typecheck:core + 194 affected unit tests + ESLint clean. Integrated into release/v3.8.41. Thanks @JxnLexn for the cleanup!
Verified dead-code removal: merged result passes typecheck:core + 194 affected unit tests + ESLint clean. Integrated into release/v3.8.41. Thanks @JxnLexn for the cleanup!
Verified dead-code removal: merged result passes typecheck:core + 194 affected unit tests + ESLint clean. Integrated into release/v3.8.41. Thanks @JxnLexn for the cleanup!
Verified dead-code removal: merged result passes typecheck:core + 194 affected unit tests + ESLint clean. Integrated into release/v3.8.41. Thanks @JxnLexn for the cleanup!
v3.8.40 cycle integration → main. All test gates green (Unit/Integration/Coverage/Node-compat/Quality-Ratchet). The only red check, 'PR Test Policy', is the test-masking heuristic firing on the cumulative ~57-commit release diff (legitimate assert consolidations already reviewed per-PR — Gemini CLI removal #5246, retired GPT models #5280, provider catalog refreshes); overridden with --admin per the documented release-PR convention. CodeQL/SonarQube advisory scans non-blocking; #5278's code already passed CodeQL on main. Homologated on VPS 192.168.0.15 (v3.8.40 healthy).
Centralizes browser-mutation origin validation into `src/server/origin/publicOrigin.ts` and wires it through the authz pipeline, replacing the per-route same-origin-only check that 403'd dashboard mutations when served behind a reverse proxy on a different public origin. The new module resolves the allowed public origin from configured base-URL env vars or trusted forwarded headers (only when OMNIROUTE_TRUST_PROXY is set AND the peer is loopback/LAN via peer-stamp), validates Sec-Fetch-Site metadata, and sanitizes Host/Forwarded inputs (rejects control chars, userinfo, path/query in Host).
Reviewed sound; validated locally: authz/public-origin + pipeline suites 27/27 green (incl. invalid-origin reject + configured-origin accept), typecheck clean. Maintainer fix-up: moved the new test from tests/unit/server/ (not collected by any runner — orphan-test gate fail) into tests/unit/authz/. Remaining red CI shards are the pre-existing #4076 Dockerfile heap base-red on `main` (unrelated; de-brittled in the v3.8.40 release line).
Co-authored-by: Thinkscape <Thinkscape@users.noreply.github.com>
