v1.8.3 — Stock challenge and authentication documents

Highlights

• Keeps ChatGPT authentication pages and Cloudflare challenge frames stock, so bridge/bootstrap code is limited to verified provider app documents.
• Stops Grok Turnstile loops by requiring a current host-side app-title signal and document epoch before bridge recovery or generic evaluation.
• Uses exact, fail-closed app-host checks; guards eval/callback/adapter refresh paths; and switches login, reload, and new-session transitions to native WebView navigation.
• Adds regression coverage for auth-host collisions, malformed host lists, challenge-title overlap, navigation races, stale document authority, and blocked-document watchdog behavior.

Thanks

A special thank-you to @bamboo94 for diagnosing the real-world ChatGPT login failure and Grok Turnstile loop, preparing the focused first contribution in #58, and giving the project the right direction for this fix. Maintainer follow-up closed the remaining isolation paths while preserving Bamboo's original contribution and attribution.

Validation

• pnpm verify: 465 frontend tests and 22 agent tests, plus typecheck, lint, build, and schema checks.
• Rust: 76/76 all-target tests, cargo fmt --check, and Clippy with warnings denied.
• GitHub: frontend and Rust/Clippy passed on Windows, macOS, and Linux; CodeQL passed; all three release builds completed successfully.
• Artifacts: Windows x64 installer, Windows portable ZIP, Apple Silicon DMG, and Linux amd64 AppImage.

Automated and compile-level validation is complete. Interactive fresh-profile ChatGPT/Grok sign-in and Apple Silicon provider-login smoke tests were not repeated during this release session.

Full Changelog: v1.8.2...v1.8.3