fork release v1.14.28-aai.1

Upstream baseline: v1.14.28
Suffix: aai.1

Fork commits in this release (newest first):
- dc57dfc docs(app): explain why manifest needs crossorigin=use-credentials
- af4358f test(server): cover basic-auth 401 Content-Type regression
- 59428c4 fix(app): drop inline theme-preload substitution to satisfy CSP
- 4eb970c fix(app): use credentials when fetching webmanifest
- 21604ac fix(server): set Content-Type on basic-auth 401 responses
- cf903b1 docs(upstream-merge): codify multi-hop, anchor tag, stale-ref sweep
- c9946cd fix(tests): update stale src/flag/flag imports to @opencode-ai/core
- 01cac83 fix(dashboard): update stale @opencode-ai/shared import to /core

Refs upstream issue anomalyco#18325

fork: v1.14.25-aai.1 — first downstream merge of upstream v1.14.25 + …

…stuck Thinking fix

This release marks the first upstream-baseline bump for the fork.
The aai.N suffix resets to .1 (per AGENTS.md fork-maintenance rule).

Upstream merge of v1.14.25 (~29 commits between v1.14.24 and v1.14.25):
- HttpApi migration progress (auth/file/mcp/etc bridge routes)
- Ripgrep schema migration to Effect
- Permission config schema with full IntelliSense for tool keys
- gpt-5.5 zen, deepseek v4 pro
- OpenTUI 0.1.99 -> 0.1.103, opentui-spinner 0.0.6 added to catalog
- LSP request details in permission metadata
- Various fixes (shell cwd after login startup, beta validation,
  permission config order, gpt-5.5 compaction context size)

Merge was clean: 75 staged files, 0 conflicts, only package.json
auto-merged for catalog version bumps. No UI conflicts with our
mobile/web port.

Fork-only changes since v1.14.24-aai.7:

- fix(timeline): trust session_status only for working derivation
  (3e7acb8)
- fix(session): trust session_status only in busy() helper (91ae391)
- fix(sidebar): trust session_status only in SessionItem.isWorking
  (347095d)
- fix(session-turn): last-message-only pending guard (ef4e181)
  Refs upstream PR anomalyco#17593

  Together these fix the long-standing stuck 'Thinking' shimmer and
  stuck Stop button on the input bar. Empirically: 12 incomplete
  assistant messages persist in DB residue from previously-crashed
  streams; the UI now ignores them as working signals.

- docs(plan): stuck Thinking / busy session indicator analysis
  (7a2f630)
- docs(agents): codify fork-maintenance philosophy in AGENTS.md
  (5a1bd96)

fork: v1.14.24-aai.7 — mobile tab-switch fix + README mission + relea…

…se auth fix

- fix(mobile): keep both session and changes panes mounted on tab
  switch. Tapping back to Session from Changes on long sessions
  previously felt 'dead' for hundreds of ms because the entire
  MessageTimeline subtree was unmounted and remounted by the
  underlying `<Show fallback>`. Lift both panes out as siblings
  with CSS visibility toggling so the tab tap is an O(1) class swap
  and message scroll position survives toggling.

- docs(readme): clarify fork mission — focus is dramatically
  improving the mobile and web experience while mirroring upstream
  OpenCode. Core stays compatible (no API or schema breaks); the
  fork carries patches for bugs and key issues; generally-useful
  work intended to flow back upstream. Contributions welcome under
  those criteria.

- fix(release): authenticate the tag-reachability check against
  api.github.com. The release phase was hitting the unauthenticated
  60/hr per-IP rate limit and returning HTTP 403, which bricked the
  aai.6 run before any artifacts uploaded.

fork: v1.14.24-aai.6 — webui-plus UI port

Ports outstanding UI/UX work from opencode-webui-plus@web-fork into
actualyze: iOS PWA support, mobile session/changes pill in titlebar,
mobile refresh button with reconnect indicator, inline prompt input
layout, calmer progress animation, mobile bash output cap, persisted
project cache, and 12 other polish items. 19 port commits total;
server-lifecycle/daemon/plus-overlay work intentionally out of scope.

See docs/plans/webui-plus-port.md and
docs/code-analysis/webui-plus-port-gaps.md for details.

v1.14.24-aai.5

- feat(server): add disk-mode web UI fallback for source runs
- feat(app): native dashboard, status provider, and non-loopback auth gate
- chore(scripts): add oc source-mode dev wrapper

fix(installation): wire opencode upgrade to the fork registry

- bake OPENCODE_REPO/OPENCODE_NPM_PACKAGE/OPENCODE_NPM_REGISTRY into the binary at build time

- query @rmk40/opencode@aai on https://npm.pkg.github.com instead of upstream npmjs

- filter the GitHub releases list by channel pattern so prereleases are picked up

- refuse curl/brew/scoop/choco upgrade paths when an npm registry is configured

- validate the upgrade target argv shape and JSON.stringify build defines

- add docs/FORK_RELEASE_PIPELINE.md as the canonical operational reference

ci(release): derive tag version in parent shell before subshell calls

- version_for is invoked in $(...) subshells so prior derive_version_from_tag assignments were lost

- run derive_version_from_tag directly in validate_cmd and build_cmd so UPSTREAM_VERSION/SUFFIX persist into metadata.json

ci(release): install Alpine runtime deps for musl smoke tests

- install libstdc++ and libgcc before executing musl binaries in Alpine

- document the runtime library requirement for future CI debugging