v3.10.8: Fix Re-OAuth buttons, block staging/sandbox for Antigravity, prefer production endpoint

- Fix Linux GUI Re-OAuth: load_oauth_secrets() was undefined, now loads inline
- Fix GLib.idle_add lambda returning truthy tuple (repeated callbacks)
- Proxy: production cloudcode-pa.googleapis.com tried first, sandbox as fallback
- Proxy: 403 SERVICE_DISABLED falls through to next endpoint
- Project discovery validates against production endpoint, not staging
- Antigravity preset base_url changed to production
- Windows GUI project discovery also uses production endpoint

CHANGELOG.md

@@ -1,5 +1,25 @@
 # Changelog
 
+## v3.10.8 (2026-05-25)
+
+**OAuth & Antigravity Endpoint Fixes**
+
+### Re-OAuth Buttons Fixed
+- Linux GUI: `load_oauth_secrets()` was undefined — buttons crashed silently on click
+- Now loads OAuth secrets inline from `~/.config/codex-launcher/oauth-secrets.json`
+- Both Linux and Windows Re-OAuth use PKCE + localhost callback (was deprecated OOB paste)
+
+### Antigravity Staging/Sandbox Blocked by Default
+- Proxy: production `cloudcode-pa.googleapis.com` tried FIRST, sandbox/daily/autopush as fallback only
+- Proxy: 403 SERVICE_DISABLED now falls through to next endpoint instead of returning error immediately
+- Project discovery: validates against production endpoint, not staging-cloudaicompanion.sandbox
+- Antigravity preset `base_url` changed to production (was `daily-cloudcode-pa.sandbox.googleapis.com`)
+- `[antigravity-endpoint]` log line shows which endpoints are being tried
+
+### Other Fixes
+- GLib.idle_add lambda returning truthy tuple fixed (caused repeated callbacks)
+- Windows GUI project discovery also uses production endpoint
+
 ## v3.10.7 (2026-05-25)
 
 **Prompt Enhancer — Fix Lost Context After Compaction**