Fix auth-host being added to origins even when no origins were wanted.

paskia/__main__.py

@@ -124,7 +124,8 @@ def main():
             args.auth_host = f"https://{args.auth_host}"
         args.auth_host = args.auth_host.rstrip("/")
         validate_auth_host(args.auth_host, args.rp_id)
-        args.origins.insert(0, args.auth_host)  # Ensure first in origins
+        if args.origins:
+            args.origins.insert(0, args.auth_host)  # Ensure first in origins
 
     # Normalize, strip trailing slashes, and deduplicate while preserving order
     origins = list({normalize_origin(o).rstrip("/"): ... for o in (args.origins)})

paskia/util/htmlutil.py

@@ -22,12 +22,6 @@ async def patched_html_response(request, filepath: str, status_code: int, **data
     Returns:
         Patched Response object, or original response if not 200.
     """
-    # Strip caching/compression headers to get raw uncompressed content
-    cache_headers = {b"if-none-match", b"if-modified-since", b"accept-encoding"}
-    request.scope["headers"] = [
-        (k, v) for k, v in request.scope["headers"] if k.lower() not in cache_headers
-    ]
-
     resp = await vitedev.handle(request, frontend, filepath)
     # Pass through non-200 responses
     if resp.status_code != 200:

paskia/util/vitedev.py

@@ -63,4 +63,13 @@ async def handle(request, frontend, filepath: str):
         )
 
     # Fallback to frontend.handle for cache negotiation
+    # Strip accept-encoding to get uncompressed content (needed for HTML patching)
+    strip_headers = {b"accept-encoding", b"if-none-match", b"if-modified-since"}
+    request.scope["headers"] = [
+        (k, v) for k, v in request.scope["headers"] if k.lower() not in strip_headers
+    ]
+    # Invalidate cached Headers object (it doesn't re-read scope after first access)
+    if hasattr(request, "_headers"):
+        del request._headers
+
     return frontend.handle(request, filepath)