Platform mu-plugin replaces allowed_redirect_hosts instead of merging, breaking cross-host wp_safe_redirect #4363

playground_allowed_redirect_hosts() in packages/playground/wordpress/src/platform-mu-plugins.ts ignores its input and returns a fixed list:

function playground_allowed_redirect_hosts( $deprecated = '' ) {
    return array( 'wordpress.org', 'api.wordpress.org', 'downloads.wordpress.org' );
}
add_filter( 'allowed_redirect_hosts', 'playground_allowed_redirect_hosts' );

This discards every host that WordPress core or plugins add through the same filter. It breaks multisite and multi-domain setups in particular: any cross-site wp_safe_redirect() falls back to the default (wp-admin/) even though the plugin allow-lists the target host. We hit this running a real 11-site multisite in Playground (via WP Codebox): an auth token handoff between two network domains always landed on wp-admin/.

Suggested fix: merge rather than replace:

function playground_allowed_redirect_hosts( $hosts ) {
    return array_merge( (array) $hosts, array( 'wordpress.org', 'api.wordpress.org', 'downloads.wordpress.org' ) );
}

Workaround today: re-add hosts at a later priority. (Filed from Extra-Chill/extrachill-network#302.)