2 Commits

Author	SHA1	Message	Date
diegosouzapw	a907ae714c	test(security): parse hostname instead of URL substring match ... Replace `result.url.includes("poe.com")` / `.includes("doubao.com")` with a parsed `new URL(result.url).hostname` check that accepts the exact host or a legitimate subdomain (`.endsWith(".poe.com")`). The substring form also matches hostile URLs like `https://evil.com/?x=poe.com`, which CodeQL flags as js/incomplete-url-substring-sanitization (2 high-severity alerts on PR #2930). This strengthens the assertion rather than masking it — the executors build `https://www.poe.com` / `https://www.doubao.com`, both still satisfied.	2026-06-02 23:40:22 -03:00
Paijo	89c52d4f04	fix: resolve pre-existing test failures (env sync, PII, quota, sidebar) (#3039) ... Integrated into release/v3.8.8. 9 legit test alignments + 34 new test files kept; restored 5 masked assertions (sk_ key redaction, circular/SSN redaction, T24 wait-log, THEORY-004 SSE, relay handoff) to strict/meaningful checks. Thanks @oyi77!	2026-06-01 14:52:50 -03:00