Diego Rodrigues de Sa e Souza d82b68274c fix(sse): exact-domain cookie match and origin-equality URL assertions (#11452) ...

Clears CodeQL js/incomplete-url-substring-sanitization alerts #860-#865:

- volcengineConsoleAutoLogin: cookie domain filter now uses an exact/
  dot-suffix helper (isVolcengineCookieDomain) instead of substring
  includes(), rejecting look-alike hosts like volcengine.com.evil.test
- security-s1-s2-s4 tests: agent-card/agent.json URL assertions compare
  parsed origin equality instead of startsWith prefix

Co-authored-by: Markus Hartung <mail@hartmark.se>

2026-08-24 23:46:45 -03:00

..

_helpers

…

_setup

…

benchmarks

…

boundary

…

e2e

fix(providers): validate bailian-coding-plan against the Token Plan host (#10634)

2026-08-18 05:51:34 -03:00

fixtures

fix(responses-continuation): recover a real id/output for passthrough and translate-mode replies (#11434)

2026-08-24 19:57:12 -03:00

golden-set

…

helpers

fix(responses): replace synthetic reasoning keepalive (#10806)

2026-08-20 09:49:55 -03:00

homolog

…

integration

fix(responses-continuation): recover a real id/output for passthrough and translate-mode replies (#11434)

2026-08-24 19:57:12 -03:00

live

…

llm-security

…

load

…

manual

…

security

…

snapshots

Integration: security tier + self-hosted operator blockers (rebased onto v3.8.51) (#10952)

2026-08-23 16:51:25 -03:00

translator

…

unit

fix(sse): exact-domain cookie match and origin-equality URL assertions (#11452)

2026-08-24 23:46:45 -03:00

_cp_mock_hook.mts

…

_cp_mock_module.mts

…

_run_dns_guard_test.sh

…

e2e-tool-calls.sh

…

theoldllm-stress.test.ts

…