chore: linting

e2e/lib/app.mjs

@@ -485,7 +485,7 @@ export class AppSession {
       // The validated response is intentionally persisted in an isolated test directory.
       await writeFile(
         path.join(this.root, "artifacts", `${safe}.png`),
-        artifact, // codeql[js/http-to-file-access]
+        artifact,
       );
     } catch {
       // Best-effort diagnostics must never hide the original test failure.
@@ -495,7 +495,7 @@ export class AppSession {
       // Escaping makes the saved HTML inert while preserving it for diagnostics.
       await writeFile(
         path.join(this.root, "artifacts", `${safe}.html`),
-        artifact, // codeql[js/http-to-file-access]
+        artifact,
       );
     } catch {
       // Best-effort diagnostics must never hide the original test failure.

e2e/tests/entities.test.mjs

@@ -364,10 +364,20 @@ test("extensions, extension groups, VPN storage, DNS rules, and event-backed ass
       allowlistMode: false,
     });
     assert.deepEqual(dns.block_domains, ["ads.example.com", "tracker.example"]);
+    assert.deepEqual(dns.allow_domains, ["safe.example"]);
     const textExport = await app.invoke("export_custom_dns_rules", {
       format: "txt",
     });
-    assert.match(textExport, /ads\.example\.com/);
+    assert.equal(
+      textExport,
+      [
+        `! source: ${process.env.DONUT_E2E_FIXTURE_URL}/dns.txt`,
+        "@@safe.example",
+        "ads.example.com",
+        "tracker.example",
+        "",
+      ].join("\n"),
+    );
     await app.invoke("import_custom_dns_rules", {
       format: "txt",
       content: "||malware.example^\n@@||allowed.example^\n",

e2e/tests/network.test.mjs

@@ -436,6 +436,12 @@ async function createXrayProfile(app, version) {
   });
 }
 
+// Matches a whole Xray-core access log line whose destination is exactly
+// api.ipify.org:443 ("... accepted tcp:api.ipify.org:443 [outbound]"). The
+// leading delimiter keeps a lookalike host such as notapi.ipify.org:443 from
+// passing the assertion.
+const XRAY_ACCESS_LOG_TARGET = /^.*[\s:]api\.ipify\.org:443(?:\s.*)?$/;
+
 test("VLESS Reality persists, imports, routes through Xray-core, records traffic, and cleans up", async () => {
   const vlessUri = process.env.DONUT_E2E_VLESS_URI;
   const accessLog = process.env.DONUT_E2E_XRAY_ACCESS_LOG;
@@ -654,9 +660,9 @@ test("VLESS Reality persists, imports, routes through Xray-core, records traffic
 
     await app.waitFor(
       async () =>
-        (await readFile(accessLog, "utf8").catch(() => "")).includes(
-          "api.ipify.org:443",
-        ),
+        (await readFile(accessLog, "utf8").catch(() => ""))
+          .split("\n")
+          .some((line) => XRAY_ACCESS_LOG_TARGET.test(line)),
       {
         timeoutMs: 15_000,
         description: "request in Xray-core server access log",