fix(portal-clis): reject foreign detail URLs in Jobbank and Jobnet (#672)

* fix(portal-clis): validate Jobbank and Jobnet detail URL hosts

* fix(portal-clis): preserve scheme-less portal detail URLs

Normalize host-like input with HTTPS before validating the portal host. Cover apex, www, mobile, uppercase and legacy routes while rejecting foreign or deceptive hosts and query-only posting paths.

Thanks to MadsLorentzen for finding the compatibility regression in #672.

* changelog: place the #672 entry under [Unreleased]

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

---------

Co-authored-by: Mads Lorentzen <madslorentzen_17@hotmail.com>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

.agents/skills/jobnet-search/cli/src/helpers.ts

@@ -60,7 +60,18 @@ export function normalizeJobId(input: string): string | null {
   const trimmed = input.trim()
   if (!trimmed) return null
   if (/^[a-zA-Z0-9_-]+$/.test(trimmed)) return trimmed
-  const match = trimmed.match(/(?:\/find-job\/|\/JobAdDetails\/|\/Details\/)(?:detaljer\/)?([a-zA-Z0-9_-]+)(?:\/|$|\?|#)/i)
+  let url: URL
+  try {
+    const hostLike = /^[a-z0-9.-]+\.[a-z]{2,}(\/|$)/i.test(trimmed)
+    url = new URL(hostLike ? `https://${trimmed}` : trimmed)
+  } catch {
+    return null
+  }
+  if (url.protocol !== "http:" && url.protocol !== "https:") return null
+  if (url.hostname !== "jobnet.dk" && !url.hostname.endsWith(".jobnet.dk")) return null
+  // Otherwise an unrelated site's matching path silently selects a Jobnet ad.
+  // Keep legacy routes, but never interpret a query or fragment as a job path.
+  const match = url.pathname.match(/(?:\/find-job\/|\/JobAdDetails\/|\/Details\/)(?:detaljer\/)?([a-zA-Z0-9_-]+)(?:\/|$)/i)
   if (match) return match[1]
   return null
 }