Validate portable workspace identifiers

internal/manifest/identity_validation_test.go

@@ -0,0 +1,36 @@
+package manifest
+
+import (
+	"context"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+	"time"
+)
+
+func TestLocalStoreRejectsUnsafeLegacyIdentity(t *testing.T) {
+	now := time.Now().UTC()
+	path := filepath.Join(t.TempDir(), "manifest.json")
+	data := []byte(`{"session_id":"../escape","campaign":"campaign","created_at":"` + now.Format(time.RFC3339Nano) + `","updated_at":"` + now.Format(time.RFC3339Nano) + `","stages":{}}`)
+	if err := os.WriteFile(path, data, 0o600); err != nil {
+		t.Fatalf("WriteFile() error = %v", err)
+	}
+
+	_, err := (&LocalStore{}).Load(context.Background(), path)
+	if err == nil || !strings.Contains(err.Error(), "migrate the legacy manifest") {
+		t.Fatalf("Load() error = %v, want migration guidance", err)
+	}
+}
+
+func TestLocalStoreRefusesUnsafeIdentityOnSave(t *testing.T) {
+	now := time.Now().UTC()
+	m := New("session", now)
+	m.Campaign = "../outside"
+	path := filepath.Join(t.TempDir(), "manifest.json")
+
+	err := (&LocalStore{}).Save(context.Background(), path, m)
+	if err == nil || !strings.Contains(err.Error(), "migrate the legacy manifest") {
+		t.Fatalf("Save() error = %v, want migration guidance", err)
+	}
+}