Consolidate path safety, temp downloads, and cleanup validation helpers

internal/pathsafe/relative_destination.go

@@ -0,0 +1,38 @@
+package pathsafe
+
+import (
+	"errors"
+	"path"
+	"regexp"
+	"strings"
+)
+
+var (
+	ErrRelativePathRequired = errors.New("relative path is required")
+	ErrRelativePathAbsolute = errors.New("relative path must not be absolute")
+	ErrRelativePathEscape   = errors.New("relative path escapes root")
+)
+
+var windowsAbsPathRE = regexp.MustCompile(`^[a-zA-Z]:[\\/]`)
+
+// NormalizeRelativeDestination validates and normalizes a relative destination
+// path to slash-separated form.
+func NormalizeRelativeDestination(relative string) (string, error) {
+	trimmed := strings.TrimSpace(relative)
+	if trimmed == "" {
+		return "", ErrRelativePathRequired
+	}
+	if strings.HasPrefix(trimmed, "/") || strings.HasPrefix(trimmed, `\`) || windowsAbsPathRE.MatchString(trimmed) {
+		return "", ErrRelativePathAbsolute
+	}
+
+	normalized := strings.ReplaceAll(trimmed, `\`, "/")
+	cleaned := path.Clean(normalized)
+	if cleaned == "." || cleaned == "" {
+		return "", ErrRelativePathRequired
+	}
+	if cleaned == ".." || strings.HasPrefix(cleaned, "../") {
+		return "", ErrRelativePathEscape
+	}
+	return cleaned, nil
+}

internal/pathsafe/relative_destination_test.go

@@ -0,0 +1,43 @@
+package pathsafe
+
+import (
+	"errors"
+	"testing"
+)
+
+func TestNormalizeRelativeDestination(t *testing.T) {
+	tests := []struct {
+		name    string
+		input   string
+		want    string
+		wantErr error
+	}{
+		{name: "simple", input: "artifacts/session_recap.md", want: "artifacts/session_recap.md"},
+		{name: "backslashes become slashes", input: `artifacts\session_recap.md`, want: "artifacts/session_recap.md"},
+		{name: "cleans dot segments", input: "artifacts/./session_recap.md", want: "artifacts/session_recap.md"},
+		{name: "reject empty", input: "", wantErr: ErrRelativePathRequired},
+		{name: "reject dot", input: ".", wantErr: ErrRelativePathRequired},
+		{name: "reject unix absolute", input: "/artifacts/session_recap.md", wantErr: ErrRelativePathAbsolute},
+		{name: "reject windows absolute", input: `C:\artifacts\session_recap.md`, wantErr: ErrRelativePathAbsolute},
+		{name: "reject traversal", input: "../artifacts/session_recap.md", wantErr: ErrRelativePathEscape},
+		{name: "reject traversal after clean", input: "a/../../session_recap.md", wantErr: ErrRelativePathEscape},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got, err := NormalizeRelativeDestination(tt.input)
+			if tt.wantErr != nil {
+				if !errors.Is(err, tt.wantErr) {
+					t.Fatalf("NormalizeRelativeDestination() error = %v, want %v", err, tt.wantErr)
+				}
+				return
+			}
+			if err != nil {
+				t.Fatalf("NormalizeRelativeDestination() error = %v", err)
+			}
+			if got != tt.want {
+				t.Fatalf("NormalizeRelativeDestination() = %q, want %q", got, tt.want)
+			}
+		})
+	}
+}