Consolidate path safety, temp downloads, and cleanup validation helpers

internal/pathsafe/relative_destination_test.go

@@ -0,0 +1,43 @@
+package pathsafe
+
+import (
+	"errors"
+	"testing"
+)
+
+func TestNormalizeRelativeDestination(t *testing.T) {
+	tests := []struct {
+		name    string
+		input   string
+		want    string
+		wantErr error
+	}{
+		{name: "simple", input: "artifacts/session_recap.md", want: "artifacts/session_recap.md"},
+		{name: "backslashes become slashes", input: `artifacts\session_recap.md`, want: "artifacts/session_recap.md"},
+		{name: "cleans dot segments", input: "artifacts/./session_recap.md", want: "artifacts/session_recap.md"},
+		{name: "reject empty", input: "", wantErr: ErrRelativePathRequired},
+		{name: "reject dot", input: ".", wantErr: ErrRelativePathRequired},
+		{name: "reject unix absolute", input: "/artifacts/session_recap.md", wantErr: ErrRelativePathAbsolute},
+		{name: "reject windows absolute", input: `C:\artifacts\session_recap.md`, wantErr: ErrRelativePathAbsolute},
+		{name: "reject traversal", input: "../artifacts/session_recap.md", wantErr: ErrRelativePathEscape},
+		{name: "reject traversal after clean", input: "a/../../session_recap.md", wantErr: ErrRelativePathEscape},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got, err := NormalizeRelativeDestination(tt.input)
+			if tt.wantErr != nil {
+				if !errors.Is(err, tt.wantErr) {
+					t.Fatalf("NormalizeRelativeDestination() error = %v, want %v", err, tt.wantErr)
+				}
+				return
+			}
+			if err != nil {
+				t.Fatalf("NormalizeRelativeDestination() error = %v", err)
+			}
+			if got != tt.want {
+				t.Fatalf("NormalizeRelativeDestination() = %q, want %q", got, tt.want)
+			}
+		})
+	}
+}