test: add path containment, builder edge-case, and batch template tests

- Export resolveWorkspaceRelativePath for testable path validation
- Add 11 tests for path containment: traversal, outside workspace, root (#33)
- Add 6 edge-case builder tests: empty/regex/unicode/spaces (#32)
- Add 3 batch template field-presence tests (#34)
- Update AGENTS.md test counts (batchApply 7->10, quickActions 15->26)

Tests: 140 -> 154

Closes #32
Closes #33
Closes #34

Signed-off-by: Sebastien Tardif <sebtardif@ncf.ca>

Author: SebTardif

AGENTS.md

@@ -43,15 +43,15 @@ src/
   workspace/readiness.ts Workspace readiness: environment detection, folder selection
 test/
   unit/                  Unit tests (node:test, dependency-injected, no VS Code API)
-    batchApply.test.ts   Batch template and operation count parsing (7 tests)
+    batchApply.test.ts   Batch template and operation count parsing (10 tests)
     binary.test.ts       Binary discovery, managed install, compatibility, workspace env (38 tests)
     binaryDiscovery.test.ts  Real executable discovery on PATH (10 tests)
     initializeProject.test.ts  Status display, agents file classification, formatError (18 tests)
     managedLifecycle.test.ts   Managed install with real file I/O (12 tests)
     mcpConfig.test.ts    MCP config with real temp directories (9 tests)
     outputChannel.test.ts Output channel logging wrapper (8 tests)
     patchloomCli.test.ts Patchloom CLI integration tests with real binary (23 tests)
-    quickActions.test.ts Quick action command building (15 tests)
+    quickActions.test.ts Quick action command building, path containment (26 tests)
   suite/
     index.ts             VS Code extension integration tests
     runExtensionTests.ts  Test runner using @vscode/test-electron

src/commands/quickActions.ts

@@ -555,19 +555,24 @@ async function inputWorkspaceFileTarget(folder: VSCode.WorkspaceFolder): Promise
   }
 }
 
-function toWorkspaceFileTarget(folder: VSCode.WorkspaceFolder, absolutePath: string): WorkspaceFileTarget {
-  const workspaceRoot = path.resolve(folder.uri.fsPath);
+export function resolveWorkspaceRelativePath(workspaceRoot: string, absolutePath: string): string {
+  const resolvedRoot = path.resolve(workspaceRoot);
   const resolvedPath = path.resolve(absolutePath);
-  const relativePath = path.relative(workspaceRoot, resolvedPath);
+  const relativePath = path.relative(resolvedRoot, resolvedPath);
   if (!relativePath || relativePath.startsWith("..") || path.isAbsolute(relativePath)) {
     throw new Error("File path must stay inside the current workspace folder.");
   }
+  return relativePath.split(path.sep).join("/");
+}
+
+function toWorkspaceFileTarget(folder: VSCode.WorkspaceFolder, absolutePath: string): WorkspaceFileTarget {
+  const relativePath = resolveWorkspaceRelativePath(folder.uri.fsPath, absolutePath);
 
   return {
     workspaceFolder: folder,
-    absolutePath: resolvedPath,
-    relativePath: relativePath.split(path.sep).join("/"),
-    uri: folder.uri.with({ path: path.posix.join(folder.uri.path, relativePath.split(path.sep).join("/")) })
+    absolutePath: path.resolve(absolutePath),
+    relativePath,
+    uri: folder.uri.with({ path: path.posix.join(folder.uri.path, relativePath) })
   };
 }
 

test/unit/batchApply.test.ts

@@ -46,3 +46,31 @@ test("parseBatchOperationCount returns 0 when operations is not an array", () =>
   assert.equal(parseBatchOperationCount('{"operations": 42}'), 0);
   assert.equal(parseBatchOperationCount('{"operations": null}'), 0);
 });
+
+// --- #34: snapshot-style template tests ---
+
+test("buildBatchTemplate replace operation has required fields", () => {
+  const parsed = JSON.parse(buildBatchTemplate());
+  const replace = parsed.operations[0];
+  assert.equal(replace.op, "replace");
+  assert.ok("file" in replace, "replace operation missing 'file'");
+  assert.ok("from" in replace, "replace operation missing 'from'");
+  assert.ok("to" in replace, "replace operation missing 'to'");
+});
+
+test("buildBatchTemplate tidy operation has required fields", () => {
+  const parsed = JSON.parse(buildBatchTemplate());
+  const tidy = parsed.operations[1];
+  assert.equal(tidy.op, "tidy");
+  assert.ok("file" in tidy, "tidy operation missing 'file'");
+  assert.ok(Array.isArray(tidy.fixes), "tidy operation 'fixes' should be an array");
+});
+
+test("buildBatchTemplate doc-set operation has required fields", () => {
+  const parsed = JSON.parse(buildBatchTemplate());
+  const docSet = parsed.operations[2];
+  assert.equal(docSet.op, "doc-set");
+  assert.ok("file" in docSet, "doc-set operation missing 'file'");
+  assert.ok("selector" in docSet, "doc-set operation missing 'selector'");
+  assert.ok("value" in docSet, "doc-set operation missing 'value'");
+});

test/unit/quickActions.test.ts

@@ -1,5 +1,6 @@
 import assert from "node:assert/strict";
 import test from "node:test";
+import path from "node:path";
 import {
   buildCreateQuickAction,
   buildDocGetQuickAction,
@@ -8,6 +9,7 @@ import {
   buildSearchQuickAction,
   buildTidyQuickAction,
   isStructuredDocumentPath,
+  resolveWorkspaceRelativePath,
   retargetQuickAction,
   withApplyFlag
 } from "../../src/commands/quickActions.js";
@@ -157,3 +159,71 @@ test("buildDocGetQuickAction builds a doc get command", () => {
   assert.deepEqual(action.args, ["doc", "get", "/workspace/demo/package.json", "scripts.test"]);
   assert.deepEqual(action.targetArgIndices, [2]);
 });
+
+// --- #33: resolveWorkspaceRelativePath path containment ---
+
+test("resolveWorkspaceRelativePath accepts path inside workspace", () => {
+  const rel = resolveWorkspaceRelativePath("/workspace/demo", "/workspace/demo/src/file.ts");
+  assert.equal(rel, "src/file.ts");
+});
+
+test("resolveWorkspaceRelativePath accepts nested subdirectory", () => {
+  const rel = resolveWorkspaceRelativePath("/workspace/demo", "/workspace/demo/a/b/c/d.txt");
+  assert.equal(rel, "a/b/c/d.txt");
+});
+
+test("resolveWorkspaceRelativePath rejects traversal with ..", () => {
+  assert.throws(
+    () => resolveWorkspaceRelativePath("/workspace/demo", "/workspace/demo/../../etc/passwd"),
+    { message: "File path must stay inside the current workspace folder." }
+  );
+});
+
+test("resolveWorkspaceRelativePath rejects absolute path outside workspace", () => {
+  assert.throws(
+    () => resolveWorkspaceRelativePath("/workspace/demo", "/tmp/evil.txt"),
+    { message: "File path must stay inside the current workspace folder." }
+  );
+});
+
+test("resolveWorkspaceRelativePath rejects workspace root itself", () => {
+  assert.throws(
+    () => resolveWorkspaceRelativePath("/workspace/demo", "/workspace/demo"),
+    { message: "File path must stay inside the current workspace folder." }
+  );
+});
+
+// --- #32: edge-case builder tests ---
+
+test("buildSearchQuickAction with empty pattern produces valid args", () => {
+  const action = buildSearchQuickAction("/workspace/demo", "");
+  assert.deepEqual(action.args, ["search", "", "/workspace/demo"]);
+});
+
+test("buildSearchQuickAction with regex special characters", () => {
+  const action = buildSearchQuickAction("/workspace/demo", "foo.*bar\\(baz\\)");
+  assert.deepEqual(action.args, ["search", "foo.*bar\\(baz\\)", "/workspace/demo"]);
+});
+
+test("buildCreateQuickAction with spaces in path", () => {
+  const action = buildCreateQuickAction("/workspace/my project/src/new file.ts");
+  assert.equal(action.title, "Create new file.ts");
+  assert.deepEqual(action.args, ["create", "/workspace/my project/src/new file.ts"]);
+});
+
+test("buildDocGetQuickAction with deeply nested selector", () => {
+  const action = buildDocGetQuickAction("/workspace/demo/config.yaml", "a.b.c.d.e");
+  assert.equal(action.title, "Get a.b.c.d.e from config.yaml");
+  assert.deepEqual(action.args, ["doc", "get", "/workspace/demo/config.yaml", "a.b.c.d.e"]);
+});
+
+test("buildCreateQuickAction with unicode filename", () => {
+  const action = buildCreateQuickAction("/workspace/demo/docs/日本語.md");
+  assert.equal(action.title, "Create 日本語.md");
+  assert.deepEqual(action.args, ["create", "/workspace/demo/docs/日本語.md"]);
+});
+
+test("buildSearchQuickAction with unicode pattern", () => {
+  const action = buildSearchQuickAction("/workspace/demo", "café");
+  assert.deepEqual(action.args, ["search", "café", "/workspace/demo"]);
+});