Expand P2 test coverage: mining chain, spread lanes, path forge, WS/beacon, E2E onion, file handling

agent/deploy/desktop_path_test.go

@@ -34,6 +34,40 @@ func TestResolveRemotePathDesktopPrefix(t *testing.T) {
 	}
 }
 
+func TestResolveRemotePathRejectsTraversalVariants(t *testing.T) {
+	cases := []string{
+		"../../etc/passwd",
+		`..\..\Windows\System32\config\sam`,
+		"uploads/../../outside.txt",
+		"/var/log/../../etc/shadow",
+		"..",
+		"~/../../etc/passwd",
+		"@desktop/../../outside.txt",
+		"desktop:../../payload.bin",
+		"safe/inner/../../../etc/shadow",
+	}
+	for _, path := range cases {
+		if _, err := ResolveRemotePath(path); err == nil {
+			t.Fatalf("ResolveRemotePath(%q) should reject traversal", path)
+		} else if !strings.Contains(err.Error(), "path traversal") {
+			t.Fatalf("ResolveRemotePath(%q) error=%q", path, err.Error())
+		}
+	}
+}
+
+func TestRemotePathHasTraversal(t *testing.T) {
+	for _, path := range []string{"../x", "desktop:../../x", "foo/../bar"} {
+		if !remotePathHasTraversal(path) {
+			t.Fatalf("expected traversal for %q", path)
+		}
+	}
+	for _, path := range []string{"~/Downloads", "notes.txt", "@desktop/report.pdf"} {
+		if remotePathHasTraversal(path) {
+			t.Fatalf("safe path flagged as traversal: %q", path)
+		}
+	}
+}
+
 func TestUserDesktopDir(t *testing.T) {
 	dir, err := UserDesktopDir()
 	if err != nil {