按规划继续工作

结论：补充 INI 派生机器文件名的 OPFS 路径拒绝回归测试，确认非法遍历和嵌套路径不会进入主机存储，并通过 host/WASM/browser 聚合验证。

wasm-port/tests/opfs/node/verify_file_service.mjs

@@ -209,6 +209,13 @@ const bridgeIniSdk = {
     ) {
       return "custom.var";
     }
+    if (
+      path === "/work/invalid-ini-file-session.ini" &&
+      section === "RS274NGC" &&
+      tag === "PARAMETER_FILE"
+    ) {
+      return "../escape.var";
+    }
     if (
       path === "/work/ini-file-session.ini" &&
       section === "EMCIO" &&
@@ -216,6 +223,13 @@ const bridgeIniSdk = {
     ) {
       return "custom-tool.tbl";
     }
+    if (
+      path === "/work/invalid-tool-file-session.ini" &&
+      section === "EMCIO" &&
+      tag === "TOOL_TABLE"
+    ) {
+      return "nested/tool.tbl";
+    }
     return null;
   },
   getBool(path, section, tag) {
@@ -416,6 +430,52 @@ assert.equal(
   "tooldata_load=0\nload_tool_path=/work/ini-file-session-tool.tbl\nrandom_toolchanger=0\n",
 );
 
+await saveMachineTextFiles("invalid-ini-file-session", {
+  ini: [
+    "[EMC]",
+    "MACHINE = invalid-ini-file-session",
+    "",
+    "[RS274NGC]",
+    "PARAMETER_FILE = ../escape.var",
+    "",
+  ].join("\n"),
+}, { storage });
+await assert.rejects(
+  () => loadMachineSessionFromOpfs(
+    bridgeInterp,
+    "invalid-ini-file-session",
+    {
+      storage,
+      iniSdk: bridgeIniSdk,
+      iniWasmPath: "/work/invalid-ini-file-session.ini",
+    },
+  ),
+  /Invalid parameter filename/,
+);
+
+await saveMachineTextFiles("invalid-tool-file-session", {
+  ini: [
+    "[EMC]",
+    "MACHINE = invalid-tool-file-session",
+    "",
+    "[EMCIO]",
+    "TOOL_TABLE = nested/tool.tbl",
+    "",
+  ].join("\n"),
+}, { storage });
+await assert.rejects(
+  () => loadMachineSessionFromOpfs(
+    bridgeInterp,
+    "invalid-tool-file-session",
+    {
+      storage,
+      iniSdk: bridgeIniSdk,
+      iniWasmPath: "/work/invalid-tool-file-session.ini",
+    },
+  ),
+  /Invalid tool table filename/,
+);
+
 await assert.rejects(
   () => loadTextFile("linuxcnc/machines/missing.ini", storage),
   /missing file/,