按规划继续工作

结论：补齐 OPFS G-code 程序文件名的自定义路径与非法遍历/嵌套路径拒绝验证，覆盖 Node OPFS 与 Chromium OPFS 路径，并通过 host/WASM/browser 聚合验证。

wasm-port/tests/browser/ini_panel_smoke.html

@@ -9,7 +9,11 @@
   <script type="module">
     import { createLinuxCncIniSdk } from "../../runtime/sdk/src/index.js";
     import { loadTextFile, saveTextFile } from "../../runtime/opfs/file-service.js";
-    import { machineIniPath, sessionSnapshotPath } from "../../runtime/opfs/path-model.js";
+    import {
+      gcodeProgramPath,
+      machineIniPath,
+      sessionSnapshotPath,
+    } from "../../runtime/opfs/path-model.js";
     import {
       loadSessionSnapshot,
       saveSessionSnapshot,
@@ -201,8 +205,25 @@ JOINTS = 3
       assertEqual(machineFiles.ini, iniText, "machine ini text");
       assertEqual(machineFiles.toolTable, "T0 P0 ; no tool\n", "tool table text");
       assertEqual(machineFiles.parameters, "5161 0.0\n", "parameter text");
+      assertEqual(
+        gcodeProgramPath("browser-custom.ngc"),
+        "linuxcnc/gcode/browser-custom.ngc",
+        "custom G-code path",
+      );
       await saveGcodeProgram("browser-smoke.ngc", "G0 X0 Y0\nM2\n");
       assertEqual(await loadGcodeProgram("browser-smoke.ngc"), "G0 X0 Y0\nM2\n", "gcode text");
+      await saveGcodeProgram("browser-custom.ngc", "G1 X1 F10\nM2\n");
+      assertEqual(await loadGcodeProgram("browser-custom.ngc"), "G1 X1 F10\nM2\n", "custom gcode text");
+      await assertRejects(
+        "browser G-code invalid filename save",
+        () => saveGcodeProgram("nested/browser.ngc", ""),
+        /Invalid G-code filename/,
+      );
+      await assertRejects(
+        "browser G-code invalid filename load",
+        () => loadGcodeProgram("../escape.ngc"),
+        /Invalid G-code filename/,
+      );
 
       const uiDocument = await loadUiFrame();
       await waitFor(

wasm-port/tests/opfs/node/verify_file_service.mjs

@@ -102,6 +102,7 @@ assert.equal(machineIniPath("xyzab-tdr"), "linuxcnc/machines/xyzab-tdr/machine.i
 assert.equal(toolTablePath("xyzab-tdr"), "linuxcnc/machines/xyzab-tdr/tool.tbl");
 assert.equal(parameterFilePath("xyzab-tdr"), "linuxcnc/machines/xyzab-tdr/linuxcnc.var");
 assert.equal(gcodeProgramPath("fixture.ngc"), "linuxcnc/gcode/fixture.ngc");
+assert.equal(gcodeProgramPath("custom-fixture.ngc"), "linuxcnc/gcode/custom-fixture.ngc");
 assert.equal(previewCachePath("fixture"), "linuxcnc/preview-cache/fixture/preview.json");
 assert.equal(sessionSnapshotPath("session-1"), "linuxcnc/sessions/session-1/snapshot.json");
 assert.equal(
@@ -204,6 +205,11 @@ assert.equal(
   "linuxcnc/gcode/fixture.ngc",
 );
 assert.equal(await loadGcodeProgram("fixture.ngc", { storage }), "G0 X0 Y0\nM2\n");
+assert.equal(
+  await saveGcodeProgram("custom-fixture.ngc", "G1 X1 F10\nM2\n", { storage }),
+  "linuxcnc/gcode/custom-fixture.ngc",
+);
+assert.equal(await loadGcodeProgram("custom-fixture.ngc", { storage }), "G1 X1 F10\nM2\n");
 
 const bridgeFiles = new Map();
 const bridgeInterp = {
@@ -594,6 +600,18 @@ assert.throws(
   () => sessionSnapshotPath("session-1", "nested/snapshot.json"),
   /Invalid session snapshot filename/,
 );
+assert.throws(
+  () => gcodeProgramPath("../escape.ngc"),
+  /Invalid G-code filename/,
+);
+await assert.rejects(
+  () => saveGcodeProgram("nested/fixture.ngc", "", { storage }),
+  /Invalid G-code filename/,
+);
+await assert.rejects(
+  () => loadGcodeProgram("../escape.ngc", { storage }),
+  /Invalid G-code filename/,
+);
 await assert.rejects(
   () => saveSessionSnapshot("session-1", {}, {
     storage,