按规划继续工作

结论：补齐 OPFS G-code 程序文件名的自定义路径与非法遍历/嵌套路径拒绝验证，覆盖 Node OPFS 与 Chromium OPFS 路径，并通过 host/WASM/browser 聚合验证。

wasm-port/tests/opfs/node/verify_file_service.mjs

@@ -102,6 +102,7 @@ assert.equal(machineIniPath("xyzab-tdr"), "linuxcnc/machines/xyzab-tdr/machine.i
 assert.equal(toolTablePath("xyzab-tdr"), "linuxcnc/machines/xyzab-tdr/tool.tbl");
 assert.equal(parameterFilePath("xyzab-tdr"), "linuxcnc/machines/xyzab-tdr/linuxcnc.var");
 assert.equal(gcodeProgramPath("fixture.ngc"), "linuxcnc/gcode/fixture.ngc");
+assert.equal(gcodeProgramPath("custom-fixture.ngc"), "linuxcnc/gcode/custom-fixture.ngc");
 assert.equal(previewCachePath("fixture"), "linuxcnc/preview-cache/fixture/preview.json");
 assert.equal(sessionSnapshotPath("session-1"), "linuxcnc/sessions/session-1/snapshot.json");
 assert.equal(
@@ -204,6 +205,11 @@ assert.equal(
   "linuxcnc/gcode/fixture.ngc",
 );
 assert.equal(await loadGcodeProgram("fixture.ngc", { storage }), "G0 X0 Y0\nM2\n");
+assert.equal(
+  await saveGcodeProgram("custom-fixture.ngc", "G1 X1 F10\nM2\n", { storage }),
+  "linuxcnc/gcode/custom-fixture.ngc",
+);
+assert.equal(await loadGcodeProgram("custom-fixture.ngc", { storage }), "G1 X1 F10\nM2\n");
 
 const bridgeFiles = new Map();
 const bridgeInterp = {
@@ -594,6 +600,18 @@ assert.throws(
   () => sessionSnapshotPath("session-1", "nested/snapshot.json"),
   /Invalid session snapshot filename/,
 );
+assert.throws(
+  () => gcodeProgramPath("../escape.ngc"),
+  /Invalid G-code filename/,
+);
+await assert.rejects(
+  () => saveGcodeProgram("nested/fixture.ngc", "", { storage }),
+  /Invalid G-code filename/,
+);
+await assert.rejects(
+  () => loadGcodeProgram("../escape.ngc", { storage }),
+  /Invalid G-code filename/,
+);
 await assert.rejects(
   () => saveSessionSnapshot("session-1", {}, {
     storage,