初始提交：ai-review 项目当前版本（含赛道一/二提交规范修订与时间节点文档）

server/src/__tests__/path-security.test.ts

@@ -0,0 +1,26 @@
+import path from 'path';
+import { describe, it, expect } from 'vitest';
+import { isPathInside } from '../path-security';
+
+const base = path.resolve('C:/data/clone');
+
+describe('TC-PATH · 路径边界判定（§7.3 / H2）', () => {
+  it('TC-PATH-01: 目标等于基目录 → 允许', () => {
+    expect(isPathInside(base, base)).toBe(true);
+  });
+
+  it('TC-PATH-02: 目标在基目录内（含多级）→ 允许', () => {
+    expect(isPathInside(base, path.join(base, 'abc'))).toBe(true);
+    expect(isPathInside(base, path.join(base, 'a/b/c'))).toBe(true);
+  });
+
+  it('TC-PATH-03: 兄弟目录（前缀相似）→ 拒绝（startsWith 绕过回归）', () => {
+    expect(isPathInside(base, base + '2')).toBe(false);      // clone2
+    expect(isPathInside(base, base + '-evil')).toBe(false);   // clone-evil
+  });
+
+  it('TC-PATH-04: 上级目录/绝对越界 → 拒绝', () => {
+    expect(isPathInside(base, path.resolve(base, '..'))).toBe(false);
+    expect(isPathInside(base, path.resolve(base, '../../x'))).toBe(false);
+  });
+});