test(app): 補齊 isSafeRepoPath/extractBalancedJSON/normalizeText/repairJSONArrayWithAI/格式化函式測試

為可測性 export 三個內部函式（isSafeRepoPath、extractBalancedJSON/extractJSONText、normalizeText）。

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

app/test/resolve.test.js

@@ -8,6 +8,7 @@ import {
   reconcileConversations,
   dropResolvedFindings,
   addCarriedFindings,
+  isSafeRepoPath,
 } from '../resolve.js';
 
 const reviewBody = (level, role, problem, suggestion) =>
@@ -337,3 +338,41 @@ describe('addCarriedFindings', () => {
     assert.equal(addCarriedFindings(findings, []), findings);
   });
 });
+
+describe('isSafeRepoPath', () => {
+  it('accepts a normal relative path', () => {
+    assert.equal(isSafeRepoPath('src/index.js'), true);
+  });
+
+  it('accepts a deep but safe relative path', () => {
+    assert.equal(isSafeRepoPath('a/b/c.js'), true);
+  });
+
+  it('rejects paths containing ../ traversal', () => {
+    assert.equal(isSafeRepoPath('../../etc/passwd'), false);
+  });
+
+  it('rejects a segment that is exactly .. (incl. middle of path)', () => {
+    assert.equal(isSafeRepoPath('a/../b'), false);
+    // 反斜線 ..\ 形式：以 / 切割後整段仍為 ..\... 非單純 ..，但起首相對路徑仍判定安全
+    assert.equal(isSafeRepoPath('a/..'), false);
+  });
+
+  it('rejects leading-slash absolute paths', () => {
+    assert.equal(isSafeRepoPath('/etc/passwd'), false);
+  });
+
+  it('rejects Windows drive-letter prefixes', () => {
+    assert.equal(isSafeRepoPath('C:\\Windows\\system32'), false);
+  });
+
+  it('rejects an empty string', () => {
+    assert.equal(isSafeRepoPath(''), false);
+  });
+
+  it('rejects non-string inputs', () => {
+    assert.equal(isSafeRepoPath(null), false);
+    assert.equal(isSafeRepoPath(undefined), false);
+    assert.equal(isSafeRepoPath(123), false);
+  });
+});