test: align agent safety mocks and fixtures

packages/core/src/__tests__/agent-tools-params.test.ts

@@ -95,7 +95,7 @@ describe("writer agent — wordCount passthrough", () => {
   beforeEach(() => {
     writeNextChapterMock = vi.fn(async () => ({ wordCount: 3000 }));
     const mockPipeline = { writeNextChapter: writeNextChapterMock } as any;
-    tool = createSubAgentTool(mockPipeline, "existing-book");
+    tool = createSubAgentTool(mockPipeline, "my-book");
   });
 
   it("passes chapterWordCount as wordCount", async () => {
@@ -118,7 +118,7 @@ describe("auditor agent — rich return value", () => {
         { severity: "critical", description: "Name inconsistency" },
       ],
     }));
-    const tool = createSubAgentTool({ auditDraft: auditDraftMock } as any, "book");
+    const tool = createSubAgentTool({ auditDraft: auditDraftMock } as any, "my-book");
     const result = await tool.execute("tc1", { agent: "auditor", instruction: "Audit", bookId: "my-book", chapterNumber: 3 });
     const text = (result.content[0] as { type: "text"; text: string }).text;
     expect(text).toContain("FAILED");
@@ -135,7 +135,7 @@ describe("reviser agent — mode field", () => {
 
   beforeEach(() => {
     reviseDraftMock = vi.fn(async () => ({}));
-    tool = createSubAgentTool({ reviseDraft: reviseDraftMock } as any, "book");
+    tool = createSubAgentTool({ reviseDraft: reviseDraftMock } as any, "my-book");
   });
 
   it("uses mode param directly", async () => {

packages/studio/src/api/phase5-hotfix.test.ts

@@ -72,6 +72,16 @@ vi.mock("@actalk/inkos-core", () => {
     createLLMClient: createLLMClientMock,
     createLogger: vi.fn(() => logger),
     computeAnalytics: vi.fn(() => ({})),
+    isSafeBookId: vi.fn((bookId: unknown) => (
+      typeof bookId === "string"
+      && bookId.length > 0
+      && bookId.length <= 120
+      && bookId.trim() === bookId
+      && bookId !== "."
+      && bookId !== ".."
+      && !bookId.includes("..")
+      && !/[\u0000-\u001f\u007f/\\:*?"'`{}<>|]/u.test(bookId)
+    )),
     chatCompletion: chatCompletionMock,
     loadProjectConfig: loadProjectConfigMock,
     GLOBAL_ENV_PATH: join(tmpdir(), "inkos-global.env"),

packages/studio/src/api/v13-hotfix-round4.test.ts

@@ -65,6 +65,16 @@ vi.mock("@actalk/inkos-core", () => {
     createLLMClient: vi.fn(() => ({})),
     createLogger: vi.fn(() => logger),
     computeAnalytics: vi.fn(() => ({})),
+    isSafeBookId: vi.fn((bookId: unknown) => (
+      typeof bookId === "string"
+      && bookId.length > 0
+      && bookId.length <= 120
+      && bookId.trim() === bookId
+      && bookId !== "."
+      && bookId !== ".."
+      && !bookId.includes("..")
+      && !/[\u0000-\u001f\u007f/\\:*?"'`{}<>|]/u.test(bookId)
+    )),
     chatCompletion: vi.fn(),
     loadProjectConfig: loadProjectConfigMock,
     GLOBAL_ENV_PATH: join(tmpdir(), "inkos-global.env"),