fix: harden task1 workspace output and publication

tools/thothctl/internal/workspaceops/operations.go

@@ -11,6 +11,7 @@ import (
 	"errors"
 	"fmt"
 	"io"
+	"path/filepath"
 	"reflect"
 	"regexp"
 	"strings"
@@ -369,7 +370,7 @@ func makeInput(c Command) (inputEnvelope, string, error) {
 			if total > maxSQLTotal {
 				return env, "", errors.New("SQL input exceeds limit")
 			}
-			base := path[strings.LastIndexAny(path, "/\\")+1:]
+			base := filepath.Base(path)
 			env.SQL = append(env.SQL, sqlInput{base, base64.StdEncoding.EncodeToString(b), DigestBytes(b)})
 		}
 	case CheckSchemaRequest:
@@ -379,7 +380,7 @@ func makeInput(c Command) (inputEnvelope, string, error) {
 			if e != nil {
 				return env, "", errors.New("unsafe annotation input")
 			}
-			base := x.Annotations[strings.LastIndexAny(x.Annotations, "/\\")+1:]
+			base := filepath.Base(x.Annotations)
 			env.Annotations = &annotationInput{base, base64.StdEncoding.EncodeToString(b), DigestBytes(b)}
 		}
 	case IndexSchemaRequest:
@@ -589,7 +590,12 @@ func publishCandidate(x *hostExport, result Result, path string) error {
 		return errors.New("invalid candidate export")
 	}
 	var doc any
-	if yaml.Unmarshal(b, &doc) != nil {
+	decoder := yaml.NewDecoder(bytes.NewReader(b))
+	if decoder.Decode(&doc) != nil {
+		return errors.New("invalid candidate export")
+	}
+	var trailing any
+	if err := decoder.Decode(&trailing); err != io.EOF {
 		return errors.New("invalid candidate export")
 	}
 	if result.RunID == "" || !runIDPattern.MatchString(result.RunID) {

tools/thothctl/internal/workspaceops/operations_test.go

@@ -3,6 +3,7 @@ package workspaceops
 import (
 	"bytes"
 	"encoding/base64"
+	"encoding/json"
 	"fmt"
 	"os"
 	"path/filepath"
@@ -16,6 +17,41 @@ import (
 	"github.com/aritmolab/thothii/tools/thothctl/internal/safeio"
 )
 
+func TestMakeInputUsesPlatformBasename(t *testing.T) {
+	if filepath.Separator == '\\' {
+		t.Skip("Unix basename behavior")
+	}
+	root, err := filepath.EvalSymlinks(t.TempDir())
+	if err != nil {
+		t.Fatal(err)
+	}
+	path := filepath.Join(root, "schema\\v2.sql")
+	if err := os.WriteFile(path, []byte("select 1"), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	_, payload, err := makeInput(SuggestFksRequest{WorkspaceID: "psd", FromSQL: []string{path}})
+	if err != nil {
+		t.Fatal(err)
+	}
+	var envelope inputEnvelope
+	if err := json.Unmarshal([]byte(payload), &envelope); err != nil {
+		t.Fatal(err)
+	}
+	if len(envelope.SQL) != 1 || envelope.SQL[0].Basename != "schema\\v2.sql" {
+		t.Fatalf("basename=%q", envelope.SQL[0].Basename)
+	}
+}
+
+func TestPublishCandidateRejectsTrailingYAMLDocument(t *testing.T) {
+	candidate := []byte("candidates: []\n---\n[\n")
+	digest := DigestBytes(candidate)
+	x := hostExport{MediaType: "application/yaml", SHA256: digest, ContentBase64: base64.StdEncoding.EncodeToString(candidate)}
+	result := Result{RunID: strings.Repeat("b", 32)}
+	if err := publishCandidate(&x, result, ""); err == nil {
+		t.Fatal("accepted malformed trailing YAML document")
+	}
+}
+
 func TestParseWorkspaceCommands(t *testing.T) {
 	cases := []struct {
 		name string