fix: harden task1 workspace output and publication

tools/thothctl/internal/workspaceops/operations_test.go

@@ -3,6 +3,7 @@ package workspaceops
 import (
 	"bytes"
 	"encoding/base64"
+	"encoding/json"
 	"fmt"
 	"os"
 	"path/filepath"
@@ -16,6 +17,41 @@ import (
 	"github.com/aritmolab/thothii/tools/thothctl/internal/safeio"
 )
 
+func TestMakeInputUsesPlatformBasename(t *testing.T) {
+	if filepath.Separator == '\\' {
+		t.Skip("Unix basename behavior")
+	}
+	root, err := filepath.EvalSymlinks(t.TempDir())
+	if err != nil {
+		t.Fatal(err)
+	}
+	path := filepath.Join(root, "schema\\v2.sql")
+	if err := os.WriteFile(path, []byte("select 1"), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	_, payload, err := makeInput(SuggestFksRequest{WorkspaceID: "psd", FromSQL: []string{path}})
+	if err != nil {
+		t.Fatal(err)
+	}
+	var envelope inputEnvelope
+	if err := json.Unmarshal([]byte(payload), &envelope); err != nil {
+		t.Fatal(err)
+	}
+	if len(envelope.SQL) != 1 || envelope.SQL[0].Basename != "schema\\v2.sql" {
+		t.Fatalf("basename=%q", envelope.SQL[0].Basename)
+	}
+}
+
+func TestPublishCandidateRejectsTrailingYAMLDocument(t *testing.T) {
+	candidate := []byte("candidates: []\n---\n[\n")
+	digest := DigestBytes(candidate)
+	x := hostExport{MediaType: "application/yaml", SHA256: digest, ContentBase64: base64.StdEncoding.EncodeToString(candidate)}
+	result := Result{RunID: strings.Repeat("b", 32)}
+	if err := publishCandidate(&x, result, ""); err == nil {
+		t.Fatal("accepted malformed trailing YAML document")
+	}
+}
+
 func TestParseWorkspaceCommands(t *testing.T) {
 	cases := []struct {
 		name string