feat: add portable directory safeguards

internal/domain/browser_test.go

@@ -3,6 +3,7 @@ package domain
 import (
 	"errors"
 	"path/filepath"
+	"strings"
 	"testing"
 )
 
@@ -90,3 +91,29 @@ func TestNormalizeProxyNameRequiresNonEmptyDisplayText(t *testing.T) {
 		t.Fatalf("empty proxy name error = %v", err)
 	}
 }
+
+func TestNormalizeInstanceNameRejectsUnsafeWindowsNames(t *testing.T) {
+	if got, err := NormalizeInstanceName("  审核 Edge  "); err != nil || got != "审核 Edge" {
+		t.Fatalf("NormalizeInstanceName() = %q, %v", got, err)
+	}
+	for _, value := range []string{"", "CON", "aux.txt", "审核?", "审核.", "审核\\Edge"} {
+		if _, err := NormalizeInstanceName(value); err == nil {
+			t.Fatalf("unsafe instance name %q was accepted", value)
+		}
+	}
+}
+
+func TestInstanceProfileDirectoryNameIsReadableAndStablePerID(t *testing.T) {
+	first, err := InstanceProfileDirectoryName("审核 Edge", "instance-one")
+	if err != nil || !strings.HasPrefix(first, "instance-审核 Edge-") {
+		t.Fatalf("first directory name = %q, %v", first, err)
+	}
+	second, err := InstanceProfileDirectoryName("审核 Edge", "instance-two")
+	if err != nil || second == first {
+		t.Fatalf("second directory name = %q, %v", second, err)
+	}
+	long, err := InstanceProfileDirectoryName(strings.Repeat("审", 80), "instance-long")
+	if err != nil || len(long) > len("instance-")+64+1+8 {
+		t.Fatalf("long directory name = %q, %v", long, err)
+	}
+}