test(service): add tests for WORK_DIR injection and file-type param resolution

- ValidateParams: file/directory type validation tests

- RenderScript: file-type not escaped, WORK_DIR injected without quotes

- ProcessTask: file_id→filename resolution, invalid ID, missing file scenarios

Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent)

Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>

internal/service/application_service_test.go

@@ -104,6 +104,89 @@ func TestValidateParams_BooleanValues(t *testing.T) {
 	}
 }
 
+func TestValidateParams_FileTypeValid(t *testing.T) {
+	params := []model.ParameterSchema{
+		{Name: "MODEL", Type: model.ParamTypeFile, Required: true},
+	}
+	values := map[string]string{"MODEL": "12345"}
+	if err := ValidateParams(params, values); err != nil {
+		t.Errorf("expected no error for valid file ID, got %v", err)
+	}
+}
+
+func TestValidateParams_FileTypeInvalid(t *testing.T) {
+	params := []model.ParameterSchema{
+		{Name: "MODEL", Type: model.ParamTypeFile, Required: true},
+	}
+	values := map[string]string{"MODEL": "not_a_number"}
+	err := ValidateParams(params, values)
+	if err == nil {
+		t.Fatal("expected error for non-numeric file ID")
+	}
+	if !strings.Contains(err.Error(), "file ID") {
+		t.Errorf("error should mention 'file ID', got: %v", err)
+	}
+}
+
+func TestValidateParams_DirectoryTypeValid(t *testing.T) {
+	params := []model.ParameterSchema{
+		{Name: "DATA_DIR", Type: model.ParamTypeDirectory, Required: true},
+	}
+	values := map[string]string{"DATA_DIR": "99"}
+	if err := ValidateParams(params, values); err != nil {
+		t.Errorf("expected no error for valid directory ID, got %v", err)
+	}
+}
+
+func TestValidateParams_DirectoryTypeInvalid(t *testing.T) {
+	params := []model.ParameterSchema{
+		{Name: "DATA_DIR", Type: model.ParamTypeDirectory, Required: true},
+	}
+	values := map[string]string{"DATA_DIR": "abc"}
+	err := ValidateParams(params, values)
+	if err == nil {
+		t.Fatal("expected error for non-numeric directory ID")
+	}
+	if !strings.Contains(err.Error(), "file ID") {
+		t.Errorf("error should mention 'file ID', got: %v", err)
+	}
+}
+
+func TestRenderScript_FileTypeNotEscaped(t *testing.T) {
+	params := []model.ParameterSchema{{Name: "MODEL_PATH", Type: model.ParamTypeFile}}
+	values := map[string]string{"MODEL_PATH": "model_v2.bin"}
+	result := RenderScript("python train.py --model $MODEL_PATH", params, values)
+	expected := "python train.py --model model_v2.bin"
+	if result != expected {
+		t.Errorf("got %q, want %q", result, expected)
+	}
+}
+
+func TestRenderScript_WorkDirInjected(t *testing.T) {
+	params := []model.ParameterSchema{{Name: "INPUT", Type: model.ParamTypeString}}
+	values := map[string]string{
+		"INPUT":    "data.txt",
+		"WORK_DIR": "/data/work/myapp_20260101_abcd",
+	}
+	result := RenderScript("#SBATCH --chdir=$WORK_DIR\necho $INPUT", params, values)
+	if !strings.Contains(result, "#SBATCH --chdir=/data/work/myapp_20260101_abcd") {
+		t.Errorf("WORK_DIR should be replaced raw, got: %s", result)
+	}
+	if !strings.Contains(result, "'data.txt'") {
+		t.Errorf("INPUT should still be shell-escaped, got: %s", result)
+	}
+}
+
+func TestRenderScript_DirectoryTypeNotEscaped(t *testing.T) {
+	params := []model.ParameterSchema{{Name: "DATA_DIR", Type: model.ParamTypeDirectory}}
+	values := map[string]string{"DATA_DIR": "input_folder"}
+	result := RenderScript("ls $DATA_DIR", params, values)
+	expected := "ls input_folder"
+	if result != expected {
+		t.Errorf("got %q, want %q", result, expected)
+	}
+}
+
 func TestRenderScript_SimpleReplacement(t *testing.T) {
 	params := []model.ParameterSchema{{Name: "INPUT", Type: model.ParamTypeString}}
 	values := map[string]string{"INPUT": "data.txt"}