test(service): add tests for WORK_DIR injection and file-type param resolution

- ValidateParams: file/directory type validation tests

- RenderScript: file-type not escaped, WORK_DIR injected without quotes

- ProcessTask: file_id→filename resolution, invalid ID, missing file scenarios

Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent)

Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>

internal/service/task_service_test.go

@@ -3,6 +3,7 @@ package service
 import (
 	"context"
 	"encoding/json"
+	"fmt"
 	"net/http"
 	"net/http/httptest"
 	"os"
@@ -536,3 +537,139 @@ func TestTaskService_ProcessTask_ValidateParams_ValidParamsSucceed(t *testing.T)
 		t.Errorf("SlurmJobID = %v, want 99", updated.SlurmJobID)
 	}
 }
+
+func TestTaskService_ProcessTask_FileParamResolution(t *testing.T) {
+	jobID := int32(88)
+	env := newTaskTestEnv(t, http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		json.NewEncoder(w).Encode(slurm.OpenapiJobSubmitResponse{
+			Result: &slurm.JobSubmitResponseMsg{JobID: &jobID},
+		})
+	}))
+	defer env.close()
+
+	ctx := context.Background()
+
+	blob := &model.FileBlob{SHA256: "deadbeef", MinioKey: "test/file.bin", FileSize: 1024}
+	if err := env.db.Create(blob).Error; err != nil {
+		t.Fatalf("create blob: %v", err)
+	}
+	file := &model.File{Name: "model_weights.bin", BlobSHA256: blob.SHA256}
+	if err := env.fileStore.Create(ctx, file); err != nil {
+		t.Fatalf("create file: %v", err)
+	}
+
+	appID := env.createApp(t, "file-param-app",
+		"#!/bin/bash\n#SBATCH --chdir=$WORK_DIR\npython train.py --model $MODEL_PATH",
+		json.RawMessage(`[{"name":"MODEL_PATH","type":"file","required":true}]`))
+
+	// No InputFileIDs because stagingSvc is nil in tests; file is still resolvable via fileStore.
+	task, err := env.svc.CreateTask(ctx, &model.CreateTaskRequest{
+		AppID:  appID,
+		Values: map[string]string{"MODEL_PATH": fmt.Sprintf("%d", file.ID)},
+	})
+	if err != nil {
+		t.Fatalf("CreateTask: %v", err)
+	}
+
+	err = env.svc.ProcessTask(ctx, task.ID)
+	if err != nil {
+		t.Fatalf("ProcessTask with file param: %v", err)
+	}
+
+	updated, _ := env.taskStore.GetByID(ctx, task.ID)
+	if updated.Status != model.TaskStatusQueued {
+		t.Errorf("Status = %q, want %q", updated.Status, model.TaskStatusQueued)
+	}
+}
+
+func TestTaskService_ProcessTask_WorkDirInScript(t *testing.T) {
+	jobID := int32(77)
+	env := newTaskTestEnv(t, http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		json.NewEncoder(w).Encode(slurm.OpenapiJobSubmitResponse{
+			Result: &slurm.JobSubmitResponseMsg{JobID: &jobID},
+		})
+	}))
+	defer env.close()
+
+	appID := env.createApp(t, "workdir-app",
+		"#!/bin/bash\n#SBATCH --chdir=$WORK_DIR\necho hello",
+		json.RawMessage(`[]`))
+
+	task, err := env.svc.CreateTask(context.Background(), &model.CreateTaskRequest{
+		AppID:  appID,
+		Values: map[string]string{},
+	})
+	if err != nil {
+		t.Fatalf("CreateTask: %v", err)
+	}
+
+	err = env.svc.ProcessTask(context.Background(), task.ID)
+	if err != nil {
+		t.Fatalf("ProcessTask: %v", err)
+	}
+
+	updated, _ := env.taskStore.GetByID(context.Background(), task.ID)
+	if updated.WorkDir == "" {
+		t.Fatal("WorkDir should be set")
+	}
+}
+
+func TestTaskService_ProcessTask_FileParamInvalidID(t *testing.T) {
+	jobID := int32(42)
+	env := newTaskTestEnv(t, http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		json.NewEncoder(w).Encode(slurm.OpenapiJobSubmitResponse{
+			Result: &slurm.JobSubmitResponseMsg{JobID: &jobID},
+		})
+	}))
+	defer env.close()
+
+	appID := env.createApp(t, "bad-file-app",
+		"#!/bin/bash\npython train.py --model $MODEL",
+		json.RawMessage(`[{"name":"MODEL","type":"file","required":true}]`))
+
+	task, err := env.svc.CreateTask(context.Background(), &model.CreateTaskRequest{
+		AppID:  appID,
+		Values: map[string]string{"MODEL": "not_a_number"},
+	})
+	if err != nil {
+		t.Fatalf("CreateTask: %v", err)
+	}
+
+	err = env.svc.ProcessTask(context.Background(), task.ID)
+	if err == nil {
+		t.Fatal("expected error for non-numeric file ID in file-type param")
+	}
+	if !strings.Contains(err.Error(), "file ID") {
+		t.Errorf("error should mention 'file ID', got: %v", err)
+	}
+}
+
+func TestTaskService_ProcessTask_FileParamNotInInputFiles(t *testing.T) {
+	jobID := int32(42)
+	env := newTaskTestEnv(t, http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		json.NewEncoder(w).Encode(slurm.OpenapiJobSubmitResponse{
+			Result: &slurm.JobSubmitResponseMsg{JobID: &jobID},
+		})
+	}))
+	defer env.close()
+
+	appID := env.createApp(t, "missing-file-app",
+		"#!/bin/bash\npython train.py --model $MODEL",
+		json.RawMessage(`[{"name":"MODEL","type":"file","required":true}]`))
+
+	task, err := env.svc.CreateTask(context.Background(), &model.CreateTaskRequest{
+		AppID:  appID,
+		Values: map[string]string{"MODEL": "999"},
+	})
+	if err != nil {
+		t.Fatalf("CreateTask: %v", err)
+	}
+
+	err = env.svc.ProcessTask(context.Background(), task.ID)
+	if err == nil {
+		t.Fatal("expected error for file_id not in input_file_ids")
+	}
+	if !strings.Contains(err.Error(), "not found") {
+		t.Errorf("error should mention 'not found', got: %v", err)
+	}
+}