Port safe_basename to the TypeScript SDK and route the default-path branch
of RemoteFile.save() through it, so a mountRelativePath of "", ".", "sub/.",
"foo/.." or ".." throws a ValidationError before any mkdir or write instead
of an unhandled EISDIR. RemoteFile.filename now splits on both separators.
Fix the shared check order in Python's safe_basename: the usability check
ran on the raw segment while the stripped value was written, so a name such
as " . " reached the filesystem as "." and failed with
IsADirectoryError.
Claude-Session: https://claude.ai/code/session_015Wv6TtPJ5GoHj9oE8FoyUc
This PR:
- centralizes filesystem path construction for API-provided slugs and
filenames in `composio.utils.safe_path`
- rejects traversal, Windows-invalid names, invalid Unicode, and
overlong encoded filenames before creating directories or writing files
- normalizes trusted roots consistently and routes both Python download
paths through the shared helpers
- adds a fail-closed AST guard for new dynamic path construction,
including direct `Path(...)` calls
- isolates provider initialization from the real home directory and
makes the home-write guard report changes without deleting them
- removes the obsolete download filename wrapper
## Verification
- `pytest -q`: 1,248 passed, 47 skipped
- repository-configured Ruff checks and formatting passed for every
changed Python file
- targeted mypy checks passed for the changed helpers and tests
jkomyno