Security-relevant runtime behaviors lack automated test coverage

[sophiecarreras]

Summary

Several documented security and correctness constraints have no automated test coverage. They are claimed in the README but not verified by CI.

Unverified claims

1. Download size caps (1 GiB / 512 MiB) — README states specific byte caps for open-file reads and workspace writes. No CI test validates these constants or that transfers actually abort at the limit.
2. presignUrl single-file list precondition — README claims a B2 list call validates exactly one file matches the prefix before minting a presigned URL. Tests are mock-based only; the live list-before-sign behavior is not tested.
3. b2.apiUrl HTTPS-only constraint — README says custom API URLs must be HTTPS with no credentials, query strings, or fragments. No test asserts that invalid URLs are rejected.
4. Upload session isolation — README claims stale upload cleanup never touches sessions not created by this extension. Not covered by any automated CI test.

Why it matters

These are the behaviors most likely to cause data loss or security issues if they regress. Mock-based tests pass even if the real constraint is removed.

Acceptance criteria

• At minimum, unit tests asserting the size cap constants exist and are the expected values
• URL validation rejection cases covered
• Session isolation claim either tested or documented as a known gap

Filed by Quality Keeper drift-audit.