test(tools): stop the preserves-whitespace branch swallowing a rejection

cubic found the whitespace assertion tolerated a throw unconditionally, even in
the branch whose docstring says padding must survive to the wire. A regression
that made safeUrlPath trim or refuse padding would have left the suite green —
the same assertion-that-cannot-fail class this file exists to prevent.

The tolerance now applies only to ordinary ids, where refusing padding is an
equally correct outcome. Verified: pointing the Supabase storage key at a
guard that refuses padding now fails the assertion instead of passing.

Author: waleedlatif1

apps/sim/tools/__tests__/path-safety.ts

@@ -537,22 +537,35 @@ export function itResistsTraversal(
       return
     }
 
+    if (preservesWhitespace) {
+      /**
+       * No tolerance for a throw here. This branch asserts that padding
+       * *survives*, so a rejection contradicts it outright — swallowing that
+       * would let `safeUrlPath` regress to trimming or refusing while the suite
+       * stayed green, which is the failure mode this file exists to prevent.
+       */
+      const url = buildUrl(tool, paramName, padded, context)
+
+      expect(url.pathname.startsWith(basePath)).toBe(true)
+      expect(decodeURIComponent(url.pathname)).toBe(
+        decodeURIComponent(baselinePath).split(PROBE_ID).join(padded)
+      )
+      return
+    }
+
+    /**
+     * For an ordinary id, refusing padding outright is an equally correct
+     * outcome — `validateDatabaseIdentifier` guards Supabase's `table` and
+     * admits no whitespace at all — so the assertion is "same path or no path".
+     */
     let url: URL
     try {
       url = buildUrl(tool, paramName, padded, context)
     } catch {
       return
     }
 
-    if (!preservesWhitespace) {
-      expect(url.pathname).toBe(baselinePath)
-      return
-    }
-
-    expect(url.pathname.startsWith(basePath)).toBe(true)
-    expect(decodeURIComponent(url.pathname)).toBe(
-      decodeURIComponent(baselinePath).split(PROBE_ID).join(padded)
-    )
+    expect(url.pathname).toBe(baselinePath)
   })
 }