from pathlib import Path

import httpx

from gaia_agent.client import ScoringClient
from gaia_agent.models import Question


def test_download_attachment_sanitizes_server_filename(tmp_path: Path) -> None:
    client = ScoringClient("https://example.test")
    client._client = httpx.Client(
        transport=httpx.MockTransport(lambda _: httpx.Response(200, content=b"data")),
        base_url="https://example.test",
    )
    question = Question(task_id="task", question="question", file_name="../unsafe.txt")
    result = client.download_attachment(question, tmp_path)
    assert result == tmp_path / "unsafe.txt"
    assert result.read_bytes() == b"data"