Improve code quality and package workflow coverage (#76)

* Remove obsolete developer scripts and clean up QML diagnostics

* Consolidate image decoder ownership

* Deduplicate audio keyframe evaluation

* Harden preset and repository file handling

* Update quality baselines and documentation

* Fix keyframe holds and Linux CI races

Author: GT-610

CMakeLists.txt

@@ -91,6 +91,7 @@ set(CORE_SOURCES
     core/src/media_decoder.cpp
     core/src/media_utils.cpp
     core/src/package_manager.cpp
+    core/src/package_url_utils.hpp
     core/src/permission_manager.cpp
     core/src/preset_manager.cpp
     core/src/project_serializer.cpp

clean.py

@@ -20,6 +20,7 @@ class ImageDecoder : public MediaDecoder {
     void startDecoding() override;
 
     void load(); // 互換性のため維持
+    void waitForFinished();
 
   signals:
     // MediaDecoder::ready を使用
@@ -33,4 +34,4 @@ class ImageDecoder : public MediaDecoder {
     QFuture<void> m_future;
 };
 
-} // namespace AviQtl::Core
+} // namespace AviQtl::Core

core/include/image_decoder.hpp

@@ -18,11 +18,11 @@ namespace AviQtl::Core {
 ImageDecoder::ImageDecoder(int clipId, const QUrl &source, VideoFrameStore *store, QObject *parent) : MediaDecoder(clipId, source, parent), m_store(store) {}
 
 ImageDecoder::~ImageDecoder() {
-    if (m_future.isRunning()) {
-        m_future.waitForFinished();
-    }
+    waitForFinished();
 }
 
+void ImageDecoder::waitForFinished() { m_future.waitForFinished(); }
+
 void ImageDecoder::seek(qint64 ms) {
     Q_UNUSED(ms);
     if (m_isReady && m_cachedVideoFrame.isValid()) {

core/src/image_decoder.cpp

@@ -1,4 +1,5 @@
 #include "package_manager.hpp"
+#include "package_url_utils.hpp"
 #include "effect_registry.hpp"
 #include "settings_manager.hpp"
 #include "shader_compiler.hpp"
@@ -46,10 +47,6 @@ bool isValidPackageType(const QString &packageType) {
            packageType == QStringLiteral("object") || packageType == QStringLiteral("transition");
 }
 
-bool isSecureNetworkUrl(const QUrl &url) {
-    return url.isValid() && url.scheme() == QStringLiteral("https") && !url.host().isEmpty();
-}
-
 bool writeJsonAtomically(const QString &path, const QJsonDocument &document) {
     QSaveFile file(path);
     if (!file.open(QIODevice::WriteOnly))
@@ -272,7 +269,7 @@ void PackageManager::saveRepositories(const QVariantList &repos) {
 }
 
 void PackageManager::addRepository(const QString &url, bool enabled, int priority) {
-    if (!isSecureNetworkUrl(QUrl(url)))
+    if (!Internal::isSecureNetworkUrl(QUrl(url)))
         return;
     QVariantList repos = repositories();
     for (const auto &r : repos) {
@@ -369,16 +366,6 @@ void PackageManager::refreshRepositories() {
             continue;
 
         QString repoUrl = repo.value(QStringLiteral("url")).toString();
-        QUrl baseUrl(repoUrl);
-        QString basePath = repoUrl;
-        if (basePath.endsWith(QStringLiteral("/repo.json")))
-            basePath.chop(9);
-        else if (basePath.endsWith(QStringLiteral(".json"))) {
-            int slash = basePath.lastIndexOf('/');
-            if (slash != -1)
-                basePath = basePath.left(slash);
-        }
-
         struct SyncCtx {
             QVariantMap repoInfo;
             QByteArray catalogData;
@@ -391,15 +378,15 @@ void PackageManager::refreshRepositories() {
         if (!fetchUrl.path().endsWith(QStringLiteral("/repo.json")))
             fetchUrl.setPath(fetchUrl.path() + (fetchUrl.path().endsWith('/') ? QStringLiteral("repo.json") : QStringLiteral("/repo.json")));
 
-        if (!isSecureNetworkUrl(fetchUrl)) {
+        if (!Internal::isSecureNetworkUrl(fetchUrl)) {
             m_pendingRequests--;
             emit errorOccurred(tr("Repository URL must use HTTPS: %1").arg(repoUrl));
             tryFinishSyncLegacy(installed);
             continue;
         }
         QNetworkReply *reply = m_networkManager->get(packageNetworkRequest(fetchUrl));
         enforceReplySizeLimit(reply, kMaxRepositoryResponseBytes);
-        connect(reply, &QNetworkReply::finished, this, [this, reply, fetchUrl, repoUrl, basePath, ctx, installed]() {
+        connect(reply, &QNetworkReply::finished, this, [this, reply, fetchUrl, repoUrl, ctx, installed]() {
             reply->deleteLater();
             m_pendingRequests--;
 
@@ -411,13 +398,9 @@ void PackageManager::refreshRepositories() {
                     ctx->repoInfo[QStringLiteral("name")] = repoObj.value(QStringLiteral("repo_name")).toString();
                     QString catalogUrl = repoObj.value(QStringLiteral("catalog_url")).toString();
                     if (!catalogUrl.isEmpty()) {
-                        QUrl absUrl;
-                        if (catalogUrl.startsWith(QStringLiteral("http://")) || catalogUrl.startsWith(QStringLiteral("https://")))
-                            absUrl = QUrl(catalogUrl);
-                        else
-                            absUrl = QUrl(basePath + QStringLiteral("/") + catalogUrl);
+                        const QUrl absUrl = Internal::resolveRepositoryReference(fetchUrl, catalogUrl);
 
-                        if (!isSecureNetworkUrl(absUrl)) {
+                        if (!Internal::isSecureNetworkUrl(absUrl)) {
                             emit errorOccurred(tr("Catalog URL must use HTTPS: %1").arg(absUrl.toString()));
                             onCatalogFetched(ctx->repoInfo, {}, installed);
                             tryFinishSyncLegacy(installed);
@@ -646,7 +629,7 @@ void PackageManager::fetchPackageMetadata(const QString &packageId, const QStrin
 
     setStatus(tr("Fetching package details: %1").arg(packageId));
     QUrl url(metadataUrl);
-    if (!isSecureNetworkUrl(url)) {
+    if (!Internal::isSecureNetworkUrl(url)) {
         emit errorOccurred(tr("Invalid or insecure metadata URL for package: %1").arg(packageId));
         return;
     }
@@ -837,7 +820,7 @@ void PackageManager::downloadPackage(const QString &packageId, const QUrl &url,
         emit errorOccurred(tr("Invalid package ID or type."));
         return;
     }
-    if (!isSecureNetworkUrl(url)) {
+    if (!Internal::isSecureNetworkUrl(url)) {
         setBusy(false);
         emit errorOccurred(tr("Invalid or insecure package download URL."));
         return;
@@ -884,7 +867,11 @@ void PackageManager::downloadPackage(const QString &packageId, const QUrl &url,
             emit errorOccurred(tr("Package archive exceeds the maximum allowed size."));
             return;
         }
-        file.write(data);
+        if (file.write(data) != data.size()) {
+            setBusy(false);
+            emit errorOccurred(tr("Failed to write the complete downloaded package."));
+            return;
+        }
         file.close();
 
         // SHA256 verification

core/src/package_manager.cpp

@@ -0,0 +1,19 @@
+#pragma once
+
+#include <QString>
+#include <QUrl>
+
+namespace AviQtl::Core::Internal {
+
+inline bool isSecureNetworkUrl(const QUrl &url) {
+    return url.isValid() && url.scheme() == QStringLiteral("https") && !url.host().isEmpty();
+}
+
+inline QUrl resolveRepositoryReference(const QUrl &repositoryIndexUrl, const QString &reference) {
+    if (!repositoryIndexUrl.isValid() || reference.isEmpty()) {
+        return {};
+    }
+    return repositoryIndexUrl.resolved(QUrl(reference));
+}
+
+} // namespace AviQtl::Core::Internal

core/src/package_url_utils.hpp

@@ -4,6 +4,7 @@
 #include <QFile>
 #include <QJsonDocument>
 #include <QJsonObject>
+#include <QSaveFile>
 #include <QStandardPaths>
 
 namespace AviQtl::Core {
@@ -13,6 +14,12 @@ bool isUnsafeName(const QString &s) {
     return s.isEmpty() || s.contains(QLatin1Char('/')) || s.contains(QLatin1Char('\\'))
         || s.contains(QLatin1String("..")) || s.startsWith(QLatin1Char('.'));
 }
+
+bool isPathWithin(const QString &basePath, const QString &candidatePath) {
+    const QString base = QDir::cleanPath(basePath);
+    const QString candidate = QDir::cleanPath(candidatePath);
+    return candidate == base || candidate.startsWith(base + QDir::separator());
+}
 } // namespace
 
 PresetManager &PresetManager::instance() {
@@ -43,11 +50,19 @@ QString PresetManager::presetPath(const QString &effectId, const QString &name)
     const QString dir = presetDir(effectId);
     if (dir.isEmpty())
         return {};
-    const QString path = QDir(dir).filePath(name + QStringLiteral(".json"));
-    const QString baseCanon = QFileInfo(resolveBaseDir()).canonicalFilePath();
-    const QString fileCanon = QFileInfo(path).canonicalFilePath();
-    if (!baseCanon.isEmpty() && !fileCanon.isEmpty() && !fileCanon.startsWith(baseCanon))
+
+    const QString basePath = QDir(resolveBaseDir()).absolutePath();
+    const QString candidateDir = QDir(dir).absolutePath();
+    if (!isPathWithin(basePath, candidateDir))
+        return {};
+
+    const QString canonicalBase = QDir(basePath).canonicalPath();
+    const QString canonicalDir = QDir(candidateDir).canonicalPath();
+    if (!canonicalBase.isEmpty() && !canonicalDir.isEmpty() &&
+        !isPathWithin(canonicalBase, canonicalDir))
         return {};
+
+    const QString path = QDir(dir).filePath(name + QStringLiteral(".json"));
     return path;
 }
 
@@ -94,11 +109,14 @@ bool PresetManager::savePreset(const QString &effectId, const QString &name, con
     obj[QStringLiteral("params")] = QJsonObject::fromVariantMap(params);
     obj[QStringLiteral("keyframes")] = QJsonObject::fromVariantMap(keyframes);
 
-    QFile f(path);
-    if (!f.open(QIODevice::WriteOnly | QIODevice::Truncate))
+    QSaveFile file(path);
+    if (!file.open(QIODevice::WriteOnly))
+        return false;
+
+    const QByteArray payload = QJsonDocument(obj).toJson(QJsonDocument::Compact);
+    if (file.write(payload) != payload.size() || !file.commit())
         return false;
 
-    f.write(QJsonDocument(obj).toJson(QJsonDocument::Compact));
     emit presetsChanged(effectId);
     return true;
 }