fix: address 6 Copilot review suggestions — long.MinValue throw, Trace.Listeners.Clear, path traversal hardening, retry catch order, regex tightening, StartsWith case

- BsdiffDiffer/StreamingHdiffDiffer WriteInt64: throw on long.MinValue instead of silent clamp
- GeneralTracer: remove Trace.Listeners.Clear() from static ctor; only manage owned listeners
- ZipCompressionStrategy: use Path.Combine + normalized root in path-traversal guard
- DefaultRetryPolicy: fix TaskCanceledException/OperationCanceledException catch order; tighten 5xx regex
- DiffPipeline CopyUnknownFiles: use platform-aware path comparison (OrdinalIgnoreCase on Windows)

Co-Authored-By: Claude <noreply@anthropic.com>

Author: JusterZhu

src/c#/GeneralUpdate.Core/Compress/ZipCompressionStrategy.cs

@@ -153,9 +153,12 @@ public void Decompress(string zipFilePath, string unZipDir, Encoding encoding)
                 }
 
                 // Guard against path-traversal entries (e.g. "../../evil.exe")
-                var filePath = directoryInfo + entryFilePath;
+                var filePath = Path.Combine(unZipDir, entryFilePath);
                 var fullTargetPath = Path.GetFullPath(filePath);
-                if (!fullTargetPath.StartsWith(extractionRoot, StringComparison.OrdinalIgnoreCase))
+                var rootWithSep = extractionRoot.EndsWith(dirSeparatorChar)
+                    ? extractionRoot
+                    : extractionRoot + dirSeparatorChar;
+                if (!fullTargetPath.StartsWith(rootWithSep, StringComparison.OrdinalIgnoreCase))
                     throw new InvalidDataException(
                         $"Zip entry path traversal detected: {entries.FullName} resolves outside extraction directory.");
 

src/c#/GeneralUpdate.Core/Download/Policy/DefaultRetryPolicy.cs

@@ -127,8 +127,10 @@ public async Task<T> ExecuteAsync<T>(Func<CancellationToken, Task<T>> action, Ca
     /// </remarks>
     private static bool IsRetryable(Exception ex)
     {
-        if (ex is OperationCanceledException) return false;
+        // TaskCanceledException derives from OperationCanceledException,
+        // so check it first — timeouts should be retryable.
         if (ex is TaskCanceledException or TimeoutException) return true;
+        if (ex is OperationCanceledException) return false;
         if (ex is IOException) return true;
         if (ex is HttpRequestException hre)
         {
@@ -143,7 +145,7 @@ private static bool IsRetryable(Exception ex)
             var s = hre.Message ?? "";
             return s.Contains("timeout", StringComparison.OrdinalIgnoreCase)
                 || s.Contains("timed out", StringComparison.OrdinalIgnoreCase)
-                || Regex.IsMatch(s, @"\b(500|502|503|504)\b");
+                || Regex.IsMatch(s, @"\b(500|502|503|504)\b(?![\d./])");
         }
         return false;
     }

src/c#/GeneralUpdate.Core/Pipeline/DiffPipeline.cs

@@ -2,6 +2,7 @@
 using System.Collections.Generic;
 using System.IO;
 using System.Linq;
+using System.Runtime.InteropServices;
 using System.Threading;
 using System.Threading.Tasks;
 using GeneralUpdate.Core.Differential;
@@ -523,7 +524,10 @@ private static Task CopyUnknownFiles(string appPath, string patchPath)
                 // Using StartsWith + Substring instead of string.Replace to avoid
                 // incorrect replacements when appPath is a substring of patchPath.
                 var patchPrefix = patchPath.TrimEnd(Path.DirectorySeparatorChar) + Path.DirectorySeparatorChar;
-                var relativePart = file.FullName.StartsWith(patchPrefix, StringComparison.Ordinal)
+                var comparison = RuntimeInformation.IsOSPlatform(OSPlatform.Windows)
+                    ? StringComparison.OrdinalIgnoreCase
+                    : StringComparison.Ordinal;
+                var relativePart = file.FullName.StartsWith(patchPrefix, comparison)
                     ? file.FullName.Substring(patchPrefix.Length)
                     : file.FullName;
                 var targetPath = Path.Combine(appPath, relativePart);

src/c#/GeneralUpdate.Core/Tracer/GeneralTracer.cs

@@ -17,7 +17,9 @@ public static class GeneralTracer
 
     static GeneralTracer()
     {
-        Trace.Listeners.Clear();
+        // Do NOT call Trace.Listeners.Clear() here — other libraries in the
+        // process may have registered their own TraceListeners. GeneralTracer
+        // only manages the listeners it adds itself via _ownedListeners.
 
         if (RuntimeInformation.IsOSPlatform(OSPlatform.Windows))
         {

src/c#/GeneralUpdate.Differential/Differ/BsdiffDiffer.cs

@@ -696,12 +696,14 @@ private static int[] SuffixSort(byte[] oldData)
         /// Writes a 64-bit signed integer in BSDIFF sign-magnitude encoding.
         /// Bytes 0-6: magnitude bits 0-55. Byte 7 lower 7 bits: magnitude bits 56-62.
         /// Byte 7 upper bit: sign flag (1 = negative).
+        /// Throws <see cref="ArgumentOutOfRangeException"/> when <paramref name="value"/>
+        /// is <see cref="long.MinValue"/> because BSDIFF sign-magnitude encoding cannot
+        /// represent -2^63 (requires a 64th magnitude bit).
         /// </summary>
         private static void WriteInt64(long value, byte[] buf, int offset)
         {
-            // Compute absolute value safely: -long.MinValue would overflow,
-            // so clamp to long.MaxValue — the sign bit is stored separately.
-            long magnitude = value == long.MinValue ? long.MaxValue : (value < 0 ? -value : value);
+            ArgumentOutOfRangeException.ThrowIfEqual(value, long.MinValue, nameof(value));
+            long magnitude = value < 0 ? -value : value;
             buf[offset + 0] = (byte)(magnitude & 0xFF);
             buf[offset + 1] = (byte)((magnitude >> 8) & 0xFF);
             buf[offset + 2] = (byte)((magnitude >> 16) & 0xFF);

src/c#/GeneralUpdate.Differential/Differ/StreamingHdiffDiffer.cs

@@ -465,9 +465,9 @@ private static byte[] ReadFileWithBudget(string path, int maxBytes)
 
         private static void WriteInt64(long value, byte[] buf, int offset)
         {
-            // Compute absolute value safely: -long.MinValue would overflow,
-            // so clamp to long.MaxValue — the sign bit is stored separately.
-            long magnitude = value == long.MinValue ? long.MaxValue : (value < 0 ? -value : value);
+            // BSDIFF sign-magnitude encoding cannot represent -2^63.
+            ArgumentOutOfRangeException.ThrowIfEqual(value, long.MinValue, nameof(value));
+            long magnitude = value < 0 ? -value : value;
             buf[offset + 0] = (byte)(magnitude & 0xFF);
             buf[offset + 1] = (byte)((magnitude >> 8) & 0xFF);
             buf[offset + 2] = (byte)((magnitude >> 16) & 0xFF);