fix: resolve low severity vulnerabilities from deepseek audit

src-tauri/src/download.rs

@@ -480,7 +480,9 @@ async fn download_file(
                     return DownloadOutcome::Paused;
                 }
                 Err(AttemptError::Controlled(DownloadControl::Cancel)) => {
-                    let _ = fs::remove_file(&payload.output_path).await;
+                    if let Err(e) = fs::remove_file(&payload.output_path).await {
+                        log::warn!("Failed to remove cancelled file '{}': {}", payload.output_path.display(), e);
+                    }
                     return DownloadOutcome::Cancelled;
                 }
                 Err(AttemptError::Controlled(DownloadControl::Replace)) => {
@@ -508,7 +510,9 @@ async fn download_file(
                                 return match control.unwrap_or(DownloadControl::Cancel) {
                                     DownloadControl::Pause => DownloadOutcome::Paused,
                                     DownloadControl::Cancel => {
-                                        let _ = fs::remove_file(&payload.output_path).await;
+                                        if let Err(e) = fs::remove_file(&payload.output_path).await {
+                                            log::warn!("Failed to remove cancelled file '{}': {}", payload.output_path.display(), e);
+                                        }
                                         DownloadOutcome::Cancelled
                                     }
                                     DownloadControl::Replace => DownloadOutcome::Cancelled,
@@ -717,7 +721,7 @@ fn build_client(payload: &DownloadPayload) -> Result<(Client, HeaderMap), String
         if proxy == "none" {
             builder = builder.no_proxy();
         } else {
-            builder = builder.proxy(reqwest::Proxy::all(proxy).map_err(|error| error.to_string())?);
+            builder = builder.proxy(reqwest::Proxy::all(proxy).map_err(|_| "Invalid proxy URL configured".to_string())?);
         }
     }
 

src-tauri/src/lib.rs

@@ -1374,12 +1374,16 @@ pub(crate) fn resolve_path(path: &str, app_handle: &tauri::AppHandle) -> std::pa
         .strip_prefix("~/")
         .or_else(|| path.strip_prefix("~\\"))
     {
-        if let Ok(home) = app_handle.path().home_dir() {
+        if let Some(home) = app_handle.path().home_dir().ok().or_else(|| std::env::var("USERPROFILE").ok().map(std::path::PathBuf::from)) {
             resolved = home.join(stripped);
+        } else {
+            log::warn!("Failed to resolve home directory for ~ expansion");
         }
     } else if path == "~" {
-        if let Ok(home) = app_handle.path().home_dir() {
+        if let Some(home) = app_handle.path().home_dir().ok().or_else(|| std::env::var("USERPROFILE").ok().map(std::path::PathBuf::from)) {
             resolved = home;
+        } else {
+            log::warn!("Failed to resolve home directory for ~ expansion");
         }
     }
     resolved
@@ -1655,13 +1659,18 @@ fn version_check_cache(
 }
 
 fn version_cache_key(binary_path: &std::path::Path, args: &[&str]) -> String {
+    use std::hash::{Hash, Hasher};
+    let mut hasher = std::collections::hash_map::DefaultHasher::new();
     let modified = std::fs::metadata(binary_path)
         .and_then(|metadata| metadata.modified())
         .ok()
         .and_then(|modified| modified.duration_since(std::time::UNIX_EPOCH).ok())
         .map(|duration| duration.as_nanos())
         .unwrap_or_default();
-    format!("{}:{modified}:{}", binary_path.display(), args.join("\u{1f}"))
+    binary_path.hash(&mut hasher);
+    modified.hash(&mut hasher);
+    args.hash(&mut hasher);
+    hasher.finish().to_string()
 }
 
 fn validate_bundled_binary(binary_path: &std::path::Path) -> Result<(), String> {
@@ -2598,7 +2607,9 @@ async fn remove_download_assets(
     }
 
     for suffix in [".aria2", ".part", ".ytdl"] {
-        let candidate = std::path::PathBuf::from(format!("{}{}", primary.display(), suffix));
+        let mut candidate_os = primary.as_os_str().to_os_string();
+        candidate_os.push(suffix);
+        let candidate = std::path::PathBuf::from(candidate_os);
         if candidate.exists() && is_safe_path(&candidate, app_handle) {
             tokio::fs::remove_file(&candidate)
                 .await