test(codeql): clear all 70 test-code CodeQL alerts (real fixes)

tests/SwfocTrainer.Tests/App/MainViewModelHotkeyHelpersFullCoverageTests.cs

@@ -109,7 +109,7 @@ public void BuildDefaultHotkeyPayloadJson_NullActionId_ShouldThrow()
     public void BuildDefaultHotkeyPayloadJson_KnownActions_ShouldContainExpectedKey(string actionId, string expectedKey)
     {
         var json = MainViewModelHotkeyHelpers.BuildDefaultHotkeyPayloadJson(actionId);
-        var obj = JsonNode.Parse(json) as JsonObject;
+        var obj = JsonNode.Parse(json)!.AsObject();
 
         obj.Should().NotBeNull();
         obj![expectedKey].Should().NotBeNull();
@@ -119,7 +119,7 @@ public void BuildDefaultHotkeyPayloadJson_KnownActions_ShouldContainExpectedKey(
     public void BuildDefaultHotkeyPayloadJson_UnknownAction_ShouldReturnEmptyObject()
     {
         var json = MainViewModelHotkeyHelpers.BuildDefaultHotkeyPayloadJson("unknown_action");
-        var obj = JsonNode.Parse(json) as JsonObject;
+        var obj = JsonNode.Parse(json)!.AsObject();
 
         obj.Should().NotBeNull();
         obj!.Count.Should().Be(0);
@@ -129,7 +129,7 @@ public void BuildDefaultHotkeyPayloadJson_UnknownAction_ShouldReturnEmptyObject(
     public void BuildDefaultHotkeyPayloadJson_SetCredits_ShouldHaveLockCreditsKey()
     {
         var json = MainViewModelHotkeyHelpers.BuildDefaultHotkeyPayloadJson(MainViewModelDefaults.ActionSetCredits);
-        var obj = JsonNode.Parse(json) as JsonObject;
+        var obj = JsonNode.Parse(json)!.AsObject();
 
         obj![MainViewModelDefaults.PayloadLockCredits]!.GetValue<bool>().Should().BeFalse();
         obj[MainViewModelDefaults.PayloadIntValue]!.GetValue<int>()
@@ -140,7 +140,7 @@ public void BuildDefaultHotkeyPayloadJson_SetCredits_ShouldHaveLockCreditsKey()
     public void BuildDefaultHotkeyPayloadJson_FreezeSymbol_ShouldHaveFreezeKey()
     {
         var json = MainViewModelHotkeyHelpers.BuildDefaultHotkeyPayloadJson(MainViewModelDefaults.ActionFreezeSymbol);
-        var obj = JsonNode.Parse(json) as JsonObject;
+        var obj = JsonNode.Parse(json)!.AsObject();
 
         obj![MainViewModelDefaults.PayloadFreeze]!.GetValue<bool>().Should().BeTrue();
     }
@@ -149,7 +149,7 @@ public void BuildDefaultHotkeyPayloadJson_FreezeSymbol_ShouldHaveFreezeKey()
     public void BuildDefaultHotkeyPayloadJson_UnfreezeSymbol_ShouldHaveFreezeKeyFalse()
     {
         var json = MainViewModelHotkeyHelpers.BuildDefaultHotkeyPayloadJson(MainViewModelDefaults.ActionUnfreezeSymbol);
-        var obj = JsonNode.Parse(json) as JsonObject;
+        var obj = JsonNode.Parse(json)!.AsObject();
 
         obj![MainViewModelDefaults.PayloadFreeze]!.GetValue<bool>().Should().BeFalse();
     }
@@ -158,7 +158,7 @@ public void BuildDefaultHotkeyPayloadJson_UnfreezeSymbol_ShouldHaveFreezeKeyFals
     public void BuildDefaultHotkeyPayloadJson_SetGameSpeed_ShouldHaveFloatValue()
     {
         var json = MainViewModelHotkeyHelpers.BuildDefaultHotkeyPayloadJson(MainViewModelDefaults.ActionSetGameSpeed);
-        var obj = JsonNode.Parse(json) as JsonObject;
+        var obj = JsonNode.Parse(json)!.AsObject();
 
         obj![MainViewModelDefaults.PayloadFloatValue]!.GetValue<float>()
             .Should().Be(MainViewModelDefaults.DefaultGameSpeedValue);
@@ -168,7 +168,7 @@ public void BuildDefaultHotkeyPayloadJson_SetGameSpeed_ShouldHaveFloatValue()
     public void BuildDefaultHotkeyPayloadJson_SetUnitCap_ShouldHaveEnableKey()
     {
         var json = MainViewModelHotkeyHelpers.BuildDefaultHotkeyPayloadJson(MainViewModelDefaults.ActionSetUnitCap);
-        var obj = JsonNode.Parse(json) as JsonObject;
+        var obj = JsonNode.Parse(json)!.AsObject();
 
         obj![MainViewModelDefaults.PayloadEnable]!.GetValue<bool>().Should().BeTrue();
         obj[MainViewModelDefaults.PayloadIntValue]!.GetValue<int>()

tests/SwfocTrainer.Tests/App/MainViewModelHotkeyHelpersWave5Tests.cs

@@ -115,7 +115,7 @@ public void BuildDefaultHotkeyPayloadJson_AllActions_ShouldReturnValidJson(strin
     public void BuildDefaultHotkeyPayloadJson_SetCredits_ShouldHaveCorrectKeys()
     {
         var json = MainViewModelHotkeyHelpers.BuildDefaultHotkeyPayloadJson(MainViewModelDefaults.ActionSetCredits);
-        var obj = JsonNode.Parse(json) as JsonObject;
+        var obj = JsonNode.Parse(json)!.AsObject();
         obj.Should().NotBeNull();
         obj![MainViewModelDefaults.PayloadSymbol]!.GetValue<string>().Should().Be("credits");
         obj[MainViewModelDefaults.PayloadIntValue]!.GetValue<int>().Should().Be(MainViewModelDefaults.DefaultCreditsValue);
@@ -126,7 +126,7 @@ public void BuildDefaultHotkeyPayloadJson_SetCredits_ShouldHaveCorrectKeys()
     public void BuildDefaultHotkeyPayloadJson_FreezeTimer_ShouldHaveBoolValueTrue()
     {
         var json = MainViewModelHotkeyHelpers.BuildDefaultHotkeyPayloadJson(MainViewModelDefaults.ActionFreezeTimer);
-        var obj = JsonNode.Parse(json) as JsonObject;
+        var obj = JsonNode.Parse(json)!.AsObject();
         obj.Should().NotBeNull();
         obj![MainViewModelDefaults.PayloadBoolValue]!.GetValue<bool>().Should().BeTrue();
     }
@@ -135,7 +135,7 @@ public void BuildDefaultHotkeyPayloadJson_FreezeTimer_ShouldHaveBoolValueTrue()
     public void BuildDefaultHotkeyPayloadJson_SetGameSpeed_ShouldHaveFloatValue()
     {
         var json = MainViewModelHotkeyHelpers.BuildDefaultHotkeyPayloadJson(MainViewModelDefaults.ActionSetGameSpeed);
-        var obj = JsonNode.Parse(json) as JsonObject;
+        var obj = JsonNode.Parse(json)!.AsObject();
         obj.Should().NotBeNull();
         obj![MainViewModelDefaults.PayloadFloatValue]!.GetValue<float>().Should().Be(MainViewModelDefaults.DefaultGameSpeedValue);
     }
@@ -144,7 +144,7 @@ public void BuildDefaultHotkeyPayloadJson_SetGameSpeed_ShouldHaveFloatValue()
     public void BuildDefaultHotkeyPayloadJson_UnfreezeSymbol_ShouldHaveFreezeFalse()
     {
         var json = MainViewModelHotkeyHelpers.BuildDefaultHotkeyPayloadJson(MainViewModelDefaults.ActionUnfreezeSymbol);
-        var obj = JsonNode.Parse(json) as JsonObject;
+        var obj = JsonNode.Parse(json)!.AsObject();
         obj.Should().NotBeNull();
         obj![MainViewModelDefaults.PayloadFreeze]!.GetValue<bool>().Should().BeFalse();
     }
@@ -153,7 +153,7 @@ public void BuildDefaultHotkeyPayloadJson_UnfreezeSymbol_ShouldHaveFreezeFalse()
     public void BuildDefaultHotkeyPayloadJson_FreezeSymbol_ShouldHaveFreezeTrue()
     {
         var json = MainViewModelHotkeyHelpers.BuildDefaultHotkeyPayloadJson(MainViewModelDefaults.ActionFreezeSymbol);
-        var obj = JsonNode.Parse(json) as JsonObject;
+        var obj = JsonNode.Parse(json)!.AsObject();
         obj.Should().NotBeNull();
         obj![MainViewModelDefaults.PayloadFreeze]!.GetValue<bool>().Should().BeTrue();
         obj[MainViewModelDefaults.PayloadIntValue]!.GetValue<int>().Should().Be(MainViewModelDefaults.DefaultCreditsValue);
@@ -163,7 +163,7 @@ public void BuildDefaultHotkeyPayloadJson_FreezeSymbol_ShouldHaveFreezeTrue()
     public void BuildDefaultHotkeyPayloadJson_ToggleInstantBuild_ShouldHaveEnableTrue()
     {
         var json = MainViewModelHotkeyHelpers.BuildDefaultHotkeyPayloadJson(MainViewModelDefaults.ActionToggleInstantBuildPatch);
-        var obj = JsonNode.Parse(json) as JsonObject;
+        var obj = JsonNode.Parse(json)!.AsObject();
         obj.Should().NotBeNull();
         obj![MainViewModelDefaults.PayloadEnable]!.GetValue<bool>().Should().BeTrue();
     }
@@ -172,7 +172,7 @@ public void BuildDefaultHotkeyPayloadJson_ToggleInstantBuild_ShouldHaveEnableTru
     public void BuildDefaultHotkeyPayloadJson_SetUnitCap_ShouldHaveCorrectValues()
     {
         var json = MainViewModelHotkeyHelpers.BuildDefaultHotkeyPayloadJson(MainViewModelDefaults.ActionSetUnitCap);
-        var obj = JsonNode.Parse(json) as JsonObject;
+        var obj = JsonNode.Parse(json)!.AsObject();
         obj.Should().NotBeNull();
         obj![MainViewModelDefaults.PayloadSymbol]!.GetValue<string>().Should().Be("unit_cap");
         obj[MainViewModelDefaults.PayloadIntValue]!.GetValue<int>().Should().Be(MainViewModelDefaults.DefaultUnitCapValue);

tests/SwfocTrainer.Tests/App/MainViewModelLiveOpsCoverageTests.cs

@@ -561,7 +561,7 @@ public async Task RunSpawnBatchAsync_Failed_ShouldSetFailureStatus()
     public void ApplyDraftFromSnapshot_NullSnapshot_ShouldThrow()
     {
         var vm = CreateViewModel();
-        var act = () => Invoke(vm, "ApplyDraftFromSnapshot", (SelectedUnitSnapshot)null!);
+        var act = () => Invoke(vm, "ApplyDraftFromSnapshot", default(SelectedUnitSnapshot));
         act.Should().Throw<TargetInvocationException>()
             .WithInnerException<ArgumentNullException>();
     }
@@ -602,7 +602,7 @@ public void RefreshSelectedUnitTransactions_EmptyHistory_ShouldClear()
     public void BuildActionContext_NullActionId_ShouldThrow()
     {
         var vm = CreateViewModel();
-        var act = () => Invoke(vm, "BuildActionContext", (string)null!);
+        var act = () => Invoke(vm, "BuildActionContext", default(string));
         act.Should().Throw<TargetInvocationException>()
             .WithInnerException<ArgumentNullException>();
     }

tests/SwfocTrainer.Tests/App/MainViewModelSaveOpsCoverageTests.cs

@@ -609,7 +609,7 @@ public void RebuildSaveFieldRows_WithNestedChildren_ShouldFlattenRecursively()
     public void FlattenNodes_NullRoot_ShouldThrow()
     {
         var vm = CreateViewModel();
-        var act = () => InvokeProtected(vm, "FlattenNodes", (SaveNode)null!);
+        var act = () => InvokeProtected(vm, "FlattenNodes", default(SaveNode));
         act.Should().Throw<TargetInvocationException>()
             .WithInnerException<ArgumentNullException>();
     }
@@ -663,7 +663,7 @@ public void ApplySaveSearch_WithQuery_ShouldMatchOnValue()
     public void PopulatePatchPreviewOperations_NullPreview_ShouldThrow()
     {
         var vm = CreateViewModel();
-        var act = () => InvokeProtected(vm, "PopulatePatchPreviewOperations", (SavePatchPreview)null!);
+        var act = () => InvokeProtected(vm, "PopulatePatchPreviewOperations", default(SavePatchPreview));
         act.Should().Throw<TargetInvocationException>()
             .WithInnerException<ArgumentNullException>();
     }
@@ -890,7 +890,7 @@ public void AppendPatchArtifactRows_BothWhitespace_ShouldNotAdd()
     public void AppendPatchArtifactRows_OnlyBackup_ShouldAddOne()
     {
         var vm = CreateViewModel();
-        InvokeProtected(vm, "AppendPatchArtifactRows", @"C:\backup.sav", (string?)null);
+        InvokeProtected(vm, "AppendPatchArtifactRows", @"C:\backup.sav", default(string));
 
         vm.SavePatchCompatibility.Should().HaveCount(1);
         vm.SavePatchCompatibility[0].Code.Should().Be("backup_path");

tests/SwfocTrainer.Tests/Core/CoreWave2CoverageTests.cs

@@ -255,7 +255,9 @@ public async Task FileAuditLogger_ShouldWriteToCustomDirectory()
         }
         finally
         {
-            try { Directory.Delete(customDir, true); } catch { /* best-effort cleanup */ }
+            try { Directory.Delete(customDir, true); }
+            catch (IOException) { /* best-effort cleanup */ }
+            catch (UnauthorizedAccessException) { /* best-effort cleanup */ }
         }
     }
 

tests/SwfocTrainer.Tests/Core/CoreWave6Tests.cs

@@ -446,7 +446,6 @@
     [Fact]
     public void ClampConfidence_NaN_ShouldReturn050()
     {
-        var service = new ActionReliabilityService();
         var mechanic = new FakeModMechanicDetectionService(new ModMechanicReport(
             "p1", DateTimeOffset.UtcNow, true, true,
             new[] { new ModMechanicSupport("set_credits", false, RuntimeReasonCode.CAPABILITY_REQUIRED_MISSING, "bad", double.NaN) },
@@ -805,7 +804,7 @@
             Actions: actionDict,
             FeatureFlags: featureFlags ?? new Dictionary<string, bool>(),
             CatalogSources: Array.Empty<CatalogSource>(),
             SaveSchemaId: null,
             HelperModHooks: Array.Empty<HelperHookSpec>(),
             Metadata: metadata);
     }

tests/SwfocTrainer.Tests/Flow/FlowWave6Tests.cs

@@ -204,7 +204,7 @@ public void BuildCapabilityLinkReport_NullCapabilities_ShouldReturnDiagnostic()
         var flowReport = new FlowIndexReport(plots, Array.Empty<string>());
         var megaIndex = MegaFilesIndex.Empty;
 
-        var symbolPack = JsonSerializer.Serialize(new { Capabilities = (object?)null });
+        var symbolPack = JsonSerializer.Serialize(new { Capabilities = default(object) });
         var result = StoryPlotFlowExtractor.BuildCapabilityLinkReport(flowReport, megaIndex, symbolPack);
         result.Diagnostics.Should().Contain(d => d.Contains("missing"));
     }
@@ -393,7 +393,7 @@ public void BuildCapabilityLinkReport_CapabilityWithNullFeatureId_ShouldBeSkippe
         {
             Capabilities = new object[]
             {
-                new { FeatureId = (string?)null, Available = true, State = "Active", ReasonCode = "OK" },
+                new { FeatureId = default(string), Available = true, State = "Active", ReasonCode = "OK" },
                 new { FeatureId = "set_credits", Available = true, State = "Active", ReasonCode = "OK" }
             }
         });
@@ -417,7 +417,7 @@ public void BuildCapabilityLinkReport_CapabilityWithNullStateAndReasonCode_Shoul
         {
             Capabilities = new object[]
             {
-                new { FeatureId = "set_credits", Available = false, State = (string?)null, ReasonCode = (string?)null }
+                new { FeatureId = "set_credits", Available = false, State = default(string), ReasonCode = default(string) }
             }
         });
 

tests/SwfocTrainer.Tests/Flow/FlowWave7FinalTests.cs

@@ -39,7 +39,7 @@ public void ResolveDefaultHarnessScriptPath_ShouldReturnPathEndingWithPs1()
             BindingFlags.NonPublic | BindingFlags.Static);
         method.Should().NotBeNull("ResolveDefaultHarnessScriptPath must exist");
 
-        var result = method!.Invoke(null, Array.Empty<object>()) as string;
+        var result = method!.Invoke(null, Array.Empty<object>()) as string ?? throw new InvalidOperationException("test setup: expected non-null result.");
         result.Should().NotBeNullOrWhiteSpace();
         result!.Should().EndWith("run-lua-harness.ps1");
     }
@@ -103,7 +103,7 @@ public void ExtractEvents_NullRoot_ShouldReturnEmpty()
 
         var result = method!.Invoke(extractor, new object?[] { null, "test.xml" });
         result.Should().NotBeNull();
-        var events = result as IReadOnlyList<FlowEventRecord>;
+        var events = result as IReadOnlyList<FlowEventRecord> ?? throw new InvalidOperationException("test setup: expected non-null result.");
         events.Should().NotBeNull();
         events!.Should().BeEmpty();
     }

tests/SwfocTrainer.Tests/Helper/HelperModServiceFullCoverageTests.cs

@@ -138,7 +138,7 @@ public async Task DeployAsync_ShouldCreateSubdirectories_ForNestedScripts()
             });
 
             var service = CreateService(profile, sourceRoot, installRoot);
-            var result = await service.DeployAsync("test_profile");
+            await service.DeployAsync("test_profile");
             File.Exists(Path.Join(installRoot, "test_profile", "scripts", "hook.lua")).Should().BeTrue();
         }
         finally

tests/SwfocTrainer.Tests/Meg/MegArchiveReaderDeepBranchTests.cs

@@ -244,9 +244,8 @@ public void Open_ShouldOrderEntriesByIndexThenPath()
         using var nameStream = new MemoryStream();
         using var nameWriter = new BinaryWriter(nameStream, Encoding.ASCII, leaveOpen: true);
         var names = new[] { "Z.txt", "A.txt" };
-        foreach (var name in names)
+        foreach (var nameBytes in names.Select(Encoding.ASCII.GetBytes))
         {
-            var nameBytes = Encoding.ASCII.GetBytes(name);
             nameWriter.Write((ushort)nameBytes.Length);
             nameWriter.Write((ushort)0);
             nameWriter.Write(nameBytes);

tests/SwfocTrainer.Tests/Meg/MegWave3FinalTests.cs

@@ -12,10 +12,10 @@
 /// MegArchiveReader IOException, InvalidOperationException, FormatException,
 /// TryParseFormat2Fallback, encrypted format3, format3 truncated header,
 /// entries with unsupported flags, entry record truncated, entry out of range,
 /// entry before dataStart, format3 name spill past boundary, TryEnsureRange offset<0/offset>length,
 /// ParseNames format2 fallback on format3 fail, MegEntry record coverage.
 /// </summary>
 public sealed class MegWave3FinalTests
 {
     private readonly MegArchiveReader _reader = new();
 
@@ -372,12 +372,6 @@
     public void Open_Format3_WithNonZeroEntryFlags_ShouldFail()
     {
         // Build a valid format3 archive with 1 name, 1 file, but flags != 0
-        var nameBytes = Encoding.ASCII.GetBytes("test.xml");
-        var nameTableSize = (uint)(4 + nameBytes.Length);
-        uint nameCount = 1, fileCount = 1;
-        var dataStart = (24 + nameTableSize + 20);
-        var totalSize = (int)(dataStart + 10);
-        var bytes = new byte[totalSize];
 
         // Non-encrypted format3: first=0x8FFFFFFF to detect format3 variant,
         // but it's always encrypted. Use format2 instead for flag test.

tests/SwfocTrainer.Tests/Profiles/ProfilesWave7FinalTests.cs

@@ -120,7 +120,7 @@ public void TryExtractPackage_IoException_ShouldReturnFailure()
         var result = method!.Invoke(null, new object[] { "testProfile", "/nonexistent/file.zip", "/tmp/extract" });
         // Should return a non-null ProfileInstallResult with failure
         result.Should().NotBeNull();
-        var installResult = result as ProfileInstallResult;
+        var installResult = result as ProfileInstallResult ?? throw new InvalidOperationException("test setup: expected non-null result.");
         installResult.Should().NotBeNull();
         installResult!.Succeeded.Should().BeFalse();
         installResult.ReasonCode.Should().Be("extract_failed");
@@ -150,7 +150,7 @@ public void PrepareExtractDirectory_ExistingDir_ShouldDeleteAndReturn()
             Directory.CreateDirectory(extractDir);
             File.WriteAllText(Path.Join(extractDir, "old.txt"), "old");
 
-            var result = method!.Invoke(service, new object[] { "testprofile", "1.0" }) as string;
+            var result = method!.Invoke(service, new object[] { "testprofile", "1.0" }) as string ?? throw new InvalidOperationException("test setup: expected non-null result.");
             result.Should().NotBeNull();
             // The old directory contents should be gone (it was deleted)
             if (Directory.Exists(extractDir))

tests/SwfocTrainer.Tests/Runtime/ModDependencyValidatorBranchCoverageTests.cs

@@ -889,7 +889,7 @@ private static void TryDeleteDirectory(string path)
                 Directory.Delete(path, true);
             }
         }
-        catch (IOException) { }
-        catch (UnauthorizedAccessException) { }
+        catch (IOException) { /* best-effort test cleanup */ }
+        catch (UnauthorizedAccessException) { /* best-effort test cleanup */ }
     }
 }

tests/SwfocTrainer.Tests/Runtime/ProcessLocatorAdditionalBranchCoverageTests.cs

@@ -220,7 +220,7 @@ public void DetermineHostRole_ShouldReturnUnknown_ForUnknownTarget()
     [Fact]
     public void ExtractSteamModIds_ShouldReturnEmpty_ForNull()
     {
-        var result = (string[])InvokeStaticMethod("ExtractSteamModIds", (string?)null)!;
+        var result = (string[])InvokeStaticMethod("ExtractSteamModIds", default(string))!;
         result.Should().BeEmpty();
     }
 
@@ -518,23 +518,23 @@ public async Task FindSupportedProcessesAsync_WithToken_ShouldWork()
     public async Task FindBestMatchAsync_Parameterless_ShouldReturnNull_WhenNoMatch()
     {
         var locator = new ProcessLocator();
-        var result = await locator.FindBestMatchAsync(ExeTarget.Swfoc);
+        await locator.FindBestMatchAsync(ExeTarget.Swfoc);
         // No game running in test env, just verify it doesn't throw
     }
 
     [Fact]
     public async Task FindBestMatchAsync_WithToken_ShouldWork()
     {
         var locator = new ProcessLocator();
-        var result = await locator.FindBestMatchAsync(ExeTarget.Swfoc, CancellationToken.None);
+        await locator.FindBestMatchAsync(ExeTarget.Swfoc, CancellationToken.None);
         // No game running in test env
     }
 
     [Fact]
     public async Task FindBestMatchAsync_WithNullOptions_ShouldDefault()
     {
         var locator = new ProcessLocator();
-        var result = await locator.FindBestMatchAsync(ExeTarget.Swfoc, null, CancellationToken.None);
+        await locator.FindBestMatchAsync(ExeTarget.Swfoc, null, CancellationToken.None);
         // Should not throw
     }
 

tests/SwfocTrainer.Tests/Runtime/ProcessLocatorBranchCoverageTests.cs

@@ -430,7 +430,6 @@ public void ResolveForcedContext_ShouldReturnDetected_WhenModMarkersPresent()
         var method = typeof(ProcessLocator).GetMethod("ResolveForcedContext", BindingFlags.Static | BindingFlags.NonPublic);
         method.Should().NotBeNull();
 
-        var optionsType = typeof(ProcessLocatorOptions);
         var options = new ProcessLocatorOptions(new[] { "99999" }, "forced_profile");
 
         var result = method!.Invoke(null, new object?[] { "cmd", "Mods/AOTR", new[] { "111" }, options });
@@ -506,7 +505,7 @@ public async Task FindBestMatchAsync_ParameterlessOverload_ShouldWork()
     {
         var locator = new ProcessLocator();
         // Most likely won't find swfoc in test environment, but should not throw
-        var result = await locator.FindBestMatchAsync(ExeTarget.Swfoc);
+        await locator.FindBestMatchAsync(ExeTarget.Swfoc);
         // result may be null, just shouldn't throw
     }