refactor: quality overhaul (#234)

* fix: prevent queue deadlock after cancelling tasks

Get no longer recurses while holding the mutex.
Cancelled queued tasks leave the map, making their IDs reusable.
Closed empty queues return ErrQueueClosed.

* fix: init task queue lazily and close on shutdown

AddTask is safe before Run by initializing the queue once.
Close unblocks workers waiting in Get.

* fix: make resource fingerprints deterministic

Sort map keys before hashing so Resource.ID is stable.

* fix: harden per-item processing tracking in tasks

Use the resource fingerprint as the dedup key on insert and delete.
Check and set processing entries atomically instead of TOCTOU.
Count only successful downloads.

* fix: honor IgnoreErrors in batch tasks

Element failures no longer cancel sibling elements or stop later groups.

* fix: report streamed upload bytes in batch tasks

Stream downloads report their byte count as the upload total.

* fix: validate i18n key parity across locales

geni18n fails when a language file misses any key.
Align the syncpeers completion key between en and zh-Hans.
Translate three untranslated parse keys in zh-Hans.

* refactor: share progress throttling helpers

Move size-tiered and count-based throttling into progressutil.
Localize hardcoded Chinese progress strings.
Drop five duplicated implementations and dead local copies.

* refactor: share unique filename logic

Storage backends use fsutil.UniquePath instead of local loops.

* fix: sanitize local storage paths

Reject absolute paths and dot-dot escapes in Save.
Check close errors and wrap creation failures.

* fix: preserve webdav error causes

Wrap mkdir and write failures with %w and drop dead error values.

* fix: kill rclone subprocess on reader close

Prevent cat processes from hanging after the pipe is closed.

* fix: fail alist init instead of exiting

Replace log.Fatalf with wrapped errors so a bad alist cannot kill the bot.
Cancel token refresh with the init context and re-login on 401.

* fix: enforce telegram album limits and track saved paths

Use tglimit.MaxAlbumItems for album batching and video splitting.
Exists now reports previously saved paths instead of always false.

* fix: guard storage registry maps

Protect Storages and UserStorages with mutexes and expose read accessors.

* fix: harden JS parser plugin runtime

Validate semver instead of panicking and require canHandle.
Recover plugin worker panics and time out CanHandle calls.
Return a copy from the registry and sanitize install filenames.

* fix: guard kemono parser against nil fields

Skip sparse preview and attachment entries instead of panicking.

* refactor: remove commented-out dead code

Drop unused kemono legacy types and commented response structs.

* test: cover invalid plugin version rejection

* fix: show all queued tasks in /task list

Render up to ten tasks and append the truncation note once.

* fix: guard callback data parsing

Reject malformed callback payloads before indexing split parts.

* fix: isolate media groups per user

Key pending groups by chat, user and group id.

* fix: require permission for callback handlers

* fix: initialize userbot context once

Replace the racy lazy init with sync.OnceValue.

* fix: avoid leaking raw errors in /dir reply

* fix: notify users on invalid update version

* fix: fail fast when API listen fails

Bind synchronously and surface errors instead of logging them.

* fix: add timeouts and backoff to webhook delivery

* refactor: remove dead code from api and bot

Drop the empty ProgressTracker shim, unused token context key and a redundant SetBotCommands call.

* fix: load remote config without local lookup

Skip the local file search after reading a config URL and add a timeout.

* refactor: drop unused hook config

* docs: document parser plugin config

* ci: fix BuildTime formatting and align checkout

Actions format does not format dates; pass the raw timestamp.

* chore: ignore cache directory

* fix: make cache init idempotent

* fix: upload only downloaded batch elements

Failed elements keep partial cache files and never reach the backend.
Successfully downloaded siblings still upload when one element fails.

* fix: record telegram saved paths only after upload

Skip-large returns a sentinel so skipped files are not marked as saved.

* fix: deduplicate alist token refreshes

Guard token access with a mutex and merge concurrent logins.
Reuse a recent refresh to avoid login storms.

* test: cover concurrent alist 401 retry

Ten parallel uploads share a single re-login under -race.

* fix: count parsed resources in progress text

* fix: localize storage lookup errors in /dir

Use the shared i18n key and escape the dynamic error.

* fix: deduplicate concurrent storage initialization

singleflight merges first-time inits so side effects are not duplicated.

* fix: guard nil progress trackers in api-created tasks

Batch, telegraph and transfer tasks run without a Telegram tracker
when created through the API; their callbacks must not panic.

* fix: keep album order when filtering failed batch items

Download results are stored by original index so surviving
elements keep their source order.

* test: cover nil-tracker task execution

* fix: report partial failure in batch done message

IgnoreErrors runs with failed elements show success and failed
counts instead of claiming every file completed.

* fix: skip login refresh for token-only alist storage

401 responses surface the auth error instead of sending a
credential-less login; the refresh window never exceeds TokenExp.

* test: cover alist refresh semantics

Concurrent refresh uses username/password; token-only storage
never attempts a login on 401.

* fix: call tracker from notifyProgress instead of recursing

The helper called itself, overflowing the stack on any batch
task with a progress tracker.

* fix: propagate cancellation past IgnoreErrors

Cancelled tasks must not be reported as successful: only
ordinary element failures are ignored.

* test: cover notifyProgress tracker call

* test: cover cancellation with IgnoreErrors

* fix: refresh alist token after startup 401s

The init login no longer satisfies the dedup window, so an
early 401 triggers a real refresh; later 401s reuse it.
Clarify that streaming uploads cannot replay their body.

* test: exercise the alist 401 refresh path

Concurrent uploads now reject the init token, share one
refresh and retry with the new token; token-only stays inert.

* style: trim verbose comments

Drop process-style explanations; keep one-line behavior notes.

* style: gofmt test files

* fix: drop unbounded saved-path cache in telegram storage

Telegram cannot reliably query remote file existence, so the
cache answered a question it could not answer and grew without
bound. Exists returns false again, as before.

* style: format codes

client/bot/bot.go

@@ -70,9 +70,6 @@ func Init(ctx context.Context) <-chan struct{} {
 			}{nil, err}
 			return
 		}
-		client.API().BotsSetBotCommands(ctx, &tg.BotsSetBotCommandsRequest{
-			Scope: &tg.BotCommandScopeDefault{},
-		})
 		commands := make([]tg.BotCommand, 0, len(handlers.CommandHandlers))
 		for _, info := range handlers.CommandHandlers {
 			commands = append(commands, tg.BotCommand{Command: info.Cmd, Description: i18n.T(info.Desc)})

client/bot/handlers/add_task.go

@@ -23,7 +23,11 @@ import (
 )
 
 func handleAddCallback(ctx *ext.Context, update *ext.Update) error {
-	dataid := strings.Split(string(update.CallbackQuery.Data), " ")[1]
+	dataParts := strings.Split(string(update.CallbackQuery.Data), " ")
+	if len(dataParts) < 2 {
+		return fmt.Errorf("invalid callback data: %q", update.CallbackQuery.Data)
+	}
+	dataid := dataParts[1]
 	data, err := shortcut.GetCallbackDataWithAnswer[tcbdata.Add](ctx, update, dataid)
 	if err != nil {
 		return err

client/bot/handlers/cancel_task.go

@@ -1,6 +1,7 @@
 package handlers
 
 import (
+	"fmt"
 	"strings"
 
 	"github.com/celestix/gotgproto/dispatcher"
@@ -14,7 +15,11 @@ import (
 )
 
 func handleCancelCallback(ctx *ext.Context, update *ext.Update) error {
-	taskid := strings.Split(string(update.CallbackQuery.Data), " ")[1]
+	dataParts := strings.Split(string(update.CallbackQuery.Data), " ")
+	if len(dataParts) < 2 {
+		return fmt.Errorf("invalid callback data: %q", update.CallbackQuery.Data)
+	}
+	taskid := dataParts[1]
 	if err := core.CancelTask(ctx, taskid); err != nil {
 		log.FromContext(ctx).Errorf("Failed to cancel task %s: %v", taskid, err)
 		ctx.AnswerCallback(msgelem.AlertCallbackAnswer(update.CallbackQuery.GetQueryID(), i18n.T(i18nk.BotMsgCancelErrorCancelFailed, map[string]any{

client/bot/handlers/dir.go

@@ -10,6 +10,7 @@ import (
 	"github.com/krau/SaveAny-Bot/client/bot/handlers/utils/msgelem"
 	"github.com/krau/SaveAny-Bot/common/i18n"
 	"github.com/krau/SaveAny-Bot/common/i18n/i18nk"
+	"github.com/krau/SaveAny-Bot/common/utils/tgutil"
 	"github.com/krau/SaveAny-Bot/database"
 	"github.com/krau/SaveAny-Bot/storage"
 )
@@ -42,7 +43,9 @@ func handleDirCmd(ctx *ext.Context, update *ext.Update) error {
 			return dispatcher.EndGroups
 		}
 		if _, err := storage.GetStorageByUserIDAndName(ctx, user.ChatID, args[2]); err != nil {
-			ctx.Reply(update, ext.ReplyTextString(err.Error()), nil)
+			logger.Errorf("Failed to get storage %q: %s", args[2], err)
+			ctx.Reply(update, ext.ReplyTextString(i18n.T(i18nk.BotMsgCommonErrorGetStorageFailed,
+				tgutil.EscapeHTMLTemplateData(map[string]any{"Error": err.Error()}))), nil)
 			return dispatcher.EndGroups
 		}
 

client/bot/handlers/media_group.go

@@ -20,9 +20,17 @@ import (
 	"github.com/krau/SaveAny-Bot/storage"
 )
 
+// mediaGroupKey uniquely identifies a media group by chat, sender, and group
+// ID so files from different users in the same chat can never be mixed.
+type mediaGroupKey struct {
+	chatID  int64
+	userID  int64
+	groupID int64
+}
+
 type MediaGroupHandler struct {
-	groups    map[int64][]tfile.TGFileMessage
-	timers    map[int64]*time.Timer
+	groups    map[mediaGroupKey][]tfile.TGFileMessage
+	timers    map[mediaGroupKey]*time.Timer
 	mu        sync.Mutex
 	timeout   time.Duration
 	setupOnce sync.Once
@@ -39,8 +47,8 @@ func (m *MediaGroupHandler) SetupTimeout(timeoutSec int) {
 
 var (
 	mediaGroupHandler = &MediaGroupHandler{
-		groups: make(map[int64][]tfile.TGFileMessage),
-		timers: make(map[int64]*time.Timer),
+		groups: make(map[mediaGroupKey][]tfile.TGFileMessage),
+		timers: make(map[mediaGroupKey]*time.Timer),
 		mu:     sync.Mutex{},
 	}
 )
@@ -66,32 +74,37 @@ func handleGroupMediaMessage(ctx *ext.Context, update *ext.Update, message *tg.M
 	}
 	mediaGroupHandler.mu.Lock()
 	defer mediaGroupHandler.mu.Unlock()
-	if mediaGroupHandler.groups[groupID] == nil {
-		mediaGroupHandler.groups[groupID] = make([]tfile.TGFileMessage, 0)
+	key := mediaGroupKey{
+		chatID:  update.EffectiveChat().GetID(),
+		userID:  userId,
+		groupID: groupID,
 	}
-	mediaGroupHandler.groups[groupID] = append(mediaGroupHandler.groups[groupID], file)
+	if mediaGroupHandler.groups[key] == nil {
+		mediaGroupHandler.groups[key] = make([]tfile.TGFileMessage, 0)
+	}
+	mediaGroupHandler.groups[key] = append(mediaGroupHandler.groups[key], file)
 
-	if timer, exists := mediaGroupHandler.timers[groupID]; exists {
+	if timer, exists := mediaGroupHandler.timers[key]; exists {
 		timer.Stop()
 	}
-	mediaGroupHandler.timers[groupID] = time.AfterFunc(mediaGroupHandler.timeout, func() {
-		processMediaGroup(ctx, update, groupID)
+	mediaGroupHandler.timers[key] = time.AfterFunc(mediaGroupHandler.timeout, func() {
+		processMediaGroup(ctx, update, key)
 	})
 	return dispatcher.EndGroups
 }
 
-func processMediaGroup(ctx *ext.Context, update *ext.Update, groupID int64) {
+func processMediaGroup(ctx *ext.Context, update *ext.Update, key mediaGroupKey) {
 	logger := log.FromContext(ctx)
 	mediaGroupHandler.mu.Lock()
-	items := mediaGroupHandler.groups[groupID]
-	delete(mediaGroupHandler.groups, groupID)
-	delete(mediaGroupHandler.timers, groupID)
+	items := mediaGroupHandler.groups[key]
+	delete(mediaGroupHandler.groups, key)
+	delete(mediaGroupHandler.timers, key)
 	mediaGroupHandler.mu.Unlock()
 	if len(items) == 0 {
-		logger.Warn("No media items to process for group", "groupID", groupID)
+		logger.Warn("No media items to process for group", "groupID", key.groupID)
 		return
 	}
-	logger.Debugf("Processing media group %d with %d items", groupID, len(items))
+	logger.Debugf("Processing media group %d with %d items", key.groupID, len(items))
 
 	userId := update.GetUserChat().GetID()
 	msg, err := ctx.Reply(update, ext.ReplyTextString(i18n.T(i18nk.BotMsgMediaGroupInfoSavingFiles, nil)), nil)

client/bot/handlers/middleware.go

@@ -22,6 +22,17 @@ func checkPermission(ctx *ext.Context, update *ext.Update) error {
 	return dispatcher.ContinueGroups
 }
 
+// withPermission wraps a callback handler with the same whitelist check used
+// for message handlers (checkPermission).
+func withPermission(handler func(*ext.Context, *ext.Update) error) func(*ext.Context, *ext.Update) error {
+	return func(ctx *ext.Context, update *ext.Update) error {
+		if err := checkPermission(ctx, update); err != nil {
+			return err
+		}
+		return handler(ctx, update)
+	}
+}
+
 func handleSilentMode(next func(*ext.Context, *ext.Update) error, handler func(*ext.Context, *ext.Update) error) func(*ext.Context, *ext.Update) error {
 	return func(ctx *ext.Context, update *ext.Update) error {
 		userID := update.GetUserChat().GetID()

client/bot/handlers/register.go

@@ -56,11 +56,11 @@ func Register(disp dispatcher.Dispatcher) {
 	for _, info := range CommandHandlers {
 		disp.AddHandler(handlers.NewCommand(info.Cmd, info.handler))
 	}
-	disp.AddHandler(handlers.NewCallbackQuery(filters.CallbackQuery.Prefix("update"), handleUpdateCallback))
-	disp.AddHandler(handlers.NewCallbackQuery(filters.CallbackQuery.Prefix(tcbdata.TypeAdd), handleAddCallback))
-	disp.AddHandler(handlers.NewCallbackQuery(filters.CallbackQuery.Prefix(tcbdata.TypeSetDefault), handleSetDefaultCallback))
-	disp.AddHandler(handlers.NewCallbackQuery(filters.CallbackQuery.Prefix(tcbdata.TypeCancel), handleCancelCallback))
-	disp.AddHandler(handlers.NewCallbackQuery(filters.CallbackQuery.Prefix(tcbdata.TypeConfig), handleConfigCallback))
+	disp.AddHandler(handlers.NewCallbackQuery(filters.CallbackQuery.Prefix("update"), withPermission(handleUpdateCallback)))
+	disp.AddHandler(handlers.NewCallbackQuery(filters.CallbackQuery.Prefix(tcbdata.TypeAdd), withPermission(handleAddCallback)))
+	disp.AddHandler(handlers.NewCallbackQuery(filters.CallbackQuery.Prefix(tcbdata.TypeSetDefault), withPermission(handleSetDefaultCallback)))
+	disp.AddHandler(handlers.NewCallbackQuery(filters.CallbackQuery.Prefix(tcbdata.TypeCancel), withPermission(handleCancelCallback)))
+	disp.AddHandler(handlers.NewCallbackQuery(filters.CallbackQuery.Prefix(tcbdata.TypeConfig), withPermission(handleConfigCallback)))
 	disp.AddHandler(handlers.NewMessage(sabotfilters.RegexUrl(regexp.MustCompile(re.TgMessageLinkRegexString)), handleSilentMode(handleMessageLink, handleSilentSaveLink)))
 	disp.AddHandler(handlers.NewMessage(sabotfilters.RegexUrl(regexp.MustCompile(re.TelegraphUrlRegexString)), handleSilentMode(handleTelegraphUrlMessage, handleSilentSaveTelegraph)))
 	disp.AddHandler(handlers.NewMessage(filters.Message.Media, handleSilentMode(handleMediaMessage, handleSilentSaveMedia)))

client/bot/handlers/silent.go

@@ -1,6 +1,7 @@
 package handlers
 
 import (
+	"fmt"
 	"strings"
 
 	"github.com/celestix/gotgproto/dispatcher"
@@ -43,7 +44,11 @@ func handleSilentCmd(ctx *ext.Context, update *ext.Update) error {
 }
 
 func handleSetDefaultCallback(ctx *ext.Context, update *ext.Update) error {
-	dataid := strings.Split(string(update.CallbackQuery.Data), " ")[1]
+	dataParts := strings.Split(string(update.CallbackQuery.Data), " ")
+	if len(dataParts) < 2 {
+		return fmt.Errorf("invalid callback data: %q", update.CallbackQuery.Data)
+	}
+	dataid := dataParts[1]
 	data, ok := cache.Get[tcbdata.SetDefaultStorage](dataid)
 
 	failedAnswer := func(message string) error {

client/bot/handlers/tasks.go

@@ -89,7 +89,11 @@ func showQueuedTasks(ctx *ext.Context, update *ext.Update) {
 		styling.Bold(i18n.T(i18nk.BotMsgTasksQueuedTitle)),
 		styling.Plain(i18n.T(i18nk.BotMsgTasksTotalPrefix, map[string]any{"Count": len(tasks)})),
 	)
-	for _, t := range tasks {
+	const maxShown = 10
+	for i, t := range tasks {
+		if i >= maxShown {
+			break
+		}
 		created := t.Created.In(time.Local).Format("2006-01-02 15:04:05")
 		status := i18n.T(i18nk.BotMsgTasksStatusQueued)
 		if t.Cancelled {
@@ -105,10 +109,9 @@ func showQueuedTasks(ctx *ext.Context, update *ext.Update) {
 			styling.Plain("\n"+i18n.T(i18nk.BotMsgTasksFieldStatus)),
 			styling.Code(status),
 		)
-		if len(tasks) > 10 {
-			opts = append(opts, styling.Plain("\n"+i18n.T(i18nk.BotMsgTasksTruncatedNote, map[string]any{"Count": len(tasks)})))
-			break
-		}
+	}
+	if len(tasks) > maxShown {
+		opts = append(opts, styling.Plain("\n"+i18n.T(i18nk.BotMsgTasksTruncatedNote, map[string]any{"Count": len(tasks)})))
 	}
 	ctx.Reply(update, ext.ReplyTextStyledTextArray(opts), nil)
 }

client/bot/handlers/update.go

@@ -10,6 +10,7 @@ import (
 	"github.com/celestix/gotgproto/ext"
 	"github.com/gotd/td/telegram/message/html"
 	"github.com/gotd/td/tg"
+	"github.com/krau/SaveAny-Bot/client/bot/handlers/utils/msgelem"
 	"github.com/krau/SaveAny-Bot/common/i18n"
 	"github.com/krau/SaveAny-Bot/common/i18n/i18nk"
 	"github.com/krau/SaveAny-Bot/config"
@@ -100,7 +101,10 @@ func handleUpdateCmd(ctx *ext.Context, u *ext.Update) error {
 func handleUpdateCallback(ctx *ext.Context, u *ext.Update) error {
 	currentV, err := semver.Parse(config.Version)
 	if err != nil {
-		return err
+		ctx.AnswerCallback(msgelem.AlertCallbackAnswer(u.CallbackQuery.GetQueryID(), i18n.T(i18nk.BotMsgUpdateErrorVersionVarInvalid, map[string]any{
+			"Error": err.Error(),
+		})))
+		return dispatcher.EndGroups
 	}
 	ctx.EditMessage(u.GetUserChat().GetID(), &tg.MessagesEditMessageRequest{
 		ID: u.CallbackQuery.GetMsgID(),