internal/download
The ~40-line progress-bar decorator stack was copy-pasted into three download
paths and had started to drift; it is now newDownloadBar, which returns a nil
bar when progress is off (so callers use it unconditionally) plus a finish
func to defer. The three hand-rolled read/write loops that differed only in
whether they touched a bar become copyWithProgress.
FileDeezerEncrypted and FileYandexEncrypted were ~90% identical: mkdir, GET,
status check, create output, bar, cleanup-on-failure, Content-Length check,
fsync. That scaffolding is now streamEncrypted, and each function supplies
only its decryption step. Also switches the io.EOF/io.ErrUnexpectedEOF
comparisons to errors.Is.
internal/app
Three copies of "coerce a JSON array that may be []any or []map[string]any"
become anySlice, which also reports whether the value was an array at all so
callers can still distinguish missing from empty.
The worker-pool dispatch existed three times and the copies disagreed: two
counted failures under a mutex and logged inline with the track id, while the
third collected errors in a channel and logged them all after wg.Wait()
without the id. runTrackWorkers unifies them on the inline form, which
reports failures as they happen and names the track, and keeps the mutex held
across the log so failure lines cannot interleave.
Tests
The progress-bar paths had no coverage at all, because progress is disabled
when not attached to a terminal; four new tests force it on via the existing
STREAMRIP_GO_FORCE_PROGRESS escape hatch and cover the determinate bar, the
unknown-length spinner, Deezer decryption with a bar attached, and the
failure path still removing the partial file. internal/download coverage
53% -> 63%.
Three cancellation tests pin the Ctrl-C fix. Verified as genuine regression
tests by reverting the guards: without them the rip walks all 40 tracks of a
cancelled album, logs a failure for each, and Rip() returns nil.
Adds store.SQLite.IsFailed, the read complement to MarkFailed, used by the
bookkeeping test to confirm failure records still land under a cancelled
context.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Six correctness bugs that the existing tests could not see. The suite passed
and `go test -race` was clean throughout, because nothing exercised concurrent
token refresh, shared-folder artwork, or hostile metadata.
main(): extract run() int
main() was a single 1196-line function that registered 20
`defer mainApp.Close()` handlers and then called os.Exit 150 times, so none
of them ever ran. Close() is what closes the SQLite handle, flushes the
progress bars and removes the artwork temp dirs, so every failed rip leaked
temp directories. main() is now a wrapper around run() int and the command
bodies return exit codes.
Ctrl-C now stops a rip
ctx was threaded everywhere but never checked: zero ctx.Err()/ctx.Done()
in internal/app and internal/download. Cancellation left Rip() iterating
the whole remaining queue, and the retry ladder retried on a dead context,
so one Ctrl-C cost three doomed attempts per remaining track. Adds checks to
the dispatch loops, the worker-spawn loops and the retry ladder, and routes
the MarkFailed/MarkDownloaded bookkeeping through a detached context so the
records survive cancellation. Convert and TagFLAC now take a ctx and use
exec.CommandContext, so a stalled ffmpeg/ffprobe no longer outlives Ctrl-C.
Config race
Provider token refresh mutated the shared *config.Config and called
SaveFile() from inside download workers with no lock, racing the struct
fields and issuing concurrent os.WriteFile against one path. Adds a mutex to
config.Config plus UpdateTokens(), and routes all five refresh sites through
it. Each provider client gets an authMu guarding loggedIn and its
login/refresh path; beatport needed it most, since ensureToken is reached
from apiRequest.
Artwork cover race
artwork.Prepare was check-then-write on a path shared by every worker in a
playlist rip. Two workers both saw a missing cover.jpg, both created it, and
the loser's cleanup deleted the winner's finished file. Adds a per-folder
lock and downloads via a unique temp file + rename. The regression test
fails against the old code with 15 of 16 workers getting no cover.
Path traversal from remote metadata
naming.CleanName stripped <>:"/\|?* and control chars but not "." , so a
title of ".." survived into filepath.Join and escaped the download root.
SoundCloud and Tidal playlist names are user-generated. Now rejects "." and
"..", trims trailing dots, handles Windows device names, adds DEL to the
invalid set and caps components at 255 bytes without splitting a rune.
app.go gains safeJoin as a second line of defence.
Credentials no longer world-readable
The config holds plaintext provider passwords, Deezer ARL cookies and OAuth
tokens and was written 0o644. Now 0o600, with 0o700 directories, and an
existing 0o644 file is tightened on write.
Also: deletes the 9 duplicated *-rip-smoke dev commands (~300 lines fully
subsumed by `rip id`) and the unreachable second dev-help arm; registers
image/png so PNG covers are downscaled instead of being silently saved as
cover.jpg containing PNG bytes; adds the missing .gitignore, which was keeping
a 21MB build artifact one `git add -A` away from the repo.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Use album artist overrides during album ripping so compilation-style tracks do not change album performer tags, and add safer disc-number fallbacks for metadata/path generation when providers omit disc fields.
This brings the Go CLI closer to upstream behavior with global flag handling and clearer resolve failures, while adding Tidal video downloads plus initial Deezer and SoundCloud no-account flows for broader end-to-end coverage.
Write replaygain gain and peak tags from provider-specific metadata fields, then apply tagging across supported output containers with graceful cover-art fallback so non-FLAC downloads retain metadata.
Make download dedupe source-specific to prevent cross-provider ID collisions. Also correct non-remaster filtering, avoid FLAC tagging on non-FLAC files, and use album IDs for singles folder templating.
JorenandClaude Opus 5