Fix security vulnerabilities, race conditions, panics, and logic bugs

[Copilot]

Analysis of the codebase revealed multiple security and reliability issues including race conditions, nil pointer dereferences, resource leaks, unbounded recursion, and incorrect concurrency patterns.

Fixes

Concurrency Issues

• Race condition in cache logging (telegram/cache.go): Accessed map sizes without holding lock
• Race condition in album handlers (telegram/updates.go): Iterated dispatcher handlers without lock; now deep copies under RLock
• Stop channel race (telegram/client.go): Added mutex-protected resetStopChannel() to prevent goroutine leaks

Nil Pointer Dereferences

• TCP read error handling (internal/transport/connection.go): Fixed logic that could deref nil e.Err when checking for io.ErrClosedPipe
• Sender cleanup (telegram/client.go): Added nil check before accessing sender.GetLastUsedTime()

Resource Leaks

• File descriptor leak (mtproto.go): os.OpenFile was never closed during permission check

Panic Prevention

• CloseChannelWithoutPanic (internal/utils/sync.go): Function never actually closed channel; now closes with specific panic recovery
• Error parsing panic (errors.go): Replaced panic() with log on unexpected reflect.Kind

Logic Bugs

• Defer inside loop (telegram/updates.go): Removed defer in loop (defer runs on function exit, not iteration end)
• Notification timeout (mtproto.go): Increased from 1ms to 100ms to prevent dropped messages
• Unbounded recursion (handshake.go): Auth key generation could recurse infinitely; added 3-retry limit

Example Fix

// Before: only closed on panic
func CloseChannelWithoutPanic(c chan tl.Object) {
    defer func() {
        if r := recover(); r != nil {
            close(c)  // Bug: closes in panic handler, never in normal case
        }
    }()
}

// After: always closes, recovers from already-closed panic
func CloseChannelWithoutPanic(c chan tl.Object) {
    if c == nil {
        return
    }
    defer func() {
        if r := recover(); r != nil {
            if str, ok := r.(string); ok && str == "close of closed channel" {
                return
            }
            panic(r)
        }
    }()
    close(c)
}

CodeQL scan shows no security alerts.

Original prompt

Analysie for security and other issues, deadlocks, other panics, logic issues

---

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.