Merge remote-tracking branch 'origin/dev' into codex/pr169-fix

Author: Vittuu

CHANGELOG.md

@@ -1,33 +1,46 @@
-# GoAnime Release Notes - Version 1.8.2
+# GoAnime Release Notes - Version 1.8.3
 
-Release date: 2026-04-25
+Release date: 2026-04-30
 
 ## Highlights
 
-- **Source Health Diagnostics**: Introduced health checks and diagnostics for scraper sources to proactively monitor and ensure source reliability.
-- **Enhanced Stream & Download Stability**: Fixed playback and download issues for direct streams by properly passing required `Referer` headers for AllAnime and AnimeFire CDNs.
-- **Windows Auto-Updater Fix**: Resolved a critical issue on Windows where the updater failed to extract the `.exe` binary from the downloaded zip archive.
-- **AllAnime Key Rotation Fix**: Updated the AES-GCM decryption key handling to accommodate AllAnime's latest API changes, restoring access to its catalog.
+- **AllAnime Encryption Update**: Updated AllAnime stream decryption from AES-GCM to AES-256-CTR cipher mode to maintain compatibility with their latest API changes.
+- **Zenpen/Kouhen Title Fix**: Fixed critical bug where anime titles with meaningful suffixes (e.g., "Jujutsu Kaisen - Zenpen") were being incorrectly stripped, causing incorrect metadata binding to sibling entries. Now preserves legitimate episode part markers while still removing PT-BR noise.
+- **Distinct ID Tracking**: Added support for keeping MyAnimeList (MAL) and AniList IDs separate throughout the playback pipeline. Previously they were conflated, causing incorrect skip intros and tracking data.
+- **AnimeFire Quality Menu Improvements**: Fixed three UX bugs in the quality picker: items now sort in descending resolution order, duplicate qualities are disambiguated with mirror labels, and pressing Esc now routes back instead of silently playing the first source.
+- **Source Health Diagnostics Enhancement**: Added post-timeout origin probing to distinguish between "client timeout waiting" and "upstream actively down" (Cloudflare 521-524), producing more actionable diagnostic messages.
+- **Cloudflare Challenge Detection Refinement**: Fixed false-positive challenge detection that was blocking legitimate Goyabu episode pages mentioning "cloudflare" in footers/comments/ToS. Now targets specific challenge markers instead of the bare word.
 
 ## Features
 
-- Implement source diagnostics and health checks for scrapers to monitor their status.
+- Add regression tests for AllAnime cipher-mode and transport changes.
+- Implement post-timeout origin probing for enhanced source diagnostics (FlixHQ, SFlix, 9Anime).
+- Add support for distinct MAL and AniList IDs in playback and tracking pipeline.
+- Normalize hyphenated search queries in SuperFlix search for better results.
+- Improve AnimeFire quality menu with descending sort, mirror disambiguation, and proper abort handling.
 
 ## Bug Fixes
 
-- Fix AllAnime AES-GCM key rotation to maintain stream extraction functionality.
-- Fix Goyabu `batchexecute` index payload structure for search queries.
-- Fix the player to properly pass the `Referer` header to direct streams, resolving playback failures.
-- Fix AllAnime source selection to preserve the `fast4speed` direct source as a fallback.
-- Stop waiting unnecessarily after failed stream sources in AllAnime.
-- Fix downloads by adding the `Referer` header for AllAnime CDN URLs.
-- Fix downloads by setting the `Referer` header for AnimeFire's CDN (`lightspeedst.net`).
-- Fix the auto-updater on Windows to extract the `.exe` file from the zip archive before replacing the application binary.
-- Fix potential crashes by adding a nil guard to the tracker.
-- Fix flaky FlixHQ tests and unblock Codacy CI checks.
+- **Critical**: Fix Zenpen/Kouhen title mismatch by preserving meaningful anime title suffixes. CleanTitle now only strips known PT-BR noise patterns, preventing data corruption where "Jujutsu Kaisen: Shimetsu Kaiyuu - Zenpen" was misbound to the Kouhen (Part 2) entry instead of Zenpen (Part 1). This affected Discord RPC, AniSkip, file naming, and tracking.
+- Fix AllAnime cipher-mode decryption: update from AES-GCM to AES-256-CTR to maintain stream extraction compatibility.
+- Fix case-sensitive source matching for AnimeFire ("Animefire.io" vs "AnimeFire") causing source breakdown diagnostics to report zero AnimeFire results despite successful searches.
+- Fix false-positive Cloudflare challenge detection that was blocking legitimate Goyabu episode pages. Relaxed body-text scan from bare "cloudflare" match to specific challenge phrases ("cf-error", "checking your browser", "ray id", etc.) while preserving all real challenge detection.
+- Fix AnimeFire quality selection bug: properly index into sorted sources by user selection instead of matching on rendered labels, fixing silent loss of selection when duplicates exist.
+- Fix AnimeFire quality picker handling of Esc/Ctrl-C to return ErrBackRequested instead of silently playing the first source.
+- Fix dead Blogger token fast-fail by detecting empty batchexecute responses (anti-hijacking prefix only) instead of wasting ~6 seconds on doomed retries.
+- Add nil guard to tracker to prevent crashes on update tracking attempts.
+- Improve Blogger video URL extraction robustness to handle edge cases and malformed responses.
+- Update error messages and log output throughout the codebase for improved clarity and consistency.
 
 ## Improvements
 
-- Update comments and error messages throughout the codebase for improved clarity and consistency.
-- Update Linux installation instructions.
-- Add test coverage for download retry exhaustion and referer handling.
+- Refactor quality menu sorting and labeling logic into buildQualityMenu helper for testability and maintainability.
+- Add comprehensive regression test suites for all major bug fixes (Zenpen/Kouhen, source breakdown, season selection abort, quality menu, Blogger unavailable token, Cloudflare challenges, origin probing).
+- Enhance debug logging throughout Goyabu scraper to aid diagnostics of extraction failures.
+- Add episode page diagnostic dumps (HTML snapshot) when all Goyabu extraction strategies fail in debug mode.
+- Improve download header handling with centralized applyDownloadAuthHeaders function for consistency.
+- Add MarginTop/Priority fields to SuperFlix media results for better UI presentation.
+- Use slices.Sort instead of deprecated sort.Slice in unified scraper manager.
+
+---
+

aur/goanime/PKGBUILD

@@ -1,5 +1,5 @@
 pkgname=goanime
-pkgver=1.8
+pkgver=1.8.3
 pkgrel=1
 pkgdesc="A command-line tool to browse, play, and download anime."
 arch=('x86_64')

go.mod

@@ -41,7 +41,7 @@ require (
 	github.com/enetx/http3 v1.0.7 // indirect
 	github.com/enetx/iter v0.0.0-20250912135656-f1583323588f // indirect
 	github.com/go-logfmt/logfmt v0.6.1 // indirect
-	github.com/klauspost/compress v1.18.5 // indirect
+	github.com/klauspost/compress v1.18.6 // indirect
 	github.com/kr/text v0.2.0 // indirect
 	github.com/mitchellh/hashstructure/v2 v2.0.2 // indirect
 	github.com/quic-go/qpack v0.6.0 // indirect

go.sum

@@ -90,8 +90,8 @@ github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
 github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
 github.com/google/gofuzz v1.2.0 h1:xRy4A+RhZaiKjJ1bPfwQ8sedCA+YS2YcCHW6ec7JMi0=
 github.com/google/gofuzz v1.2.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
-github.com/klauspost/compress v1.18.5 h1:/h1gH5Ce+VWNLSWqPzOVn6XBO+vJbCNGvjoaGBFW2IE=
-github.com/klauspost/compress v1.18.5/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ=
+github.com/klauspost/compress v1.18.6 h1:2jupLlAwFm95+YDR+NwD2MEfFO9d4z4Prjl1XXDjuao=
+github.com/klauspost/compress v1.18.6/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ=
 github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=
 github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk=
 github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=

internal/api/providers/metadata/metadata.go

@@ -703,8 +703,10 @@ func (e *Enricher) buildSeasonMapFromSuperFlix(ctx context.Context, animeName st
 		return nil
 	}
 
-	// Step 1: Search SuperFlix
-	searchURL := "https://superflixapi.rest/pesquisar?s=" + url.QueryEscape(cleanName)
+	// Step 1: Search SuperFlix. Use the canonical .online host directly: the
+	// legacy .rest host 301-redirects here and Go's http.Client downgrades
+	// POSTs to GETs across the redirect, which breaks the player API.
+	searchURL := "https://superflixapi.online/pesquisar?s=" + url.QueryEscape(cleanName)
 	req, err := http.NewRequestWithContext(ctx, "GET", searchURL, nil)
 	if err != nil {
 		return nil
@@ -740,13 +742,13 @@ func (e *Enricher) buildSeasonMapFromSuperFlix(ctx context.Context, animeName st
 	// Step 2: Fetch episode data from player page
 	// Must include Referer and Sec-Fetch-* headers or SuperFlix returns
 	// "ACESSO RESTRITO" instead of the actual player page with ALL_EPISODES.
-	epURL := "https://superflixapi.rest/serie/" + tmdbID
+	epURL := "https://superflixapi.online/serie/" + tmdbID
 	req2, err := http.NewRequestWithContext(ctx, "GET", epURL, nil)
 	if err != nil {
 		return nil
 	}
 	req2.Header.Set("User-Agent", "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36")
-	req2.Header.Set("Referer", "https://superflixapi.rest/")
+	req2.Header.Set("Referer", "https://superflixapi.online/")
 	req2.Header.Set("Accept", "text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8")
 	req2.Header.Set("Accept-Language", "pt-BR,pt;q=0.9,en-US;q=0.8,en;q=0.7")
 	req2.Header.Set("Sec-Fetch-Dest", "iframe")

internal/api/providers/metadata/metadata_test.go

@@ -354,10 +354,10 @@ func TestEnrichAnime_SuperFlixFallback(t *testing.T) {
 		<div class="card">
 			<h3>Black Clover</h3>
 			<button data-msg="Copiar TMDB" data-copy="73223">TMDB</button>
-			<button data-msg="Copiar Link" data-copy="https://superflixapi.rest/serie/73223">Link</button>
+			<button data-msg="Copiar Link" data-copy="https://superflixapi.online/serie/73223">Link</button>
 		</div>
 	</body></html>`
-	mock.responses["GET:superflixapi.rest/pesquisar"] = &http.Response{
+	mock.responses["GET:superflixapi.online/pesquisar"] = &http.Response{
 		StatusCode: http.StatusOK,
 		Body:       io.NopCloser(strings.NewReader(searchHTML)),
 	}
@@ -377,7 +377,7 @@ func TestEnrichAnime_SuperFlixFallback(t *testing.T) {
 		`{"epi_num":"16","title":"ep","air_date":"2021-03-30"}` +
 		`]};`
 	playerHTML := `<html><body><script>` + allEpisodes + `</script></body></html>`
-	mock.responses["GET:superflixapi.rest/serie/73223"] = &http.Response{
+	mock.responses["GET:superflixapi.online/serie/73223"] = &http.Response{
 		StatusCode: http.StatusOK,
 		Body:       io.NopCloser(strings.NewReader(playerHTML)),
 	}

internal/scraper/superflix.go

@@ -20,7 +20,11 @@ import (
 )
 
 const (
-	SuperFlixBase      = "https://superflixapi.rest"
+	// SuperFlixBase is the canonical SuperFlix host. The legacy
+	// `superflixapi.rest` host now 301-redirects here; Go's http.Client follows
+	// the redirect but downgrades the POST to a GET (dropping the body), which
+	// makes /player/bootstrap return HTML 404 and break JSON decoding.
+	SuperFlixBase      = "https://superflixapi.online"
 	SuperFlixUserAgent = "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36"
 )
 
@@ -431,6 +435,10 @@ func (c *SuperFlixClient) Bootstrap(ctx context.Context, tokens *SuperFlixTokens
 		return nil, fmt.Errorf("failed to read response: %w", err)
 	}
 
+	if err := ensureJSONResponse("bootstrap", resp, body); err != nil {
+		return nil, err
+	}
+
 	var result struct {
 		Data struct {
 			Options []SuperFlixServer `json:"options"`
@@ -477,6 +485,10 @@ func (c *SuperFlixClient) GetSourceURL(ctx context.Context, videoID string, toke
 		return "", fmt.Errorf("failed to read response: %w", err)
 	}
 
+	if err := ensureJSONResponse("source", resp, body); err != nil {
+		return "", err
+	}
+
 	var result struct {
 		Data struct {
 			VideoURL string `json:"video_url"`
@@ -621,6 +633,10 @@ func (c *SuperFlixClient) GetVideoAPI(ctx context.Context, playerBaseURL, videoH
 		return "", "", fmt.Errorf("failed to read response: %w", err)
 	}
 
+	if err := ensureJSONResponse("video API", resp, body); err != nil {
+		return "", "", err
+	}
+
 	var result struct {
 		SecuredLink string `json:"securedLink"`
 		VideoSource string `json:"videoSource"`
@@ -768,6 +784,33 @@ func (m *SuperFlixMedia) ToAnimeModel() *models.Anime {
 	return anime
 }
 
+// ensureJSONResponse fails fast when a SuperFlix API endpoint replies with an
+// HTML body or a non-2xx status. Without this, callers get the unhelpful
+// `invalid character '<' looking for beginning of value` JSON error — which
+// hides real causes like the host having moved (the .rest → .online 301 that
+// silently downgrades POST → GET) or a Cloudflare/captcha interstitial.
+//
+// Trust the body, not the Content-Type header. Some upstream players (e.g.
+// firevideoplayer.com behind llanfairpwllgwyngy.com) serve real JSON with
+// `Content-Type: text/html`, so a header-only check would reject valid
+// responses.
+func ensureJSONResponse(label string, resp *http.Response, body []byte) error {
+	trimmed := strings.TrimLeft(string(body), " \t\r\n\ufeff")
+	looksHTML := len(trimmed) > 0 && trimmed[0] == '<'
+
+	if looksHTML {
+		finalURL := ""
+		if resp.Request != nil && resp.Request.URL != nil {
+			finalURL = resp.Request.URL.String()
+		}
+		return fmt.Errorf("%s endpoint returned HTML (status %d, url=%q) — provider may have moved or is blocking the request", label, resp.StatusCode, finalURL)
+	}
+	if resp.StatusCode < 200 || resp.StatusCode >= 300 {
+		return fmt.Errorf("%s endpoint returned status %d", label, resp.StatusCode)
+	}
+	return nil
+}
+
 // Helper: split string by separator and trim each part
 func splitAndTrim(s, sep string) []string {
 	parts := strings.Split(s, sep)

internal/scraper/superflix_test.go

@@ -1034,8 +1034,9 @@ func TestGetVideoAPI_NoStreamURL(t *testing.T) {
 func TestGetVideoAPI_InvalidJSON(t *testing.T) {
 	t.Parallel()
 
+	// Non-JSON, non-HTML body still surfaces a JSON decode error.
 	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
-		fmt.Fprint(w, `<html>Error</html>`)
+		fmt.Fprint(w, `{not json`)
 	}))
 	defer srv.Close()
 
@@ -1955,3 +1956,143 @@ func TestRegexPatterns(t *testing.T) {
 		assert.Equal(t, "https://subs.example.com/pt.vtt", match[2])
 	})
 }
+
+// =============================================================================
+// Regression tests (added 2026-04-30)
+//
+// Context: SuperFlix moved from `superflixapi.rest` to `superflixapi.online`
+// using a server-side 301 redirect. Go's http.Client follows the redirect but
+// downgrades the POST to a GET (dropping the body), so /player/bootstrap
+// returned an HTML 404 page. The JSON decoder then surfaced the cryptic
+// `invalid character '<' looking for beginning of value`, breaking playback.
+// These tests pin (a) the canonical base URL and (b) that an HTML/non-2xx
+// response from the player API produces a clear, actionable error rather
+// than the cryptic JSON decode error.
+// =============================================================================
+
+func TestSuperFlixBase_PointsToOnlineHost_2026_04_30(t *testing.T) {
+	t.Parallel()
+	// Pinning the canonical host. If this needs to change in the future,
+	// also update internal/api/providers/metadata/metadata.go.
+	assert.Equal(t, "https://superflixapi.online", SuperFlixBase)
+}
+
+func TestBootstrap_HTMLResponseSurfacesActionableError_2026_04_30(t *testing.T) {
+	t.Parallel()
+
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+		w.Header().Set("Content-Type", "text/html; charset=utf-8")
+		w.WriteHeader(http.StatusNotFound)
+		fmt.Fprint(w, `<!DOCTYPE html><html><head><title>Not Found</title></head><body>404</body></html>`)
+	}))
+	defer srv.Close()
+
+	client := newTestSuperFlixClient(srv.URL)
+	tokens := &SuperFlixTokens{CSRF: "a", PageToken: "b", ContentID: "1", ContentType: "filme"}
+	_, err := client.Bootstrap(context.Background(), tokens)
+
+	require.Error(t, err)
+	// Must NOT leak the cryptic JSON decode error.
+	assert.NotContains(t, err.Error(), "invalid character '<'")
+	// Must surface the real cause: HTML body with status code in context.
+	assert.Contains(t, err.Error(), "bootstrap")
+	assert.Contains(t, err.Error(), "HTML")
+	assert.Contains(t, err.Error(), "404")
+}
+
+func TestGetSourceURL_HTMLResponseSurfacesActionableError_2026_04_30(t *testing.T) {
+	t.Parallel()
+
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+		w.Header().Set("Content-Type", "text/html; charset=utf-8")
+		w.WriteHeader(http.StatusForbidden)
+		fmt.Fprint(w, `<html><body>blocked</body></html>`)
+	}))
+	defer srv.Close()
+
+	client := newTestSuperFlixClient(srv.URL)
+	tokens := &SuperFlixTokens{CSRF: "a", PageToken: "b"}
+	_, err := client.GetSourceURL(context.Background(), "vid", tokens)
+
+	require.Error(t, err)
+	assert.NotContains(t, err.Error(), "invalid character '<'")
+	assert.Contains(t, err.Error(), "source")
+	assert.Contains(t, err.Error(), "HTML")
+	assert.Contains(t, err.Error(), "403")
+}
+
+func TestGetVideoAPI_HTMLResponseSurfacesActionableError_2026_04_30(t *testing.T) {
+	t.Parallel()
+
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+		w.Header().Set("Content-Type", "text/html; charset=utf-8")
+		fmt.Fprint(w, `<html><body>captcha</body></html>`)
+	}))
+	defer srv.Close()
+
+	client := newTestSuperFlixClient(srv.URL)
+	_, _, err := client.GetVideoAPI(context.Background(), srv.URL, "hash", srv.URL+"/")
+
+	require.Error(t, err)
+	assert.NotContains(t, err.Error(), "invalid character '<'")
+	assert.Contains(t, err.Error(), "video API")
+	assert.Contains(t, err.Error(), "HTML")
+}
+
+// Some upstream players (firevideoplayer.com behind llanfairpwllgwyngy.com)
+// serve real JSON with `Content-Type: text/html; charset=utf-8`. Trusting the
+// header alone would reject these valid responses. The body sniff is the
+// source of truth.
+func TestGetVideoAPI_AcceptsJSONBodyWithHTMLContentType_2026_04_30(t *testing.T) {
+	t.Parallel()
+
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+		w.Header().Set("Content-Type", "text/html; charset=utf-8")
+		fmt.Fprint(w, `{"hls":true,"securedLink":"https://example.com/master.m3u8","videoSource":"https://example.com/master.txt","videoImage":"https://example.com/thumb.jpg"}`)
+	}))
+	defer srv.Close()
+
+	client := newTestSuperFlixClient(srv.URL)
+	streamURL, thumb, err := client.GetVideoAPI(context.Background(), srv.URL, "hash", srv.URL+"/")
+
+	require.NoError(t, err)
+	assert.Equal(t, "https://example.com/master.m3u8", streamURL)
+	assert.Equal(t, "https://example.com/thumb.jpg", thumb)
+}
+
+func TestBootstrap_AcceptsJSONBodyWithHTMLContentType_2026_04_30(t *testing.T) {
+	t.Parallel()
+
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+		w.Header().Set("Content-Type", "text/html; charset=utf-8")
+		fmt.Fprint(w, `{"data":{"options":[{"ID":"sv1","name":"Server 1"}]}}`)
+	}))
+	defer srv.Close()
+
+	client := newTestSuperFlixClient(srv.URL)
+	tokens := &SuperFlixTokens{CSRF: "a", PageToken: "b", ContentID: "1", ContentType: "filme"}
+	servers, err := client.Bootstrap(context.Background(), tokens)
+
+	require.NoError(t, err)
+	require.Len(t, servers, 1)
+	assert.Equal(t, "Server 1", servers[0].Name)
+}
+
+func TestEnsureJSONResponse_BlankBodyWithBadStatus_2026_04_30(t *testing.T) {
+	t.Parallel()
+
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+		w.Header().Set("Content-Type", "application/json")
+		w.WriteHeader(http.StatusInternalServerError)
+		// Empty body — JSON decode would also fail with EOF; ensure the
+		// status-code path produces a useful error first.
+	}))
+	defer srv.Close()
+
+	client := newTestSuperFlixClient(srv.URL)
+	tokens := &SuperFlixTokens{CSRF: "a", PageToken: "b", ContentID: "1", ContentType: "filme"}
+	_, err := client.Bootstrap(context.Background(), tokens)
+
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "500")
+}