fix: pick up the client's review fixes

tg v0.0.1-alpha.6 closes two ways the bot token could escape -- an error
body echoed by a proxy in front of the Bot API server, and the path
inside a local-file error, which on a --local server is a directory named
after the token -- and stops a symlink in the media directory from
reading out of another bot's files.

It also stops misreporting failures: ok=false on a 2xx is an API error
again, the startup preflight waits through a booting server rather than
exiting on its first 502, and TELEGRAM_READY_WAIT bounds the whole check
instead of only the pauses in it.

The rich senders take options now, so the Telegram interface here names
them.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014xA348oKfgDBSH1mbUkej3

Author: amtiYo

CHANGELOG.md

@@ -8,6 +8,23 @@ GitHub Releases.
 
 ## Unreleased
 
+### Security
+
+- Through `tg` v0.0.1-alpha.6: the bot token can no longer reach a log line
+  through an error body echoed by something in front of the Bot API server, nor
+  through the file path wrapped inside a local-file error. A symlink in the
+  server's media directory can no longer read a file out of another bot's
+  directory.
+
+### Fixed
+
+- Through the client: an `ok=false` answer carried on a 2xx is an API error
+  again, so rate limits and edit-not-modified are classified rather than
+  slipping through as untyped failures; a startup preflight waits through a
+  Bot API server that is still booting instead of exiting on its first 502;
+  and `TELEGRAM_READY_WAIT` now bounds the whole startup check rather than only
+  the pauses inside it.
+
 ## v0.0.1-beta.2 - 2026-09-08
 
 Voicy's Telegram client is no longer its own, and it will not start against a

go.mod

@@ -5,7 +5,7 @@ module github.com/FreshLabDev/voicy
 go 1.26.6
 
 require (
-	github.com/FreshLabDev/tg v0.0.1-alpha.1
+	github.com/FreshLabDev/tg v0.0.1-alpha.6
 	github.com/jackc/pgx/v5 v5.9.2
 )
 

go.sum

@@ -1,5 +1,5 @@
-github.com/FreshLabDev/tg v0.0.1-alpha.1 h1:eR1lHxbTYXF0oEe0arFERM2rT0anFuH60duzUFmTcLU=
-github.com/FreshLabDev/tg v0.0.1-alpha.1/go.mod h1:wsFn10qoSGmL5G1kkEQCxKG3N2BEqnry0yU1CrNwvrI=
+github.com/FreshLabDev/tg v0.0.1-alpha.6 h1:PBjXFUL1CbQgqDp55Sv8Q/TLx596B1yGhKCoDOP1n5c=
+github.com/FreshLabDev/tg v0.0.1-alpha.6/go.mod h1:wsFn10qoSGmL5G1kkEQCxKG3N2BEqnry0yU1CrNwvrI=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=

internal/bot/bot.go

@@ -68,11 +68,11 @@ type Telegram interface {
 	SetMyCommandsForScope(context.Context, []tg.BotCommand, *tg.BotCommandScope) error
 	SendMessage(context.Context, int64, string, *tg.InlineKeyboardMarkup) (tg.Message, error)
 	SendEphemeralMessage(context.Context, int64, int64, int64, string, *tg.InlineKeyboardMarkup) (tg.Message, error)
-	SendRichHTML(context.Context, int64, int64, int, string, *tg.InlineKeyboardMarkup) (tg.Message, error)
+	SendRichHTML(context.Context, int64, int64, int, string, *tg.InlineKeyboardMarkup, ...tg.RichOption) (tg.Message, error)
 	EditEphemeralMessageText(ctx context.Context, chatID, receiverUserID, ephemeralMessageID int64, text string, markup *tg.InlineKeyboardMarkup) error
-	EditEphemeralRichHTML(ctx context.Context, chatID, receiverUserID, ephemeralMessageID int64, body string, markup *tg.InlineKeyboardMarkup) error
+	EditEphemeralRichHTML(ctx context.Context, chatID, receiverUserID, ephemeralMessageID int64, body string, markup *tg.InlineKeyboardMarkup, opts ...tg.RichOption) error
 	EditMessageText(context.Context, int64, int64, string, *tg.InlineKeyboardMarkup) error
-	EditMessageRichHTML(ctx context.Context, chatID, messageID int64, body string, markup *tg.InlineKeyboardMarkup) error
+	EditMessageRichHTML(ctx context.Context, chatID, messageID int64, body string, markup *tg.InlineKeyboardMarkup, opts ...tg.RichOption) error
 	DeleteMessage(context.Context, int64, int64) error
 	DeleteEphemeralMessage(ctx context.Context, chatID, receiverUserID, ephemeralMessageID int64) error
 	AnswerCallbackQuery(context.Context, string, string) error

internal/bot/bot_test.go

@@ -215,7 +215,7 @@ func (f *fakeTG) SendEphemeralMessage(_ context.Context, _, _, _ int64, text str
 	f.ephemeral = append(f.ephemeral, text)
 	return tg.Message{MessageID: 501, EphemeralMessageID: 501}, nil
 }
-func (f *fakeTG) SendRichHTML(_ context.Context, chatID, _ int64, _ int, text string, _ *tg.InlineKeyboardMarkup) (tg.Message, error) {
+func (f *fakeTG) SendRichHTML(_ context.Context, chatID, _ int64, _ int, text string, _ *tg.InlineKeyboardMarkup, _ ...tg.RichOption) (tg.Message, error) {
 	f.mu.Lock()
 	hook := f.onRich
 	f.calls = append(f.calls, "sendRich")
@@ -251,14 +251,14 @@ func (f *fakeTG) transcriptParts() []string {
 	return out
 }
 
-func (f *fakeTG) EditMessageRichHTML(_ context.Context, _, _ int64, text string, _ *tg.InlineKeyboardMarkup) error {
+func (f *fakeTG) EditMessageRichHTML(_ context.Context, _, _ int64, text string, _ *tg.InlineKeyboardMarkup, _ ...tg.RichOption) error {
 	f.mu.Lock()
 	defer f.mu.Unlock()
 	f.calls = append(f.calls, "editRich")
 	f.richEdits = append(f.richEdits, text)
 	return nil
 }
-func (f *fakeTG) EditEphemeralRichHTML(_ context.Context, _, _, _ int64, text string, _ *tg.InlineKeyboardMarkup) error {
+func (f *fakeTG) EditEphemeralRichHTML(_ context.Context, _, _, _ int64, text string, _ *tg.InlineKeyboardMarkup, _ ...tg.RichOption) error {
 	f.mu.Lock()
 	defer f.mu.Unlock()
 	f.calls = append(f.calls, "editEphemeralRich")