fix(storage): make session, peer cache and config files safe to share between processes

[ApexAiOfficial]

Several tg processes routinely share one session directory: parallel commands, or two agents driving the same account. This makes the files they share safe for that.

Torn reads. gotd's session.FileStorage, the peer cache and the config truncated files in place, so a concurrent reader could load an empty or torn session or cache and fail. New internal/atomicfile: write a temp file in the same directory, fsync, rename over the target, fsync the directory. The cache skips the fsyncs, since it can be rebuilt. The file session store keeps gotd's on-disk format and path.

Lost updates. Atomic replacement alone doesn't stop two processes that both read, merge and replace the peer cache from dropping each other's entries: an overlapping-writers test (8 writers × 25 saves) lost 18–64 of 200. New internal/filelock takes an advisory exclusive lock on a sidecar <file>.lock (flock on Unix, LockFileEx on Windows, no-op where tg is single-process; released by the OS if the holder dies). The cache holds it across the whole read-merge-write cycle, and a corrupt cache is rebuilt instead of failing every command.

Stale session keys. gotd re-saves the session on every reconnect to the primary DC, writing its own auth key into the file. A long-running process (e.g. tg watch) that reconnected after another process ran tg login or tg logout therefore wrote its old key back, undoing the login or resurrecting the logged-out session. The store remembers the key it loaded and, under the lock, skips writing that key over a session someone else re-keyed or removed. Same-key writers stay last-writer-wins, which is safe because their copies differ only in volatile state such as the server salt.

Config creation. writeConfig stat'ed and then wrote, which raced. A crash mid-write also left a partial config that a retried tg init refused to replace. atomicfile.Create writes and syncs a temp file and hard-links it into place: atomic, and it fails if the target exists. It falls back to an exclusive synced create on filesystems without hard links.

Tests cover atomic replace and create, permissions, symlinked targets, lock exclusivity, overlapping cache writers, corrupt-cache recovery, and the session cases: re-login elsewhere, logout elsewhere, same-key writers, and this process re-keying. go test -race and golangci-lint v2.12.1 (Go 1.25) pass.

🤖 Generated with Claude Code