Release v1.4.20 with comprehensive audit fixes (140 issues) and expanded test coverage

- Speed calculation: raised minimum elapsed floor to 0.5s preventing unrealistic spikes
- Reconnect: exponential backoff with consecutive counter, clock regression protection
- Download engine: retry byte tracking (itemContributedBytes), mkdir before createWriteStream, content-length validation
- Fire-and-forget promises: all void promises now have .catch() error handlers
- Session recovery: normalize stale active statuses to queued on crash recovery, clear speedBps
- Storage: config backup (.bak) before overwrite, EXDEV cross-device rename fallback with type guard
- IPC security: input validation on all string/array IPC handlers, CSP headers in production
- Main process: clipboard memory limit (50KB), installer timing increased to 800ms
- Debrid: attribute-order-independent meta tag regex for Rapidgator filename extraction
- Constants: named constants for magic numbers (MAX_MANIFEST_FILE_BYTES, MAX_LINK_ARTIFACT_BYTES, etc.)
- Extractor/integrity: use shared constants, document password visibility and TOCTOU limitations
- Tests: 103 tests total (55 new), covering utils, storage, integrity, cleanup, extractor, debrid, update

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

tests/cleanup.test.ts

@@ -37,4 +37,56 @@ describe("cleanup", () => {
     expect(links).toBeGreaterThan(0);
     expect(samples.files + samples.dirs).toBeGreaterThan(0);
   });
+
+  it("cleans up archive files in nested directories", () => {
+    const dir = fs.mkdtempSync(path.join(os.tmpdir(), "rd-clean-"));
+    tempDirs.push(dir);
+
+    // Create nested directory structure with archive files
+    const sub1 = path.join(dir, "season1");
+    const sub2 = path.join(dir, "season1", "extras");
+    fs.mkdirSync(sub2, { recursive: true });
+
+    fs.writeFileSync(path.join(sub1, "episode.part1.rar"), "x");
+    fs.writeFileSync(path.join(sub1, "episode.part2.rar"), "x");
+    fs.writeFileSync(path.join(sub2, "bonus.zip"), "x");
+    fs.writeFileSync(path.join(sub2, "bonus.7z"), "x");
+    // Non-archive files should be kept
+    fs.writeFileSync(path.join(sub1, "video.mkv"), "real content");
+    fs.writeFileSync(path.join(sub2, "subtitle.srt"), "subtitle content");
+
+    const removed = cleanupCancelledPackageArtifacts(dir);
+    expect(removed).toBe(4); // 2 rar parts + zip + 7z
+    expect(fs.existsSync(path.join(sub1, "episode.part1.rar"))).toBe(false);
+    expect(fs.existsSync(path.join(sub1, "episode.part2.rar"))).toBe(false);
+    expect(fs.existsSync(path.join(sub2, "bonus.zip"))).toBe(false);
+    expect(fs.existsSync(path.join(sub2, "bonus.7z"))).toBe(false);
+    // Non-archives kept
+    expect(fs.existsSync(path.join(sub1, "video.mkv"))).toBe(true);
+    expect(fs.existsSync(path.join(sub2, "subtitle.srt"))).toBe(true);
+  });
+
+  it("detects link artifacts by URL content in text files", () => {
+    const dir = fs.mkdtempSync(path.join(os.tmpdir(), "rd-clean-"));
+    tempDirs.push(dir);
+
+    // File with link-like name containing URLs should be removed
+    fs.writeFileSync(path.join(dir, "download_links.txt"), "https://rapidgator.net/file/abc123\nhttps://uploaded.net/file/def456\n");
+    // File with link-like name but no URLs should be kept
+    fs.writeFileSync(path.join(dir, "my_downloads.txt"), "Just some random text without URLs");
+    // Regular text file that doesn't match the link pattern should be kept
+    fs.writeFileSync(path.join(dir, "readme.txt"), "https://example.com");
+    // .url files should always be removed
+    fs.writeFileSync(path.join(dir, "bookmark.url"), "[InternetShortcut]\nURL=https://example.com");
+    // .dlc files should always be removed
+    fs.writeFileSync(path.join(dir, "container.dlc"), "encrypted-data");
+
+    const removed = removeDownloadLinkArtifacts(dir);
+    expect(removed).toBeGreaterThanOrEqual(3); // download_links.txt + bookmark.url + container.dlc
+    expect(fs.existsSync(path.join(dir, "download_links.txt"))).toBe(false);
+    expect(fs.existsSync(path.join(dir, "bookmark.url"))).toBe(false);
+    expect(fs.existsSync(path.join(dir, "container.dlc"))).toBe(false);
+    // Non-matching files should be kept
+    expect(fs.existsSync(path.join(dir, "readme.txt"))).toBe(true);
+  });
 });