v5.3.1: Modular architecture, 14 upstream PRs, security fixes, bug fixes

[TheCellMaster]

Summary

Complete refactor of the Undiscord codebase with modular architecture, implementation of 14 open community PRs, security fixes, numerical bug fixes, and quality-of-life improvements.

Version: 5.3.1 (7 commits: v5.3.0 initial + 6 follow-up fixes)

Architecture Overhaul

• Split monolithic undiscord-core.js (584 lines) into 5 focused modules under src/core/ (orchestrator, search, filter, delete, unarchive)
• Split monolithic undiscord-ui.js (378 lines) into 4 modules under src/ui/ (init, handlers, progress, logger)
• Created src/api/discord-api.js as a pure fetch layer with AbortSignal.timeout(30s) on all requests
• Split helpers.js (8 unrelated functions) into semantic modules: time.js, html.js, discord.js
• Merged createElm.js + insertCss.js into dom.js
• Split CSS (527 lines across 2 files) into 6 modular files: layout, components, scrollbar, redact, log, drag
• Moved HTML templates to src/ui/html/
• Created src/utils/constants.js with shared constants (API_VERSION, DELETE_RESULT, DELETABLE_MSG_TYPES)
• All selectors in drag.css scoped with #undiscord to prevent DOM conflicts
• Added CLAUDE.md project documentation

Community PRs Implemented

• feat: delete polls & fix: undeletable bot cmd responses #741: Delete polls (type 46) + exclude undeletable bot command responses (type 20)
• fix: insufficient perms retry-looping indefinitely #742: HTTP 403 on delete returns FAIL_SKIP instead of infinite retry loop
• fix: unreliable retry logic #743: Retry logic refactored -- FAILED/FAIL_SKIP properly handled, failCount centralized
• fix: missing permissions during search cancels entire batch job #740: HTTP 403 on search gracefully skips channel instead of canceling entire batch
• fix: no delay between batch jobs #739: 30s delay between batch jobs to prevent API spam
• support thread unarchiving (* ^ ω ^) #737: Thread unarchiving -- attempts PATCH to unarchive before skipping archived threads
• Added emptyPageRetries #729: Empty page retries (configurable, default 2) before stopping
• Application Commands fix. #629: "Include bot/application messages" checkbox in Filter section
• be able to autofill thread channel id and only delete messages in that thread #610: Thread auto-detection via API when clicking "current" channel button
• Fix for Wipe Archive Feature API ERROR 50024 - 50021 #603: Graceful handling of API errors 50024 (channel not found) and 50001 (missing access)
• Specify that not entering a time will make date filter NOT work #643: Date filter warning: "Make sure you enter both date AND time"
• Stop attempting to delete CHAT_INPUT_COMMAND (Type 20) messages + Adjust delete delay after ratelimit to compensate ontop of current delay #527: Rate limit delete delay adds on top (never decreases)
• Do not adjust delay if retry_after < delay #519: Delete delay only increases, never decreases on rate limit
• Fixes for Wipe Archive (index.json) method #722: Batch job resilience with try/catch per job

Security Fixes

• XSS fix in log rendering: printLog now escapes all external data via escapeHTML(), preserving <x> redact tags for streamer mode via split pattern
• escapeHTML() now escapes > character (was missing)
• Log type validated against whitelist before becoming CSS class name
• AbortSignal.timeout(30s) on ALL 4 fetch endpoints (search, delete, unarchive, getChannel) -- native browser API, no timer leaks
• retry_after clamped with Math.max(w, 0) to prevent negative values causing tight request loops

Bug Fixes (v5.3.1)

• ETR calculation: Now uses remaining messages (grandTotal - delCount - failCount) instead of total, so the estimate actually decreases as messages are deleted
• ETR page count: Math.ceil instead of Math.round (round under-counted pages when remaining < half a page)
• avgPing/lastPing: Initialized to 0 instead of null (prevented accidental NaN in ETR arithmetic)
• Batch continuation: runBatch now continues to next job after failure using _userStopped flag (previously silently stopped all remaining jobs with misleading "skipping to next" log)
• Display counter: [N/Total] now shows delCount+failCount+1 to reflect actual processing position, not just successful deletes
• throttledTotalTime: Now tracks actual cooldown time (w*2) instead of just retry_after value
• HTTP 202: No longer counted as rate limit throttle (was inflating "Rate Limited: N times" statistic)
• Progress bar: Sets max before value to avoid brief 100% glitch on first update (HTML progress default max is 1.0)
• onStop guard: _userStopped flag prevents double onStop callback when user clicks Stop during execution
• Unnecessary 30s wait after completion: After setting running=false, the code no longer falls through to await wait(searchDelay) -- exits immediately via guard
• Stop button not resetting: stop() now guards on _userStopped instead of running, so it works even after the run loop has already set running=false
• _userStopped initialized as class field: Was undefined for single runs, causing stop() to be a no-op
• Missing return: Added return DELETE_RESULT.FAILED in JSON.parse catch path
• filterResponse: Converted from async to sync (no await inside), added guard for null _searchResponse
• replaceInterpolations: || changed to ?? to preserve falsy values (0, false, "")

Quality Improvements

• DELETE_RESULT enum (Object.freeze) replaces magic strings across 7 return paths
• DELETABLE_MSG_TYPES Set replaces compound conditional for message type filtering
• Set-based lookup for skipped messages (O(n) vs O(n^2))
• search() converted from recursive to iterative with MAX_SEARCH_RETRIES=20 (prevents stack overflow)
• searchDelay capped at MAX_SEARCH_DELAY_MS (60s)
• deleteDelay capped at MAX_DELETE_DELAY_MS (30s)
• Log ring buffer: MAX_LOG_ENTRIES=5000 prevents unbounded DOM growth
• Confirm preview limited to 10 messages (was unbounded window.confirm)
• messagePicker timeout (30s) with automatic cleanup of event listeners
• All CSS variables use fallback pattern var(--new, var(--old))
• JSDoc on all public methods
• contributors field added to package.json
• Help documentation updated for all new features (7 help files)

Stats

• 40+ files changed, +3000, -1900
• 28 focused source files replacing 12 monolithic ones
• 0 lint errors, build passes cleanly
• All numerical calculations verified by simulation (3 scenarios + edge cases each)

Test plan

• Install userscript in Tampermonkey -- tested, works
• Trash icon appears in Discord toolbar -- confirmed
• Single channel deletion -- tested with 886 messages
• Rate limit handling (delays increase, capped at 30s/60s) -- confirmed in production
• Empty page retries -- triggered and recovered correctly
• ETR decreases as messages are deleted -- confirmed after fix
• Test batch deletion (multiple channels via comma-separated IDs)
• Test archive wipe (import index.json)
• Verify thread detection (click "current" on a thread)
• Test "Include bot/application messages" toggle
• Verify streamer mode (redact) hides sensitive data
• Test stop button during deletion

Generated with Claude Code