Switch config format from YAML to TOML

Replaces gopkg.in/yaml.v3 with github.com/BurntSushi/toml. Updates struct tags, default config path, Dockerfile CMD, README, and ships config.example.toml in place of the YAML example. ${ENV_VAR} expansion still runs on the raw file before parsing, so the behavior is unchanged.
Fix correctness bugs found by code review
2026-05-24 21:05:41 -07:00 · 2026-05-24 20:50:51 -07:00 · 2026-05-24 20:29:13 -07:00 · 2026-05-24 20:27:17 -07:00 · 2026-05-24 20:22:50 -07:00
18 changed files with 1217 additions and 276 deletions
--- a/21
+++ b/21
@@ -0,0 +1,21 @@
+# syntax=docker/dockerfile:1
+
+FROM golang:1.25-alpine AS build
+RUN apk add --no-cache build-base
+WORKDIR /src
+COPY go.mod go.sum ./
+RUN go mod download
+COPY . .
+# goolm = pure-Go olm; sqlite needs cgo for the device/crypto stores.
+ENV CGO_ENABLED=1
+RUN go build -tags goolm -trimpath -ldflags="-s -w" -o /out/bellhop ./
+
+FROM alpine:3.21
+RUN apk add --no-cache ca-certificates tzdata
+RUN addgroup -S bellhop && adduser -S -G bellhop bellhop
+WORKDIR /app
+COPY --from=build /out/bellhop /usr/local/bin/bellhop
+USER bellhop
+VOLUME ["/app/data"]
+ENTRYPOINT ["/usr/local/bin/bellhop"]
+CMD ["-config", "/app/config.toml"]
--- a/README.md
+++ b/README.md
@@ -1,267 +1,81 @@
 # Bellhop

-A Matrix-authenticated web portal for submitting media requests to Radarr, Sonarr, and Lidarr. Users sign in with their Matrix homeserver credentials, search for movies, TV shows, or music, and submit requests — all through a clean single-page interface. Every request is logged to a Matrix room for auditing.
+A Matrix bot that adds movies, TV, and music to Radarr/Sonarr/Lidarr from chat. Invite the bot to a room, allowlist the room ID, and any member can type `!movie dune` to add the top search hit.

-## Architecture
+## Command UX

 ```
-Browser ──► FastAPI app ──► Matrix homeserver (authentication)
-                        ──► Radarr / Sonarr / Lidarr (search + add)
-                        ──► Matrix room (audit log)
-                        ──► SQLite (session storage)
+!movie <query>   — add the top Radarr hit
+!tv <query>      — add the top Sonarr hit
+!music <query>   — add the top Lidarr hit
+!help            — show the command list
 ```

-All *arr communication happens server-side. API keys and service URLs are never exposed to the browser.
+The bot replies in a thread under the request so a busy room stays readable. No numbered picker, no reaction selector — the top search result is what gets added. If you want something other than the top hit, narrow the query.

-## Requirements
+## Authorization

- Python 3.12+
- A Matrix homeserver (Synapse, Dendrite, Conduit, etc.)
- At least one of: Radarr, Sonarr, or Lidarr accessible over HTTPS
- (Optional) A Matrix bot account for audit logging
+Any member of an allowlisted room may issue commands. The bot auto-joins on invite, but the room ID must appear under `matrix.allowed_rooms` in the config before commands are honored.

-## Quick Start
+## Configuration

-### 1. Clone and configure
+Copy `config.example.toml` to `config.toml` and edit. The loader expands `${ENV_VAR}` references at load time, so secrets can come from the environment.

-```bash
-git clone https://github.com/prosolis/Bellhop.git
-cd Bellhop
-cp .env.example .env
-```
+Required:

-Edit `.env` with your actual values (see [Environment Variables](#environment-variables) below).
+- `matrix.homeserver`, `matrix.user_id`, `matrix.password`
+- `matrix.allowed_rooms` (at least one room ID)
+- At least one of `services.radarr` / `services.sonarr` / `services.lidarr`

-### 2. Run locally
+Per-service: `url`, `api_key`, `quality_profile_id`, `root_folder`. Lidarr also needs `metadata_profile_id`.

-```bash
-pip install -r requirements.txt
-uvicorn app.main:app --host 0.0.0.0 --port 8000
-```
+Omit a service block to disable its command — `!movie` with no `radarr` block replies "Radarr is not configured".

-Open `http://localhost:8000` in your browser.
-
-### 3. Run with Docker
-
-```bash
-docker build -t bellhop .
-docker run -d \
-  --name bellhop \
-  --env-file .env \
-  -p 8000:8000 \
-  -v bellhop-data:/app \
-  bellhop
-```
-
-The SQLite database file is created at the path specified by `DATABASE_PATH` (default: `bellhop.db` in the working directory). Mount a volume if you want persistence across container recreations.
-
-## Environment Variables
-
-Create a `.env` file in the project root (or pass variables via Docker `--env-file`). See `.env.example` for a template.
-
-### Required
-
-| Variable | Description |
-|---|---|
-| `MATRIX_HOMESERVER_URL` | Base URL of your Matrix homeserver (e.g. `https://matrix.example.com`) |
-
-### *arr Services
-
-Configure one or more. If a service's URL or API key is left empty, that media type will return a "not configured" error when used.
-
-| Variable | Default | Description |
-|---|---|---|
-| `RADARR_URL` | _(empty)_ | Radarr instance URL (e.g. `https://radarr.example.com`) |
-| `RADARR_API_KEY` | _(empty)_ | Radarr API key (Settings > General in Radarr) |
-| `RADARR_QUALITY_PROFILE_ID` | `1` | Quality profile ID to assign to new movies |
-| `RADARR_ROOT_FOLDER` | `/movies` | Root folder path for movie storage |
-| `SONARR_URL` | _(empty)_ | Sonarr instance URL |
-| `SONARR_API_KEY` | _(empty)_ | Sonarr API key |
-| `SONARR_QUALITY_PROFILE_ID` | `1` | Quality profile ID for new series |
-| `SONARR_ROOT_FOLDER` | `/tv` | Root folder path for TV storage |
-| `LIDARR_URL` | _(empty)_ | Lidarr instance URL |
-| `LIDARR_API_KEY` | _(empty)_ | Lidarr API key |
-| `LIDARR_QUALITY_PROFILE_ID` | `1` | Quality profile ID for new artists |
-| `LIDARR_ROOT_FOLDER` | `/music` | Root folder path for music storage |
-
-**Finding quality profile IDs:** Open your *arr instance, go to Settings > Profiles. The ID is visible in the URL when you click a profile, or query the API directly:
+**Finding quality profile IDs:**

 ```bash
 curl -H "X-Api-Key: YOUR_KEY" https://radarr.example.com/api/v3/qualityprofile
 ```

-### Audit Bot (optional)
+## Running

-| Variable | Default | Description |
-|---|---|---|
-| `MATRIX_AUDIT_ROOM_ID` | _(empty)_ | Room ID for audit messages (e.g. `!abc123:example.com`) |
-| `MATRIX_BOT_USER_ID` | _(empty)_ | Bot's Matrix user ID (e.g. `@bellhop-bot:example.com`) |
-| `MATRIX_BOT_ACCESS_TOKEN` | _(empty)_ | Pre-authenticated access token for the bot |
-
-If any of these are left empty, audit logging is silently disabled. The room must be **unencrypted** and the bot must already be joined to it.
-
-**Getting a bot access token:**
+### Local

 ```bash
-curl -X POST https://matrix.example.com/_matrix/client/v3/login \
-  -H "Content-Type: application/json" \
-  -d '{"type":"m.login.password","identifier":{"type":"m.id.user","user":"@bellhop-bot:example.com"},"password":"bot-password"}'
+go build -tags goolm -o bellhop ./
+./bellhop -config config.toml
 ```

-Copy the `access_token` from the response.
+The `goolm` tag uses the pure-Go olm implementation so libolm isn't needed.

-### Other
+### Docker

-| Variable | Default | Description |
-|---|---|---|
-| `SESSION_SECRET_KEY` | _(auto-generated)_ | Secret for signing session cookies. Auto-generated at startup if not set. A new key is generated on every restart, which invalidates all existing sessions. |
-| `DATABASE_PATH` | `bellhop.db` | Path to the SQLite database file |
-
-## API Reference
-
-### Authentication
-
-| Method | Path | Description |
-|---|---|---|
-| `POST` | `/auth/login` | Authenticate with Matrix credentials. Rate-limited to 5 requests/minute per IP. |
-| `POST` | `/auth/logout` | Destroy the current session. |
-| `GET` | `/auth/me` | Return the current user's Matrix ID, or 401 if not authenticated. |
-
-**Login request body:**
-
-```json
-{
-  "username": "@user:example.com",
-  "password": "your-password"
-}
+```bash
+docker build -t bellhop .
+docker run -d \
+  --name bellhop \
+  -v "$PWD/config.toml:/app/config.toml:ro" \
+  -v bellhop-data:/app/data \
+  bellhop
 ```

-The username can be a full Matrix ID (`@user:example.com`) or a localpart (`user`) — the homeserver resolves it.
+The `data` volume holds the Matrix device file and the E2EE crypto store. Losing it forces a re-login and re-verification on next start.

-**Login response (200):**
+## E2EE notes

-```json
-{
-  "user_id": "@user:example.com"
-}
-```
+The bot bootstraps cross-signing on first run and persists Olm/Megolm sessions in `data/crypto.db`. If you rotate the bot's password or wipe `data/`, the bot logs in as a new device — existing rooms will need to re-share keys, which mautrix handles automatically on the next message.

-A `bellhop_session` cookie is set automatically.
-
-### Search
-
-| Method | Path | Description |
-|---|---|---|
-| `GET` | `/search/movie?term=...` | Search Radarr for movies |
-| `GET` | `/search/tv?term=...` | Search Sonarr for TV shows |
-| `GET` | `/search/music?term=...` | Search Lidarr for artists |
-
-All search endpoints require an active session (cookie). Results are capped at 25 items. Response fields are sanitized — only safe metadata (title, year, poster URL, IDs) is returned.
-
-### Request
-
-| Method | Path | Description |
-|---|---|---|
-| `POST` | `/request/movie` | Add a movie to Radarr |
-| `POST` | `/request/tv` | Add a series to Sonarr |
-| `POST` | `/request/music` | Add an artist to Lidarr |
-
-**Movie request body:**
-
-```json
-{
-  "title": "Movie Title",
-  "tmdbId": 12345,
-  "year": 2024
-}
-```
-
-**TV request body:**
-
-```json
-{
-  "title": "Show Title",
-  "tvdbId": 67890,
-  "year": 2024
-}
-```
-
-**Music request body:**
-
-```json
-{
-  "artistName": "Artist Name",
-  "foreignArtistId": "mbid-uuid-here"
-}
-```
-
-All items are added as monitored with "search on add" enabled. Quality profile and root folder are set from the corresponding environment variables.
-
-**Success response (200):**
-
-```json
-{
-  "ok": true,
-  "message": "Movie added successfully"
-}
-```
-
-### Frontend
-
-| Method | Path | Description |
-|---|---|---|
-| `GET` | `/` | Serves the single-page Alpine.js frontend |
-
-## Project Structure
+## Project layout

 ```
-Bellhop/
-├── app/
-│   ├── __init__.py
-│   ├── main.py          # FastAPI app, lifespan, rate limiter, route mounting
-│   ├── config.py         # Environment variable loading
-│   ├── database.py       # Async SQLite session CRUD
-│   ├── auth.py           # /auth/* routes, session cookie management
-│   ├── arr.py            # /search/* and /request/* routes, *arr API proxying
-│   ├── audit.py          # Fire-and-forget Matrix room messaging
-│   ├── static/           # Static assets (served at /static)
-│   └── templates/
-│       └── index.html    # Alpine.js single-page frontend
-├── Dockerfile
-├── requirements.txt
-├── .env.example
-└── README.md
+main.go
+internal/
+  config/   — TOML loader with ${ENV_VAR} expansion
+  matrix/   — mautrix client: login, device persistence, E2EE, sync loop
+  arr/      — Radarr/Sonarr/Lidarr HTTP clients
+  bot/      — command parser + dispatch + threaded replies
 ```

-## Security
-
- **Session cookies** are set with `httponly`, `samesite=strict`, and `secure` flags. The `secure` flag means cookies are only sent over HTTPS — use a reverse proxy with TLS in production.
- **Login rate limiting** — 5 attempts per minute per IP address via slowapi.
- **Token validation** — every protected route verifies the Matrix access token against the homeserver's `/_matrix/client/v3/account/whoami` endpoint. If the token has been revoked, the session is deleted immediately. If the homeserver is unreachable, the local session is trusted as a fallback.
- **No credential leakage** — *arr API keys, URLs, and internal IDs are never included in any response to the browser. Search results are mapped to a safe subset of fields before returning.
- **Sessions expire** after 7 days (cookie `max_age`).
-
-### Production Recommendations
-
- Run behind a reverse proxy (nginx, Caddy, Traefik) with TLS termination so the `secure` cookie flag works.
- If you want sessions to persist across restarts, set `SESSION_SECRET_KEY` explicitly. Otherwise, all users are logged out on restart.
- Restrict network access to your *arr instances — only the Bellhop container needs to reach them.
- Use a dedicated Matrix bot account for audit logging rather than a personal account.
-
-## How It Works
-
-1. **User signs in** — the frontend POSTs Matrix credentials to `/auth/login`. The backend authenticates against the Matrix homeserver's Client-Server API (`m.login.password`), stores the resulting access token in SQLite, and returns a session cookie.
-
-2. **User searches** — the frontend sends a search query to `/search/{type}`. The backend proxies the request to the appropriate *arr instance, strips internal fields, and returns sanitized results with poster URLs.
-
-3. **User requests** — clicking "Request" on a result POSTs it to `/request/{type}`. The backend sends the add command to the *arr API with preconfigured quality profile and root folder. On success, an audit message is fired asynchronously to the configured Matrix room.
-
-4. **Audit trail** — every successful request posts a message like `[REQUEST] @user:example.com → [Movie] "Title" (2024)` to the Matrix audit room. This is fire-and-forget — failures are logged but never block the user's request.
-
-## Lidarr Notes
-
-Lidarr uses MusicBrainz IDs (`foreignArtistId`) rather than TMDB/TVDB IDs. The lookup response includes this field and it is passed through directly to the add call. No independent MBID resolution is needed.
-
 ## License

 See repository for license details.
--- a/SESSION_PLAN.md
+++ b/SESSION_PLAN.md
@@ -26,7 +26,7 @@ Rewriting Bellhop from a Python FastAPI web portal into a Go-based Matrix comman
  - Threaded reply helper for command responses
  - Drop Pete-specific bits: image upload, reaction handler, story formatting

- [ ] **Session 3 — *arr clients** (`internal/arr/`)
+- [x] **Session 3 — *arr clients** (`internal/arr/`)
  - One file per service or a single generic client (TBD in session)
  - `Search(term) → []Result` and `Add(result) → error`
  - Radarr: `/api/v3/movie/lookup` + POST `/api/v3/movie`
@@ -35,14 +35,14 @@ Rewriting Bellhop from a Python FastAPI web portal into a Go-based Matrix comman
  - All adds: monitored=true, search-on-add=true, quality profile + root folder from config
  - Unit tests with httptest

- [ ] **Session 4 — Command dispatch + main** (`internal/bot/`, `main.go`)
+- [x] **Session 4 — Command dispatch + main** (`internal/bot/`, `main.go`)
  - Parse `<prefix><cmd> <query>` (default prefix `!`)
  - Commands: `movie`, `tv`, `music`, `help`
  - On match: search → take `[0]` → add → reply with title/year (or error)
  - "Service not configured" reply if the corresponding *arr block is absent
  - `main.go`: load config, init matrix, wire handler, SIGINT/SIGTERM shutdown

- [ ] **Session 5 — Ship polish**
+- [x] **Session 5 — Ship polish**
  - Multi-stage Dockerfile (`golang:1.25-alpine` → `alpine:3.21`, build with `-tags goolm`)
  - `config.example.yaml`
  - Rewrite `README.md`: command UX, install, config reference, Docker
--- a/config.example.toml
+++ b/config.example.toml
@@ -0,0 +1,43 @@
+# Bellhop config. Values like ${ENV_VAR} are expanded from the environment
+# at load time so secrets can stay out of this file.
+
+[matrix]
+homeserver = "https://matrix.example.com"
+user_id = "@bellhop:example.com"
+password = "${BELLHOP_MATRIX_PASSWORD}"
+
+# Optional. Defaults shown.
+display_name = "Bellhop"
+data_dir = "./data"                  # device.json + crypto.db live here
+pickle_key = "${BELLHOP_PICKLE_KEY}" # encrypts the crypto store; pick something stable
+command_prefix = "!"
+
+# Rooms the bot will respond to commands in. Messages anywhere else are
+# ignored. The bot auto-joins on invite, but joining alone does not grant
+# command access — the room ID must appear here.
+allowed_rooms = [
+  "!room-id-one:example.com",
+  "!room-id-two:example.com",
+]
+
+# Configure any subset. Omit a section to disable that command:
+# leaving out [services.radarr] makes `!movie` reply "Radarr is not configured".
+
+[services.radarr]
+url = "https://radarr.example.com"
+api_key = "${RADARR_API_KEY}"
+quality_profile_id = 1
+root_folder = "/movies"
+
+[services.sonarr]
+url = "https://sonarr.example.com"
+api_key = "${SONARR_API_KEY}"
+quality_profile_id = 1
+root_folder = "/tv"
+
+[services.lidarr]
+url = "https://lidarr.example.com"
+api_key = "${LIDARR_API_KEY}"
+quality_profile_id = 1
+metadata_profile_id = 1   # required for Lidarr only
+root_folder = "/music"
--- a/go.mod
+++ b/go.mod
@@ -3,7 +3,7 @@ module bellhop
 go 1.25.0

 require (
-	gopkg.in/yaml.v3 v3.0.1
+	github.com/BurntSushi/toml v1.6.0
 	maunium.net/go/mautrix v0.28.0
 )

--- a/go.sum
+++ b/go.sum
@@ -1,5 +1,7 @@
 filippo.io/edwards25519 v1.2.0 h1:crnVqOiS4jqYleHd9vaKZ+HKtHfllngJIiOpNpoJsjo=
 filippo.io/edwards25519 v1.2.0/go.mod h1:xzAOLCNug/yB62zG1bQ8uziwrIqIuxhctzJT18Q77mc=
+github.com/BurntSushi/toml v1.6.0 h1:dRaEfpa2VI55EwlIW72hMRHdWouJeRF7TPYhI+AUQjk=
+github.com/BurntSushi/toml v1.6.0/go.mod h1:ukJfTF/6rtPPRCnwkur4qwRxa8vTRFBF0uk2lLoLwho=
 github.com/DATA-DOG/go-sqlmock v1.5.2 h1:OcvFkGmslmlZibjAjaHm3L//6LiuBgolP7OputlJIzU=
 github.com/DATA-DOG/go-sqlmock v1.5.2/go.mod h1:88MAG/4G7SMwSE3CeA0ZKzrT5CiOU3OJ+JlNzwDqpNU=
 github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
@@ -41,8 +43,6 @@ golang.org/x/sys v0.44.0 h1:ildZl3J4uzeKP07r2F++Op7E9B29JRUy+a27EibtBTQ=
 golang.org/x/sys v0.44.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
 golang.org/x/text v0.37.0 h1:Cqjiwd9eSg8e0QAkyCaQTNHFIIzWtidPahFWR83rTrc=
 golang.org/x/text v0.37.0/go.mod h1:a5sjxXGs9hsn/AJVwuElvCAo9v8QYLzvavO5z2PiM38=
-gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405 h1:yhCVgyC4o1eVCa2tZl7eS0r+SDo693bJlVdllGtEeKM=
-gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 maunium.net/go/mautrix v0.28.0 h1:vBakLzf8MAdfED3NzAKiMeKQbc3AQ4EAS03NC+TVMXQ=
--- a/internal/arr/arr.go
+++ b/internal/arr/arr.go
@@ -0,0 +1,151 @@
+// Package arr provides clients for Radarr, Sonarr, and Lidarr.
+//
+// Each client exposes Search to look up candidates by free-text query and
+// Add to enqueue the first/chosen candidate for download. Lookup responses
+// are preserved as raw JSON inside Result so Add can replay the entity back
+// to the *arr server with the configured profile and root folder layered on.
+package arr
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"fmt"
+	"io"
+	"net/http"
+	"strings"
+	"time"
+)
+
+// Result is a single candidate returned by an *arr lookup. Title and Year
+// are extracted for display; raw is the untouched JSON object used to build
+// the Add payload. Exists is true when the *arr server already has this item
+// in its library (lookup responses set "id" to a non-zero value in that case),
+// so the bot can skip the Add and report 'already in library' instead of
+// blindly re-POSTing.
+type Result struct {
+	Title  string
+	Year   int
+	Exists bool
+	raw    json.RawMessage
+}
+
+// Raw exposes the underlying lookup JSON; useful for tests and debugging.
+func (r Result) Raw() json.RawMessage { return r.raw }
+
+// Client is the common interface implemented by every *arr backend.
+type Client interface {
+	Search(ctx context.Context, term string) ([]Result, error)
+	Add(ctx context.Context, r Result) error
+}
+
+type httpClient struct {
+	baseURL string
+	apiKey  string
+	hc      *http.Client
+}
+
+func newHTTP(baseURL, apiKey string) *httpClient {
+	return &httpClient{
+		baseURL: strings.TrimRight(baseURL, "/"),
+		apiKey:  apiKey,
+		hc:      &http.Client{Timeout: 30 * time.Second},
+	}
+}
+
+func (c *httpClient) get(ctx context.Context, path string, query map[string]string) ([]byte, error) {
+	req, err := http.NewRequestWithContext(ctx, http.MethodGet, c.baseURL+path, nil)
+	if err != nil {
+		return nil, err
+	}
+	if len(query) > 0 {
+		q := req.URL.Query()
+		for k, v := range query {
+			q.Set(k, v)
+		}
+		req.URL.RawQuery = q.Encode()
+	}
+	return c.do(req)
+}
+
+func (c *httpClient) post(ctx context.Context, path string, body []byte) ([]byte, error) {
+	req, err := http.NewRequestWithContext(ctx, http.MethodPost, c.baseURL+path, bytes.NewReader(body))
+	if err != nil {
+		return nil, err
+	}
+	req.Header.Set("Content-Type", "application/json")
+	return c.do(req)
+}
+
+func (c *httpClient) do(req *http.Request) ([]byte, error) {
+	req.Header.Set("X-Api-Key", c.apiKey)
+	req.Header.Set("Accept", "application/json")
+	resp, err := c.hc.Do(req)
+	if err != nil {
+		return nil, err
+	}
+	defer resp.Body.Close()
+	body, err := io.ReadAll(resp.Body)
+	if err != nil {
+		return nil, fmt.Errorf("read response: %w", err)
+	}
+	if resp.StatusCode >= 400 {
+		return nil, fmt.Errorf("%s %s: %d: %s", req.Method, req.URL.Path, resp.StatusCode, strings.TrimSpace(string(body)))
+	}
+	return body, nil
+}
+
+// parseLookup decodes a lookup response into Results, pulling Title/Year out
+// of each item while keeping the original JSON object intact.
+func parseLookup(body []byte, titleField string) ([]Result, error) {
+	var items []json.RawMessage
+	if err := json.Unmarshal(body, &items); err != nil {
+		return nil, fmt.Errorf("decode lookup: %w", err)
+	}
+	out := make([]Result, 0, len(items))
+	for _, item := range items {
+		var meta map[string]json.RawMessage
+		if err := json.Unmarshal(item, &meta); err != nil {
+			continue
+		}
+		var title string
+		if raw, ok := meta[titleField]; ok && len(raw) > 0 {
+			_ = json.Unmarshal(raw, &title)
+		}
+		if title == "" {
+			// Skip items we can't display. The Add path would still POST the
+			// raw JSON, but the user reply would read "Added to Radarr:" with
+			// no title — worse than dropping the candidate.
+			continue
+		}
+		var year int
+		if raw, ok := meta["year"]; ok && len(raw) > 0 {
+			_ = json.Unmarshal(raw, &year)
+		}
+		var existingID int
+		if raw, ok := meta["id"]; ok && len(raw) > 0 {
+			_ = json.Unmarshal(raw, &existingID)
+		}
+		out = append(out, Result{
+			Title:  title,
+			Year:   year,
+			Exists: existingID > 0,
+			raw:    item,
+		})
+	}
+	return out, nil
+}
+
+// buildAddBody decodes the raw lookup item into a generic map, overlays the
+// provided fields, and re-marshals. Each *arr backend supplies the fields
+// specific to its add endpoint.
+func buildAddBody(raw json.RawMessage, overlay map[string]any) ([]byte, error) {
+	var m map[string]any
+	if err := json.Unmarshal(raw, &m); err != nil {
+		return nil, fmt.Errorf("decode lookup item: %w", err)
+	}
+	for k, v := range overlay {
+		m[k] = v
+	}
+	return json.Marshal(m)
+}
--- a/internal/arr/lidarr.go
+++ b/internal/arr/lidarr.go
@@ -0,0 +1,57 @@
+package arr
+
+import (
+	"context"
+	"fmt"
+
+	"bellhop/internal/config"
+)
+
+// Lidarr drives a Lidarr v1 instance.
+type Lidarr struct {
+	h                 *httpClient
+	qualityProfileID  int
+	metadataProfileID int
+	rootFolder        string
+}
+
+func NewLidarr(cfg *config.ArrConfig) *Lidarr {
+	return &Lidarr{
+		h:                 newHTTP(cfg.URL, cfg.APIKey),
+		qualityProfileID:  cfg.QualityProfileID,
+		metadataProfileID: cfg.MetadataProfileID,
+		rootFolder:        cfg.RootFolder,
+	}
+}
+
+func (l *Lidarr) Search(ctx context.Context, term string) ([]Result, error) {
+	body, err := l.h.get(ctx, "/api/v1/artist/lookup", map[string]string{"term": term})
+	if err != nil {
+		return nil, err
+	}
+	// Lidarr's lookup uses "artistName" instead of "title".
+	return parseLookup(body, "artistName")
+}
+
+func (l *Lidarr) Add(ctx context.Context, res Result) error {
+	if len(res.raw) == 0 {
+		return fmt.Errorf("lidarr: empty result")
+	}
+	body, err := buildAddBody(res.raw, map[string]any{
+		"qualityProfileId":  l.qualityProfileID,
+		"metadataProfileId": l.metadataProfileID,
+		"rootFolderPath":    l.rootFolder,
+		"monitored":         true,
+		"addOptions": map[string]any{
+			"monitor":                "all",
+			"searchForMissingAlbums": true,
+		},
+	})
+	if err != nil {
+		return err
+	}
+	_, err = l.h.post(ctx, "/api/v1/artist", body)
+	return err
+}
+
+var _ Client = (*Lidarr)(nil)
--- a/internal/arr/lidarr_test.go
+++ b/internal/arr/lidarr_test.go
@@ -0,0 +1,69 @@
+package arr
+
+import (
+	"context"
+	"encoding/json"
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"bellhop/internal/config"
+)
+
+func TestLidarrSearch(t *testing.T) {
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.URL.Path != "/api/v1/artist/lookup" {
+			t.Errorf("path = %q", r.URL.Path)
+		}
+		if r.URL.Query().Get("term") != "radiohead" {
+			t.Errorf("term = %q", r.URL.Query().Get("term"))
+		}
+		_, _ = io.WriteString(w, `[{"artistName":"Radiohead","foreignArtistId":"a74b1b7f-71a5-4011-9441-d0b5e4122711"}]`)
+	}))
+	defer srv.Close()
+
+	l := NewLidarr(&config.ArrConfig{URL: srv.URL, APIKey: "k", QualityProfileID: 2, MetadataProfileID: 1, RootFolder: "/music"})
+	results, err := l.Search(context.Background(), "radiohead")
+	if err != nil {
+		t.Fatalf("search: %v", err)
+	}
+	if len(results) != 1 || results[0].Title != "Radiohead" {
+		t.Fatalf("unexpected results: %+v", results)
+	}
+}
+
+func TestLidarrAdd(t *testing.T) {
+	var got map[string]any
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.Method != http.MethodPost || r.URL.Path != "/api/v1/artist" {
+			t.Errorf("unexpected %s %s", r.Method, r.URL.Path)
+		}
+		_ = json.NewDecoder(r.Body).Decode(&got)
+		w.WriteHeader(http.StatusCreated)
+	}))
+	defer srv.Close()
+
+	l := NewLidarr(&config.ArrConfig{URL: srv.URL, APIKey: "k", QualityProfileID: 2, MetadataProfileID: 1, RootFolder: "/music"})
+	res := makeResult("Radiohead", 0, `{"artistName":"Radiohead","foreignArtistId":"a74b1b7f-71a5-4011-9441-d0b5e4122711"}`)
+	if err := l.Add(context.Background(), res); err != nil {
+		t.Fatalf("add: %v", err)
+	}
+
+	if got["qualityProfileId"].(float64) != 2 {
+		t.Errorf("qualityProfileId = %v", got["qualityProfileId"])
+	}
+	if got["metadataProfileId"].(float64) != 1 {
+		t.Errorf("metadataProfileId = %v", got["metadataProfileId"])
+	}
+	if got["rootFolderPath"] != "/music" {
+		t.Errorf("rootFolderPath = %v", got["rootFolderPath"])
+	}
+	if got["foreignArtistId"] != "a74b1b7f-71a5-4011-9441-d0b5e4122711" {
+		t.Errorf("foreignArtistId not preserved: %v", got["foreignArtistId"])
+	}
+	opts := got["addOptions"].(map[string]any)
+	if opts["searchForMissingAlbums"] != true || opts["monitor"] != "all" {
+		t.Errorf("addOptions wrong: %v", opts)
+	}
+}
--- a/internal/arr/radarr.go
+++ b/internal/arr/radarr.go
@@ -0,0 +1,60 @@
+package arr
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+
+	"bellhop/internal/config"
+)
+
+// Radarr drives a Radarr v3 instance.
+type Radarr struct {
+	h                *httpClient
+	qualityProfileID int
+	rootFolder       string
+}
+
+func NewRadarr(cfg *config.ArrConfig) *Radarr {
+	return &Radarr{
+		h:                newHTTP(cfg.URL, cfg.APIKey),
+		qualityProfileID: cfg.QualityProfileID,
+		rootFolder:       cfg.RootFolder,
+	}
+}
+
+func (r *Radarr) Search(ctx context.Context, term string) ([]Result, error) {
+	body, err := r.h.get(ctx, "/api/v3/movie/lookup", map[string]string{"term": term})
+	if err != nil {
+		return nil, err
+	}
+	return parseLookup(body, "title")
+}
+
+func (r *Radarr) Add(ctx context.Context, res Result) error {
+	if len(res.raw) == 0 {
+		return fmt.Errorf("radarr: empty result")
+	}
+	body, err := buildAddBody(res.raw, map[string]any{
+		"qualityProfileId": r.qualityProfileID,
+		"rootFolderPath":   r.rootFolder,
+		"monitored":        true,
+		"addOptions": map[string]any{
+			"searchForMovie": true,
+		},
+	})
+	if err != nil {
+		return err
+	}
+	_, err = r.h.post(ctx, "/api/v3/movie", body)
+	return err
+}
+
+// compile-time interface check
+var _ Client = (*Radarr)(nil)
+
+// makeResult is a tiny helper used by tests in this package to construct a
+// Result from arbitrary JSON without going through the network.
+func makeResult(title string, year int, raw string) Result {
+	return Result{Title: title, Year: year, raw: json.RawMessage(raw)}
+}
--- a/internal/arr/radarr_test.go
+++ b/internal/arr/radarr_test.go
@@ -0,0 +1,96 @@
+package arr
+
+import (
+	"context"
+	"encoding/json"
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"bellhop/internal/config"
+)
+
+func TestRadarrSearch(t *testing.T) {
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if got := r.Header.Get("X-Api-Key"); got != "secret" {
+			t.Errorf("api key header = %q, want secret", got)
+		}
+		if r.URL.Path != "/api/v3/movie/lookup" {
+			t.Errorf("path = %q", r.URL.Path)
+		}
+		if r.URL.Query().Get("term") != "dune" {
+			t.Errorf("term = %q", r.URL.Query().Get("term"))
+		}
+		w.Header().Set("Content-Type", "application/json")
+		_, _ = io.WriteString(w, `[
+			{"title":"Dune","year":2021,"tmdbId":438631,"titleSlug":"dune-2021"},
+			{"title":"Dune: Part Two","year":2024,"tmdbId":693134,"titleSlug":"dune-part-two-2024"}
+		]`)
+	}))
+	defer srv.Close()
+
+	r := NewRadarr(&config.ArrConfig{URL: srv.URL, APIKey: "secret", QualityProfileID: 6, RootFolder: "/movies"})
+	results, err := r.Search(context.Background(), "dune")
+	if err != nil {
+		t.Fatalf("search: %v", err)
+	}
+	if len(results) != 2 {
+		t.Fatalf("got %d results, want 2", len(results))
+	}
+	if results[0].Title != "Dune" || results[0].Year != 2021 {
+		t.Errorf("first result = %+v", results[0])
+	}
+}
+
+func TestRadarrAdd(t *testing.T) {
+	var got map[string]any
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.Method != http.MethodPost || r.URL.Path != "/api/v3/movie" {
+			t.Errorf("unexpected %s %s", r.Method, r.URL.Path)
+		}
+		if err := json.NewDecoder(r.Body).Decode(&got); err != nil {
+			t.Fatalf("decode body: %v", err)
+		}
+		w.WriteHeader(http.StatusCreated)
+		_, _ = io.WriteString(w, `{"id":42}`)
+	}))
+	defer srv.Close()
+
+	r := NewRadarr(&config.ArrConfig{URL: srv.URL, APIKey: "k", QualityProfileID: 6, RootFolder: "/movies"})
+	res := makeResult("Dune", 2021, `{"title":"Dune","year":2021,"tmdbId":438631,"titleSlug":"dune-2021"}`)
+	if err := r.Add(context.Background(), res); err != nil {
+		t.Fatalf("add: %v", err)
+	}
+
+	if got["qualityProfileId"].(float64) != 6 {
+		t.Errorf("qualityProfileId = %v", got["qualityProfileId"])
+	}
+	if got["rootFolderPath"] != "/movies" {
+		t.Errorf("rootFolderPath = %v", got["rootFolderPath"])
+	}
+	if got["monitored"] != true {
+		t.Errorf("monitored = %v", got["monitored"])
+	}
+	if got["tmdbId"].(float64) != 438631 {
+		t.Errorf("tmdbId not preserved from lookup: %v", got["tmdbId"])
+	}
+	opts := got["addOptions"].(map[string]any)
+	if opts["searchForMovie"] != true {
+		t.Errorf("addOptions.searchForMovie = %v", opts["searchForMovie"])
+	}
+}
+
+func TestRadarrAddError(t *testing.T) {
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.WriteHeader(http.StatusBadRequest)
+		_, _ = io.WriteString(w, `{"error":"already exists"}`)
+	}))
+	defer srv.Close()
+
+	r := NewRadarr(&config.ArrConfig{URL: srv.URL, APIKey: "k", QualityProfileID: 1, RootFolder: "/m"})
+	err := r.Add(context.Background(), makeResult("X", 0, `{"title":"X"}`))
+	if err == nil {
+		t.Fatal("expected error, got nil")
+	}
+}
--- a/internal/arr/sonarr.go
+++ b/internal/arr/sonarr.go
@@ -0,0 +1,55 @@
+package arr
+
+import (
+	"context"
+	"fmt"
+
+	"bellhop/internal/config"
+)
+
+// Sonarr drives a Sonarr v3/v4 instance.
+type Sonarr struct {
+	h                *httpClient
+	qualityProfileID int
+	rootFolder       string
+}
+
+func NewSonarr(cfg *config.ArrConfig) *Sonarr {
+	return &Sonarr{
+		h:                newHTTP(cfg.URL, cfg.APIKey),
+		qualityProfileID: cfg.QualityProfileID,
+		rootFolder:       cfg.RootFolder,
+	}
+}
+
+func (s *Sonarr) Search(ctx context.Context, term string) ([]Result, error) {
+	body, err := s.h.get(ctx, "/api/v3/series/lookup", map[string]string{"term": term})
+	if err != nil {
+		return nil, err
+	}
+	return parseLookup(body, "title")
+}
+
+func (s *Sonarr) Add(ctx context.Context, res Result) error {
+	if len(res.raw) == 0 {
+		return fmt.Errorf("sonarr: empty result")
+	}
+	body, err := buildAddBody(res.raw, map[string]any{
+		"qualityProfileId": s.qualityProfileID,
+		"rootFolderPath":   s.rootFolder,
+		"monitored":        true,
+		"seasonFolder":     true,
+		"addOptions": map[string]any{
+			"monitor":                      "all",
+			"searchForMissingEpisodes":     true,
+			"searchForCutoffUnmetEpisodes": false,
+		},
+	})
+	if err != nil {
+		return err
+	}
+	_, err = s.h.post(ctx, "/api/v3/series", body)
+	return err
+}
+
+var _ Client = (*Sonarr)(nil)
--- a/internal/arr/sonarr_test.go
+++ b/internal/arr/sonarr_test.go
@@ -0,0 +1,66 @@
+package arr
+
+import (
+	"context"
+	"encoding/json"
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"bellhop/internal/config"
+)
+
+func TestSonarrSearch(t *testing.T) {
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.URL.Path != "/api/v3/series/lookup" {
+			t.Errorf("path = %q", r.URL.Path)
+		}
+		if r.URL.Query().Get("term") != "severance" {
+			t.Errorf("term = %q", r.URL.Query().Get("term"))
+		}
+		_, _ = io.WriteString(w, `[{"title":"Severance","year":2022,"tvdbId":371980}]`)
+	}))
+	defer srv.Close()
+
+	s := NewSonarr(&config.ArrConfig{URL: srv.URL, APIKey: "k", QualityProfileID: 4, RootFolder: "/tv"})
+	results, err := s.Search(context.Background(), "severance")
+	if err != nil {
+		t.Fatalf("search: %v", err)
+	}
+	if len(results) != 1 || results[0].Title != "Severance" || results[0].Year != 2022 {
+		t.Fatalf("unexpected results: %+v", results)
+	}
+}
+
+func TestSonarrAdd(t *testing.T) {
+	var got map[string]any
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.Method != http.MethodPost || r.URL.Path != "/api/v3/series" {
+			t.Errorf("unexpected %s %s", r.Method, r.URL.Path)
+		}
+		_ = json.NewDecoder(r.Body).Decode(&got)
+		w.WriteHeader(http.StatusCreated)
+	}))
+	defer srv.Close()
+
+	s := NewSonarr(&config.ArrConfig{URL: srv.URL, APIKey: "k", QualityProfileID: 4, RootFolder: "/tv"})
+	res := makeResult("Severance", 2022, `{"title":"Severance","year":2022,"tvdbId":371980}`)
+	if err := s.Add(context.Background(), res); err != nil {
+		t.Fatalf("add: %v", err)
+	}
+
+	if got["qualityProfileId"].(float64) != 4 {
+		t.Errorf("qualityProfileId = %v", got["qualityProfileId"])
+	}
+	if got["rootFolderPath"] != "/tv" {
+		t.Errorf("rootFolderPath = %v", got["rootFolderPath"])
+	}
+	if got["monitored"] != true || got["seasonFolder"] != true {
+		t.Errorf("monitored/seasonFolder wrong: %v", got)
+	}
+	opts := got["addOptions"].(map[string]any)
+	if opts["monitor"] != "all" || opts["searchForMissingEpisodes"] != true {
+		t.Errorf("addOptions wrong: %v", opts)
+	}
+}
--- a/internal/bot/bot.go
+++ b/internal/bot/bot.go
@@ -0,0 +1,173 @@
+// Package bot wires Matrix command messages to the *arr clients.
+//
+// Commands take the form "<prefix><cmd> <query>" (e.g. "!movie dune"). The
+// dispatcher parses the message, picks the *arr client by command name,
+// performs a lookup, and adds the top hit. The reply is posted back into a
+// thread rooted at the request event so a busy room stays readable.
+package bot
+
+import (
+	"context"
+	"fmt"
+	"html"
+	"log/slog"
+	"strings"
+	"time"
+
+	"bellhop/internal/arr"
+
+	"maunium.net/go/mautrix/id"
+)
+
+// Replier sends a threaded reply into roomID under rootEventID. The ctx
+// governs cancellation/deadline so shutdown propagates through replies.
+type Replier interface {
+	PostThreadedReply(ctx context.Context, roomID id.RoomID, rootEventID id.EventID, plain, htmlBody string) error
+}
+
+// Services holds the configured *arr clients. Any field may be nil; commands
+// that target an unconfigured service reply with "not configured".
+type Services struct {
+	Radarr arr.Client
+	Sonarr arr.Client
+	Lidarr arr.Client
+}
+
+// Dispatcher routes parsed commands to services and posts replies.
+type Dispatcher struct {
+	baseCtx  context.Context
+	prefix   string
+	services Services
+	replier  Replier
+	timeout  time.Duration
+}
+
+// New builds a Dispatcher. prefix is the leading character(s) on a command
+// (e.g. "!"); a zero value defaults to "!". baseCtx becomes the parent of
+// every per-command context so app shutdown cancels in-flight handlers.
+func New(baseCtx context.Context, prefix string, services Services, replier Replier) *Dispatcher {
+	if prefix == "" {
+		prefix = "!"
+	}
+	if baseCtx == nil {
+		baseCtx = context.Background()
+	}
+	return &Dispatcher{
+		baseCtx:  baseCtx,
+		prefix:   prefix,
+		services: services,
+		replier:  replier,
+		timeout:  60 * time.Second,
+	}
+}
+
+// Handle is the matrix.MessageHandler entry point. It parses body, dispatches
+// the command, and posts a reply. Non-command messages are ignored silently.
+func (d *Dispatcher) Handle(roomID id.RoomID, eventID id.EventID, sender id.UserID, body string) {
+	cmd, query, ok := parseCommand(d.prefix, body)
+	if !ok {
+		return
+	}
+
+	slog.Info("bot: command received", "room", roomID, "sender", sender, "cmd", cmd, "query", query)
+
+	ctx, cancel := context.WithTimeout(d.baseCtx, d.timeout)
+	defer cancel()
+
+	plain, htmlBody := d.dispatch(ctx, cmd, query)
+	if err := d.replier.PostThreadedReply(ctx, roomID, eventID, plain, htmlBody); err != nil {
+		slog.Error("bot: reply failed", "room", roomID, "err", err)
+	}
+}
+
+// parseCommand pulls (cmd, query) out of a body like "!movie dune". Returns
+// ok=false when the message is not a command for us.
+func parseCommand(prefix, body string) (cmd, query string, ok bool) {
+	body = strings.TrimSpace(body)
+	if !strings.HasPrefix(body, prefix) {
+		return "", "", false
+	}
+	rest := strings.TrimSpace(body[len(prefix):])
+	if rest == "" {
+		return "", "", false
+	}
+	parts := strings.SplitN(rest, " ", 2)
+	cmd = strings.ToLower(parts[0])
+	if len(parts) == 2 {
+		query = strings.TrimSpace(parts[1])
+	}
+	return cmd, query, true
+}
+
+func (d *Dispatcher) dispatch(ctx context.Context, cmd, query string) (plain, htmlBody string) {
+	switch cmd {
+	case "help":
+		return d.help()
+	case "movie":
+		return d.run(ctx, "movie", "Radarr", d.services.Radarr, query)
+	case "tv":
+		return d.run(ctx, "tv", "Sonarr", d.services.Sonarr, query)
+	case "music":
+		return d.run(ctx, "music", "Lidarr", d.services.Lidarr, query)
+	default:
+		msg := fmt.Sprintf("Unknown command %q. Try %shelp.", cmd, d.prefix)
+		return msg, html.EscapeString(msg)
+	}
+}
+
+func (d *Dispatcher) run(ctx context.Context, cmd, service string, client arr.Client, query string) (plain, htmlBody string) {
+	if client == nil {
+		msg := fmt.Sprintf("%s is not configured.", service)
+		return msg, html.EscapeString(msg)
+	}
+	if query == "" {
+		msg := fmt.Sprintf("Usage: %s%s <query>", d.prefix, cmd)
+		return msg, html.EscapeString(msg)
+	}
+
+	results, err := client.Search(ctx, query)
+	if err != nil {
+		slog.Error("bot: search failed", "service", service, "query", query, "err", err)
+		msg := fmt.Sprintf("%s search failed: %v", service, err)
+		return msg, html.EscapeString(msg)
+	}
+	if len(results) == 0 {
+		msg := fmt.Sprintf("No %s results for %q.", service, query)
+		return msg, html.EscapeString(msg)
+	}
+
+	top := results[0]
+	if top.Exists {
+		msg := fmt.Sprintf("%s already has %s in the library.", service, formatTitle(top))
+		return msg, html.EscapeString(msg)
+	}
+	if err := client.Add(ctx, top); err != nil {
+		slog.Error("bot: add failed", "service", service, "title", top.Title, "err", err)
+		msg := fmt.Sprintf("%s: failed to add %s: %v", service, formatTitle(top), err)
+		return msg, html.EscapeString(msg)
+	}
+
+	plain = fmt.Sprintf("Added to %s: %s", service, formatTitle(top))
+	htmlBody = fmt.Sprintf("Added to <b>%s</b>: %s", html.EscapeString(service), html.EscapeString(formatTitle(top)))
+	return plain, htmlBody
+}
+
+func (d *Dispatcher) help() (string, string) {
+	lines := []string{
+		"Bellhop commands:",
+		fmt.Sprintf("  %smovie <query>  — add the top Radarr hit", d.prefix),
+		fmt.Sprintf("  %stv <query>     — add the top Sonarr hit", d.prefix),
+		fmt.Sprintf("  %smusic <query>  — add the top Lidarr hit", d.prefix),
+		fmt.Sprintf("  %shelp           — show this message", d.prefix),
+	}
+	plain := strings.Join(lines, "\n")
+	htmlBody := "<pre>" + html.EscapeString(plain) + "</pre>"
+	return plain, htmlBody
+}
+
+func formatTitle(r arr.Result) string {
+	if r.Year > 0 {
+		return fmt.Sprintf("%s (%d)", r.Title, r.Year)
+	}
+	return r.Title
+}
--- a/internal/bot/bot_test.go
+++ b/internal/bot/bot_test.go
@@ -0,0 +1,237 @@
+package bot
+
+import (
+	"context"
+	"errors"
+	"strings"
+	"sync"
+	"testing"
+
+	"bellhop/internal/arr"
+
+	"maunium.net/go/mautrix/id"
+)
+
+type stubClient struct {
+	results []arr.Result
+	addErr  error
+	srchErr error
+
+	searched string
+	added    []arr.Result
+}
+
+func (s *stubClient) Search(_ context.Context, term string) ([]arr.Result, error) {
+	s.searched = term
+	if s.srchErr != nil {
+		return nil, s.srchErr
+	}
+	return s.results, nil
+}
+
+func (s *stubClient) Add(_ context.Context, r arr.Result) error {
+	if s.addErr != nil {
+		return s.addErr
+	}
+	s.added = append(s.added, r)
+	return nil
+}
+
+type stubReplier struct {
+	mu       sync.Mutex
+	plain    string
+	htmlBody string
+	calls    int
+}
+
+func (r *stubReplier) PostThreadedReply(_ context.Context, _ id.RoomID, _ id.EventID, plain, htmlBody string) error {
+	r.mu.Lock()
+	defer r.mu.Unlock()
+	r.calls++
+	r.plain = plain
+	r.htmlBody = htmlBody
+	return nil
+}
+
+func newDispatcher(prefix string, services Services, replier Replier) *Dispatcher {
+	return New(context.Background(), prefix, services, replier)
+}
+
+const (
+	room   = id.RoomID("!room:example.org")
+	event  = id.EventID("$evt")
+	sender = id.UserID("@alice:example.org")
+)
+
+func TestParseCommand(t *testing.T) {
+	cases := []struct {
+		body            string
+		wantCmd, wantQ  string
+		wantOk          bool
+	}{
+		{"!movie dune", "movie", "dune", true},
+		{"  !movie  dune part two  ", "movie", "dune part two", true},
+		{"!HELP", "help", "", true},
+		{"hello world", "", "", false},
+		{"!", "", "", false},
+		{"!  ", "", "", false},
+	}
+	for _, c := range cases {
+		cmd, q, ok := parseCommand("!", c.body)
+		if cmd != c.wantCmd || q != c.wantQ || ok != c.wantOk {
+			t.Errorf("parseCommand(%q) = (%q,%q,%v); want (%q,%q,%v)",
+				c.body, cmd, q, ok, c.wantCmd, c.wantQ, c.wantOk)
+		}
+	}
+}
+
+func TestDispatchMovieTopHit(t *testing.T) {
+	radarr := &stubClient{results: []arr.Result{
+		{Title: "Dune", Year: 2021},
+		{Title: "Dune", Year: 1984},
+	}}
+	rep := &stubReplier{}
+	d := newDispatcher("!", Services{Radarr: radarr}, rep)
+
+	d.Handle(room, event, sender, "!movie dune")
+
+	if radarr.searched != "dune" {
+		t.Fatalf("search term = %q", radarr.searched)
+	}
+	if len(radarr.added) != 1 || radarr.added[0].Year != 2021 {
+		t.Fatalf("expected top hit added, got %+v", radarr.added)
+	}
+	if !strings.Contains(rep.plain, "Dune (2021)") || !strings.Contains(rep.plain, "Radarr") {
+		t.Fatalf("reply missing expected content: %q", rep.plain)
+	}
+}
+
+func TestDispatchNoResults(t *testing.T) {
+	sonarr := &stubClient{}
+	rep := &stubReplier{}
+	d := newDispatcher("!", Services{Sonarr: sonarr}, rep)
+
+	d.Handle(room, event, sender, "!tv obscure show")
+
+	if len(sonarr.added) != 0 {
+		t.Fatal("should not add when no results")
+	}
+	if !strings.Contains(rep.plain, "No Sonarr results") {
+		t.Fatalf("unexpected reply: %q", rep.plain)
+	}
+}
+
+func TestDispatchUnconfigured(t *testing.T) {
+	rep := &stubReplier{}
+	d := newDispatcher("!", Services{}, rep)
+
+	d.Handle(room, event, sender, "!music radiohead")
+
+	if !strings.Contains(rep.plain, "Lidarr is not configured") {
+		t.Fatalf("unexpected reply: %q", rep.plain)
+	}
+}
+
+func TestDispatchEmptyQuery(t *testing.T) {
+	radarr := &stubClient{}
+	rep := &stubReplier{}
+	d := newDispatcher("!", Services{Radarr: radarr}, rep)
+
+	d.Handle(room, event, sender, "!movie")
+
+	if radarr.searched != "" {
+		t.Fatal("should not search with empty query")
+	}
+	if !strings.Contains(rep.plain, "Usage:") {
+		t.Fatalf("unexpected reply: %q", rep.plain)
+	}
+}
+
+func TestDispatchAddError(t *testing.T) {
+	radarr := &stubClient{
+		results: []arr.Result{{Title: "Dune", Year: 2021}},
+		addErr:  errors.New("boom"),
+	}
+	rep := &stubReplier{}
+	d := newDispatcher("!", Services{Radarr: radarr}, rep)
+
+	d.Handle(room, event, sender, "!movie dune")
+
+	if !strings.Contains(rep.plain, "failed to add") || !strings.Contains(rep.plain, "boom") {
+		t.Fatalf("unexpected reply: %q", rep.plain)
+	}
+}
+
+func TestDispatchSearchError(t *testing.T) {
+	radarr := &stubClient{srchErr: errors.New("network down")}
+	rep := &stubReplier{}
+	d := newDispatcher("!", Services{Radarr: radarr}, rep)
+
+	d.Handle(room, event, sender, "!movie dune")
+
+	if !strings.Contains(rep.plain, "search failed") {
+		t.Fatalf("unexpected reply: %q", rep.plain)
+	}
+}
+
+func TestDispatchHelp(t *testing.T) {
+	rep := &stubReplier{}
+	d := newDispatcher("!", Services{}, rep)
+
+	d.Handle(room, event, sender, "!help")
+
+	for _, want := range []string{"!movie", "!tv", "!music", "!help"} {
+		if !strings.Contains(rep.plain, want) {
+			t.Errorf("help missing %q: %q", want, rep.plain)
+		}
+	}
+}
+
+func TestDispatchUnknown(t *testing.T) {
+	rep := &stubReplier{}
+	d := newDispatcher("!", Services{}, rep)
+
+	d.Handle(room, event, sender, "!frobnicate stuff")
+
+	if !strings.Contains(rep.plain, "Unknown command") {
+		t.Fatalf("unexpected reply: %q", rep.plain)
+	}
+}
+
+func TestNonCommandIgnored(t *testing.T) {
+	rep := &stubReplier{}
+	d := newDispatcher("!", Services{}, rep)
+
+	d.Handle(room, event, sender, "just chatting")
+
+	if rep.calls != 0 {
+		t.Fatalf("expected no reply, got %d", rep.calls)
+	}
+}
+
+func TestDispatchAlreadyInLibrary(t *testing.T) {
+	radarr := &stubClient{results: []arr.Result{{Title: "Dune", Year: 2021, Exists: true}}}
+	rep := &stubReplier{}
+	d := newDispatcher("!", Services{Radarr: radarr}, rep)
+
+	d.Handle(room, event, sender, "!movie dune")
+
+	if len(radarr.added) != 0 {
+		t.Fatalf("should not re-add existing item, got %d adds", len(radarr.added))
+	}
+	if !strings.Contains(rep.plain, "already has") || !strings.Contains(rep.plain, "Dune (2021)") {
+		t.Fatalf("unexpected reply: %q", rep.plain)
+	}
+}
+
+func TestCustomPrefix(t *testing.T) {
+	radarr := &stubClient{results: []arr.Result{{Title: "Dune", Year: 2021}}}
+	rep := &stubReplier{}
+	d := newDispatcher(".bh ", Services{Radarr: radarr}, rep)
+
+	d.Handle(room, event, sender, ".bh movie dune")
+
+	if len(radarr.added) != 1 {
+		t.Fatalf("expected add, got %d", len(radarr.added))
+	}
+}
--- a/internal/config/config.go
+++ b/internal/config/config.go
@@ -6,40 +6,42 @@ import (
 	"os"
 	"regexp"

-	"gopkg.in/yaml.v3"
+	"github.com/BurntSushi/toml"
 )

 var envBracketRe = regexp.MustCompile(`\$\{([^}]+)\}`)

 type Config struct {
-	Matrix   MatrixConfig   `yaml:"matrix"`
-	Services ServicesConfig `yaml:"services"`
+	Matrix   MatrixConfig   `toml:"matrix"`
+	Services ServicesConfig `toml:"services"`
 }

 type MatrixConfig struct {
-	Homeserver  string   `yaml:"homeserver"`
-	UserID      string   `yaml:"user_id"`
-	Password    string   `yaml:"password"`
-	PickleKey   string   `yaml:"pickle_key"`
-	DisplayName string   `yaml:"display_name"`
-	DataDir     string   `yaml:"data_dir"`
-	CommandPrefix string `yaml:"command_prefix"`
+	Homeserver    string `toml:"homeserver"`
+	UserID        string `toml:"user_id"`
+	Password      string `toml:"password"`
+	PickleKey     string `toml:"pickle_key"`
+	DisplayName   string `toml:"display_name"`
+	DataDir       string `toml:"data_dir"`
+	CommandPrefix string `toml:"command_prefix"`
 	// AllowedRooms is the set of room IDs the bot listens for commands in.
 	// Messages in any other room are ignored.
-	AllowedRooms []string `yaml:"allowed_rooms"`
+	AllowedRooms []string `toml:"allowed_rooms"`
 }

 type ServicesConfig struct {
-	Radarr *ArrConfig `yaml:"radarr"`
-	Sonarr *ArrConfig `yaml:"sonarr"`
-	Lidarr *ArrConfig `yaml:"lidarr"`
+	Radarr *ArrConfig `toml:"radarr"`
+	Sonarr *ArrConfig `toml:"sonarr"`
+	Lidarr *ArrConfig `toml:"lidarr"`
 }

 type ArrConfig struct {
-	URL              string `yaml:"url"`
-	APIKey           string `yaml:"api_key"`
-	QualityProfileID int    `yaml:"quality_profile_id"`
-	RootFolder       string `yaml:"root_folder"`
+	URL              string `toml:"url"`
+	APIKey           string `toml:"api_key"`
+	QualityProfileID int    `toml:"quality_profile_id"`
+	RootFolder       string `toml:"root_folder"`
+	// MetadataProfileID is required by Lidarr; ignored by Radarr/Sonarr.
+	MetadataProfileID int `toml:"metadata_profile_id"`
 }

 func Load(path string) (*Config, error) {
@@ -58,7 +60,7 @@ func Load(path string) (*Config, error) {
 	})

 	var cfg Config
-	if err := yaml.Unmarshal([]byte(expanded), &cfg); err != nil {
+	if _, err := toml.Decode(expanded, &cfg); err != nil {
 		return nil, fmt.Errorf("parse config: %w", err)
 	}

@@ -108,6 +110,9 @@ func (c *Config) validate() error {
 			return fmt.Errorf("services.%s.quality_profile_id is required when service is set", name)
 		}
 	}
+	if c.Services.Lidarr != nil && c.Services.Lidarr.MetadataProfileID == 0 {
+		return fmt.Errorf("services.lidarr.metadata_profile_id is required when lidarr is set")
+	}
 	return nil
 }

--- a/internal/matrix/client.go
+++ b/internal/matrix/client.go
@@ -3,6 +3,7 @@ package matrix
 import (
 	"context"
 	"encoding/json"
+	"errors"
 	"fmt"
 	"log/slog"
 	"net/http"
@@ -50,13 +51,16 @@ func New(cfg config.MatrixConfig) (*Client, error) {

 	device, err := loadDevice(devicePath)
 	if err != nil {
-		slog.Info("no existing device found, will login fresh")
+		// File exists but is unparseable — refuse to overwrite. A silent fresh
+		// login would orphan the prior device's megolm sessions and break
+		// decryption in every encrypted room the bot is already in.
+		return nil, fmt.Errorf("load device file %s: %w (refusing to overwrite — fix or delete the file)", devicePath, err)
 	}

 	var mx *mautrix.Client

 	if device != nil {
-		if isTokenValid(cfg.Homeserver, device.AccessToken) {
+		if isTokenValid(cfg.Homeserver, device.AccessToken, cfg.UserID) {
 			slog.Info("existing device credentials valid", "device_id", device.DeviceID)
 			mx, err = mautrix.NewClient(cfg.Homeserver, id.UserID(device.UserID), device.AccessToken)
 			if err != nil {
@@ -92,12 +96,11 @@ func New(cfg config.MatrixConfig) (*Client, error) {
 		mx.UserID = resp.UserID
 		mx.DeviceID = resp.DeviceID

-		device = &deviceInfo{
+		if err := saveDevice(devicePath, &deviceInfo{
 			AccessToken: resp.AccessToken,
 			DeviceID:    string(resp.DeviceID),
 			UserID:      string(resp.UserID),
-		}
-		if err := saveDevice(devicePath, device); err != nil {
+		}); err != nil {
 			slog.Warn("failed to save device info", "err", err)
 		}

@@ -117,16 +120,11 @@ func New(cfg config.MatrixConfig) (*Client, error) {
 			"room", evt.RoomID, "event_id", evt.ID, "sender", evt.Sender, "err", err)
 	}

-	ch.LoginAs = &mautrix.ReqLogin{
-		Type: mautrix.AuthTypePassword,
-		Identifier: mautrix.UserIdentifier{
-			Type: mautrix.IdentifierTypeUser,
-			User: cfg.UserID,
-		},
-		Password:                 cfg.Password,
-		InitialDeviceDisplayName: cfg.DisplayName,
-	}
-
+	// Intentionally NOT setting ch.LoginAs: cryptohelper.Init will Login() every
+	// time LoginAs is non-nil (see mautrix cryptohelper.go), which would mint a
+	// new access_token on every startup and silently invalidate the device.json
+	// we just wrote. We already have valid credentials in mx by this point —
+	// Init will reuse them.
 	if err := ch.Init(context.Background()); err != nil {
 		return nil, fmt.Errorf("crypto helper init: %w", err)
 	}
@@ -189,8 +187,11 @@ func (c *Client) SetMessageHandler(fn MessageHandler) {
 }

 // Start begins the Matrix sync loop in the background.
-func (c *Client) Start(ctx context.Context) {
-	syncer := c.mx.Syncer.(*mautrix.DefaultSyncer)
+func (c *Client) Start(ctx context.Context) error {
+	syncer, ok := c.mx.Syncer.(*mautrix.DefaultSyncer)
+	if !ok {
+		return fmt.Errorf("matrix syncer is not *mautrix.DefaultSyncer (got %T)", c.mx.Syncer)
+	}

 	syncer.OnEventType(event.EventMessage, func(ctx context.Context, evt *event.Event) {
 		if evt.Sender == c.userID {
@@ -243,6 +244,7 @@ func (c *Client) Start(ctx context.Context) {
 			}
 		}
 	}()
+	return nil
 }

 // Stop halts the sync loop and closes the crypto store.
@@ -259,10 +261,8 @@ func (c *Client) Stop() {

 // PostThreadedReply sends a plain/HTML message into the thread rooted at rootEventID.
 // IsFallingBack + m.in_reply_to gives non-thread-aware clients a sensible quoted reply.
-func (c *Client) PostThreadedReply(roomID id.RoomID, rootEventID id.EventID, plain, htmlBody string) error {
-	ctx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
-	defer cancel()
-
+// The caller's ctx governs cancellation and deadline.
+func (c *Client) PostThreadedReply(ctx context.Context, roomID id.RoomID, rootEventID id.EventID, plain, htmlBody string) error {
 	content := &event.MessageEventContent{
 		MsgType:       event.MsgText,
 		Body:          plain,
@@ -279,14 +279,24 @@ func (c *Client) PostThreadedReply(roomID id.RoomID, rootEventID id.EventID, pla
 	return err
 }

+// loadDevice returns (nil, nil) when no device file exists, the parsed device
+// when it does, or (nil, err) when the file is present but unreadable/corrupt.
+// Distinguishing the corrupt case lets the caller refuse to silently overwrite
+// it with a brand-new device registration.
 func loadDevice(path string) (*deviceInfo, error) {
 	data, err := os.ReadFile(path)
 	if err != nil {
+		if errors.Is(err, os.ErrNotExist) {
+			return nil, nil
+		}
 		return nil, err
 	}
 	var info deviceInfo
 	if err := json.Unmarshal(data, &info); err != nil {
-		return nil, err
+		return nil, fmt.Errorf("parse: %w", err)
+	}
+	if info.AccessToken == "" || info.DeviceID == "" || info.UserID == "" {
+		return nil, fmt.Errorf("missing required fields (access_token/device_id/user_id)")
 	}
 	return &info, nil
 }
@@ -299,7 +309,11 @@ func saveDevice(path string, info *deviceInfo) error {
 	return os.WriteFile(path, data, 0o600)
 }

-func isTokenValid(homeserver, accessToken string) bool {
+// isTokenValid hits /whoami and confirms both that the token is accepted AND
+// that it identifies the user we expect. A bare status-code check would accept
+// a token belonging to a different account if the operator swapped user_id
+// without clearing data_dir.
+func isTokenValid(homeserver, accessToken, expectedUserID string) bool {
 	req, err := http.NewRequest("GET", homeserver+"/_matrix/client/v3/account/whoami", nil)
 	if err != nil {
 		return false
@@ -312,5 +326,19 @@ func isTokenValid(homeserver, accessToken string) bool {
 		return false
 	}
 	defer resp.Body.Close()
-	return resp.StatusCode == http.StatusOK
+	if resp.StatusCode != http.StatusOK {
+		return false
+	}
+	var body struct {
+		UserID string `json:"user_id"`
+	}
+	if err := json.NewDecoder(resp.Body).Decode(&body); err != nil {
+		return false
+	}
+	if body.UserID != expectedUserID {
+		slog.Warn("saved token belongs to a different user, will re-login",
+			"saved", body.UserID, "configured", expectedUserID)
+		return false
+	}
+	return true
 }
--- a/main.go
+++ b/main.go
@@ -0,0 +1,66 @@
+package main
+
+import (
+	"context"
+	"flag"
+	"log/slog"
+	"os"
+	"os/signal"
+	"syscall"
+
+	"bellhop/internal/arr"
+	"bellhop/internal/bot"
+	"bellhop/internal/config"
+	"bellhop/internal/matrix"
+)
+
+func main() {
+	configPath := flag.String("config", "config.toml", "path to config file")
+	flag.Parse()
+
+	slog.SetDefault(slog.New(slog.NewTextHandler(os.Stderr, &slog.HandlerOptions{Level: slog.LevelInfo})))
+
+	cfg, err := config.Load(*configPath)
+	if err != nil {
+		slog.Error("config load failed", "err", err)
+		os.Exit(1)
+	}
+
+	services := bot.Services{}
+	if cfg.Services.Radarr != nil {
+		services.Radarr = arr.NewRadarr(cfg.Services.Radarr)
+	}
+	if cfg.Services.Sonarr != nil {
+		services.Sonarr = arr.NewSonarr(cfg.Services.Sonarr)
+	}
+	if cfg.Services.Lidarr != nil {
+		services.Lidarr = arr.NewLidarr(cfg.Services.Lidarr)
+	}
+
+	mx, err := matrix.New(cfg.Matrix)
+	if err != nil {
+		slog.Error("matrix init failed", "err", err)
+		os.Exit(1)
+	}
+
+	ctx, cancel := context.WithCancel(context.Background())
+	defer cancel()
+
+	dispatcher := bot.New(ctx, cfg.Matrix.CommandPrefix, services, mx)
+	mx.SetMessageHandler(dispatcher.Handle)
+
+	if err := mx.Start(ctx); err != nil {
+		slog.Error("matrix start failed", "err", err)
+		mx.Stop()
+		os.Exit(1)
+	}
+	slog.Info("bellhop started", "allowed_rooms", len(cfg.Matrix.AllowedRooms))
+
+	sig := make(chan os.Signal, 1)
+	signal.Notify(sig, syscall.SIGINT, syscall.SIGTERM)
+	<-sig
+
+	slog.Info("shutting down")
+	cancel()
+	mx.Stop()
+}
Author	SHA1	Message	Date
prosolis	8f38d3d9f4	Switch config format from YAML to TOML Replaces gopkg.in/yaml.v3 with github.com/BurntSushi/toml. Updates struct tags, default config path, Dockerfile CMD, README, and ships config.example.toml in place of the YAML example. ${ENV_VAR} expansion still runs on the raw file before parsing, so the behavior is unchanged.	2026-05-24 21:05:41 -07:00
prosolis	035089c159	Fix correctness bugs found by code review - matrix: drop cryptohelper LoginAs so device.json creds aren't invalidated on every restart by Init's re-login - matrix: thread ctx through PostThreadedReply; bot dispatcher derives per-command ctx from app lifecycle so SIGTERM cancels in-flight work - matrix: isTokenValid verifies /whoami user_id matches configured one - matrix: loadDevice distinguishes missing file from corrupt parse; refuse to silently overwrite a corrupt device.json - matrix: Start checks Syncer type assertion and returns error - arr: parseLookup skips empty-title items and extracts existing id - bot: skip Add when Result.Exists; reply "already in library"	2026-05-24 20:50:51 -07:00
prosolis	8c295d183b	Session 5: Dockerfile, config example, README rewrite Multi-stage alpine Dockerfile builds with -tags goolm so libolm isn't needed at runtime. Annotated config.example.yaml documents every field and shows ${ENV_VAR} usage for secrets. README is rewritten for the Go bot — Python-era web-portal docs are gone.	2026-05-24 20:29:13 -07:00
prosolis	0de6dd8c0d	Session 4: command dispatcher and main entrypoint Wire Matrix messages to the *arr clients. Dispatcher parses "<prefix><cmd> <query>", routes movie/tv/music to Radarr/Sonarr/Lidarr, adds the top hit, and replies in a thread. Unconfigured services reply with a clear message instead of failing.	2026-05-24 20:27:17 -07:00
prosolis	206b378d93	Session 3: Radarr/Sonarr/Lidarr clients with add-on-search Adds internal/arr with a shared HTTP layer and per-service clients that look up candidates and POST the chosen one back with monitored=true and search-on-add enabled. Lidarr requires metadata_profile_id, now part of ArrConfig and validated when lidarr is set.	2026-05-24 20:22:50 -07:00