fix(batch1): safe fixes — saveOffsets ordering, pid atomic, error handlers, go mutex, frontend cleanup

plugin/server/api.go

@@ -122,6 +122,16 @@ func (p *Plugin) handleCreateSession(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
+	// Validate KV key length — Mattermost enforces a 50-char limit.
+	// Encoded key = kvPrefix (11 chars) + url.PathEscape(sessionKey).
+	// Exceeding the limit causes KVSet to silently succeed but never store data.
+	if len(encodeKey(req.SessionKey)) > 50 {
+		writeJSON(w, http.StatusBadRequest, map[string]string{
+			"error": fmt.Sprintf("session_key too long: encoded key length %d exceeds 50-char KV limit", len(encodeKey(req.SessionKey))),
+		})
+		return
+	}
+
 	// Check max active sessions
 	config := p.getConfiguration()
 	allSessions, _ := p.store.ListAllSessions()