Add referral onboarding, pending-action timeouts, persistent menus, group-linking tools, and improved smoke/unit tests

[gamblecodezcom]

User description

Motivation

• Introduce Runewager 2.0 UX/back-end improvements: deterministic play-link routing (browser vs mini-app), onboarding referral flow, safer pending-action timeout handling, and robust group-linking tooling for admins.
• Harden navigation/menu behavior to avoid stale menu cards and make admin/group workflows more discoverable and safe.
• Improve static smoke tests to better validate command/callback parity, catch-all callback handling, and environment/runtime configuration documentation.

Description

• Updated .env.example to document BOT_PRIVACY_MODE, TLS paths (HTTPS_CERT_PATH/HTTPS_KEY_PATH), telegram links and other runtime keys and reordered entries for clarity.
• Added link helpers (unwrapTelegramUrl, getDiscordLink, getBrowserLink, getStartAppLink, getPlayLink) and switched LINKS discord entries to use unwrapped external HTTPS links.
• Implemented pending-action timeout utilities (ACTION_LABELS, evaluatePendingActionTimeout) and integrated them into the text handler to seed createdAt, enforce a 15-minute boundary (exact 15 minutes still valid), and produce user-facing timeout labels.
• Added persistent-menu helpers (clearOldMenus, replyMenu) and tracked last menu message IDs in user objects; updated main/settings/menu senders to clear stale menus before replying.
• Implemented referral onboarding and sharing: onboarding prompt for referral code, applyOnboardingReferralCode logic (self-referral and post-onboarding prevention), referral bookkeeping (referralStore.referrals and user referral fields), referral share HTML, and referral menu callbacks (ref_menu_code, ref_menu_share, ref_menu_how).
• Added Group Linking Tools under Settings with actions for linking via forwarded messages, viewing, removing, testing permissions, and corresponding admin handlers and UI flows; persisted approved groups in approvedGroupsStore and exposed helper keyboard renderers.
• Adjusted various UI labels (e.g., "Refer a Friend"), play button to be settings-aware, and ensured mini-app/browser launch messaging uses getPlayLink.
• Extended runtime state snapshot/load to include new referral and menu fields and updated related data structures.
• Expanded and hardened test suite changes: test/smoke.test.js improved static analyzers for bot.action regex coverage, command extraction (supports const-backed names and different quote styles), catch-all regex filtering, environment doc checks, pending-action boundary checks and navigation/menu assertions; test/unit.test.js added unit tests for pending-action expiry semantics, link helpers, play-link behavior, and referral logic.

Testing

• Ran the automated test suite via npm test covering test/unit.test.js and test/smoke.test.js, and all tests passed.
• Smoke checks validate command/callback parity, catch-all callback exclusions, presence of BOT_PRIVACY_MODE and HTTPS path checks, and the TestAll final summary line.
• Unit tests assert pending-action timeout boundary behavior, play-link routing differences for browser vs miniapp, discord link unwrapping, and referral onboarding/abuse-prevention rules.

---

Codex Task

---

CodeAnt-AI Description

Ensure bot is configured to read group messages and surface that in diagnostics

What Changed

• The bot now reads a unified BOT_PRIVACY_MODE setting and requires it to be "disabled" during the runtime health check; the test command flags a failure if it's not set to "disabled"
• Group listing output and admin reports show the normalized BOT_PRIVACY_MODE value and recommend disabling privacy mode when group message visibility is required
• .env.example now documents BOT_PRIVACY_MODE as "disabled" (BotFather non-privacy mode) to make setup expectations clear

Impact

✅ Fewer missed group messages due to privacy mode
✅ Clearer diagnostics about group visibility in health checks
✅ Shorter setup time with explicit BOT_PRIVACY_MODE guidance

💡 Usage Guide

Checking Your Pull Request

Every time you make a pull request, our system automatically looks through it. We check for security issues, mistakes in how you're setting up your infrastructure, and common code problems. We do this to make sure your changes are solid and won't cause any trouble later.

Talking to CodeAnt AI

Got a question or need a hand with something in your pull request? You can easily get in touch with CodeAnt AI right here. Just type the following in a comment on your pull request, and replace "Your question here" with whatever you want to ask:

@codeant-ai ask: Your question here

This lets you have a chat with CodeAnt AI about your pull request, making it easier to understand and improve your code.

Example

@codeant-ai ask: Can you suggest a safer alternative to storing this secret?

Preserve Org Learnings with CodeAnt

You can record team preferences so CodeAnt AI applies them in future reviews. Reply directly to the specific CodeAnt AI suggestion (in the same thread) and replace "Your feedback here" with your input:

@codeant-ai: Your feedback here

This helps CodeAnt AI learn and adapt to your team's coding style and standards.

Example

@codeant-ai: Do not flag unused imports.

Retrigger review

Ask CodeAnt AI to review the PR again, by typing:

@codeant-ai: review

Check Your Repository Health

To analyze the health of your code repository, visit our dashboard at https://app.codeant.ai. This tool helps you identify potential issues and areas for improvement in your codebase, ensuring your repository maintains high standards of code health.

[codeant-ai]

CodeAnt AI is reviewing your PR.

---

Thanks for using CodeAnt! 🎉

We're free for open-source projects. if you're enjoying it, help us grow by sharing.

Share on X ·
Reddit ·
LinkedIn

[coderabbitai]

Warning

Rate limit exceeded

@gamblecodezcom has exceeded the limit for the number of commits that can be reviewed per hour. Please wait 3 minutes and 42 seconds before requesting another review.

⌛ How to resolve this issue?

After the wait time has elapsed, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout.

Please see our FAQ for further information.

📥 Commits

Reviewing files that changed from the base of the PR and between 80384db and 579ba54.

📒 Files selected for processing (3)

• .env.example
• RUNEWAGER_FUNCTIONALITY_MAP.md
• index.js

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Post copyable unit tests in a comment
• Commit unit tests in branch codex/perform-full-audit-and-implementation-for-runewager-bot

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[codeant-ai]

CodeAnt AI finished reviewing your PR.