Persistent menu & navigation hygiene, onboarding referral + group-linking tools, play button helpers, pending-action timeouts, and expanded tests

[gamblecodezcom]

User description

Motivation

• Improve menu/card UX by enforcing single-active-menu behavior and avoiding stacked/stale callback cards.
• Add a first-class onboarding referral flow with anti-abuse rules and persistent referral tracking.
• Expose admin Group Linking Tools (link/view/remove/test) for reliable giveaway posting and permission checks.
• Harden runtime checks and smoke/unit tests to cover new 2.0 behaviors (play-mode determinism, pending-action semantics, env docs).

Description

• Added helpers for deterministic Play launch: getPlayMode, getBrowserLink, getStartAppLink, getPlayLink, getPlayButton, and playButtonMarkup, and replaced hardcoded play buttons in menus with the unified helper.
• Implemented menu/callback hygiene: callback middleware deletes source callback cards, and new clearOldMenus, replyMenu helpers ensure only one transient/persistent menu message per user is kept.
• Introduced pending-action timeout labeling and enforcement via ACTION_LABELS and evaluatePendingActionTimeout with exact-15-minute boundary semantics and slash-command escape behavior.
• Added onboarding referral flow and storage: applyOnboardingReferralCode, referral record list (referralStore.referrals), referral share HTML, onboarding prompt (onboard_ref_*), and prevention rules (no self-referral / only during onboarding).
• Added Group Linking Tools: UI and callbacks for group_link_start, group_link_view, group_link_remove_menu, group_link_test_permissions, and admin-facing renderGroupLinkingTools, plus persisted approvedGroupsStore uses.
• Added URL unwrapping and Discord sanitation via unwrapTelegramUrl and getDiscordLink to ensure external Discord links.
• Improved admin/test diagnostics: testall now reports warnings, enforces BOT_PRIVACY_MODE=disabled expectation, validates HTTPS cert paths optionally, and includes PendingAction/Navigation checks.
• Updated .env.example to document new keys (BOT_PRIVACY_MODE, HTTPS_CERT_PATH, HTTPS_KEY_PATH, telegram links, and WEBAPP_HMAC_KEY placement).
• Many callbacks/commands updated to use clearOldMenus/replyMenu and to persist settings immediately where applicable (e.g. play-mode toggle).
• Documentation updates: RUNEWAGER_FUNCTIONALITY_MAP.md and CLAUDE.md synced with new agent contract notes.

Testing

• Ran the repository test suite via npm test (node:test) which executes the updated smoke tests (test/smoke.test.js) and unit tests (test/unit.test.js); all tests passed.
• Added new smoke/unit checks validating menu→handler coverage, catch-all regex exclusions, command declaration parsing (including const/backtick forms), pending-action timeout behavior, play-button determinism, env var documentation, and group-linking callbacks, and these checks succeeded.
• Performed the /testall diagnostic assertions inside tests to validate the new diagnostic summary line and environment expectations, which reported no failures.

---

Codex Task

---

CodeAnt-AI Description

Add menu hygiene, deterministic play buttons, pending-action timeouts, onboarding referrals, and group-linking admin tools

What Changed

• Menus no longer stack: the bot removes the previous transient menu before sending a new one and tracks last menu message per user so only one active menu card appears.
• Play button and play links are settings-aware and deterministic: browser mode opens external Runewager URLs, mini-app mode uses Telegram startapp/web_app launches; toggling play mode persists and re-renders menus.
• Pending input states enforce a 15-minute timeout with exact-boundary semantics (exactly 15 minutes stays valid), seed createdAt when missing, clear timed-out state, and show a user-facing timeout message using friendly labels.
• Onboarding gains a referral step: users can enter a referral code during onboarding only; self-referral and post-onboarding use are blocked; valid referral grants both users a 7-day 2× giveaway boost and records the referral for analytics; a share flow produces shareable HTML via Telegram share URL.
• Admin Group Linking Tools added: link/view/remove/test linked groups and test bot permissions from Settings/Admin menus.
• Discord and Telegram links are normalized so Discord joins always open externally; Telegram-wrapped URLs are unwrapped when possible.
• Smoke/test suite expanded: detects command handler forms (including const/backtick forms), ignores catch-all callback regexes for coverage, verifies navigation helpers, pending-action checks, and .env.example documents required keys.

Impact

✅ Fewer stale menu cards in chats
✅ Deterministic Play launches (browser vs mini-app) based on user setting
✅ Fewer stuck pending inputs and clearer timeout recovery

💡 Usage Guide

Checking Your Pull Request

Every time you make a pull request, our system automatically looks through it. We check for security issues, mistakes in how you're setting up your infrastructure, and common code problems. We do this to make sure your changes are solid and won't cause any trouble later.

Talking to CodeAnt AI

Got a question or need a hand with something in your pull request? You can easily get in touch with CodeAnt AI right here. Just type the following in a comment on your pull request, and replace "Your question here" with whatever you want to ask:

@codeant-ai ask: Your question here

This lets you have a chat with CodeAnt AI about your pull request, making it easier to understand and improve your code.

Example

@codeant-ai ask: Can you suggest a safer alternative to storing this secret?

Preserve Org Learnings with CodeAnt

You can record team preferences so CodeAnt AI applies them in future reviews. Reply directly to the specific CodeAnt AI suggestion (in the same thread) and replace "Your feedback here" with your input:

@codeant-ai: Your feedback here

This helps CodeAnt AI learn and adapt to your team's coding style and standards.

Example

@codeant-ai: Do not flag unused imports.

Retrigger review

Ask CodeAnt AI to review the PR again, by typing:

@codeant-ai: review

Check Your Repository Health

To analyze the health of your code repository, visit our dashboard at https://app.codeant.ai. This tool helps you identify potential issues and areas for improvement in your codebase, ensuring your repository maintains high standards of code health.

Summary by CodeRabbit

• New Features

  • Referral system: Generate and share referral codes to earn rewards.
  • Group linking tools for administrative purposes.
  • Enhanced onboarding with referral prompts and 2× boost rewards for 7 days when using a referral code.
  • Improved play flow with automatic browser/miniapp mode detection.
  • Cleaner menu interface with single active menu per chat.

• Configuration

  • Added new environment variables for TLS certificates, image URLs, and privacy mode settings.

[codeant-ai]

CodeAnt AI is reviewing your PR.

---

Thanks for using CodeAnt! 🎉

We're free for open-source projects. if you're enjoying it, help us grow by sharing.

Share on X ·
Reddit ·
LinkedIn

[coderabbitai]

Warning

Rate limit exceeded

@gamblecodezcom has exceeded the limit for the number of commits that can be reviewed per hour. Please wait 12 minutes and 49 seconds before requesting another review.

⌛ How to resolve this issue?

After the wait time has elapsed, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout.

Please see our FAQ for further information.

📥 Commits

Reviewing files that changed from the base of the PR and between 34d0519 and f1cce4f.

📒 Files selected for processing (7)

• .env.example
• CLAUDE.md
• RUNEWAGER_FUNCTIONALITY_MAP.md
• index.js
• load_tooltips.sh
• test/smoke.test.js
• test/unit.test.js

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Post copyable unit tests in a comment
• Commit unit tests in branch codex/perform-full-audit-and-implementation-for-runewager-bot-qwjwd0

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[codeant-ai]

Nitpicks 🔍

🔒 No security issues identified

⚡ Recommended areas for review HTML injection risk referralShareHTML interpolates code directly into an HTML template literal without escaping. If code is ever derived from user input or external sources this could allow HTML injection/XSS when the template is rendered in an HTML-capable context. Pending-action mutation evaluatePendingActionTimeout mutates user.pendingAction.createdAt and clears user.pendingAction on expiry. The code seeds createdAt with the passed now value without coercion and later uses Number(...) to compute age — this can lead to inconsistent types or NaN if createdAt is non-numeric. Also the function intentionally mutates input; callers should be aware of that side effect. Command detection gaps extractCommandHandlerNames resolves simple const-driven names and quoted literals but will not detect commands registered via complex expressions, variable concatenation, or helper wrappers. Verify the repository's registration patterns (e.g., helper wrappers, arrays, or dynamic builds) so REGISTERED_COMMANDS checks remain accurate. Catch-all detection The isCatchAllRegexPattern implementation compares a compacted source string against a small set of literal forms. It may miss grouped/anchored/case-insensitive variants (e.g. ^(?:.*)$, (?i)^.*$, or wrappers using non-capturing groups). This affects extractActionRegexPatterns filtering and may incorrectly treat some handlers as catch-all or miss some catch-alls. Callback extraction The extractLiteralIds regex for Markup.button.callback is strict and may miss callback/button shapes with additional args, nested objects, or whitespace variants. Also the logic skips templated backticks but might still include some edge cases; validate against real code shapes used elsewhere in the repo.

[codeant-ai]

CodeAnt AI finished reviewing your PR.