Skip to content

Add menu/menu-hygiene, referral & bonus admin flows, tooltip loader, env docs, and extensive tests - #104

Merged
gamblecodezcom merged 2 commits into
mainfrom
codex/perform-full-audit-and-implementation-for-runewager-bot-owp4vy
Feb 26, 2026
Merged

Add menu/menu-hygiene, referral & bonus admin flows, tooltip loader, env docs, and extensive tests#104
gamblecodezcom merged 2 commits into
mainfrom
codex/perform-full-audit-and-implementation-for-runewager-bot-owp4vy

Conversation

@gamblecodezcom

@gamblecodezcom gamblecodezcom commented Feb 26, 2026

Copy link
Copy Markdown
Owner

User description

Motivation

  • Make menu behavior deterministic by enforcing a single-active-menu card and avoid stacked callback panels that confuse users.
  • Harden pending-input state handling with a labeled 15-minute timeout and safe escape routes to prevent stuck flows.
  • Add referral-onboarding, group-linking tools, and a manual 30 SC bonus review workflow with admin audit logging to support operational processes.
  • Ship runtime improvements: system tooltip loading, clearer environment documentation, safer external link handling, and broaden smoke/unit coverage to verify these behaviors.

Description

  • Introduced URL helpers and deterministic play button helpers: unwrapTelegramUrl, getDiscordLink, getPlayMode, getPlayLink, getPlayButton, and playButtonMarkup and switched menu play buttons to use them.
  • Added callback-query hygiene middleware that deletes the source callback message before replying, plus clearOldMenus(ctx) and replyMenu(ctx, user, ...) to enforce a single persistent/transient menu per user (stores last menu IDs on user objects).
  • Implemented pending-action timeout labeling and evaluation via ACTION_LABELS and evaluatePendingActionTimeout, with exact-15-minute boundary semantics and escape handling for /cancel, /menu, /start, and /help.
  • Added referral onboarding flow and helpers: referralCodeForUser, referralShareHTML, and applyOnboardingReferralCode to enforce one-time onboarding-only referral entry, self-referral prevention, and dual 7-day boost assignment recorded in referralStore.referrals.
  • Reworked 30 SC bonus flow to be manual-review-only: simplified checkBonusEligibility, admin actions (bonusAdminApprove, bonusAdminDeny, bonusAdminSent) log to /var/www/html/Runewager/logs/bonus_admin.log via appendBonusAdminLog, and added a user-facing bonus submenu (w30_*) and admin submenu (w30_admin_menu).
  • Added Group Linking Tools (link/view/remove/test) with callbacks and persistent configuration stored in approvedGroupsStore and helper UIs wired into Settings and Admin menus.
  • Added system tooltip support: bot now prefers /var/www/html/Runewager/data/tooltips.json (loaded in loadHelpfulMessages), and included the load_tooltips.sh operational script to seed and manage tooltips.json (and update .gitignore).
  • Updated .env.example to document BOT_PRIVACY_MODE, HTTPS cert/key envs, Telegram link vars, and moved some keys for clarity.
  • Synchronized docs and governance: updated RUNEWAGER_FUNCTIONALITY_MAP.md and CLAUDE.md to reflect the new behaviors/agent contract and operational notes.
  • Expanded and updated tests: large additions/changes in test/smoke.test.js and test/unit.test.js to cover menu hygiene, pending-action timeouts, play-mode behavior, referral flows, group-linking tools, admin bonus admin paths, and smoke-test expectations.

Testing

  • Ran the repository test suite (unit + smoke tests) via the project test runner; all tests passed after the changes, including new checks for callback-to-handler coverage, pending-action boundary behavior, play-button determinism, referral/onboarding rules, group-linking tool handlers, and TestAll summary formatting.
  • Added tests that exercise evaluatePendingActionTimeout, getPlayLink/getPlayButton, getDiscordLink unwrapping, referral logic, and static analysis helpers used by smoke checks, and confirmed they succeed.
  • Verified load_tooltips.sh creates and validates /var/www/html/Runewager/data/tooltips.json in CI-like validation (script syntax and JSON tool formatting).

Codex Task


CodeAnt-AI Description

Escape referral codes in bot messages, harden pending-action timeout handling, and ensure tooltip data exists

What Changed

  • Referral codes shown in share messages are HTML-escaped so injected tags or attributes no longer render in the message text.
  • Pending-action timeout logic now tolerates missing or malformed timestamps and correctly treats pending actions as unexpired until a valid time is available, preventing false expirations or crashes.
  • Tooltip loader script now creates a data/tooltips.json if missing, adds it to .gitignore, and runs a safe pull/commit/push flow to avoid missing tooltip data during deployment.
  • Unit and smoke tests added/updated to verify referral HTML escaping and improved regex/pattern detection.

Impact

✅ Prevents referral HTML injection
✅ Fewer false pending-action expirations
✅ Tooltip data file reliably present during deployments

💡 Usage Guide

Checking Your Pull Request

Every time you make a pull request, our system automatically looks through it. We check for security issues, mistakes in how you're setting up your infrastructure, and common code problems. We do this to make sure your changes are solid and won't cause any trouble later.

Talking to CodeAnt AI

Got a question or need a hand with something in your pull request? You can easily get in touch with CodeAnt AI right here. Just type the following in a comment on your pull request, and replace "Your question here" with whatever you want to ask:

@codeant-ai ask: Your question here

This lets you have a chat with CodeAnt AI about your pull request, making it easier to understand and improve your code.

Example

@codeant-ai ask: Can you suggest a safer alternative to storing this secret?

Preserve Org Learnings with CodeAnt

You can record team preferences so CodeAnt AI applies them in future reviews. Reply directly to the specific CodeAnt AI suggestion (in the same thread) and replace "Your feedback here" with your input:

@codeant-ai: Your feedback here

This helps CodeAnt AI learn and adapt to your team's coding style and standards.

Example

@codeant-ai: Do not flag unused imports.

Retrigger review

Ask CodeAnt AI to review the PR again, by typing:

@codeant-ai: review

Check Your Repository Health

To analyze the health of your code repository, visit our dashboard at https://app.codeant.ai. This tool helps you identify potential issues and areas for improvement in your codebase, ensuring your repository maintains high standards of code health.

@codeant-ai

codeant-ai Bot commented Feb 26, 2026

Copy link
Copy Markdown

CodeAnt AI is reviewing your PR.


Thanks for using CodeAnt! 🎉

We're free for open-source projects. if you're enjoying it, help us grow by sharing.

Share on X ·
Reddit ·
LinkedIn

@coderabbitai

coderabbitai Bot commented Feb 26, 2026

Copy link
Copy Markdown

Warning

Rate limit exceeded

@gamblecodezcom has exceeded the limit for the number of commits that can be reviewed per hour. Please wait 11 minutes and 38 seconds before requesting another review.

⌛ How to resolve this issue?

After the wait time has elapsed, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout.

Please see our FAQ for further information.

📥 Commits

Reviewing files that changed from the base of the PR and between 084a267 and ab2a23d.

📒 Files selected for processing (4)
  • index.js
  • load_tooltips.sh
  • test/smoke.test.js
  • test/unit.test.js
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Post copyable unit tests in a comment
  • Commit unit tests in branch codex/perform-full-audit-and-implementation-for-runewager-bot-owp4vy

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands and usage tips.

@gamblecodezcom
gamblecodezcom merged commit 9593630 into main Feb 26, 2026
2 checks passed
@gamblecodezcom
gamblecodezcom deleted the codex/perform-full-audit-and-implementation-for-runewager-bot-owp4vy branch February 26, 2026 23:39
@codeant-ai codeant-ai Bot added the size:M This PR changes 30-99 lines, ignoring generated files label Feb 26, 2026
Comment thread load_tooltips.sh
Comment on lines +2 to 33

echo "=== GCZ — TOOLTIP PIPELINE EXECUTION ==="

cd /var/www/html/Runewager || exit 1

echo "[1] Pulling latest from origin main..."
git pull origin main || exit 1

echo "[2] Ensuring data directory exists..."
mkdir -p /var/www/html/Runewager/data

echo "[3] Ensuring tooltips.json exists..."
if [ ! -f /var/www/html/Runewager/data/tooltips.json ]; then
echo "[]" > /var/www/html/Runewager/data/tooltips.json
echo "Created empty tooltips.json"
fi

echo "[6] Adding data/tooltips.json to .gitignore if missing..."
grep -qxF "data/tooltips.json" .gitignore || echo "data/tooltips.json" >> .gitignore

echo "[7] Staging .gitignore only..."
git add .gitignore

echo "[8] Committing..."
git commit -m "GCZ: ensure tooltips.json exists, ignore it, and run load_tooltips.sh"

echo "[9] Pushing to origin main..."
git push origin main

echo "=== GCZ — DONE ==="

set -euo pipefail

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggestion: The script enables set -euo pipefail only after running git pull, git add, git commit, and git push, so failures in those git commands (for example, authentication issues or rejected pushes) will be silently ignored while the script still prints a successful completion message; moving strict error handling to the top and only committing/pushing when there are staged changes ensures that genuine failures stop the pipeline instead of leaving the repo in an inconsistent state. [logic error]

Severity Level: Major ⚠️
- ⚠️ Tooltip seeding script may report success despite push failure.
- ⚠️ Remote origin/main may miss .gitignore tooltip entry.
- ⚠️ Operators may assume repo synced when it is not.
Suggested change
echo "=== GCZ — TOOLTIP PIPELINE EXECUTION ==="
cd /var/www/html/Runewager || exit 1
echo "[1] Pulling latest from origin main..."
git pull origin main || exit 1
echo "[2] Ensuring data directory exists..."
mkdir -p /var/www/html/Runewager/data
echo "[3] Ensuring tooltips.json exists..."
if [ ! -f /var/www/html/Runewager/data/tooltips.json ]; then
echo "[]" > /var/www/html/Runewager/data/tooltips.json
echo "Created empty tooltips.json"
fi
echo "[6] Adding data/tooltips.json to .gitignore if missing..."
grep -qxF "data/tooltips.json" .gitignore || echo "data/tooltips.json" >> .gitignore
echo "[7] Staging .gitignore only..."
git add .gitignore
echo "[8] Committing..."
git commit -m "GCZ: ensure tooltips.json exists, ignore it, and run load_tooltips.sh"
echo "[9] Pushing to origin main..."
git push origin main
echo "=== GCZ — DONE ==="
set -euo pipefail
set -euo pipefail
echo "=== GCZ — TOOLTIP PIPELINE EXECUTION ==="
cd /var/www/html/Runewager || exit 1
echo "[1] Pulling latest from origin main..."
git pull origin main
echo "[2] Ensuring data directory exists..."
mkdir -p /var/www/html/Runewager/data
echo "[3] Ensuring tooltips.json exists..."
if [ ! -f /var/www/html/Runewager/data/tooltips.json ]; then
echo "[]" > /var/www/html/Runewager/data/tooltips.json
echo "Created empty tooltips.json"
fi
echo "[6] Adding data/tooltips.json to .gitignore if missing..."
grep -qxF "data/tooltips.json" .gitignore || echo "data/tooltips.json" >> .gitignore
echo "[7] Staging .gitignore only..."
git add .gitignore
if git diff --cached --quiet; then
echo "[8] No changes to commit; skipping git commit/push."
else
echo "[8] Committing..."
git commit -m "GCZ: ensure tooltips.json exists, ignore it, and run load_tooltips.sh"
echo "[9] Pushing to origin main..."
git push origin main
fi
echo "=== GCZ — DONE ==="
Steps of Reproduction ✅
1. On the deployment host, ensure `/var/www/html/Runewager` is a git clone with `origin`
pointing at the main repo (script entrypoint at
`/workspace/Runewager/load_tooltips.sh:1-31`).

2. Create a condition where `git push origin main` will fail (for example, revoke push
permissions or misconfigure credentials) so that `git push` at `load_tooltips.sh:28-29`
exits with a non-zero status.

3. Run `bash load_tooltips.sh` from the repo root; observe that `git push origin main`
prints an error but the script continues because `set -euo pipefail` is only enabled later
at `load_tooltips.sh:33` and there is no `|| exit 1` on the push or commit.

4. Observe that the script prints `=== GCZ — DONE ===` (line 31) and then proceeds to
write `/var/www/html/Runewager/data/tooltips.json` and print `✅ Tooltips loaded
successfully into $OUT` (lines 35-59), while the remote `origin/main` does not contain the
new `.gitignore` change, leaving local and remote states inconsistent even though the
script reported success.
Prompt for AI Agent 🤖
This is a comment left during a code review.

**Path:** load_tooltips.sh
**Line:** 2:33
**Comment:**
	*Logic Error: The script enables `set -euo pipefail` only after running `git pull`, `git add`, `git commit`, and `git push`, so failures in those git commands (for example, authentication issues or rejected pushes) will be silently ignored while the script still prints a successful completion message; moving strict error handling to the top and only committing/pushing when there are staged changes ensures that genuine failures stop the pipeline instead of leaving the repo in an inconsistent state.

Validate the correctness of the flagged issue. If correct, How can I resolve this? If you propose a fix, implement it and please make it concise.
👍 | 👎

@codeant-ai

codeant-ai Bot commented Feb 26, 2026

Copy link
Copy Markdown

CodeAnt AI finished reviewing your PR.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

codex size:M This PR changes 30-99 lines, ignoring generated files

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant