Skip to content

Add menu/menu-hygiene, referral & bonus admin flows, tooltip loader, env docs, and extensive tests #104

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
gamblecodezcom merged 2 commits into from
Feb 26, 2026
Merged

Add menu/menu-hygiene, referral & bonus admin flows, tooltip loader, env docs, and extensive tests #104

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
5423d9f
Harden referral HTML escaping and parser/timeout robustness
gamblecodezcom Feb 26, 2026
ab2a23d
Merge branch 'main' into codex/perform-full-audit-and-implementation-…
gamblecodezcom Feb 26, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
16 changes: 13 additions & 3 deletions index.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -520,9 +520,19 @@ function evaluatePendingActionTimeout(user, now = Date.now()) {
return { hadPending: false, expired: false, expiredType: null };
}

if (!user.pendingAction.createdAt) user.pendingAction.createdAt = now;
const nowMs = Number(now);
const safeNow = Number.isFinite(nowMs) ? nowMs : Date.now();
const createdRaw = user.pendingAction.createdAt;
const createdMs = Number(createdRaw);
if (!Number.isFinite(createdMs)) user.pendingAction.createdAt = safeNow;

const normalizedCreatedAt = Number(user.pendingAction.createdAt);
if (!Number.isFinite(normalizedCreatedAt)) {
user.pendingAction.createdAt = safeNow;
return { hadPending: true, expired: false, expiredType: null };
}

if ((now - Number(user.pendingAction.createdAt || 0)) <= PENDING_ACTION_TIMEOUT_MS) {
if ((safeNow - normalizedCreatedAt) <= PENDING_ACTION_TIMEOUT_MS) {
return { hadPending: true, expired: false, expiredType: null };
}

Expand Down Expand Up @@ -4651,7 +4661,7 @@ function referralShareHTML(code) {

Daily giveaways, instant rewards, drops, and a secret new-user bonus waiting inside the bot.

Use my code <b>${code}</b> when you start — we BOTH get a <b>2× boost on all giveaways for 7 days</b>.
Use my code <b>${escapeHtml(code)}</b> when you start — we BOTH get a <b>2× boost on all giveaways for 7 days</b>.

👉 <a href="https://t.me/RunewagerBot">Tap here to join Runewager</a>

Expand Down
33 changes: 32 additions & 1 deletion load_tooltips.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,35 @@
#!/usr/bin/env bash
#!/bin/bash

echo "=== GCZ — TOOLTIP PIPELINE EXECUTION ==="

cd /var/www/html/Runewager || exit 1

echo "[1] Pulling latest from origin main..."
git pull origin main || exit 1

echo "[2] Ensuring data directory exists..."
mkdir -p /var/www/html/Runewager/data

echo "[3] Ensuring tooltips.json exists..."
if [ ! -f /var/www/html/Runewager/data/tooltips.json ]; then
echo "[]" > /var/www/html/Runewager/data/tooltips.json
echo "Created empty tooltips.json"
fi

echo "[6] Adding data/tooltips.json to .gitignore if missing..."
grep -qxF "data/tooltips.json" .gitignore || echo "data/tooltips.json" >> .gitignore

echo "[7] Staging .gitignore only..."
git add .gitignore

echo "[8] Committing..."
git commit -m "GCZ: ensure tooltips.json exists, ignore it, and run load_tooltips.sh"

echo "[9] Pushing to origin main..."
git push origin main

echo "=== GCZ — DONE ==="

set -euo pipefail
Comment on lines +2 to 33

@codeant-ai codeant-ai Bot Feb 26, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggestion: The script enables set -euo pipefail only after running git pull, git add, git commit, and git push, so failures in those git commands (for example, authentication issues or rejected pushes) will be silently ignored while the script still prints a successful completion message; moving strict error handling to the top and only committing/pushing when there are staged changes ensures that genuine failures stop the pipeline instead of leaving the repo in an inconsistent state. [logic error]

Severity Level: Major ⚠️ 
- ⚠️ Tooltip seeding script may report success despite push failure.
- ⚠️ Remote origin/main may miss .gitignore tooltip entry.
- ⚠️ Operators may assume repo synced when it is not.
Suggested change
echo "=== GCZ — TOOLTIP PIPELINE EXECUTION ==="
cd /var/www/html/Runewager || exit 1
echo "[1] Pulling latest from origin main..."
git pull origin main || exit 1
echo "[2] Ensuring data directory exists..."
mkdir -p /var/www/html/Runewager/data
echo "[3] Ensuring tooltips.json exists..."
if [ ! -f /var/www/html/Runewager/data/tooltips.json ]; then
echo "[]" > /var/www/html/Runewager/data/tooltips.json
echo "Created empty tooltips.json"
fi
echo "[6] Adding data/tooltips.json to .gitignore if missing..."
grep -qxF "data/tooltips.json" .gitignore || echo "data/tooltips.json" >> .gitignore
echo "[7] Staging .gitignore only..."
git add .gitignore
echo "[8] Committing..."
git commit -m "GCZ: ensure tooltips.json exists, ignore it, and run load_tooltips.sh"
echo "[9] Pushing to origin main..."
git push origin main
echo "=== GCZ — DONE ==="
set -euo pipefail
set -euo pipefail
echo "=== GCZ — TOOLTIP PIPELINE EXECUTION ==="
cd /var/www/html/Runewager || exit 1
echo "[1] Pulling latest from origin main..."
git pull origin main
echo "[2] Ensuring data directory exists..."
mkdir -p /var/www/html/Runewager/data
echo "[3] Ensuring tooltips.json exists..."
if [ ! -f /var/www/html/Runewager/data/tooltips.json ]; then
echo "[]" > /var/www/html/Runewager/data/tooltips.json
echo "Created empty tooltips.json"
fi
echo "[6] Adding data/tooltips.json to .gitignore if missing..."
grep -qxF "data/tooltips.json" .gitignore || echo "data/tooltips.json" >> .gitignore
echo "[7] Staging .gitignore only..."
git add .gitignore
if git diff --cached --quiet; then
echo "[8] No changes to commit; skipping git commit/push."
else
echo "[8] Committing..."
git commit -m "GCZ: ensure tooltips.json exists, ignore it, and run load_tooltips.sh"
echo "[9] Pushing to origin main..."
git push origin main
fi
echo "=== GCZ — DONE ==="
Steps of Reproduction ✅ 
1. On the deployment host, ensure `/var/www/html/Runewager` is a git clone with `origin`
pointing at the main repo (script entrypoint at
`/workspace/Runewager/load_tooltips.sh:1-31`).

2. Create a condition where `git push origin main` will fail (for example, revoke push
permissions or misconfigure credentials) so that `git push` at `load_tooltips.sh:28-29`
exits with a non-zero status.

3. Run `bash load_tooltips.sh` from the repo root; observe that `git push origin main`
prints an error but the script continues because `set -euo pipefail` is only enabled later
at `load_tooltips.sh:33` and there is no `|| exit 1` on the push or commit.

4. Observe that the script prints `=== GCZ — DONE ===` (line 31) and then proceeds to
write `/var/www/html/Runewager/data/tooltips.json` and print `✅ Tooltips loaded
successfully into $OUT` (lines 35-59), while the remote `origin/main` does not contain the
new `.gitignore` change, leaving local and remote states inconsistent even though the
script reported success.
Prompt for AI Agent 🤖 
This is a comment left during a code review.

**Path:** load_tooltips.sh
**Line:** 2:33
**Comment:**
	*Logic Error: The script enables `set -euo pipefail` only after running `git pull`, `git add`, `git commit`, and `git push`, so failures in those git commands (for example, authentication issues or rejected pushes) will be silently ignored while the script still prints a successful completion message; moving strict error handling to the top and only committing/pushing when there are staged changes ensures that genuine failures stop the pipeline instead of leaving the repo in an inconsistent state.

Validate the correctness of the flagged issue. If correct, How can I resolve this? If you propose a fix, implement it and please make it concise.
👍 | 👎


OUT="/var/www/html/Runewager/data/tooltips.json"
Expand Down
10 changes: 8 additions & 2 deletions test/smoke.test.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -208,8 +208,14 @@ function extractActionRegexPatterns(source) {
* Supports `.*`, `^.*$`, and `.+` with optional grouping/anchors.
*/
function isCatchAllRegexPattern(patternSource) {
const compact = String(patternSource || '').replace(/\s+/g, '');
return compact === '.*' || compact === '^.*$' || compact === '.+' || compact === '^.+$';
let compact = String(patternSource || '').replace(/\s+/g, '');
compact = compact.replace(/^\^/, '').replace(/\$$/, '');
while (compact.startsWith('(') && compact.endsWith(')')) compact = compact.slice(1, -1);
compact = compact.replace(/^\?:/, '');

if (['.*', '.+', '.*?', '.+?'].includes(compact)) return true;
if (/^\(\?:?\.?\*\)$/.test(String(patternSource || '').replace(/\s+/g, ''))) return true;
return false;
}

/**
Expand Down
18 changes: 17 additions & 1 deletion test/unit.test.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -503,12 +503,21 @@ test('discord links remain external and unwrap telegram wrappers', () => {



function escapeHtml(text) {
return String(text || '')
.replace(/&/g, '&amp;')
.replace(/</g, '&lt;')
.replace(/>/g, '&gt;')
.replace(/"/g, '&quot;')
.replace(/'/g, '&#39;');
}

function referralShareHTML(code) {
return `<b>🚨 YO! I’m farming free SC on Runewager and you need to get in NOW.</b>

Daily giveaways, instant rewards, drops, and a secret new-user bonus waiting inside the bot.

Use my code <b>${code}</b> when you start — we BOTH get a <b>2× boost on all giveaways for 7 days</b>.
Use my code <b>${escapeHtml(code)}</b> when you start — we BOTH get a <b>2× boost on all giveaways for 7 days</b>.

👉 <a href="https://t.me/RunewagerBot">Tap here to join Runewager</a>

Expand Down Expand Up @@ -595,3 +604,10 @@ test('manual bonus policy allows requests without auto wager/API checks', () =>
assert.equal(checkBonusEligibilityLike({ status: 'bonus_sent', attempts: 1 }).ok, false);
assert.equal(checkBonusEligibilityLike({ status: 'none', attempts: 3 }).ok, false);
});


test('referralShareHTML escapes HTML-sensitive referral codes', () => {
const html = referralShareHTML('<img src=x onerror=1>');
assert.ok(!html.includes('<img'));
assert.ok(html.includes('&lt;img src=x onerror=1&gt;'));
});