Introduce single-active-menu UX, referral onboarding, deterministic Play button, manual 30 SC review + tooltips support

[gamblecodezcom]

User description

Motivation

• Prevent menu-card stacking and make Play links deterministic between browser vs mini-app modes.
• Add onboarding referral support with a 2× giveaway boost, and move 30 SC bonus to a manual review/admin workflow with audit logging.
• Surface runtime config for Telegram/HTTPS and enable system-managed HTML tooltips for richer help content.

Description

• Added unified play helpers (getPlayMode, getPlayLink, getPlayButton, playButtonMarkup) and wired main/persistent menus to use them so Play behavior is deterministic for browser vs mini-app.
• Implemented single-active-menu behavior with clearOldMenus, replyMenu, and per-user lastMenuMsgId/lastMenuChatId tracking; callback-query middleware deletes source callback cards to avoid stacked menus.
• Added pending-action timeout handling via evaluatePendingActionTimeout and human-friendly ACTION_LABELS, with exact-15-minute boundary semantics and slash-command escape handling preserved.
• Added referral onboarding flow (await_referral_code, applyOnboardingReferralCode), referral sharing HTML, referral data in referralStore.referrals, and a referral submenu (code/share/how-it-works).
• Reworked 30 SC bonus flow to be manual-review only: simplified eligibility checks, submission flow (submitBonusRequest), admin tools for approve/deny/sent, and append-only admin audit logging to /var/www/html/Runewager/logs/bonus_admin.log.
• Added group linking tools under Settings (link/view/remove/test permissions) plus supporting handlers and persisted approvedGroupsStore integration.
• Added system tooltip support: systemTooltipsFile path and load_tooltips.sh script to seed /var/www/html/Runewager/data/tooltips.json; loadHelpfulMessages will prefer this system file.
• Read BOT_PRIVACY_MODE and documented core env variables and HTTPS cert/key paths in .env.example; reorganized/added several env entries and example links.
• Multiple smaller safety/UX fixes: unwrapTelegramUrl/getDiscordLink, callback hygiene middleware, many menu labels updated, admin dashboard additions (30 SC admin submenu), and numerous persistence/serialization updates.
• Tests updated: test/smoke.test.js and test/unit.test.js extended to assert new behaviors (menu hygiene, play button determinism, pending-action boundary, referral flow, tooltips/script presence, TestAll summary line, catch-all regex filtering, and others).

Testing

• Ran the repo test suites via the project test runner (npm test / Node's node:test) covering test/smoke.test.js and test/unit.test.js. All tests passed locally.
• Executed smoke checks that validate command/callback parity, critical diagnostic categories, pending-action boundary semantics, and play-button/link behavior; these checks succeeded.
• Verified load_tooltips.sh creates the system tooltip JSON path and that loadHelpfulMessages will prefer the system file when present (script and path existence asserted by tests).

---

Codex Task

---

CodeAnt-AI Description

Ensure load_tooltips.sh only commits .gitignore changes

What Changed

• The script now checks staged changes only for .gitignore before committing, so it won't create or push commits when unrelated files are staged
• If .gitignore has no staged changes the script skips the commit/push step and reports that it skipped
• Keeps tooltip data file handling unchanged while avoiding accidental repository commits during the load step

Impact

✅ Fewer unintended repository commits
✅ Safer deployment script runs
✅ Clearer commit/push outcomes during tooltip updates

💡 Usage Guide

Checking Your Pull Request

Every time you make a pull request, our system automatically looks through it. We check for security issues, mistakes in how you're setting up your infrastructure, and common code problems. We do this to make sure your changes are solid and won't cause any trouble later.

Talking to CodeAnt AI

Got a question or need a hand with something in your pull request? You can easily get in touch with CodeAnt AI right here. Just type the following in a comment on your pull request, and replace "Your question here" with whatever you want to ask:

@codeant-ai ask: Your question here

This lets you have a chat with CodeAnt AI about your pull request, making it easier to understand and improve your code.

Example

@codeant-ai ask: Can you suggest a safer alternative to storing this secret?

Preserve Org Learnings with CodeAnt

You can record team preferences so CodeAnt AI applies them in future reviews. Reply directly to the specific CodeAnt AI suggestion (in the same thread) and replace "Your feedback here" with your input:

@codeant-ai: Your feedback here

This helps CodeAnt AI learn and adapt to your team's coding style and standards.

Example

@codeant-ai: Do not flag unused imports.

Retrigger review

Ask CodeAnt AI to review the PR again, by typing:

@codeant-ai: review

Check Your Repository Health

To analyze the health of your code repository, visit our dashboard at https://app.codeant.ai. This tool helps you identify potential issues and areas for improvement in your codebase, ensuring your repository maintains high standards of code health.

[codeant-ai]

CodeAnt AI is reviewing your PR.

---

Thanks for using CodeAnt! 🎉

We're free for open-source projects. if you're enjoying it, help us grow by sharing.

Share on X ·
Reddit ·
LinkedIn

[coderabbitai]

Warning

Rate limit exceeded

@gamblecodezcom has exceeded the limit for the number of commits that can be reviewed per hour. Please wait 14 minutes and 16 seconds before requesting another review.

⌛ How to resolve this issue?

After the wait time has elapsed, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout.

Please see our FAQ for further information.

📥 Commits

Reviewing files that changed from the base of the PR and between 0ef3f17 and 2b9ce02.

📒 Files selected for processing (1)

• load_tooltips.sh

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Post copyable unit tests in a comment
• Commit unit tests in branch codex/perform-full-audit-and-implementation-for-runewager-bot-k9j3jh

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[codeant-ai]

Nitpicks 🔍

🔒 No security issues identified

⚡ Recommended areas for review Possible Bug The git diff --cached --quiet -- .gitignore check only inspects staged changes for .gitignore. If other files are staged, this condition will be true (no changes to .gitignore) and the script will skip committing/pushing, leaving other staged changes uncommitted. Confirm intended behavior (check whole index vs a single path). Commit Scope The commit invocation git commit -m "..." -- .gitignore restricts the commit to .gitignore only. Combined with the limited diff check above, this can lead to inconsistencies if the intent was to commit any staged changes or to ensure .gitignore is committed when modified. Verify whether the script should commit the entire index or only .gitignore.

[codeant-ai]

CodeAnt AI finished reviewing your PR.