Add persistent-menu hygiene, deterministic Play button, referrals, QA tooling, tooltips, and 30 SC manual-review admin flows

[gamblecodezcom]

User description

Motivation

• Improve menu UX by preventing stacked/stale inline menus and make Play button behavior deterministic between browser vs mini-app modes.
• Add onboarding referral support (one-time code entry during onboarding) and a clear manual-review 30 SC bonus workflow with admin audit logging.
• Provide QA artifacts and runtime QA controls to assist testers and automated diagnostics, and make system tooltips manageable via a deployable loader script.
• Synchronize documentation (functionality map and operator guidance) and surface runtime env keys in .env.example for easier production configuration.

Description

• Added navigation/menu hygiene: clearOldMenus, replyMenu, and callback-query middleware to delete source panels before sending replacements, and made persistent menu send/delete behavior consistent across flows.
• Implemented deterministic Play-button helpers (getPlayMode, getPlayLink, getPlayButton, playButtonMarkup) so browser mode uses an external URL and mini-app mode uses a Telegram web_app link; updated main and persistent menus to use the unified helper.
• Introduced referral onboarding and referral application logic (applyOnboardingReferralCode, referral storage, share HTML) with protections against self-referral and post-onboarding application, plus referral-related menu callbacks and onboarding prompts.
• Reworked 30 SC bonus flow to be manual-review only: eligibility simplified, request submission records an admin audit line (appendBonusAdminLog), new admin submenu for bonus reviews and actions, and admin-side logging to /var/www/html/Runewager/logs/bonus_admin.log.
• Added QA tooling and artifacts: /qa commands (/qa_on, /qa_off, /qa_mode, /qa_status), qa/context and qa/state files, ensureQaArtifacts() and runtime QA helpers with provider fallback metadata and logs; integrated periodic provider cooldown refresh.
• Added system tooltips support and loader script: load_tooltips.sh populates /var/www/html/Runewager/data/tooltips.json with approved HTML tooltips and .env.example now documents HTTPS_CERT_PATH, HTTPS_KEY_PATH, BOT_PRIVACY_MODE, and other runtime keys.
• Implemented pending-action timeout utilities (evaluatePendingActionTimeout, ACTION_LABELS) with exact-15-minute boundary semantics and integrated timeout handling into the text router; added related tests and smoke-test enhancements.
• Multiple admin and group-linking tools added: group linking UI in Settings (settings_group_linking_tools), link/view/remove/test permission callbacks, and persistence in approvedGroupsStore.
• Updated docs and maps: RUNEWAGER_FUNCTIONALITY_MAP.md and CLAUDE.md were synchronized with new behaviors and agent/QA contracts.
• Tests and test helpers updated: test/smoke.test.js and test/unit.test.js extended to cover new helpers, catch-all regex handling, command/callback coverage rules, environment docs, pending-action boundary behavior, and many new invariants.

Testing

• Ran the automated test suite: test/unit.test.js and test/smoke.test.js (extended coverage); all unit and smoke tests were executed and passed locally against the modified codebase.
• New smoke tests verify: callback-to-handler coverage (literal and regex), registered command parity (including const/backtick forms), pending-action timeout semantics and boundary, catch-all regex filtering, presence of QA artifacts, .env.example documentation, and play-button deterministic behavior.
• Load/script sanity: load_tooltips.sh was added and validated to write well-formed JSON (script produces expected output path and success message), and QA artifact generation functions were exercised by smoke checks.

---

Codex Task

---

CodeAnt-AI Description

Deterministic Play button, single-active menu hygiene, referrals, QA tooling, tooltips, and manual-review 30 SC admin flows

What Changed

• Menus no longer stack: callbacks now clear the previous transient menu card before sending a replacement so users see a single active menu per chat.
• Play button behavior is deterministic: browser mode opens the external Runewager site; mini-app mode opens the Telegram web_app/startapp link. All menus use the unified helper and no longer mix launch methods.
• Referral onboarding and application: users can enter a one-time referral code during onboarding; self-referral and post-onboarding use are blocked; referral grants a 7-day 2× giveaway boost and is recorded for auditing.
• 30 SC bonus is manual-review only: users submit requests with clear copy; admin submenu exposes pending/approve/deny/reset actions and writes audit lines to a server-side log for traceability.
• QA scaffolding and diagnostics: added /qa control commands, persistent QA artifacts (capabilities, repo info, provider state), daily QA logs, and test-suite updates that cover new helpers and navigation rules.
• System tooltips and loader script: added load_tooltips.sh and runtime support to prefer a system tooltips JSON to provide deployable HTML guidance.
• Pending-action and SSHV fixes: pending-action timeouts use human-friendly labels and exact-15-minute boundary semantics; SSHV run prompt and admin DM flows are hardened to execute against active sessions if desynced.
• Group linking tools exposed in Settings: admins can link/view/remove/test linked groups from a dedicated submenu.

Impact

✅ Fewer stacked menus
✅ Deterministic Play launches
✅ Clearer referral and manual-review bonus workflows

💡 Usage Guide

Checking Your Pull Request

Every time you make a pull request, our system automatically looks through it. We check for security issues, mistakes in how you're setting up your infrastructure, and common code problems. We do this to make sure your changes are solid and won't cause any trouble later.

Talking to CodeAnt AI

Got a question or need a hand with something in your pull request? You can easily get in touch with CodeAnt AI right here. Just type the following in a comment on your pull request, and replace "Your question here" with whatever you want to ask:

@codeant-ai ask: Your question here

This lets you have a chat with CodeAnt AI about your pull request, making it easier to understand and improve your code.

Example

@codeant-ai ask: Can you suggest a safer alternative to storing this secret?

Preserve Org Learnings with CodeAnt

You can record team preferences so CodeAnt AI applies them in future reviews. Reply directly to the specific CodeAnt AI suggestion (in the same thread) and replace "Your feedback here" with your input:

@codeant-ai: Your feedback here

This helps CodeAnt AI learn and adapt to your team's coding style and standards.

Example

@codeant-ai: Do not flag unused imports.

Retrigger review

Ask CodeAnt AI to review the PR again, by typing:

@codeant-ai: review

Check Your Repository Health

To analyze the health of your code repository, visit our dashboard at https://app.codeant.ai. This tool helps you identify potential issues and areas for improvement in your codebase, ensuring your repository maintains high standards of code health.

[codeant-ai]

CodeAnt AI is reviewing your PR.

---

Thanks for using CodeAnt! 🎉

We're free for open-source projects. if you're enjoying it, help us grow by sharing.

Share on X ·
Reddit ·
LinkedIn

[coderabbitai]

Warning

Rate limit exceeded

@gamblecodezcom has exceeded the limit for the number of commits that can be reviewed per hour. Please wait 27 minutes and 18 seconds before requesting another review.

⌛ How to resolve this issue?

After the wait time has elapsed, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout.

Please see our FAQ for further information.

📥 Commits

Reviewing files that changed from the base of the PR and between 39ef496 and 712e007.

📒 Files selected for processing (7)

• CLAUDE.md
• RUNEWAGER_FUNCTIONALITY_MAP.md
• index.js
• qa/README_QA.md
• qa/context/bot_capabilities.json
• qa/context/repo_info.json
• qa/state/provider_status.json

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Post copyable unit tests in a comment
• Commit unit tests in branch codex/perform-full-audit-and-implementation-for-runewager-bot-w1l0es

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[codeant-ai]

Nitpicks 🔍

🔒 No security issues identified

⚡ Recommended areas for review Catch-all Detection isCatchAllRegexPattern() performs normalization and pattern checks but may miss or mis-classify some equivalent catch-all forms (for example nested non-capturing groups, optional anchors, or whitespace/formatting variants). Review and extend the detection to reliably identify forms like ^.$, (?:.), ^(?:.*)$, and other logically equivalent patterns so catch-all handlers are never counted for coverage. Filtering Logic The extractActionRegexPatterns() loop now guards insertion with isCatchAllRegexPattern(patternSource). Confirm the patternSource shape produced by parseRegexLiteral() matches what isCatchAllRegexPattern() expects and that legitimate non-catch patterns are not incorrectly filtered out. Also validate that the check occurs at the right place (before constructing RegExp) and that malformed patterns aren't silently skipped when they should be surfaced. Command detection gap extractCommandHandlerNames() resolves command names from simple const declarations but the const regex requires a trailing semicolon and only inspects const (not let/var) forms. That can miss handlers declared via other declaration styles or without semicolons, producing false negatives in REGISTERED_COMMANDS coverage checks. Consider broadening constant resolution and token parsing. XSS risk The script writes raw HTML strings into a web‑accessible JSON file (data/tooltips.json) that will likely be rendered in clients. If those HTML snippets are served to users without server‑side sanitization/escaping, this can lead to stored XSS or UI injection. Verify where and how tooltips.json is consumed and ensure sanitization/escaping or a safe rendering policy. Atomic write / partial file risk The file is created/written in place via a heredoc and then validated. If the process is interrupted, consumers might read a partial or invalid JSON file. Use an atomic write pattern (temp file + mv) and validate before replacing the live file. Repo operations / accidental push The script runs git pull and may commit & push .gitignore automatically. Running automated pushes from a deployment/production machine can leak credentials or cause unintended changes on origin. Consider making pushes manual or gated by an explicit environment flag. Hardcoded paths & permission assumptions The script uses hardcoded /var/www/html/Runewager paths and cd into them. This assumes correct user, ownership and permissions; if run as the wrong user it could fail or create files with insecure permissions. Confirm required user/permissions and consider clearer checks or safer path handling. URL parsing edge unwrapTelegramUrl and getDiscordLink perform hostname checks and parsing but silently swallow parsing errors and accept a few host variants. Verify behaviour for more variants (e.g. uppercase hosts, www.t.me, unexpected query parameter shapes) and ensure the fallback URL and security expectations are correct.

[codeant-ai]

CodeAnt AI finished reviewing your PR.