Claude/pr51 fixes lq2g s

[gamblecodezcom]

User description

Summary by CodeRabbit

Release Notes

• New Features

  • Smart Runewager username detection with one-click confirmation flow
  • Seamless bonus request resumption after account linking
  • Admin-only live deployment command with real-time status updates
  • Admin notifications when bot comes online

• Improvements

  • Enhanced system compatibility and restart stability across different environments
  • Better error handling during deployment processes

---

CodeAnt-AI Description

Link Runewager username by typing it naturally and resume bonus requests without extra steps

What Changed

• Typing a valid Runewager username anywhere prompts an inline confirmation so users can link their account without running a command
• If a user starts the 30 SC bonus flow without a linked username, the bot asks for the username inline and automatically continues the bonus request after linking
• Eligibility checks now indicate when a username is specifically missing so flows can distinguish that case
• Admins can run a new in-chat deploy command that pulls latest code, installs dependencies, notifies admins, and restarts the bot
• Startup now sends a silent "bot online" notification to all admins so deployments/restarts are confirmed
• Deployment/start scripts improved: automatic fallback project path, safer restart behavior (prefer systemd, otherwise kill+nohup), and validation guards for systems missing systemctl/logrotate/crontab

Impact

✅ Shorter bonus request
✅ Fewer interrupted bonus requests
✅ Remote in-chat deploy with restart confirmation

💡 Usage Guide

Checking Your Pull Request

Every time you make a pull request, our system automatically looks through it. We check for security issues, mistakes in how you're setting up your infrastructure, and common code problems. We do this to make sure your changes are solid and won't cause any trouble later.

Talking to CodeAnt AI

Got a question or need a hand with something in your pull request? You can easily get in touch with CodeAnt AI right here. Just type the following in a comment on your pull request, and replace "Your question here" with whatever you want to ask:

@codeant-ai ask: Your question here

This lets you have a chat with CodeAnt AI about your pull request, making it easier to understand and improve your code.

Example

@codeant-ai ask: Can you suggest a safer alternative to storing this secret?

Preserve Org Learnings with CodeAnt

You can record team preferences so CodeAnt AI applies them in future reviews. Reply directly to the specific CodeAnt AI suggestion (in the same thread) and replace "Your feedback here" with your input:

@codeant-ai: Your feedback here

This helps CodeAnt AI learn and adapt to your team's coding style and standards.

Example

@codeant-ai: Do not flag unused imports.

Retrigger review

Ask CodeAnt AI to review the PR again, by typing:

@codeant-ai: review

Check Your Repository Health

To analyze the health of your code repository, visit our dashboard at https://app.codeant.ai. This tool helps you identify potential issues and areas for improvement in your codebase, ensuring your repository maintains high standards of code health.

[codeant-ai]

CodeAnt AI is reviewing your PR.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

[coderabbitai]

Caution

Review failed

The pull request is closed.

📝 Walkthrough

Walkthrough

Added deployment functionality with admin-only command for live git and npm operations, restart signaling, and bot startup notifications. Introduced smart username detection for Runewager accounts with confirmation flow and mid-bonus-request restoration. Enhanced prod-run.sh with fallback directory resolution and conditional guards for systemctl, logrotate, and crontab utilities.

Changes

Cohort / File(s)	Summary
Deployment and Admin Notifications index.js	Added admin-only /deploy command executing git pull and npm ci with live status updates, systemctl restart with fallback, and post-restart admin notifications. Added startup flow to notify all admins when bot comes online, including UTC timestamp and process details.
Smart Username Detection and Confirmation index.js	Introduced automatic detection of free-form Runewager usernames in text handler when no pending action exists. Added confirm_smart_username action handler to finalize username linking, update onboarding state, award XP, and support mid-flow resumption via returnTo field in pending actions.
Bonus Flow Mid-Flight Restoration index.js	Added logic to resume interrupted bonus flows (e.g., w30 requests) after username is confirmed via smart detection path. Re-evaluates eligibility and continues with appropriate next steps or wager prompts.
Helper Functions and Imports index.js	Added child_process (execFile, spawn) imports, PROJECT_DIR constant, and runCmd helper function that executes shell commands and resolves with standardized { ok, out, err } structure instead of throwing errors.
Script Resilience and Fallbacks prod-run.sh	Added fallback project directory resolution for VPS deployments; conditional systemctl, logrotate, and crontab usage with warnings when utilities unavailable. Reworked restart logic to use unified safe-restart workflow with kill\+nohup fallback when systemd unavailable.

Sequence Diagrams

sequenceDiagram
    actor User
    participant Bot
    participant DataStore as Data Store
    participant BonusFlow as Bonus Flow

    User->>Bot: Types Runewager username (no pending action)
    Bot->>Bot: Smart detection triggered
    Bot->>User: Prompts to confirm/modify username
    User->>Bot: Confirms username (confirm_smart_username)
    Bot->>DataStore: Link username to user account
    Bot->>DataStore: Update onboarding state
    Bot->>DataStore: Award XP
    alt returnTo field exists (mid-flow)
        Bot->>BonusFlow: Resume pending flow (e.g., w30_bonus)
        BonusFlow->>BonusFlow: Re-evaluate eligibility
        BonusFlow->>User: Continue with next step
    else No pending flow
        Bot->>User: Confirm linking complete
    end

Loading

sequenceDiagram
    actor Admin
    participant Bot
    participant System as System (git/npm)
    participant Systemd as Systemctl/Init
    participant AdminNotif as Admin Notification

    Admin->>Bot: Issues /deploy command
    Bot->>Bot: Validates admin permission
    Bot->>Admin: Sends live status: starting deployment
    Bot->>System: Execute git pull
    Bot->>Admin: Sends live status: git pull result
    Bot->>System: Execute npm ci
    Bot->>Admin: Sends live status: npm ci result
    Bot->>Systemd: Attempt systemctl restart
    alt systemctl success
        Systemd->>Bot: Service restarted
    else systemctl unavailable/fails
        Bot->>System: Fallback: kill + nohup restart
        System->>Bot: Process restarted
    end
    Bot->>Admin: Sends deployment complete status
    Note over Bot,Admin: On bot startup, admin receives<br/>online notification with timestamp

Loading

Estimated code review effort

🎯 4 (Complex) | ⏱️ ~60 minutes

Poem

🐰 The bot now deploys with a hop and a bound,
Smart usernames detected without a sound,
Admins get notified when all is well,
Mid-flow bonuses now resume to tell,
Scripts guard their gates with conditional care,
A rabbit's delight—improvements everywhere! ✨

---

Note

🎁 Summarized by CodeRabbit Free

Your organization is on the Free plan. CodeRabbit will generate a high-level summary and a walkthrough for each pull request. For a comprehensive line-by-line review, please upgrade your subscription to CodeRabbit Pro by visiting https://app.coderabbit.ai/login.

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[codeant-ai]

Nitpicks 🔍

🔒 No security issues identified

⚡ Recommended areas for review Deploy Risk New admin-only /deploy executes git pull, npm ci and attempts a systemctl restart. This merges remote code and runs install/restart on the host — if an admin account is compromised or admin IDs misconfigured this provides an easy path for arbitrary code to land and run. Confirm authorization boundaries, logging, and a safe rollback strategy before using in production. Command execution feedback The runCmd + deploy flow posts git/npm stdout/stderr into Telegram messages. Those outputs can include long text or characters that break Markdown and might leak internal details (paths, errors). Consider sanitising/escaping and truncating output before sending to chats. Deployment path detection The fallback logic sets PROJECT_DIR to a hard-coded VPS path if the script's directory doesn't contain index.js. This can misdetect when the script is symlinked or when deployments live in different locations. Also there is no way to override the fallback path via environment variable, which reduces flexibility for automated deploys. Username detection regex Smart username detection regex uses /^[A-Za-z0-9_.\\-]{3,30}$/ which contains an extra backslash escape sequence. This may unintentionally allow backslashes in detected usernames. Validate allowed characters against Runewager username rules. Systemd handling consistency The PR adds guarding when calling systemctl in service installation and restart flows, which is good. Verify that all usages of systemctl throughout the script are consistently guarded (otherwise the script can behave differently or error on non-systemd systems).

[codeant-ai]

Suggestion: The /deploy command restarts the bot process even when git pull or npm ci fail, meaning it can deliberately restart into a broken or partially updated state contrary to the intended "pull, install, then restart" flow, likely causing the new process to crash or misbehave until manually fixed. [logic error]

Severity Level: Critical 🚨

- ❌ /deploy can restart bot after failed git or npm steps.
- ⚠️ Bot may restart into inconsistent or broken deployment state.

Suggested change

	await edit(
	if (!allOk) {
	await edit(
	`🚀 *Deployment summary* — ${ts()}\n\n`
	+ `${gitLine}\n`
	+ `${npmLine}\n\n`
	+ `${summary}\n\n`
	+ `③ Restart skipped — one or more steps failed.`,
	);
	return;
	}

Steps of Reproduction ✅

1. As an admin (ID present in `ADMIN_IDS` from `index.js:14-18`), run the `/deploy`
command in Telegram, which executes the handler defined at `index.js:1216-1280`
(`bot.command('deploy', async (ctx) => { ... })` after passing `requireAdmin(ctx)` at
`index.js:1200-1207`).

2. In an environment where `git pull` fails (e.g. merge conflict, network issue, or local
changes), the call `runCmd('git', ['pull', 'origin', 'main'], PROJECT_DIR, 30000)` at
`index.js:1234` returns `{ ok: false, err: '...' }`, so `gitResult.ok` is `false` and
`gitLine` describes the failure.

3. The subsequent `npm ci` step runs via `runCmd('npm', ['ci', '--omit=dev'], PROJECT_DIR,
180000)` at `index.js:1245`; regardless of whether `npmResult.ok` is true or false, the
expression `const allOk = gitResult.ok && npmResult.ok;` at `index.js:1250` evaluates to
`false` because `gitResult.ok` is already `false`.

4. Despite `allOk` being `false`, the code immediately edits the status message with `③
Restarting bot now…` (lines `1253-1259`) and then executes the restart block at
`index.js:1261-1279`, sending a restart note to all admins and calling `spawn('systemctl',
['restart', 'runewager'], ...)` followed by `process.exit(0)`; the bot process is
restarted even though the codebase or dependencies were not successfully updated, risking
a new process that fails to start correctly or runs with mismatched code/deps.

Prompt for AI Agent 🤖

This is a comment left during a code review.

**Path:** index.js
**Line:** 1253:1253
**Comment:**
	*Logic Error: The `/deploy` command restarts the bot process even when `git pull` or `npm ci` fail, meaning it can deliberately restart into a broken or partially updated state contrary to the intended "pull, install, then restart" flow, likely causing the new process to crash or misbehave until manually fixed.

Validate the correctness of the flagged issue. If correct, How can I resolve this? If you propose a fix, implement it and please make it concise.

👍 | 👎

[codeant-ai]

CodeAnt AI finished reviewing your PR.