Add admin VPS console, tips persistence, HTTPS health, secure path checks and production deploy improvements

[gamblecodezcom]

User description

Motivation

• Improve admin tooling with an interactive lightweight VPS console and richer admin dashboards for safer remote operations.
• Harden file handling, health checks, and webapp verification to improve security and reliability in production.
• Streamline and harden the production deployment experience (systemd, perms, health probes, logrotate and runner script).

Description

• Introduce a full-featured admin VPS console (/sshv) with session persistence, editor mode, command execution, safety checks, session GC and NDJSON session storage in data/sshv-sessions.json plus related UI actions and keyboard flows in index.js.
• Add tips/helpful-messages persistence and management: tips scheduler improvements, import/export via JSON in /tipadd and /tipedit, helpful_messages.json storage, dedup rotate avoidance and permission checks before posting to target group.
• Add secure path validation helpers and safe atomic writes: validateSafePath, writeFileAtomic/loadJson changes to protect filesystem access under dataDir, and hardened image senders to use safe paths.
• Support Telegram WebApp init-data HMAC verification via WEBAPP_HMAC_KEY and update .env.example accordingly.
• Health server now supports HTTPS when HTTPS_KEY_PATH/HTTPS_CERT_PATH are configured and resolves TLS files only from allowed directories; health request helper requestHealthPayload added and used throughout.
• Improve user/admin UX: persistent user/admin menus, ephemeral promo prompt auto-expire, clearer admin-mode toggles (/on/off) and many callback UI refinements including replaceCallbackPanel.
• Persist and migrate runtime state enhancements: loadSshvSessions, persistSshvSessions, runtime-state backups and safety checks, plus various schema migrations and safer admin logging (admin-events.log).
• Deployment and ops improvements in prod-run.sh: create/ensure service user, lock down permissions, create required data/log dirs, read .env safely, health probe URL resolution with TLS awareness, conflict detection and port freeing, wait-for-health logic, improved systemd unit generation and logrotate configuration.
• Add project files: LICENSE (MIT) and SECURITY.md, update README.md and .env.example, remove the old Dockerfile, and refine .gitignore.
• Large refactors and additions across index.js, prod-run.sh, runewager.service, and scripts/self-diagnose.sh to implement the above features and improve robustness.

Testing

• Ran CI-mode startup smoke by loading the runtime with CI=true node index.js to ensure the module initializes without starting the full runtime, and the load succeeded.
• Executed the self-diagnose script ./scripts/self-diagnose.sh in a staging-like environment to validate environment, service and health checks, and it completed with expected pass/warn output.
• Exercised prod-run.sh in a controlled environment to validate directory creation, permission adjustments, systemd unit rendering and health probe checks (including HTTPS path resolution), and those checks completed successfully.

---

Codex Task

---

CodeAnt-AI Description

Add lightweight admin VPS console, safe file handling, HTTPS health checks, tips persistence, and improved production deploy

What Changed

• Admins get an interactive, persistent VPS console (/sshv) in private chat with run/lock/refresh, editor mode for editing files, session restore across restarts, and one-session-per-admin timeout and session persistence to disk
• File and path operations are validated and restricted to the bot data/project directories; image and JSON loads/writes now refuse path traversal and use safe resolved paths
• Health endpoint can run over HTTPS when TLS files are configured; health probe resolves TLS files only from allowed directories and the bot exposes protocol in responses; health checks used by bot and deploy script now tolerate TLS/no-TLS and report failures
• Tips/helpful messages are persisted to disk, can be imported/exported via JSON, have a manager UI, and scheduled tips avoid immediate repeats and auto-check posting permissions before sending
• Persistent user/admin menus and many admin callback panels now replace or delete prior messages instead of piling up; ephemeral promo claim prompt auto-expires after 15s to keep chats tidy
• Admin visibility toggles (/on, /off) now control admin UI visibility (admin view) without changing admin identity or permissions; admin menus reflect the current view state
• Deploy runner and systemd service now prefer a non-root service user, create required runtime files/dirs, enforce file permissions, detect and free conflicted ports, probe health endpoint robustly, and include stricter systemd sandbox settings

Impact

✅ Clearer health endpoint status and HTTPS support
✅ Fewer accidental filesystem accesses from bots or images
✅ Shorter admin recovery and less UI clutter

💡 Usage Guide

Checking Your Pull Request

Every time you make a pull request, our system automatically looks through it. We check for security issues, mistakes in how you're setting up your infrastructure, and common code problems. We do this to make sure your changes are solid and won't cause any trouble later.

Talking to CodeAnt AI

Got a question or need a hand with something in your pull request? You can easily get in touch with CodeAnt AI right here. Just type the following in a comment on your pull request, and replace "Your question here" with whatever you want to ask:

@codeant-ai ask: Your question here

This lets you have a chat with CodeAnt AI about your pull request, making it easier to understand and improve your code.

Example

@codeant-ai ask: Can you suggest a safer alternative to storing this secret?

Preserve Org Learnings with CodeAnt

You can record team preferences so CodeAnt AI applies them in future reviews. Reply directly to the specific CodeAnt AI suggestion (in the same thread) and replace "Your feedback here" with your input:

@codeant-ai: Your feedback here

This helps CodeAnt AI learn and adapt to your team's coding style and standards.

Example

@codeant-ai: Do not flag unused imports.

Retrigger review

Ask CodeAnt AI to review the PR again, by typing:

@codeant-ai: review

Check Your Repository Health

To analyze the health of your code repository, visit our dashboard at https://app.codeant.ai. This tool helps you identify potential issues and areas for improvement in your codebase, ensuring your repository maintains high standards of code health.

[codeant-ai]

CodeAnt AI is reviewing your PR.

---

Thanks for using CodeAnt! 🎉

We're free for open-source projects. if you're enjoying it, help us grow by sharing.

Share on X ·
Reddit ·
LinkedIn

[coderabbitai]

Warning

Rate limit exceeded

@gamblecodezcom has exceeded the limit for the number of commits that can be reviewed per hour. Please wait 5 minutes and 36 seconds before requesting another review.

⌛ How to resolve this issue?

After the wait time has elapsed, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout.

Please see our FAQ for further information.

📥 Commits

Reviewing files that changed from the base of the PR and between 0a984ef and bc08d24.

📒 Files selected for processing (2)

• index.js
• prod-run.sh

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Post copyable unit tests in a comment
• Commit unit tests in branch codex/configure-git-and-update-project-files-fqtjkf

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[codeant-ai]

Nitpicks 🔍

🔒 No security issues identified

⚡ Recommended areas for review Ownership / permission assumptions The deploy step creates and restricts data and log directories and files but assumes the service runs as APP_NAME and that the script has permission to change ownership. If chown is skipped (user missing or script not run as root) the files may remain owned by the deploy user and the service might not be able to read/write the session/log files, causing runtime errors. Validate and handle the case where ownership changes fail. Silent failures on chown/chmod The script intentionally swallows chown/chmod errors using || true. This hides permission-change failures from operators and from automatic notifications; a failed chown can leave the bot unable to write to sshv-sessions.json or admin-events.log. Consider surfacing failures or adding a verification step and admin notification. Service user assumption The shipped runewager.service file now specifies User=runewager/Group=runewager. If prod-run.sh is run on systems where that user/group is not created (or if the deploy uses fallback identity), installing or starting the service could fail. Confirm the repo example is consistent with the runtime behavior and document the required step (create user) in README or have prod-run.sh ensure the user is created before enabling the unit. Service user fallback The script falls back to the invoking non-root user when the system user runewager is missing. However the systemd unit and later steps assume the User/Group exist and will write service files that reference SERVICE_USER. If the fallback user differs from the intended system user, systemd installs may fail or run with incorrect ownership. Verify service-user creation path, and ensure installs either require root or write a systemd unit that will work when the user is not present. File ownership race The script touches/creates log and data files then chowns/chmods them. If multiple deploys run concurrently (or systemd starts the service immediately), there is a small race window where files are present but ownership/mode are not yet set. Consider creating files atomically with desired owner/mode or locking to avoid races and ensure the service can write logs immediately after start. Health probe TLS mismatch The self-diagnose script probes health endpoints via plain HTTP (http://127.0.0.1:${PORT}/health) unconditionally. prod-run.sh supports HTTPS health endpoints (and optional insecure TLS probing). The inconsistency will yield false failures when the app serves health on HTTPS. Align detection with the same HTTPS detection/resolution (or read HTTPS env variables) so the diagnostic reflects the real service state. SPDX identifier missing The LICENSE file is the standard MIT text but lacks an SPDX short identifier line (e.g. "SPDX-License-Identifier: MIT") which many tools and package ecosystems use for automated license detection and compliance.

[codeant-ai]

CodeAnt AI finished reviewing your PR.