Add HTTPS health, admin VPS console, tips manager, deployment hardening, and misc housekeeping

[gamblecodezcom]

User description

Motivation

• Improve runtime security and deployment robustness (HTTPS health, safer file access, service user, locked .env, port/health checks).
• Provide richer admin tooling for on-vps maintenance (lightweight SSH-like console, admin-mode UI, persistent admin/user menus).
• Harden WebApp verification and tips/announcement workflows and make helpful messages importable/persistent.
• Project housekeeping: add LICENSE, SECURITY policy, update README, remove unused Dockerfile, and tidy .gitignore.

Description

• Added WEBAPP_HMAC_KEY to .env.example and switched Mini App init-data verification to use the configured HMAC key in index.js (verifyWebAppInitData).
• Implemented a safe path validator (validateSafePath) and switched file reads/writes to validated/data-dir paths; added atomic writes for JSON stores and helpful-messages persistence.
• Reworked health server to optionally serve HTTPS when HTTPS_KEY_PATH/HTTPS_CERT_PATH are configured and added requestHealthPayload() helper used by admin health checks.
• Introduced an admin lightweight VPS console (/sshv) with per-admin session persistence, editor mode, command execution controls, confirmation and blocking rules, session GC, and NDJSON session export (sshv-sessions.json) in index.js.
• Enhanced tips/“helpful messages” system: HTML formatting support, import/export/overwrite via JSON, scheduler improvements (avoid repeats, permission checks), admin dashboard and inline actions for tips, and persistence to data/helpful_messages.json.
• Added ephemeral promo prompt UI that auto-deletes, reworked persistent user/admin menus, admin-mode toggle (visibility of admin UI), improved callback handling and a fallback for stale callbacks; added callback audit utilities and keyboard-extraction helpers.
• Many admin command and keyboard refactors (renamed/normalized callback IDs, more consistent use of replaceCallbackPanel), added announcement composer flow, promo claim flow refactoring, and various safety checks.
• Deployment and runtime hardening in prod-run.sh: create service user if missing, lock down .env, create runtime dirs/files, health URL resolution (HTTP/HTTPS), port-listener checks and auto-free on conflicts, wait-for-health probes, improved systemd unit generation, logrotate updates, file ownership/permissions handling and runtime prechecks.
• Updated runewager.service template to use runewager user, restrict filesystem and tighten privileges.
• Rewrote scripts/self-diagnose.sh to capture a consistent snapshot and added more checks (service, network, releases, logs) and improved reporting.
• Misc: added LICENSE (MIT), SECURITY.md, updated README.md (deployment and health docs), removed Dockerfile, and adjusted .gitignore.

Testing

• Smoke-loaded the runtime in CI mode to validate the module initializes cleanly with CI=true (startup paths exercised without runtime exit); no startup exceptions observed.
• Executed the updated scripts/self-diagnose.sh to validate runtime-facing checks and file/service inspections; the script completed and produced a snapshot report.
• Ran npm ci --omit=dev as part of deploy flow to validate dependency installation (successful).

---

Codex Task

---

CodeAnt-AI Description

Add "I Have Claimed — Next Step" promo action; harden deployment, health checks, and diagnostics

What Changed

• Users see a new "✅ I Have Claimed — Next Step" button on the ephemeral promo prompt that records the promo claim and advances the user's onboarding flow (may show the next onboarding prompt or the final 30 SC claim).
• Promo claim handling was unified so both the simple "I Entered Promo Code" and the new "…Next Step" button reliably save claim intent, award onboarding XP/badges, and avoid duplicate processing.
• Deployment scripts create and secure runtime directories/files, attempt to create/use a non-root service user, enforce tighter file permissions for .env and logs, and set stricter systemd service constraints to run the bot with reduced privileges.
• Production runner now detects and uses HTTPS for the local health endpoint when TLS is configured, probes health with retries (and optional insecure TLS for self-signed certs), reports health/port status, and attempts simple auto-recovery from port conflicts.
• The self-diagnose script was rewritten to produce a consistent, read-only snapshot report (system, files, env, service, process, network, releases, logs) and clearer pass/warn/fail output.
• Documentation and example files updated: .env.example includes WEBAPP_HMAC_KEY; README clarifies local health server supports HTTPS; added LICENSE and SECURITY policy; systemd service file updated to use non-root service user and stronger protections.

Impact

✅ Clearer promo onboarding flow and next-step prompts
✅ Health checks use HTTPS when certs are present and auto-recover from port conflicts
✅ Safer production deployments with locked secrets and non-root service runtime

💡 Usage Guide

Checking Your Pull Request

Every time you make a pull request, our system automatically looks through it. We check for security issues, mistakes in how you're setting up your infrastructure, and common code problems. We do this to make sure your changes are solid and won't cause any trouble later.

Talking to CodeAnt AI

Got a question or need a hand with something in your pull request? You can easily get in touch with CodeAnt AI right here. Just type the following in a comment on your pull request, and replace "Your question here" with whatever you want to ask:

@codeant-ai ask: Your question here

This lets you have a chat with CodeAnt AI about your pull request, making it easier to understand and improve your code.

Example

@codeant-ai ask: Can you suggest a safer alternative to storing this secret?

Preserve Org Learnings with CodeAnt

You can record team preferences so CodeAnt AI applies them in future reviews. Reply directly to the specific CodeAnt AI suggestion (in the same thread) and replace "Your feedback here" with your input:

@codeant-ai: Your feedback here

This helps CodeAnt AI learn and adapt to your team's coding style and standards.

Example

@codeant-ai: Do not flag unused imports.

Retrigger review

Ask CodeAnt AI to review the PR again, by typing:

@codeant-ai: review

Check Your Repository Health

To analyze the health of your code repository, visit our dashboard at https://app.codeant.ai. This tool helps you identify potential issues and areas for improvement in your codebase, ensuring your repository maintains high standards of code health.

[codeant-ai]

CodeAnt AI is reviewing your PR.

---

Thanks for using CodeAnt! 🎉

We're free for open-source projects. if you're enjoying it, help us grow by sharing.

Share on X ·
Reddit ·
LinkedIn

[coderabbitai]

Warning

Rate limit exceeded

@gamblecodezcom has exceeded the limit for the number of commits that can be reviewed per hour. Please wait 22 minutes and 55 seconds before requesting another review.

⌛ How to resolve this issue?

After the wait time has elapsed, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout.

Please see our FAQ for further information.

📥 Commits

Reviewing files that changed from the base of the PR and between 952db28 and 20316ce.

📒 Files selected for processing (2)

• index.js
• prod-run.sh

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Post copyable unit tests in a comment
• Commit unit tests in branch codex/configure-git-and-update-project-files-hizk40

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[codeant-ai]

Nitpicks 🔍

🔒 No security issues identified

⚡ Recommended areas for review Sensitive Info Exposure The script uses "set -o allexport" and then sources the repository .env file, exporting all variables into the shell and later printing environment values. This can leak secrets (e.g., API/TOKEN values, DB credentials) to logs, stdout or to any subprocesses invoked by the script. The behavior is risky when run interactively or via CI and should be limited to only the specific variables needed or kept un-exported. Aggressive Port Kill The function that resolves and frees a conflicting port will kill any process listening on the configured health port (TERM/KILL) without verifying ownership or intent. On multi-service VPS (e.g. nginx or other apps) this can terminate unrelated services. Limit kill scope (by uid, cmdline, or require confirmation in interactive runs) or prefer failing with a clear error. Ownership / Service User Gap After npm install the script creates data/log dirs and attempts to chown them only if the service user exists. On fresh installs the runewager user may not exist, leaving files owned by root and causing permission errors when the service (configured to run as runewager) starts. The deploy flow should either ensure/create the service user when run as root or apply a safe fallback to avoid broken ownership. Missing SPDX identifier The LICENSE file is a free-form MIT text but lacks a machine-readable SPDX identifier (e.g. "SPDX-License-Identifier: MIT"). Adding an SPDX identifier helps package tooling and package indexes (npm, pip, etc.) detect the license unambiguously. Distribution metadata Ensure the new LICENSE is referenced in project metadata (package.json, setup.cfg, pyproject.toml, container image labels, etc.) and included in release artifacts so downstream consumers and package scanners see it.

[codeant-ai]

CodeAnt AI finished reviewing your PR.