Promo manager, content-drops, SSHV and admin UX overhaul; persistence & tests

[gamblecodezcom]

User description

Motivation

• Replace the ad-hoc single promo-code flow with a DB-backed Promo Manager to support multiple promos, cooldowns, claim limits, auto-approval and admin review workflows.
• Improve admin operations, observability and safety for server interactions via a much richer admin dashboard, a hardened SSHV console, and clearer persistence/backups.
• Make Content Drops (previously "tips") robust and configurable with scheduler, target registration and test/send tooling.
• Harden static checks and automated tests (smoke/unit/runtime) and improve repository metadata (.env.example, .gitignore, README-style maps) for maintainability.

Description

• Promo system refactor: introduced promoManagerStore, promo-manager-db.json, richer promo model and claims flow, helper functions like evaluatePromoEligibility, getPromoById, listActivePromos, and admin commands /pmapprove/pmdeny and approval queue handling; legacy simple promoCodeStore preserved as compatibility placeholder.
• Content Drops (formerly Tips): kept tipsStore but renamed UX to "Content Drops", added postTipToConfiguredTarget, improved scheduler, target auto-registration from forwarded messages, test/send flows and new admin dashboards (tips_cmd_*).
• SSHV and admin tooling: many fixes and improvements to the lightweight VPS console (session persistence, editor save error handling, sandbox restriction hints, kill/lock/refresh handlers), plus improved admin keyboards, persistent user/admin main menus and new helpers (renderSshvConsole, sshvKeyboard, etc.).
• Persistence, startup, and safety: added runtime snapshot/backup improvements, savePromoManagerDb/loadPromoManagerDb, safer validateSafePath/atomic writeFileAtomic, health server TLS detection, and more documented env vars in .env.example.
• Tests and static checks: enhanced test/smoke.test.js to statically validate callback/button coverage and REGISTERED_COMMANDS parity, extended test/unit.test.js and test/runtime.test.js to cover many refactored helpers and scripts; promo-message.js also gained read/write helpers.
• Repo housekeeping: updated .gitignore to keep example env files, added RUNEWAGER_FUNCTIONALITY_MAP.md (full functionality map), and added AI coder contract text to CLAUDE.md (repository-level agent guidance and requirements).

Testing

• Ran the automated unit suite: node test/unit.test.js (covers state transitions, markdown escaping, username normalization and small helpers) and it passed.
• Ran smoke checks: node test/smoke.test.js (syntax check + static callback/command coverage and REGISTERED_COMMANDS parity) and it passed.
• Ran runtime scripts tests: node test/runtime.test.js (backup/restore scripts) and they passed.

---

Codex Task

---

CodeAnt-AI Description

Enforce command/callback parity in smoke tests, remove /language command, and clarify env docs

What Changed

• Smoke tests now scan all .js files and verify every inline callback button has a matching handler (literal or regex) and that REGISTERED_COMMANDS matches declared command handlers; CI will fail if callbacks or registered commands are out of sync.
• Unit and runtime tests added/expanded helpers that validate markdown escaping, bonus state transitions, username normalization, and other runtime invariants to catch behavior regressions earlier.
• Removed the user-facing /language command (no longer replies with detected language).
• Renamed an admin announce callback mapping (legacy announce action adjusted) — admin broadcast UI maps to the new broadcast flow.
• .env.example now documents WEBAPP_HMAC_KEY usage and valid LOG_LEVEL values to reduce deployment/configuration mistakes.
• Repo now includes a comprehensive functionality map and updated AI coder contract notes to help contributors understand intended features.

Impact

✅ Fewer silent command/callback regressions
✅ Clearer deployment environment guidance
✅ Faster detection of broken admin/bot handlers during CI

💡 Usage Guide

Checking Your Pull Request

Every time you make a pull request, our system automatically looks through it. We check for security issues, mistakes in how you're setting up your infrastructure, and common code problems. We do this to make sure your changes are solid and won't cause any trouble later.

Talking to CodeAnt AI

Got a question or need a hand with something in your pull request? You can easily get in touch with CodeAnt AI right here. Just type the following in a comment on your pull request, and replace "Your question here" with whatever you want to ask:

@codeant-ai ask: Your question here

This lets you have a chat with CodeAnt AI about your pull request, making it easier to understand and improve your code.

Example

@codeant-ai ask: Can you suggest a safer alternative to storing this secret?

Preserve Org Learnings with CodeAnt

You can record team preferences so CodeAnt AI applies them in future reviews. Reply directly to the specific CodeAnt AI suggestion (in the same thread) and replace "Your feedback here" with your input:

@codeant-ai: Your feedback here

This helps CodeAnt AI learn and adapt to your team's coding style and standards.

Example

@codeant-ai: Do not flag unused imports.

Retrigger review

Ask CodeAnt AI to review the PR again, by typing:

@codeant-ai: review

Check Your Repository Health

To analyze the health of your code repository, visit our dashboard at https://app.codeant.ai. This tool helps you identify potential issues and areas for improvement in your codebase, ensuring your repository maintains high standards of code health.

[codeant-ai]

CodeAnt AI is reviewing your PR.

---

Thanks for using CodeAnt! 🎉

We're free for open-source projects. if you're enjoying it, help us grow by sharing.

Share on X ·
Reddit ·
LinkedIn

[coderabbitai]

Warning

Rate limit exceeded

@gamblecodezcom has exceeded the limit for the number of commits that can be reviewed per hour. Please wait 21 minutes and 33 seconds before requesting another review.

⌛ How to resolve this issue?

After the wait time has elapsed, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout.

Please see our FAQ for further information.

📥 Commits

Reviewing files that changed from the base of the PR and between e4e8057 and 6fcd6ba.

📒 Files selected for processing (2)

• index.js
• test/smoke.test.js

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Post copyable unit tests in a comment
• Commit unit tests in branch codex/add-new-admin-promo-manager

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[codeant-ai]

Nitpicks 🔍

🔒 No security issues identified

⚡ Recommended areas for review Atomic write / error handling setPromoMessage writes directly with fs.writeFileSync after mkdirSync and doesn't handle write errors or partial writes. Concurrent writes, crashes, or filesystem issues may leave a corrupted file. Use an atomic write or temp-file+rename pattern and handle filesystem errors explicitly. Silent errors readPromoMessageFile swallows any error and returns null without logging or distinguishing parse vs IO errors. This can hide disk/permission problems and makes debugging impossible in production; consider logging and distinguishing recoverable vs fatal errors. Code Coverage Gap extractRegisteredCommands finds the first [ after REGISTERED_COMMANDS and parses that array body. If REGISTERED_COMMANDS is defined in a non-array way (e.g. computed, object, or via helper function) or uses unusual formatting, this scanner will return null and the test will fail. Consider a more robust parsing strategy (AST-based) or additional fallback heuristics. Regex Parsing parseRegexLiteral and extractActionRegexPatterns implement hand-rolled regex-literal parsing. Hand-written parsers are brittle: they may mis-handle escaped slashes, nested character classes, or uncommon/experimental flags. This can lead the smoke test to miss action handlers (false negatives) or crash on unusual source. Consider hardening or falling back to a JS parser for robustness. Possible Bug The new helper run(script, args) does not provide a default for args. If callers ever call run(script) with no second argument, the spread [script, ...args] will throw. Consider making args default to an empty array or defensively normalizing it within the function.

[codeant-ai]

CodeAnt AI finished reviewing your PR.