Add referral onboarding, persistent menus, group-linking, play-mode links & pending-action timeout

[gamblecodezcom]

User description

Motivation

• Improve onboarding by adding a referral flow and boost mechanics so referred users and owners receive giveaway boosts during signup.
• Make navigation safer and less noisy by enforcing a single-active-menu model and clearing stale menus when showing new menus.
• Harden pending-input handling by adding labeled pending-action timeouts and explicit escape routes to avoid stuck states.
• Surface runtime configuration (HTTPS / Telegram / Discord / play-mode) and add utilities for deterministic link behavior across Telegram mini-app vs browser modes.

Description

• Added referral onboarding and application logic with applyOnboardingReferralCode, referral storage (referralStore.referrals), referral share HTML (referralShareHTML) and onboarding UI callbacks (onboard_ref_yes, onboard_ref_no, ref_menu_*).
• Implemented pending-action timeout labeling and exact-15-minute boundary semantics via ACTION_LABELS and evaluatePendingActionTimeout, and wired timeouts into the text router to clear expired states.
• Introduced persistent-menu utilities clearOldMenus, replyMenu and tracked last menu message ids on users (lastMenuMsgId, lastMenuChatId) so only one transient menu card is active per user; updated menu senders (sendSettingsMenu, sendMainMenu, test flows) to use replyMenu.
• Added play-mode helpers (getPlayLink, getBrowserLink, getStartAppLink) and adapted miniAppPlayButton and play-related handlers to respect user.settings.playMode (mini-app vs browser).
• Added Discord/TG link helpers (unwrapTelegramUrl, getDiscordLink) to unwrap t.me wrappers and enforce safe external Discord links.
• Implemented Group Linking admin tools and callbacks (settings_group_linking_tools, group_link_*, renderGroupLinkingTools, group_link_test_permissions) and persisted approvals in approvedGroupsStore.
• Extended runtime state (user shape, referralStore.referrals) and adjusted serialization/deserialization to persist new fields.
• Updated .env.example to document BOT_PRIVACY_MODE, HTTPS cert/key paths and Telegram link keys used by the runtime.
• Large test updates in test/smoke.test.js and test/unit.test.js to cover new behaviors: pending-action boundary checks, catch-all regex handling, command/callback extraction improvements, env docs, referral flows, group-linking presence and menu clearing helpers.

Testing

• Ran the repository smoke and unit test suite (node --test / npm test equivalent) which executed updated test/smoke.test.js and test/unit.test.js; all added and existing automated tests passed.
• Exercised testall logic in the smoke tests which validates link parsing, pending-action boundary, navigation helpers, and environment variable documentation; these checks succeeded in CI-local runs.
• Static/file-based tests for command/callback coverage and regex filtering were executed and validated that literal callbacks map to handlers or regex families and that catch-all regex handlers are ignored for coverage; results were green.
• Verified state serialization changes by running the runtime snapshot/load codepaths exercised by unit tests to ensure new fields (referrals, lastMenu*, referral metadata) are persisted and loaded without errors.

---

Codex Task

---

CodeAnt-AI Description

Add referral onboarding, single-active menus, group-linking tools, play-mode links and pending-action timeouts

What Changed

• Onboarding now asks "Were you referred by a friend?" after age confirmation; users can enter one referral code during onboarding, valid codes grant a 7-day 2× giveaway boost to both accounts and generate a shareable invite message.
• Menu behavior now enforces a single active transient menu per user/chat: menu sends delete the previous menu and store last menu IDs so users no longer see stacked/stale menu cards.
• Play links are deterministic by user setting: browser mode opens external gamble-codez.com URLs, Telegram mode uses mini-app deep links; the play button label reflects the active mode.
• Pending-input states gain a normalized 15-minute timeout with human-friendly labels; timeouts use exact-boundary semantics (exactly 15 minutes does not expire) and clear stuck pending states with a user-facing timeout message and recovery buttons.
• Group-linking tools added to Settings/Admin: link/view/remove/test linked groups and test bot permissions; approvals are persisted.
• Discord link handling unwraps t.me wrappers and forces safe https external Discord URLs; share/Discord buttons now use sanitized external links.
• Smoke/tests updated: command and callback coverage checks improved (const/backtick/quoted names, catch-all regex ignored), TestAll reports include warnings count, and .env.example documents runtime keys used by core flows.

Impact

✅ Clearer referral errors and share flow
✅ Fewer stuck pending-input states
✅ Deterministic open behavior for Play links

💡 Usage Guide

Checking Your Pull Request

Every time you make a pull request, our system automatically looks through it. We check for security issues, mistakes in how you're setting up your infrastructure, and common code problems. We do this to make sure your changes are solid and won't cause any trouble later.

Talking to CodeAnt AI

Got a question or need a hand with something in your pull request? You can easily get in touch with CodeAnt AI right here. Just type the following in a comment on your pull request, and replace "Your question here" with whatever you want to ask:

@codeant-ai ask: Your question here

This lets you have a chat with CodeAnt AI about your pull request, making it easier to understand and improve your code.

Example

@codeant-ai ask: Can you suggest a safer alternative to storing this secret?

Preserve Org Learnings with CodeAnt

You can record team preferences so CodeAnt AI applies them in future reviews. Reply directly to the specific CodeAnt AI suggestion (in the same thread) and replace "Your feedback here" with your input:

@codeant-ai: Your feedback here

This helps CodeAnt AI learn and adapt to your team's coding style and standards.

Example

@codeant-ai: Do not flag unused imports.

Retrigger review

Ask CodeAnt AI to review the PR again, by typing:

@codeant-ai: review

Check Your Repository Health

To analyze the health of your code repository, visit our dashboard at https://app.codeant.ai. This tool helps you identify potential issues and areas for improvement in your codebase, ensuring your repository maintains high standards of code health.

[codeant-ai]

CodeAnt AI is reviewing your PR.

---

Thanks for using CodeAnt! 🎉

We're free for open-source projects. if you're enjoying it, help us grow by sharing.

Share on X ·
Reddit ·
LinkedIn

[coderabbitai]

Warning

Rate limit exceeded

@gamblecodezcom has exceeded the limit for the number of commits that can be reviewed per hour. Please wait 8 minutes and 44 seconds before requesting another review.

⌛ How to resolve this issue?

After the wait time has elapsed, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout.

Please see our FAQ for further information.

📥 Commits

Reviewing files that changed from the base of the PR and between 7fa5c30 and 2c6368e.

📒 Files selected for processing (5)

• CLAUDE.md
• RUNEWAGER_FUNCTIONALITY_MAP.md
• index.js
• test/smoke.test.js
• test/unit.test.js

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Post copyable unit tests in a comment
• Commit unit tests in branch codex/perform-full-audit-and-implementation-for-runewager-bot

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[codeant-ai]

CodeAnt AI finished reviewing your PR.