3 Commits

Author	SHA1	Message	Date
prosolis	e459b6e78d	Full codebase audit: 21 security/robustness fixes, 328 tests across 4 packages ... Security & economy: - Credit()/Debit() reject non-positive amounts (closes infinite-money exploit) - Lottery ticket purchase uses in-transaction count check (closes TOCTOU race) - Arena bail channel ownership prevents double-close panic - Entry.ID validated before exec.Command in fetch-esteemed - Internal errors no longer leaked to users (forex, esteemed) Robustness: - safeGo() panic recovery added to 17 goroutine launch sites across 14 plugins - db.Close() added and called on shutdown - Miniflux mutex pattern fixed (snapshot-under-lock) - Silently ignored DB/JSON errors now logged (lottery_db) Performance: - Added indexes: idx_arena_runs_user(user_id, status), idx_euro_bal_user(user_id) UX: - Empty !buy args shows usage instead of "No item matching ''" - "Failed to load character" now suggests !adventure Test coverage: - internal/util/parser_test.go (19 tests: XP, levels, progress bar, commands, parsing) - internal/crypto/crypto_test.go (12 tests: encrypt/decrypt, HMAC, ParseKey) - internal/plugin/helpers_test.go (30 tests: formatNumber, calc, lottery, chat perks) - internal/plugin/audit_fixes_test.go (25 tests: safeGo, bail channels, error leaks, overflow) - internal/db/db_test.go (4 tests: Init, Close, schema indexes) Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-04-08 17:04:40 -07:00
prosolis	f57dcd93a5	Fix streak grace period, UNO earnings, hospital UX, wordle/lottery atomicity ... - Streak grace now checks LastDeathDate instead of LastActionDate (was suppressing streak updates for all active players) - UNO single-player earnings use net payout (minus wager) not gross - Hospital sends error message on save failure instead of silent no-op - Wordle total_earned update moved into stats transaction - Lottery ticket inserts + community pot add wrapped in single transaction with euro refund on failure - Lottery fixed-tier ticket prize updated with actual prorated amount - Added last_death_date column to adventure_characters Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-04-08 00:54:58 -07:00
prosolis	6c6d74fb1b	Add blacksmith repair system, community lottery, and audit fixes ... Blacksmith: equipment repair with tier-based pricing, DM confirmation flow, masterwork/arena surcharges, full flavor text pools. Added to main adventure menu as option 6 (rest bumped to 7). Lottery: weekly draw (Friday 23:59 UTC), ticket purchases with 100/week cap, Fisher-Yates number generation, fixed+jackpot prize tiers, community pot funding, Thursday reminders, draw history. Audit fixes: TOCTOU in blacksmith repair costs (recompute from fresh equipment), user lock in DM slot selection, partial repair refund tracking, error logging on save failures, Fisher-Yates bias correction, communityPotDebit return value checks in draw execution. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-04-04 09:37:21 -07:00