Codex full-repository audit for BONanza v1.5.13

[maghuro]

Temporary PR used only as the supported GitHub conversation surface for a Codex audit of the entire repository. Do not merge this PR.

[maghuro]

@codex Please perform a full repository audit of the current repository state, not merely the diff in this PR.

Audit the entire current codebase at main/BONanza v1.5.13, including all modular giveaway source, generated bundle, tests, build script, workflows, Gist publication/update logic, and operational assumptions in docs.

Prioritize real correctness and safety problems, not stylistic nitpicks. Specifically hunt for credible failures involving:

• payout/refund/BON Pool accounting, missed or double sends, idempotency
• cross-tab ownership, races, reload/BFCache/restore, stale state and timer boundaries
• sponsor Gift History reconciliation, timestamp/cutoff ambiguity
• chat parsing, formatting, BBCode/IRC bridge behavior, regexes consuming adjacent data
• attacker-controlled or unusual usernames/messages affecting parsing or output
• host/staff authorization, replay and cooldown bypasses
• localStorage snapshots, ledgers, migrations and corruption recovery
• fail-open behavior on network/API errors
• source/bundle/build drift
• missing regression coverage
• workflow/Gist/update paths that could publish stale or inconsistent userscripts

The recent v1.5.13 bug is an example of the class of hidden assumption to challenge: username Sch2021 caused the thousands formatter to wake up, and a permissive regex turned the valid list "28, 36, 52, 83, 89" into "28, 365 283, 89". Do not limit the audit to that area.

For every substantive finding, include severity P0/P1/P2/P3, exact file/function, concrete reproduction path, why current guards/tests miss it, the smallest safe fix, and the regression test to add. Avoid speculative findings without a credible execution path. If a serious pass finds nothing substantive, say so explicitly.

[chatgpt-codex-connector]

To use Codex here, create an environment for this repo.

[maghuro]

@codex Environment is now configured for this repository. Please run the full-repository audit requested above against the entire current codebase, not just this PR diff. Prioritize substantive correctness/safety findings only, with severity, exact location, concrete reproduction path, why current guards/tests miss it, smallest safe fix, and regression coverage. If the repository is clean after a serious pass, say so explicitly.

[chatgpt-codex-connector]

Summary

• Completed a full-repository audit covering the modular giveaway implementation, generated bundle, settlement and accounting paths, cross-tab recovery, Gift History reconciliation, chat parsing, authorization, persistence, tests, build tooling, workflows, Gist publication, and operational documentation.
• Found and fixed one substantive P2 correctness issue: giftBon() terminalized a winner/refund transfer before its /gift fallback, but ignored a definitive false result from sendMessage(). If both the chat API and chatbox transport rejected the command, later settlement attempts treated the unsent transfer as already attempted, potentially stranding a winner payout or sponsor refund until manual intervention.
• Added a fail-closed recovery helper that restores only the exact unsent attempt token to retryable state, while requiring the current tab still to own the giveaway lock and requiring durable ledger read-back. userscripts/giveaway/src/12-utilities.jsL1157-L1182
• Made the /gift fallback retain exclusive-ownership enforcement, inspect the actual send result, and report the definitive no-send outcome rather than incorrectly reporting a successful attempt. userscripts/giveaway/src/12-utilities.jsL1368-L1390 userscripts/giveaway/src/12-utilities.jsL1406-L1412
• Applied the same explicit failure result when a safe HTTP rejection—400, 401, 403, 404, or 422—attempts the chat fallback. userscripts/giveaway/src/12-utilities.jsL1424-L1447
• Added regression coverage ensuring the fallback is ownership-guarded, checks sendMessage()’s result, restores retryability after a definitive rejection, and exposes the correct failure reason. tests/bonanza-review-hardening.test.mjsL31-L39
• Rebuilt the generated userscript from all 15 source modules using the repository’s canonical build process. scripts/build-bonanza.mjsL10-L28 scripts/build-bonanza.mjsL30-L41
• No additional credible P0–P3 correctness or safety findings remained after the broader audit.
• Committed the changes as f853a9b (Keep rejected gift fallbacks retryable) and created the requested follow-up PR titled “Prevent definitively rejected gift fallbacks from stranding settlement.”

Testing

• ✅ node scripts/build-bonanza.mjs
• ✅ node scripts/build-bonanza.mjs --check
• ✅ node --check userscripts/giveaway/DarkPeers_BONanza_Giveaway.user.js
• ✅ node --test tests/bonanza-*.test.mjs — 37 tests passed.
• ✅ git diff --check
• ✅ git status --short --branch — working tree clean after commit.

View task →

[maghuro]

Full-repository audit completed. Codex found one substantive P2 in the /gift fallback path. It was fixed in PR #28, reviewed again by Codex (final review: no major issues), merged to main as abcecf570216cc78d2833dcbc1a4a3c66d238f33, and both Validate BONanza and Publish BONanza to Gist completed successfully. Closing this temporary audit PR without merge.