From 407e66e499af85a724aa52a6bbea853321e53ad9 Mon Sep 17 00:00:00 2001 From: Jared Vititoe Date: Sun, 26 Apr 2026 15:43:30 -0400 Subject: [PATCH] fix: add guess to help, document 8ball --debug, fix pip-audit CVE false positive - !help Games section now includes !guess - !8ball description mentions --debug flag - pip-audit now scans only requirements.txt instead of --local (which was flagging CVE-2026-3219 in pip itself, not our dependencies) Co-Authored-By: Claude Sonnet 4.6 --- .gitea/workflows/lint.yml | 9 +++------ matrixbot/commands.py | 4 ++-- 2 files changed, 5 insertions(+), 8 deletions(-) diff --git a/.gitea/workflows/lint.yml b/.gitea/workflows/lint.yml index ebcc271..6966774 100644 --- a/.gitea/workflows/lint.yml +++ b/.gitea/workflows/lint.yml @@ -60,15 +60,12 @@ jobs: # Debian Bullseye only ships Python 3.9; use a prebuilt standalone binary curl -sSL "https://github.com/indygreg/python-build-standalone/releases/download/20241002/cpython-3.10.15+20241002-x86_64-unknown-linux-gnu-install_only.tar.gz" \ | tar -xz -C /opt - # Upgrade pip+setuptools first (standalone build ships old versions with CVEs), - # then install pip-audit + the bot's requirements into the same env. - # Using --local avoids pip-audit creating an internal venv (which fails - # with ensurepip exit 127 on this standalone build). /opt/python/bin/pip install --upgrade pip setuptools - /opt/python/bin/pip install pip-audit -r matrixbot/requirements.txt + /opt/python/bin/pip install pip-audit - name: Audit matrixbot dependencies - run: /opt/python/bin/pip-audit --local + # Audit only our declared dependencies, not pip-audit itself or pip + run: /opt/python/bin/pip-audit -r matrixbot/requirements.txt secret-scan: name: Secret scan (gitleaks) diff --git a/matrixbot/commands.py b/matrixbot/commands.py index 066babe..4fac801 100644 --- a/matrixbot/commands.py +++ b/matrixbot/commands.py @@ -114,7 +114,7 @@ def check_cooldown(sender: str, cmd_name: str, seconds: int = COOLDOWN_SECONDS) async def cmd_help(client: AsyncClient, room_id: str, sender: str, args: str): categories = [ ("🤖 AI / Fun", ["ask", "fortune", "8ball", "roast", "story", "debate"]), - ("🎮 Games", ["wordle", "trivia", "rps", "poll", "hangman", "scramble", "wyr", "riddle"]), + ("🎮 Games", ["wordle", "trivia", "rps", "poll", "hangman", "guess", "scramble", "wyr", "riddle"]), ("🎲 Random", ["flip", "roll", "random", "champion", "agent"]), ("🖥️ Server", ["minecraft", "ping", "health"]), ] @@ -222,7 +222,7 @@ def _implies_jared_wynter_romance(text): ] return any(phrase in lower for phrase in romantic_words) -@command("8ball", "Ask the magic 8-ball a question") +@command("8ball", "Ask the magic 8-ball a question — append --debug to see the prompt used") async def cmd_8ball(client: AsyncClient, room_id: str, sender: str, args: str): if not args: await send_text(client, room_id, f"Usage: {BOT_PREFIX}8ball ")