fix: add guess to help, document 8ball --debug, fix pip-audit CVE false positive

- !help Games section now includes !guess
- !8ball description mentions --debug flag
- pip-audit now scans only requirements.txt instead of --local (which
  was flagging CVE-2026-3219 in pip itself, not our dependencies)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

.gitea/workflows/lint.yml

@@ -60,15 +60,12 @@ jobs:
           # Debian Bullseye only ships Python 3.9; use a prebuilt standalone binary
           curl -sSL "https://github.com/indygreg/python-build-standalone/releases/download/20241002/cpython-3.10.15+20241002-x86_64-unknown-linux-gnu-install_only.tar.gz" \
             | tar -xz -C /opt
-          # Upgrade pip+setuptools first (standalone build ships old versions with CVEs),
-          # then install pip-audit + the bot's requirements into the same env.
-          # Using --local avoids pip-audit creating an internal venv (which fails
-          # with ensurepip exit 127 on this standalone build).
           /opt/python/bin/pip install --upgrade pip setuptools
-          /opt/python/bin/pip install pip-audit -r matrixbot/requirements.txt
+          /opt/python/bin/pip install pip-audit
 
       - name: Audit matrixbot dependencies
-        run: /opt/python/bin/pip-audit --local
+        # Audit only our declared dependencies, not pip-audit itself or pip
+        run: /opt/python/bin/pip-audit -r matrixbot/requirements.txt
 
   secret-scan:
     name: Secret scan (gitleaks)

matrixbot/commands.py

@@ -114,7 +114,7 @@ def check_cooldown(sender: str, cmd_name: str, seconds: int = COOLDOWN_SECONDS)
 async def cmd_help(client: AsyncClient, room_id: str, sender: str, args: str):
     categories = [
         ("🤖 AI / Fun", ["ask", "fortune", "8ball", "roast", "story", "debate"]),
-        ("🎮 Games", ["wordle", "trivia", "rps", "poll", "hangman", "scramble", "wyr", "riddle"]),
+        ("🎮 Games", ["wordle", "trivia", "rps", "poll", "hangman", "guess", "scramble", "wyr", "riddle"]),
         ("🎲 Random", ["flip", "roll", "random", "champion", "agent"]),
         ("🖥️ Server", ["minecraft", "ping", "health"]),
     ]
@@ -222,7 +222,7 @@ def _implies_jared_wynter_romance(text):
     ]
     return any(phrase in lower for phrase in romantic_words)
 
-@command("8ball", "Ask the magic 8-ball a question")
+@command("8ball", "Ask the magic 8-ball a question — append --debug to see the prompt used")
 async def cmd_8ball(client: AsyncClient, room_id: str, sender: str, args: str):
     if not args:
         await send_text(client, room_id, f"Usage: {BOT_PREFIX}8ball <question>")