feat(matrixbot): remove the auto-invite welcome flow entirely
Lint / JS (eslint) (push) Successful in 1m16s
Lint / Python (ruff) (push) Successful in 6s
Lint / Python deps (pip-audit) (push) Successful in 1m1s
Lint / Secret scan (gitleaks) (push) Successful in 7s
Lint / Shell (shellcheck) (push) Successful in 16s

Joining the Lotus Guild Space (join_rule: public) triggered a welcome DM;
reacting to it made the bot invite that user into a fixed room list. Now
that #general is published to the public room directory, any stranger can
join the Space and trigger this.

The room list excluded the invite-only rooms, but it included Voice, whose
join rule is `knock`. An invite bypasses a knock gate, so a stranger could
skip the approval step that rule exists to enforce.

Removes welcome.py, the Space-join watcher in Callbacks.member, both
welcome-reaction hooks, and the admin `cleanwelcome` command. The bot no
longer issues invites automatically anywhere. The PL50+ `invite` and
`inviteall` commands are untouched: those are deliberate admin actions.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This commit is contained in:
2026-08-16 15:46:36 -04:00
co-authored by Claude Opus 5
parent 9e5d3ec83d
commit fb933b0b13
4 changed files with 9 additions and 212 deletions
+1 -13
View File
@@ -15,7 +15,6 @@ from nio import AsyncClient
from utils import send_text, send_html, send_reaction, edit_html, sanitize_input, rcon_command, RconError
from wordle import handle_wordle, wordle_stats as _wordle_stats
from welcome import clean_stale_dm_messages
from config import (
MAX_DICE_SIDES, MAX_DICE_COUNT, BOT_PREFIX, ADMIN_USERS,
OLLAMA_URL, OLLAMA_MODEL, CREATIVE_MODEL, ASK_MODEL, COOLDOWN_SECONDS,
@@ -147,7 +146,7 @@ async def cmd_help(client: AsyncClient, room_id: str, sender: str, args: str):
categories.append(("🔧 Management (PL50+)", [
"mkroom", "roominfo", "roomname", "topic", "invite", "inviteall",
"setpl", "kick", "purge", "members", "whois", "announce", "syncspace",
] + (["cleanwelcome"] if sender in ADMIN_USERS else [])))
]))
plain_lines = ["LotusBot Commands"]
html_parts = ['<font color="#a855f7"><strong>🌸 LotusBot — Commands</strong></font>']
@@ -4444,14 +4443,3 @@ async def cmd_syncspace(client: AsyncClient, room_id: str, sender: str, args: st
)
@command("cleanwelcome", "Purge pending welcome DMs that were never reacted to (admin only)")
async def cmd_cleanwelcome(client: AsyncClient, room_id: str, sender: str, args: str):
if sender not in ADMIN_USERS:
await send_text(client, room_id, "⛔ Admin only.")
return
removed = clean_stale_dm_messages()
await send_html(client, room_id,
f"✅ Cleared {removed} stale welcome DM record(s).",
f'<font color="#22c55e"><strong>✅ Welcome cleanup</strong></font><br>'
f'Removed <strong>{removed}</strong> pending DM record(s) that were never reacted to.',
)