[valzargaming]

Server status embeds displayed the configured host placeholder instead of the host identified by each game server's config/host.txt. Read that server's local host file when rendering both status surfaces, trim surrounding whitespace, and report unavailable when the file is missing, unreadable, empty, oversized or invalid UTF-8. Nonlocal and UNC paths are not probed. Remove the hard-coded Connectivity field while preserving heartbeat and observation behavior.

Windows PHP 8.5.12 offline checks passed: heartbeat integration with two isolated server fixtures, missing/unreadable/empty/oversized and invalid UTF-8 cases, valid non-ASCII text, remote/UNC guards and Connectivity absence; heartbeat and server-compatibility contracts; and PHP lint. The server-compatibility fixture now initializes the required base directory before rendering status. Network and process functions were disabled. Dependency-backed local tests used an existing vendor baseline whose production package versions and references match the lock; no live bot or game was started.

Policy review - 2026-10-28

Current head: 452974bac720c5515feb35e6161f4f7c5d8a6b03; base: main. This completed slice is offered as a regular PR. verifier (8.5) is successful. Existing failed, skipped and historical results retain their stated scope. Unverified native/in-game/save/load items do not by themselves hold a source fix. Merge decisions and any live activation remain separate.

Summary by CodeRabbit

• Server Status
  • Server status embeds now display the host value from the server’s host configuration when it is available. If the value is missing, unreadable, invalid, or otherwise unavailable, the embed displays “Unavailable.”
  • The “Connectivity: Unverified” field is no longer shown.

[coderabbitai]

Walkthrough

Server embeds now display a host value read from config/host.txt for eligible local servers. Invalid or unavailable host data displays as Unavailable. The status embed no longer includes the Connectivity field, and toEmbed() also uses the host lookup.

Changes: Host Display

Layer / File(s)	Summary
Resolve and render host values src/Civ13/GameServer.php	The status embed and toEmbed() use displayHost() instead of the configured host value. The helper returns Unavailable when the server path or host-file data fails validation.
Validate host display behavior tests/local/heartbeat-integration.php, tests/local/server-compatibility.php	Integration tests cover host-file values, invalid or unavailable data, remote-server isolation, and the absence of the Connectivity field. The compatibility test initializes basedir with the server properties.

Priority: Low

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Bug fix

Merge Risk: Minimal · up to 45297

Server status embeds now show the host read from each local server's host file, or Unavailable when it cannot be read safely, and the Connectivity field is removed. The change is bounded and tested. The only remaining note is an unconfirmed edge case for network-mapped game directories, which the repository does not support as a configuration.

Security architecture risk: Moderate · up to 45297

The new host lookup has useful locality, size and encoding checks, but it follows filesystem links without verifying that the file belongs to the intended server. Someone able to replace that file or its parent directories could cause other readable text to appear in Discord. Actual exposure depends on deployment permissions that have not been established.

Retained concerns

• High · security · inferred: The newly introduced host-file publication does not bind disclosure to the intended server-owned file. If a lower-trust actor can replace config/host.txt or a parent component, a link or pathname substitution can redirect the bot to another readable, nonblank UTF-8 file of at most 1024 bytes and publish its contents to Discord. Production replacement authority remains unresolved.

Security review details

Security Blast Radius

• inferred — Conditional exposure extends beyond the configured server directory to qualifying files readable by the bot account if pathname substitution is possible. Each ordinary successful rendering publishes at most 1024 bytes of valid UTF-8 content. Deployment account permissions determine whether other servers' data or secrets are reachable; cross-service or tenant-wide access is not established.

Security Findings and Attack Paths

• inferred — The retained disclosure finding concerns a newly introduced publication path: an actor with file-replacement authority redirects the host pathname, the bot follows it during validation and reading, and accepted contents reach Discord through the Host field. A pre-existing link does not require winning a race; separate pathname checks also leave a concurrent replacement window. The production writer prerequisite remains unknown.

Trust Boundaries and Controls

• observed — The strongest implemented controls limit ordinary remote access and unsuitable output, but neither IP equality nor is_file establishes disclosure authority for the underlying file. Path validation and reading are separate operations, and no opened-object identity check binds them together.

Resilience and Maintainability Implications

• observed — The integration fixture asserts per-server isolation, unchanged host-file contents, invalid-data fallback, remote and UNC guards, and preservation of heartbeat behavior. These are source-inspected assertions, not independently executed results; they do not exercise symlink substitution or concurrent pathname replacement.

Hardening Proposals

• proposed — Establish and enforce who may replace the host file and its parent directories. Where writers are less trusted than the bot, use platform-appropriate no-follow and opened-file identity controls to bind publication to the intended file, and add substitution tests. Canonicalizing a pathname alone would not close a subsequent replacement race.

Pre-merge checks: 4 · 1

Failed checks: 1 warning

Check name	Status	Explanation	Resolution
Docstring Coverage		Docstring coverage is 40.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documenta…	Write docstrings for the functions missing them to satisfy the coverage threshold.

Passed checks: 4 passed

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title clearly and concisely describes the main change: reading each server's host file for status embeds.
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

Docstring coverage is 40.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentation-only edits and deletions within surviving functions are included; unchanged diff context and fully deleted functions are excluded. Analyzed 5 functions across 3 files.

Resolution

Write docstrings for the functions missing them to satisfy the coverage threshold.

Finishing Touches: 💡 1

📝 Generate docstrings: 💡

• Commit to this branch
• Create a new PR

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

🔇 Additional comments: 1

src/Civ13/GameServer.php-1909-1910: 1

1909-1910: Major · Stability & Availability · Heavy lift

⚠️ Unverified finding
Verification ran but could not confirm this finding. It is shown for review, not as a verified issue.

Reject network-backed paths before probing them.

A mapped network drive such as Z:\game passes this guard. is_file() then performs a network lookup on the event-loop thread, which can stall the bot when the share is unavailable. Check the underlying volume before probing the host file; a path-prefix check alone cannot establish that it is local. (learn.microsoft.com)

---

Review info

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: bae59077-3b0e-44d7-9654-2bd509bc620e

Commits

Reviewing files that changed from the base of the PR and between 813e4b2 and 452974b.

Files selected for processing: 3

• src/Civ13/GameServer.php
• tests/local/heartbeat-integration.php
• tests/local/server-compatibility.php

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 9 remain after this review.