feat: add honeypot anti-spam channel

[DysektAI]

User description

Summary

• Adds an optional honeypot channel (HONEYPOT_CHANNEL_ID) that auto-bans anyone who posts in it, falling back to kick if the ban fails (permissions/hierarchy).
• On startup the bot posts an idempotent warning message — skipped if one already exists (detected via a stable marker, no persisted state needed).
• Sweeps messages older than 16h hourly (and once on startup), preserving the warning message. Uses Discord bulk-delete within the 14-day window and individual deletes beyond it.
• HONEYPOT_CHANNEL_ID is optional — when unset the feature is a no-op, so existing deployments and the test suite are unaffected.
• New module lives at src/handlers/honeypotHandler.js, following the existing setupXxx(client) handler pattern and wired into bot.js.

Closes #24.

Design notes

• setInterval (hourly) over cron/sweepers: the bot process is already the scheduler, and discord.js sweepers only clear the local cache, not Discord messages.
• Ban over kick: honeypots catch bot/spam accounts — banning prevents rejoining. Kick is the fallback.
• Idempotency via an HTML-comment marker in the bot's warning message, detected by fetching recent messages on startup.

Test plan

• npm test — 6/6 pass (4 existing env tests + 2 new honeypot tests: no-op when unset, registers listener when enabled)
• node --check syntax sweep passes on all JS files
• No changes to requiredEnvVars — feature is opt-in

---

CodeAnt-AI Description

Add an optional honeypot channel that bans spam accounts and keeps the channel clean

What Changed

• When the optional honeypot channel is enabled, anyone who posts in it is banned immediately, with a kick fallback if banning is not allowed
• The bot now posts one warning message in that channel and reuses it after restarts instead of creating duplicates
• Messages older than 16 hours are removed on startup and then swept every hour, while preserving the warning message
• Added tests to confirm the feature stays inactive when the channel is not configured and turns on when it is
• Updated the setup docs and example env file to explain how to enable the honeypot channel

Impact

✅ Fewer spam posts in hidden channels
✅ Faster removal of unwanted messages
✅ Clearer setup for optional anti-spam protection

💡 Usage Guide

Checking Your Pull Request

Every time you make a pull request, our system automatically looks through it. We check for security issues, mistakes in how you're setting up your infrastructure, and common code problems. We do this to make sure your changes are solid and won't cause any trouble later.

Talking to CodeAnt AI

Got a question or need a hand with something in your pull request? You can easily get in touch with CodeAnt AI right here. Just type the following in a comment on your pull request, and replace "Your question here" with whatever you want to ask:

@codeant-ai ask: Your question here

This lets you have a chat with CodeAnt AI about your pull request, making it easier to understand and improve your code.

Example

@codeant-ai ask: Can you suggest a safer alternative to storing this secret?

Preserve Org Learnings with CodeAnt

You can record team preferences so CodeAnt AI applies them in future reviews. Reply directly to the specific CodeAnt AI suggestion (in the same thread) and replace "Your feedback here" with your input:

@codeant-ai: Your feedback here

This helps CodeAnt AI learn and adapt to your team's coding style and standards.

Example

@codeant-ai: Do not flag unused imports.

Retrigger review

Ask CodeAnt AI to review the PR again, by typing:

@codeant-ai: review

Check Your Repository Health

To analyze the health of your code repository, visit our dashboard at https://app.codeant.ai. This tool helps you identify potential issues and areas for improvement in your codebase, ensuring your repository maintains high standards of code health.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: 370391a0-8f9a-4422-8275-e6a34f4f5a49

📥 Commits

Reviewing files that changed from the base of the PR and between a8898ea and 7affd90.

📒 Files selected for processing (2)

• src/handlers/honeypotHandler.js
• test/honeypot.test.js

---

📝 Walkthrough

Summary by CodeRabbit

• New Features
  • Added an optional honeypot anti-spam mode for a dedicated hidden channel.
  • Messages sent in that channel are automatically removed, and the sender is blocked with a fallback action if needed.
  • The app now starts this protection automatically when the setting is enabled.
• Documentation
  • Updated setup docs and example environment settings to explain the new optional channel and what happens when it's configured or left blank.

Walkthrough

Adds a Discord honeypot feature that watches a configured hidden channel, removes trigger messages, bans or kicks authors, periodically cleans up older messages, and wires the handler into startup. It also documents the environment variable and adds tests for setup behavior.

Changes

Honeypot Feature

Layer / File(s)	Summary
Honeypot handler core logic src/handlers/honeypotHandler.js	Defines the honeypot constants, sets up the ready and message listeners, ensures the warning message exists, and punishes users who post in the configured channel.
Cleanup pagination and deletion src/handlers/honeypotHandler.js	Implements bounded message pagination and cleanup of old messages, splitting deletions between bulk delete and individual delete paths.
Bot startup wiring bot.js	Imports setupHoneypot and invokes it with the client instance during startup alongside the existing handler registrations.
Configuration and documentation .env.example, README.md	Adds a commented-out HONEYPOT_CHANNEL_ID placeholder and documents the honeypot feature and environment variable behavior.
Setup behavior tests test/honeypot.test.js	Adds tests verifying setupHoneypot is a no-op without the env var and registers listeners when it is set.

Estimated code review effort: 3 (Moderate) | ~25 minutes

Sequence Diagram(s)

sequenceDiagram
  participant Client
  participant HoneypotHandler
  participant Channel
  participant Author

  Client->>HoneypotHandler: ClientReady
  HoneypotHandler->>Channel: ensureHoneypotMessage()
  HoneypotHandler->>Channel: cleanupOldMessages() (initial + hourly)
  Author->>Channel: post message
  Channel->>HoneypotHandler: MessageCreate event
  HoneypotHandler->>Channel: delete message
  HoneypotHandler->>Author: ban (fallback: kick)

Loading

Suggested labels: enhancement

Suggested reviewers: Nivmizz7

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Linked Issues check	⚠️ Warning	The core honeypot behavior is implemented, but the requested production configuration env var change is not shown.	Add HONEYPOT_CHANNEL_ID to the production configuration as requested, or note the relevant deployment file if it already exists.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly summarizes the main change: adding an optional honeypot anti-spam channel.
Description check	✅ Passed	The description matches the PR and describes the honeypot channel, cleanup behavior, and tests.
Out of Scope Changes check	✅ Passed	The changes are focused on the honeypot feature, docs, config example, and tests with no obvious unrelated additions.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch feat/honeypot

Warning

Tools execution failed with the following error:

Failed to run tools: Stream initialization permanently failed: 13 INTERNAL: Received RST_STREAM with code 2 (Internal server error)

---

_{Comment @coderabbitai help to get the list of available commands.}

[DysektAI]

Hey @Nivmizz7 — both PRs are ready to merge and have been re-approved by CodeRabbit after the review fixes:

• chore: add AGENTS.md with project conventions and verification steps #30 (chore: AGENTS.md) — CI green, no code changes
• feat: add honeypot anti-spam channel #31 (feat: honeypot, closes Add honeypot #24) — CI green, 6/6 tests pass, approved

The only failing check is code/snyk which is a pre-existing org-wide quota issue ("Code test limit reached") unrelated to these changes.

When you merge, please verify the honeypot works end-to-end on the server:

1. Set HONEYPOT_CHANNEL_ID to the target hidden channel in production env
2. Restart the bot — confirm the warning message appears in the channel (and doesn't duplicate on restart)
3. Confirm the bot has Ban Members permission in the guild
4. Have a test account post in the channel — it should be banned (or kicked if ban fails) and the message deleted
5. Wait/verify the 16h sweep runs (or just confirm no errors in logs)

Feel free to merge #30 first (no risk), then #31.

[Nivmizz7]

LGTM