fix: enforce safe DropsBot start payloads

[svg8bit]

Summary

• derive the maximum event slug length from Telegram's official 64-character start payload limit
• add the exact long live Polymarket slug found during production verification as a rejection regression
• retain strict official-host, slug-character, payload-length, and Hormuz override checks

Why the long event has no Track button

The live event's TRACKpm_... payload is 76 characters, so Telegram cannot deliver it through the official bot deep-link contract. OddsFront intentionally keeps the valid Market action and withholds an unusable Track action until a server-side short-ID lookup contract exists.

Verification

• Red: the 256-character implementation accepted the invalid 76-character payload
• Green: the exact live payload and every 57+ character slug are rejected
• valid 64-character payloads and Hormuz overrides remain accepted
• npm run check on Node 24.19.0

Summary by CodeRabbit

• Bug Fixes
  • Improved validation of DropsBot tracking links to enforce Telegram’s maximum supported parameter length.
  • Added clearer handling for malformed or unsupported event slugs and overlong tracking slugs.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
oddsfront	Ready	Preview	Aug 11, 2026 9:46am

[coderabbitai]

📝 Walkthrough

Walkthrough

The change adds Telegram’s start-parameter limit, derives the DropsBot tracking slug limit from it, and updates preview tests for malformed and 57-character slugs.

Changes

Tracking slug limits

Layer / File(s)	Summary
Slug limit contract and validation lib/polymarket-links.ts, tests/global-conflict-map-preview.spec.ts	TELEGRAM_START_MAX_LENGTH is set to 64. MAX_DROPSBOT_TRACK_SLUG_LENGTH now derives from that limit and the tracking prefix length. Tests cover malformed slugs and 57-character slugs.

Estimated code review effort: 1 (Trivial) | ~5 minutes

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title clearly summarizes the main change: enforcing safe DropsBot start payloads.
Description check	✅ Passed	The description explains the change and verification, but it omits the template's What changed and Safety sections.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/activity-track-links

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 167e459270

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".