@serverkgg/bridge 0.1.9 → 0.1.11

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@serverkgg/bridge",
-	"version": "0.1.9",
+	"version": "0.1.11",
 	"description": "Serverk game bridge and driver runtime, wire protocol, manifest schema, and maintainer CLI",
 	"homepage": "https://serverk.gg",
 	"license": "SEE LICENSE IN LICENSE.md",

package/src/bot/botCauses.test.ts

@@ -25,6 +25,26 @@ const CASES: readonly {
 		line: "GrammyError: Call to 'getMe' failed! (401: Unauthorized)",
 		cause: BridgeCrashCause.TokenInvalid,
 	},
+	{
+		line: "TelegramError: 401: Unauthorized",
+		cause: BridgeCrashCause.TokenInvalid,
+	},
+	{
+		line: 'error: [polling_error] {"code":"ETELEGRAM","message":"ETELEGRAM: 401 Unauthorized"}',
+		cause: BridgeCrashCause.TokenInvalid,
+	},
+	{
+		line: "TelegramApiError: 401: Unauthorized",
+		cause: BridgeCrashCause.TokenInvalid,
+	},
+	{
+		line: "DiscordAPIError[0]: 401: Unauthorized",
+		cause: BridgeCrashCause.TokenInvalid,
+	},
+	{
+		line: "httpx.HTTPStatusError: Client error '401 Unauthorized' for url 'https://api.telegram.org/bot***/getMe'",
+		cause: BridgeCrashCause.TokenInvalid,
+	},
 	{
 		line: "telegram.error.InvalidToken: The token `123:abc` was rejected by the server.",
 		cause: BridgeCrashCause.TokenInvalid,
@@ -101,6 +121,18 @@ const CASES: readonly {
 		line: "discord.errors.PrivilegedIntentsRequired: Shard ID None is requesting privileged intents that have not been explicitly enabled in the developer portal.",
 		cause: BridgeCrashCause.IntentsDisallowed,
 	},
+	{
+		line: "Error: Disallowed intents specified",
+		cause: BridgeCrashCause.IntentsDisallowed,
+	},
+	{
+		line: "GatewayError: Disallowed intents specified. Make sure any privileged intents you're trying to access have been enabled in the developer portal.",
+		cause: BridgeCrashCause.IntentsDisallowed,
+	},
+	{
+		line: "hikari.errors.GatewayServerClosedConnectionError: Server closed connection with code 4014 (Disallowed intent(s))",
+		cause: BridgeCrashCause.IntentsDisallowed,
+	},
 	{
 		line: "telegram.error.Conflict: Conflict: terminated by other getUpdates request; make sure that only one bot instance is running",
 		cause: BridgeCrashCause.TokenInUse,
@@ -109,6 +141,62 @@ const CASES: readonly {
 		line: "GrammyError: Call to 'getUpdates' failed! (409: Conflict: terminated by other getUpdates request; make sure that only one bot instance is running)",
 		cause: BridgeCrashCause.TokenInUse,
 	},
+	{
+		line: "TelegramError: 409: Conflict: terminated by other getUpdates request; make sure that only one bot instance is running",
+		cause: BridgeCrashCause.TokenInUse,
+	},
+	{
+		line: 'error: [polling_error] {"code":"ETELEGRAM","message":"ETELEGRAM: 409 Conflict: terminated by other getUpdates request; make sure that only one bot instance is running"}',
+		cause: BridgeCrashCause.TokenInUse,
+	},
+	{
+		line: "TelegramApiError: 409: Conflict: terminated by other getUpdates request; make sure that only one bot instance is running",
+		cause: BridgeCrashCause.TokenInUse,
+	},
+	{
+		line: "TelegramError: 409: Conflict: terminated by setWebhook request",
+		cause: BridgeCrashCause.TokenInUse,
+	},
+	{
+		line: "GrammyError: Call to 'getUpdates' failed! (409: Conflict: can't use getUpdates method while webhook is active; use deleteWebhook to delete the webhook first)",
+		cause: BridgeCrashCause.WebhookActive,
+	},
+	{
+		line: "TelegramError: 409: Conflict: can't use getUpdates method while webhook is active; use deleteWebhook to delete the webhook first",
+		cause: BridgeCrashCause.WebhookActive,
+	},
+	{
+		line: "telegram.error.Conflict: Conflict: can't use getUpdates method while webhook is active; use deleteWebhook to delete the webhook first",
+		cause: BridgeCrashCause.WebhookActive,
+	},
+	{
+		line: "aiogram.exceptions.TelegramConflictError: Telegram server says - Conflict: can't use getUpdates method while webhook is active; use deleteWebhook to delete the webhook first",
+		cause: BridgeCrashCause.WebhookActive,
+	},
+	{
+		line: "Error: listen EADDRINUSE: address already in use :::8080",
+		cause: BridgeCrashCause.PortBusy,
+	},
+	{
+		line: "Error: listen EADDRINUSE: address already in use 0.0.0.0:8080",
+		cause: BridgeCrashCause.PortBusy,
+	},
+	{
+		line: "OSError: [Errno 98] Address already in use",
+		cause: BridgeCrashCause.PortBusy,
+	},
+	{
+		line: "OSError: [Errno 98] error while attempting to bind on address ('0.0.0.0', 8080): address already in use",
+		cause: BridgeCrashCause.PortBusy,
+	},
+	{
+		line: "ERROR:    [Errno 98] error while attempting to bind on address ('0.0.0.0', 8080): address already in use",
+		cause: BridgeCrashCause.PortBusy,
+	},
+	{
+		line: "OSError: [Errno 48] Address already in use",
+		cause: BridgeCrashCause.PortBusy,
+	},
 	{
 		line: "Error: Cannot find module 'discord.js'",
 		cause: BridgeCrashCause.MissingDependency,
@@ -185,6 +273,14 @@ const CASES: readonly {
 		line: "error code: 1015",
 		cause: BridgeCrashCause.RateLimited,
 	},
+	{
+		line: "Error 1015: You are being rate limited",
+		cause: BridgeCrashCause.RateLimited,
+	},
+	{
+		line: '"message": "You are being rate limited.",',
+		cause: BridgeCrashCause.RateLimited,
+	},
 	{
 		line: "FATAL ERROR: Reached heap limit Allocation failed - JavaScript heap out of memory",
 		cause: BridgeCrashCause.OutOfMemory,
@@ -285,6 +381,26 @@ describe("BOT_CRASH_EVIDENCE", () => {
 		});
 	}
 
+	it("names an active webhook before the token in use its 409 line also matches", () => {
+		const { ring, print } = botRing();
+
+		print(
+			"GrammyError: Call to 'getUpdates' failed! (409: Conflict: can't use getUpdates method while webhook is active; use deleteWebhook to delete the webhook first)",
+		);
+
+		expect(ring.crash(recordOf())).toBe(BridgeCrashCause.WebhookActive);
+	});
+
+	it("still names a second poller on the token as the token in use", () => {
+		const { ring, print } = botRing();
+
+		print(
+			"GrammyError: Call to 'getUpdates' failed! (409: Conflict: terminated by other getUpdates request; make sure that only one bot instance is running)",
+		);
+
+		expect(ring.crash(recordOf())).toBe(BridgeCrashCause.TokenInUse);
+	});
+
 	it("names the removed audioop module before any other missing module", () => {
 		const { ring, print } = botRing();
 
@@ -345,6 +461,27 @@ describe("BOT_CRASH_EVIDENCE", () => {
 		expect(ring.crash(recordOf())).toBe(BridgeCrashCause.Unknown);
 	});
 
+	for (const line of [
+		"AxiosError: Request failed with status code 401",
+		"AxiosError: Request failed with status code 409",
+		"requests.exceptions.HTTPError: 401 Client Error: Unauthorized for url: https://api.spotify.com/v1/me",
+		"requests.exceptions.HTTPError: 409 Client Error: Conflict for url: https://api.github.com/repos/owner/repo/merges",
+		"aiohttp.client_exceptions.ClientResponseError: 401, message='Unauthorized', url='https://api.spotify.com/v1/me'",
+		"httpx.HTTPStatusError: Client error '401 Unauthorized' for url 'https://api.spotify.com/v1/me'",
+		"httpx.HTTPStatusError: Client error '409 Conflict' for url 'https://api.github.com/repos/owner/repo/merges'",
+		"urllib.error.HTTPError: HTTP Error 401: Unauthorized",
+		"urllib.error.HTTPError: HTTP Error 409: Conflict",
+		"openai.AuthenticationError: Error code: 401 - {'error': {'message': 'Incorrect API key provided: sk-proj-****. You can find your API key at https://platform.openai.com/account/api-keys.', 'type': 'invalid_request_error', 'param': None, 'code': 'invalid_api_key'}}",
+	]) {
+		it(`leaves a refusal from an API other than the bot's platform unexplained from "${line}"`, () => {
+			const { ring, print } = botRing();
+
+			print(line);
+
+			expect(ring.crash(recordOf())).toBe(BridgeCrashCause.Unknown);
+		});
+	}
+
 	it("calls exit 137 out of memory only when the record carries the flag", () => {
 		const unflagged = botRing();
 

package/src/bot/botCauses.ts

@@ -4,7 +4,7 @@ import { BridgeEventName } from "../protocol";
 export const BOT_CRASH_EVIDENCE: readonly BridgeEventPattern[] = [
 	{
 		match:
-			/\[TokenInvalid\]|An invalid token was provided|LoginFailure: Improper token|\b401:? Unauthorized\b|\bInvalidToken\b|TelegramUnauthorizedError|\bACCESS_TOKEN_(?:INVALID|EXPIRED)\b/,
+			/\[TokenInvalid\]|An invalid token was provided|LoginFailure: Improper token|(?:Telegram|ETELEGRAM|Call to '|\/bot[^/\s]*\/|DiscordAPIError\[).*\b401:? Unauthorized\b|\b401:? Unauthorized\b.*(?:Telegram|ETELEGRAM|\/bot[^/\s]*\/)|\bInvalidToken\b|TelegramUnauthorizedError|\bACCESS_TOKEN_(?:INVALID|EXPIRED)\b/,
 		emit: BridgeEventName.TokenInvalid,
 	},
 	{
@@ -19,13 +19,22 @@ export const BOT_CRASH_EVIDENCE: readonly BridgeEventPattern[] = [
 	},
 	{
 		match:
-			/Used disallowed intents|\[DisallowedIntents\]|Privileged intent provided is not enabled or whitelisted|PrivilegedIntentsRequired|close code:? 4014\b/,
+			/Used disallowed intents|\[DisallowedIntents\]|Privileged intent provided is not enabled or whitelisted|PrivilegedIntentsRequired|Disallowed intents specified|Server closed connection with code 4014\b|close code:? 4014\b/,
 		emit: BridgeEventName.IntentsDisallowed,
 	},
 	{
-		match: /terminated by other getUpdates request|\b409:? Conflict\b/,
+		match: /can't use getUpdates method while webhook is active/,
+		emit: BridgeEventName.WebhookActive,
+	},
+	{
+		match:
+			/terminated by other getUpdates request|(?:Telegram|ETELEGRAM|Call to '|\/bot[^/\s]*\/).*\b409:? Conflict\b|\b409:? Conflict\b.*(?:Telegram|ETELEGRAM|\/bot[^/\s]*\/)/,
 		emit: BridgeEventName.TokenInUse,
 	},
+	{
+		match: /EADDRINUSE|\[Errno 98\][^\n]*[Aa]ddress already in use|OSError: [^\n]*Address already in use/,
+		emit: BridgeEventName.PortBindFailed,
+	},
 	{
 		match:
 			/Cannot find module|ERR_MODULE_NOT_FOUND|ModuleNotFoundError: No module named|(?:davey|PyNaCl) library needed in order to use voice/,
@@ -63,6 +72,6 @@ export const BOT_CRASH_EVIDENCE: readonly BridgeEventPattern[] = [
 	{
 		match:
 			/FATAL ERROR: (?:Reached heap limit|Ineffective mark-compacts near heap limit) Allocation failed - JavaScript heap out of memory|^MemoryError\b/,
-		emit: BridgeEventName.ServerCrashed,
+		emit: BridgeEventName.OutOfMemory,
 	},
 ];

package/src/bot/botEnvironment.test.ts

@@ -1,5 +1,8 @@
 import { describe, expect, it } from "bun:test";
 import {
+	BOT_NO_EXPOSURE,
+	type BotExposure,
+	botExposureOf,
 	botProcessEnvironment,
 	customerEnvironment,
 	LAUNCHER_DEPLOYMENT_ID,
@@ -17,7 +20,17 @@ import {
 	platformEnvironment,
 } from "./botEnvironment";
 import { type BotConfig, DEFAULT_REPO_BRANCH } from "./botVariables";
-import { BotPlatform } from "./detect";
+import {
+	BOT_PORT_1_KEY,
+	BOT_PORT_2_KEY,
+	BOT_WEB_PORT_KEY,
+	BotPlatform,
+	PORT,
+	SERVERK_PORT_1,
+	SERVERK_PORT_2,
+	SERVERK_WEB_HOST,
+	SERVERK_WEB_URL,
+} from "./detect";
 
 const SHA = "0123456789abcdef0123456789abcdef01234567";
 
@@ -32,9 +45,33 @@ const config = (overrides: Partial<BotConfig> = {}): BotConfig => ({
 	deployment: null,
 	snapshot: null,
 	gitToken: null,
+	webUrl: null,
+	...overrides,
+});
+
+const WEB_URL = "https://my-bot.srvk.gg";
+
+const exposureOf = (overrides: Partial<BotExposure> = {}): BotExposure => ({
+	...BOT_NO_EXPOSURE,
 	...overrides,
 });
 
+const contextWith = (ports: Record<string, number>, variables: Record<string, string> = {}) => {
+	return {
+		port: (key: string) => {
+			const value = ports[key];
+
+			if (value === undefined) {
+				throw new Error(`this game declares no port named "${key}"`);
+			}
+
+			return value;
+		},
+		variable: (key: string) => variables[key] ?? null,
+		secret: () => null,
+	};
+};
+
 describe("customerEnvironment", () => {
 	it("hands the process every vault key and nothing the platform or the runtime owns", () => {
 		expect(
@@ -152,6 +189,153 @@ describe("platformEnvironment", () => {
 			SERVERK_SERVER_CODE: "abc",
 		});
 	});
+
+	it("hands the bot PORT, the web address and its host while the web port is active", () => {
+		expect(
+			platformEnvironment(
+				"abc",
+				null,
+				exposureOf({
+					web: 8080,
+					webUrl: WEB_URL,
+				}),
+			),
+		).toEqual({
+			SERVERK_BOT: "1",
+			SERVERK_SERVER_CODE: "abc",
+			[PORT]: "8080",
+			[SERVERK_WEB_URL]: WEB_URL,
+			[SERVERK_WEB_HOST]: "my-bot.srvk.gg",
+		});
+	});
+
+	it("hands the bot no PORT and no address while the web port is off, even with an address delivered", () => {
+		expect(
+			platformEnvironment(
+				"abc",
+				null,
+				exposureOf({
+					webUrl: WEB_URL,
+				}),
+			),
+		).toEqual({
+			SERVERK_BOT: "1",
+			SERVERK_SERVER_CODE: "abc",
+		});
+	});
+
+	it("hands the bot PORT alone while the web port is active before its address is known", () => {
+		expect(
+			platformEnvironment(
+				"abc",
+				null,
+				exposureOf({
+					web: 8080,
+				}),
+			),
+		).toEqual({
+			SERVERK_BOT: "1",
+			SERVERK_SERVER_CODE: "abc",
+			[PORT]: "8080",
+		});
+	});
+
+	it("drops an address that is not a bare https host", () => {
+		for (const webUrl of [
+			"http://my-bot.srvk.gg",
+			"https://my-bot.srvk.gg/",
+			"https://my-bot.srvk.gg:8443",
+			"https://My-Bot.srvk.gg",
+		]) {
+			expect(
+				platformEnvironment(
+					"abc",
+					null,
+					exposureOf({
+						web: 8080,
+						webUrl,
+					}),
+				),
+				webUrl,
+			).toEqual({
+				SERVERK_BOT: "1",
+				SERVERK_SERVER_CODE: "abc",
+				[PORT]: "8080",
+			});
+		}
+	});
+
+	it("hands the bot each raw port only while it is active", () => {
+		expect(
+			platformEnvironment(
+				"abc",
+				null,
+				exposureOf({
+					port1: 29_004,
+					port2: 30_017,
+				}),
+			),
+		).toEqual({
+			SERVERK_BOT: "1",
+			SERVERK_SERVER_CODE: "abc",
+			[SERVERK_PORT_1]: "29004",
+			[SERVERK_PORT_2]: "30017",
+		});
+		expect(
+			platformEnvironment(
+				"abc",
+				null,
+				exposureOf({
+					port2: 30_017,
+				}),
+			),
+		).toEqual({
+			SERVERK_BOT: "1",
+			SERVERK_SERVER_CODE: "abc",
+			[SERVERK_PORT_2]: "30017",
+		});
+	});
+});
+
+describe("botExposureOf", () => {
+	it("reads the active ports and the validated address from the bridge context", () => {
+		expect(
+			botExposureOf(
+				contextWith(
+					{
+						[BOT_WEB_PORT_KEY]: 8080,
+						[BOT_PORT_2_KEY]: 30_017,
+					},
+					{
+						[SERVERK_WEB_URL]: WEB_URL,
+					},
+				),
+			),
+		).toEqual({
+			web: 8080,
+			webUrl: WEB_URL,
+			port1: null,
+			port2: 30_017,
+		});
+	});
+
+	it("answers no exposure for a bundle that declares no port", () => {
+		expect(botExposureOf(contextWith({}))).toEqual(BOT_NO_EXPOSURE);
+	});
+
+	it("reads a raw port without the web port", () => {
+		expect(
+			botExposureOf(
+				contextWith({
+					[BOT_PORT_1_KEY]: 29_004,
+				}),
+			),
+		).toEqual(
+			exposureOf({
+				port1: 29_004,
+			}),
+		);
+	});
 });
 
 describe("botProcessEnvironment", () => {
@@ -186,4 +370,37 @@ describe("botProcessEnvironment", () => {
 			BOT_PLATFORM: BotPlatform.Telegram,
 		});
 	});
+
+	it("lets the platform's PORT win over the customer's while the web port is active", () => {
+		const customer = customerEnvironment(
+			{
+				[PORT]: "3000",
+			},
+			{},
+		);
+
+		expect(
+			botProcessEnvironment({
+				tool: {},
+				customer,
+				launcher: {},
+				platform: platformEnvironment(
+					"abc",
+					null,
+					exposureOf({
+						web: 8080,
+						webUrl: WEB_URL,
+					}),
+				),
+			})[PORT],
+		).toBe("8080");
+		expect(
+			botProcessEnvironment({
+				tool: {},
+				customer,
+				launcher: {},
+				platform: platformEnvironment("abc", null),
+			})[PORT],
+		).toBe("3000");
+	});
 });

package/src/bot/botEnvironment.ts

@@ -1,6 +1,20 @@
-import type { BotConfig } from "./botVariables";
+import type { BridgeContext } from "../context";
+import { type BotConfig, readBotConfig, WEB_URL_PATTERN } from "./botVariables";
 import type { BotPlatform } from "./detect";
-import { BOT_PLATFORM, isReservedBotKey, SERVERK_BOT, SERVERK_SERVER_CODE } from "./detect";
+import {
+	BOT_PLATFORM,
+	BOT_PORT_1_KEY,
+	BOT_PORT_2_KEY,
+	BOT_WEB_PORT_KEY,
+	isReservedBotKey,
+	PORT,
+	SERVERK_BOT,
+	SERVERK_PORT_1,
+	SERVERK_PORT_2,
+	SERVERK_SERVER_CODE,
+	SERVERK_WEB_HOST,
+	SERVERK_WEB_URL,
+} from "./detect";
 
 export const LAUNCHER_REPO_URL = "SERVERK_REPO_URL";
 
@@ -112,7 +126,73 @@ export const launcherEnvironment = (config: BotConfig, stateDir: string): Record
 	return environment;
 };
 
-export const platformEnvironment = (code: string, platform: BotPlatform | null): Record<string, string> => {
+export interface BotExposure {
+	web: number | null;
+	webUrl: string | null;
+	port1: number | null;
+	port2: number | null;
+}
+
+export const BOT_NO_EXPOSURE: BotExposure = {
+	web: null,
+	webUrl: null,
+	port1: null,
+	port2: null,
+};
+
+const activePortOf = (context: Pick<BridgeContext, "port">, key: string) => {
+	try {
+		return context.port(key);
+	} catch {
+		return null;
+	}
+};
+
+export const botExposureOf = (context: Pick<BridgeContext, "port" | "variable" | "secret">): BotExposure => {
+	return {
+		web: activePortOf(context, BOT_WEB_PORT_KEY),
+		webUrl: readBotConfig(context).webUrl,
+		port1: activePortOf(context, BOT_PORT_1_KEY),
+		port2: activePortOf(context, BOT_PORT_2_KEY),
+	};
+};
+
+const webEnvironment = (exposure: BotExposure): Record<string, string> => {
+	if (exposure.web === null) {
+		return {};
+	}
+
+	const environment: Record<string, string> = {
+		[PORT]: String(exposure.web),
+	};
+
+	if (exposure.webUrl !== null && WEB_URL_PATTERN.test(exposure.webUrl)) {
+		environment[SERVERK_WEB_URL] = exposure.webUrl;
+		environment[SERVERK_WEB_HOST] = new URL(exposure.webUrl).hostname;
+	}
+
+	return environment;
+};
+
+const rawPortEnvironment = (exposure: BotExposure): Record<string, string> => {
+	const environment: Record<string, string> = {};
+
+	if (exposure.port1 !== null) {
+		environment[SERVERK_PORT_1] = String(exposure.port1);
+	}
+
+	if (exposure.port2 !== null) {
+		environment[SERVERK_PORT_2] = String(exposure.port2);
+	}
+
+	return environment;
+};
+
+export const platformEnvironment = (
+	code: string,
+	platform: BotPlatform | null,
+	exposure: BotExposure = BOT_NO_EXPOSURE,
+): Record<string, string> => {
 	return {
 		[SERVERK_BOT]: "1",
 		[SERVERK_SERVER_CODE]: code,
@@ -121,6 +201,8 @@ export const platformEnvironment = (code: string, platform: BotPlatform | null):
 					[BOT_PLATFORM]: platform,
 				}
 			: {}),
+		...webEnvironment(exposure),
+		...rawPortEnvironment(exposure),
 	};
 };
 

package/src/bot/botVariables.test.ts

@@ -9,6 +9,7 @@ import {
 	ROOT_DIRECTORY_LENGTH_LIMIT,
 	readBotConfig,
 	SNAPSHOT_ID_PATTERN,
+	WEB_URL_PATTERN,
 } from "./botVariables";
 import {
 	BOT_PLATFORM,
@@ -20,6 +21,7 @@ import {
 	REPO_REF,
 	REPO_URL,
 	ROOT_DIRECTORY,
+	SERVERK_WEB_URL,
 	SNAPSHOT_ID,
 	START_COMMAND,
 } from "./detect";
@@ -49,6 +51,7 @@ describe("readBotConfig", () => {
 						[DEPLOYMENT_ID]: "dep_a1b2c3d4",
 						[SNAPSHOT_ID]: "snap_1",
 						[GIT_TOKEN]: "ignored-in-variables",
+						[SERVERK_WEB_URL]: " https://my-bot.srvk.gg ",
 					},
 					{
 						[GIT_TOKEN]: "ghs_installation",
@@ -66,6 +69,7 @@ describe("readBotConfig", () => {
 			deployment: "dep_a1b2c3d4",
 			snapshot: "snap_1",
 			gitToken: "ghs_installation",
+			webUrl: "https://my-bot.srvk.gg",
 		});
 	});
 
@@ -88,8 +92,29 @@ describe("readBotConfig", () => {
 			deployment: null,
 			snapshot: null,
 			gitToken: null,
+			webUrl: null,
 		});
 	});
+
+	it("drops a web address that is not a bare https host", () => {
+		for (const value of [
+			"http://my-bot.srvk.gg",
+			"https://my-bot.srvk.gg/webhook",
+			"https://my-bot.srvk.gg:443",
+			"https://user@my-bot.srvk.gg",
+			"https://My-Bot.srvk.gg",
+			"https://",
+		]) {
+			expect(
+				readBotConfig(
+					contextWith({
+						[SERVERK_WEB_URL]: value,
+					}),
+				).webUrl,
+				value,
+			).toBeNull();
+		}
+	});
 });
 
 describe("the patterns", () => {
@@ -145,6 +170,13 @@ describe("the patterns", () => {
 		}
 	});
 
+	it("take a web address only as https and a lowercase host", () => {
+		expect(WEB_URL_PATTERN.test("https://my-bot.srvk.gg")).toBe(true);
+		expect(WEB_URL_PATTERN.test("https://abc123.srvk.localhost")).toBe(true);
+		expect(WEB_URL_PATTERN.test("https://my-bot.srvk.gg/")).toBe(false);
+		expect(WEB_URL_PATTERN.test("http://my-bot.srvk.gg")).toBe(false);
+	});
+
 	it("accept https repositories and git branch names", () => {
 		expect(REPO_URL_PATTERN.test("https://github.com/you/bot.git")).toBe(true);
 		expect(REPO_URL_PATTERN.test("https://user:pass@github.com/you/bot")).toBe(false);

package/src/bot/botVariables.ts

@@ -10,6 +10,7 @@ import {
 	REPO_REF,
 	REPO_URL,
 	ROOT_DIRECTORY,
+	SERVERK_WEB_URL,
 	SNAPSHOT_ID,
 	START_COMMAND,
 } from "./detect";
@@ -30,6 +31,8 @@ export const ROOT_DIRECTORY_PATTERN =
 
 export const ROOT_DIRECTORY_LENGTH_LIMIT = 255;
 
+export const WEB_URL_PATTERN = /^https:\/\/[a-z0-9.-]+$/;
+
 export const DEFAULT_REPO_BRANCH = "main";
 
 export const isRootDirectory = (value: string) => {
@@ -47,6 +50,7 @@ export interface BotConfig {
 	deployment: string | null;
 	snapshot: string | null;
 	gitToken: string | null;
+	webUrl: string | null;
 }
 
 const present = (value: string | null) => {
@@ -55,6 +59,10 @@ const present = (value: string | null) => {
 	return trimmed.length === 0 ? null : trimmed;
 };
 
+const webUrlOf = (value: string | null) => {
+	return value !== null && WEB_URL_PATTERN.test(value) ? value : null;
+};
+
 export const readBotConfig = (context: Pick<BridgeContext, "variable" | "secret">): BotConfig => {
 	const platform = present(context.variable(BOT_PLATFORM));
 
@@ -69,5 +77,6 @@ export const readBotConfig = (context: Pick<BridgeContext, "variable" | "secret"
 		deployment: present(context.variable(DEPLOYMENT_ID)),
 		snapshot: present(context.variable(SNAPSHOT_ID)),
 		gitToken: present(context.secret(GIT_TOKEN)),
+		webUrl: webUrlOf(present(context.variable(SERVERK_WEB_URL))),
 	};
 };