Jamie BruntonandClaude Opus 5
f88db1ae7d
Reddit answers a throttled client with a large HTML 403 interstitial. To the comment client that was indistinguishable from a logged-out session: the body would not parse, so no modhash was found, so it reported "Reddit did not return a modhash for this session" and returned session-invalid — which calls auth.invalidate() and so could disrupt outreach and chat for an account whose session was perfectly healthy. That matches what prod is doing. u/Saira_Makimad posted successfully 25 seconds after boot and every later attempt failed with that message, which is the shape of Reddit starting to throttle rather than a session going bad. A response is now only treated as a verdict about the session when it is actually JSON. Non-JSON, at any status, is Reddit refusing to serve us and stays retryable. A genuine JSON 403, or JSON with no modhash, still invalidates as before. When Reddit does report a signed-out session, the log and the recorded reason now name the cookies visible to the write origin — names and domains only, never values. Cookies scoped to www.reddit.com rather than .reddit.com would produce exactly this symptom, and this makes that answerable from the logs instead of by guesswork. Also clarify the allowance in the dashboard. It is derived from the trust level rather than typed in, and it is a rolling 24-hour window, neither of which the page said. A per-community cap above the account allowance now says how much of it is actually reachable, because "1 of 10 today" next to an account limit of 2 reads as far more headroom than exists. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
RedditBot documentation
This directory is the starting point for agents and maintainers. It explains the system at the level needed to make safe changes; source code, tests, database migrations, and the generated API reference remain authoritative.
Read this first
RedditBot is a stateful, multi-account outreach and conversation application. It discovers eligible Reddit posts, prepares AI-generated openers, sends them through Reddit's Matrix chat service, follows replies under bounded policies, records outcomes, and exposes an authenticated operator dashboard and agent API.
The most important operational fact is that local and production configuration may be live-capable. Installing dependencies, building, and testing are safe. Starting the backend, invoking control endpoints, importing sessions, sending messages, or deploying may affect real Reddit accounts and requires explicit authorization.
Documentation map
| Document | Use it when |
|---|---|
| Product goals and safety | You need the purpose, product boundaries, eligibility policy, or definition of success. |
| Architecture | You need the system shape, process lifecycle, dependency boundaries, or repository map. |
| Runtime flows | You are changing discovery, screening, candidate delivery, replies, chat sync, media, or realtime updates. |
| Service map | You need to find the module that owns a responsibility or identify extension seams. |
| Data model | You are changing persistence, migrations, account scoping, idempotency, or analytics. |
| Configuration | You are adding a setting, changing precedence, or diagnosing startup validation. |
| API | You are using or changing HTTP/MCP operations. This file is generated. |
| Frontend | You are changing the React dashboard, shared contracts, queries, routes, or SSE behavior. |
| Development and testing | You are setting up locally, implementing a change, or choosing verification commands. |
| Deployment and operations | You are diagnosing or performing Docker/Dokploy work, backups, recovery, or live verification. |
Fast orientation by task
- Candidate selection or outreach: read product-and-safety, data-flow, services, and database.
- Conversation automation: read product-and-safety, data-flow, and the conversation state/claim sections in database.
- Dashboard/API work: read frontend, api, and architecture.
- Authentication or account work: read architecture, configuration, database, and deployment.
- Production incident: read deployment first, then the flow and service that own the failing state.
- Schema or config change: read database/configuration and update both transport contracts and tests where applicable.
Sources of truth
Use this order when facts conflict:
- Observable behavior and focused tests.
- Shared Zod transport contracts in
packages/api-contracts/src/. - Runtime Zod configuration in
src/config/index.tsand migrations insrc/database/client.ts. - Owning implementation under
src/orapps/dashboard/src/. - Generated
docs/api.mdand live/api/openapi.json. - Narrative documentation in this directory.
Documentation should explain why boundaries exist and where behavior lives. Avoid copying entire schemas, hard-coded production identifiers, current counts, or secrets into prose.
Keeping documentation current
Every code change must include the documentation changes needed to keep this map accurate. In particular:
- Add or remove links here when documents change.
- Update architecture and service ownership when dependencies move.
- Update runtime flows when ordering, eligibility, retries, or idempotency changes.
- Update configuration and data model documents with schema changes.
- Run
npm run docs:apiafter modifyingsrc/web/api-catalog.ts. - Keep historical plans out of current-state documents; use Git history for retired designs.
See the repository-level agents.md for the mandatory agent workflow.