test: add the boot harness as npm test and run it in CI

test/harness.js does what main.js does without logging in: it unions the
intents, builds the shared command registry through all three attach() calls,
serializes the exact rest.put payload (33 commands, no duplicates, valid names,
4 context menus), and dispatches mock interactions through the real
InteractionCreate listeners. It also verifies that every gcfg.*_ROLE_ID used
anywhere in the code exists in core/config.js and looks like a snowflake,
exercises the Collection surface discord.js relies on, and round trips the
points system. data/points.json is restored afterwards, so the run is safe on a
machine holding real data. 58 checks.

The final section makes one unauthenticated request to Discord: it logs in with
an invalid token and asserts Discord rejects it, which proves the REST stack
works end to end. That is the check that caught undici 8 breaking
@discordjs/rest. SKIP_NETWORK_TESTS=1 skips it for offline work.

The header documents what the harness cannot cover: an invalid token fails at
REST authentication, so the gateway WebSocket never opens and @discordjs/ws is
never exercised. An override of that package passed 47 of 47 checks here and
still crashed the bot on startup. Gateway changes need a real login.

Both READMEs gain a Testing section and a short note on why there are no
overrides, and the dependency table was still listing discord.js ^14.26.4 and
dotenv ^16.6.1.

Author: Musiker15

.github/workflows/ci.yml

@@ -59,6 +59,14 @@ jobs:
           done
           echo "$FILES" | wc -l | xargs printf '✅ %s files parsed without errors.\n'
 
+      # Boots every bot module against a fake client, serializes the exact
+      # payload main.js sends to Discord and dispatches mock interactions
+      # through the real listeners. Also makes one unauthenticated request to
+      # Discord to prove the REST stack works, which is what catches a broken
+      # undici. See the header of test/harness.js for what it cannot cover.
+      - name: Boot harness
+        run: npm test
+
       # points_config.json is read at runtime, a broken one takes the bot down.
       - name: Validate tracked JSON files
         run: |

README.md

@@ -261,6 +261,34 @@ Point values per game are configurable in `bots/minigames/points_config.json`.
 
 ---
 
+## Testing
+
+```bash
+npm test
+```
+
+`test/harness.js` boots every bot module against a fake client, exactly the way
+`main.js` does but without logging in. It unions the intents, builds the shared
+command registry through all three `attach()` calls, serializes the exact
+payload that goes to Discord, and dispatches mock interactions through the real
+`InteractionCreate` listeners. It also round trips the points system and
+restores `data/points.json` afterwards, so it is safe to run on a machine that
+holds real data.
+
+The last section makes one unauthenticated request to Discord: it logs in with
+an obviously invalid token and asserts that Discord rejects it. That proves the
+REST stack works end to end. Set `SKIP_NETWORK_TESTS=1` to skip it offline.
+
+**What it cannot cover.** An invalid token fails at REST authentication, so the
+gateway WebSocket is never opened and `@discordjs/ws` never runs. Anything that
+touches the gateway needs a real login with a real token. This is not a
+theoretical gap: an `@discordjs/ws` override once passed this harness 47 checks
+out of 47 and still crashed the bot on startup.
+
+The harness runs in CI on every pull request.
+
+---
+
 ## Project Structure
 
 ```
@@ -275,6 +303,8 @@ discord_multibot/
 │       ├── codeql.yml               ← Code scanning
 │       ├── deploy.yml               ← SSH deploy + systemd restart on push to main
 │       └── release.yml              ← GitHub release on v* tags
+├── test/
+│   └── harness.js                   ← Boot harness, run via npm test
 ├── core/
 │   ├── config.js                    ← Environment config
 │   ├── utils.js                     ← Shared helpers (makeEmbed, readJson, …)
@@ -323,11 +353,28 @@ discord_multibot/
 
 | Package | Version |
 |---|---|
-| [discord.js](https://discord.js.org) | `^14.26.4` |
-| [dotenv](https://github.com/motdotla/dotenv) | `^16.6.1` |
+| [discord.js](https://discord.js.org) | `^14.27.0` |
+| [dotenv](https://github.com/motdotla/dotenv) | `^17.4.2` |
 
 Dependency updates are monitored automatically via [Dependabot](.github/dependabot.yml) (weekly, grouped).
 
+### No overrides, on purpose
+
+`npm outdated --all` reports major updates for `@discordjs/collection`,
+`@discordjs/ws` and `undici`. They belong to the discord.js 15 line and are
+deliberately left alone. Both attempts to force them failed:
+
+- **`undici@8`** kills the REST layer. `@discordjs/rest` puts Node's
+  `sensitiveHeaders` symbol into the request headers and undici 8 rejects it
+  (`Key Symbol(sensitiveHeaders) in init is a symbol, which cannot be converted
+  to a ByteString`). No command registration, no interaction reply. `npm test`
+  catches this one.
+- **`@discordjs/ws@2.0.4`** passed every test and crashed the bot on startup in
+  production. Note that discord.js 14.27.0 pins `@discordjs/collection` to
+  exactly `1.5.3`, without a caret.
+
+Patch level updates inside the existing ranges are fine and need no override.
+
 ---
 
 ## Links

README_DE.md

@@ -262,6 +262,36 @@ Die Punktwerte pro Spiel sind in `bots/minigames/points_config.json` konfigurier
 
 ---
 
+## Tests
+
+```bash
+npm test
+```
+
+`test/harness.js` bootet alle Bot-Module gegen einen Fake-Client, genau wie
+`main.js`, nur ohne Login. Es vereinigt die Intents, baut die gemeinsame
+Command-Registry über alle drei `attach()`-Aufrufe, serialisiert exakt das
+Payload, das an Discord geht, und schickt Mock-Interactions durch die echten
+`InteractionCreate`-Listener. Das Punktesystem wird ebenfalls durchgespielt und
+`data/points.json` danach wiederhergestellt, der Lauf ist also auch auf einer
+Maschine mit echten Daten unbedenklich.
+
+Der letzte Abschnitt stellt eine unauthentifizierte Anfrage an Discord: Login
+mit offensichtlich ungültigem Token, und die Erwartung, dass Discord ihn
+ablehnt. Das beweist, dass die REST-Schicht durchgängig funktioniert. Mit
+`SKIP_NETWORK_TESTS=1` bleibt der Test offline außen vor.
+
+**Was er nicht abdeckt.** Ein ungültiges Token scheitert an der
+REST-Authentifizierung, der Gateway-WebSocket wird also nie geöffnet und
+`@discordjs/ws` nie ausgeführt. Alles, was den Gateway betrifft, braucht einen
+echten Login mit echtem Token. Das ist keine theoretische Lücke: ein
+`@discordjs/ws`-Override hat diesen Harness mit 47 von 47 bestanden und den Bot
+trotzdem beim Start zum Absturz gebracht.
+
+Der Harness läuft in der CI bei jedem Pull Request.
+
+---
+
 ## Projektstruktur
 
 ```
@@ -276,6 +306,8 @@ discord_multibot/
 │       ├── codeql.yml               ← Code Scanning
 │       ├── deploy.yml               ← SSH-Deploy + systemd-Restart bei Push auf main
 │       └── release.yml              ← GitHub-Release bei v*-Tags
+├── test/
+│   └── harness.js                   ← Boot-Harness, Aufruf über npm test
 ├── core/
 │   ├── config.js                    ← Umgebungskonfiguration
 │   ├── utils.js                     ← Gemeinsame Helfer (makeEmbed, readJson, …)
@@ -324,11 +356,29 @@ discord_multibot/
 
 | Paket | Version |
 |---|---|
-| [discord.js](https://discord.js.org) | `^14.26.4` |
-| [dotenv](https://github.com/motdotla/dotenv) | `^16.6.1` |
+| [discord.js](https://discord.js.org) | `^14.27.0` |
+| [dotenv](https://github.com/motdotla/dotenv) | `^17.4.2` |
 
 Dependency-Updates werden automatisch über [Dependabot](.github/dependabot.yml) überwacht (wöchentlich, gruppiert).
 
+### Bewusst keine Overrides
+
+`npm outdated --all` meldet Major-Updates für `@discordjs/collection`,
+`@discordjs/ws` und `undici`. Die gehören zur discord.js-15-Linie und bleiben
+bewusst liegen. Beide Versuche, sie zu erzwingen, sind gescheitert:
+
+- **`undici@8`** zerlegt die REST-Schicht. `@discordjs/rest` reicht Nodes
+  `sensitiveHeaders`-Symbol in die Request-Header, undici 8 lehnt das ab (`Key
+  Symbol(sensitiveHeaders) in init is a symbol, which cannot be converted to a
+  ByteString`). Keine Command-Registrierung, keine Interaction-Antwort. Das
+  findet `npm test`.
+- **`@discordjs/ws@2.0.4`** hat jeden Test bestanden und den Bot in Produktion
+  beim Start zum Absturz gebracht. discord.js 14.27.0 pinnt
+  `@discordjs/collection` übrigens auf exakt `1.5.3`, ohne Caret.
+
+Patch-Updates innerhalb der bestehenden Ranges sind unproblematisch und
+brauchen keinen Override.
+
 ---
 
 ## Links

package.json

@@ -4,7 +4,8 @@
   "description": "MSK Scripts Discord Multi-Bot",
   "main": "main.js",
   "scripts": {
-    "start": "node main.js"
+    "start": "node main.js",
+    "test": "node test/harness.js"
   },
   "dependencies": {
     "discord.js": "^14.27.0",