In `@waifu-deal-sniper/bot.js`:
- Around line 1415-1459: The runWatchChecker function can be invoked while a
previous execution is still running, causing overlapping runs and duplicate
notifications; add a reentrancy guard (e.g., a module-level boolean like
isWatchCheckerRunning) or switch to scheduling the next run after completion
(use setTimeout chaining instead of setInterval) so a new invocation returns
immediately if isWatchCheckerRunning is true; set the flag to true at the start
of runWatchChecker and ensure it is cleared in a finally block (or clear after
all watches processed) to avoid leaving it stuck, and update the interval
scheduling code (the setInterval/start call that triggers runWatchChecker) to
use the new non-overlapping pattern.
- Around line 1497-1499: The current console.log call printing message.content
(console.log(`📨 Message from ${message.author.username}:
"${message.content.slice(0, 50)}" (DM: ${isDM})`)) risks leaking PII; change it
so raw DM content is never logged in production by gating detailed logging
behind a DEBUG flag (e.g., process.env.DEBUG_LOGGING === 'true') or by logging
only metadata when the flag is false (author id, username, message length, isDM,
message.id) and, if DEBUG is true, include a safe redacted preview rather than
full content. Locate the console.log in the message handler (references:
message, isDM) and replace/wrap it with a conditional that checks the DEBUG flag
and falls back to metadata-only logging.
- Around line 374-380: The MAX price text in searchSite is hard-coded to "JPY"
causing wrong filtering for other sites; update the construction of the goal
string in async function searchSite (the site.goal + ... line) to use the site's
currency (e.g., site.currency) instead of "JPY", and if the app must compare
across sites either convert maxPrice into the site's currency before appending
or clearly state in the goal which site's currency is expected (e.g., "Only
items under {maxPrice} {site.currency}"). Ensure you reference the maxPrice
handling and site.goal so the message and any filtering logic use the correct
currency semantics.
- Around line 885-894: The main search path never updates lastSearchResults so
subsequent commands like gacha_last or roast can't access the latest results;
after computing result.items (before sending the summary/embed) update the
shared lastSearchResults store for this user (e.g., set
lastSearchResults[user.id] or the appropriate per-user key used by
gacha_last/roast to point to result.items) so the gacha_last and roast handlers
can read the most recent standard search results; place this update near the
block that computes deals (referencing result.items, user.id, and
lastSearchResults/gacha_last/roast).
- Around line 539-590: Sanitize external fields before embedding: in
createFigureEmbed() apply sanitizeForDisplay() to item.name,
item.item_grade/item.condition, item.box_grade (if considered condition), and
any item.manufacturer or item.seller used in the description/title/footer so the
embedded text cannot contain `@everyone/`@here; mirror the same sanitization in
createSiteEmbed() for item.name, item.condition, item.seller and
item.manufacturer referenced there. Also, when sending embeds (the message
send/interaction reply calls that include the EmbedBuilder from
createFigureEmbed/createSiteEmbed), add allowedMentions: { parse: [] } to the
send options to disable mention parsing as defense-in-depth. Ensure you only
transform display strings (don’t mutate raw item objects) and reference the
functions createFigureEmbed and createSiteEmbed when making the changes.

In `@waifu-deal-sniper/package.json`:
- Around line 6-26: The package.json currently sets "engines.node": ">=18.0.0"
while the "dev" script uses "node --watch" which is only stable in Node
>=20.13.0; either raise the engine requirement or remove the dependency on the
experimental flag: update "engines.node" to ">=20.13.0" if you want to keep
using "node --watch", or change the "scripts.dev" entry to use nodemon (e.g.,
"nodemon --watch bot.js bot.js") and add nodemon to devDependencies so
development works on older Node 18.x without forcing a node version bump; modify
the "scripts.dev" and "devDependencies" accordingly and ensure "scripts.start"
and "scripts.dev" remain consistent with the chosen approach.

In `@waifu-deal-sniper/README.md`:
- Line 3: Replace bare URLs in the README with proper Markdown link syntax to
satisfy MD034: change the literal OAuth2 link at the "Live Demo" line into a
labeled link like "Live Demo: [text](https://discord.com/...)" and similarly
convert the other bare URL noted at line 19 into a descriptive label with
bracketed text followed by the URL in parentheses; ensure each link uses the
form [label](URL) and keep descriptive labels (e.g., "Live Demo") for
readability.
- Around line 113-115: The README contains several fenced code blocks missing
language identifiers which fails linting; add a language tag (e.g., "text") to
each triple-backtick fence for the blocks that include the Discord OAuth URL
("https://discord.com/oauth2/authorize?client_id=YOUR_CLIENT_ID..."), the large
ASCII architecture diagram (the block starting with the DISCORD USER/ DISCORD
BOT diagram), and the repository file tree block that begins
"waifu-deal-sniper/"; ensure you update every matching fenced block (also the
other occurrences mentioned around the ASCII/art and file-tree sections) so each
opening ``` becomes ```text.

In `@waifu-deal-sniper/bot.js`:
- Around line 1256-1265: The embed description uses chosen.name unsanitized;
call the existing sanitizeForDisplay function on the name before trimming and
inserting into the EmbedBuilder. Replace the current interpolation
`${(chosen.name || 'Mystery Figure').slice(0, 200)}` with a sanitized value
(e.g., const safeName = sanitizeForDisplay(chosen.name || 'Mystery Figure') and
then use safeName.slice(0,200)) so EmbedBuilder.setDescription uses the
sanitized, truncated string; update the code around EmbedBuilder (the
setDescription line) accordingly.
- Around line 1493-1499: The embed title currently interpolates untrusted
deal.name in embed.setTitle (within the block that calls createFigureEmbed and
discordUser.send), which can contain mentions or markdown—sanitize deal.name
before use; replace (deal.name || watch.query) with a sanitized value using the
existing sanitizeForDisplay utility (or an equivalent mention-escaping function)
and use that sanitized string in embed.setTitle and the discordUser.send content
to prevent accidental mentions/formatting.

In `@waifu-deal-sniper/bot.js`:
- Around line 1318-1322: In handleGachaLast (same pattern as handleGacha) the
embed uses unsanitized chosen.name; update the EmbedBuilder description to call
sanitizeForDisplay(chosen.name) before using it (and keep the existing fallback
'Mystery Figure' and .slice(0, 200) behavior), so the display string is
sanitized prior to slicing/embedding; locate the EmbedBuilder construction in
handleGachaLast and replace direct uses of chosen.name with
sanitizeForDisplay(chosen.name).
- Around line 1587-1592: The SIGTERM handler in process.on('SIGTERM') currently
calls client.destroy() and exits without persisting the sql.js database; export
the existing saveDb function from the database module (ensure saveDb is added to
module.exports alongside other exports) and update the SIGTERM handler to
require/import that saveDb and call await saveDb() (or call it and wait for its
Promise) before client.destroy() and process.exit(0), handling errors from
saveDb so shutdown still completes.