Prevent fabricated Uncanny Dodge and Evasion refunds

[adrev]

Summary\n- remove the client-reported HP refund behavior from Uncanny Dodge and Evasion\n- make Evasion automatic in the DM's authoritative DEX save-for-half resolver\n- make Uncanny Dodge apply reduced incoming damage directly through CombatService, with strict current-map/class/reaction validation\n- synchronize HP, versions, death saves, conditions, concentration, and action economy through privacy-scoped fanout\n- update command help and add focused security/rules coverage\n\n## Verification\n- 20 focused Uncanny Dodge/Evasion tests\n- 177 focused plus adjacent chat-command tests\n- 1,696/1,696 full tests\n- shared, client, and server production builds\n- strict lint with zero warnings\n- npm audit: zero vulnerabilities\n\n## Deliberate boundary\nUncanny Dodge no longer permits fabricated healing, but its attack trigger is still DM/player-adjudicated because the current attack resolver does not issue a server-bound damage/reaction transaction. A later UI/resolver task should prompt the defending Rogue after a verified hit and before damage.

Summary by CodeRabbit

• New Features
  • Uncanny Dodge now validates eligibility, reaction availability, combat state, and damage timing before reducing incoming damage.
  • Evasion now resolves automatically during qualifying Dexterity saves, applying the correct damage outcome.
  • Damage results now synchronize relevant conditions, death-save state, and combat updates through appropriate private channels.
• Documentation
  • Updated help text to explain Uncanny Dodge usage and the revised Evasion workflow through saving throws.
• Bug Fixes
  • Invalid, duplicate, failed, or unauthorized reactions are rejected without incorrectly changing health or reaction state.

[coderabbitai]

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 8d01f403-d74b-48cf-83bd-270541d059e3

📥 Commits

Reviewing files that changed from the base of the PR and between c8e31e3 and b10a269.

📒 Files selected for processing (4)

• server/src/__tests__/uncanny-evasion-authoritative.test.ts
• server/src/services/chatCommands/classAbilityHandlers.ts
• server/src/services/chatCommands/helpHandlers.ts
• server/src/services/chatCommands/saveHandler.ts

---

📝 Walkthrough

Walkthrough

The PR adds authoritative Uncanny Dodge and Evasion handling. It validates class and combat state, applies damage on the server, resolves Evasion during Dexterity saves, updates combat state, and restricts synchronization events to appropriate private channels.

Changes

Authoritative combat abilities

Layer / File(s)	Summary
Shared authoritative damage pipeline server/src/services/chatCommands/classAbilityHandlers.ts	Validated damage now uses a shared flow for HP, combat, condition, death-save, concentration, grapple, token, and side-effect updates.
Uncanny Dodge reaction flow server/src/services/chatCommands/classAbilityHandlers.ts, server/src/__tests__/uncanny-evasion-authoritative.test.ts	Uncanny Dodge validates Rogue level and actionable combat state, halves incoming damage before resolution, reserves the reaction, restores it after failure, and synchronizes private damage results.
Evasion eligibility and command contract server/src/services/chatCommands/classAbilityHandlers.ts, server/src/services/chatCommands/saveHandler.ts, server/src/services/chatCommands/helpHandlers.ts	Evasion status validates Rogue or Monk class levels. The command no longer accepts player-reported pass/fail damage arguments.
Authoritative Dexterity-save Evasion server/src/services/chatCommands/saveHandler.ts, server/src/__tests__/uncanny-evasion-authoritative.test.ts	Successful Dexterity saves deal zero damage. Failed saves deal floor-half damage. Structured results include Evasion and defense notes. Tests cover class eligibility, malformed input, and legacy command rejection.

Estimated code review effort: 4 (Complex) | ~45 minutes

Sequence Diagram(s)

sequenceDiagram
  participant DM
  participant SaveResolver
  participant CharacterState
  participant PrivateOutput
  DM->>SaveResolver: resolve Dexterity save
  SaveResolver->>CharacterState: load class, level, and HP
  SaveResolver->>CharacterState: apply zero or floor-half damage
  SaveResolver->>PrivateOutput: report Evasion result and damage notes

Loading

Possibly related PRs

• adrev/Atlas_bound#35: Related authoritative combat damage and HP/death-save synchronization.
• adrev/Atlas_bound#114: Related concentration, condition, and damage-result updates.
• adrev/Atlas_bound#131: Related token and character version synchronization.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/uncanny-evasion-authoritative

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}