Add Auto Claim

[BambooFury]

Auto-detects 100% discounted games on Steam and adds them to your library.
https://github.com/BambooFury/Auto-Claim

[madmaxgrey]

i have tested and can confirm this plugin works as intended

[github-actions]

Automated Message: This message has been sent to all open pull requests. Your pull request will be further reviewed once Millennium 3.0.0 is released. We are very busy with Millennium!

[shdwmtr]

@claude Review this.

[claude]

Claude finished @shdwmtr's task in 8m 40s —— View job

---

PR Review: Add Auto-Claim Plugin

• Gather PR context
• Review PR diff
• Inspect CI build logs
• Attempt source code access (blocked by sandbox)
• Security review (partial — see note)
• Bug review (partial — see note)
• UI/component standards check (partial)
• Backend language policy check (partial)
• Post full review

---

Important

Incomplete Review — Source Code Unavailable
Per the CLAUDE.md review instructions, this review requires cloning and inspecting the plugin source at BambooFury/Auto-Claim@8cd1f68. The review sandbox blocked all outbound network access (no git clone, curl, gh api, etc.), making a full source inspection impossible. The findings below are based on CI build logs, .gitmodules, and workflow artifacts only. This review should not be used as the sole basis for approval.

---

What the CI Build Tells Us

From the successful Test Build job:

• Build succeeds cleanly at commit 8cd1f68 (v1.5.7) with millennium-ttc --build prod
• Dependencies: @steambrew/client 5.8.5, @steambrew/api 5.8.4, @steambrew/webkit 5.8.4, @steambrew/ttc 3.3.6 — all standard Steambrew packages
• No Python backend: requirements.txt not found — consistent with Lua backend policy compliance
• Asset structure: the plugin bundles CSS (14 KB), a widget component, card component, settings panel (~1.4 KB), icons, and welcome icons — indicating a non-trivial UI
• Includes LICENSE (via plugin.json's include field)
• 7 files in the distribution artifact (normal size)

Concerns

1. Functionality and Steam ToS Risk

The plugin's stated purpose is to automatically detect 100%-discounted games and add them to the user's library without per-game confirmation. This raises questions that can only be answered by reading the source:

• Does it use Steam's internal JS API (SteamClient.Apps.*) or does it make outbound HTTP calls to the Steam store to detect deals?
• Does it rate-limit its scanning to avoid triggering Steam's bot detection / account flags?
• Does it provide a settings toggle to require confirmation before claiming?

Steam has historically taken action against accounts that automate store interactions. If the plugin polls store endpoints aggressively or lacks a rate-limit/confirmation mechanism, users could be at risk.

2. Scanning Stability (Past Issues)

The source repo has a branch named fix/millennium-scan-stability, which implies the scanning mechanism had known stability problems. Without reading the diff for that fix (and verifying it was merged before v1.5.7), it's not possible to confirm this is resolved in the pinned commit.

3. Rapid Version Churn

The PR includes 7 commits bumping from v1.5.1 → v1.5.7 since May 12. Rapid iteration can indicate active bug fixing, but the PR review should confirm that each bump is a deliberate, reviewed release and not a regression. The PR should ideally be pinned to a stable tag after the source review passes.

4. Items That Cannot Be Verified Without Source

These checks are required by the review guidelines but were not possible:

Check	Status
No eval() / Function() / innerHTML injection vectors	❌ Not checked
No outbound network requests to non-Steam third-party hosts	❌ Not checked
No credential/token leakage	❌ Not checked
callable Lua RPC input validation	❌ Not checked
backendType: "lua" confirmed in plugin.json	❌ Not checked
Event listeners cleaned up on unmount	❌ Not checked
No stale closure / missing useEffect dependency bugs	❌ Not checked
Settings stored under stable, non-breaking keys	❌ Not checked
Settings panel uses Field + Steambrew components (no raw <input>)	❌ Not checked

Recommendation

Do not merge without a manual source review. Specifically, a maintainer should inspect:

1. plugin.json — confirm "backendType": "lua", check name / common_name / description / version fields
2. The main TypeScript entry point — check for eval, innerHTML, unsafe network calls
3. The Lua backend — check for file path traversal, input validation on callable RPCs
4. How the plugin discovers and claims free games (Steam API vs. external endpoints)
5. Whether a rate-limit or confirmation setting exists

The author (BambooFury) already has dotastats in this database, which suggests some track record, but that does not substitute for reviewing this plugin's code.

---

| Test Build run

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[shdwmtr]

Styles/elements must follow Steams inbuilt component model. It's better integrated and is properly supported by themes. There is the ConfirmModal or something along those lines that lets you create a native Steam popup.

[BambooFury]

Styles/elements must follow Steams inbuilt component model. It's better integrated and is properly supported by themes. There is the ConfirmModal or something along those lines that lets you create a native Steam popup.

I’ve made the changes. I think I didn’t miss anything.

[shdwmtr]

Including this?

[BambooFury]

Including this?

So what am I supposed to do with this? If the design of this window needs to be changed completely, then let this plugin remain closed to merging, and only people who download it from my profile will be able to use it.

[shdwmtr]

Sounds good, same with the other one too?

[BambooFury]

Sounds good, same with the other one too?

Yes, go ahead and do it - it’s your project. I won’t be able to make these windows the way you want because they won’t look very good.

[shdwmtr]

@BambooFury It appears you are misunderstanding me, I'm strictly reviewing your plugin. Emotions don't need to get involved. I would love this plugin on the store, but we have guidelines. In open-source, when something needs to be changed, it's strictly a professional, non-personal critique.

I'm not as cut and dry as you're thinking I am, I am more than willing to reach a resolution, and or even potentially help community members getting stuff done. I receive many DM's from developers daily! My delayed response times aren't a sign I don't value your project, I am just incredibly busy!

I simply closed this PR as you explicitly told me you didn't want it merged.
I hope to see you back on the server, or we can iron it out in DM's.

We've clearly gotten off on the wrong foot! 😆(Could even be a language barrier)

[BambooFury]

You misunderstood me because I’m not a native English speaker. It’s difficult for me to explain exactly what I meant in what I wrote. Where did I say that you should reject my plugin just because I didn’t change the plugin’s window? If I change it, it will no longer be the original concept/template that I created. But that’s not even the main point. The main issue is that you called my product something written by AI. That made me seriously question why I should be here when my work has essentially been dismissed and reduced to nothing. I do use AI, but only for optimization or to find bugs. I write about 90% of the code myself.

[shdwmtr]

I absolutely did not dismiss you for using AI, I am not responsible for how you understand my words. My note on AI was fact, it was not a personal attack.

then let this plugin remain closed to merging.

This explicitly means do not merge this plugin, so I closed it.

Hopefully we are on the same page now.

[BambooFury]

I absolutely did not dismiss you for using AI, I am not responsible for how you understand my words. My note on AI was fact, it was not a personal attack.

then let this plugin remain closed to merging.

This explicitly means do not merge this plugin, so I closed it.

Hopefully we are on the same page now.

In the Theme Song plugin, the interface panel was not generated by AI. Everything was implemented using Steam’s own interface panel.

[shdwmtr]

I'm not entertaining this any further; this is in your hands.

You can still restore your deleted/privated plugins from GitHub Settings. If you choose not to, I will proceed with removing them from the database.

Have a nice day!

[BambooFury]

If you don’t want to add plugins like Auto-Claim or Theme Song, then I have nothing else to do here. You can remove them from the database.

[shdwmtr]

I think it's fairly clear that isn't my point. You are more than welcome to contribute your plugins, but a good plugin idea doesn't take precedence over the reviewal process. We will not be merging your code if its not up to snuff - written by AI or not.

Again, as I've mentioned, nothing I've said has been directed to you as a person; it's strictly professional.
I am more than happy to re-open this PR, I did not deny it. I simply closed it by your wishes.

For the sake of saving both of our time, this will be by last message unless either you:

A: Restore your repositories, letting me know.
B: Fully disband your plugins, letting me know, and I permanently remove their data.

Thanks!

[BambooFury]

If you have some time, I have a couple of questions about the recovery process and my other plugins.

[BambooFury]

discord: bamboofury - if you feel like it