@bongos/core 1.21.68 → 1.21.70

package/tests/hub_account_page.mjs

@@ -81,7 +81,7 @@ test('the script builds no markup from strings, and the controls are real markup
 test('the door returns here, and the page calls only its own-scoped routes', () => {
   assert.match(PAGE, /href="\/api\/bongos\/auth\/web\/start\?return=\/account&repos=1"/, 'sign-in lands back on /account, asking for repo access once (task 1004549)');
   const calls = [...SCRIPT.matchAll(/request\('(GET|PATCH|POST)', '([^']+)'/g)].map((m) => `${m[1]} ${m[2]}`);
-  assert.deepEqual([...new Set(calls)].sort(), ['GET /me/cross-project', 'PATCH /me/cross-project', 'PATCH /me/handle', 'PATCH /me/profile'].sort());
+  assert.deepEqual([...new Set(calls)].sort(), ['GET /me/cross-project', 'PATCH /me/cross-project', 'PATCH /me/handle', 'PATCH /me/profile', 'GET /my-projects', 'POST /my-projects/'].sort());
   // the bar's two calls live in the shared asset: the identity read and sign out
   const barCalls = [...BAR.matchAll(/fetch\(API \+ '([^']+)', \{ method: '(GET|POST)'/g)].map((m) => `${m[2]} ${m[1]}`);
   assert.deepEqual(barCalls.sort(), ['GET /me', 'POST /auth/logout']);
@@ -180,14 +180,27 @@ const ACCOUNT = () => ({
 function boot(answer) {
   const els = new Map();
   const listeners = (o) => { o._on = {}; o.addEventListener = (t, f) => { (o._on[t] ||= []).push(f); }; return o; };
-  const el = (id, hidden, attrs) => listeners({
-    id, hidden, attrs, value: '', textContent: '', className: '', disabled: false, style: {},
-    appendChild(c) { this.textContent += c.textContent; return c; },
+  // textContent reads the node's own text plus its children's, and setting it
+  // drops the children, as in the browser — so a list can be built, read and
+  // emptied (the projects you build on, task 1004277)
+  const withChildren = (o) => {
+    o.children = [];
+    o._text = '';
+    Object.defineProperty(o, 'textContent', {
+      get() { return o._text + o.children.map((c) => c.textContent).join(''); },
+      set(v) { o._text = String(v); o.children = []; },
+    });
+    o.appendChild = (c) => { c.parent = o; o.children.push(c); return c; };
+    o.remove = () => { if (o.parent) o.parent.children = o.parent.children.filter((c) => c !== o); };
+    return o;
+  };
+  const el = (id, hidden, attrs) => withChildren(listeners({
+    id, hidden, attrs, value: '', className: '', disabled: false, style: {},
     getAttribute(n) { return n in attrs ? attrs[n] : null; },
     setAttribute(n, v) { attrs[n] = v; },
     closest(sel) { return sel === '.trig' && /\btrig\b/.test(attrs.class || '') ? this : null; },
     focus() { dom.focused = id; document.activeElement = this; },
-  });
+  }));
   for (const m of PAGE.matchAll(/<(\w+)([^>]*?)\sid="([\w-]+)"([^>]*)>/g)) {
     const attrs = Object.fromEntries([...(m[2] + m[4]).matchAll(/\s([\w-]+)="([^"]*)"/g)].map((a) => [a[1], a[2]]));
     els.set(m[3], el(m[3], /\shidden\b/.test(m[2] + m[4]), attrs));
@@ -262,7 +275,10 @@ function boot(answer) {
       if (!names.length) throw new Error(`unstubbed selector: ${sel}`);
       return radios.filter((r) => names.includes(r.name));
     },
-    createElement: () => ({ className: '', textContent: '' }),
+    createElement: (tag) => {
+      const attrs = {};
+      return withChildren(listeners({ tag, attrs, className: '', disabled: false, setAttribute(n, v) { attrs[n] = String(v); } }));
+    },
   };
   const fetch = (url, init = {}) => {
     const method = init.method || 'GET';
@@ -440,6 +456,116 @@ test('a session that expired mid-edit reopens the door instead of failing silent
   assert.equal(dom.els.get('signinTop').hidden, false);
 });
 
+// ── 3a. the projects you build on (task 1004277) ─────────────────────────────
+// Moved here from /projects?view=mine (task 1003774's list and Leave): the owner
+// put it on the builder's own profile, own view only, and with no hub profile
+// page built, /account is that view (the owner's pick, 2026-10-06).
+
+const BUILDING = [
+  { client_id: 'otb', name: 'Example World', origin: 'https://www.example.com/' },
+  { client_id: 'a b', name: null, origin: 'https://emersonian.cloudbongos.com' },
+];
+const building = (rows, leave = () => ({ status: 200, data: { ok: true, left: true } })) => (m, p) => {
+  if (m === 'GET' && p === '/me/cross-project') return { status: 200, data: ACCOUNT() };
+  if (m === 'GET' && p === '/my-projects') return rows ? { status: 200, data: { owned: [], building: rows, applied: [] } } : { status: 500, data: null };
+  if (m === 'POST' && /^\/my-projects\/[^/]+\/leave$/.test(p)) return leave(p);
+  return { status: 500, data: null };
+};
+const rowsOf = (dom) => dom.els.get('buildingList').children;
+const leaveOf = (row) => row.children[1].children[0];
+
+test('the section ships inside the signed-in body, last, as a list with an empty line and a status line', () => {
+  const body = PAGE.split('<div id="acctBody" hidden>')[1].split('</main>')[0];
+  const sec = (body.match(/<section class="aSec" id="aBuilding" aria-labelledby="aBuilding-h">[\s\S]*?<\/section>/) || [''])[0];
+  assert.ok(sec, 'the projects you build on are a section of the account body');
+  assert.ok(body.indexOf('id="aBuilding"') > body.indexOf('id="aRecord"'), 'after your record, which counts them');
+  assert.match(sec, /<h2 id="aBuilding-h">projects you build on<\/h2>/);
+  assert.match(sec, /<p class="aWhat" id="buildingEmpty" hidden>/, 'the empty line waits for a read that says so');
+  assert.match(sec, /<ul class="mineRows" id="buildingList"><\/ul>/, 'the rows are cosmos.css’s, as on /invitations');
+  assert.match(sec, /<p class="projMsg" id="buildingMsg" role="status" aria-live="polite"><\/p>/);
+});
+
+test('signed in: the list is read once, after the account, and each row names its project and host with its own Leave', async () => {
+  const dom = boot(building(BUILDING));
+  await settle();
+  assert.deepEqual(dom.calls.filter((c) => c.method === 'GET' && c.path !== '/me').map((c) => c.path), ['/me/cross-project', '/my-projects']);
+  assert.equal(dom.els.get('buildingLoading').hidden, true);
+  assert.equal(dom.els.get('buildingEmpty').hidden, true);
+  const rows = rowsOf(dom);
+  assert.equal(rows.length, 2);
+  assert.equal(rows[0].className, 'mineRow');
+  assert.equal(rows[0].children[0].children[0].textContent, 'Example World');
+  assert.equal(rows[0].children[0].children[1].textContent, 'example.com', 'the host, without scheme, www or path');
+  assert.equal(rows[1].children[0].children[0].textContent, 'a b', 'no name: the client id stands in');
+  assert.equal(leaveOf(rows[0]).textContent, 'Leave');
+  assert.equal(leaveOf(rows[0]).attrs['aria-label'], 'Leave Example World', 'every button reads Leave; its name says which project');
+  assert.equal(leaveOf(rows[0]).className, 'btn small ghost');
+});
+
+test('nothing built on: the empty line shows; a failed read says so and never claims the list is empty', async () => {
+  const none = boot(building([]));
+  await settle();
+  assert.equal(rowsOf(none).length, 0);
+  assert.equal(none.els.get('buildingEmpty').hidden, false);
+  assert.match(PAGE, /id="buildingEmpty" hidden>You’re not building on any other projects yet\.<\/p>/);
+
+  const failed = boot(building(null));
+  await settle();
+  assert.equal(failed.els.get('buildingEmpty').hidden, true, 'a failed read is not "nothing"');
+  assert.equal(failed.els.get('buildingLoading').hidden, true);
+  assert.equal(failed.text('buildingMsg'), 'Couldn’t read the projects you build on — refresh in a moment.');
+  assert.equal(failed.els.get('buildingMsg').className, 'projMsg err');
+});
+
+test('Leave posts to the project’s own client id, says so while it goes, drops the row, and the last one shows the empty line', async () => {
+  const dom = boot(building(BUILDING));
+  await settle();
+  const [first] = rowsOf(dom);
+  dom.click(leaveOf(first));
+  assert.equal(leaveOf(first).disabled, true);
+  assert.equal(leaveOf(first).textContent, 'Leaving…');
+  await settle();
+  assert.equal(dom.calls.filter((c) => c.method === 'POST')[0].path, '/my-projects/otb/leave');
+  assert.equal(rowsOf(dom).length, 1, 'the row is gone once the server says so');
+  assert.equal(dom.text('buildingMsg'), 'You left Example World.');
+  assert.equal(dom.els.get('buildingMsg').className, 'projMsg ok');
+  assert.equal(dom.els.get('buildingEmpty').hidden, true, 'one left still');
+
+  dom.click(leaveOf(rowsOf(dom)[0]));
+  await settle();
+  assert.equal(dom.calls.filter((c) => c.method === 'POST')[1].path, '/my-projects/a%20b/leave', 'the id is encoded, never spliced raw');
+  assert.equal(rowsOf(dom).length, 0);
+  assert.equal(dom.els.get('buildingEmpty').hidden, false, 'and with the last gone, the empty line');
+});
+
+test('a refused Leave keeps the row and its button, and an expired session opens the door', async () => {
+  const refused = boot(building(BUILDING, () => ({ status: 500, data: { error: { code: 'leave_failed', message: 'internal error' } } })));
+  await settle();
+  const row = rowsOf(refused)[0];
+  refused.click(leaveOf(row));
+  await settle();
+  assert.equal(rowsOf(refused).length, 2);
+  assert.equal(leaveOf(row).disabled, false);
+  assert.equal(leaveOf(row).textContent, 'Leave');
+  assert.equal(refused.text('buildingMsg'), 'Couldn’t leave Example World. Try again.', 'plain words, not the server’s "internal error"');
+  assert.equal(refused.els.get('buildingMsg').className, 'projMsg err');
+
+  const expired = boot(building(BUILDING, () => ({ status: 401, data: null })));
+  await settle();
+  expired.click(leaveOf(rowsOf(expired)[0]));
+  await settle();
+  assert.equal(rowsOf(expired).length, 2);
+  assert.equal(expired.els.get('door').hidden, false);
+  assert.equal(expired.els.get('acctBody').hidden, true);
+});
+
+test('/projects keeps no copy: the mine view points here, and nothing there reads or leaves the list', () => {
+  assert.doesNotMatch(HUB, /id="buildingList"|renderBuildingList|\/leave'/, 'the list and Leave moved here whole');
+  assert.match(HUB, /<h2 id="mineToAccountH">Projects you build on<\/h2>\s*<p class="lede">[^<]*<a href="\/account#aBuilding">Open your account<\/a><\/p>/, 'the mine view says where they went');
+  assert.match(HUB, /\(d\.building \|\| \[\]\)\.forEach\(function \(m\) \{ if \(m\.origin\) mineOrigins\[hostOf\(m\.origin\)\] = 'builder'; \}\);/, 'the map still reads who you build with');
+  assert.match(SCRIPT, /if \(target && typeof target\.scrollIntoView === 'function'\) target\.scrollIntoView\(\);/, 'and #aBuilding lands on the section once the body shows');
+});
+
 // ── 3b. the bar, executed (task 1004455) ─────────────────────────────────────
 
 const ME = { builder: { id: '1', github_login: 'octocat', avatar_url: 'https://avatars.example/u/1' } };

package/tests/instance_feedback.mjs

@@ -1,6 +1,6 @@
-// tests/instance_feedback.mjs — `bongos feedback`: a builder on a managed project
-// reports something about Bongos itself, their project relays it to the hub, and
-// the hub files it (task 1004462). DB-free: the hub half is driven through its
+// tests/instance_feedback.mjs — `bongos feedback`: a builder reports something
+// about Bongos itself straight to the hub, their project vouches for who sent it
+// with a one-time receipt, and the hub files it (tasks 1004462, 1004591). DB-free: the hub half is driven through its
 // pure module with a fake `ideas.capture`, the project half through its real
 // router with a fake hub.
 
@@ -8,6 +8,7 @@ import assert from 'node:assert/strict';
 import { test } from 'node:test';
 import fs from 'node:fs';
 import path from 'node:path';
+import os from 'node:os';
 import { createRequire } from 'node:module';
 import { fileURLToPath } from 'node:url';
 
@@ -118,9 +119,12 @@ test('the hub route authenticates the project and the sender BEFORE spending or
     'the route passes neither a rank nor a vector — both are fixed in instance-feedback.js');
 });
 
-// ── the project: the relay ────────────────────────────────────────────────────
+// ── the project: the receipt (task 1004591) ──────────────────────────────────
+// The project no longer relays anything. It vouches: a signed-in builder asks
+// for a one-time receipt naming them and the hash of the text, and the hub
+// redeems it once at the project's public URL.
 
-async function withRoute({ idp, hub }, fn) {
+async function withRoute(opts, fn) {
   const r2 = createRequire(import.meta.url);
   const authPath = r2.resolve(path.join(ROOT, 'src/bongos/auth.js'));
   const routePath = r2.resolve(path.join(ROOT, 'src/bongos/routes/feedback.js'));
@@ -129,24 +133,21 @@ async function withRoute({ idp, hub }, fn) {
   const saved = realAuth.requireBuilder;
   realAuth.requireBuilder = (req, _res, next) => { req.builder = { id: 5, github_id: '42', github_login: 'someone' }; next(); };
   delete r2.cache[routePath];
-  const sent = [];
-  const fetchImpl = async (url, opts) => {
-    sent.push({ url, body: JSON.parse(opts.body) });
-    const { status, body } = hub;
-    return { status, json: async () => body };
-  };
+  const build = r2(routePath);
   const express = r2('express');
   const app = express();
   app.use(express.json());
   app.use(r2(envPath).attachFail);
-  app.use(r2(routePath)({ idpConfig: () => idp, fetchImpl }));
+  app.use(build({ hub: () => 'https://hub.example.com', ...opts }));
   const server = app.listen(0);
   await new Promise((res) => server.once('listening', res));
-  const post = (body) => fetch(`http://127.0.0.1:${server.address().port}/feedback`, {
+  const url = (p) => `http://127.0.0.1:${server.address().port}${p}`;
+  const post = (body) => fetch(url('/feedback/receipt'), {
     method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify(body),
   }).then(async (r) => ({ status: r.status, body: await r.json() }));
+  const redeem = (id) => fetch(url(`/feedback/receipt/${id}`)).then(async (r) => ({ status: r.status, body: await r.json() }));
   try {
-    await fn({ post, sent });
+    await fn({ post, redeem, build });
   } finally {
     server.close();
     realAuth.requireBuilder = saved;
@@ -154,75 +155,232 @@ async function withRoute({ idp, hub }, fn) {
   }
 }
 
-const IDP = { origin: 'https://hub.example.com', clientId: 'acme', clientSecret: 's3cret' };
-
-test('the relay sends the SESSION\'s identity and the running core to the hub, and returns the landing', async () => {
-  await withRoute({ idp: IDP, hub: { status: 201, body: { ok: true, landed: 'task', task_id: '1234', status: 'backlog' } } }, async ({ post, sent }) => {
-    assert.equal((await post({ message: 'x', github_id: '1' })).status, 400, 'a body naming a sender is refused outright');
-    assert.equal(sent.length, 0);
-    const r = await post({ message: '  it broke  ', context: { cli_version: '0.2.0', os: 'darwin', core_version: 'forged' } });
-    assert.equal(r.status, 201);
-    assert.equal(r.body.task_id, '1234');
-    assert.equal(r.body.hub_origin, IDP.origin);
-    assert.equal(sent.length, 1);
-    assert.equal(sent[0].url, 'https://hub.example.com/api/bongos/sso/feedback');
-    assert.equal(sent[0].body.github_id, '42', 'from the session, never the body');
-    assert.equal(sent[0].body.message, 'it broke');
-    assert.equal(sent[0].body.kind, 'bug');
-    assert.notEqual(sent[0].body.context.core_version, 'forged', 'the core version is this server\'s own');
-    assert.equal(sent[0].body.client_secret, 's3cret');
+const HASH = IF.sha256Hex('it broke');
+
+test('a receipt names the SESSION\'s builder and the text hash, and redeems exactly once', async () => {
+  await withRoute({}, async ({ post, redeem }) => {
+    const r = await post({ sha256: HASH, kind: 'idea' });
+    assert.equal(r.status, 201, JSON.stringify(r.body));
+    assert.equal(r.body.hub, 'https://hub.example.com');
+    assert.match(r.body.receipt, /^[A-Za-z0-9_-]{24}$/);
+    const first = await redeem(r.body.receipt);
+    assert.equal(first.status, 200);
+    assert.equal(first.body.github_id, '42', 'from the session, never the body');
+    assert.equal(first.body.github_login, 'someone');
+    assert.equal(first.body.sha256, HASH);
+    assert.equal(first.body.kind, 'idea');
+    assert.equal((await redeem(r.body.receipt)).status, 404, 'single use');
+    assert.equal((await redeem('not-a-real-receipt-id')).status, 404);
   });
 });
 
-test('a project with no hub link says so, and sends nothing', async () => {
-  await withRoute({ idp: null, hub: { status: 500, body: {} } }, async ({ post, sent }) => {
-    const r = await post({ message: 'hello' });
-    assert.equal(r.status, 409);
-    assert.equal(r.body.error.code, 'not_hub_connected');
-    assert.equal(sent.length, 0);
+test('a receipt request with a body naming a sender, or no hash, is refused', async () => {
+  await withRoute({}, async ({ post }) => {
+    assert.equal((await post({ sha256: HASH, github_id: '1' })).status, 400, 'no sender rides the body');
+    assert.equal((await post({ sha256: 'abc' })).status, 400);
+    assert.equal((await post({ sha256: HASH, kind: 'task' })).status, 400);
   });
 });
 
-test('an empty message or an unknown kind is refused locally', async () => {
-  await withRoute({ idp: IDP, hub: { status: 201, body: { ok: true } } }, async ({ post, sent }) => {
-    assert.equal((await post({ message: '   ' })).body.error.code, 'message_required');
-    const badKind = await post({ message: 'x', kind: 'task' });
-    assert.equal(badKind.status, 400);
-    assert.equal((await post({ message: 'x'.repeat(4001) })).status, 400, 'over the cap');
-    assert.equal(sent.length, 0);
-  });
+test('receipts expire and the store is capped', () => {
+  const { makeReceiptStore } = require_(path.join(ROOT, 'src/bongos/routes/feedback.js'));
+  let now = 0;
+  const store = makeReceiptStore({ now: () => now, ttlMs: 1000, max: 3 });
+  const id = store.issue({ github_id: '1' });
+  now = 1001;
+  assert.equal(store.redeem(id), null, 'expired');
+  const live = [0, 1, 2].map((i) => store.issue({ github_id: String(i) }));
+  assert.equal(store.issue({ github_id: 'noisy' }), null, 'a full store refuses the new one');
+  assert.equal(store._rows.size, 3);
+  assert.equal(store.redeem(live[0]).github_id, '0', 'and never evicts a pending receipt');
 });
 
-test('a hub refusal the builder can act on is passed through; anything else is generic', async () => {
-  await withRoute({ idp: IDP, hub: { status: 429, body: { error: { code: 'rate_limited', details: { retry_after_seconds: 600 } } } } }, async ({ post }) => {
-    const r = await post({ message: 'x' });
-    assert.equal(r.status, 429);
-    assert.equal(r.body.error.code, 'rate_limited');
-    assert.equal(r.body.error.details.retry_after_seconds, 600);
-  });
-  await withRoute({ idp: IDP, hub: { status: 401, body: { error: { code: 'invalid_client', message: 'secret mismatch' } } } }, async ({ post }) => {
-    const r = await post({ message: 'x' });
-    assert.equal(r.status, 502);
-    assert.equal(r.body.error.code, 'hub_refused');
-    assert.doesNotMatch(JSON.stringify(r.body), /secret/);
-  });
+test('a members-only project still lets the hub redeem a receipt — and nothing else', () => {
+  const { isExempt } = require_(path.join(ROOT, 'src/bongos/platform-visibility-gate.js'));
+  assert.equal(isExempt('/api/bongos/feedback/receipt/AbC_d-123456789012', 'GET'), true);
+  assert.equal(isExempt('/api/bongos/feedback/receipt', 'POST'), false, 'issuing one needs a member');
+  assert.equal(isExempt('/api/bongos/feedback/receipt/AbC/x', 'GET'), false);
+  assert.equal(isExempt('/api/bongos/feedback/receipt/AbC', 'DELETE'), false);
+});
+
+test('reports go to the Cloud Bongos hub unless overridden; the hub itself answers null', () => {
+  const { feedbackHub, DEFAULT_FEEDBACK_HUB } = require_(path.join(ROOT, 'src/bongos/routes/feedback.js'));
+  assert.equal(feedbackHub({ env: {}, isHub: false }), DEFAULT_FEEDBACK_HUB);
+  assert.equal(feedbackHub({ env: {}, isHub: true }), null);
+  assert.equal(feedbackHub({ env: { CLOUDBONGOS_FEEDBACK_HUB: 'https://test-hub.example.com/' }, isHub: false }), 'https://test-hub.example.com');
+});
+
+// ── the hub: the direct door (task 1004591) ──────────────────────────────────
+
+function receiptFetch(receipt, status = 200) {
+  const calls = [];
+  const fetchImpl = async (url, opts) => { calls.push({ url, opts }); return { status, json: async () => receipt }; };
+  return { fetchImpl, calls };
+}
+const DEPS = (extra = {}) => ({
+  assertPublicHost: async () => {},
+  capture: async (c) => { DEPS.last = c; return { id: 3, routing: { routed: true, task_id: 77, goal_id: 9, status: 'backlog' } }; },
+  getAccount: async () => ({ github_login: 'hub-login' }),
+  hubBuilderId: async () => 99,
+  ...extra,
+});
+
+test('direct: a hosted project\'s matching receipt files the report as verified', async () => {
+  const { fetchImpl, calls } = receiptFetch({ github_id: '42', github_login: 'will', sha256: HASH, kind: 'bug', core_version: '1.21.70' });
+  const landing = await IF.fileDirectReport({
+    origin: 'https://mercury.cloudbongos.com', receipt: 'r'.repeat(24), message: 'it broke', kind: 'bug',
+    context: { cli_version: '1.21.70', os: 'darwin' }, hubHost: 'cloudbongos.com',
+  }, DEPS({ fetchImpl }));
+  assert.equal(calls[0].url, `https://mercury.cloudbongos.com/api/bongos/feedback/receipt/${'r'.repeat(24)}`);
+  assert.equal(calls[0].opts.redirect, 'error', 'a redirect is never followed');
+  assert.equal(landing.landed, 'task');
+  assert.equal(DEPS.last.filerRank, null, 'still waits for a nod');
+  assert.equal(DEPS.last.vector, 'instance-feedback');
+  assert.equal(DEPS.last.capturedBy, 99);
+  assert.match(DEPS.last.bodyMd, /Sent by: @hub-login/);
+  assert.match(DEPS.last.bodyMd, /verified \(a project Cloud Bongos hosts\)/);
+  assert.match(DEPS.last.bodyMd, /Core 1\.21\.70/);
+});
+
+test('direct: a self-hosted project\'s word is labelled and never borrows a hub account', async () => {
+  const { fetchImpl } = receiptFetch({ github_id: '42', github_login: 'will', sha256: HASH, kind: 'bug' });
+  const lookups = [];
+  await IF.fileDirectReport({
+    origin: 'https://bongos.acme.example', receipt: 'r'.repeat(24), message: 'it broke', kind: 'bug', hubHost: 'cloudbongos.com',
+  }, DEPS({
+    fetchImpl,
+    getAccount: async (id) => { lookups.push(['account', id]); return { github_login: 'hub-login' }; },
+    hubBuilderId: async (id) => { lookups.push(['builder', id]); return 99; },
+  }));
+  assert.deepEqual(lookups, [], 'neither hub row is even read for an unverified sender');
+  assert.equal(DEPS.last.capturedBy, null);
+  assert.doesNotMatch(DEPS.last.bodyMd, /hub-login/);
+  assert.match(DEPS.last.bodyMd, /Sent by: @will \(GitHub user 42\)/);
+  assert.match(DEPS.last.bodyMd, /confirmed by bongos\.acme\.example \(self-hosted, not verified by us\)/);
+});
+
+test('direct: a report the project does not vouch for is dropped, never filed', async () => {
+  const filed = [];
+  const deps = (receipt, status, extra) => DEPS({ ...receiptFetch(receipt, status), capture: async (c) => { filed.push(c); return {}; }, ...extra });
+  const base = { origin: 'https://p.example.com', receipt: 'r'.repeat(24), message: 'it broke', kind: 'bug', hubHost: 'cloudbongos.com' };
+  const good = { github_id: '42', sha256: HASH, kind: 'bug' };
+  assert.deepEqual(await IF.fileDirectReport(base, deps({ ...good, sha256: IF.sha256Hex('something else') })), { dropped: 'text_mismatch' });
+  assert.deepEqual(await IF.fileDirectReport(base, deps({ ...good, kind: 'idea' })), { dropped: 'kind_mismatch' });
+  assert.deepEqual(await IF.fileDirectReport(base, deps(good, 404)), { dropped: 'receipt_http_404' });
+  assert.deepEqual(await IF.fileDirectReport(base, deps({ ...good, github_id: 'x' })), { dropped: 'receipt_malformed' });
+  assert.deepEqual(await IF.fileDirectReport(base, deps(good, 200, { assertPublicHost: async () => { throw new Error('private'); } })), { dropped: 'private_host' });
+  assert.deepEqual(await IF.fileDirectReport({ ...base, receipt: '../../x' }, deps(good)), { dropped: 'bad_receipt' });
+  assert.equal(filed.length, 0);
+});
+
+test('direct: only a bare https origin on a public DNS name is ever called', () => {
+  for (const bad of ['http://p.example.com', 'https://127.0.0.1', 'https://[::1]', 'https://localhost', 'https://p.example.com:8443',
+    'https://p.example.com/path', 'https://u:p@p.example.com', 'https://box.internal', 'https://intranet', 'ftp://p.example.com']) {
+    assert.equal(IF.projectOrigin(bad), null, bad);
+  }
+  assert.deepEqual(IF.projectOrigin('https://Mercury.CloudBongos.com/'), { origin: 'https://mercury.cloudbongos.com', host: 'mercury.cloudbongos.com' });
+  assert.equal(IF.isHostedBy('mercury.cloudbongos.com', 'cloudbongos.com'), true);
+  assert.equal(IF.isHostedBy('evilcloudbongos.com', 'cloudbongos.com'), false);
+  assert.equal(IF.isHostedBy('x.example.com', ''), false);
+});
+
+test('direct route: answers 202 before verifying, and caps BEFORE anything is fetched', () => {
+  const src = fs.readFileSync(path.join(ROOT, 'modules/platform-identity/routes/sso.js'), 'utf8');
+  const route = src.slice(src.indexOf("router.post('/sso/feedback/direct'"));
+  const at = (s) => { const i = route.indexOf(s); assert.ok(i > 0, `route has ${s}`); return i; };
+  assert.ok(at('projectOrigin') < at('directIpLimiter.take'));
+  assert.ok(at("directIpLimiter.take(ip, 'direct')") < at('directFeedbackLimiter.take'), 'a per-address cap no named host can dodge');
+  assert.ok(at('directFeedbackLimiter.take') < at('res.status(202)'));
+  assert.ok(at('res.status(202)') < at('fileDirectReport'));
+  assert.match(route, /assertPublicHost/);
 });
 
 // ── the CLI ───────────────────────────────────────────────────────────────────
 
-test('`bongos feedback` is a registered verb, and every refusal code has a plain line', () => {
+test('`bongos feedback` is a registered verb, and every refusal has a plain line', () => {
   const { VERBS } = require_(path.join(ROOT, 'bin/bongos.js'));
   assert.equal(VERBS.feedback.script, 'feedback-send.js');
   const { REFUSALS, readMessage } = require_(path.join(ROOT, 'scripts/gds/feedback-send.js'));
-  for (const code of ['message_required', 'not_hub_connected', 'membership_required', 'rate_limited', 'feedback_unavailable', 'hub_unreachable']) {
-    assert.ok(REFUSALS[code], code);
-  }
-  for (const code of ['validation_failed']) {
-    assert.ok(REFUSALS[code], code);
-  }
+  for (const code of ['message_required', 'too_long', 'local_only', 'no_scrubber']) assert.ok(REFUSALS[code], code);
   assert.equal(readMessage(['--idea', 'filter', 'by', 'goal']), 'filter by goal');
 });
 
+// The skill tells the agent to use --message-file; it used to send the literal
+// "[object Object]" because argText's result object was used as the text.
+test('--message-file and stdin give the TEXT, never an object', () => {
+  const { readMessage } = require_(path.join(ROOT, 'scripts/gds/feedback-send.js'));
+  assert.equal(readMessage(['--message-file', '-'], { readStdin: () => 'from stdin' }), 'from stdin');
+  assert.equal(readMessage(['--message-file', 'x.md'], { readFile: () => 'from file' }), 'from file');
+  assert.equal(readMessage([], { stdinIsPiped: true, readStdin: () => 'piped' }), 'piped');
+  assert.equal(readMessage([], { stdinIsPiped: false }), '');
+});
+
+async function runCli(argv, extra = {}) {
+  const { main } = require_(path.join(ROOT, 'scripts/gds/feedback-send.js'));
+  const out = []; const err = [];
+  const log = console.log; const error = console.error;
+  console.log = (...a) => out.push(a.join(' ')); console.error = (...a) => err.push(a.join(' '));
+  const spawned = [];
+  try {
+    const code = await main(argv, {
+      requireSession: async () => ({ token: 't' }),
+      base: 'https://mercury.cloudbongos.com',
+      checkRepeat: () => false,
+      spawnDelivery: (job) => spawned.push(job),
+      ...extra,
+    });
+    return { code, out, err, spawned };
+  } finally { console.log = log; console.error = error; }
+}
+
+test('the CLI prints one line and hands the network to the background', async () => {
+  const r = await runCli(['claim', 'hung']);
+  assert.equal(r.code, 0);
+  assert.deepEqual(r.out, ['Sent to the Bongos team.']);
+  assert.deepEqual(r.spawned, [{ message: 'claim hung', kind: 'bug' }]);
+});
+
+test('the CLI refuses a project only this computer can reach, and sends nothing', async () => {
+  for (const base of ['http://localhost:3000', 'http://127.0.0.1:3006', 'https://dev.test']) {
+    const r = await runCli(['x'], { base });
+    assert.equal(r.code, 1, base);
+    assert.equal(r.spawned.length, 0);
+    assert.match(r.err.join('\n'), /only on your computer/);
+  }
+});
+
+test('the same report twice inside the window is sent once', async () => {
+  const { checkAndRecordRepeat } = require_(path.join(ROOT, 'scripts/gds/feedback-send.js'));
+  const file = path.join(fs.mkdtempSync(path.join(os.tmpdir(), 'fb-')), 'sent.json');
+  assert.equal(checkAndRecordRepeat('Claim hung\nfirst time', { file, now: 0 }), false);
+  assert.equal(checkAndRecordRepeat('claim hung  \nsecond rant', { file, now: 1000 }), true);
+  assert.equal(checkAndRecordRepeat('a different problem', { file, now: 2000 }), false);
+  assert.equal(checkAndRecordRepeat('claim hung', { file, now: 7 * 60 * 60 * 1000 }), false, 'the window expires');
+  const r = await runCli(['x'], { checkRepeat: () => true });
+  assert.equal(r.spawned.length, 0);
+  assert.match(r.out[0], /Already sent/);
+});
+
+test('deliver: receipt for the exact text from the project, then the report straight to the hub', async () => {
+  const { deliver } = require_(path.join(ROOT, 'scripts/gds/feedback-send.js'));
+  const reqs = [];
+  const api = { request: async (m, p, o) => { reqs.push({ m, p, body: o.body }); return { ok: true, data: { receipt: 'R'.repeat(24), hub: 'https://hub.example.com' } }; } };
+  const sent = [];
+  const fetchImpl = async (url, opts) => { sent.push({ url, body: JSON.parse(opts.body) }); return { status: 202, json: async () => ({ ok: true }) }; };
+  const out = await deliver({ message: 'it broke', kind: 'bug' }, { api, base: 'https://mercury.cloudbongos.com', fetchImpl });
+  assert.deepEqual(out, { ok: true, hub: 'https://hub.example.com' });
+  assert.deepEqual(reqs[0], { m: 'POST', p: '/feedback/receipt', body: { sha256: IF.sha256Hex('it broke'), kind: 'bug' } });
+  assert.equal(sent[0].url, 'https://hub.example.com/api/bongos/sso/feedback/direct');
+  assert.equal(sent[0].body.origin, 'https://mercury.cloudbongos.com');
+  assert.equal(sent[0].body.receipt, 'R'.repeat(24));
+  assert.equal(sent[0].body.message, 'it broke');
+  const hubSelf = await deliver({ message: 'x', kind: 'bug' }, {
+    api: { request: async () => ({ ok: true, data: { receipt: 'R'.repeat(24), hub: null } }) },
+    base: 'https://cloudbongos.com', fetchImpl,
+  });
+  assert.equal(hubSelf.hub, 'https://cloudbongos.com', 'on the hub itself, the report goes to the project it talks to');
+});
+
 // ── the hub route, driven for real ────────────────────────────────────────────
 // The assembled /sso router with its DB edges stubbed: the client lookup, the
 // membership read and the account read on the platform-identity domain, the
@@ -230,6 +388,11 @@ test('`bongos feedback` is a registered verb, and every refusal code has a plain
 
 async function withHub(overrides, fn) {
   const r2 = createRequire(import.meta.url);
+  // No real DNS from a unit test: the direct door's background redeem resolves
+  // the named host through project-stats, so refuse every host here.
+  const ps = r2(path.join(ROOT, 'modules/platform-identity/project-stats.js'));
+  const savedAssert = ps.assertPublicHost;
+  ps.assertPublicHost = async () => { throw new Error('no network in tests'); };
   const api = r2(path.join(ROOT, 'src/module-api.js'));
   const seams = r2(path.join(ROOT, 'src/module-seams.js'));
   const pi = r2(path.join(ROOT, 'modules/platform-identity/platform-identity.js'));
@@ -250,6 +413,7 @@ async function withHub(overrides, fn) {
   delete r2.cache[routerPath];
   const express = r2('express');
   const app = express();
+  app.set('trust proxy', 1); // as src/platform-server.js does
   app.use(express.json());
   app.use(r2(path.join(ROOT, 'src/bongos/middleware/error-envelope.js')).attachFail);
   app.use(r2(routerPath)());
@@ -258,10 +422,14 @@ async function withHub(overrides, fn) {
   const post = (body) => fetch(`http://127.0.0.1:${server.address().port}/sso/feedback`, {
     method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify(body),
   }).then(async (res) => ({ status: res.status, body: await res.json() }));
-  try { await fn({ post, captured }); } finally {
+  const postTo = (p, body, headers = {}) => fetch(`http://127.0.0.1:${server.address().port}${p}`, {
+    method: 'POST', headers: { 'Content-Type': 'application/json', ...headers }, body: JSON.stringify(body),
+  }).then(async (res) => ({ status: res.status, body: await res.json() }));
+  try { await fn({ post, postTo, captured }); } finally {
     server.close();
     Object.assign(pi, saved);
     api.pool.query = savedQuery;
+    ps.assertPublicHost = savedAssert;
     delete r2.cache[routerPath];
   }
 }
@@ -295,6 +463,36 @@ test('hub: a wrong secret, an unwitnessed sender and a forged field are all refu
   });
 });
 
+// The router's limiters live for the life of the module, so each case below
+// uses its own made-up caller addresses (sent as X-Forwarded-For; the harness
+// trusts the proxy as the platform server does) and its own project hosts.
+const direct = (postTo, ip, host) => postTo('/sso/feedback/direct',
+  { origin: `https://${host}`, receipt: 'r'.repeat(24), message: 'x' }, { 'X-Forwarded-For': ip });
+
+test('direct route: one address naming a fresh host each time is still capped', async () => {
+  await withHub({}, async ({ postTo }) => {
+    const codes = [];
+    for (let i = 0; i < IF.PER_SENDER_LIMIT + 2; i++) codes.push((await direct(postTo, '203.0.113.1', `fresh${i}.example.com`)).status);
+    assert.deepEqual(codes.slice(0, IF.PER_SENDER_LIMIT), Array(IF.PER_SENDER_LIMIT).fill(202));
+    assert.equal(codes.at(-1), 429);
+    assert.equal((await postTo('/sso/feedback/direct', { origin: 'https://127.0.0.1', receipt: 'r'.repeat(24), message: 'x' })).status, 400);
+  });
+});
+
+test('direct route: callers never share a bucket, and a capped caller costs a project nothing', async () => {
+  await withHub({}, async ({ postTo }) => {
+    // Many different addresses, one report each: nobody is refused (no global bucket).
+    for (let i = 0; i < IF.PER_PROJECT_LIMIT + 5; i++) {
+      assert.equal((await direct(postTo, `198.51.100.${i + 1}`, `spread${i}.example.com`)).status, 202, `address ${i}`);
+    }
+    // An address past its own cap keeps naming a victim project: always 429...
+    for (let i = 0; i < IF.PER_SENDER_LIMIT; i++) await direct(postTo, '203.0.113.9', `burn${i}.example.com`);
+    for (let i = 0; i < IF.PER_PROJECT_LIMIT + 5; i++) assert.equal((await direct(postTo, '203.0.113.9', 'victim.example.com')).status, 429);
+    // ...and the victim's own builders still get through.
+    assert.equal((await direct(postTo, '192.0.2.50', 'victim.example.com')).status, 202);
+  });
+});
+
 // ── proactive filing (task 1004467) ───────────────────────────────────────────
 // The owner's rule: a builder venting that Bongos is broken gets it filed without
 // asking. That lives in two places, and both must keep saying it.
@@ -334,6 +532,7 @@ test('every report is secret-scrubbed before it leaves the machine, and never se
   assert.ok(r.removed >= 2);
   assert.equal(scrubReport('bongos claim hung for two minutes', {}).text, 'bongos claim hung for two minutes', 'plain prose is untouched');
   const src = fs.readFileSync(path.join(ROOT, 'scripts/gds/feedback-send.js'), 'utf8');
-  assert.ok(src.indexOf('scrubReport(message)') < src.indexOf("api.request('POST', '/feedback'"), 'scrubbed before the request');
-  assert.match(src, /message: scrubbed\.text/, 'only the scrubbed text is sent');
+  const main = src.slice(src.indexOf('async function main('));
+  assert.ok(main.indexOf('scrubReport(message)') < main.indexOf('spawnDelivery'), 'scrubbed before anything is handed off');
+  assert.match(main, /message: scrubbed\.text/, 'only the scrubbed text is sent');
 });