@bongos/core 1.21.69 → 1.21.70

package/tests/instance_feedback.mjs

@@ -1,6 +1,6 @@
-// tests/instance_feedback.mjs — `bongos feedback`: a builder on a managed project
-// reports something about Bongos itself, their project relays it to the hub, and
-// the hub files it (task 1004462). DB-free: the hub half is driven through its
+// tests/instance_feedback.mjs — `bongos feedback`: a builder reports something
+// about Bongos itself straight to the hub, their project vouches for who sent it
+// with a one-time receipt, and the hub files it (tasks 1004462, 1004591). DB-free: the hub half is driven through its
 // pure module with a fake `ideas.capture`, the project half through its real
 // router with a fake hub.
 
@@ -8,6 +8,7 @@ import assert from 'node:assert/strict';
 import { test } from 'node:test';
 import fs from 'node:fs';
 import path from 'node:path';
+import os from 'node:os';
 import { createRequire } from 'node:module';
 import { fileURLToPath } from 'node:url';
 
@@ -118,9 +119,12 @@ test('the hub route authenticates the project and the sender BEFORE spending or
     'the route passes neither a rank nor a vector — both are fixed in instance-feedback.js');
 });
 
-// ── the project: the relay ────────────────────────────────────────────────────
+// ── the project: the receipt (task 1004591) ──────────────────────────────────
+// The project no longer relays anything. It vouches: a signed-in builder asks
+// for a one-time receipt naming them and the hash of the text, and the hub
+// redeems it once at the project's public URL.
 
-async function withRoute({ idp, hub }, fn) {
+async function withRoute(opts, fn) {
   const r2 = createRequire(import.meta.url);
   const authPath = r2.resolve(path.join(ROOT, 'src/bongos/auth.js'));
   const routePath = r2.resolve(path.join(ROOT, 'src/bongos/routes/feedback.js'));
@@ -129,24 +133,21 @@ async function withRoute({ idp, hub }, fn) {
   const saved = realAuth.requireBuilder;
   realAuth.requireBuilder = (req, _res, next) => { req.builder = { id: 5, github_id: '42', github_login: 'someone' }; next(); };
   delete r2.cache[routePath];
-  const sent = [];
-  const fetchImpl = async (url, opts) => {
-    sent.push({ url, body: JSON.parse(opts.body) });
-    const { status, body } = hub;
-    return { status, json: async () => body };
-  };
+  const build = r2(routePath);
   const express = r2('express');
   const app = express();
   app.use(express.json());
   app.use(r2(envPath).attachFail);
-  app.use(r2(routePath)({ idpConfig: () => idp, fetchImpl }));
+  app.use(build({ hub: () => 'https://hub.example.com', ...opts }));
   const server = app.listen(0);
   await new Promise((res) => server.once('listening', res));
-  const post = (body) => fetch(`http://127.0.0.1:${server.address().port}/feedback`, {
+  const url = (p) => `http://127.0.0.1:${server.address().port}${p}`;
+  const post = (body) => fetch(url('/feedback/receipt'), {
     method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify(body),
   }).then(async (r) => ({ status: r.status, body: await r.json() }));
+  const redeem = (id) => fetch(url(`/feedback/receipt/${id}`)).then(async (r) => ({ status: r.status, body: await r.json() }));
   try {
-    await fn({ post, sent });
+    await fn({ post, redeem, build });
   } finally {
     server.close();
     realAuth.requireBuilder = saved;
@@ -154,75 +155,232 @@ async function withRoute({ idp, hub }, fn) {
   }
 }
 
-const IDP = { origin: 'https://hub.example.com', clientId: 'acme', clientSecret: 's3cret' };
-
-test('the relay sends the SESSION\'s identity and the running core to the hub, and returns the landing', async () => {
-  await withRoute({ idp: IDP, hub: { status: 201, body: { ok: true, landed: 'task', task_id: '1234', status: 'backlog' } } }, async ({ post, sent }) => {
-    assert.equal((await post({ message: 'x', github_id: '1' })).status, 400, 'a body naming a sender is refused outright');
-    assert.equal(sent.length, 0);
-    const r = await post({ message: '  it broke  ', context: { cli_version: '0.2.0', os: 'darwin', core_version: 'forged' } });
-    assert.equal(r.status, 201);
-    assert.equal(r.body.task_id, '1234');
-    assert.equal(r.body.hub_origin, IDP.origin);
-    assert.equal(sent.length, 1);
-    assert.equal(sent[0].url, 'https://hub.example.com/api/bongos/sso/feedback');
-    assert.equal(sent[0].body.github_id, '42', 'from the session, never the body');
-    assert.equal(sent[0].body.message, 'it broke');
-    assert.equal(sent[0].body.kind, 'bug');
-    assert.notEqual(sent[0].body.context.core_version, 'forged', 'the core version is this server\'s own');
-    assert.equal(sent[0].body.client_secret, 's3cret');
+const HASH = IF.sha256Hex('it broke');
+
+test('a receipt names the SESSION\'s builder and the text hash, and redeems exactly once', async () => {
+  await withRoute({}, async ({ post, redeem }) => {
+    const r = await post({ sha256: HASH, kind: 'idea' });
+    assert.equal(r.status, 201, JSON.stringify(r.body));
+    assert.equal(r.body.hub, 'https://hub.example.com');
+    assert.match(r.body.receipt, /^[A-Za-z0-9_-]{24}$/);
+    const first = await redeem(r.body.receipt);
+    assert.equal(first.status, 200);
+    assert.equal(first.body.github_id, '42', 'from the session, never the body');
+    assert.equal(first.body.github_login, 'someone');
+    assert.equal(first.body.sha256, HASH);
+    assert.equal(first.body.kind, 'idea');
+    assert.equal((await redeem(r.body.receipt)).status, 404, 'single use');
+    assert.equal((await redeem('not-a-real-receipt-id')).status, 404);
   });
 });
 
-test('a project with no hub link says so, and sends nothing', async () => {
-  await withRoute({ idp: null, hub: { status: 500, body: {} } }, async ({ post, sent }) => {
-    const r = await post({ message: 'hello' });
-    assert.equal(r.status, 409);
-    assert.equal(r.body.error.code, 'not_hub_connected');
-    assert.equal(sent.length, 0);
+test('a receipt request with a body naming a sender, or no hash, is refused', async () => {
+  await withRoute({}, async ({ post }) => {
+    assert.equal((await post({ sha256: HASH, github_id: '1' })).status, 400, 'no sender rides the body');
+    assert.equal((await post({ sha256: 'abc' })).status, 400);
+    assert.equal((await post({ sha256: HASH, kind: 'task' })).status, 400);
   });
 });
 
-test('an empty message or an unknown kind is refused locally', async () => {
-  await withRoute({ idp: IDP, hub: { status: 201, body: { ok: true } } }, async ({ post, sent }) => {
-    assert.equal((await post({ message: '   ' })).body.error.code, 'message_required');
-    const badKind = await post({ message: 'x', kind: 'task' });
-    assert.equal(badKind.status, 400);
-    assert.equal((await post({ message: 'x'.repeat(4001) })).status, 400, 'over the cap');
-    assert.equal(sent.length, 0);
-  });
+test('receipts expire and the store is capped', () => {
+  const { makeReceiptStore } = require_(path.join(ROOT, 'src/bongos/routes/feedback.js'));
+  let now = 0;
+  const store = makeReceiptStore({ now: () => now, ttlMs: 1000, max: 3 });
+  const id = store.issue({ github_id: '1' });
+  now = 1001;
+  assert.equal(store.redeem(id), null, 'expired');
+  const live = [0, 1, 2].map((i) => store.issue({ github_id: String(i) }));
+  assert.equal(store.issue({ github_id: 'noisy' }), null, 'a full store refuses the new one');
+  assert.equal(store._rows.size, 3);
+  assert.equal(store.redeem(live[0]).github_id, '0', 'and never evicts a pending receipt');
 });
 
-test('a hub refusal the builder can act on is passed through; anything else is generic', async () => {
-  await withRoute({ idp: IDP, hub: { status: 429, body: { error: { code: 'rate_limited', details: { retry_after_seconds: 600 } } } } }, async ({ post }) => {
-    const r = await post({ message: 'x' });
-    assert.equal(r.status, 429);
-    assert.equal(r.body.error.code, 'rate_limited');
-    assert.equal(r.body.error.details.retry_after_seconds, 600);
-  });
-  await withRoute({ idp: IDP, hub: { status: 401, body: { error: { code: 'invalid_client', message: 'secret mismatch' } } } }, async ({ post }) => {
-    const r = await post({ message: 'x' });
-    assert.equal(r.status, 502);
-    assert.equal(r.body.error.code, 'hub_refused');
-    assert.doesNotMatch(JSON.stringify(r.body), /secret/);
-  });
+test('a members-only project still lets the hub redeem a receipt — and nothing else', () => {
+  const { isExempt } = require_(path.join(ROOT, 'src/bongos/platform-visibility-gate.js'));
+  assert.equal(isExempt('/api/bongos/feedback/receipt/AbC_d-123456789012', 'GET'), true);
+  assert.equal(isExempt('/api/bongos/feedback/receipt', 'POST'), false, 'issuing one needs a member');
+  assert.equal(isExempt('/api/bongos/feedback/receipt/AbC/x', 'GET'), false);
+  assert.equal(isExempt('/api/bongos/feedback/receipt/AbC', 'DELETE'), false);
+});
+
+test('reports go to the Cloud Bongos hub unless overridden; the hub itself answers null', () => {
+  const { feedbackHub, DEFAULT_FEEDBACK_HUB } = require_(path.join(ROOT, 'src/bongos/routes/feedback.js'));
+  assert.equal(feedbackHub({ env: {}, isHub: false }), DEFAULT_FEEDBACK_HUB);
+  assert.equal(feedbackHub({ env: {}, isHub: true }), null);
+  assert.equal(feedbackHub({ env: { CLOUDBONGOS_FEEDBACK_HUB: 'https://test-hub.example.com/' }, isHub: false }), 'https://test-hub.example.com');
+});
+
+// ── the hub: the direct door (task 1004591) ──────────────────────────────────
+
+function receiptFetch(receipt, status = 200) {
+  const calls = [];
+  const fetchImpl = async (url, opts) => { calls.push({ url, opts }); return { status, json: async () => receipt }; };
+  return { fetchImpl, calls };
+}
+const DEPS = (extra = {}) => ({
+  assertPublicHost: async () => {},
+  capture: async (c) => { DEPS.last = c; return { id: 3, routing: { routed: true, task_id: 77, goal_id: 9, status: 'backlog' } }; },
+  getAccount: async () => ({ github_login: 'hub-login' }),
+  hubBuilderId: async () => 99,
+  ...extra,
+});
+
+test('direct: a hosted project\'s matching receipt files the report as verified', async () => {
+  const { fetchImpl, calls } = receiptFetch({ github_id: '42', github_login: 'will', sha256: HASH, kind: 'bug', core_version: '1.21.70' });
+  const landing = await IF.fileDirectReport({
+    origin: 'https://mercury.cloudbongos.com', receipt: 'r'.repeat(24), message: 'it broke', kind: 'bug',
+    context: { cli_version: '1.21.70', os: 'darwin' }, hubHost: 'cloudbongos.com',
+  }, DEPS({ fetchImpl }));
+  assert.equal(calls[0].url, `https://mercury.cloudbongos.com/api/bongos/feedback/receipt/${'r'.repeat(24)}`);
+  assert.equal(calls[0].opts.redirect, 'error', 'a redirect is never followed');
+  assert.equal(landing.landed, 'task');
+  assert.equal(DEPS.last.filerRank, null, 'still waits for a nod');
+  assert.equal(DEPS.last.vector, 'instance-feedback');
+  assert.equal(DEPS.last.capturedBy, 99);
+  assert.match(DEPS.last.bodyMd, /Sent by: @hub-login/);
+  assert.match(DEPS.last.bodyMd, /verified \(a project Cloud Bongos hosts\)/);
+  assert.match(DEPS.last.bodyMd, /Core 1\.21\.70/);
+});
+
+test('direct: a self-hosted project\'s word is labelled and never borrows a hub account', async () => {
+  const { fetchImpl } = receiptFetch({ github_id: '42', github_login: 'will', sha256: HASH, kind: 'bug' });
+  const lookups = [];
+  await IF.fileDirectReport({
+    origin: 'https://bongos.acme.example', receipt: 'r'.repeat(24), message: 'it broke', kind: 'bug', hubHost: 'cloudbongos.com',
+  }, DEPS({
+    fetchImpl,
+    getAccount: async (id) => { lookups.push(['account', id]); return { github_login: 'hub-login' }; },
+    hubBuilderId: async (id) => { lookups.push(['builder', id]); return 99; },
+  }));
+  assert.deepEqual(lookups, [], 'neither hub row is even read for an unverified sender');
+  assert.equal(DEPS.last.capturedBy, null);
+  assert.doesNotMatch(DEPS.last.bodyMd, /hub-login/);
+  assert.match(DEPS.last.bodyMd, /Sent by: @will \(GitHub user 42\)/);
+  assert.match(DEPS.last.bodyMd, /confirmed by bongos\.acme\.example \(self-hosted, not verified by us\)/);
+});
+
+test('direct: a report the project does not vouch for is dropped, never filed', async () => {
+  const filed = [];
+  const deps = (receipt, status, extra) => DEPS({ ...receiptFetch(receipt, status), capture: async (c) => { filed.push(c); return {}; }, ...extra });
+  const base = { origin: 'https://p.example.com', receipt: 'r'.repeat(24), message: 'it broke', kind: 'bug', hubHost: 'cloudbongos.com' };
+  const good = { github_id: '42', sha256: HASH, kind: 'bug' };
+  assert.deepEqual(await IF.fileDirectReport(base, deps({ ...good, sha256: IF.sha256Hex('something else') })), { dropped: 'text_mismatch' });
+  assert.deepEqual(await IF.fileDirectReport(base, deps({ ...good, kind: 'idea' })), { dropped: 'kind_mismatch' });
+  assert.deepEqual(await IF.fileDirectReport(base, deps(good, 404)), { dropped: 'receipt_http_404' });
+  assert.deepEqual(await IF.fileDirectReport(base, deps({ ...good, github_id: 'x' })), { dropped: 'receipt_malformed' });
+  assert.deepEqual(await IF.fileDirectReport(base, deps(good, 200, { assertPublicHost: async () => { throw new Error('private'); } })), { dropped: 'private_host' });
+  assert.deepEqual(await IF.fileDirectReport({ ...base, receipt: '../../x' }, deps(good)), { dropped: 'bad_receipt' });
+  assert.equal(filed.length, 0);
+});
+
+test('direct: only a bare https origin on a public DNS name is ever called', () => {
+  for (const bad of ['http://p.example.com', 'https://127.0.0.1', 'https://[::1]', 'https://localhost', 'https://p.example.com:8443',
+    'https://p.example.com/path', 'https://u:p@p.example.com', 'https://box.internal', 'https://intranet', 'ftp://p.example.com']) {
+    assert.equal(IF.projectOrigin(bad), null, bad);
+  }
+  assert.deepEqual(IF.projectOrigin('https://Mercury.CloudBongos.com/'), { origin: 'https://mercury.cloudbongos.com', host: 'mercury.cloudbongos.com' });
+  assert.equal(IF.isHostedBy('mercury.cloudbongos.com', 'cloudbongos.com'), true);
+  assert.equal(IF.isHostedBy('evilcloudbongos.com', 'cloudbongos.com'), false);
+  assert.equal(IF.isHostedBy('x.example.com', ''), false);
+});
+
+test('direct route: answers 202 before verifying, and caps BEFORE anything is fetched', () => {
+  const src = fs.readFileSync(path.join(ROOT, 'modules/platform-identity/routes/sso.js'), 'utf8');
+  const route = src.slice(src.indexOf("router.post('/sso/feedback/direct'"));
+  const at = (s) => { const i = route.indexOf(s); assert.ok(i > 0, `route has ${s}`); return i; };
+  assert.ok(at('projectOrigin') < at('directIpLimiter.take'));
+  assert.ok(at("directIpLimiter.take(ip, 'direct')") < at('directFeedbackLimiter.take'), 'a per-address cap no named host can dodge');
+  assert.ok(at('directFeedbackLimiter.take') < at('res.status(202)'));
+  assert.ok(at('res.status(202)') < at('fileDirectReport'));
+  assert.match(route, /assertPublicHost/);
 });
 
 // ── the CLI ───────────────────────────────────────────────────────────────────
 
-test('`bongos feedback` is a registered verb, and every refusal code has a plain line', () => {
+test('`bongos feedback` is a registered verb, and every refusal has a plain line', () => {
   const { VERBS } = require_(path.join(ROOT, 'bin/bongos.js'));
   assert.equal(VERBS.feedback.script, 'feedback-send.js');
   const { REFUSALS, readMessage } = require_(path.join(ROOT, 'scripts/gds/feedback-send.js'));
-  for (const code of ['message_required', 'not_hub_connected', 'membership_required', 'rate_limited', 'feedback_unavailable', 'hub_unreachable']) {
-    assert.ok(REFUSALS[code], code);
-  }
-  for (const code of ['validation_failed']) {
-    assert.ok(REFUSALS[code], code);
-  }
+  for (const code of ['message_required', 'too_long', 'local_only', 'no_scrubber']) assert.ok(REFUSALS[code], code);
   assert.equal(readMessage(['--idea', 'filter', 'by', 'goal']), 'filter by goal');
 });
 
+// The skill tells the agent to use --message-file; it used to send the literal
+// "[object Object]" because argText's result object was used as the text.
+test('--message-file and stdin give the TEXT, never an object', () => {
+  const { readMessage } = require_(path.join(ROOT, 'scripts/gds/feedback-send.js'));
+  assert.equal(readMessage(['--message-file', '-'], { readStdin: () => 'from stdin' }), 'from stdin');
+  assert.equal(readMessage(['--message-file', 'x.md'], { readFile: () => 'from file' }), 'from file');
+  assert.equal(readMessage([], { stdinIsPiped: true, readStdin: () => 'piped' }), 'piped');
+  assert.equal(readMessage([], { stdinIsPiped: false }), '');
+});
+
+async function runCli(argv, extra = {}) {
+  const { main } = require_(path.join(ROOT, 'scripts/gds/feedback-send.js'));
+  const out = []; const err = [];
+  const log = console.log; const error = console.error;
+  console.log = (...a) => out.push(a.join(' ')); console.error = (...a) => err.push(a.join(' '));
+  const spawned = [];
+  try {
+    const code = await main(argv, {
+      requireSession: async () => ({ token: 't' }),
+      base: 'https://mercury.cloudbongos.com',
+      checkRepeat: () => false,
+      spawnDelivery: (job) => spawned.push(job),
+      ...extra,
+    });
+    return { code, out, err, spawned };
+  } finally { console.log = log; console.error = error; }
+}
+
+test('the CLI prints one line and hands the network to the background', async () => {
+  const r = await runCli(['claim', 'hung']);
+  assert.equal(r.code, 0);
+  assert.deepEqual(r.out, ['Sent to the Bongos team.']);
+  assert.deepEqual(r.spawned, [{ message: 'claim hung', kind: 'bug' }]);
+});
+
+test('the CLI refuses a project only this computer can reach, and sends nothing', async () => {
+  for (const base of ['http://localhost:3000', 'http://127.0.0.1:3006', 'https://dev.test']) {
+    const r = await runCli(['x'], { base });
+    assert.equal(r.code, 1, base);
+    assert.equal(r.spawned.length, 0);
+    assert.match(r.err.join('\n'), /only on your computer/);
+  }
+});
+
+test('the same report twice inside the window is sent once', async () => {
+  const { checkAndRecordRepeat } = require_(path.join(ROOT, 'scripts/gds/feedback-send.js'));
+  const file = path.join(fs.mkdtempSync(path.join(os.tmpdir(), 'fb-')), 'sent.json');
+  assert.equal(checkAndRecordRepeat('Claim hung\nfirst time', { file, now: 0 }), false);
+  assert.equal(checkAndRecordRepeat('claim hung  \nsecond rant', { file, now: 1000 }), true);
+  assert.equal(checkAndRecordRepeat('a different problem', { file, now: 2000 }), false);
+  assert.equal(checkAndRecordRepeat('claim hung', { file, now: 7 * 60 * 60 * 1000 }), false, 'the window expires');
+  const r = await runCli(['x'], { checkRepeat: () => true });
+  assert.equal(r.spawned.length, 0);
+  assert.match(r.out[0], /Already sent/);
+});
+
+test('deliver: receipt for the exact text from the project, then the report straight to the hub', async () => {
+  const { deliver } = require_(path.join(ROOT, 'scripts/gds/feedback-send.js'));
+  const reqs = [];
+  const api = { request: async (m, p, o) => { reqs.push({ m, p, body: o.body }); return { ok: true, data: { receipt: 'R'.repeat(24), hub: 'https://hub.example.com' } }; } };
+  const sent = [];
+  const fetchImpl = async (url, opts) => { sent.push({ url, body: JSON.parse(opts.body) }); return { status: 202, json: async () => ({ ok: true }) }; };
+  const out = await deliver({ message: 'it broke', kind: 'bug' }, { api, base: 'https://mercury.cloudbongos.com', fetchImpl });
+  assert.deepEqual(out, { ok: true, hub: 'https://hub.example.com' });
+  assert.deepEqual(reqs[0], { m: 'POST', p: '/feedback/receipt', body: { sha256: IF.sha256Hex('it broke'), kind: 'bug' } });
+  assert.equal(sent[0].url, 'https://hub.example.com/api/bongos/sso/feedback/direct');
+  assert.equal(sent[0].body.origin, 'https://mercury.cloudbongos.com');
+  assert.equal(sent[0].body.receipt, 'R'.repeat(24));
+  assert.equal(sent[0].body.message, 'it broke');
+  const hubSelf = await deliver({ message: 'x', kind: 'bug' }, {
+    api: { request: async () => ({ ok: true, data: { receipt: 'R'.repeat(24), hub: null } }) },
+    base: 'https://cloudbongos.com', fetchImpl,
+  });
+  assert.equal(hubSelf.hub, 'https://cloudbongos.com', 'on the hub itself, the report goes to the project it talks to');
+});
+
 // ── the hub route, driven for real ────────────────────────────────────────────
 // The assembled /sso router with its DB edges stubbed: the client lookup, the
 // membership read and the account read on the platform-identity domain, the
@@ -230,6 +388,11 @@ test('`bongos feedback` is a registered verb, and every refusal code has a plain
 
 async function withHub(overrides, fn) {
   const r2 = createRequire(import.meta.url);
+  // No real DNS from a unit test: the direct door's background redeem resolves
+  // the named host through project-stats, so refuse every host here.
+  const ps = r2(path.join(ROOT, 'modules/platform-identity/project-stats.js'));
+  const savedAssert = ps.assertPublicHost;
+  ps.assertPublicHost = async () => { throw new Error('no network in tests'); };
   const api = r2(path.join(ROOT, 'src/module-api.js'));
   const seams = r2(path.join(ROOT, 'src/module-seams.js'));
   const pi = r2(path.join(ROOT, 'modules/platform-identity/platform-identity.js'));
@@ -250,6 +413,7 @@ async function withHub(overrides, fn) {
   delete r2.cache[routerPath];
   const express = r2('express');
   const app = express();
+  app.set('trust proxy', 1); // as src/platform-server.js does
   app.use(express.json());
   app.use(r2(path.join(ROOT, 'src/bongos/middleware/error-envelope.js')).attachFail);
   app.use(r2(routerPath)());
@@ -258,10 +422,14 @@ async function withHub(overrides, fn) {
   const post = (body) => fetch(`http://127.0.0.1:${server.address().port}/sso/feedback`, {
     method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify(body),
   }).then(async (res) => ({ status: res.status, body: await res.json() }));
-  try { await fn({ post, captured }); } finally {
+  const postTo = (p, body, headers = {}) => fetch(`http://127.0.0.1:${server.address().port}${p}`, {
+    method: 'POST', headers: { 'Content-Type': 'application/json', ...headers }, body: JSON.stringify(body),
+  }).then(async (res) => ({ status: res.status, body: await res.json() }));
+  try { await fn({ post, postTo, captured }); } finally {
     server.close();
     Object.assign(pi, saved);
     api.pool.query = savedQuery;
+    ps.assertPublicHost = savedAssert;
     delete r2.cache[routerPath];
   }
 }
@@ -295,6 +463,36 @@ test('hub: a wrong secret, an unwitnessed sender and a forged field are all refu
   });
 });
 
+// The router's limiters live for the life of the module, so each case below
+// uses its own made-up caller addresses (sent as X-Forwarded-For; the harness
+// trusts the proxy as the platform server does) and its own project hosts.
+const direct = (postTo, ip, host) => postTo('/sso/feedback/direct',
+  { origin: `https://${host}`, receipt: 'r'.repeat(24), message: 'x' }, { 'X-Forwarded-For': ip });
+
+test('direct route: one address naming a fresh host each time is still capped', async () => {
+  await withHub({}, async ({ postTo }) => {
+    const codes = [];
+    for (let i = 0; i < IF.PER_SENDER_LIMIT + 2; i++) codes.push((await direct(postTo, '203.0.113.1', `fresh${i}.example.com`)).status);
+    assert.deepEqual(codes.slice(0, IF.PER_SENDER_LIMIT), Array(IF.PER_SENDER_LIMIT).fill(202));
+    assert.equal(codes.at(-1), 429);
+    assert.equal((await postTo('/sso/feedback/direct', { origin: 'https://127.0.0.1', receipt: 'r'.repeat(24), message: 'x' })).status, 400);
+  });
+});
+
+test('direct route: callers never share a bucket, and a capped caller costs a project nothing', async () => {
+  await withHub({}, async ({ postTo }) => {
+    // Many different addresses, one report each: nobody is refused (no global bucket).
+    for (let i = 0; i < IF.PER_PROJECT_LIMIT + 5; i++) {
+      assert.equal((await direct(postTo, `198.51.100.${i + 1}`, `spread${i}.example.com`)).status, 202, `address ${i}`);
+    }
+    // An address past its own cap keeps naming a victim project: always 429...
+    for (let i = 0; i < IF.PER_SENDER_LIMIT; i++) await direct(postTo, '203.0.113.9', `burn${i}.example.com`);
+    for (let i = 0; i < IF.PER_PROJECT_LIMIT + 5; i++) assert.equal((await direct(postTo, '203.0.113.9', 'victim.example.com')).status, 429);
+    // ...and the victim's own builders still get through.
+    assert.equal((await direct(postTo, '192.0.2.50', 'victim.example.com')).status, 202);
+  });
+});
+
 // ── proactive filing (task 1004467) ───────────────────────────────────────────
 // The owner's rule: a builder venting that Bongos is broken gets it filed without
 // asking. That lives in two places, and both must keep saying it.
@@ -334,6 +532,7 @@ test('every report is secret-scrubbed before it leaves the machine, and never se
   assert.ok(r.removed >= 2);
   assert.equal(scrubReport('bongos claim hung for two minutes', {}).text, 'bongos claim hung for two minutes', 'plain prose is untouched');
   const src = fs.readFileSync(path.join(ROOT, 'scripts/gds/feedback-send.js'), 'utf8');
-  assert.ok(src.indexOf('scrubReport(message)') < src.indexOf("api.request('POST', '/feedback'"), 'scrubbed before the request');
-  assert.match(src, /message: scrubbed\.text/, 'only the scrubbed text is sent');
+  const main = src.slice(src.indexOf('async function main('));
+  assert.ok(main.indexOf('scrubReport(message)') < main.indexOf('spawnDelivery'), 'scrubbed before anything is handed off');
+  assert.match(main, /message: scrubbed\.text/, 'only the scrubbed text is sent');
 });