@bongos/core 1.21.69 → 1.21.71

package/tests/goal_spec_task_db.mjs

@@ -0,0 +1,95 @@
+// tests/goal_spec_task_db.mjs — a goal made in the hall carries its own spec task,
+// and its other work waits behind it (task 1004585, ADR 0366 D3). REAL DB: the
+// claim gate and the auto-promotion are the database's, so this proves the edge
+// gateOnSpecTask writes is one they actually honour.
+//
+// Real-DB integration test (self-skips without a reachable Postgres; in the
+// INTEGRATION set so the default DB-free lane never runs it).
+//
+// Run:  DATABASE_URL=... node tests/goal_spec_task_db.mjs
+
+import { createRequire } from 'node:module';
+import { strict as assert } from 'node:assert';
+const require = createRequire(import.meta.url);
+const { Pool } = require('pg');
+
+const pool = new Pool({ connectionString: process.env.DATABASE_URL || undefined });
+try {
+  await pool.query('SELECT 1');
+} catch (e) {
+  console.log(`goal_spec_task_db.mjs SKIPPED — no reachable Postgres (${e.code || e.message}).`);
+  await pool.end().catch(() => {});
+  process.exit(0);
+}
+
+const seams = require('../src/module-seams.js');
+if (!seams.hasProvider('reward')) seams.registerProvider('reward', require('../modules/economy/reward.js'));
+const db = require('../modules/lifecycle/db.js');
+const spec = require('../modules/lifecycle/goal-spec-task.js');
+
+const VER = 'ZZZ-SPEC', WORKER = 90000401;
+const q = (sql, params) => pool.query(sql, params).then((r) => r.rows);
+
+async function cleanup() {
+  const ids = (await q(`SELECT id FROM tasks WHERE version_id=$1`, [VER]).catch(() => [])).map((r) => r.id);
+  await q(`DELETE FROM claims WHERE task_id = ANY($1::bigint[])`, [ids]).catch(() => {});
+  await q(`DELETE FROM credit_log WHERE builder_id=$1 OR task_id = ANY($2::bigint[])`, [WORKER, ids]).catch(() => {});
+  await q(`DELETE FROM builder_achievements WHERE builder_id=$1`, [WORKER]).catch(() => {});
+  await q(`DELETE FROM dependencies WHERE (from_kind='task' AND from_id = ANY($1::bigint[])) OR (to_kind='task' AND to_id = ANY($1::bigint[]))`, [ids]).catch(() => {});
+  await q(`DELETE FROM tasks WHERE version_id=$1`, [VER]).catch(() => {});
+  await q(`DELETE FROM goal_members WHERE goal_id IN (SELECT id FROM goals WHERE version_id=$1)`, [VER]).catch(() => {});
+  await q(`DELETE FROM goals WHERE version_id=$1`, [VER]).catch(() => {});
+  await q(`DELETE FROM builders WHERE id=$1`, [WORKER]).catch(() => {});
+  await q(`DELETE FROM versions WHERE id=$1`, [VER]).catch(() => {});
+}
+
+let pass = 0;
+const ok = (cond, msg) => { assert.ok(cond, msg); console.log(`  ok  ${msg}`); pass++; };
+const statusOf = async (id) => (await q(`SELECT status FROM tasks WHERE id=$1`, [id]))[0].status;
+const edges = async (id) => (await q(`SELECT to_id FROM dependencies WHERE from_kind='task' AND from_id=$1 AND to_kind='task'`, [id])).map((r) => Number(r.to_id));
+
+try {
+  await cleanup();
+  await q(`INSERT INTO versions (id,name,status,track) VALUES ($1,'spec','building','internal') ON CONFLICT (id) DO NOTHING`, [VER]);
+  await q(`INSERT INTO builders (id,github_id,github_login,display_name,rank) VALUES ($1,'spec-w','spec-worker','Spec Worker','archon')`, [WORKER]);
+
+  // A hall-made goal and its spec task (what POST /goals { spec_task: true } writes).
+  const goal = await db.createGoal({ versionId: VER, title: 'Hall goal', createdBy: WORKER });
+  const specTask = await db.createTask(spec.specTaskFields(goal, { createdBy: WORKER }));
+  ok(specTask.status === 'ready' && specTask.kind === 'spike', 'the spec task is born ready, a spike');
+  ok((await edges(specTask.id)).length === 0, 'the spec task does not wait on itself');
+
+  // 1) A task filed into the goal waits on the spec task, and the claim gate says so.
+  const work = await db.createTask({ versionId: VER, goalId: goal.id, title: 'Build the first page', kind: 'feature', discipline: 'engineer', creditsReward: 10 });
+  ok((await edges(work.id)).includes(Number(specTask.id)), 'a filed task carries an edge to the spec task');
+  // unsatisfiedDeps is the read the claim gate refuses on (db-claims.js: a non-empty
+  // answer throws DEPS_NOT_SHIPPED). The full claim path is not driven here — its own
+  // DB test (claim_gate_open_blocker) is parked in this lane for unrelated setup.
+  const gating = await db.unsatisfiedDeps(work.id);
+  ok(gating.some((d) => d.kind === 'task' && Number(d.id) === Number(specTask.id)), 'the claim gate read names the spec task as unshipped');
+
+  // 2) Shipping the spec task releases it: the auto-promotion trigger moves it to ready.
+  await q(`UPDATE tasks SET status='shipped' WHERE id=$1`, [specTask.id]);
+  ok((await db.unsatisfiedDeps(work.id)).length === 0, 'nothing gates the task once the spec ships');
+  ok((await statusOf(work.id)) === 'ready', `the waiting task auto-promotes to ready (got ${await statusOf(work.id)})`);
+
+  // 3) A task filed after the spec shipped waits on nothing.
+  const later = await db.createTask({ versionId: VER, goalId: goal.id, title: 'Build the second page', kind: 'feature', discipline: 'engineer' });
+  ok((await edges(later.id)).length === 0, 'a shipped spec gates nothing new');
+
+  // 4) A goal made WITHOUT a spec task behaves exactly as before.
+  const plain = await db.createGoal({ versionId: VER, title: 'CLI goal', createdBy: WORKER });
+  const plainTask = await db.createTask({ versionId: VER, goalId: plain.id, title: 'Build the third page', kind: 'feature', discipline: 'engineer' });
+  ok((await edges(plainTask.id)).length === 0, 'a goal with no spec task adds no edge');
+
+  // 5) A task MOVED into a goal with an open spec task waits on it too.
+  const goal2 = await db.createGoal({ versionId: VER, title: 'Second hall goal', createdBy: WORKER });
+  const spec2 = await db.createTask(spec.specTaskFields(goal2, { createdBy: WORKER }));
+  await db.updateTaskGoal(plainTask.id, goal2.id);
+  ok((await edges(plainTask.id)).includes(Number(spec2.id)), 'a moved-in task carries an edge to the open spec task');
+
+  console.log(`\n${pass} passed, 0 failed`);
+} finally {
+  await cleanup();
+  await pool.end();
+}

package/tests/instance_feedback.mjs

@@ -1,6 +1,6 @@
-// tests/instance_feedback.mjs — `bongos feedback`: a builder on a managed project
-// reports something about Bongos itself, their project relays it to the hub, and
-// the hub files it (task 1004462). DB-free: the hub half is driven through its
+// tests/instance_feedback.mjs — `bongos feedback`: a builder reports something
+// about Bongos itself straight to the hub, their project vouches for who sent it
+// with a one-time receipt, and the hub files it (tasks 1004462, 1004591). DB-free: the hub half is driven through its
 // pure module with a fake `ideas.capture`, the project half through its real
 // router with a fake hub.
 
@@ -8,6 +8,7 @@ import assert from 'node:assert/strict';
 import { test } from 'node:test';
 import fs from 'node:fs';
 import path from 'node:path';
+import os from 'node:os';
 import { createRequire } from 'node:module';
 import { fileURLToPath } from 'node:url';
 
@@ -118,9 +119,12 @@ test('the hub route authenticates the project and the sender BEFORE spending or
     'the route passes neither a rank nor a vector — both are fixed in instance-feedback.js');
 });
 
-// ── the project: the relay ────────────────────────────────────────────────────
+// ── the project: the receipt (task 1004591) ──────────────────────────────────
+// The project no longer relays anything. It vouches: a signed-in builder asks
+// for a one-time receipt naming them and the hash of the text, and the hub
+// redeems it once at the project's public URL.
 
-async function withRoute({ idp, hub }, fn) {
+async function withRoute(opts, fn) {
   const r2 = createRequire(import.meta.url);
   const authPath = r2.resolve(path.join(ROOT, 'src/bongos/auth.js'));
   const routePath = r2.resolve(path.join(ROOT, 'src/bongos/routes/feedback.js'));
@@ -129,24 +133,21 @@ async function withRoute({ idp, hub }, fn) {
   const saved = realAuth.requireBuilder;
   realAuth.requireBuilder = (req, _res, next) => { req.builder = { id: 5, github_id: '42', github_login: 'someone' }; next(); };
   delete r2.cache[routePath];
-  const sent = [];
-  const fetchImpl = async (url, opts) => {
-    sent.push({ url, body: JSON.parse(opts.body) });
-    const { status, body } = hub;
-    return { status, json: async () => body };
-  };
+  const build = r2(routePath);
   const express = r2('express');
   const app = express();
   app.use(express.json());
   app.use(r2(envPath).attachFail);
-  app.use(r2(routePath)({ idpConfig: () => idp, fetchImpl }));
+  app.use(build({ hub: () => 'https://hub.example.com', ...opts }));
   const server = app.listen(0);
   await new Promise((res) => server.once('listening', res));
-  const post = (body) => fetch(`http://127.0.0.1:${server.address().port}/feedback`, {
+  const url = (p) => `http://127.0.0.1:${server.address().port}${p}`;
+  const post = (body) => fetch(url('/feedback/receipt'), {
     method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify(body),
   }).then(async (r) => ({ status: r.status, body: await r.json() }));
+  const redeem = (id) => fetch(url(`/feedback/receipt/${id}`)).then(async (r) => ({ status: r.status, body: await r.json() }));
   try {
-    await fn({ post, sent });
+    await fn({ post, redeem, build });
   } finally {
     server.close();
     realAuth.requireBuilder = saved;
@@ -154,75 +155,232 @@ async function withRoute({ idp, hub }, fn) {
   }
 }
 
-const IDP = { origin: 'https://hub.example.com', clientId: 'acme', clientSecret: 's3cret' };
-
-test('the relay sends the SESSION\'s identity and the running core to the hub, and returns the landing', async () => {
-  await withRoute({ idp: IDP, hub: { status: 201, body: { ok: true, landed: 'task', task_id: '1234', status: 'backlog' } } }, async ({ post, sent }) => {
-    assert.equal((await post({ message: 'x', github_id: '1' })).status, 400, 'a body naming a sender is refused outright');
-    assert.equal(sent.length, 0);
-    const r = await post({ message: '  it broke  ', context: { cli_version: '0.2.0', os: 'darwin', core_version: 'forged' } });
-    assert.equal(r.status, 201);
-    assert.equal(r.body.task_id, '1234');
-    assert.equal(r.body.hub_origin, IDP.origin);
-    assert.equal(sent.length, 1);
-    assert.equal(sent[0].url, 'https://hub.example.com/api/bongos/sso/feedback');
-    assert.equal(sent[0].body.github_id, '42', 'from the session, never the body');
-    assert.equal(sent[0].body.message, 'it broke');
-    assert.equal(sent[0].body.kind, 'bug');
-    assert.notEqual(sent[0].body.context.core_version, 'forged', 'the core version is this server\'s own');
-    assert.equal(sent[0].body.client_secret, 's3cret');
+const HASH = IF.sha256Hex('it broke');
+
+test('a receipt names the SESSION\'s builder and the text hash, and redeems exactly once', async () => {
+  await withRoute({}, async ({ post, redeem }) => {
+    const r = await post({ sha256: HASH, kind: 'idea' });
+    assert.equal(r.status, 201, JSON.stringify(r.body));
+    assert.equal(r.body.hub, 'https://hub.example.com');
+    assert.match(r.body.receipt, /^[A-Za-z0-9_-]{24}$/);
+    const first = await redeem(r.body.receipt);
+    assert.equal(first.status, 200);
+    assert.equal(first.body.github_id, '42', 'from the session, never the body');
+    assert.equal(first.body.github_login, 'someone');
+    assert.equal(first.body.sha256, HASH);
+    assert.equal(first.body.kind, 'idea');
+    assert.equal((await redeem(r.body.receipt)).status, 404, 'single use');
+    assert.equal((await redeem('not-a-real-receipt-id')).status, 404);
   });
 });
 
-test('a project with no hub link says so, and sends nothing', async () => {
-  await withRoute({ idp: null, hub: { status: 500, body: {} } }, async ({ post, sent }) => {
-    const r = await post({ message: 'hello' });
-    assert.equal(r.status, 409);
-    assert.equal(r.body.error.code, 'not_hub_connected');
-    assert.equal(sent.length, 0);
+test('a receipt request with a body naming a sender, or no hash, is refused', async () => {
+  await withRoute({}, async ({ post }) => {
+    assert.equal((await post({ sha256: HASH, github_id: '1' })).status, 400, 'no sender rides the body');
+    assert.equal((await post({ sha256: 'abc' })).status, 400);
+    assert.equal((await post({ sha256: HASH, kind: 'task' })).status, 400);
   });
 });
 
-test('an empty message or an unknown kind is refused locally', async () => {
-  await withRoute({ idp: IDP, hub: { status: 201, body: { ok: true } } }, async ({ post, sent }) => {
-    assert.equal((await post({ message: '   ' })).body.error.code, 'message_required');
-    const badKind = await post({ message: 'x', kind: 'task' });
-    assert.equal(badKind.status, 400);
-    assert.equal((await post({ message: 'x'.repeat(4001) })).status, 400, 'over the cap');
-    assert.equal(sent.length, 0);
-  });
+test('receipts expire and the store is capped', () => {
+  const { makeReceiptStore } = require_(path.join(ROOT, 'src/bongos/routes/feedback.js'));
+  let now = 0;
+  const store = makeReceiptStore({ now: () => now, ttlMs: 1000, max: 3 });
+  const id = store.issue({ github_id: '1' });
+  now = 1001;
+  assert.equal(store.redeem(id), null, 'expired');
+  const live = [0, 1, 2].map((i) => store.issue({ github_id: String(i) }));
+  assert.equal(store.issue({ github_id: 'noisy' }), null, 'a full store refuses the new one');
+  assert.equal(store._rows.size, 3);
+  assert.equal(store.redeem(live[0]).github_id, '0', 'and never evicts a pending receipt');
 });
 
-test('a hub refusal the builder can act on is passed through; anything else is generic', async () => {
-  await withRoute({ idp: IDP, hub: { status: 429, body: { error: { code: 'rate_limited', details: { retry_after_seconds: 600 } } } } }, async ({ post }) => {
-    const r = await post({ message: 'x' });
-    assert.equal(r.status, 429);
-    assert.equal(r.body.error.code, 'rate_limited');
-    assert.equal(r.body.error.details.retry_after_seconds, 600);
-  });
-  await withRoute({ idp: IDP, hub: { status: 401, body: { error: { code: 'invalid_client', message: 'secret mismatch' } } } }, async ({ post }) => {
-    const r = await post({ message: 'x' });
-    assert.equal(r.status, 502);
-    assert.equal(r.body.error.code, 'hub_refused');
-    assert.doesNotMatch(JSON.stringify(r.body), /secret/);
-  });
+test('a members-only project still lets the hub redeem a receipt — and nothing else', () => {
+  const { isExempt } = require_(path.join(ROOT, 'src/bongos/platform-visibility-gate.js'));
+  assert.equal(isExempt('/api/bongos/feedback/receipt/AbC_d-123456789012', 'GET'), true);
+  assert.equal(isExempt('/api/bongos/feedback/receipt', 'POST'), false, 'issuing one needs a member');
+  assert.equal(isExempt('/api/bongos/feedback/receipt/AbC/x', 'GET'), false);
+  assert.equal(isExempt('/api/bongos/feedback/receipt/AbC', 'DELETE'), false);
+});
+
+test('reports go to the Cloud Bongos hub unless overridden; the hub itself answers null', () => {
+  const { feedbackHub, DEFAULT_FEEDBACK_HUB } = require_(path.join(ROOT, 'src/bongos/routes/feedback.js'));
+  assert.equal(feedbackHub({ env: {}, isHub: false }), DEFAULT_FEEDBACK_HUB);
+  assert.equal(feedbackHub({ env: {}, isHub: true }), null);
+  assert.equal(feedbackHub({ env: { CLOUDBONGOS_FEEDBACK_HUB: 'https://test-hub.example.com/' }, isHub: false }), 'https://test-hub.example.com');
+});
+
+// ── the hub: the direct door (task 1004591) ──────────────────────────────────
+
+function receiptFetch(receipt, status = 200) {
+  const calls = [];
+  const fetchImpl = async (url, opts) => { calls.push({ url, opts }); return { status, json: async () => receipt }; };
+  return { fetchImpl, calls };
+}
+const DEPS = (extra = {}) => ({
+  assertPublicHost: async () => {},
+  capture: async (c) => { DEPS.last = c; return { id: 3, routing: { routed: true, task_id: 77, goal_id: 9, status: 'backlog' } }; },
+  getAccount: async () => ({ github_login: 'hub-login' }),
+  hubBuilderId: async () => 99,
+  ...extra,
+});
+
+test('direct: a hosted project\'s matching receipt files the report as verified', async () => {
+  const { fetchImpl, calls } = receiptFetch({ github_id: '42', github_login: 'will', sha256: HASH, kind: 'bug', core_version: '1.21.70' });
+  const landing = await IF.fileDirectReport({
+    origin: 'https://mercury.cloudbongos.com', receipt: 'r'.repeat(24), message: 'it broke', kind: 'bug',
+    context: { cli_version: '1.21.70', os: 'darwin' }, hubHost: 'cloudbongos.com',
+  }, DEPS({ fetchImpl }));
+  assert.equal(calls[0].url, `https://mercury.cloudbongos.com/api/bongos/feedback/receipt/${'r'.repeat(24)}`);
+  assert.equal(calls[0].opts.redirect, 'error', 'a redirect is never followed');
+  assert.equal(landing.landed, 'task');
+  assert.equal(DEPS.last.filerRank, null, 'still waits for a nod');
+  assert.equal(DEPS.last.vector, 'instance-feedback');
+  assert.equal(DEPS.last.capturedBy, 99);
+  assert.match(DEPS.last.bodyMd, /Sent by: @hub-login/);
+  assert.match(DEPS.last.bodyMd, /verified \(a project Cloud Bongos hosts\)/);
+  assert.match(DEPS.last.bodyMd, /Core 1\.21\.70/);
+});
+
+test('direct: a self-hosted project\'s word is labelled and never borrows a hub account', async () => {
+  const { fetchImpl } = receiptFetch({ github_id: '42', github_login: 'will', sha256: HASH, kind: 'bug' });
+  const lookups = [];
+  await IF.fileDirectReport({
+    origin: 'https://bongos.acme.example', receipt: 'r'.repeat(24), message: 'it broke', kind: 'bug', hubHost: 'cloudbongos.com',
+  }, DEPS({
+    fetchImpl,
+    getAccount: async (id) => { lookups.push(['account', id]); return { github_login: 'hub-login' }; },
+    hubBuilderId: async (id) => { lookups.push(['builder', id]); return 99; },
+  }));
+  assert.deepEqual(lookups, [], 'neither hub row is even read for an unverified sender');
+  assert.equal(DEPS.last.capturedBy, null);
+  assert.doesNotMatch(DEPS.last.bodyMd, /hub-login/);
+  assert.match(DEPS.last.bodyMd, /Sent by: @will \(GitHub user 42\)/);
+  assert.match(DEPS.last.bodyMd, /confirmed by bongos\.acme\.example \(self-hosted, not verified by us\)/);
+});
+
+test('direct: a report the project does not vouch for is dropped, never filed', async () => {
+  const filed = [];
+  const deps = (receipt, status, extra) => DEPS({ ...receiptFetch(receipt, status), capture: async (c) => { filed.push(c); return {}; }, ...extra });
+  const base = { origin: 'https://p.example.com', receipt: 'r'.repeat(24), message: 'it broke', kind: 'bug', hubHost: 'cloudbongos.com' };
+  const good = { github_id: '42', sha256: HASH, kind: 'bug' };
+  assert.deepEqual(await IF.fileDirectReport(base, deps({ ...good, sha256: IF.sha256Hex('something else') })), { dropped: 'text_mismatch' });
+  assert.deepEqual(await IF.fileDirectReport(base, deps({ ...good, kind: 'idea' })), { dropped: 'kind_mismatch' });
+  assert.deepEqual(await IF.fileDirectReport(base, deps(good, 404)), { dropped: 'receipt_http_404' });
+  assert.deepEqual(await IF.fileDirectReport(base, deps({ ...good, github_id: 'x' })), { dropped: 'receipt_malformed' });
+  assert.deepEqual(await IF.fileDirectReport(base, deps(good, 200, { assertPublicHost: async () => { throw new Error('private'); } })), { dropped: 'private_host' });
+  assert.deepEqual(await IF.fileDirectReport({ ...base, receipt: '../../x' }, deps(good)), { dropped: 'bad_receipt' });
+  assert.equal(filed.length, 0);
+});
+
+test('direct: only a bare https origin on a public DNS name is ever called', () => {
+  for (const bad of ['http://p.example.com', 'https://127.0.0.1', 'https://[::1]', 'https://localhost', 'https://p.example.com:8443',
+    'https://p.example.com/path', 'https://u:p@p.example.com', 'https://box.internal', 'https://intranet', 'ftp://p.example.com']) {
+    assert.equal(IF.projectOrigin(bad), null, bad);
+  }
+  assert.deepEqual(IF.projectOrigin('https://Mercury.CloudBongos.com/'), { origin: 'https://mercury.cloudbongos.com', host: 'mercury.cloudbongos.com' });
+  assert.equal(IF.isHostedBy('mercury.cloudbongos.com', 'cloudbongos.com'), true);
+  assert.equal(IF.isHostedBy('evilcloudbongos.com', 'cloudbongos.com'), false);
+  assert.equal(IF.isHostedBy('x.example.com', ''), false);
+});
+
+test('direct route: answers 202 before verifying, and caps BEFORE anything is fetched', () => {
+  const src = fs.readFileSync(path.join(ROOT, 'modules/platform-identity/routes/sso.js'), 'utf8');
+  const route = src.slice(src.indexOf("router.post('/sso/feedback/direct'"));
+  const at = (s) => { const i = route.indexOf(s); assert.ok(i > 0, `route has ${s}`); return i; };
+  assert.ok(at('projectOrigin') < at('directIpLimiter.take'));
+  assert.ok(at("directIpLimiter.take(ip, 'direct')") < at('directFeedbackLimiter.take'), 'a per-address cap no named host can dodge');
+  assert.ok(at('directFeedbackLimiter.take') < at('res.status(202)'));
+  assert.ok(at('res.status(202)') < at('fileDirectReport'));
+  assert.match(route, /assertPublicHost/);
 });
 
 // ── the CLI ───────────────────────────────────────────────────────────────────
 
-test('`bongos feedback` is a registered verb, and every refusal code has a plain line', () => {
+test('`bongos feedback` is a registered verb, and every refusal has a plain line', () => {
   const { VERBS } = require_(path.join(ROOT, 'bin/bongos.js'));
   assert.equal(VERBS.feedback.script, 'feedback-send.js');
   const { REFUSALS, readMessage } = require_(path.join(ROOT, 'scripts/gds/feedback-send.js'));
-  for (const code of ['message_required', 'not_hub_connected', 'membership_required', 'rate_limited', 'feedback_unavailable', 'hub_unreachable']) {
-    assert.ok(REFUSALS[code], code);
-  }
-  for (const code of ['validation_failed']) {
-    assert.ok(REFUSALS[code], code);
-  }
+  for (const code of ['message_required', 'too_long', 'local_only', 'no_scrubber']) assert.ok(REFUSALS[code], code);
   assert.equal(readMessage(['--idea', 'filter', 'by', 'goal']), 'filter by goal');
 });
 
+// The skill tells the agent to use --message-file; it used to send the literal
+// "[object Object]" because argText's result object was used as the text.
+test('--message-file and stdin give the TEXT, never an object', () => {
+  const { readMessage } = require_(path.join(ROOT, 'scripts/gds/feedback-send.js'));
+  assert.equal(readMessage(['--message-file', '-'], { readStdin: () => 'from stdin' }), 'from stdin');
+  assert.equal(readMessage(['--message-file', 'x.md'], { readFile: () => 'from file' }), 'from file');
+  assert.equal(readMessage([], { stdinIsPiped: true, readStdin: () => 'piped' }), 'piped');
+  assert.equal(readMessage([], { stdinIsPiped: false }), '');
+});
+
+async function runCli(argv, extra = {}) {
+  const { main } = require_(path.join(ROOT, 'scripts/gds/feedback-send.js'));
+  const out = []; const err = [];
+  const log = console.log; const error = console.error;
+  console.log = (...a) => out.push(a.join(' ')); console.error = (...a) => err.push(a.join(' '));
+  const spawned = [];
+  try {
+    const code = await main(argv, {
+      requireSession: async () => ({ token: 't' }),
+      base: 'https://mercury.cloudbongos.com',
+      checkRepeat: () => false,
+      spawnDelivery: (job) => spawned.push(job),
+      ...extra,
+    });
+    return { code, out, err, spawned };
+  } finally { console.log = log; console.error = error; }
+}
+
+test('the CLI prints one line and hands the network to the background', async () => {
+  const r = await runCli(['claim', 'hung']);
+  assert.equal(r.code, 0);
+  assert.deepEqual(r.out, ['Sent to the Bongos team.']);
+  assert.deepEqual(r.spawned, [{ message: 'claim hung', kind: 'bug' }]);
+});
+
+test('the CLI refuses a project only this computer can reach, and sends nothing', async () => {
+  for (const base of ['http://localhost:3000', 'http://127.0.0.1:3006', 'https://dev.test']) {
+    const r = await runCli(['x'], { base });
+    assert.equal(r.code, 1, base);
+    assert.equal(r.spawned.length, 0);
+    assert.match(r.err.join('\n'), /only on your computer/);
+  }
+});
+
+test('the same report twice inside the window is sent once', async () => {
+  const { checkAndRecordRepeat } = require_(path.join(ROOT, 'scripts/gds/feedback-send.js'));
+  const file = path.join(fs.mkdtempSync(path.join(os.tmpdir(), 'fb-')), 'sent.json');
+  assert.equal(checkAndRecordRepeat('Claim hung\nfirst time', { file, now: 0 }), false);
+  assert.equal(checkAndRecordRepeat('claim hung  \nsecond rant', { file, now: 1000 }), true);
+  assert.equal(checkAndRecordRepeat('a different problem', { file, now: 2000 }), false);
+  assert.equal(checkAndRecordRepeat('claim hung', { file, now: 7 * 60 * 60 * 1000 }), false, 'the window expires');
+  const r = await runCli(['x'], { checkRepeat: () => true });
+  assert.equal(r.spawned.length, 0);
+  assert.match(r.out[0], /Already sent/);
+});
+
+test('deliver: receipt for the exact text from the project, then the report straight to the hub', async () => {
+  const { deliver } = require_(path.join(ROOT, 'scripts/gds/feedback-send.js'));
+  const reqs = [];
+  const api = { request: async (m, p, o) => { reqs.push({ m, p, body: o.body }); return { ok: true, data: { receipt: 'R'.repeat(24), hub: 'https://hub.example.com' } }; } };
+  const sent = [];
+  const fetchImpl = async (url, opts) => { sent.push({ url, body: JSON.parse(opts.body) }); return { status: 202, json: async () => ({ ok: true }) }; };
+  const out = await deliver({ message: 'it broke', kind: 'bug' }, { api, base: 'https://mercury.cloudbongos.com', fetchImpl });
+  assert.deepEqual(out, { ok: true, hub: 'https://hub.example.com' });
+  assert.deepEqual(reqs[0], { m: 'POST', p: '/feedback/receipt', body: { sha256: IF.sha256Hex('it broke'), kind: 'bug' } });
+  assert.equal(sent[0].url, 'https://hub.example.com/api/bongos/sso/feedback/direct');
+  assert.equal(sent[0].body.origin, 'https://mercury.cloudbongos.com');
+  assert.equal(sent[0].body.receipt, 'R'.repeat(24));
+  assert.equal(sent[0].body.message, 'it broke');
+  const hubSelf = await deliver({ message: 'x', kind: 'bug' }, {
+    api: { request: async () => ({ ok: true, data: { receipt: 'R'.repeat(24), hub: null } }) },
+    base: 'https://cloudbongos.com', fetchImpl,
+  });
+  assert.equal(hubSelf.hub, 'https://cloudbongos.com', 'on the hub itself, the report goes to the project it talks to');
+});
+
 // ── the hub route, driven for real ────────────────────────────────────────────
 // The assembled /sso router with its DB edges stubbed: the client lookup, the
 // membership read and the account read on the platform-identity domain, the
@@ -230,6 +388,11 @@ test('`bongos feedback` is a registered verb, and every refusal code has a plain
 
 async function withHub(overrides, fn) {
   const r2 = createRequire(import.meta.url);
+  // No real DNS from a unit test: the direct door's background redeem resolves
+  // the named host through project-stats, so refuse every host here.
+  const ps = r2(path.join(ROOT, 'modules/platform-identity/project-stats.js'));
+  const savedAssert = ps.assertPublicHost;
+  ps.assertPublicHost = async () => { throw new Error('no network in tests'); };
   const api = r2(path.join(ROOT, 'src/module-api.js'));
   const seams = r2(path.join(ROOT, 'src/module-seams.js'));
   const pi = r2(path.join(ROOT, 'modules/platform-identity/platform-identity.js'));
@@ -250,6 +413,7 @@ async function withHub(overrides, fn) {
   delete r2.cache[routerPath];
   const express = r2('express');
   const app = express();
+  app.set('trust proxy', 1); // as src/platform-server.js does
   app.use(express.json());
   app.use(r2(path.join(ROOT, 'src/bongos/middleware/error-envelope.js')).attachFail);
   app.use(r2(routerPath)());
@@ -258,10 +422,14 @@ async function withHub(overrides, fn) {
   const post = (body) => fetch(`http://127.0.0.1:${server.address().port}/sso/feedback`, {
     method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify(body),
   }).then(async (res) => ({ status: res.status, body: await res.json() }));
-  try { await fn({ post, captured }); } finally {
+  const postTo = (p, body, headers = {}) => fetch(`http://127.0.0.1:${server.address().port}${p}`, {
+    method: 'POST', headers: { 'Content-Type': 'application/json', ...headers }, body: JSON.stringify(body),
+  }).then(async (res) => ({ status: res.status, body: await res.json() }));
+  try { await fn({ post, postTo, captured }); } finally {
     server.close();
     Object.assign(pi, saved);
     api.pool.query = savedQuery;
+    ps.assertPublicHost = savedAssert;
     delete r2.cache[routerPath];
   }
 }
@@ -295,6 +463,36 @@ test('hub: a wrong secret, an unwitnessed sender and a forged field are all refu
   });
 });
 
+// The router's limiters live for the life of the module, so each case below
+// uses its own made-up caller addresses (sent as X-Forwarded-For; the harness
+// trusts the proxy as the platform server does) and its own project hosts.
+const direct = (postTo, ip, host) => postTo('/sso/feedback/direct',
+  { origin: `https://${host}`, receipt: 'r'.repeat(24), message: 'x' }, { 'X-Forwarded-For': ip });
+
+test('direct route: one address naming a fresh host each time is still capped', async () => {
+  await withHub({}, async ({ postTo }) => {
+    const codes = [];
+    for (let i = 0; i < IF.PER_SENDER_LIMIT + 2; i++) codes.push((await direct(postTo, '203.0.113.1', `fresh${i}.example.com`)).status);
+    assert.deepEqual(codes.slice(0, IF.PER_SENDER_LIMIT), Array(IF.PER_SENDER_LIMIT).fill(202));
+    assert.equal(codes.at(-1), 429);
+    assert.equal((await postTo('/sso/feedback/direct', { origin: 'https://127.0.0.1', receipt: 'r'.repeat(24), message: 'x' })).status, 400);
+  });
+});
+
+test('direct route: callers never share a bucket, and a capped caller costs a project nothing', async () => {
+  await withHub({}, async ({ postTo }) => {
+    // Many different addresses, one report each: nobody is refused (no global bucket).
+    for (let i = 0; i < IF.PER_PROJECT_LIMIT + 5; i++) {
+      assert.equal((await direct(postTo, `198.51.100.${i + 1}`, `spread${i}.example.com`)).status, 202, `address ${i}`);
+    }
+    // An address past its own cap keeps naming a victim project: always 429...
+    for (let i = 0; i < IF.PER_SENDER_LIMIT; i++) await direct(postTo, '203.0.113.9', `burn${i}.example.com`);
+    for (let i = 0; i < IF.PER_PROJECT_LIMIT + 5; i++) assert.equal((await direct(postTo, '203.0.113.9', 'victim.example.com')).status, 429);
+    // ...and the victim's own builders still get through.
+    assert.equal((await direct(postTo, '192.0.2.50', 'victim.example.com')).status, 202);
+  });
+});
+
 // ── proactive filing (task 1004467) ───────────────────────────────────────────
 // The owner's rule: a builder venting that Bongos is broken gets it filed without
 // asking. That lives in two places, and both must keep saying it.
@@ -334,6 +532,7 @@ test('every report is secret-scrubbed before it leaves the machine, and never se
   assert.ok(r.removed >= 2);
   assert.equal(scrubReport('bongos claim hung for two minutes', {}).text, 'bongos claim hung for two minutes', 'plain prose is untouched');
   const src = fs.readFileSync(path.join(ROOT, 'scripts/gds/feedback-send.js'), 'utf8');
-  assert.ok(src.indexOf('scrubReport(message)') < src.indexOf("api.request('POST', '/feedback'"), 'scrubbed before the request');
-  assert.match(src, /message: scrubbed\.text/, 'only the scrubbed text is sent');
+  const main = src.slice(src.indexOf('async function main('));
+  assert.ok(main.indexOf('scrubReport(message)') < main.indexOf('spawnDelivery'), 'scrubbed before anything is handed off');
+  assert.match(main, /message: scrubbed\.text/, 'only the scrubbed text is sent');
 });

package/tests/provision_settings_apply.mjs

@@ -78,6 +78,7 @@ ${NEUTRAL_PREFIX}_LOGO_URL=
 ${NEUTRAL_PREFIX}_FOUNDING_BIRTH=
 ${NEUTRAL_PREFIX}_DEMO_PEOPLE=
 ${NEUTRAL_PREFIX}_DEMO_HOURS=
+${NEUTRAL_PREFIX}_HUB_UPGRADE_URL=
 `;
 
 t('replaces an existing KEY= line where it stands; every other line survives byte-for-byte', () => {
@@ -147,6 +148,8 @@ t('settingsEnvVarsFor: the runner pushes the SAME pair webEnvBody writes at stan
     [`${NEUTRAL_PREFIX}_LOOK_ACCENT`]: '', [`${NEUTRAL_PREFIX}_LOGO_URL`]: '',
     // the birth marker and a demo's box (task 1004506), empty on an un-stamped row
     [`${NEUTRAL_PREFIX}_FOUNDING_BIRTH`]: '', [`${NEUTRAL_PREFIX}_DEMO_PEOPLE`]: '', [`${NEUTRAL_PREFIX}_DEMO_HOURS`]: '',
+    // where the hall's Update button goes (task 1004608), empty when no hub origin resolves
+    [`${NEUTRAL_PREFIX}_HUB_UPGRADE_URL`]: '',
   });
   const body = P.webEnvBody(inst, {});
   for (const [k, v] of Object.entries(vars)) assert.match(body, new RegExp(`^${k}=${v}$`, 'm'), `${k} at standup`);
@@ -247,7 +250,7 @@ await ta('dry-run PLANS the patch: reads nothing real, writes NOTHING (no synthe
   assert.equal(r.ok, true);
   assert.equal(r.healthy, null, 'nothing ran, nothing observed');
   assert.equal(writes.length, 0, 'a dry-run must not plan a two-line overwrite of web.env');
-  assert.ok(logs.some((l) => /would patch .*_PLATFORM_VISIBILITY, .*_JOINABILITY, .*_VISIBILITY, .*_JOIN_GRANT, .*_ARTIST_GATE, .*_SPEND_PAYER, .*_LOOK, .*_NIGHT_TINT, .*_ARTIST_GATE_SINCE, .*_LOOK_ACCENT, .*_LOGO_URL, .*_FOUNDING_BIRTH, .*_DEMO_PEOPLE, .*_DEMO_HOURS in \/etc\/spike\/web\.env in place/.test(l)), logs.join('\n'));
+  assert.ok(logs.some((l) => /would patch .*_PLATFORM_VISIBILITY, .*_JOINABILITY, .*_VISIBILITY, .*_JOIN_GRANT, .*_ARTIST_GATE, .*_SPEND_PAYER, .*_LOOK, .*_NIGHT_TINT, .*_ARTIST_GATE_SINCE, .*_LOOK_ACCENT, .*_LOGO_URL, .*_FOUNDING_BIRTH, .*_DEMO_PEOPLE, .*_DEMO_HOURS, .*_HUB_UPGRADE_URL in \/etc\/spike\/web\.env in place/.test(l)), logs.join('\n'));
   assert.ok(cmds.some((c) => /restart spike/.test(c)), 'the restart is still in the plan');
   assert.ok(logs.some((l) => /dry-run — nothing ran/.test(l)), 'the closing line does not claim a restart happened');
 });
@@ -630,5 +633,26 @@ await ta('a failed write reports the error without the value', async () => {
   assert.ok(!r.error.includes(SECRET), r.error);
 });
 
+console.log('\nhubUpgradeEnvVarsFor — where a hosted project\'s Update button goes (task 1004608):');
+
+t('both tenant shapes get the hub door for THEIR slug; no other shape gets the key; it rides standup AND the push', () => {
+  const saved = process.env.PROVISION_HUB_ORIGIN;
+  process.env.PROVISION_HUB_ORIGIN = 'https://hub.example.com/';
+  try {
+    const key = `${NEUTRAL_PREFIX}_HUB_UPGRADE_URL`;
+    for (const shape of ['cloud-host', 'co-tenant']) {
+      const inst = { slug: 'mercury', port: 3009, hosting_shape: shape, target_ref: 'will/mercury' };
+      assert.deepEqual(require('../scripts/gds/provision-units.js').hubUpgradeEnvVarsFor(inst), { [key]: 'https://hub.example.com/deploy?project=mercury' }, shape);
+      assert.equal(P.settingsEnvVarsFor(inst)[key], 'https://hub.example.com/deploy?project=mercury', `${shape} push`);
+      assert.match(P.webEnvBody(inst, {}), new RegExp(`^${key}=https://hub\\.example\\.com/deploy\\?project=mercury$`, 'm'), `${shape} standup`);
+    }
+    for (const shape of ['byo-host', 'control-plane']) {
+      assert.deepEqual(require('../scripts/gds/provision-units.js').hubUpgradeEnvVarsFor({ slug: 'x', hosting_shape: shape }), {}, shape);
+    }
+  } finally {
+    if (saved === undefined) delete process.env.PROVISION_HUB_ORIGIN; else process.env.PROVISION_HUB_ORIGIN = saved;
+  }
+});
+
 console.log(`\nprovision_settings_apply: ${passed} passed, ${failed} failed`);
 process.exit(failed ? 1 : 0);

package/tests/software_update.mjs

@@ -180,7 +180,8 @@ async function drive(deps) {
   const build = require('../src/bongos/routes/core-update.js');
   const express = require('express');
   const app = express();
-  app.use(build(deps));
+  // The ask state's stored row is the DB's; these tests never reach one (task 1004595).
+  app.use(build({ askDeps: () => ({ hub: 'https://cloudbongos.com', getSetting: async () => null }), ...deps }));
   auth.requireBuilder = saved;
   const server = app.listen(0);
   await new Promise((r) => server.once('listening', r));
@@ -205,6 +206,22 @@ test('a hosted project: the Update button goes to the hub\'s door for THIS proje
   assert.deepEqual(r.body.door, { kind: 'hub', url: 'https://cloudbongos.com/deploy?project=hoodify-finance' });
 });
 
+// Task 1004608: Will's mercury (a cloud-host that keeps its own GitHub app) has no sign-in
+// federation, so the panel told its owner to run `bongos upgrade` on the platform's server.
+test('a hosted project that does not federate sign-in still gets the hub\'s door, from HUB_UPGRADE_URL', async () => {
+  const r = await drive({ softwareUpdate: async () => STUB_UPDATE, canUpdate: async () => true,
+    doorInputs: () => ({ provisioning: false, idp: null, hubUpgradeUrl: 'https://cloudbongos.com/deploy?project=mercury' }) });
+  assert.deepEqual(r.body.door, { kind: 'hub', url: 'https://cloudbongos.com/deploy?project=mercury' });
+});
+
+test('HUB_UPGRADE_URL is taken only as a hub /deploy address; anything else stays the cli answer', async () => {
+  for (const bad of ['', 'javascript:alert(1)', 'https://evil.example/phish', 'https://cloudbongos.com/deploy?project=a b', '/deploy']) {
+    const r = await drive({ softwareUpdate: async () => STUB_UPDATE, canUpdate: async () => true,
+      doorInputs: () => ({ provisioning: false, idp: null, hubUpgradeUrl: bad }) });
+    assert.deepEqual(r.body.door, { kind: 'cli', url: null }, bad);
+  }
+});
+
 test('a self-hosted instance has no door to link, and says how it is upgraded instead', async () => {
   const r = await drive({ softwareUpdate: async () => STUB_UPDATE, canUpdate: async () => true, doorInputs: () => ({ provisioning: false, idp: null }) });
   assert.deepEqual(r.body.door, { kind: 'cli', url: null });

package/tests/start_env_guard.mjs

@@ -94,8 +94,8 @@ t('offers the wrong-instance escape hatch (bongos login)', () => {
 t('a hosted origin never routes to bongos dev', () => {
   for (const deps of [true, false]) {
     const card = instanceNotRunningCard({ origin: 'https://example-instance.cloudbongos.com', depsMissing: deps });
-    assert.ok(!/^\s*\d+\.\s*`bongos dev`/m.test(card), 'must not list `bongos dev` as a step');
-    assert.ok(/Don't run `bongos dev`/.test(card), 'must say plainly not to, and why');
+    assert.ok(!/^\s*\d+\.\s*`(npx )?bongos dev`/m.test(card), 'must not list `bongos dev` as a step');
+    assert.ok(/Don't run `npx bongos dev`/.test(card), 'must say plainly not to, and why');
     assert.ok(/empty database/.test(card), 'must name the consequence, not just forbid it');
   }
 });