refactor(console): remove Jev spam scoring from enterprise form

infra/console.ts

@@ -22,8 +22,6 @@ new sst.cloudflare.Bucket("ZenDataNew")
 const AWS_SES_ACCESS_KEY_ID = new sst.Secret("AWS_SES_ACCESS_KEY_ID")
 const AWS_SES_SECRET_ACCESS_KEY = new sst.Secret("AWS_SES_SECRET_ACCESS_KEY")
 const ENTERPRISE_SALES_INBOX_EMAIL = new sst.Secret("ENTERPRISE_SALES_INBOX_EMAIL")
-// OpenCode API key for Jev spam scoring of enterprise form submissions.
-const ENTERPRISE_SPAM_API_KEY = new sst.Secret("ENTERPRISE_SPAM_API_KEY")
 // hCaptcha guards the enterprise form; the site key is public and baked into the client bundle.
 const HCAPTCHA_SITE_KEY = new sst.Secret("HCAPTCHA_SITE_KEY")
 const HCAPTCHA_SECRET_KEY = new sst.Secret("HCAPTCHA_SECRET_KEY")
@@ -45,7 +43,6 @@ new sst.cloudflare.x.SolidStart("Console", {
     AWS_SES_ACCESS_KEY_ID,
     AWS_SES_SECRET_ACCESS_KEY,
     ENTERPRISE_SALES_INBOX_EMAIL,
-    ENTERPRISE_SPAM_API_KEY,
     HCAPTCHA_SECRET_KEY,
     SALESFORCE_CLIENT_ID,
     SALESFORCE_CLIENT_SECRET,

packages/console/app/src/lib/enterprise.test.ts

@@ -0,0 +1,51 @@
+import { expect, test } from "bun:test"
+import { enterpriseEmailContent } from "./enterprise"
+
+const submission = {
+  name: "Fake Visitor",
+  role: "Engineering lead",
+  company: "Example Test Company",
+  email: "fake-visitor@example.test",
+  message: "We need SSO for 200 developers.",
+}
+
+test("the sales inbox email escapes submitted HTML", () => {
+  const content = enterpriseEmailContent({
+    name: "<b>Name</b>",
+    role: "Role",
+    email: "fake-visitor@example.test",
+    message: `<script>alert("x")</script> & <img src=x onerror=alert(1)>`,
+    alias: "",
+  })
+  expect(content.html).not.toContain("<script>")
+  expect(content.html).not.toContain("<img")
+  expect(content.html).not.toContain("<b>")
+  expect(content.html).toContain(
+    "&lt;script&gt;alert(&quot;x&quot;)&lt;/script&gt; &amp; &lt;img src=x onerror=alert(1)&gt;",
+  )
+  expect(content.html).toContain("&lt;b&gt;Name&lt;/b&gt;<br>")
+})
+
+test("the sales inbox plain-text email is not HTML-escaped", () => {
+  const content = enterpriseEmailContent(
+    { ...submission, name: "Ada <CTO>", message: "Pricing & SSO?", phone: "+1 555 0100", alias: "" },
+    "$10k+",
+  )
+  expect(content.text).not.toContain("<br>")
+  expect(content.text).not.toContain("&lt;")
+  expect(content.text).not.toContain("&amp;")
+  expect(content.text).toBe(
+    [
+      "Pricing & SSO?",
+      "",
+      "Current monthly inference spend: $10k+",
+      "",
+      "--",
+      "Ada <CTO>",
+      submission.role,
+      submission.company,
+      submission.email,
+      "+1 555 0100",
+    ].join("\n"),
+  )
+})

packages/console/app/src/lib/enterprise.ts

@@ -5,7 +5,6 @@ import { localeFromRequest } from "~/lib/language"
 import { createLead } from "~/lib/salesforce"
 import { inferenceSpendOptions } from "~/lib/inference-spend"
 import { lookupConsoleAccount, type ConsoleAccount } from "~/lib/console-account"
-import { ENTERPRISE_SPAM_THRESHOLD, enterpriseSpamProbability } from "~/lib/enterprise-spam"
 import { verifyHcaptcha } from "~/lib/hcaptcha"
 
 interface EnterpriseFormData {
@@ -99,7 +98,6 @@ export async function handleEnterpriseRequest(
     salesforceSubmit?: (payload: Record<string, unknown>) => Promise<boolean>
     notifications?: boolean
     accountLookup?: (email: string) => Promise<ConsoleAccount | null>
-    spam?: Parameters<typeof enterpriseSpamProbability>[1]
     captcha?: Parameters<typeof verifyHcaptcha>[1]
   } = {},
 ) {
@@ -138,15 +136,6 @@ export async function handleEnterpriseRequest(
       return Response.json({ error: dict["enterprise.form.error.captcha"] }, { status: 400 })
     }
 
-    // Fail open: a missing score never blocks a lead. Confident spam gets the same
-    // response as the honeypot and never reaches Salesforce, email, or EmailOctopus.
-    const spam = await enterpriseSpamProbability(body, options.spam)
-    if (spam !== undefined) console.info("Enterprise inquiry spam score", { probability: spam })
-    if (spam !== undefined && spam >= ENTERPRISE_SPAM_THRESHOLD) {
-      console.warn("Enterprise inquiry dropped as spam", { email: body.email, probability: spam })
-      return Response.json({ success: true, message: dict["enterprise.form.success.submitted"] }, { status: 200 })
-    }
-
     const account = await (options.accountLookup ?? lookupConsoleAccount)(body.email).catch((err) => {
       console.error("Failed to look up Console account:", err)
       return undefined

packages/console/app/src/lib/hcaptcha.test.ts

@@ -66,7 +66,6 @@ const submit = async (captcha: string | undefined, verify: () => Promise<Respons
     }),
     {
       captcha: { secret: "test-secret", fetch: verify },
-      spam: { inferenceUrl: "" },
       salesforceSubmit: async (payload) => {
         leads.push(payload)
         return true