@bongos/core 1.20.36 → 1.20.38

package/modules/platform-identity/routes/sso.js

@@ -26,6 +26,10 @@ const hubDevice = require('../hub-device');
 // The D7 applicant-profile read (task 1002972) and the echo that gates it.
 const applicantProfile = require('../applicant-profile');
 const applicationEcho = require('../application-echo');
+const instanceFeedback = require('../instance-feedback');
+
+// One limiter per hub process for POST /sso/feedback (task 1004462).
+const feedbackLimiter = instanceFeedback.makeFeedbackLimiter();
 
 // Per-IP cap for POST /sso/applicant-profile — DEFENCE IN DEPTH behind the echo
 // gate, not the gate itself (task 1002972 grade advisory). The echo already
@@ -692,5 +696,63 @@ module.exports = function ssoRoutes() {
     }
   });
 
+  // POST /sso/feedback — a federated project relays one builder's feedback about
+  // Bongos itself (task 1004462). A bug becomes a 'backlog' task in the building
+  // version's maintenance goal; an idea becomes an inbox row. Why always backlog,
+  // and why the sender must be a witnessed member: ../instance-feedback.js.
+  //
+  // rank: public — authenticated by client_id + client_secret, not a builder rank.
+  // The per-project and per-sender caps run after the client check, so an
+  // unauthenticated caller cannot spend a real project's allowance.
+  router.post('/sso/feedback', async (req, res) => {
+    if (validateOrRespond(req, res, {
+      client_id: { required: true, type: 'string', maxLength: 200 },
+      client_secret: { required: true, type: 'string', maxLength: 512 },
+      github_id: { required: true },
+      message: { required: true, type: 'string', maxLength: instanceFeedback.MESSAGE_MAX },
+      kind: { type: 'string', enum: Object.keys(instanceFeedback.FEEDBACK_KINDS) },
+      context: {},
+    })) return;
+    const b = req.body || {};
+    try {
+      const client = await pi.getClient(b.client_id, { pool });
+      if (!client || client.status !== 'active' || !pi.clientSecretValid(client, b.client_secret)) {
+        return res.fail('invalid_client', 401);
+      }
+      if (!pi.isNumericGithubId(b.github_id)) return res.fail('invalid_github_id', 400);
+      if (!String(b.message).trim()) return res.fail('message_required', 400);
+      const membership = await pi.getMembership(client.client_id, b.github_id, { pool });
+      if (!pi.membershipBacksRollup(membership)) return res.fail('membership_required', 409);
+      const allowed = feedbackLimiter.take(client.client_id, String(b.github_id));
+      if (!allowed.ok) {
+        res.set('Retry-After', String(allowed.retryAfter));
+        return res.fail('rate_limited', 429, { scope: `feedback-${allowed.scope}`, retry_after_seconds: allowed.retryAfter });
+      }
+      const landing = await instanceFeedback.fileInstanceFeedback({
+        client,
+        githubId: String(b.github_id),
+        message: b.message,
+        kind: b.kind || 'bug',
+        context: b.context && typeof b.context === 'object' ? b.context : {},
+      }, {
+        capture: (...a) => api.resolve('ideas.capture')(...a),
+        getAccount: (id) => pi.getAccount(id, { pool }),
+        hubBuilderId: async (id) => {
+          const { rows } = await pool.query('SELECT id FROM builders WHERE github_id = $1 LIMIT 1', [id]);
+          return rows[0] ? rows[0].id : null;
+        },
+      });
+      res.status(201).json({ ok: true, ...landing });
+    } catch (err) {
+      // No building version / no maintenance goal: the hub cannot take a bug right
+      // now. Say so rather than 500, so the CLI can tell the builder to retry later.
+      if (err && (err.code === 'NO_BUILDING_VERSION' || err.code === 'NO_MAINTENANCE_GOAL')) {
+        return res.fail('feedback_unavailable', 503, { reason: err.code });
+      }
+      log.error('[platform-identity] /sso/feedback', err);
+      res.fail('feedback_failed', { status: 500, message: 'internal error' });
+    }
+  });
+
   return router;
 };

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.20.36",
+  "version": "1.20.38",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.20.36",
+      "version": "1.20.38",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.20.36",
+  "version": "1.20.38",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/release-notes.json

@@ -8303,5 +8303,35 @@
       "id": "1004450",
       "text": "The deploy page now explains why an update stopped in plain words, says when it will try again, and offers a one-click fix when the only thing in the way is your own update setting. You can also see and change how far a projec"
     }
+  ],
+  "1.20.37": [
+    {
+      "id": "1003791",
+      "text": "A module's own tests can now be run and scored: the store records what share of them pass, and a module with no tests shows as 'no data yet' instead of failing."
+    },
+    {
+      "id": "1004406",
+      "text": "The unattended runner stops restarting every time anyone merges: it now updates its code in place and only restarts when its own code has changed."
+    }
+  ],
+  "1.20.38": [
+    {
+      "id": "1004468",
+      "text": "The nightly auto-update now follows the update rule you set on /deploy for each project, instead of a file on the server."
+    },
+    {
+      "id": "1004453",
+      "text": "When you start Autobongos from the Gate page you can now pick a priority goal: the runner works that goal first and moves to the other allowed goals only when it runs out of work there."
+    },
+    {
+      "id": "1004472",
+      "text": "Fixes the broken automatic check on main that was stopping everyone's finished work from landing."
+    },
+    {
+      "text": "When a builder complains that Bongos isn't working, their assistant now reports it to the Bongos team by itself, so every frustration becomes something on the fix list."
+    },
+    {
+      "text": "Builders on any Cloud Bongos project can now send feedback about Bongos itself with one command, and it arrives with the Bongos team as a task waiting for approval."
+    }
   ]
 }

package/scripts/gds/autobongos-run.js

@@ -106,6 +106,15 @@ function record(entry) {
   return row;
 }
 
+// pickedFrom — the row fields that say where a pick came from (task 1004453).
+// `priority` is true only when the fence named a priority goal AND this pick came
+// from it, so "the priority goal ran dry and the runner moved on" reads as
+// priority:false beside the goal it moved on to.
+function pickedFrom(goalId, gate) {
+  const p = gate && gate.priorityGoal != null ? gate.priorityGoal : null;
+  return { priority: p !== null && Number(goalId) === p };
+}
+
 // pickTask — the allowlisted goals, in order, through sequence.js's halt matrix.
 // The matrix is reused rather than re-derived: it already refuses thin specs,
 // protected paths, judgement kinds and unmet dependencies, from facts on the row.
@@ -359,7 +368,7 @@ const MAX_CLAIM_ATTEMPTS = 5;
 const LIMIT_UNKNOWN_RESET_MS = 30 * 60 * 1000;
 
 function newRunnerState() {
-  return { setAside: new Map(), queueGate: null, limitUntil: null };
+  return { setAside: new Map(), queueGate: null, limitUntil: null, diskHead: null };
 }
 const RUNNER_STATE = newRunnerState();
 
@@ -479,7 +488,7 @@ async function iteration(opts, deps = {}) {
       // looks like, and it must still reach the failure ladder (task 1004179).
       if (lastRefusal) return lastRefusal;
       return log({
-        event: 'nothing_claimable', goals: gate.goals,
+        event: 'nothing_claimable', goals: gate.goals, priority_goal: gate.priorityGoal ?? null,
         // Carried so the cadence can tell an EMPTY queue from one where every task
         // halts — the reasons are the matrix's own codes, safe to print.
         skipped: (got.skipped || []).map((sk) => ({ id: sk.id, goal_id: sk.goal_id, reasons: (sk.reasons || []).map((r) => r.code) })),
@@ -501,10 +510,10 @@ async function iteration(opts, deps = {}) {
       task: candidate, goals: gate.goals, protectedHits: matchProtected(candidate.touches || []),
     });
     if (!taskGate.go) {
-      return log({ event: 'fenced', code: taskGate.code, reason: taskGate.reason, task_id: candidate.id, goal_id: got.goalId, globs: taskGate.globs || [] });
+      return log({ event: 'fenced', code: taskGate.code, reason: taskGate.reason, task_id: candidate.id, goal_id: got.goalId, ...pickedFrom(got.goalId, gate), globs: taskGate.globs || [] });
     }
 
-    if (opts.dryRun) return log({ event: 'dry_run', task_id: candidate.id, title: candidate.title, goal_id: got.goalId });
+    if (opts.dryRun) return log({ event: 'dry_run', task_id: candidate.id, title: candidate.title, goal_id: got.goalId, ...pickedFrom(got.goalId, gate) });
 
     // 3. The task's own working tree.
     const name = deps.worktreeName ? deps.worktreeName(candidate.id) : worktreeName(candidate.id);
@@ -566,6 +575,7 @@ async function iteration(opts, deps = {}) {
 
   const row = {
     event: 'worked', task_id: task.id, title: task.title, goal_id: picked.goalId,
+    ...pickedFrom(picked.goalId, gate),
     worktree: wtName,
     outcome: verdict.outcome, reason: verdict.reason,
     session_id: res.sessionId || null, duration_s: Math.round((Date.now() - started) / 1000),
@@ -666,13 +676,16 @@ function heartbeatPath() {
 // output, reddening `unit` on main and blocking every PR. Use a regular FILE as the
 // parent directory instead: mkdir under it is ENOTDIR immediately, everywhere, and it
 // does not depend on the caller's permissions.
-function writeHeartbeat(now = Date.now()) {
+function writeHeartbeat(now = Date.now(), runnerState = RUNNER_STATE) {
   try {
     const p = heartbeatPath();
     fs.mkdirSync(path.dirname(p), { recursive: true });
     // `head` is what this process is RUNNING, not what is on disk (task 1004374).
     // Alive and alive-on-stale-code look identical from a check-in age alone.
-    fs.writeFileSync(p, JSON.stringify({ pid: process.pid, at: now, head: LOADED_HEAD }));
+    // `disk_head` appears only when the checkout was refreshed in place past what
+    // is running (task 1004406): "up to date on disk, old supervisor" is visible.
+    const disk = runnerState && runnerState.diskHead && runnerState.diskHead !== LOADED_HEAD ? runnerState.diskHead : undefined;
+    fs.writeFileSync(p, JSON.stringify({ pid: process.pid, at: now, head: LOADED_HEAD, ...(disk ? { disk_head: disk } : {}) }));
     return true;
   } catch (_) { return false; }
 }
@@ -851,10 +864,79 @@ async function codeDrifted(deps = {}) {
   // the comparison untestable in isolation.
   const mine = deps.loadedHead ? await deps.loadedHead(deps) : await loadedHead(deps);
   if (!mine) return null;
+  // Measured from what is on DISK once the checkout has been refreshed in place
+  // (task 1004406), or every loop after a refresh would see the same drift again.
+  const base = ((deps.state || RUNNER_STATE).diskHead) || mine;
   let tip = null;
   try { tip = await runFetchHead(deps); } catch (_) { return null; }
   if (!tip) return null;
-  return tip !== mine ? { from: mine.slice(0, 8), to: String(tip).slice(0, 8) } : false;
+  return tip !== base ? { from: base.slice(0, 8), to: String(tip).slice(0, 8) } : false;
+}
+
+// ── pull always, restart rarely (task 1004406) ──────────────────────────────
+//
+// Owner-approved 2026-09-30. Main moves every time ANY session lands, and a
+// relaunch per merge meant a busy day of restarts (four in fourteen minutes on
+// 2026-09-29). But a restart only refreshes code THIS process holds in memory:
+// every worker, and every claim.js / worktree.js / release.js the loop shells
+// out to, is a fresh process that runs whatever is on disk. So on drift the
+// checkout is updated in place, and the process exits for the wrapper only when
+// a change touches code it has actually loaded.
+//
+// SUPERVISOR_PATH_RES catch the supervisor's own files even before they are
+// required (autobongos-verify.js is loaded lazily on the first ship), so a change
+// to a file the loop is ABOUT to load cannot mix old callers with a new callee.
+const SUPERVISOR_PATH_RES = [/^scripts\/gds\/autobongos-[^/]+$/, /^modules\/autonomy\//];
+
+// The repo files this process has loaded, repo-relative with forward slashes.
+function loadedFiles() {
+  const root = REPO_ROOT + path.sep;
+  const nm = path.sep + 'node_modules' + path.sep;
+  return Object.keys(require.cache)
+    .filter((p) => p.startsWith(root) && !p.includes(nm))
+    .map((p) => path.relative(REPO_ROOT, p).split(path.sep).join('/'));
+}
+
+// The changed files that force a restart: ones this process holds, or ones under
+// the supervisor's own paths. Everything else is picked up by the next child.
+function supervisorTouched(changed = [], loaded = loadedFiles()) {
+  const held = new Set(loaded);
+  return changed.filter((f) => held.has(f) || SUPERVISOR_PATH_RES.some((re) => re.test(f)));
+}
+
+// refreshCheckout — the wrapper's fetch + reset, done from inside the process.
+//
+// THE MAIN CHECKOUT ONLY. It runs `git reset --hard`, and a linked worktree is a
+// claim somebody is building in; resetting one would destroy their work. The
+// check compares git-dir to git-common-dir, which are equal only in the main
+// checkout. Armed only by main() (`opts.refreshInPlace`), so a test driving
+// forever() can never reach it — in CI that reset would wipe the code under test.
+//
+// The diff is from the LOADED commit, not the last refresh, so a supervisor
+// change that landed several refreshes ago still forces the restart it needs.
+async function refreshCheckout(deps = {}) {
+  const runCmd = deps.run || run;
+  const git = (args) => runCmd('git', args, { cwd: REPO_ROOT });
+  try {
+    const [gd, cd] = await Promise.all([git(['rev-parse', '--git-dir']), git(['rev-parse', '--git-common-dir'])]);
+    if (!gd.ok || !cd.ok) return { ok: false, reason: 'could not tell which checkout this is' };
+    if (path.resolve(REPO_ROOT, String(gd.stdout).trim()) !== path.resolve(REPO_ROOT, String(cd.stdout).trim())) {
+      return { ok: false, reason: 'not the main checkout — refusing to reset a linked worktree' };
+    }
+    const loaded = deps.loadedHead ? await deps.loadedHead(deps) : await loadedHead(deps);
+    if (!loaded) return { ok: false, reason: 'the running commit is unknown' };
+    if (!(await git(['fetch', '--quiet', 'origin', 'main'])).ok) return { ok: false, reason: 'fetch failed' };
+    const fh = await git(['rev-parse', 'FETCH_HEAD']);
+    const to = fh.ok ? String(fh.stdout).trim() : '';
+    if (!/^[0-9a-f]{40}$/.test(to)) return { ok: false, reason: 'could not read the fetched commit' };
+    const diff = await git(['diff', '--name-only', loaded, to]);
+    if (!diff.ok) return { ok: false, reason: 'could not diff the running commit against main' };
+    if (!(await git(['reset', '--quiet', '--hard', to])).ok) return { ok: false, reason: 'reset failed' };
+    const changed = String(diff.stdout).split(/\r?\n/).map((l) => l.trim()).filter(Boolean);
+    return { ok: true, to, changed };
+  } catch (e) {
+    return { ok: false, reason: e && e.message ? e.message : String(e) };
+  }
 }
 
 // The head of origin/main, or null. `git ls-remote` rather than `fetch`: it moves
@@ -932,7 +1014,9 @@ async function forever(opts, deps = {}) {
   // reports itself anyway: the hall reads the AGE of the last check-in, so a
   // failed beat shows up as silence, which is the signal.
   const beat = async (fields) => {
-    try { beatFile(); } catch (_) { /* a runner that cannot write its file still runs */ }
+    // The runner state is passed, not defaulted: the file names `disk_head` from
+    // it (task 1004406), and an injected state must reach the beat that reports it.
+    try { beatFile(Date.now(), deps.state || RUNNER_STATE); } catch (_) { /* a runner that cannot write its file still runs */ }
     try { await beatServer(fields, deps); } catch (_) { /* and one that cannot reach the instance still runs */ }
   };
   // The running commit, read ONCE, BEFORE the first beat (task 1004397). It used
@@ -969,7 +1053,7 @@ async function forever(opts, deps = {}) {
       // task 1234" from "quiet because it is dead". A worker may hold the loop for
       // ninety minutes, and without this every honest hour of work looks like a
       // corpse.
-      await beat({ mode: state.mode, last_event: row.event, working_task_id: Number(row.task_id) || undefined });
+      await beat({ mode: state.mode, last_event: row.event, working_task_id: Number(row.task_id) || undefined, working_goal_id: Number(row.goal_id) || undefined });
       const seen = cadence.classifyEvent(row);
       // A hold that names its reset SECOND waits until that second (task 1004454).
       // classifyEvent carries it as an absolute epoch; the cadence has no clock of
@@ -993,14 +1077,35 @@ async function forever(opts, deps = {}) {
     // spends nearly all of its time and an upgrade should not sit behind it.
     const upMs = (deps.now ? deps.now() : Date.now()) - Date.parse(RUNNER_STARTED_AT);
     const mayUpgrade = upMs >= MIN_UPTIME_BEFORE_UPGRADE_MS;
-    const drift = mayUpgrade
+    let drift = mayUpgrade
       ? (deps.codeDrifted ? await deps.codeDrifted(deps) : await codeDrifted(deps))
       : false;
     if (drift) {
-      log({ event: 'upgrade_exit', from: drift.from, to: drift.to,
-        reason: `main moved from ${drift.from} to ${drift.to} — exiting so the wrapper can relaunch on the new code` });
-      await beat({ mode: state.mode, last_event: 'upgrade_exit' });
-      return UPGRADE_EXIT_CODE;
+      // Pull always, restart rarely (task 1004406). Only main() arms the refresh.
+      let why = 'exiting so the wrapper can relaunch on the new code';
+      if (opts.refreshInPlace) {
+        const refreshed = await (deps.refreshCheckout || refreshCheckout)(deps);
+        if (refreshed && refreshed.ok) {
+          const touched = supervisorTouched(refreshed.changed, deps.loadedFiles ? deps.loadedFiles() : loadedFiles());
+          if (!touched.length) {
+            (deps.state || RUNNER_STATE).diskHead = refreshed.to;
+            log({ event: 'code_refreshed', from: drift.from, to: refreshed.to.slice(0, 8), changed: refreshed.changed.length,
+              reason: `main moved from ${drift.from} to ${refreshed.to.slice(0, 8)} — checkout updated in place; none of the ${refreshed.changed.length} changed file(s) is code this process runs, so no restart` });
+            await beat({ mode: state.mode, last_event: 'code_refreshed' });
+            drift = null;
+          } else {
+            const more = touched.length > 5 ? `, +${touched.length - 5} more` : '';
+            why = `it changed code this process runs (${touched.slice(0, 5).join(', ')}${more}) — exiting so the wrapper can relaunch on it`;
+          }
+        } else {
+          why = `the in-place refresh did not run (${(refreshed && refreshed.reason) || 'no result'}) — exiting so the wrapper's own refresh can`;
+        }
+      }
+      if (drift) {
+        log({ event: 'upgrade_exit', from: drift.from, to: drift.to, reason: `main moved from ${drift.from} to ${drift.to} — ${why}` });
+        await beat({ mode: state.mode, last_event: 'upgrade_exit' });
+        return UPGRADE_EXIT_CODE;
+      }
     }
 
     const { waited, jumped } = await wait(state.waitS, { ...deps, beat }, opts.cadence);
@@ -1015,7 +1120,7 @@ async function main(argv) {
   // it lived on the machine being fenced; the database owns that now, and an empty
   // `--goal` means "every allowlisted goal" rather than "anything claimable". The
   // refusal did not disappear — it moved somewhere the runner host cannot edit.
-  if (opts.forever) return forever(opts);
+  if (opts.forever) return forever({ ...opts, refreshInPlace: true });
 
   // The one-shot path, kept for an operator running a single task by hand. It
   // still reconciles first: a leftover claim is a leftover claim whoever is
@@ -1043,5 +1148,5 @@ module.exports = {
   worktreeName, readFence, reconcileLeftoverClaims, pollSignals, waitOrJump, forever, CLAIM_PREFIX, codeDrifted, loadedHead, UPGRADE_EXIT_CODE, MIN_UPTIME_BEFORE_UPGRADE_MS,
   heartbeatPath, writeHeartbeat, readHeartbeat, pidAlive, anotherRunnerIsAlive, HEARTBEAT_STALE_MS,
   isRunnerTree, RUNNER_TREE_RE, postHeartbeat, RUNNER_STARTED_AT, failureReason,
-  newRunnerState, LIMIT_UNKNOWN_RESET_MS, QUEUE_GATED_EXIT, CLAIM_SET_ASIDE_MS, MAX_CLAIM_ATTEMPTS, owedTaskIds,
+  newRunnerState, loadedFiles, supervisorTouched, refreshCheckout, LIMIT_UNKNOWN_RESET_MS, QUEUE_GATED_EXIT, CLAIM_SET_ASIDE_MS, MAX_CLAIM_ATTEMPTS, owedTaskIds,
 };

package/scripts/gds/feedback-send.js

@@ -0,0 +1,131 @@
+#!/usr/bin/env node
+// Send feedback about Bongos itself to the Cloud Bongos maintainers (task 1004462).
+//
+// Usage:
+//   bongos feedback "the claim command hung for two minutes"
+//   bongos feedback --idea "let me filter the task list by goal"
+//   bongos feedback --message-file notes.md
+//   [--json]
+//
+// Not the /feedback skill, which loads a locally recorded walkthrough into a
+// session. This SENDS: it posts to the builder's OWN project (POST /feedback,
+// src/bongos/routes/feedback.js), which relays it to the hub. A bug lands on the
+// hub as a 'backlog' task in the maintenance goal awaiting a maintainer's nod; an
+// idea lands in the hub's idea inbox. Only the typed text and version stamps
+// travel — never code, a transcript or file contents.
+
+'use strict';
+
+const os = require('node:os');
+const { cliClient, requireSession, argText, hasFlag, errCode, errDetails, cliExit } = require('./cli-lib');
+
+const USAGE = [
+  'usage:',
+  '  bongos feedback "what went wrong"          report a problem with Bongos',
+  '  bongos feedback --idea "what you wish for" suggest an improvement',
+  '  bongos feedback --message-file notes.md    send a longer note from a file',
+  '',
+  'Goes to the Cloud Bongos maintainers. Only the text you type and the Bongos',
+  'versions you run are sent — no code, chat or files from your project.',
+].join('\n');
+
+// The CLI release, as `bongos version` reports it: config/bongos-cli.json where
+// the core checkout carries it (an instance does not — task 1824), else the
+// package version. Read from disk, never required, so a vanilla core still runs.
+function cliVersion() {
+  const fs = require('node:fs');
+  const path = require('node:path');
+  for (const rel of ['../../config/bongos-cli.json', '../../package.json']) {
+    try {
+      const f = path.join(__dirname, rel);
+      if (fs.existsSync(f)) { const v = JSON.parse(fs.readFileSync(f, 'utf8')).version; if (v) return v; }
+    } catch { /* try the next */ }
+  }
+  return null;
+}
+
+// The message: --message / --message-file, else every positional word joined.
+function readMessage(args) {
+  if (args.includes('--message') || args.includes('--message-file')) return argText('--message', args);
+  return args.filter((a) => !a.startsWith('--')).join(' ');
+}
+
+// Every report goes through the transcript-grade secret scrubber before it leaves
+// this machine (task 1004467). An assistant may file unasked when a builder vents,
+// so nobody reviews the text first — the scrubber is the check that does not
+// depend on the assistant's judgment. FAIL CLOSED: no scrubber, nothing is sent.
+// It also strips the builder's environment secrets by value, whatever their shape.
+function scrubReport(message, env = process.env) {
+  let scrub;
+  try { scrub = require('../../modules/security/secret-scrub.js'); } catch { return null; }
+  const text = scrub.scrubSecrets(message, scrub.collectEnvSecrets(env));
+  const removed = text.split(scrub.REDACTED).length - message.split(scrub.REDACTED).length;
+  return { text, removed };
+}
+
+// Plain-language lines for each refusal the route can give.
+const REFUSALS = {
+  message_required: 'Nothing to send — add your feedback after the command, in quotes.',
+  validation_failed: 'That could not be sent as written — keep it under 4,000 characters, or split it into two.',
+  not_hub_connected: 'This project is not connected to Cloud Bongos, so feedback cannot be relayed from here.\n'
+    + 'Report it to the Bongos maintainers on the Bongos core repository instead.',
+  membership_required: 'Cloud Bongos does not yet know you as a member of this project.\n'
+    + 'Sign in to this project once through Cloud Bongos in a browser, then try again.',
+  rate_limited: 'Too much feedback from you or this project in the last hour. Try again later.',
+  feedback_unavailable: 'Cloud Bongos is not taking bug reports right now (no version is being built). Try again later.',
+  hub_unreachable: 'Could not reach Cloud Bongos. Check your connection and try again.',
+};
+
+async function main(argv = process.argv.slice(2)) {
+  if (hasFlag('--help', argv) || hasFlag('-h', argv)) { console.log(USAGE); return 0; }
+  const json = hasFlag('--json', argv);
+  const kind = hasFlag('--idea', argv) ? 'idea' : 'bug';
+  const message = String(readMessage(argv) || '').trim();
+  if (!message) { console.error(USAGE); return 2; }
+
+  const scrubbed = scrubReport(message);
+  if (!scrubbed) {
+    console.error('Feedback was not sent: the secret filter that checks every report is missing from this install.');
+    return 1;
+  }
+
+  await requireSession();
+  const api = await cliClient();
+  const res = await api.request('POST', '/feedback', {
+    body: { message: scrubbed.text, kind, context: { cli_version: cliVersion(), os: `${os.platform()} ${os.release()}` } },
+  });
+  if (scrubbed.removed > 0 && !json) {
+    console.log(`Removed ${scrubbed.removed} secret-looking value(s) from the report before sending.`);
+  }
+
+  if (json) { console.log(JSON.stringify(res.data, null, 2)); return res.ok ? 0 : 1; }
+  if (!res.ok) {
+    const code = errCode(res.data);
+    const details = errDetails(res.data) || {};
+    let line = REFUSALS[code] || `Feedback was not sent (${code || `HTTP ${res.status}`}).`;
+    if (code === 'rate_limited' && details.retry_after_seconds) {
+      line += ` (in about ${Math.ceil(details.retry_after_seconds / 60)} min)`;
+    }
+    console.error(line);
+    return 1;
+  }
+  const d = res.data || {};
+  if (d.landed === 'task') {
+    console.log(`Thanks — sent to the Cloud Bongos maintainers as task ${d.task_id}.`);
+    console.log('It waits for a maintainer to approve it before anyone works on it.');
+    if (d.hub_origin) console.log(`${String(d.hub_origin).replace(/\/+$/, '')}/builders#/task/${d.task_id}`);
+  } else {
+    console.log(`Thanks — your idea is in the Cloud Bongos idea inbox (idea ${d.idea_id}) for the maintainers to review.`);
+  }
+  return 0;
+}
+
+if (require.main === module) {
+  // cliExit, never process.exit, after a request (task 1002734 — the Windows abort).
+  main().then((code) => cliExit(code), (err) => {
+    console.error(`Feedback was not sent: ${err && err.message ? err.message : err}`);
+    cliExit(1);
+  });
+}
+
+module.exports = { main, readMessage, REFUSALS, scrubReport };