@bongos/core 1.21.69 → 1.21.70

package/docs/api-reference.md

@@ -2,7 +2,7 @@
 
 # Bongos API reference
 
-> **Generated from the live route files** — the route file is authoritative. 520 endpoints across 93 route files.
+> **Generated from the live route files** — the route file is authoritative. 522 endpoints across 93 route files.
 > Machine-readable spec: [`docs/api/openapi.json`](api/openapi.json) (OpenAPI 3.1). Rendered docs site: **`/docs`** (e.g. `cloudbongos.com/docs`).
 
 Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/0016-trust-boundary-server-enforced-permissions.md)): `public` < `any-builder` < `metic+archon` < `archon`.
@@ -261,11 +261,12 @@ Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/0016-trust
 | POST | `/api/bongos/done-when/:criterionId/unsatisfy` | `metic+archon` | `reason` | Auth: flip a criterion back to unsatisfied (rare; for corrections). |
 | GET | `/api/bongos/done-when/pending-review` | `metic+archon` | — | Auth (Metic+): the criterion review queue — every criterion auto-flagged "met — pending review" (≥1 linked task, all shipped, not yet con… |
 
-## `feedback` (1)
+## `feedback` (2)
 
 | Method | Path | Rank | Body | Description |
 |---|---|---|---|---|
-| POST | `/api/bongos/feedback` | `any-builder` | `message`, `kind`, `context` | signed-in builder — reporting a problem with Bongos grants nothing here, and the hub files every report at 'backlog' behind a Metic+ nod. |
+| POST | `/api/bongos/feedback/receipt` | `any-builder` | `sha256`, `kind` | signed-in builder — a receipt only says "this builder sent this text"; it grants nothing here, and the hub files every report behind a nod. |
+| GET | `/api/bongos/feedback/receipt/:id` | `public` | — | the hub redeems a receipt with no session of its own. |
 
 ## `founding` (6)
 
@@ -793,7 +794,7 @@ Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/0016-trust
 | GET | `/api/bongos/specialities/installed-skills` | `any-builder` | — | GET /specialities/installed-skills — every skill THIS instance has, each explained the way the adoption walkthrough explains it, so a spe… |
 | GET | `/api/bongos/specialities/offered` | `any-builder` | — | GET /specialities/offered — the suggestions for THIS builder. |
 
-## `sso` (11)
+## `sso` (12)
 
 | Method | Path | Rank | Body | Description |
 |---|---|---|---|---|
@@ -803,6 +804,7 @@ Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/0016-trust
 | POST | `/api/bongos/sso/device/poll` | `public` | `device_code` | POST /sso/device/poll — poll the hub device flow. |
 | POST | `/api/bongos/sso/device/start` | `public` | `origin` | POST /sso/device/start — begin CLI federation. |
 | POST | `/api/bongos/sso/feedback` | `public` | `client_id`, `client_secret`, `github_id`, `message`, `kind`, `context` | POST /sso/feedback — a federated project relays one builder's feedback about Bongos itself (task 1004462). |
+| POST | `/api/bongos/sso/feedback/direct` | `public` | `origin`, `receipt`, `message`, `kind`, `context` | POST /sso/feedback/direct — `bongos feedback` straight from a builder's CLI, with a one-time receipt from their own project (task 1004591). |
 | POST | `/api/bongos/sso/invites/clear` | `public` | `client_id`, `client_secret`, `github_login` | authenticated by client_id + client_secret, not a builder rank. |
 | POST | `/api/bongos/sso/invites/notify` | `public` | `client_id`, `client_secret`, `github_login` | authenticated by client_id + client_secret, not a builder rank. |
 | POST | `/api/bongos/sso/membership/check-in` | `public` | `client_id`, `client_secret`, `github_id`, `github_login`, `display_name`, `avatar_url`, `membership_kind` | POST /sso/membership/check-in — a federated instance reports, on every sign-in, that a builder builds on its project (ADR 0141 §3). |

package/docs/module-api-changelog.md

@@ -2970,5 +2970,7 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.21.67 with no explicit bump. run 37511231885. (task 1002620)
   1.21.69 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.21.68 with no explicit bump. run 37516251453. (task 1002620)
+  1.21.70 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.21.69 with no explicit bump. run 37524456209. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/modules/platform-identity/instance-feedback.js

@@ -21,6 +21,15 @@
 // an absent rank as untrusted, so even the owner's own feedback waits for the nod
 // rather than inheriting a hub rank the instance never vouched for.
 //
+// TWO DOORS IN (task 1004591). The relay above needs the project linked to the hub,
+// which many are not, so the CLI now sends STRAIGHT here (POST /sso/feedback/direct)
+// with a one-time receipt from its own project (src/bongos/routes/feedback.js).
+// The hub answers at once, then redeems the receipt at the project's public URL:
+// the project names the signed-in sender and the hash of the text, and only a
+// matching report is filed. A project on the hub's own domain is one we run, so
+// its word is verified; any other domain is printed as "confirmed by <host>".
+// The relay stays for projects on cores older than the receipt.
+//
 // THE ATTRIBUTION IS THE HUB'S, NOT THE INSTANCE'S. Client credentials prove WHICH
 // PROJECT is calling and nothing about WHO sent it, so the sender must hold a
 // membership on that project carrying the hub's own sign-in witness
@@ -86,8 +95,11 @@ function feedbackTitle(message) {
   return `Feedback: ${title}`;
 }
 
-function feedbackBody({ message, client, account, githubId, context = {} }) {
-  const who = account && account.github_login ? `@${account.github_login}` : `GitHub user ${githubId}`;
+function feedbackBody({ message, client, account, githubId, context = {}, vouch = null }) {
+  // vouch (direct reports only): { hosted, host, login } — the receipt's word.
+  const claimed = vouch && typeof vouch.login === 'string' && /^[A-Za-z0-9-]{1,39}$/.test(vouch.login) ? vouch.login : null;
+  const who = account && account.github_login ? `@${account.github_login}`
+    : claimed ? `@${claimed} (GitHub user ${githubId})` : `GitHub user ${githubId}`;
   const project = client.name ? `${client.name} (${client.origin || client.client_id})` : (client.origin || client.client_id);
   const stamps = [
     ['Core', cleanStamp(context.core_version)],
@@ -97,10 +109,13 @@ function feedbackBody({ message, client, account, githubId, context = {} }) {
   // The hub's own attribution comes FIRST and the sender's words follow as a
   // quote, so text they type can never pose as the footer a reviewer trusts.
   const quoted = String(message).trim().split('\n').map((l) => `> ${l}`).join('\n');
+  const vouchLine = !vouch ? []
+    : [`- Sender: ${vouch.hosted ? 'verified (a project Cloud Bongos hosts)' : `confirmed by ${vouch.host} (self-hosted, not verified by us)`}`];
   return [
-    'Sent from a managed project with `bongos feedback`.',
+    vouch ? 'Sent with `bongos feedback`.' : 'Sent from a managed project with `bongos feedback`.',
     `- Project: ${project}`,
     `- Sent by: ${who}`,
+    ...vouchLine,
     ...(stamps ? [`- Running: ${stamps}`] : []),
     '',
     quoted,
@@ -110,12 +125,15 @@ function feedbackBody({ message, client, account, githubId, context = {} }) {
 // fileInstanceFeedback — file one relayed report. `deps.capture` is the
 // `ideas.capture` port; `deps.getAccount` and `deps.hubBuilderId` read the hub's
 // own rows for the sender. Returns the landing the CLI prints.
-async function fileInstanceFeedback({ client, githubId, message, kind, context }, deps) {
-  const account = await deps.getAccount(githubId).catch(() => null);
-  const capturedBy = await deps.hubBuilderId(githubId).catch(() => null);
+async function fileInstanceFeedback({ client, githubId, message, kind, context, vouch = null }, deps) {
+  // A self-hosted project's word cannot borrow a hub account: its owner could
+  // name anyone's GitHub id, so the hub's login and builder row stay unread.
+  const trusted = !vouch || vouch.hosted;
+  const account = trusted ? await deps.getAccount(githubId).catch(() => null) : null;
+  const capturedBy = trusted ? await deps.hubBuilderId(githubId).catch(() => null) : null;
   const idea = await deps.capture({
     title: feedbackTitle(message),
-    bodyMd: feedbackBody({ message, client, account, githubId, context }),
+    bodyMd: feedbackBody({ message, client, account, githubId, context, vouch }),
     kind: FEEDBACK_KINDS[kind],
     capturedBy,
     filerRank: null, // untrusted by design — see the header
@@ -129,7 +147,90 @@ async function fileInstanceFeedback({ client, githubId, message, kind, context }
     : { landed: 'inbox', idea_id: String(idea.id) };
 }
 
+// ── the direct door (task 1004591) ───────────────────────────────────────────
+
+const RECEIPT_TIMEOUT_MS = 8000;
+
+function sha256Hex(text) {
+  return require('node:crypto').createHash('sha256').update(String(text), 'utf8').digest('hex');
+}
+
+// projectOrigin — the caller-named project, accepted only as a bare https origin
+// on a DNS name (no IP literal, no port, no path, no userinfo). Null otherwise.
+function projectOrigin(raw) {
+  let u;
+  try { u = new URL(String(raw || '')); } catch { return null; }
+  if (u.protocol !== 'https:' || u.port || u.username || u.password) return null;
+  if (u.pathname !== '/' && u.pathname !== '') return null;
+  if (u.search || u.hash) return null;
+  const host = u.hostname.toLowerCase();
+  if (!host.includes('.') || require('node:net').isIP(host.replace(/^\[|\]$/g, ''))) return null;
+  if (/(^|\.)(localhost|local|internal|test|invalid)$/.test(host)) return null;
+  return { origin: `https://${host}`, host };
+}
+
+// isHostedBy — a project on the hub's own domain (or the hub itself) is one we run.
+function isHostedBy(host, hubHost) {
+  const h = String(hubHost || '').toLowerCase();
+  return !!h && (host === h || host.endsWith(`.${h}`));
+}
+
+// verifyDirectReport — redeem the receipt at the project and check it matches.
+// Resolves { ok: true, receipt } or { ok: false, reason }; never throws. The
+// address is attacker-named, so the host must resolve to a public address
+// (deps.assertPublicHost) and a redirect is an error, never followed.
+async function verifyDirectReport({ origin, receipt, message, kind }, deps) {
+  const target = projectOrigin(origin);
+  if (!target) return { ok: false, reason: 'bad_origin' };
+  if (!/^[A-Za-z0-9_-]{16,64}$/.test(String(receipt || ''))) return { ok: false, reason: 'bad_receipt' };
+  try {
+    await deps.assertPublicHost(target.host);
+  } catch {
+    return { ok: false, reason: 'private_host' };
+  }
+  let body;
+  try {
+    const res = await (deps.fetchImpl || fetch)(`${target.origin}/api/bongos/feedback/receipt/${receipt}`, {
+      headers: { accept: 'application/json' },
+      redirect: 'error',
+      signal: AbortSignal.timeout(RECEIPT_TIMEOUT_MS),
+    });
+    if (res.status !== 200) return { ok: false, reason: `receipt_http_${res.status}` };
+    body = await res.json();
+  } catch {
+    return { ok: false, reason: 'receipt_unreachable' };
+  }
+  if (!body || typeof body !== 'object') return { ok: false, reason: 'receipt_malformed' };
+  if (!/^\d{1,20}$/.test(String(body.github_id || ''))) return { ok: false, reason: 'receipt_malformed' };
+  if (body.sha256 !== sha256Hex(message)) return { ok: false, reason: 'text_mismatch' };
+  if ((body.kind || 'bug') !== kind) return { ok: false, reason: 'kind_mismatch' };
+  return { ok: true, target, receipt: body };
+}
+
+// fileDirectReport — the whole after-the-202 half: verify, then file. Returns the
+// landing, or { dropped: reason } for a report the project did not vouch for.
+async function fileDirectReport({ origin, receipt, message, kind, context = {}, hubHost }, deps) {
+  const v = await verifyDirectReport({ origin, receipt, message, kind }, deps);
+  if (!v.ok) return { dropped: v.reason };
+  const githubId = String(v.receipt.github_id);
+  const hosted = isHostedBy(v.target.host, hubHost);
+  return fileInstanceFeedback({
+    client: { name: v.target.host, origin: v.target.origin, client_id: v.target.host },
+    githubId,
+    message,
+    kind,
+    // The project's own core version beats whatever the CLI claimed.
+    context: { ...context, core_version: v.receipt.core_version || null },
+    vouch: { hosted, host: v.target.host, login: v.receipt.github_login },
+  }, deps);
+}
+
 module.exports = {
+  sha256Hex,
+  projectOrigin,
+  isHostedBy,
+  verifyDirectReport,
+  fileDirectReport,
   FEEDBACK_KINDS,
   MESSAGE_MAX,
   PER_SENDER_LIMIT,

package/modules/platform-identity/routes/sso.js

@@ -30,9 +30,25 @@ const applicationEcho = require('../application-echo');
 // The guild label the echo carries (task 1002303, ADR 0365 D5).
 const guildEngagements = require('../guild-engagements');
 const instanceFeedback = require('../instance-feedback');
+const projectStats = require('../project-stats');
 
 // One limiter per hub process for POST /sso/feedback (task 1004462).
 const feedbackLimiter = instanceFeedback.makeFeedbackLimiter();
+// …and two for POST /sso/feedback/direct (task 1004591), which carries no
+// credential: one keyed by the caller's address ALONE, so naming a fresh host on
+// every request buys nothing, and one by the named project and address.
+const directIpLimiter = instanceFeedback.makeFeedbackLimiter();
+const directFeedbackLimiter = instanceFeedback.makeFeedbackLimiter();
+
+// The hub's own host: a direct report from it or a subdomain of it comes from a
+// project we run. Best-effort — no host means nothing counts as hosted. Read once.
+let _hubHost = null;
+function hubHost() {
+  if (_hubHost === null) {
+    try { _hubHost = new URL(api.branding().domains.publicOrigin).hostname.toLowerCase(); } catch { _hubHost = ''; }
+  }
+  return _hubHost;
+}
 
 // Per-IP cap for POST /sso/applicant-profile — DEFENCE IN DEPTH behind the echo
 // gate, not the gate itself (task 1002972 grade advisory). The echo already
@@ -781,5 +797,60 @@ module.exports = function ssoRoutes() {
     }
   });
 
+  // POST /sso/feedback/direct — `bongos feedback` straight from a builder's CLI,
+  // with a one-time receipt from their own project (task 1004591). Answers 202 at
+  // once so the builder never waits; the receipt is redeemed AFTER, and a report
+  // the project does not vouch for is dropped (logged, never filed). Why this
+  // proves the sender, and what "hosted" earns: ../instance-feedback.js.
+  //
+  // rank: public — no session on the hub; the proof is the project's receipt.
+  // Capped per caller address (10/h whatever host it names), then per named
+  // project (30/h), BEFORE anything is fetched.
+  router.post('/sso/feedback/direct', (req, res) => {
+    if (validateOrRespond(req, res, {
+      origin: { required: true, type: 'string', maxLength: 200 },
+      receipt: { required: true, type: 'string', maxLength: 64 },
+      message: { required: true, type: 'string', maxLength: instanceFeedback.MESSAGE_MAX },
+      kind: { type: 'string', enum: Object.keys(instanceFeedback.FEEDBACK_KINDS) },
+      context: {},
+    })) return;
+    const b = req.body || {};
+    const target = instanceFeedback.projectOrigin(b.origin);
+    if (!target) return res.fail('bad_origin', 400);
+    const message = String(b.message).trim();
+    if (!message) return res.fail('message_required', 400);
+    // The address's own bucket first (both of its tiers keyed by the address, so
+    // no bucket is shared between callers); only an address still under its cap
+    // may spend from the named project's bucket — a refused caller costs a real
+    // project nothing.
+    const ip = String(req.ip || 'unknown');
+    let allowed = directIpLimiter.take(ip, 'direct');
+    if (allowed.ok) allowed = directFeedbackLimiter.take(target.host, ip);
+    if (!allowed.ok) {
+      res.set('Retry-After', String(allowed.retryAfter));
+      return res.fail('rate_limited', 429, { scope: `feedback-${allowed.scope}`, retry_after_seconds: allowed.retryAfter });
+    }
+    res.status(202).json({ ok: true, accepted: true });
+    const ctx = b.context && typeof b.context === 'object' ? b.context : {};
+    instanceFeedback.fileDirectReport({
+      origin: target.origin,
+      receipt: b.receipt,
+      message: b.message,
+      kind: b.kind || 'bug',
+      context: { cli_version: ctx.cli_version, os: ctx.os },
+      hubHost: hubHost(),
+    }, {
+      assertPublicHost: (host) => projectStats.assertPublicHost(host),
+      capture: (...a) => api.resolve('ideas.capture')(...a),
+      getAccount: (id) => pi.getAccount(id, { pool }),
+      hubBuilderId: async (id) => {
+        const { rows } = await pool.query('SELECT id FROM builders WHERE github_id = $1 LIMIT 1', [id]);
+        return rows[0] ? rows[0].id : null;
+      },
+    }).then((r) => {
+      if (r && r.dropped) log.warn(`[platform-identity] /sso/feedback/direct dropped from ${target.host}: ${r.dropped}`);
+    }, (err) => log.error('[platform-identity] /sso/feedback/direct', err));
+  });
+
   return router;
 };

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.21.69",
+  "version": "1.21.70",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.21.69",
+      "version": "1.21.70",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.21.69",
+  "version": "1.21.70",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/release-notes.json

@@ -9194,5 +9194,10 @@
       "id": "1004277",
       "text": "The projects you build on, with their Leave buttons, now live on your account page. My projects links there."
     }
+  ],
+  "1.21.70": [
+    {
+      "text": "Reporting a problem with Bongos now works from every project, including ones like Will's that could not send feedback before. It takes a second, needs no extra sign-in, and the Bongos team can see who really sent each report."
+    }
   ]
 }

package/scripts/gds/feedback-send.js

@@ -1,40 +1,58 @@
 #!/usr/bin/env node
-// Send feedback about Bongos itself to the Cloud Bongos maintainers (task 1004462).
+// Send feedback about Bongos itself to the Cloud Bongos maintainers (tasks 1004462, 1004591).
 //
 // Usage:
 //   bongos feedback "the claim command hung for two minutes"
 //   bongos feedback --idea "let me filter the task list by goal"
-//   bongos feedback --message-file notes.md
-//   [--json]
+//   bongos feedback --message-file notes.md      (or --message-file - for stdin)
+//   [--wait]   send in the foreground and print the outcome (debugging)
 //
-// Not the /feedback skill, which loads a locally recorded walkthrough into a
-// session. This SENDS: it posts to the builder's OWN project (POST /feedback,
-// src/bongos/routes/feedback.js), which relays it to the hub. A bug lands on the
-// hub as a 'backlog' task in the maintenance goal awaiting a maintainer's nod; an
-// idea lands in the hub's idea inbox. Only the typed text and version stamps
-// travel — never code, a transcript or file contents.
+// Straight to the hub, never through the project: a project with no hub link can
+// still send. The builder's OWN project vouches for who sent it — the CLI asks it
+// for a one-time receipt (src/bongos/routes/feedback.js) and the hub redeems that
+// receipt before filing (modules/platform-identity/instance-feedback.js). So a
+// signed-in builder does nothing extra.
+//
+// Fast and quiet by design (the owner, 2026-10-06): the command prints one line
+// and returns at once; a detached background process does the network. No task
+// number comes back. Only the typed text (secret-scrubbed) and version stamps travel.
 
 'use strict';
 
+const fs = require('node:fs');
 const os = require('node:os');
-const { cliClient, requireSession, argText, hasFlag, errCode, errDetails, cliExit } = require('./cli-lib');
+const path = require('node:path');
+const crypto = require('node:crypto');
+const { spawn } = require('node:child_process');
+const { cliClient, requireSession, loadSessionSync, argText, hasFlag, errCode, cliExit } = require('./cli-lib');
+const ic = require('../../src/instance-config');
 
 const USAGE = [
   'usage:',
   '  bongos feedback "what went wrong"          report a problem with Bongos',
   '  bongos feedback --idea "what you wish for" suggest an improvement',
-  '  bongos feedback --message-file notes.md    send a longer note from a file',
+  '  bongos feedback --message-file notes.md    send a longer note from a file (- for stdin)',
   '',
   'Goes to the Cloud Bongos maintainers. Only the text you type and the Bongos',
   'versions you run are sent — no code, chat or files from your project.',
 ].join('\n');
 
-// The CLI release, as `bongos version` reports it: config/bongos-cli.json where
-// the core checkout carries it (an instance does not — task 1824), else the
-// package version. Read from disk, never required, so a vanilla core still runs.
+const SENT_LINE = 'Sent to the Bongos team.';
+const REPEAT_WINDOW_MS = 6 * 60 * 60 * 1000;
+
+// Plain lines for the refusals the builder can see (everything else happens in
+// the background and is written to the outcome file, never to the terminal).
+const REFUSALS = {
+  message_required: 'Nothing to send — add your feedback after the command, in quotes.',
+  too_long: 'That is too long to send — keep it under 4,000 characters, or split it into two.',
+  local_only: 'This project runs only on your computer, so Cloud Bongos cannot confirm who sent the report. Nothing was sent.',
+  no_scrubber: 'Feedback was not sent: the secret filter that checks every report is missing from this install.',
+};
+
+function stateDir() { return path.join(os.homedir(), '.config', ic.FALLBACK_DIR || 'cloudbongos'); }
+
+// The CLI release, as `bongos version` reports it. Read from disk, never required.
 function cliVersion() {
-  const fs = require('node:fs');
-  const path = require('node:path');
   for (const rel of ['../../config/bongos-cli.json', '../../package.json']) {
     try {
       const f = path.join(__dirname, rel);
@@ -44,17 +62,19 @@ function cliVersion() {
   return null;
 }
 
-// The message: --message / --message-file, else every positional word joined.
-function readMessage(args) {
-  if (args.includes('--message') || args.includes('--message-file')) return argText('--message', args);
-  return args.filter((a) => !a.startsWith('--')).join(' ');
+// The message: --message / --message-file (incl. - for stdin), else every
+// positional word joined, else whatever was piped in.
+function readMessage(args, io = {}) {
+  if (args.includes('--message') || args.includes('--message-file')) return argText('--message', args, io).value || '';
+  const words = args.filter((a) => !a.startsWith('--')).join(' ');
+  if (words) return words;
+  const stdinIsPiped = io.stdinIsPiped !== undefined ? io.stdinIsPiped : !process.stdin.isTTY;
+  if (!stdinIsPiped) return '';
+  try { return (io.readStdin || (() => fs.readFileSync(0, 'utf8')))(); } catch { return ''; }
 }
 
 // Every report goes through the transcript-grade secret scrubber before it leaves
-// this machine (task 1004467). An assistant may file unasked when a builder vents,
-// so nobody reviews the text first — the scrubber is the check that does not
-// depend on the assistant's judgment. FAIL CLOSED: no scrubber, nothing is sent.
-// It also strips the builder's environment secrets by value, whatever their shape.
+// this machine (task 1004467). FAIL CLOSED: no scrubber, nothing is sent.
 function scrubReport(message, env = process.env) {
   let scrub;
   try { scrub = require('../../modules/security/secret-scrub.js'); } catch { return null; }
@@ -63,69 +83,122 @@ function scrubReport(message, env = process.env) {
   return { text, removed };
 }
 
-// Plain-language lines for each refusal the route can give.
-const REFUSALS = {
-  message_required: 'Nothing to send — add your feedback after the command, in quotes.',
-  validation_failed: 'That could not be sent as written — keep it under 4,000 characters, or split it into two.',
-  not_hub_connected: 'This project is not connected to Cloud Bongos, so feedback cannot be relayed from here.\n'
-    + 'Report it to the Bongos maintainers on the Bongos core repository instead.',
-  membership_required: 'Cloud Bongos does not yet know you as a member of this project.\n'
-    + 'Sign in to this project once through Cloud Bongos in a browser, then try again.',
-  rate_limited: 'Too much feedback from you or this project in the last hour. Try again later.',
-  feedback_unavailable: 'Cloud Bongos is not taking bug reports right now (no version is being built). Try again later.',
-  hub_unreachable: 'Could not reach Cloud Bongos. Check your connection and try again.',
-};
+// A project the hub cannot reach can never vouch for a report — say so up front
+// rather than send something that is certain to be dropped.
+function isLocalBase(base) {
+  let host;
+  try { host = new URL(base).hostname.toLowerCase(); } catch { return true; }
+  if (require('node:net').isIP(host.replace(/^\[|\]$/g, ''))) return true;
+  return !host.includes('.') || /(^|\.)(localhost|local|internal|test|invalid)$/.test(host);
+}
+
+// Repeat guard: the same report (same first line) inside REPEAT_WINDOW_MS is not
+// sent twice, so an assistant filing on every rant cannot spam the maintainers.
+function repeatKey(message) {
+  const first = String(message).split('\n').map((l) => l.trim().toLowerCase()).find(Boolean) || '';
+  return crypto.createHash('sha256').update(first).digest('hex').slice(0, 16);
+}
+function checkAndRecordRepeat(message, { file = path.join(stateDir(), 'feedback-sent.json'), now = Date.now() } = {}) {
+  let seen = {};
+  try { seen = JSON.parse(fs.readFileSync(file, 'utf8')) || {}; } catch { /* first report */ }
+  for (const [k, t] of Object.entries(seen)) if (!(now - t < REPEAT_WINDOW_MS)) delete seen[k];
+  const key = repeatKey(message);
+  if (Object.prototype.hasOwnProperty.call(seen, key)) return true;
+  seen[key] = now;
+  try {
+    fs.mkdirSync(path.dirname(file), { recursive: true });
+    fs.writeFileSync(file, JSON.stringify(seen), { mode: 0o600 });
+  } catch { /* a guard that cannot write still lets the report through */ }
+  return false;
+}
+
+// deliver — the network half: receipt from the project, then the report to the
+// hub. Returns an outcome object; never prints. Runs in the background child.
+async function deliver({ message, kind }, deps = {}) {
+  const api = deps.api || await cliClient();
+  const base = deps.base || ic.resolveApiBase({ session: loadSessionSync() });
+  const doFetch = deps.fetchImpl || fetch;
+  const sha256 = crypto.createHash('sha256').update(message, 'utf8').digest('hex');
+  const r = await api.request('POST', '/feedback/receipt', { body: { sha256, kind } });
+  if (!r.ok) return { ok: false, step: 'receipt', code: errCode(r.data) || `http_${r.status}` };
+  const origin = new URL(base).origin;
+  const hub = String((r.data && r.data.hub) || origin).replace(/\/+$/, '');
+  const res = await doFetch(`${hub}/api/bongos/sso/feedback/direct`, {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/json', Accept: 'application/json' },
+    body: JSON.stringify({
+      origin, receipt: r.data.receipt, message, kind,
+      context: { cli_version: cliVersion(), os: `${os.platform()} ${os.release()}` },
+    }),
+    signal: AbortSignal.timeout(15000),
+  });
+  if (res.status === 202) return { ok: true, hub };
+  let body = null;
+  try { body = await res.json(); } catch { /* non-JSON */ }
+  return { ok: false, step: 'hub', code: errCode(body) || `http_${res.status}` };
+}
+
+// The background child: read the queued report, deliver it, record the outcome
+// where a curious builder (or a maintainer helping them) can look.
+async function runDeliverChild(file) {
+  let job;
+  try { job = JSON.parse(fs.readFileSync(file, 'utf8')); } finally { fs.rmSync(path.dirname(file), { recursive: true, force: true }); }
+  let outcome;
+  try { outcome = await deliver(job); } catch (e) { outcome = { ok: false, step: 'network', code: String(e && e.message || e).slice(0, 200) }; }
+  try {
+    fs.writeFileSync(path.join(stateDir(), 'feedback-last.json'), JSON.stringify({ at: new Date().toISOString(), ...outcome }), { mode: 0o600 });
+  } catch { /* nowhere to record — the report itself is what mattered */ }
+  return outcome.ok ? 0 : 1;
+}
+
+// Hand the job to a detached child and return. The job travels in a 0600 temp
+// file, never argv (visible in ps) or env.
+function spawnDelivery(job, { spawnImpl = spawn } = {}) {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'bongos-feedback-'));
+  const file = path.join(dir, 'job.json');
+  fs.writeFileSync(file, JSON.stringify(job), { mode: 0o600 });
+  const child = spawnImpl(process.execPath, [__filename, '--deliver', file], { detached: true, stdio: 'ignore' });
+  if (child && child.unref) child.unref();
+  return file;
+}
 
-async function main(argv = process.argv.slice(2)) {
+async function main(argv = process.argv.slice(2), deps = {}) {
   if (hasFlag('--help', argv) || hasFlag('-h', argv)) { console.log(USAGE); return 0; }
-  const json = hasFlag('--json', argv);
   const kind = hasFlag('--idea', argv) ? 'idea' : 'bug';
-  const message = String(readMessage(argv) || '').trim();
-  if (!message) { console.error(USAGE); return 2; }
+  const message = String(readMessage(argv, deps.io) || '').trim();
+  if (!message) { console.error(REFUSALS.message_required); return 2; }
+  if (message.length > 4000) { console.error(REFUSALS.too_long); return 2; }
 
   const scrubbed = scrubReport(message);
-  if (!scrubbed) {
-    console.error('Feedback was not sent: the secret filter that checks every report is missing from this install.');
-    return 1;
-  }
+  if (!scrubbed) { console.error(REFUSALS.no_scrubber); return 1; }
 
-  await requireSession();
-  const api = await cliClient();
-  const res = await api.request('POST', '/feedback', {
-    body: { message: scrubbed.text, kind, context: { cli_version: cliVersion(), os: `${os.platform()} ${os.release()}` } },
-  });
-  if (scrubbed.removed > 0 && !json) {
-    console.log(`Removed ${scrubbed.removed} secret-looking value(s) from the report before sending.`);
-  }
+  const session = await (deps.requireSession || requireSession)();
+  const base = deps.base || ic.resolveApiBase({ session });
+  if (isLocalBase(base)) { console.error(REFUSALS.local_only); return 1; }
 
-  if (json) { console.log(JSON.stringify(res.data, null, 2)); return res.ok ? 0 : 1; }
-  if (!res.ok) {
-    const code = errCode(res.data);
-    const details = errDetails(res.data) || {};
-    let line = REFUSALS[code] || `Feedback was not sent (${code || `HTTP ${res.status}`}).`;
-    if (code === 'rate_limited' && details.retry_after_seconds) {
-      line += ` (in about ${Math.ceil(details.retry_after_seconds / 60)} min)`;
-    }
-    console.error(line);
-    return 1;
+  const job = { message: scrubbed.text, kind };
+  if ((deps.checkRepeat || checkAndRecordRepeat)(job.message)) {
+    console.log('Already sent — the Bongos team has this one.');
+    return 0;
   }
-  const d = res.data || {};
-  if (d.landed === 'task') {
-    console.log(`Thanks — sent to the Cloud Bongos maintainers as task ${d.task_id}.`);
-    console.log('It waits for a maintainer to approve it before anyone works on it.');
-    if (d.hub_origin) console.log(`${String(d.hub_origin).replace(/\/+$/, '')}/builders#/task/${d.task_id}`);
-  } else {
-    console.log(`Thanks — your idea is in the Cloud Bongos idea inbox (idea ${d.idea_id}) for the maintainers to review.`);
+  if (hasFlag('--wait', argv)) {
+    const outcome = await (deps.deliver || deliver)(job);
+    console.log(outcome.ok ? SENT_LINE : `Not sent (${outcome.step}: ${outcome.code}).`);
+    return outcome.ok ? 0 : 1;
   }
+  (deps.spawnDelivery || spawnDelivery)(job);
+  console.log(SENT_LINE);
   return 0;
 }
 
 if (require.main === module) {
+  const argv = process.argv.slice(2);
+  const run = argv[0] === '--deliver' ? runDeliverChild(argv[1]) : main(argv);
   // cliExit, never process.exit, after a request (task 1002734 — the Windows abort).
-  main().then((code) => cliExit(code), (err) => {
+  run.then((code) => cliExit(code), (err) => {
     console.error(`Feedback was not sent: ${err && err.message ? err.message : err}`);
     cliExit(1);
   });
 }
 
-module.exports = { main, readMessage, REFUSALS, scrubReport };
+module.exports = { main, deliver, readMessage, REFUSALS, scrubReport, isLocalBase, repeatKey, checkAndRecordRepeat, SENT_LINE };

package/src/bongos/platform-visibility-gate.js

@@ -110,6 +110,9 @@ const EXEMPT = [
   /^\/downloads\//,
   { re: new RegExp(`^${API}/access-requests$`), methods: ['POST'] },
   { re: new RegExp(`^${API}/access-requests/status$`), methods: ['GET'] },
+  // The hub redeeming a `bongos feedback` receipt (task 1004591): it has no
+  // session here, and a members-only project must still vouch for its builders.
+  { re: new RegExp(`^${API}/feedback/receipt/[a-z0-9_-]+$`), methods: ['GET'] },
 ];
 
 // The policy, read through the memoized pack. A pack that cannot be read at all