feat: feedback posts to feedback.instacloud.com

[Fermionic-Lyu]

Default FEEDBACK_ENDPOINT moves from the app-named compute host to the custom domain feedback.instacloud.com (DNS: insta-cloud#77, cert issued, ingest verified live — bad-enum probe returns the self-teaching 400). Old URL keeps working for released clients; INSTA_FEEDBACK_URL still overrides.

Companion: insta-mcp same change. Release 0.0.35 follows once merged.

🤖 Generated with Claude Code

---

Summary by cubic

Switches the default feedback POST endpoint from https://insta-main-api-cdad9b6c.compute.instacloud.com/v1/feedback to https://feedback.instacloud.com/v1/feedback to provide a stable domain. Existing clients keep working and INSTA_FEEDBACK_URL still overrides.

Review and rollout

• Only the default hostname changed; token, limits, and timeout remain the same.
• Roll back by setting INSTA_FEEDBACK_URL to https://insta-main-api-cdad9b6c.compute.instacloud.com/v1/feedback.
• DNS and TLS for feedback.instacloud.com are live; ingest path verified healthy.

^{Written for commit f63b5b6. Summary will update on new commits.}

[jwfing]

Review: feat: feedback posts to feedback.instacloud.com

Summary: A one-line change swapping the default FEEDBACK_ENDPOINT from the app-named Fly compute host to the stable custom domain feedback.instacloud.com, leaving the INSTA_FEEDBACK_URL override and the public ingest token untouched.

Requirements context: No /docs/superpowers/ or docs/specs/ spec exists in this repo, and nothing under docs/ matches this PR — assessing against the PR description alone (and the companion insta-mcp change it references).

Findings

Critical — (none)

Suggestion — (none)

Information

• Functionality (verified live). Confirmed the new default endpoint independently, not just from the PR body: feedback.instacloud.com resolves (CNAME → insta-main-api-cdad9b6c.fly.dev, i.e. the same Fly app the old ...compute.instacloud.com host fronted), the TLS chain validates (ssl_verify_result=0), and a bad-enum probe POST to /v1/feedback returns the self-teaching 400 described in the PR body. Because DNS points at the same backing app, the "old URL keeps working for released clients" claim holds — this is a pure hostname change, not a backend move. src/commands/feedback.ts:40-42
• Software engineering. No test change is needed and none is expected: test/feedback.test.ts injects a fetchImpl and asserts on payload/behavior, never on the URL constant (test/feedback.test.ts:15-21, 109+), so the endpoint is not pinned by any assertion and the suite stays green. Consistent with the file's existing "hardcoded, env-overridable" convention (src/commands/feedback.ts:35-43).
• Security. No new attack surface. The ingest token remains the public-by-design insta-feedback-public-v1 (documented at src/commands/feedback.ts:35-39; real abuse control is server-side per-IP rate-limit + weekly dedup), no secrets are added or logged, and the request stays HTTPS with a validated certificate. If anything this is a marginal improvement — a purpose-named domain decouples the client default from an opaque Fly app slug, easing future emergency rotation.
• Performance. No performance-relevant change (same single 10s-timeout, zero-retry POST).

Verdict

approved (informational — a human still applies the GitHub approval). Single-line, well-scoped, and independently verified against the live endpoint; no blocking concerns. Reminder from the PR body: cut release 0.0.35 and land the companion insta-mcp change so both clients point at the new default together.

[jwfing]

LGTM - approved.