feat: wire contribute_feedback remote submission to Supabase

Replace placeholder remote endpoint with real PostgREST INSERT using
the public anon key. Feedback is POSTed directly to community_feedback
table with RLS restricting anon to INSERT-only.

New file: src/services/feedback-remote.ts — lightweight POST with
hardcoded anon key (public by Supabase design, safe to ship in npm).

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: 2 people

src/services/feedback-remote.ts

@@ -0,0 +1,43 @@
+/**
+ * Remote feedback submission via Supabase anon key.
+ *
+ * This uses the PUBLIC anon key (designed to be shipped in client apps).
+ * RLS restricts anon to INSERT-only on community_feedback.
+ * Separate from supabase-client.ts because it uses the anon key, not service role.
+ */
+
+const FEEDBACK_URL = "https://cjptxyezuxdiinufgrrm.supabase.co/rest/v1/community_feedback";
+const FEEDBACK_ANON_KEY = "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJzdXBhYmFzZSIsInJlZiI6ImNqcHR4eWV6dXhkaWludWZncnJtIiwicm9sZSI6ImFub24iLCJpYXQiOjE3NjYxODY3MDMsImV4cCI6MjA4MTc2MjcwM30.L0oZy3LYCMikmZ15IUU5DnfJmucM37DJ14nUkM3AreY";
+
+export interface FeedbackPayload {
+  feedback_id: string;
+  type: string;
+  tool: string;
+  description: string;
+  severity: string;
+  suggested_fix?: string;
+  context?: string;
+  gitmem_version: string;
+  agent_identity?: string;
+  install_id?: string | null;
+  client_timestamp: string;
+}
+
+export async function submitFeedbackRemote(payload: FeedbackPayload): Promise<void> {
+  const response = await fetch(FEEDBACK_URL, {
+    method: "POST",
+    headers: {
+      "apikey": FEEDBACK_ANON_KEY,
+      "Authorization": `Bearer ${FEEDBACK_ANON_KEY}`,
+      "Content-Type": "application/json",
+      "Content-Profile": "public",
+      "Prefer": "return=minimal",
+    },
+    body: JSON.stringify(payload),
+  });
+
+  if (!response.ok) {
+    const text = await response.text();
+    throw new Error(`Feedback submit failed: ${response.status} - ${text.slice(0, 200)}`);
+  }
+}

src/tools/contribute-feedback.ts

@@ -21,6 +21,7 @@ import { isFeedbackEnabled, getInstallId } from "../services/gitmem-dir.js";
 import { getAgentIdentity } from "../services/agent-detection.js";
 import { sanitizeFeedbackText } from "../services/feedback-sanitizer.js";
 import { getEffectTracker } from "../services/effect-tracker.js";
+import { submitFeedbackRemote } from "../services/feedback-remote.js";
 import { wrapDisplay } from "../services/display-protocol.js";
 import { Timer } from "../services/metrics.js";
 import type { ContributeFeedbackParams } from "../schemas/contribute-feedback.js";
@@ -118,17 +119,19 @@ export async function contributeFeedback(params: ContributeFeedbackParams): Prom
       "feedback",
       "remote-submit",
       async () => {
-        // Remote endpoint — POST to Supabase Edge Function or similar
-        // For now, this is a placeholder that logs the intent.
-        // The actual endpoint will be configured when the backend is ready.
-        console.error(`[contribute-feedback] Remote feedback queued: ${id} (${params.type})`);
-        // When endpoint is available:
-        // const response = await fetch(FEEDBACK_ENDPOINT, {
-        //   method: "POST",
-        //   headers: { "Content-Type": "application/json" },
-        //   body: JSON.stringify(remotePayload),
-        // });
-        // if (!response.ok) throw new Error(`HTTP ${response.status}`);
+        await submitFeedbackRemote({
+          feedback_id: id,
+          type: params.type,
+          tool: params.tool,
+          description: sanitizedDescription,
+          severity: params.severity,
+          suggested_fix: sanitizedFix,
+          context: sanitizedContext,
+          gitmem_version: pkg.version,
+          agent_identity: getAgentIdentity(),
+          install_id: installId,
+          client_timestamp: now.toISOString(),
+        });
         return remotePayload;
       },
     );