@indigoai-us/hq-cli 5.47.15 → 5.47.17

package/dist/utils/feedback-screenshots.js

@@ -0,0 +1,98 @@
+
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="13f46978-c3c8-532d-b0bb-e8febf876587")}catch(e){}}();
+import * as fs from "node:fs";
+import * as path from "node:path";
+import { vaultApiFetch } from "./vault-api.js";
+export const MAX_SCREENSHOTS = 5;
+// Per-image ceiling. Screenshots are PNG/JPEG captures; 10 MB is generous.
+export const MAX_SCREENSHOT_BYTES = 10 * 1024 * 1024;
+// Extension → content type. Must stay in sync with the server's allowed set
+// (hq-pro feedback-screenshots.ts ALLOWED_CONTENT_TYPES).
+const EXT_CONTENT_TYPE = {
+    ".png": "image/png",
+    ".jpg": "image/jpeg",
+    ".jpeg": "image/jpeg",
+    ".webp": "image/webp",
+    ".gif": "image/gif",
+};
+export function contentTypeForPath(filePath) {
+    const ext = path.extname(filePath).toLowerCase();
+    const contentType = EXT_CONTENT_TYPE[ext];
+    if (!contentType) {
+        throw new Error(`unsupported screenshot type: ${filePath} (allowed: ${Object.keys(EXT_CONTENT_TYPE).join(", ")})`);
+    }
+    return contentType;
+}
+/** Validate + read the given screenshot paths (count, type, existence, size). */
+export function loadScreenshots(paths) {
+    if (paths.length > MAX_SCREENSHOTS) {
+        throw new Error(`at most ${MAX_SCREENSHOTS} screenshots are allowed (got ${paths.length})`);
+    }
+    return paths.map((filePath) => {
+        const contentType = contentTypeForPath(filePath);
+        let bytes;
+        try {
+            bytes = fs.readFileSync(filePath);
+        }
+        catch {
+            throw new Error(`cannot read screenshot: ${filePath}`);
+        }
+        if (bytes.byteLength === 0) {
+            throw new Error(`screenshot is empty: ${filePath}`);
+        }
+        if (bytes.byteLength > MAX_SCREENSHOT_BYTES) {
+            throw new Error(`screenshot too large: ${filePath} (${bytes.byteLength} bytes, max ${MAX_SCREENSHOT_BYTES})`);
+        }
+        return { path: filePath, contentType, bytes };
+    });
+}
+/**
+ * Validate the screenshot paths, request presigned PUT URLs from the feedback
+ * endpoint, upload each image direct to S3, and return the object keys to
+ * attach to the feedback submission. Returns [] for no screenshots.
+ *
+ * `fetchImpl` is injectable for tests; defaults to the global fetch.
+ */
+export async function uploadScreenshots(opts) {
+    if (opts.paths.length === 0)
+        return [];
+    const inputs = loadScreenshots(opts.paths);
+    const res = await vaultApiFetch({
+        token: opts.token,
+        path: "/v1/feedback/screenshots/presign",
+        method: "POST",
+        body: { contentTypes: inputs.map((i) => i.contentType) },
+    });
+    if (!res.ok) {
+        const data = await res.json().catch(() => ({}));
+        const msg = data &&
+            typeof data === "object" &&
+            typeof data.error === "string"
+            ? data.error
+            : res.statusText;
+        throw new Error(`Failed to presign screenshots: ${msg}`);
+    }
+    const parsed = (await res.json());
+    if (!parsed ||
+        !Array.isArray(parsed.screenshots) ||
+        parsed.screenshots.length !== inputs.length) {
+        throw new Error("Presign response did not match the requested screenshots");
+    }
+    const doFetch = opts.fetchImpl ?? fetch;
+    const keys = [];
+    for (let i = 0; i < inputs.length; i++) {
+        const slot = parsed.screenshots[i];
+        const put = await doFetch(slot.url, {
+            method: "PUT",
+            headers: { "Content-Type": slot.contentType },
+            body: inputs[i].bytes,
+        });
+        if (!put.ok) {
+            throw new Error(`Failed to upload screenshot ${inputs[i].path}: HTTP ${put.status}`);
+        }
+        keys.push(slot.key);
+    }
+    return keys;
+}
+//# sourceMappingURL=feedback-screenshots.js.map
+//# debugId=13f46978-c3c8-532d-b0bb-e8febf876587

package/dist/utils/feedback-versions.d.ts

@@ -0,0 +1,34 @@
+/**
+ * The three HQ component versions captured from the submitter's environment
+ * and attached to a feedback submission so triage can see exactly which
+ * versions a report came from.
+ *
+ *   - `cli`  — this hq-cli build (always known).
+ *   - `core` — the HQ scaffold version from `core/core.yaml` (`hqVersion`);
+ *               null when the command runs outside an HQ tree.
+ *   - `sync` — the installed hq-sync menubar app version, which the app
+ *               records at `~/.hq/sync-version.json` on startup; null when
+ *               hq-sync is not installed (e.g. CLI-only / CI environments).
+ */
+export interface VersionInfo {
+    cli: string;
+    core: string | null;
+    sync: string | null;
+}
+/**
+ * Best-effort read of the hq-core scaffold version (`core/core.yaml`
+ * `hqVersion`). Resolves the HQ root from the working directory; returns
+ * null when no HQ root / core.yaml is found rather than throwing — version
+ * capture must never break a feedback submission.
+ */
+export declare function readCoreVersion(): string | null;
+/**
+ * Best-effort read of the hq-sync menubar app version. The app writes
+ * `{ version, updatedAt }` to `~/.hq/sync-version.json` on startup; the CLI
+ * reads it here. Returns null when the file is absent or malformed (hq-sync
+ * not installed, or an older build that predates the marker).
+ */
+export declare function readSyncVersion(homeDir?: string): string | null;
+/** Collect all three component versions, each independently best-effort. */
+export declare function collectVersions(): VersionInfo;
+//# sourceMappingURL=feedback-versions.d.ts.map

package/dist/utils/feedback-versions.js

@@ -0,0 +1,50 @@
+
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="ea3328d1-5c42-5d60-ad24-f96c11a37f22")}catch(e){}}();
+import * as fs from "node:fs";
+import * as os from "node:os";
+import * as path from "node:path";
+import { CLI_VERSION } from "../cli-version.js";
+import { findHqRoot } from "./manifest.js";
+import { readHqVersion } from "./pack-contributions.js";
+/**
+ * Best-effort read of the hq-core scaffold version (`core/core.yaml`
+ * `hqVersion`). Resolves the HQ root from the working directory; returns
+ * null when no HQ root / core.yaml is found rather than throwing — version
+ * capture must never break a feedback submission.
+ */
+export function readCoreVersion() {
+    try {
+        return readHqVersion(findHqRoot());
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Best-effort read of the hq-sync menubar app version. The app writes
+ * `{ version, updatedAt }` to `~/.hq/sync-version.json` on startup; the CLI
+ * reads it here. Returns null when the file is absent or malformed (hq-sync
+ * not installed, or an older build that predates the marker).
+ */
+export function readSyncVersion(homeDir = os.homedir()) {
+    try {
+        const raw = fs.readFileSync(path.join(homeDir, ".hq", "sync-version.json"), "utf-8");
+        const parsed = JSON.parse(raw);
+        return typeof parsed.version === "string" && parsed.version.length > 0
+            ? parsed.version
+            : null;
+    }
+    catch {
+        return null;
+    }
+}
+/** Collect all three component versions, each independently best-effort. */
+export function collectVersions() {
+    return {
+        cli: CLI_VERSION,
+        core: readCoreVersion(),
+        sync: readSyncVersion(),
+    };
+}
+//# sourceMappingURL=feedback-versions.js.map
+//# debugId=ea3328d1-5c42-5d60-ad24-f96c11a37f22

package/dist/utils/people.d.ts

@@ -0,0 +1,99 @@
+/**
+ * Company people (membership) directory reader + search.
+ *
+ * The local source of truth for "who belongs to a company" is the per-company
+ * people store on disk:
+ *
+ *     companies/<company-slug>/people/<person-slug>/meta.yaml
+ *
+ * Each `meta.yaml` carries at least `name` and `type` ("internal" | "external")
+ * plus optional `email`, `role`, `organization`, `tags`, etc. (see
+ * `companies/_template/people/_example/meta.yaml` for the canonical schema).
+ *
+ * Everything here is scoped to ONE company directory. Callers resolve a single
+ * company slug up front; nothing in this module ever enumerates or reads across
+ * company boundaries — HQ tenancy rules forbid cross-company member lookups.
+ */
+/** A single person/member record parsed from a `people/<slug>/meta.yaml`. */
+export interface PersonRecord {
+    /** Folder slug under `companies/<company>/people/<slug>/`. */
+    slug: string;
+    /** Display name (required field in `meta.yaml`). */
+    name: string;
+    /** Contact email, when recorded. */
+    email?: string;
+    /** "internal" (team member) | "external" (client, vendor, …). */
+    type?: string;
+    /** Role/title inside (or relative to) the company. */
+    role?: string;
+    /** External-only: the person's own organization. */
+    organization?: string;
+    /** Freeform tags for filtering. */
+    tags?: string[];
+    /** Absolute path to the `meta.yaml` this record was parsed from. */
+    source: string;
+}
+export declare function assertSafeCompanySlug(slug: string): void;
+/** Absolute path to a company's `people/` directory. */
+export declare function companyPeopleDir(hqRoot: string, companySlug: string): string;
+/**
+ * Parse a single `meta.yaml` body into a `PersonRecord`. Returns `null` when the
+ * file is empty, unparseable, or has no usable `name` — a person record without
+ * a name can't be listed, searched, or resolved, so it's skipped rather than
+ * surfaced as a half-row. Exported for unit testing.
+ */
+export declare function parsePersonMeta(raw: string, slug: string, source: string): PersonRecord | null;
+/**
+ * List every person recorded for ONE company. Reads
+ * `companies/<companySlug>/people/<personSlug>/meta.yaml` for each person
+ * folder.
+ *
+ * - Folders whose name starts with `_` are skipped (e.g. the `_example`
+ *   template that ships in `companies/_template/people/`).
+ * - Folders without a `meta.yaml`, or whose `meta.yaml` has no `name`, are
+ *   skipped silently — they aren't members yet.
+ * - Returns `[]` when the company has no `people/` directory at all.
+ *
+ * Results are sorted by name (case-insensitive) for stable output.
+ */
+export declare function listCompanyPeople(hqRoot: string, companySlug: string): PersonRecord[];
+/**
+ * Case-insensitive keyword search over a person's NAME and EMAIL (plus the
+ * folder slug, which is a normalized alias of the name). Pure — operates on an
+ * already-loaded list so it's trivially testable and reusable.
+ *
+ * An empty/whitespace keyword matches nothing (callers should treat that as a
+ * usage error rather than "return everyone").
+ */
+export declare function searchPeople(people: PersonRecord[], keyword: string): PersonRecord[];
+/** Outcome of resolving a name to an email address. */
+export type ResolveResult = {
+    status: "found";
+    email: string;
+    person: PersonRecord;
+} | {
+    status: "no_email";
+    person: PersonRecord;
+} | {
+    status: "ambiguous";
+    matches: PersonRecord[];
+} | {
+    status: "not_found";
+};
+/**
+ * Resolve a person NAME to their email, built on top of {@link searchPeople}.
+ *
+ * Match precedence (narrowest first) so a precise query isn't drowned out by
+ * looser substring hits:
+ *   1. exact name match (case-insensitive, trimmed)
+ *   2. exact folder-slug match
+ *   3. substring search over name/email/slug
+ *
+ * The first tier that yields any match decides the result:
+ *   - exactly one match with an email  → `found`
+ *   - exactly one match, no email      → `no_email`
+ *   - more than one match              → `ambiguous` (caller disambiguates)
+ *   - no match in any tier             → `not_found`
+ */
+export declare function resolveNameToEmail(people: PersonRecord[], name: string): ResolveResult;
+//# sourceMappingURL=people.d.ts.map

package/dist/utils/people.js

@@ -0,0 +1,168 @@
+/**
+ * Company people (membership) directory reader + search.
+ *
+ * The local source of truth for "who belongs to a company" is the per-company
+ * people store on disk:
+ *
+ *     companies/<company-slug>/people/<person-slug>/meta.yaml
+ *
+ * Each `meta.yaml` carries at least `name` and `type` ("internal" | "external")
+ * plus optional `email`, `role`, `organization`, `tags`, etc. (see
+ * `companies/_template/people/_example/meta.yaml` for the canonical schema).
+ *
+ * Everything here is scoped to ONE company directory. Callers resolve a single
+ * company slug up front; nothing in this module ever enumerates or reads across
+ * company boundaries — HQ tenancy rules forbid cross-company member lookups.
+ */
+
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="aac5adc3-c336-5d9a-8a1a-edaf16ef4c11")}catch(e){}}();
+import * as fs from "fs";
+import * as path from "path";
+import * as yaml from "js-yaml";
+/**
+ * Company slugs map directly onto a filesystem path segment, so we validate
+ * them before joining to keep a malicious or fat-fingered `--company` value
+ * from escaping the `companies/` tree. Mirrors the slug rules used by
+ * cloud-provision.
+ */
+const COMPANY_SLUG_REGEX = /^[A-Za-z0-9._-]+$/;
+const FORBIDDEN_COMPANY_SLUGS = new Set(["personal", ".", ".."]);
+export function assertSafeCompanySlug(slug) {
+    if (!slug || !COMPANY_SLUG_REGEX.test(slug)) {
+        throw new Error(`Invalid company slug "${slug}" — must match ${COMPANY_SLUG_REGEX.source}`);
+    }
+    if (FORBIDDEN_COMPANY_SLUGS.has(slug)) {
+        throw new Error(`Company slug "${slug}" is reserved and cannot be used here`);
+    }
+}
+/** Absolute path to a company's `people/` directory. */
+export function companyPeopleDir(hqRoot, companySlug) {
+    assertSafeCompanySlug(companySlug);
+    return path.join(hqRoot, "companies", companySlug, "people");
+}
+/**
+ * Parse a single `meta.yaml` body into a `PersonRecord`. Returns `null` when the
+ * file is empty, unparseable, or has no usable `name` — a person record without
+ * a name can't be listed, searched, or resolved, so it's skipped rather than
+ * surfaced as a half-row. Exported for unit testing.
+ */
+export function parsePersonMeta(raw, slug, source) {
+    let doc;
+    try {
+        doc = yaml.load(raw);
+    }
+    catch (err) {
+        throw new Error(`Failed to parse ${source}: ${err instanceof Error ? err.message : String(err)}`);
+    }
+    if (!doc || typeof doc !== "object")
+        return null;
+    const d = doc;
+    const name = typeof d.name === "string" ? d.name.trim() : "";
+    if (!name)
+        return null;
+    const str = (v) => typeof v === "string" && v.trim() ? v.trim() : undefined;
+    const tags = Array.isArray(d.tags)
+        ? d.tags.filter((t) => typeof t === "string")
+        : undefined;
+    return {
+        slug,
+        name,
+        email: str(d.email),
+        type: str(d.type),
+        role: str(d.role),
+        organization: str(d.organization),
+        ...(tags && tags.length > 0 ? { tags } : {}),
+        source,
+    };
+}
+/**
+ * List every person recorded for ONE company. Reads
+ * `companies/<companySlug>/people/<personSlug>/meta.yaml` for each person
+ * folder.
+ *
+ * - Folders whose name starts with `_` are skipped (e.g. the `_example`
+ *   template that ships in `companies/_template/people/`).
+ * - Folders without a `meta.yaml`, or whose `meta.yaml` has no `name`, are
+ *   skipped silently — they aren't members yet.
+ * - Returns `[]` when the company has no `people/` directory at all.
+ *
+ * Results are sorted by name (case-insensitive) for stable output.
+ */
+export function listCompanyPeople(hqRoot, companySlug) {
+    const dir = companyPeopleDir(hqRoot, companySlug);
+    if (!fs.existsSync(dir))
+        return [];
+    const entries = fs.readdirSync(dir, { withFileTypes: true });
+    const people = [];
+    for (const entry of entries) {
+        if (!entry.isDirectory())
+            continue;
+        if (entry.name.startsWith("_"))
+            continue; // _example and other scaffolding
+        const metaPath = path.join(dir, entry.name, "meta.yaml");
+        if (!fs.existsSync(metaPath))
+            continue;
+        const raw = fs.readFileSync(metaPath, "utf-8");
+        const record = parsePersonMeta(raw, entry.name, metaPath);
+        if (record)
+            people.push(record);
+    }
+    people.sort((a, b) => a.name.localeCompare(b.name, undefined, { sensitivity: "base" }));
+    return people;
+}
+/**
+ * Case-insensitive keyword search over a person's NAME and EMAIL (plus the
+ * folder slug, which is a normalized alias of the name). Pure — operates on an
+ * already-loaded list so it's trivially testable and reusable.
+ *
+ * An empty/whitespace keyword matches nothing (callers should treat that as a
+ * usage error rather than "return everyone").
+ */
+export function searchPeople(people, keyword) {
+    const needle = keyword.trim().toLowerCase();
+    if (!needle)
+        return [];
+    return people.filter((p) => {
+        const haystacks = [p.name, p.email, p.slug].filter((v) => typeof v === "string");
+        return haystacks.some((h) => h.toLowerCase().includes(needle));
+    });
+}
+/**
+ * Resolve a person NAME to their email, built on top of {@link searchPeople}.
+ *
+ * Match precedence (narrowest first) so a precise query isn't drowned out by
+ * looser substring hits:
+ *   1. exact name match (case-insensitive, trimmed)
+ *   2. exact folder-slug match
+ *   3. substring search over name/email/slug
+ *
+ * The first tier that yields any match decides the result:
+ *   - exactly one match with an email  → `found`
+ *   - exactly one match, no email      → `no_email`
+ *   - more than one match              → `ambiguous` (caller disambiguates)
+ *   - no match in any tier             → `not_found`
+ */
+export function resolveNameToEmail(people, name) {
+    const query = name.trim();
+    if (!query)
+        return { status: "not_found" };
+    const lowered = query.toLowerCase();
+    const exactName = people.filter((p) => p.name.toLowerCase() === lowered);
+    const exactSlug = people.filter((p) => p.slug.toLowerCase() === lowered);
+    const substring = searchPeople(people, query);
+    const matches = exactName.length > 0
+        ? exactName
+        : exactSlug.length > 0
+            ? exactSlug
+            : substring;
+    if (matches.length === 0)
+        return { status: "not_found" };
+    if (matches.length > 1)
+        return { status: "ambiguous", matches };
+    const person = matches[0];
+    if (!person.email)
+        return { status: "no_email", person };
+    return { status: "found", email: person.email, person };
+}
+//# sourceMappingURL=people.js.map
+//# debugId=aac5adc3-c336-5d9a-8a1a-edaf16ef4c11

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.47.15",
+  "version": "5.47.17",
   "description": "HQ by Indigo management CLI — modules and cloud sync",
   "main": "dist/index.js",
   "bin": {

package/src/commands/feedback.test.ts

@@ -156,6 +156,24 @@ describe("submitFeedback", () => {
     expect((call.body as Record<string, unknown>)).not.toHaveProperty("company");
   });
 
+  it("includes screenshot keys when provided, omits the key otherwise", async () => {
+    mockVaultApiFetch.mockResolvedValueOnce(jsonResponse(200, { id: "feedback_s1" }));
+    await submitFeedback({
+      type: "bug",
+      title: "With shots",
+      body: "Details",
+      token: "tok",
+      screenshots: ["feedback-screenshots/prs_a/sub/0.png"],
+    });
+    expect((mockVaultApiFetch.mock.calls[0][0].body as Record<string, unknown>).screenshots).toEqual([
+      "feedback-screenshots/prs_a/sub/0.png",
+    ]);
+
+    mockVaultApiFetch.mockResolvedValueOnce(jsonResponse(200, { id: "feedback_s2" }));
+    await submitFeedback({ type: "bug", title: "No shots", body: "Details", token: "tok", screenshots: [] });
+    expect(mockVaultApiFetch.mock.calls[1][0].body).not.toHaveProperty("screenshots");
+  });
+
   it("attaches diagnostics from collectDiagnostics to the request body", async () => {
     mockVaultApiFetch.mockResolvedValueOnce(
       jsonResponse(200, { id: "feedback_diag" }),
@@ -249,6 +267,32 @@ describe("submitFeedback", () => {
 
     expect(mockVaultApiFetch).not.toHaveBeenCalled();
   });
+
+  // HQ-AB: an empty/whitespace title (e.g. `--title ""`, or a title the /hq-bug
+  // skill derived to nothing) used to slip past Commander's required-flag check
+  // and 400 server-side, flooding Sentry with a context-free warning. The local
+  // guard now rejects it before any network call.
+  it("throws before fetching when title is empty or whitespace-only", async () => {
+    await expect(
+      submitFeedback({
+        type: "bug",
+        title: "   \n\t  ",
+        body: "Real body",
+        token: "tok",
+      }),
+    ).rejects.toThrow(/title must not be empty/);
+
+    await expect(
+      submitFeedback({
+        type: "feature",
+        title: "",
+        body: "Real body",
+        token: "tok",
+      }),
+    ).rejects.toThrow(/title must not be empty/);
+
+    expect(mockVaultApiFetch).not.toHaveBeenCalled();
+  });
 });
 
 // ---------------------------------------------------------------------------

package/src/commands/feedback.ts

@@ -4,6 +4,7 @@ import chalk from "chalk";
 import { ensureCognitoToken } from "../utils/cognito-session.js";
 import { vaultApiFetch } from "../utils/vault-api.js";
 import { collectDiagnostics } from "../utils/feedback-diagnostics.js";
+import { MAX_SCREENSHOTS, uploadScreenshots } from "../utils/feedback-screenshots.js";
 
 export const BODY_MAX_BYTES = 64 * 1024;
 
@@ -17,6 +18,8 @@ export interface FeedbackSubmitOptions {
   body: string;
   company?: string;
   token: string;
+  /** S3 object keys of already-uploaded screenshots (see uploadScreenshots). */
+  screenshots?: string[];
 }
 
 export async function readBodyFile(
@@ -46,6 +49,19 @@ export async function readBodyFile(
 export async function submitFeedback(
   opts: FeedbackSubmitOptions,
 ): Promise<FeedbackResult> {
+  // Validate the title locally, symmetric with the body check below. Commander's
+  // `requiredOption("--title")` only requires the flag to be PRESENT — an empty
+  // or whitespace-only value (`--title ""`, or a title the /hq-bug skill derived
+  // to nothing) passes the flag check, then the server rejects it with a 400
+  // "title (non-empty string) is required" that floods Sentry as a context-free
+  // warning (HQ-AB). Catch it here so the caller gets a clear, actionable error
+  // and the bad request never reaches the server.
+  if (opts.title.trim().length === 0) {
+    throw new Error(
+      "title must not be empty. Provide a short, non-whitespace title via --title.",
+    );
+  }
+
   if (opts.body.trim().length === 0) {
     throw new Error(
       "body must not be empty. Provide at least one non-whitespace character.",
@@ -70,6 +86,9 @@ export async function submitFeedback(
   if (opts.company) {
     requestBody.company = opts.company;
   }
+  if (opts.screenshots && opts.screenshots.length > 0) {
+    requestBody.screenshots = opts.screenshots;
+  }
 
   const res = await vaultApiFetch({
     token: opts.token,
@@ -104,19 +123,33 @@ function registerSubcommand(feedbackCmd: Command, type: "bug" | "feature"): void
       "Path to a markdown file with the body; use - to read from stdin",
     )
     .option("--company <slug>", "Company slug to associate with the report")
-    .action(async (opts: { title: string; bodyFile: string; company?: string }) => {
-      try {
-        const token = await ensureCognitoToken({ interactive: false });
-        const body = await readBodyFile(opts.bodyFile);
-        const result = await submitFeedback({
-          type,
-          title: opts.title,
-          body,
-          company: opts.company,
-          token,
-        });
-        console.log(`Submitted: ${result.id}`);
-      } catch (err) {
+    .option(
+      "--screenshot <path>",
+      `Attach a screenshot (repeatable, up to ${MAX_SCREENSHOTS}; .png/.jpg/.jpeg/.webp/.gif)`,
+      (value: string, prev: string[]) => [...prev, value],
+      [] as string[],
+    )
+    .action(
+      async (opts: { title: string; bodyFile: string; company?: string; screenshot: string[] }) => {
+        try {
+          const token = await ensureCognitoToken({ interactive: false });
+          const body = await readBodyFile(opts.bodyFile);
+          // Validate + upload screenshots (direct-to-S3 via presigned PUT)
+          // before submitting, so the row references uploaded objects.
+          const screenshots = await uploadScreenshots({
+            paths: opts.screenshot ?? [],
+            token,
+          });
+          const result = await submitFeedback({
+            type,
+            title: opts.title,
+            body,
+            company: opts.company,
+            token,
+            screenshots,
+          });
+          console.log(`Submitted: ${result.id}`);
+        } catch (err) {
         console.error(
           chalk.red("Error:"),
           err instanceof Error ? err.message : String(err),