@myapihq/cli 2.13.0 → 2.15.0

package/dist/commands/feedback.js

@@ -6,7 +6,7 @@
 // because nothing they read mentioned it.
 import { feedback as sdkFeedback } from '@myapihq/sdk';
 import { requireConfig } from '../config.js';
-import { success, error, info, printTable, printJson, banner } from '../output.js';
+import { success, error, info, printJson, banner } from '../output.js';
 import { formatDate } from '../utils.js';
 import { requireOrg, requireArg, confirmDestructive } from '../helpers.js';
 export const EXPOSES = [
@@ -20,6 +20,7 @@ export const EXPOSES = [
     'DELETE /feedback/orgs/{org_id}/widgets/{id}',
 ];
 export const SCHEMA = {
+    trace: 'boolean',
     routes: 'string',
     accent: 'string',
     position: 'string',
@@ -33,6 +34,28 @@ export const SCHEMA = {
 };
 // The platform's enum, checked against the schema rather than invented.
 const KINDS = ['bug', 'issue', 'suggestion'];
+// A selector says `div#install > button.save`. The context says the button read
+// "Save settings" and sat under "Install". The second is what a person needs,
+// so prefer it and fall back to the selector only when it is absent.
+function describeTarget(i) {
+    const ctx = i.target_context;
+    const one = ctx && !ctx.region ? ctx : (ctx?.region?.[0]);
+    if (one) {
+        const label = one.text || one.aria_label || one.name || one.id;
+        const bits = [];
+        if (label)
+            bits.push(JSON.stringify(label));
+        if (one.tag)
+            bits.push(`(${one.tag})`);
+        let s = bits.join(' ') || one.tag || '';
+        if (one.section)
+            s += ` under ${JSON.stringify(one.section)}`;
+        const more = ctx?.region?.length > 1 ? ` +${ctx.region.length - 1} more` : '';
+        if (s)
+            return s + more;
+    }
+    return i.target_selector ?? '';
+}
 export async function list(flags) {
     const config = requireConfig();
     const orgId = requireOrg(flags, config, 'myapi feedback list [--kind <k>] [--status open|resolved] [--org <id>]');
@@ -56,14 +79,55 @@ export async function list(flags) {
     // that explicitly, having been bitten by the opposite in CRM search.
     const shown = page.items?.length ?? 0;
     info(shown === page.total ? `${shown} item${shown === 1 ? '' : 's'}` : `${shown} of ${page.total} items`);
-    printTable((page.items ?? []).map(i => ({
-        id: i.id,
-        kind: i.kind,
-        status: i.status,
-        body: i.body.length > 60 ? `${i.body.slice(0, 57)}…` : i.body,
-        route: i.route ?? i.page_url ?? '',
-        created: i.created_at ? formatDate(i.created_at) : '',
-    })), { flags, empty: 'No feedback yet. Put a widget on a page: myapi feedback widget create <name>' });
+    info('');
+    // A report used to be one line of prose with a CSS selector under it. It now
+    // carries what was pointed at, what happened before, and a picture — and a
+    // table cannot hold any of that. Twenty of these dumped in full would be
+    // unreadable, so each item summarises and `--trace` expands.
+    for (const i of page.items ?? []) {
+        const when = i.created_at ? formatDate(i.created_at) : '';
+        info(`${i.kind.padEnd(10)} ${when}  ${i.route ?? i.page_url ?? ''}`);
+        info(`  ${JSON.stringify(i.body.length > 100 ? `${i.body.slice(0, 97)}…` : i.body)}`);
+        const pointing = describeTarget(i);
+        if (pointing)
+            info(`  pointing at  ${pointing}`);
+        const trace = Array.isArray(i.trace) ? i.trace : [];
+        if (trace.length) {
+            // Errors and failed requests are the highest-signal part — for most
+            // reports the answer is a 500 nobody saw. Counting them beats truncating
+            // the trace into the summary line.
+            const errors = trace.filter(e => e.kind === 'error').length;
+            const failed = trace.filter(e => e.kind === 'request' && /\b[45]\d\d\b/.test(e.detail)).length;
+            const parts = [`${trace.length} step${trace.length === 1 ? '' : 's'}`];
+            if (errors)
+                parts.push(`${errors} error${errors === 1 ? '' : 's'}`);
+            if (failed)
+                parts.push(`${failed} failed request${failed === 1 ? '' : 's'}`);
+            info(`  before       ${parts.join(' · ')}`);
+        }
+        if (i.screenshot_url)
+            info('  screenshot   yes');
+        else if (i.screenshot_asset_id)
+            info('  screenshot   yes (link could not be signed)');
+        if (flags.trace && trace.length) {
+            info('');
+            for (const e of trace) {
+                // `t` is ms since page load, not wall clock — rendered as a delta so
+                // nobody reads it as a time of day.
+                info(`    +${(e.t / 1000).toFixed(1)}s  ${String(e.kind).padEnd(8)}  ${e.detail}`);
+            }
+        }
+        info(`  id ${i.id}`);
+        info('');
+    }
+    if (!shown)
+        info('No feedback yet. Put a widget on a page: myapi feedback widget create <name>');
+    const withShots = (page.items ?? []).filter(i => i.screenshot_url || i.screenshot_asset_id).length;
+    if (withShots > 0)
+        info(`\`--json\` carries the screenshot links (signed, ~1h — do not cache them).`);
+    if ((page.items ?? []).some(i => Array.isArray(i.trace) && i.trace.length) && !flags.trace) {
+        info('`--trace` expands what happened before each report.');
+    }
     if (page.has_more)
         info('More available — raise --limit or pass --offset.');
 }
@@ -106,9 +170,12 @@ export async function del(id, flags) {
     requireArg(id, 'id', usage);
     // Erases rather than closes. `resolve` is the reversible one; this is not,
     // so it takes the same confirmation every destructive verb here takes.
-    await confirmDestructive(flags, `permanently delete feedback ${id} (resolve keeps it; this erases it)`, usage);
+    await confirmDestructive(flags, `permanently delete feedback ${id} — the report AND its screenshot (resolve keeps both)`, usage);
     await sdkFeedback.deleteFeedback(config.api_key, orgId, id);
     success(`Deleted ${id}`);
+    // The cascade is the point: somebody deleting a report because of what is IN
+    // it needs the picture gone too, and it used to be left behind.
+    info('The stored screenshot went with it.');
     info('(Idempotent — an unknown id answers the same way, so this is not confirmation the item existed.)');
 }
 export async function widget(sub, arg, flags) {

package/dist/errors.js

@@ -26,6 +26,7 @@ export const ERROR_MESSAGES = {
     invalid_org: 'Invalid organization.',
     FORBIDDEN: 'You do not have permission to perform this action.',
     RATE_LIMITED: 'Too many requests. Please wait a moment and try again.',
+    BODY_TOO_LARGE: 'The request is over 64 KB — usually an oversized feedback `trace`. Nothing was saved. This used to surface as INVALID_JSON, which sent people looking for a syntax error they did not have.',
     INSUFFICIENT_BALANCE: 'Insufficient balance. Run: myapi billing topup <amount>',
     INVALID_AMOUNT: 'Amount out of range. Maximum single top-up is $100. Run: myapi billing topup <amount>',
     SERVICE_NOT_LAUNCHED: 'This service is disabled pre-launch. Track availability via: myapi status',

package/dist/skills/my-feedback-api/SKILL.md

@@ -1,10 +1,10 @@
 ---
 name: my-feedback-api
-version: 1.3.0
+version: 1.5.0
 description: >
   Collect feedback from the people using what you built. A public widget key lets a page submit without a credential; you list, filter and resolve the results. Kind is chosen by the person reporting, not inferred from their wording.
 triggers: [feedback, bug report, user feedback, feature request, widget, support, complaints, praise]
-checksum: sha256-de137a7db55ba3173aecdd489b4568e66166a0d6c145f5a9fa165c5ef252bc01
+checksum: sha256-fdd06435d3f56b8ff220144771731b60694ed107835b3869d96571f46e3f3653
 ---
 
 # MyFeedbackAPI
@@ -44,17 +44,25 @@ theme baked in. This is the intended way in — you do not build a UI:
 
 It renders a button, shows itself only on the routes the widget is configured
 for (set them with `widget update <id> --routes /app,/app/**`; changes reach
-browsers within ~5 minutes with no redeploy of your site), and lets the person point at an element or drag a region. It sends `kind`,
-`body`, `page_url`, `route`, `viewport`, plus **either** `target_selector` (they
-clicked something) **or** `target_region` `{x,y,w,h}` (they dragged a box).
+browsers within ~5 minutes with no redeploy of your site), and lets the person point at an element or drag a region. It sends `kind`, `body`, `page_url`, `route`, `viewport`, `target_selector`,
+and `target_region` `{x,y,w,h}` — the region is on **every** report now, the
+element's bounding rectangle for a click and the dragged box for a drag. It also
+sends `target_context` (what the element *was* — its text, role, the heading
+above it) and `trace`, the last events before the report.
 
 A wrong key does not break the page: the response is `application/javascript`
 carrying a JS comment that names the fix, so a typo cannot throw a syntax error
 in your app.
 
-**No screenshots.** The submit body takes no image and there is no multipart
-form — `target_selector` / `target_region` are the platform's answer to "where
-were they pointing". Do not build a capture step expecting somewhere to put it.
+**Screenshots are automatic — you do not build a capture step.** When someone
+opens the feedback sheet the widget fetches a renderer on demand and attaches
+the picture itself, as a second call after the report is saved. That ordering is
+deliberate: an image that fails to render or upload never costs the report.
+
+The image is **stored private in your org's assets**, and listing feedback
+returns a **signed link good for about an hour** (`screenshot_url`). It is
+signed on read, so it is not stable — re-list rather than persisting it. PNG,
+JPEG or WebP up to 3 MB; over that the feedback is kept without the picture.
 
 ### Submitting by hand (only if you cannot use the script)
 
@@ -86,6 +94,20 @@ processed signal.
 
 ### Reading it back
 
+Each item carries what was pointed at, how they got there, and a picture.
+`myapi feedback list` summarises that per report — the element's own text rather
+than its CSS selector, a count of steps/errors/failed requests, and whether a
+screenshot exists. `--trace` expands the event list; `--json` passes everything
+through.
+
+Two things not to misread: **`trace[].t` is milliseconds since page load**, not
+a clock time, so it only means anything as a delta within one trace. And
+**`target_context.filled` says an input had a value, never what it was** — the
+widget does not collect it.
+
+`delete` removes the screenshot along with the report, which is the case that
+matters: somebody erasing a report because of what is in the picture.
+
 `myapi feedback list` is newest first, filterable by `--kind` and `--status`
 (`open` | `resolved`), paged with `--limit` / `--offset`. **`total` is the
 number of matches, not the size of the page**, and `has_more` flags a truncated

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@myapihq/cli",
   "license": "Apache-2.0",
-  "version": "2.13.0",
+  "version": "2.15.0",
   "description": "MyAPI command-line interface",
   "repository": {
     "type": "git",
@@ -46,7 +46,7 @@
     "lint:skills:strict": "node scripts/copy-skills.js && node scripts/lint-skills.js --strict"
   },
   "dependencies": {
-    "@myapihq/sdk": "^2.13.0"
+    "@myapihq/sdk": "^2.15.0"
   },
   "devDependencies": {
     "@types/node": "^25.6.0",