@myapihq/cli 2.14.0 → 2.15.1

package/dist/commands/feedback.js

@@ -6,7 +6,7 @@
 // because nothing they read mentioned it.
 import { feedback as sdkFeedback } from '@myapihq/sdk';
 import { requireConfig } from '../config.js';
-import { success, error, info, printTable, printJson, banner } from '../output.js';
+import { success, error, info, printJson, banner } from '../output.js';
 import { formatDate } from '../utils.js';
 import { requireOrg, requireArg, confirmDestructive } from '../helpers.js';
 export const EXPOSES = [
@@ -20,6 +20,7 @@ export const EXPOSES = [
     'DELETE /feedback/orgs/{org_id}/widgets/{id}',
 ];
 export const SCHEMA = {
+    trace: 'boolean',
     routes: 'string',
     accent: 'string',
     position: 'string',
@@ -33,6 +34,28 @@ export const SCHEMA = {
 };
 // The platform's enum, checked against the schema rather than invented.
 const KINDS = ['bug', 'issue', 'suggestion'];
+// A selector says `div#install > button.save`. The context says the button read
+// "Save settings" and sat under "Install". The second is what a person needs,
+// so prefer it and fall back to the selector only when it is absent.
+function describeTarget(i) {
+    const ctx = i.target_context;
+    const one = ctx && !ctx.region ? ctx : (ctx?.region?.[0]);
+    if (one) {
+        const label = one.text || one.aria_label || one.name || one.id;
+        const bits = [];
+        if (label)
+            bits.push(JSON.stringify(label));
+        if (one.tag)
+            bits.push(`(${one.tag})`);
+        let s = bits.join(' ') || one.tag || '';
+        if (one.section)
+            s += ` under ${JSON.stringify(one.section)}`;
+        const more = ctx?.region?.length > 1 ? ` +${ctx.region.length - 1} more` : '';
+        if (s)
+            return s + more;
+    }
+    return i.target_selector ?? '';
+}
 export async function list(flags) {
     const config = requireConfig();
     const orgId = requireOrg(flags, config, 'myapi feedback list [--kind <k>] [--status open|resolved] [--org <id>]');
@@ -56,23 +79,54 @@ export async function list(flags) {
     // that explicitly, having been bitten by the opposite in CRM search.
     const shown = page.items?.length ?? 0;
     info(shown === page.total ? `${shown} item${shown === 1 ? '' : 's'}` : `${shown} of ${page.total} items`);
-    // The table cannot carry a signed URL, a selector and a navigation trace, so
-    // it flags what exists and --json carries it. Saying nothing about a
-    // screenshot would leave a picture nobody knows to look for.
-    printTable((page.items ?? []).map(i => ({
-        id: i.id,
-        kind: i.kind,
-        status: i.status,
-        body: i.body.length > 60 ? `${i.body.slice(0, 57)}…` : i.body,
-        route: i.route ?? i.page_url ?? '',
-        // A failed signature still means a picture is there — distinguish that
-        // from having none, rather than showing both as blank.
-        shot: i.screenshot_url ? 'yes' : (i.screenshot_asset_id ? 'unsigned' : ''),
-        created: i.created_at ? formatDate(i.created_at) : '',
-    })), { flags, empty: 'No feedback yet. Put a widget on a page: myapi feedback widget create <name>' });
+    info('');
+    // A report used to be one line of prose with a CSS selector under it. It now
+    // carries what was pointed at, what happened before, and a picture — and a
+    // table cannot hold any of that. Twenty of these dumped in full would be
+    // unreadable, so each item summarises and `--trace` expands.
+    for (const i of page.items ?? []) {
+        const when = i.created_at ? formatDate(i.created_at) : '';
+        info(`${i.kind.padEnd(10)} ${when}  ${i.route ?? i.page_url ?? ''}`);
+        info(`  ${JSON.stringify(i.body.length > 100 ? `${i.body.slice(0, 97)}…` : i.body)}`);
+        const pointing = describeTarget(i);
+        if (pointing)
+            info(`  pointing at  ${pointing}`);
+        const trace = Array.isArray(i.trace) ? i.trace : [];
+        if (trace.length) {
+            // Errors and failed requests are the highest-signal part — for most
+            // reports the answer is a 500 nobody saw. Counting them beats truncating
+            // the trace into the summary line.
+            const errors = trace.filter(e => e.kind === 'error').length;
+            const failed = trace.filter(e => e.kind === 'request' && /\b[45]\d\d\b/.test(e.detail)).length;
+            const parts = [`${trace.length} step${trace.length === 1 ? '' : 's'}`];
+            if (errors)
+                parts.push(`${errors} error${errors === 1 ? '' : 's'}`);
+            if (failed)
+                parts.push(`${failed} failed request${failed === 1 ? '' : 's'}`);
+            info(`  before       ${parts.join(' · ')}`);
+        }
+        if (i.screenshot_url)
+            info('  screenshot   yes');
+        else if (i.screenshot_asset_id)
+            info('  screenshot   yes (link could not be signed)');
+        if (flags.trace && trace.length) {
+            info('');
+            for (const e of trace) {
+                // `t` is ms since page load, not wall clock — rendered as a delta so
+                // nobody reads it as a time of day.
+                info(`    +${(e.t / 1000).toFixed(1)}s  ${String(e.kind).padEnd(8)}  ${e.detail}`);
+            }
+        }
+        info(`  id ${i.id}`);
+        info('');
+    }
+    if (!shown)
+        info('No feedback yet. Put a widget on a page: myapi feedback widget create <name>');
     const withShots = (page.items ?? []).filter(i => i.screenshot_url || i.screenshot_asset_id).length;
-    if (withShots > 0 && !flags.json) {
-        info(`${withShots} item${withShots === 1 ? ' has' : 's have'} a screenshot — \`--json\` carries the link (signed, ~1h).`);
+    if (withShots > 0)
+        info(`\`--json\` carries the screenshot links (signed, ~1h — do not cache them).`);
+    if ((page.items ?? []).some(i => Array.isArray(i.trace) && i.trace.length) && !flags.trace) {
+        info('`--trace` expands what happened before each report.');
     }
     if (page.has_more)
         info('More available — raise --limit or pass --offset.');
@@ -116,9 +170,12 @@ export async function del(id, flags) {
     requireArg(id, 'id', usage);
     // Erases rather than closes. `resolve` is the reversible one; this is not,
     // so it takes the same confirmation every destructive verb here takes.
-    await confirmDestructive(flags, `permanently delete feedback ${id} (resolve keeps it; this erases it)`, usage);
+    await confirmDestructive(flags, `permanently delete feedback ${id} — the report AND its screenshot (resolve keeps both)`, usage);
     await sdkFeedback.deleteFeedback(config.api_key, orgId, id);
     success(`Deleted ${id}`);
+    // The cascade is the point: somebody deleting a report because of what is IN
+    // it needs the picture gone too, and it used to be left behind.
+    info('The stored screenshot went with it.');
     info('(Idempotent — an unknown id answers the same way, so this is not confirmation the item existed.)');
 }
 export async function widget(sub, arg, flags) {

package/dist/errors.js

@@ -26,6 +26,7 @@ export const ERROR_MESSAGES = {
     invalid_org: 'Invalid organization.',
     FORBIDDEN: 'You do not have permission to perform this action.',
     RATE_LIMITED: 'Too many requests. Please wait a moment and try again.',
+    BODY_TOO_LARGE: 'The request is over 64 KB — usually an oversized feedback `trace`. Nothing was saved. This used to surface as INVALID_JSON, which sent people looking for a syntax error they did not have.',
     INSUFFICIENT_BALANCE: 'Insufficient balance. Run: myapi billing topup <amount>',
     INVALID_AMOUNT: 'Amount out of range. Maximum single top-up is $100. Run: myapi billing topup <amount>',
     SERVICE_NOT_LAUNCHED: 'This service is disabled pre-launch. Track availability via: myapi status',

package/dist/skills/my-feedback-api/SKILL.md

@@ -1,10 +1,10 @@
 ---
 name: my-feedback-api
-version: 1.4.0
+version: 1.5.1
 description: >
   Collect feedback from the people using what you built. A public widget key lets a page submit without a credential; you list, filter and resolve the results. Kind is chosen by the person reporting, not inferred from their wording.
 triggers: [feedback, bug report, user feedback, feature request, widget, support, complaints, praise]
-checksum: sha256-b8a6dbed6fa4aa393e538225ae611f5f5d8c4fbb1ffea7922e4a0286d984eca4
+checksum: sha256-b1aba273d6d32b4145dcee85fb59fec35f50b257fc41fb8da9f649a0b519e909
 ---
 
 # MyFeedbackAPI
@@ -42,11 +42,18 @@ theme baked in. This is the intended way in — you do not build a UI:
 <script src="https://api.myapihq.com/feedback/in/<widget_key>/widget.js" async></script>
 ```
 
-It renders a button, shows itself only on the routes the widget is configured
-for (set them with `widget update <id> --routes /app,/app/**`; changes reach
-browsers within ~5 minutes with no redeploy of your site), and lets the person point at an element or drag a region. It sends `kind`,
-`body`, `page_url`, `route`, `viewport`, plus **either** `target_selector` (they
-clicked something) **or** `target_region` `{x,y,w,h}` (they dragged a box).
+It renders a button and shows itself only on the routes the widget is
+configured for — set them with `widget update <id> --routes /app,/app/**`, and
+the change reaches browsers within ~5 minutes with no redeploy of your site.
+
+The person points at an element or drags a region, and it sends:
+
+- `kind`, `body`, `page_url`, `route`, `viewport`
+- `target_selector` and `target_region` `{x,y,w,h}` — the region is on **every**
+  report now: the element's bounding rectangle for a click, the dragged box for
+  a drag
+- `target_context` — what the element *was*: its text, role, the heading above it
+- `trace` — the last events before the report
 
 A wrong key does not break the page: the response is `application/javascript`
 carrying a JS comment that names the fix, so a typo cannot throw a syntax error
@@ -77,7 +84,9 @@ await fetch(`https://api.myapihq.com/feedback/in/${WIDGET_KEY}`, {
 
 Errors: `WIDGET_NOT_FOUND` (a revoked key reads like an invented one, so keys
 cannot be probed), `ORIGIN_NOT_ALLOWED`, `RATE_LIMITED`, `INVALID_KIND`,
-`BODY_REQUIRED`, `BODY_TOO_LONG`. The key only ever writes.
+`BODY_REQUIRED`, `BODY_TOO_LONG` (the text is over 8000 chars) and
+`BODY_TOO_LARGE` (the whole request is over 64 KB, usually an oversized
+`trace`). Nothing is saved in either case. The key only ever writes.
 
 ### Kind is a claim, not a guess
 
@@ -92,10 +101,19 @@ processed signal.
 
 ### Reading it back
 
-Each item also carries what was pointed at (`target_selector`, `target_region`,
-`target_context`), how they got there (`trace`), the `viewport`, and
-`screenshot_url` when there is a picture. The table flags which items have one;
-`--json` carries the link.
+Each item carries what was pointed at, how they got there, and a picture.
+`myapi feedback list` summarises that per report — the element's own text rather
+than its CSS selector, a count of steps/errors/failed requests, and whether a
+screenshot exists. `--trace` expands the event list; `--json` passes everything
+through.
+
+Two things not to misread: **`trace[].t` is milliseconds since page load**, not
+a clock time, so it only means anything as a delta within one trace. And
+**`target_context.filled` says an input had a value, never what it was** — the
+widget does not collect it.
+
+`delete` removes the screenshot along with the report, which is the case that
+matters: somebody erasing a report because of what is in the picture.
 
 `myapi feedback list` is newest first, filterable by `--kind` and `--status`
 (`open` | `resolved`), paged with `--limit` / `--offset`. **`total` is the
@@ -112,7 +130,7 @@ that is deliberate, so ids cannot be probed across orgs.
 | Command | What it does |
 |---|---|
 | `myapi feedback create "<text>" --kind <k>` | Record one item (`--page-url`, `--route` for context) |
-| `myapi feedback list [--kind bug\|issue\|suggestion] [--status open\|resolved] [--limit N] [--offset N]` | List feedback, newest first |
+| `myapi feedback list [--kind bug\|issue\|suggestion] [--status open\|resolved] [--limit N] [--offset N] [--trace]` | List feedback, newest first. Each report summarises what was pointed at, what happened before, and whether a screenshot exists; `--trace` expands the events |
 | `myapi feedback resolve <id>` | Close an item, keeping it |
 | `myapi feedback delete <id>` | Erase an item — for spam, or personal details typed into the box |
 | `myapi feedback widget create <name> [--origins a.com,b.com]` | Mint a PUBLIC widget key for a site |
@@ -138,12 +156,13 @@ myapi feedback widget update <id> --routes /app,/app/**
 myapi feedback list --status open
 myapi feedback list --kind bug --limit 20
 
-# 3. Record something yourself (support call, your own testing)
+# 5. Record something yourself (support call, your own testing)
 myapi feedback create "checkout 500s on the second attempt" --kind bug \
   --route /checkout
 
-# 4. Close it
+# 6. Close it — or delete it, which also removes its screenshot
 myapi feedback resolve <id>
+myapi feedback delete <id> --yes
 ```
 <!-- llm:end -->
 

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@myapihq/cli",
   "license": "Apache-2.0",
-  "version": "2.14.0",
+  "version": "2.15.1",
   "description": "MyAPI command-line interface",
   "repository": {
     "type": "git",
@@ -46,7 +46,7 @@
     "lint:skills:strict": "node scripts/copy-skills.js && node scripts/lint-skills.js --strict"
   },
   "dependencies": {
-    "@myapihq/sdk": "^2.14.0"
+    "@myapihq/sdk": "^2.15.1"
   },
   "devDependencies": {
     "@types/node": "^25.6.0",