@myapihq/cli 2.15.0 → 2.15.2

package/dist/config-save-upsert.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/config-save-upsert.test.js

@@ -0,0 +1,98 @@
+// saveConfig() writes by api_key, not by the active index.
+//
+// The bug this pins is data loss, not misconfiguration. saveConfig wrote to
+// accounts[active] on the assumption that the Config handed to it belongs to
+// the active account. It does not when MYAPI_API_KEY names a key the file has
+// never seen: loadConfig deliberately returns a bare `{ api_key, account_id:'' }`
+// for an unknown key — inheriting the active account's defaults is the
+// cross-tenant bug config-envkey.test.ts pins — and saving that stub then
+// overwrote the signed-in entry with it. api_key, account_id, default_org and
+// default_funnel, gone from disk.
+//
+// It was reachable from any org-scoped command once requireOrg began persisting
+// `last_org_used`, which turned a config-command bug into a data-loss one on an
+// ordinary `database namespaces`. Reported by the backend team 2026-08-17 while
+// setting up a developer with an org-locked key; reproduced before fixing.
+import { describe, it, expect, beforeEach, afterEach, vi } from 'vitest';
+import * as fs from 'node:fs';
+import * as os from 'node:os';
+import * as path from 'node:path';
+const SIGNED_IN = 'hq_live_signed_in_account';
+const ORG_LOCKED = 'hq_live_org_locked_key';
+let tmpHome;
+let realHome;
+const FULL_CONFIG = {
+    active: 0,
+    accounts: [
+        {
+            api_key: SIGNED_IN,
+            account_id: 'acct-real',
+            email: 'operator@example.com',
+            default_org: 'org-real',
+            default_funnel: 'fun-real',
+        },
+    ],
+};
+async function freshConfigModule() {
+    vi.resetModules();
+    return import('./config.js');
+}
+function readAccounts() {
+    return JSON.parse(fs.readFileSync(path.join(tmpHome, '.myapi', 'config.json'), 'utf-8')).accounts;
+}
+beforeEach(() => {
+    tmpHome = fs.mkdtempSync(path.join(os.tmpdir(), 'myapi-save-'));
+    fs.mkdirSync(path.join(tmpHome, '.myapi'), { recursive: true });
+    fs.writeFileSync(path.join(tmpHome, '.myapi', 'config.json'), JSON.stringify(FULL_CONFIG));
+    realHome = process.env.HOME;
+    process.env.HOME = tmpHome;
+    delete process.env.MYAPI_API_KEY;
+    delete process.env.MYAPI_KEY;
+});
+afterEach(() => {
+    if (realHome !== undefined)
+        process.env.HOME = realHome;
+    delete process.env.MYAPI_API_KEY;
+    fs.rmSync(tmpHome, { recursive: true, force: true });
+});
+describe('saveConfig upserts by api_key', () => {
+    it('does not destroy the signed-in account when saving an unknown env key', async () => {
+        process.env.MYAPI_API_KEY = ORG_LOCKED;
+        const { loadConfig, saveConfig } = await freshConfigModule();
+        const cfg = loadConfig();
+        expect(cfg.api_key).toBe(ORG_LOCKED);
+        expect(cfg.account_id).toBe(''); // the stub loadConfig hands back on purpose
+        // What any org-scoped command now does via requireOrg.
+        saveConfig({ ...cfg, last_org_used: 'org-customer' });
+        const accounts = readAccounts();
+        const original = accounts.find((a) => a.api_key === SIGNED_IN);
+        expect(original, 'the signed-in account must still exist').toBeDefined();
+        expect(original.account_id).toBe('acct-real');
+        expect(original.default_org).toBe('org-real');
+        expect(original.default_funnel).toBe('fun-real');
+    });
+    it('gives the env key its own entry so its defaults can persist', async () => {
+        process.env.MYAPI_API_KEY = ORG_LOCKED;
+        const { loadConfig, saveConfig } = await freshConfigModule();
+        saveConfig({ ...loadConfig(), default_org: 'org-customer' });
+        const entry = readAccounts().find((a) => a.api_key === ORG_LOCKED);
+        expect(entry, 'an unknown key should be appended, not merged into another').toBeDefined();
+        expect(entry.default_org).toBe('org-customer');
+    });
+    it('leaves `active` alone — an env key must not become the signed-in account', async () => {
+        process.env.MYAPI_API_KEY = ORG_LOCKED;
+        const { loadConfig, saveConfig } = await freshConfigModule();
+        saveConfig({ ...loadConfig(), default_org: 'org-customer' });
+        const full = JSON.parse(fs.readFileSync(path.join(tmpHome, '.myapi', 'config.json'), 'utf-8'));
+        expect(full.active).toBe(0);
+        expect(full.accounts[full.active].api_key).toBe(SIGNED_IN);
+    });
+    it('still updates in place for a key the config already knows', async () => {
+        const { loadConfig, saveConfig } = await freshConfigModule();
+        saveConfig({ ...loadConfig(), default_org: 'org-moved' });
+        const accounts = readAccounts();
+        expect(accounts).toHaveLength(1); // updated, not duplicated
+        expect(accounts[0].default_org).toBe('org-moved');
+        expect(accounts[0].account_id).toBe('acct-real');
+    });
+});

package/dist/config.js

@@ -94,13 +94,37 @@ function writeFullConfig(full) {
     // configs written by older CLI versions (pre-0o600) that are still 0644.
     fs.chmodSync(CONFIG_FILE, 0o600);
 }
+// Upsert by api_key, NOT by the active index.
+//
+// Writing to accounts[active] assumed the config being saved is the active
+// account's. It is not when MYAPI_API_KEY names a key the file has never seen:
+// loadConfig deliberately returns a bare `{ api_key, account_id: '' }` for an
+// unknown key (see the comment there — inheriting the active account's defaults
+// is the cross-tenant bug it exists to avoid), and saving that stub then
+// overwrote the signed-in entry with it. One ordinary command wiped the stored
+// api_key, account_id, default_org and default_funnel.
+//
+// It became reachable from any org-scoped command once requireOrg started
+// persisting `last_org_used`, which is what made a config-only bug into a
+// data-loss one. Reproduced 2026-08-17.
+//
+// Matching loadConfig's own lookup makes read and write symmetric, and gives an
+// env-supplied key somewhere of its own to keep defaults — which is what lets a
+// developer holding an org-locked key have a default_org at all.
 export function saveConfig(config) {
     const full = loadFullConfig() ?? { active: 0, accounts: [] };
     const { autocomplete_setup, ...account } = config;
-    if (full.accounts.length === 0)
-        full.accounts.push(account);
-    else
-        full.accounts[full.active] = account;
+    const entry = account;
+    const existing = full.accounts.findIndex(a => a.api_key === entry.api_key);
+    if (existing >= 0) {
+        full.accounts[existing] = entry;
+    }
+    else {
+        // Appended, and `active` is deliberately left alone: a key passed through
+        // the environment for one command must not silently become the account the
+        // user is signed in as.
+        full.accounts.push(entry);
+    }
     if (autocomplete_setup !== undefined)
         full.autocomplete_setup = autocomplete_setup;
     writeFullConfig(full);

package/dist/skills/my-feedback-api/SKILL.md

@@ -1,10 +1,10 @@
 ---
 name: my-feedback-api
-version: 1.5.0
+version: 1.5.1
 description: >
   Collect feedback from the people using what you built. A public widget key lets a page submit without a credential; you list, filter and resolve the results. Kind is chosen by the person reporting, not inferred from their wording.
 triggers: [feedback, bug report, user feedback, feature request, widget, support, complaints, praise]
-checksum: sha256-fdd06435d3f56b8ff220144771731b60694ed107835b3869d96571f46e3f3653
+checksum: sha256-b1aba273d6d32b4145dcee85fb59fec35f50b257fc41fb8da9f649a0b519e909
 ---
 
 # MyFeedbackAPI
@@ -42,13 +42,18 @@ theme baked in. This is the intended way in — you do not build a UI:
 <script src="https://api.myapihq.com/feedback/in/<widget_key>/widget.js" async></script>
 ```
 
-It renders a button, shows itself only on the routes the widget is configured
-for (set them with `widget update <id> --routes /app,/app/**`; changes reach
-browsers within ~5 minutes with no redeploy of your site), and lets the person point at an element or drag a region. It sends `kind`, `body`, `page_url`, `route`, `viewport`, `target_selector`,
-and `target_region` `{x,y,w,h}` — the region is on **every** report now, the
-element's bounding rectangle for a click and the dragged box for a drag. It also
-sends `target_context` (what the element *was* — its text, role, the heading
-above it) and `trace`, the last events before the report.
+It renders a button and shows itself only on the routes the widget is
+configured for — set them with `widget update <id> --routes /app,/app/**`, and
+the change reaches browsers within ~5 minutes with no redeploy of your site.
+
+The person points at an element or drags a region, and it sends:
+
+- `kind`, `body`, `page_url`, `route`, `viewport`
+- `target_selector` and `target_region` `{x,y,w,h}` — the region is on **every**
+  report now: the element's bounding rectangle for a click, the dragged box for
+  a drag
+- `target_context` — what the element *was*: its text, role, the heading above it
+- `trace` — the last events before the report
 
 A wrong key does not break the page: the response is `application/javascript`
 carrying a JS comment that names the fix, so a typo cannot throw a syntax error
@@ -79,7 +84,9 @@ await fetch(`https://api.myapihq.com/feedback/in/${WIDGET_KEY}`, {
 
 Errors: `WIDGET_NOT_FOUND` (a revoked key reads like an invented one, so keys
 cannot be probed), `ORIGIN_NOT_ALLOWED`, `RATE_LIMITED`, `INVALID_KIND`,
-`BODY_REQUIRED`, `BODY_TOO_LONG`. The key only ever writes.
+`BODY_REQUIRED`, `BODY_TOO_LONG` (the text is over 8000 chars) and
+`BODY_TOO_LARGE` (the whole request is over 64 KB, usually an oversized
+`trace`). Nothing is saved in either case. The key only ever writes.
 
 ### Kind is a claim, not a guess
 
@@ -123,7 +130,7 @@ that is deliberate, so ids cannot be probed across orgs.
 | Command | What it does |
 |---|---|
 | `myapi feedback create "<text>" --kind <k>` | Record one item (`--page-url`, `--route` for context) |
-| `myapi feedback list [--kind bug\|issue\|suggestion] [--status open\|resolved] [--limit N] [--offset N]` | List feedback, newest first |
+| `myapi feedback list [--kind bug\|issue\|suggestion] [--status open\|resolved] [--limit N] [--offset N] [--trace]` | List feedback, newest first. Each report summarises what was pointed at, what happened before, and whether a screenshot exists; `--trace` expands the events |
 | `myapi feedback resolve <id>` | Close an item, keeping it |
 | `myapi feedback delete <id>` | Erase an item — for spam, or personal details typed into the box |
 | `myapi feedback widget create <name> [--origins a.com,b.com]` | Mint a PUBLIC widget key for a site |
@@ -149,12 +156,13 @@ myapi feedback widget update <id> --routes /app,/app/**
 myapi feedback list --status open
 myapi feedback list --kind bug --limit 20
 
-# 3. Record something yourself (support call, your own testing)
+# 5. Record something yourself (support call, your own testing)
 myapi feedback create "checkout 500s on the second attempt" --kind bug \
   --route /checkout
 
-# 4. Close it
+# 6. Close it — or delete it, which also removes its screenshot
 myapi feedback resolve <id>
+myapi feedback delete <id> --yes
 ```
 <!-- llm:end -->
 

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@myapihq/cli",
   "license": "Apache-2.0",
-  "version": "2.15.0",
+  "version": "2.15.2",
   "description": "MyAPI command-line interface",
   "repository": {
     "type": "git",
@@ -46,7 +46,7 @@
     "lint:skills:strict": "node scripts/copy-skills.js && node scripts/lint-skills.js --strict"
   },
   "dependencies": {
-    "@myapihq/sdk": "^2.15.0"
+    "@myapihq/sdk": "^2.15.2"
   },
   "devDependencies": {
     "@types/node": "^25.6.0",