@myapihq/cli 2.18.0 → 2.19.1

package/dist/commands/feedback-capture.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/commands/feedback-capture.test.js

@@ -0,0 +1,49 @@
+// Capture flags send only what the operator named.
+//
+// The rule this file defends: an absent `capture` sub-field means "leave it
+// alone", never "off". ImmoPilot's screens carry tenant names, IBANs and dates
+// of birth; the widget photographs the viewport and reads the text of whatever
+// the reporter points at. If `--no-screenshot` also sent `text: true` because
+// the CLI helpfully filled in the object, it would turn one deliberate
+// restriction into a different, undeclared permission — on exactly those pages.
+//
+// Both fields default to true server-side, so this is also what keeps every
+// widget embedded before capture existed behaving as it always did.
+import { describe, it, expect } from 'vitest';
+import { _captureFrom } from './feedback.js';
+const f = (o) => o;
+describe('_captureFrom', () => {
+    it('is undefined when the operator said nothing', () => {
+        // Not `{}` — an empty object would still put `capture` in the PATCH body,
+        // and "Nothing to change" would stop being reachable.
+        expect(_captureFrom(f({}))).toBeUndefined();
+        expect(_captureFrom(f({ routes: '/a' }))).toBeUndefined();
+    });
+    it('sends only the field that was named', () => {
+        expect(_captureFrom(f({ 'no-screenshot': true }))).toEqual({ screenshot: false });
+        expect(_captureFrom(f({ 'no-text': true }))).toEqual({ text: false });
+        expect(_captureFrom(f({ screenshot: true }))).toEqual({ screenshot: true });
+        expect(_captureFrom(f({ text: true }))).toEqual({ text: true });
+    });
+    it('never infers the field it was not told about', () => {
+        // The whole point. Turning screenshots off must not carry an opinion about
+        // text, in either direction.
+        const only = _captureFrom(f({ 'no-screenshot': true }));
+        expect(only).not.toHaveProperty('text');
+        expect(Object.keys(only)).toEqual(['screenshot']);
+    });
+    it('carries both when both were named', () => {
+        expect(_captureFrom(f({ 'no-screenshot': true, 'no-text': true })))
+            .toEqual({ screenshot: false, text: false });
+        expect(_captureFrom(f({ screenshot: true, 'no-text': true })))
+            .toEqual({ screenshot: true, text: false });
+    });
+    it('lets the negative win when both spellings are passed', () => {
+        // `--screenshot --no-screenshot` is contradictory input. Resolving it to
+        // the restrictive answer is the safe direction: the cost of wrongly not
+        // capturing is a less useful bug report, the cost of wrongly capturing is
+        // a customer's records in a screenshot.
+        expect(_captureFrom(f({ screenshot: true, 'no-screenshot': true }))).toEqual({ screenshot: false });
+        expect(_captureFrom(f({ text: true, 'no-text': true }))).toEqual({ text: false });
+    });
+});

package/dist/commands/feedback.d.ts

@@ -1,8 +1,16 @@
+import { feedback as sdkFeedback } from '@myapihq/sdk';
 import type { FlagSchema } from '../flags.js';
 import { type Flags } from '../helpers.js';
 import type { Exposes } from '../exposes.js';
 export declare const EXPOSES: Exposes;
 export declare const SCHEMA: FlagSchema;
+/** Reads the paired --x / --no-x flags into a capture patch.
+ *
+ *  Only the fields the operator actually named end up in the object. Sending a
+ *  full `capture` would turn "stop taking screenshots" into "stop taking
+ *  screenshots and start capturing text", silently changing a setting they did
+ *  not mention — on a widget that may be pointed at tenant records. */
+export declare function _captureFrom(flags: Flags): sdkFeedback.WidgetCapture | undefined;
 export declare function list(flags: Flags): Promise<void>;
 export declare function create(bodyArg: string | undefined, flags: Flags): Promise<void>;
 export declare function resolve(id: string, flags: Flags): Promise<void>;

package/dist/commands/feedback.js

@@ -36,7 +36,41 @@ export const SCHEMA = {
     'page-url': 'string',
     route: 'string',
     origins: 'string',
+    // Capture controls. Paired --x / --no-x rather than --x=true|false so that
+    // "unset" stays distinguishable from "set to false": the API treats an absent
+    // key as unchanged, and the CLI must be able to express that.
+    screenshot: 'boolean',
+    'no-screenshot': 'boolean',
+    text: 'boolean',
+    'no-text': 'boolean',
 };
+/** Reads the paired --x / --no-x flags into a capture patch.
+ *
+ *  Only the fields the operator actually named end up in the object. Sending a
+ *  full `capture` would turn "stop taking screenshots" into "stop taking
+ *  screenshots and start capturing text", silently changing a setting they did
+ *  not mention — on a widget that may be pointed at tenant records. */
+export function _captureFrom(flags) {
+    const cap = {};
+    if (flags['no-screenshot'])
+        cap.screenshot = false;
+    else if (flags.screenshot)
+        cap.screenshot = true;
+    if (flags['no-text'])
+        cap.text = false;
+    else if (flags.text)
+        cap.text = true;
+    return Object.keys(cap).length ? cap : undefined;
+}
+/** "on" / "off" for a resolved capture field. The server returns both fields
+ *  resolved, so an undefined here means an older backend that did not answer —
+ *  say so rather than printing "off" for something that is on. */
+function captureLine(c) {
+    if (!c)
+        return '(not reported by this backend)';
+    const s = (v) => v === undefined ? '?' : v ? 'on' : 'off';
+    return `screenshot ${s(c.screenshot)}, text ${s(c.text)}`;
+}
 // The platform's enum, checked against the schema rather than invented.
 const KINDS = ['bug', 'issue', 'suggestion'];
 // A selector says `div#install > button.save`. The context says the button read
@@ -96,6 +130,15 @@ export async function list(flags) {
         const pointing = describeTarget(i);
         if (pointing)
             info(`  pointing at  ${pointing}`);
+        // Whoever the host app named via window.__myapiFeedback.identify(). Opaque
+        // to us — their id for their user, never resolved against anything.
+        //
+        // Printed only when set: an anonymous visitor is still the normal case, and
+        // a blank `from` reads as a failure to capture rather than nobody to name.
+        // Every item filed before 2026-08-19 carries '' — the column existed and
+        // nothing ever wrote it — so most history will show no line here.
+        if (i.end_user_ref)
+            info(`  from         ${i.end_user_ref}`);
         const trace = Array.isArray(i.trace) ? i.trace : [];
         if (trace.length) {
             // Errors and failed requests are the highest-signal part — for most
@@ -197,13 +240,14 @@ export async function widget(sub, arg, flags) {
         const origins = typeof flags.origins === 'string'
             ? flags.origins.split(',').map(s => s.trim()).filter(Boolean)
             : undefined;
-        const w = await sdkFeedback.createWidget(config.api_key, orgId, arg, origins);
+        const w = await sdkFeedback.createWidget(config.api_key, orgId, arg, origins, _captureFrom(flags));
         if (flags.json) {
             printJson(w);
             return;
         }
         success(`Widget created: ${w.id}`);
         info(`Key:  ${w.key}`);
+        info(`Capture: ${captureLine(w.capture)}`);
         info('');
         // Saying this plainly matters: a value that looks like a credential and is
         // not one gets treated as a secret, and then nobody puts it in the page.
@@ -239,12 +283,16 @@ export async function widget(sub, arg, flags) {
                     .filter(Boolean).join(' · ')}`);
             }
             info(`  origins: ${w.allowed_origins?.length ? w.allowed_origins.join(', ') : '(any — anyone can post with this key)'}`);
+            // Listed for the same reason position and label are: the only other way
+            // to read it back was to fetch widget.js and read the JavaScript, which
+            // ImmoPilot reported once already.
+            info(`  capture: ${captureLine(w.capture)}`);
             info('');
         }
         return;
     }
     if (sub === 'update') {
-        requireArg(arg, 'id', 'myapi feedback widget update <id> [--routes /a,/b] [--origins a.com] [--accent #2563eb] [--position bottom-right] [--label "Feedback"]');
+        requireArg(arg, 'id', 'myapi feedback widget update <id> [--routes /a,/b] [--origins a.com] [--accent #2563eb] [--position bottom-right] [--label "Feedback"] [--no-screenshot] [--no-text]');
         const patch = {};
         const csv = (v) => typeof v === 'string' ? v.split(',').map(s => s.trim()).filter(Boolean) : undefined;
         if (flags.routes !== undefined)
@@ -260,8 +308,36 @@ export async function widget(sub, arg, flags) {
         }
         if (Object.keys(theme).length)
             patch.theme = theme;
+        // Read-modify-write, because the backend REPLACES `capture` rather than
+        // merging it. Verified against production 2026-08-20: set
+        // {screenshot:false, text:false}, PATCH {text:true}, and screenshot comes
+        // back TRUE. Only the capture object behaves this way — a name-only PATCH
+        // leaves it untouched — so the request as a whole merges and this field
+        // does not.
+        //
+        // --help and the skill both promise "omitted flags are left alone". Sending
+        // the partial object would make `--no-text` silently switch screenshots
+        // back ON for a widget that had them off: the exact harm this feature
+        // exists to prevent, on the pages it was built for.
+        //
+        // Remove once the backend merges (cross-repo prompt, 2026-08-20): then
+        // `patch.capture = capture` stands alone and the extra read disappears.
+        const capture = _captureFrom(flags);
+        if (capture) {
+            patch.capture = capture;
+            try {
+                const current = (await sdkFeedback.listWidgets(config.api_key, orgId)).find(x => x.id === arg);
+                if (current?.capture)
+                    patch.capture = { ...current.capture, ...capture };
+            }
+            catch {
+                // A failed read must not block the change that was asked for. The
+                // operator still gets what they typed, and the resolved state printed
+                // after the call is the truth either way.
+            }
+        }
         if (Object.keys(patch).length === 0) {
-            error('Nothing to change. Pass at least one of --routes, --origins, --name, --accent, --position, --label.');
+            error('Nothing to change. Pass at least one of --routes, --origins, --name, --accent, --position, --label, --screenshot/--no-screenshot, --text/--no-text.');
         }
         const w = await sdkFeedback.updateWidget(config.api_key, orgId, arg, patch);
         if (flags.json) {
@@ -269,9 +345,13 @@ export async function widget(sub, arg, flags) {
             return;
         }
         success(`Widget ${arg} updated`);
+        // Resolved by the server: both fields, whatever was sent. Print it so the
+        // operator sees what the widget will DO, not what they happened to type.
+        if (w.capture)
+            info(`  capture: ${captureLine(w.capture)}`);
         // The key is unchanged, which is the reason to use this instead of
         // revoke + create — the customer's page does not need editing.
-        info('Same key, so your page needs no change. Route changes reach browsers within ~5 minutes.');
+        info('Same key, so your page needs no change. Route and capture changes reach browsers within ~5 minutes, with no redeploy of your site.');
         return;
     }
     if (sub === 'revoke') {
@@ -282,7 +362,7 @@ export async function widget(sub, arg, flags) {
         info('Feedback already collected through it is kept.');
         return;
     }
-    error('Usage: myapi feedback widget create <name> [--origins <list>]\n       myapi feedback widget list\n       myapi feedback widget update <id> [--routes <list>] [--origins <list>]\n       myapi feedback widget revoke <id>');
+    error('Usage: myapi feedback widget create <name> [--origins <list>] [--no-screenshot] [--no-text]\n       myapi feedback widget list\n       myapi feedback widget update <id> [--routes <list>] [--origins <list>] [--no-screenshot] [--no-text]\n       myapi feedback widget revoke <id>');
 }
 export const SUBCOMMAND_USAGE = {
     'delete': `myapi feedback delete <id> [--yes] [--org <id>]
@@ -300,10 +380,24 @@ Newest first. \`total\` is the number of matches, not the page size.`,
     'resolve': 'myapi feedback resolve <id> [--org <id>]',
     'widget': `myapi feedback widget list
        myapi feedback widget create <name> [--origins a.com,b.com] [--org <id>]
+       myapi feedback widget update <id> [--routes <list>] [--no-screenshot] [--no-text] [--org <id>]
        myapi feedback widget revoke <id> [--yes] [--org <id>]
 
 The key a widget mints is PUBLIC — it ships in page source and authenticates
-nobody. --origins stops another site posting through it.`,
+nobody. --origins stops another site posting through it.
+
+What a report may collect (both on by default):
+  --no-screenshot   Stop photographing the viewport.
+  --no-text         Keep the SHAPE of the element pointed at — tag, role, id,
+                    data-feedback-id — and drop the words inside it. On a table
+                    row that is "row, id row-8" instead of the customer's name.
+Pass --screenshot / --text to turn one back on. Flags you omit are left alone,
+so turning one off never silently changes the other. Changes reach live
+browsers within ~5 minutes, with no redeploy of your site.
+
+To exempt one panel rather than the whole widget, mark it data-feedback-ignore
+in your page: it is skipped in the element context AND blacked out in the
+screenshot.`,
 };
 export async function run(subcommand, args, flags) {
     if (!subcommand || (flags.help && !subcommand)) {
@@ -320,7 +414,7 @@ Subcommands:
   widget create <name> Mint a PUBLIC widget key for a site (--origins to restrict)
   widget list          List widgets with the script tag to paste
   widget revoke <id>   Revoke a widget key; collected feedback is kept
-  widget update <id>   Change routes/origins/theme, keeping the same key
+  widget update <id>   Change routes/origins/theme/capture, keeping the same key
 
 All commands accept --org <id> (or set default: myapi config set-org <id>).`);
         return;

package/dist/errors.js

@@ -26,6 +26,12 @@ export const ERROR_MESSAGES = {
     invalid_org: 'Invalid organization.',
     FORBIDDEN: 'You do not have permission to perform this action.',
     RATE_LIMITED: 'Too many requests. Please wait a moment and try again.',
+    // The backend refuses an unknown key or a non-boolean rather than ignoring it
+    // — `{"screenshots": false}` (plural) is a 422, not a no-op. That is
+    // deliberate: a capture setting accepted and ignored reads as "screenshots
+    // are off" while screenshots keep being taken, on pages that may carry
+    // customer records.
+    INVALID_CAPTURE: 'capture accepts only `screenshot` and `text`, both booleans. Check the spelling — an unknown key is refused, not ignored.',
     BODY_TOO_LARGE: 'The request is over 64 KB — usually an oversized feedback `trace`. Nothing was saved. This used to surface as INVALID_JSON, which sent people looking for a syntax error they did not have.',
     INSUFFICIENT_BALANCE: 'Insufficient balance. Run: myapi billing topup <amount>',
     INVALID_AMOUNT: 'Amount out of range. Maximum single top-up is $100. Run: myapi billing topup <amount>',

package/dist/skills/my-feedback-api/SKILL.md

@@ -1,10 +1,10 @@
 ---
 name: my-feedback-api
-version: 1.5.1
+version: 1.6.0
 description: >
   Collect feedback from the people using what you built. A public widget key lets a page submit without a credential; you list, filter and resolve the results. Kind is chosen by the person reporting, not inferred from their wording.
 triggers: [feedback, bug report, user feedback, feature request, widget, support, complaints, praise]
-checksum: sha256-b1aba273d6d32b4145dcee85fb59fec35f50b257fc41fb8da9f649a0b519e909
+checksum: sha256-f8be1cee17e2dc5e1dcf2310cf18d275982d54460af26a0b642fc46bd8c4691e
 ---
 
 # MyFeedbackAPI
@@ -18,111 +18,129 @@ Two halves: a **widget key** a page embeds, and the **items** it produces.
 
 ### The widget key is public, and that is the point
 
-`myapi feedback widget create <name>` mints a key that ships in your page
-source. It is **not a secret** — it names your org so a visitor can submit
-without signing in, and it authenticates nobody.
+`widget create <name>` mints a key that ships in your page source. It is **not a
+secret** — it names your org so a visitor can submit without signing in, and
+authenticates nobody.
 
-Treating it as a credential is the mistake to avoid: people hide it, and then
-the widget cannot work. What it does need is `--origins`, so another site
-cannot post through it:
+Treating it as a credential is the mistake: people hide it and the widget cannot
+work. It needs `--origins`, so another site cannot post through it:
 
 ```bash
 myapi feedback widget create site --origins app.example.com,example.com
 ```
 
-Revoke with `myapi feedback widget revoke <id>`. Submissions stop immediately;
-feedback already collected is kept.
+Revoke with `myapi feedback widget revoke <id>`: submissions stop immediately,
+collected feedback is kept.
 
 ### Embedding it: one script tag
 
-The platform hosts the widget, compiled per key with that widget's routes and
-theme baked in. This is the intended way in — you do not build a UI:
+The platform hosts the widget, compiled per key with its routes and theme baked
+in. The intended way in — you build no UI:
 
 ```html
 <script src="https://api.myapihq.com/feedback/in/<widget_key>/widget.js" async></script>
 ```
 
-It renders a button and shows itself only on the routes the widget is
-configured for — set them with `widget update <id> --routes /app,/app/**`, and
-the change reaches browsers within ~5 minutes with no redeploy of your site.
+It shows only on the widget's routes — set them with `widget update <id>
+--routes /app,/app/**`; live in ~5 min, no redeploy.
 
-The person points at an element or drags a region, and it sends:
+The person points at an element or drags a region; it sends:
 
 - `kind`, `body`, `page_url`, `route`, `viewport`
-- `target_selector` and `target_region` `{x,y,w,h}` — the region is on **every**
-  report now: the element's bounding rectangle for a click, the dragged box for
-  a drag
-- `target_context` — what the element *was*: its text, role, the heading above it
+- `target_selector` and `target_region` `{x,y,w,h}` — on **every** report: the
+  element's bounding box for a click, the dragged box for a drag
+- `target_context` — what the element *was*: text, role, the heading above it
 - `trace` — the last events before the report
 
-A wrong key does not break the page: the response is `application/javascript`
-carrying a JS comment that names the fix, so a typo cannot throw a syntax error
-in your app.
+A wrong key cannot break the page: the response is `application/javascript`
+with a comment naming the fix, so a typo throws no syntax error.
 
-**Screenshots are automatic — you do not build a capture step.** When someone
-opens the feedback sheet the widget fetches a renderer on demand and attaches
-the picture itself, as a second call after the report is saved. That ordering is
-deliberate: an image that fails to render or upload never costs the report.
+**Screenshots are automatic — you build no capture step.** The widget attaches
+the picture as a second call after the report is saved, so an image that fails
+to render never costs the report.
 
-The image is **stored private in your org's assets**, and listing feedback
-returns a **signed link good for about an hour** (`screenshot_url`). It is
-signed on read, so it is not stable — re-list rather than persisting it. PNG,
-JPEG or WebP up to 3 MB; over that the feedback is kept without the picture.
+The image is **private in your org's assets**; listing returns a **signed link
+good for ~an hour** (`screenshot_url`) — re-list rather than persisting it.
+PNG/JPEG/WebP up to 3 MB; over that the report is kept without it.
 
 ### Submitting by hand (only if you cannot use the script)
 
-`POST https://api.myapihq.com/feedback/in/<widget_key>` — no auth, no SDK.
-Same fields the widget sends:
-
-```js
-await fetch(`https://api.myapihq.com/feedback/in/${WIDGET_KEY}`, {
-  method: 'POST',
-  headers: { 'Content-Type': 'application/json' },
-  body: JSON.stringify({ kind: 'bug', body: text, page_url: location.href }),
-});
-```
+`POST https://api.myapihq.com/feedback/in/<widget_key>` — no auth, no SDK, same
+fields the widget sends (`kind`, `body`, `page_url`, …).
 
 Errors: `WIDGET_NOT_FOUND` (a revoked key reads like an invented one, so keys
 cannot be probed), `ORIGIN_NOT_ALLOWED`, `RATE_LIMITED`, `INVALID_KIND`,
-`BODY_REQUIRED`, `BODY_TOO_LONG` (the text is over 8000 chars) and
-`BODY_TOO_LARGE` (the whole request is over 64 KB, usually an oversized
-`trace`). Nothing is saved in either case. The key only ever writes.
+`BODY_REQUIRED`, `BODY_TOO_LONG` (>8000 chars), `BODY_TOO_LARGE` (>64 KB, usually
+an oversized `trace`). Nothing is saved; the key only writes.
 
 ### Kind is a claim, not a guess
 
-`--kind` is one of `bug`, `issue`, `suggestion`, and it is **what the person
-reporting says it is**. Someone filing a `bug` is telling you
-they believe the product is broken — which is a different and more urgent
+`--kind` is one of `bug`, `issue`, `suggestion`, and it is **what the reporter
+says it is**. A `bug` means they believe the product is broken — a more urgent
 signal than a wish for something new. Do not re-classify from the wording.
 
-Classification and duplicate-grouping exist in the platform's design and are
-not built yet, so treat `kind` as the person's own label rather than a
-processed signal.
+Classification and duplicate-grouping are designed but not built, so treat
+`kind` as the person's own label, not a processed signal.
+
+### Controlling what a report contains
+
+A report carries a screenshot of the viewport plus the text of the element
+pointed at. On a page of customer records, that is the page. Both on by default:
+
+```bash
+myapi feedback widget update <id> --no-screenshot   # stop photographing
+myapi feedback widget update <id> --no-text         # keep SHAPE, drop words
+```
+
+`--no-text` keeps tag, role, id and `data-feedback-id`: on a table row, "row, id
+`row-8`" not the tenant's name. `--screenshot` / `--text` turn one back on.
+Omitted flags are left alone, so one off never changes the other. Live in ~5 min.
+
+**In your page**, two levers only you control:
+
+```js
+window.__myapiFeedback.identify("your-user-id");  // when you learn who it is
+window.__myapiFeedback.identify();                // on sign-out
+```
+
+Callable any time, even long after load. Your id for your user — opaque to us,
+never resolved, posted to a public endpoint: a label, not authentication. Shows
+as `from` in `feedback list`.
+
+Mark an element `data-feedback-ignore` to skip it in the context AND black it out
+in the screenshot.
+
+| Need | Lever |
+|---|---|
+| No pictures at all | `--no-screenshot` |
+| Pictures, no words | `--no-text` |
+| All but one panel | `data-feedback-ignore` |
+| Different rules per page | two widgets, two route sets |
+
+The last row is usually right: capture off on record-bearing routes, on
+elsewhere — not one global switch.
 
 ### Reading it back
 
 Each item carries what was pointed at, how they got there, and a picture.
-`myapi feedback list` summarises that per report — the element's own text rather
-than its CSS selector, a count of steps/errors/failed requests, and whether a
-screenshot exists. `--trace` expands the event list; `--json` passes everything
-through.
-
-Two things not to misread: **`trace[].t` is milliseconds since page load**, not
-a clock time, so it only means anything as a delta within one trace. And
-**`target_context.filled` says an input had a value, never what it was** — the
-widget does not collect it.
-
-`delete` removes the screenshot along with the report, which is the case that
-matters: somebody erasing a report because of what is in the picture.
-
-`myapi feedback list` is newest first, filterable by `--kind` and `--status`
-(`open` | `resolved`), paged with `--limit` / `--offset`. **`total` is the
-number of matches, not the size of the page**, and `has_more` flags a truncated
-result — both describe the whole match set.
-
-`myapi feedback resolve <id>` closes an item. An unknown id answers the same
-way as an already-resolved one, so a success is not proof the item existed —
-that is deliberate, so ids cannot be probed across orgs.
+`list` summarises it — the element's own text rather than its CSS selector,
+counts of steps/errors/failed requests, whether a screenshot exists, and `from`
+when the page called `identify()`. `--trace` expands the events; `--json` passes
+everything through.
+
+Two not to misread: **`trace[].t` is ms since page load**, not clock time — only
+a delta means anything. And **`target_context.filled` says an input had a value,
+never what**.
+
+`delete` removes the screenshot with the report — what matters is somebody
+erasing a report because of what is in the picture.
+
+`list` is newest first, filterable by `--kind`/`--status`, paged with `--limit`
+/ `--offset`. **`total` is the match count, not the page size**; `has_more` flags
+truncation — both describe the whole match set.
+
+`resolve <id>` closes an item. An unknown id answers like an already-resolved
+one, so success is not proof it existed — deliberate, so ids cannot be probed.
 <!-- llm:end -->
 
 ## Commands
@@ -135,7 +153,7 @@ that is deliberate, so ids cannot be probed across orgs.
 | `myapi feedback delete <id>` | Erase an item — for spam, or personal details typed into the box |
 | `myapi feedback widget create <name> [--origins a.com,b.com]` | Mint a PUBLIC widget key for a site |
 | `myapi feedback widget list` | List widgets, each with the script tag to paste |
-| `myapi feedback widget update <id>` | Change `--routes`, `--origins`, `--name`, or the look (`--accent`, `--position`, `--label`), keeping the same key |
+| `myapi feedback widget update <id>` | Change `--routes`, `--origins`, `--name`, look (`--accent`/`--position`/`--label`) or capture (`--no-screenshot`/`--no-text`); same key |
 | `myapi feedback widget revoke <id>` | Revoke a key; collected feedback is kept |
 <!-- generated:end -->
 
@@ -149,16 +167,16 @@ myapi feedback widget create marketing --origins example.com,www.example.com
 # 2. See your widgets and the exact tag to paste
 myapi feedback widget list
 
-# 3. Change where it appears — same key, so your page needs no edit
+# 3. Change where it appears, or what it may collect — same key either way
 myapi feedback widget update <id> --routes /app,/app/**
+myapi feedback widget update <id> --no-screenshot --no-text   # record-bearing routes
 
-# 4. Read what came back, newest first
+# 4. Read what came back, newest first (`from` shows if the page identify()d)
 myapi feedback list --status open
 myapi feedback list --kind bug --limit 20
 
 # 5. Record something yourself (support call, your own testing)
-myapi feedback create "checkout 500s on the second attempt" --kind bug \
-  --route /checkout
+myapi feedback create "checkout 500s on retry" --kind bug --route /checkout
 
 # 6. Close it — or delete it, which also removes its screenshot
 myapi feedback resolve <id>
@@ -168,12 +186,11 @@ myapi feedback delete <id> --yes
 
 ## Notes
 
-- The widget key is public by design — restrict it with `--origins` rather than hiding it.
-- `resolve` is idempotent and deliberately indistinguishable from an unknown id.
+- The widget key is public by design — restrict with `--origins`, don't hide it.
 - Feedback survives widget revocation.
-- **`resolve` keeps, `delete` erases.** A public inbox collects spam and the
-  occasional report with personal details in it; `delete` is how those leave.
-  Both are idempotent and answer the same for an unknown id.
+- **`resolve` keeps, `delete` erases.** A public inbox collects spam and the odd
+  report with personal details in it; `delete` is how those leave. Both are
+  idempotent and answer the same for an unknown id, so ids cannot be probed.
 
 ## HTTP (from deployed code)
 

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@myapihq/cli",
   "license": "Apache-2.0",
-  "version": "2.18.0",
+  "version": "2.19.1",
   "description": "MyAPI command-line interface",
   "repository": {
     "type": "git",
@@ -46,7 +46,7 @@
     "lint:skills:strict": "node scripts/copy-skills.js && node scripts/lint-skills.js --strict"
   },
   "dependencies": {
-    "@myapihq/sdk": "^2.18.0"
+    "@myapihq/sdk": "^2.19.1"
   },
   "devDependencies": {
     "@types/node": "^25.6.0",