@myapihq/cli 2.19.0 → 2.19.1

package/dist/commands/feedback.js

@@ -240,13 +240,14 @@ export async function widget(sub, arg, flags) {
         const origins = typeof flags.origins === 'string'
             ? flags.origins.split(',').map(s => s.trim()).filter(Boolean)
             : undefined;
-        const w = await sdkFeedback.createWidget(config.api_key, orgId, arg, origins);
+        const w = await sdkFeedback.createWidget(config.api_key, orgId, arg, origins, _captureFrom(flags));
         if (flags.json) {
             printJson(w);
             return;
         }
         success(`Widget created: ${w.id}`);
         info(`Key:  ${w.key}`);
+        info(`Capture: ${captureLine(w.capture)}`);
         info('');
         // Saying this plainly matters: a value that looks like a credential and is
         // not one gets treated as a secret, and then nobody puts it in the page.
@@ -282,6 +283,10 @@ export async function widget(sub, arg, flags) {
                     .filter(Boolean).join(' · ')}`);
             }
             info(`  origins: ${w.allowed_origins?.length ? w.allowed_origins.join(', ') : '(any — anyone can post with this key)'}`);
+            // Listed for the same reason position and label are: the only other way
+            // to read it back was to fetch widget.js and read the JavaScript, which
+            // ImmoPilot reported once already.
+            info(`  capture: ${captureLine(w.capture)}`);
             info('');
         }
         return;
@@ -303,8 +308,36 @@ export async function widget(sub, arg, flags) {
         }
         if (Object.keys(theme).length)
             patch.theme = theme;
+        // Read-modify-write, because the backend REPLACES `capture` rather than
+        // merging it. Verified against production 2026-08-20: set
+        // {screenshot:false, text:false}, PATCH {text:true}, and screenshot comes
+        // back TRUE. Only the capture object behaves this way — a name-only PATCH
+        // leaves it untouched — so the request as a whole merges and this field
+        // does not.
+        //
+        // --help and the skill both promise "omitted flags are left alone". Sending
+        // the partial object would make `--no-text` silently switch screenshots
+        // back ON for a widget that had them off: the exact harm this feature
+        // exists to prevent, on the pages it was built for.
+        //
+        // Remove once the backend merges (cross-repo prompt, 2026-08-20): then
+        // `patch.capture = capture` stands alone and the extra read disappears.
+        const capture = _captureFrom(flags);
+        if (capture) {
+            patch.capture = capture;
+            try {
+                const current = (await sdkFeedback.listWidgets(config.api_key, orgId)).find(x => x.id === arg);
+                if (current?.capture)
+                    patch.capture = { ...current.capture, ...capture };
+            }
+            catch {
+                // A failed read must not block the change that was asked for. The
+                // operator still gets what they typed, and the resolved state printed
+                // after the call is the truth either way.
+            }
+        }
         if (Object.keys(patch).length === 0) {
-            error('Nothing to change. Pass at least one of --routes, --origins, --name, --accent, --position, --label.');
+            error('Nothing to change. Pass at least one of --routes, --origins, --name, --accent, --position, --label, --screenshot/--no-screenshot, --text/--no-text.');
         }
         const w = await sdkFeedback.updateWidget(config.api_key, orgId, arg, patch);
         if (flags.json) {
@@ -312,9 +345,13 @@ export async function widget(sub, arg, flags) {
             return;
         }
         success(`Widget ${arg} updated`);
+        // Resolved by the server: both fields, whatever was sent. Print it so the
+        // operator sees what the widget will DO, not what they happened to type.
+        if (w.capture)
+            info(`  capture: ${captureLine(w.capture)}`);
         // The key is unchanged, which is the reason to use this instead of
         // revoke + create — the customer's page does not need editing.
-        info('Same key, so your page needs no change. Route changes reach browsers within ~5 minutes.');
+        info('Same key, so your page needs no change. Route and capture changes reach browsers within ~5 minutes, with no redeploy of your site.');
         return;
     }
     if (sub === 'revoke') {

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@myapihq/cli",
   "license": "Apache-2.0",
-  "version": "2.19.0",
+  "version": "2.19.1",
   "description": "MyAPI command-line interface",
   "repository": {
     "type": "git",
@@ -46,7 +46,7 @@
     "lint:skills:strict": "node scripts/copy-skills.js && node scripts/lint-skills.js --strict"
   },
   "dependencies": {
-    "@myapihq/sdk": "^2.19.0"
+    "@myapihq/sdk": "^2.19.1"
   },
   "devDependencies": {
     "@types/node": "^25.6.0",