@mytegroupinc/myte-core 0.0.31 → 0.0.33

package/README.md

@@ -12,21 +12,30 @@ This package exists so the public wrapper can stay small and versioned cleanly.
 ## Requirements
 
 - Node `18+`
-- `MYTE_API_KEY` for project-scoped commands
-- `MYTEAI_API_KEY` for `myte ai`
-- `git` only when using `query --with-diff`
+- `MYTE_API_KEY` for project-scoped commands
+- `MYTEAI_API_KEY` for `myte ai`
+- `MYTEAI_API_KEY` for `mytecody`
+- `git` only when using `query --with-diff`
 - No runtime npm dependencies. The CLI uses Node 18+ built-ins for env loading, argument parsing, HTTP, and local context serialization.
 
 ## Behavior Summary
 
 - Snapshot-style commands such as `bootstrap`, `sync-qaqc`, `feedback-sync`, and `suggestions sync` write local `MyteCommandCenter` data.
 - `feedback status|edit|assign|archive` writes reviewable local YAML artifacts; `feedback submit|revise|reviews|review` routes them through the backend owner-review membrane.
-- `feedback move|undo|prd-versions|prd-diff|history` calls the project-key Feedback API while leaving lifecycle rules and permissions server-side. `feedback move --feedback-ids` sends one batch move request.
+- `feedback move|comment|undo|prd-versions|prd-diff|history` calls the project-key Feedback API while leaving lifecycle rules and permissions server-side. `feedback move --feedback-ids` sends one batch move request.
 - `feedback validate|apply` remains available for validation and owner-direct apply paths; live authorization, stale checks, and history stay server-side.
 - `query --with-diff` requires project repos to be configured for diff collection and fails fast when no matching local project repo can be resolved.
-- Public package documentation is intentionally minimal. Internal rollout and design notes are not part of the npm package contract.
-
-## Agent Usage Contract
+- Public package documentation is intentionally minimal. Internal rollout and design notes are not part of the npm package contract.
+- `mytecody` is a model-agnostic MyteCody team launcher. It supports `doctor`,
+  `doctor --probe-gateway`, `update --dry-run`, and `update`. On first coding
+  run, it installs the branded MyteCody engine from the Myte release manifest
+  into a user-local Myte cache after signature/hash checks. Coding execution
+  requires that engine, a reachable Myte AI Cody gateway, and `MYTEAI_API_KEY`.
+- The package does not bundle the large MyteCody engine binary. See
+  `THIRD_PARTY_NOTICES.md` and `TRADEMARKS.md` for Codex lineage and Myte brand
+  notices.
+
+## Agent Usage Contract
 
 Coding agents should treat `MYTE_API_KEY` as a project-scoped Project Assistant key:
 
@@ -42,7 +51,8 @@ Coding agents should treat `MYTE_API_KEY` as a project-scoped Project Assistant
 - Use `suggestions revise` only against an existing `suggestion_id`; do not send `change_type` on revisions because the backend keeps the thread's original type.
 - Use `suggestions review` for owner/elevated mission-review decisions: `approve`, `request_changes`, or `reject`.
 - Use `mission archive` for project-key lifecycle archival. Do not send `Archived` through `mission status`; restore archived missions from the web archived-board view.
-- Use `feedback move` only when a direct audited state move is intended and include a concrete `--reason`. Use `--feedback-ids` for batch active-state moves or authorized batch archive.
+- Use `feedback move` only when a direct audited state move is intended and include a concrete `--reason`. Use `--feedback-ids` for batch active-state moves or authorized batch archive.
+- Use `feedback comment --feedback-id <id> --body-file ./comment.md` for text-only feedback-specific implementation notes. Attachments remain web UI only for this project-key endpoint.
 - Do not use the project-key API/CLI to unarchive Feedback. Normal `feedback-sync` excludes archived Feedback; unarchive from the web archived Feedback view.
 - Use `update-team` when an agent needs to leave a project-level implementation note or verification comment.
 
@@ -57,12 +67,16 @@ PRD document contract:
 - `myte-kanban` uploads send `{ ticket_markdown }`, where the leading JSON block contains metadata and the remaining markdown is the PRD body.
 - The backend stores the markdown as `prd_markdown`, mirrors it as PRD text for search/sync, generates a DOCX attachment from it, and marks `prd_format=markdown`.
 - The UI renders the PRD from stored PRD text/document content, not from `description`.
+- Renderer-friendly PRDs should use one `# Title`, `##` sections, concise paragraphs, bullets, GitHub tables/checklists where useful, and fenced code blocks only for real code/config.
+- Do not wrap the whole PRD in a ` ```markdown ` fence. Do not use raw HTML, inline style blocks, or decorative banners.
+- PRD identity is explicit: `myte create-prd` creates a PRD asset with PRD metadata. Generic uploaded `.md`, `.docx`, `.pdf`, and `.txt` files remain normal attachments unless explicitly created as PRDs.
 
-Feedback comment support:
-
-- `feedback-sync` includes existing feedback comment turns in local context.
-- Feedback-specific comment creation exists in the web backend at `/api/feedbacks/<feedback_id>/comments`, protected by JWT/project assignment.
-- There is no project-key CLI command for `myte feedback comment` yet. That requires a Project Assistant feedback-comment route plus npm command before agents should rely on it.
+Feedback comment support:
+
+- `feedback-sync` includes existing feedback comment turns in local context.
+- Feedback-specific comment creation exists in the web backend at `/api/feedbacks/<feedback_id>/comments`, protected by JWT/project assignment.
+- Project-key comment creation is available through `myte feedback comment --feedback-id <id> --body "..."` or `--body-file ./comment.md`.
+- The project-key feedback comment endpoint is text-only in this slice and caps content at 500,000 characters. Use the web UI when comment attachments are required.
 
 ## Mission Action Map
 
@@ -144,9 +158,10 @@ Agent rule: never guess `suggestion_id`. If `mission-ops.yml` is missing or stal
 | `feedback submit` | Sends a local proposal artifact to the backend as a review request. | Does not mutate live feedback before approval. |
 | `feedback revise` | Resubmits the original submitter's request after `request_changes`. | Only valid for the original submitter and `needs_changes` requests. |
 | `feedback reviews` | Lists review requests or fetches one request by `--request-id`. | Read-only; response includes backend permissions. |
-| `feedback review` | Approves, rejects, requests changes, or cancels one review request, or a batch with `--request-ids`. | Backend restricts approval/review decisions to Project Owner or elevated delegate for Feedback scope; batch review uses one grouped notification path. |
-| `feedback move` | Moves a card or batch of cards across allowed board states directly with an audit event. | `--feedback-ids` sends one batch request. Blocked with `pending_feedback_review` while an active linked review request exists; governed states such as archive/reject/deploy/freeze remain backend-authorized. Project-key unarchive is not supported. |
-| `feedback undo` | Reverses an audited board event when there is no conflict. | Backend validates event ownership/project scope and conflict state. |
+| `feedback review` | Approves, rejects, requests changes, or cancels one review request, or a batch with `--request-ids`. | Backend restricts approval/review decisions to Project Owner or elevated delegate for Feedback scope; batch review uses one grouped notification path. |
+| `feedback move` | Moves a card or batch of cards across allowed board states directly with an audit event. | `--feedback-ids` sends one batch request. Blocked with `pending_feedback_review` while an active linked review request exists; governed states such as archive/reject/deploy/freeze remain backend-authorized. Project-key unarchive is not supported. |
+| `feedback comment` | Creates a text-only comment on one Feedback item. | Backend checks project-key access, owner/assigned permission, idempotency, and the 500,000-character content cap. Attachments remain web UI only. |
+| `feedback undo` | Reverses an audited board event when there is no conflict. | Backend validates event ownership/project scope and conflict state. |
 | `feedback prd-versions` | Lists retained PRD baselines/revisions for a feedback item. | Read-only; old S3 objects are retained by reference. |
 | `feedback prd-diff` | Fetches backend-generated text diff for PRD versions. | Read-only; backend controls version access. |
 | `feedback history` | Lists audited feedback board/refinement events. | Read-only; backend checks project access. |
@@ -202,9 +217,10 @@ Mutation routes:
 - `POST /api/project-assistant/feedback-review-requests/batch-review`
 - `POST /api/project-assistant/feedback-review-requests/<request_id>/request-changes`
 - `POST /api/project-assistant/feedback-review-requests/<request_id>/cancel`
-- `POST /api/project-assistant/feedback/<feedback_id>/board-move`
-- `POST /api/project-assistant/feedback/batch-board-move`
-- `POST /api/project-assistant/feedback/<feedback_id>/events/<event_id>/undo`
+- `POST /api/project-assistant/feedback/<feedback_id>/board-move`
+- `POST /api/project-assistant/feedback/batch-board-move`
+- `POST /api/project-assistant/feedback/<feedback_id>/comments`
+- `POST /api/project-assistant/feedback/<feedback_id>/events/<event_id>/undo`
 - `POST /api/project-assistant/suggestions`
 - `POST /api/project-assistant/suggestions/revise`
 - `POST /api/project-assistant/suggestions/review`

package/THIRD_PARTY_NOTICES.md

@@ -0,0 +1,21 @@
+# Third-Party Notices
+
+This package includes the Myte CLI launcher and MyteCody distribution client.
+
+The branded MyteCody engine installed by the launcher is derived from the
+OpenAI Codex open-source project. OpenAI Codex is licensed under the
+Apache License, Version 2.0.
+
+Source lineage tracked for this slice:
+
+- Project: OpenAI Codex
+- Version baseline: `0.139.0`
+- License: Apache-2.0
+- Upstream: https://github.com/openai/codex
+
+The MyteCody engine artifact is distributed separately from this npm package
+through a Myte release manifest. This package verifies the release artifact
+before installing it into the user's Myte-owned local cache.
+
+Myte names, marks, logos, terminal branding, and product design are not part of
+the OpenAI Codex project and remain Myte-owned brand assets.

package/TRADEMARKS.md

@@ -0,0 +1,10 @@
+# Trademarks
+
+Myte, Myte AI, MyteCody, "MYTE CODY - Your Tech Your Way", logo assets, terminal
+animation assets, and related product branding are Myte-owned marks and brand
+assets.
+
+OpenAI and Codex are trademarks or project names of their respective owners.
+MyteCody uses a Codex-derived open-source engine under the applicable open
+source license, but MyteCody is a Myte product surface and is not presented as
+an official OpenAI product.

package/cli.js

@@ -208,9 +208,10 @@ function printHelp() {
     "  myte feedback reviews [--status open|terminal|all] [--request-id <id>] [--json]",
     "  myte feedback review --request-id <id> --action approve|reject|request_changes|cancel [--reason \"...\"] [--json]",
     "  myte feedback review --request-ids \"<id1,id2>\" --action approve|reject|request_changes|cancel [--reason \"...\"] [--json]",
-    "  myte feedback move --feedback-id <id> --to-state in_progress --from-state todo --reason \"...\" [--json]",
-    "  myte feedback move --feedback-ids \"<id1,id2>\" --to-state in_progress --reason \"...\" [--json]",
-    "  myte feedback undo --feedback-id <id> --event-id <id> --reason \"...\" [--json]",
+    "  myte feedback move --feedback-id <id> --to-state in_progress --from-state todo --reason \"...\" [--json]",
+    "  myte feedback move --feedback-ids \"<id1,id2>\" --to-state in_progress --reason \"...\" [--json]",
+    "  myte feedback comment --feedback-id <id> --body \"...\" [--body-file ./comment.md] [--json]",
+    "  myte feedback undo --feedback-id <id> --event-id <id> --reason \"...\" [--json]",
     "  myte feedback prd-versions --feedback-id <id> [--json]",
     "  myte feedback prd-diff --feedback-id <id> --version-id <id> [--compare-to <id>] [--json]",
     "  myte feedback validate --file ./MyteCommandCenter/reviews/feedback/<id>-status.yml [--json]",
@@ -287,6 +288,8 @@ function printHelp() {
     "  - Never put the full PRD in description. The complete PRD must live in the markdown file body",
     "  - Each item carries the full PRD markdown blob as prd_markdown/ticket_markdown",
     "  - Backend stores that blob as the renderable PRD document source, mirrors it for PRD text search/sync, and generates a DOCX attachment",
+    "  - Renderer-friendly PRDs use one # title, ## sections, bullets, GitHub tables/checklists where useful, and code fences only for real code/config",
+    "  - Do not wrap the whole PRD in a ```markdown fence; generic .md/.docx/.pdf/.txt uploads are normal attachments unless created as PRDs",
     "  - PRD DOCX content: the markdown body is stored verbatim",
     "",
     "update-team contract:",
@@ -310,7 +313,7 @@ function printHelp() {
     "  - Archived feedback is intentionally excluded from normal sync; returning it to active work is web UI only",
     "  - Writes project feedback metadata and conversation turns into MyteCommandCenter/data/feedback.yml",
     "  - Stores full PRD context in MyteCommandCenter/PRD/feedback-sync/*.md and points to those files from feedback.yml",
-    "  - Reads existing feedback comments; direct project-key creation of feedback-specific comments is not exposed yet",
+    "  - Reads existing feedback comments and can create text-only feedback-specific comments through the project-key API",
     "",
     "feedback review contract:",
     "  - Draft commands write review artifacts under MyteCommandCenter/reviews/feedback/*.yml for local IDE diff review",
@@ -319,8 +322,9 @@ function printHelp() {
     "  - reviews/review expose owner/delegate approval, rejection, request-changes, and cancel decisions",
     "  - review with --request-ids sends one batch review request; it does not loop single-review calls",
     "  - live lifecycle moves return pending_feedback_review while an active linked review request exists",
-    "  - move/undo operate safe board states directly; governed states remain backend-authorized",
-    "  - move with --feedback-ids sends one batch board move request; it supports active-state moves and authorized archive",
+    "  - move/undo operate safe board states directly; governed states remain backend-authorized",
+    "  - move with --feedback-ids sends one batch board move request; it supports active-state moves and authorized archive",
+    "  - comment creates text-only feedback-specific comments; attachments remain web UI only for this endpoint",
     "  - project-key API/CLI cannot unarchive archived Feedback; use the web archived Feedback view",
     "  - get/history read current feedback snapshots and audited event history through the project-key API",
     "  - prd-versions/prd-diff expose retained PRD versions and backend-generated text diffs",
@@ -336,8 +340,9 @@ function printHelp() {
     "  - revise: resubmit the original submitter's request after request_changes",
     "  - reviews: list open/terminal/all requests or inspect one request",
     "  - review: approve, reject, request_changes, or cancel; backend restricts this to owner/delegate capability",
-    "  - move: direct audited board movement for allowed states; governed transitions remain backend-authorized",
-    "  - undo: reverse an audited board event when conflict checks allow it",
+    "  - move: direct audited board movement for allowed states; governed transitions remain backend-authorized",
+    "  - comment: create a text-only comment on one Feedback item",
+    "  - undo: reverse an audited board event when conflict checks allow it",
     "  - prd-versions: list retained PRD baselines/revisions for a feedback item",
     "  - prd-diff: fetch backend-generated text diff between PRD versions",
     "  - history: list board/refinement events for audit review",
@@ -358,10 +363,11 @@ function printHelp() {
     "  --stdin               Read supported command content from stdin instead of inline text or a file path",
     "  --title <text>        Override PRD title for raw markdown uploads",
     "  --description <text>  Set feedback description/card summary for raw markdown uploads",
-    "  --content <text>      Team update content for update-team",
-    "  --subject <text>      Subject for update-owner or update-client",
+    "  --content <text>      Team update content for update-team",
+    "  --body <text>         Feedback comment body for feedback comment",
+    "  --subject <text>      Subject for update-owner or update-client",
     "  --body-markdown <md>  Markdown body for update-owner or update-client",
-    "  --body-file <path>    Read update-owner or update-client markdown body from a file",
+    "  --body-file <path>    Read feedback comment, update-owner, or update-client markdown body from a file",
     "  --target-contact-id   Add one client contact ObjectId (repeatable)",
     "  --target-contact-ids  Comma-separated client contact ObjectIds",
     "  --feedback-id <id>    Feedback ObjectId for feedback review commands",
@@ -415,9 +421,10 @@ function printHelp() {
     "  myte feedback status --feedback-id 507f1f77bcf86cd799439011 --status in_review --reason \"Ready for owner review\"",
     "  myte feedback submit --file ./MyteCommandCenter/reviews/feedback/507f1f77bcf86cd799439011-edit.yml --json",
     "  myte feedback reviews --status open --json",
-    "  myte feedback review --request-id 507f1f77bcf86cd799439022 --action approve --reason \"Looks correct\" --json",
-    "  myte feedback move --feedback-id 507f1f77bcf86cd799439011 --to-state in_progress --reason \"Started\" --json",
-    "  myte feedback validate --file ./MyteCommandCenter/reviews/feedback/507f1f77bcf86cd799439011-status.yml --json",
+    "  myte feedback review --request-id 507f1f77bcf86cd799439022 --action approve --reason \"Looks correct\" --json",
+    "  myte feedback move --feedback-id 507f1f77bcf86cd799439011 --to-state in_progress --reason \"Started\" --json",
+    "  myte feedback comment --feedback-id 507f1f77bcf86cd799439011 --body \"Implementation notes are ready for review.\" --json",
+    "  myte feedback validate --file ./MyteCommandCenter/reviews/feedback/507f1f77bcf86cd799439011-status.yml --json",
     "  myte feedback apply --file ./MyteCommandCenter/reviews/feedback/507f1f77bcf86cd799439011-status.yml --json",
     "  myte suggestions create --file ./suggestions/create.yml",
     "  myte suggestions revise",
@@ -1968,7 +1975,7 @@ async function postFeedbackBoardMutation({ apiBase, key, timeoutMs, feedbackId,
   return body.data || {};
 }
 
-async function postFeedbackBatchBoardMutation({ apiBase, key, timeoutMs, payload, idempotencyKey, clientSessionId }) {
+async function postFeedbackBatchBoardMutation({ apiBase, key, timeoutMs, payload, idempotencyKey, clientSessionId }) {
   const fetchFn = await getFetch();
   const url = `${apiBase}/project-assistant/feedback/batch-board-move`;
   const { resp, body } = await fetchJsonWithTimeout(
@@ -1994,10 +2001,39 @@ async function postFeedbackBatchBoardMutation({ apiBase, key, timeoutMs, payload
     err.data = body?.data;
     throw err;
   }
-  return body.data || {};
-}
-
-async function fetchFeedbackPrdVersions({ apiBase, key, timeoutMs, feedbackId }) {
+  return body.data || {};
+}
+
+async function postFeedbackComment({ apiBase, key, timeoutMs, feedbackId, payload, idempotencyKey, clientSessionId }) {
+  const fetchFn = await getFetch();
+  const url = `${apiBase}/project-assistant/feedback/${encodeURIComponent(String(feedbackId || ""))}/comments`;
+  const { resp, body } = await fetchJsonWithTimeout(
+    fetchFn,
+    url,
+    {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json",
+        Authorization: `Bearer ${key}`,
+        "X-Idempotency-Key": String(idempotencyKey || "").trim(),
+        ...(String(clientSessionId || "").trim() ? { "X-Client-Session-Id": String(clientSessionId).trim() } : {}),
+      },
+      body: JSON.stringify(payload || {}),
+    },
+    timeoutMs
+  );
+
+  if (!resp.ok || body.status !== "success") {
+    const msg = body?.message || `Feedback comment failed (${resp.status})`;
+    const err = new Error(msg);
+    err.status = resp.status;
+    err.data = body?.data;
+    throw err;
+  }
+  return body.data || {};
+}
+
+async function fetchFeedbackPrdVersions({ apiBase, key, timeoutMs, feedbackId }) {
   const fetchFn = await getFetch();
   const url = `${apiBase}/project-assistant/feedback/${encodeURIComponent(String(feedbackId || ""))}/prd/versions`;
   const { resp, body } = await fetchJsonWithTimeout(
@@ -3401,25 +3437,25 @@ function writeFeedbackSnapshot({ snapshot, wrapperRoot, outputDir }) {
   let prdFileCount = 0;
   const materializedItems = items.map((rawItem, index) => {
     const item = isPlainObject(rawItem) ? { ...rawItem } : {};
-    const feedbackId = stableItemId(item, ["feedback_id", "id"], `F${String(index + 1).padStart(3, "0")}`);
-    const conversationTurns = normalizeFeedbackConversationTurns(item.conversation_turns);
-    const prdText = String(item.prd_text || "").trim();
-    const attachmentDocuments = Array.isArray(item.attachment_documents) ? item.attachment_documents : [];
-
-    let contextSource = "description_only";
-    let contextNote = "No separate PRD. Use feedback_text as the context for this feedback item.";
-    let prdFile = null;
+    const feedbackId = stableItemId(item, ["feedback_id", "id"], `F${String(index + 1).padStart(3, "0")}`);
+    const conversationTurns = normalizeFeedbackConversationTurns(item.conversation_turns);
+    const prdText = String(item.prd_text || "").trim();
+    const attachmentDocuments = Array.isArray(item.attachment_documents) ? item.attachment_documents : [];
+
+    let contextSource = "description_only";
+    let contextNote = "No separate PRD. Use feedback_text as the context for this feedback item.";
+    let prdFile = null;
 
     if (prdText) {
       const prdFilename = `${sanitizeFileSegment(feedbackId, `feedback-${index + 1}`)}.md`;
-      const prdPath = path.join(prdSyncDir, prdFilename);
-      writeTextFile(prdPath, ensureTrailingNewline(prdText));
-      prdFile = toPosixRelativePath(targetRoot, prdPath);
-      contextSource = attachmentDocuments.length > 0 ? "attachment_file" : "prd_file";
-      contextNote = attachmentDocuments.length > 0
-        ? "Readable feedback attachment documents are stored in the linked file."
-        : "Full PRD context is stored in the linked file.";
-      prdFileCount += 1;
+      const prdPath = path.join(prdSyncDir, prdFilename);
+      writeTextFile(prdPath, ensureTrailingNewline(prdText));
+      prdFile = toPosixRelativePath(targetRoot, prdPath);
+      contextSource = attachmentDocuments.length > 0 ? "attachment_file" : "prd_file";
+      contextNote = attachmentDocuments.length > 0
+        ? "Readable feedback attachment documents are stored in the linked file."
+        : "Full PRD context is stored in the linked file.";
+      prdFileCount += 1;
     } else if (item.has_prd_text) {
       contextSource = "prd_declared_but_unavailable";
       contextNote = "A separate PRD exists for this feedback item, but readable PRD text was not included in this sync snapshot.";
@@ -5086,13 +5122,33 @@ function resolveFeedbackRequestIdArg(args) {
   return firstNonEmptyString(args["request-id"], args.requestId, args.request_id, args._?.[1]);
 }
 
-function resolveFeedbackEventIdArg(args) {
-  return firstNonEmptyString(args["event-id"], args.eventId, args.event_id, args._?.[1]);
-}
+function resolveFeedbackEventIdArg(args) {
+  return firstNonEmptyString(args["event-id"], args.eventId, args.event_id, args._?.[1]);
+}
 
-function resolveFeedbackVersionIdArg(args) {
-  return firstNonEmptyString(args["version-id"], args.versionId, args.version_id, args._?.[1]);
-}
+function resolveFeedbackVersionIdArg(args) {
+  return firstNonEmptyString(args["version-id"], args.versionId, args.version_id, args._?.[1]);
+}
+
+async function resolveFeedbackCommentContent(args, feedbackId) {
+  const explicit = firstNonEmptyString(args.body, args.content, args["body-markdown"], args.bodyMarkdown, args.body_markdown);
+  if (explicit) return explicit;
+
+  const bodyFile = firstNonEmptyString(args["body-file"], args.bodyFile, args.body_file);
+  if (bodyFile) {
+    const bodyPath = resolveInputFile(bodyFile, "Feedback comment body");
+    return fs.readFileSync(bodyPath, "utf8");
+  }
+
+  if (args.stdin) {
+    return readStdinText();
+  }
+
+  const positionals = Array.isArray(args._) ? args._.slice(1) : [];
+  const feedbackIdFromPositional = positionals[0] && String(positionals[0]) === String(feedbackId);
+  const textParts = feedbackIdFromPositional ? positionals.slice(1) : positionals;
+  return textParts.join(" ");
+}
 
 function summarizeFeedbackReviewRequestPayload(data) {
   const request = data?.request || data || {};
@@ -5451,7 +5507,7 @@ async function runFeedbackReviewDecision(args) {
   if (postSync?.error) console.error(`Feedback sync warning: ${postSync.error}`);
 }
 
-async function runFeedbackMove(args) {
+async function runFeedbackMove(args) {
   const key = getProjectApiKey();
   if (!key) {
     console.error("Missing MYTE_API_KEY (project key) in environment/.env");
@@ -5557,9 +5613,85 @@ async function runFeedbackMove(args) {
   console.log(`State: ${data.feedback_state || toState}`);
   if (data.event?.event_id) console.log(`Event: ${data.event.event_id}`);
   if (postSync?.error) console.error(`Feedback sync warning: ${postSync.error}`);
-}
-
-async function runFeedbackUndo(args) {
+}
+
+async function runFeedbackComment(args) {
+  const key = getProjectApiKey();
+  if (!key) {
+    console.error("Missing MYTE_API_KEY (project key) in environment/.env");
+    process.exit(1);
+  }
+  const feedbackId = resolveFeedbackIdArg(args);
+  if (!feedbackId) {
+    console.error("Missing --feedback-id.");
+    process.exit(1);
+  }
+
+  const content = String(await resolveFeedbackCommentContent(args, feedbackId) || "").trim();
+  if (!content) {
+    console.error("Missing feedback comment body. Use --body, --body-file, --stdin, or positional text.");
+    process.exit(1);
+  }
+
+  const payload = { content };
+  const timeoutMs = resolveTimeoutMs(args);
+  const apiBase = resolveApiBase(args);
+  const clientSessionId = firstNonEmptyString(args["client-session-id"], args.clientSessionId, args.client_session_id);
+  if (clientSessionId) payload.client_session_id = clientSessionId;
+  const idempotencyKey = resolveProjectMutationIdempotencyKey({
+    args,
+    operation: `feedback_comment_create:${feedbackId}`,
+    payload,
+  });
+
+  if (args["print-context"] || args.printContext || args["dry-run"] || args.dryRun) {
+    console.log(JSON.stringify(payload, null, 2));
+    return;
+  }
+
+  let data;
+  try {
+    data = await postFeedbackComment({
+      apiBase,
+      key,
+      timeoutMs,
+      feedbackId,
+      payload,
+      idempotencyKey,
+      clientSessionId,
+    });
+  } catch (err) {
+    if (args.json) {
+      console.log(JSON.stringify({ ok: false, status: err?.status || null, message: err?.message || String(err), data: err?.data || null }, null, 2));
+    } else {
+      console.error("Feedback comment failed:", err?.message || err);
+      if (err?.data) console.error(JSON.stringify(err.data, null, 2));
+    }
+    process.exit(1);
+  }
+
+  const postSync = await refreshFeedbackSnapshotAfterMutation(args, { apiBase, key, timeoutMs });
+  if (args.json) {
+    console.log(JSON.stringify({ ok: true, ...data, post_sync: postSync }, null, 2));
+    return;
+  }
+
+  if (data.comment_id) console.log(`Comment ID: ${data.comment_id}`);
+  console.log(`Feedback: ${data.feedback_id || feedbackId}`);
+  if (data.project_id) console.log(`Project ID: ${data.project_id}`);
+  if (data.user_name) console.log(`Author: ${data.user_name}`);
+  if (data.created_at) console.log(`Created At: ${data.created_at}`);
+  if (data.content) {
+    const body = String(data.content);
+    const truncated = body.length > 2000 ? `${body.slice(0, 2000)}\n...[truncated]` : body;
+    console.log("Content:");
+    console.log(truncated);
+  }
+  if (postSync?.data_root) console.log(`Synced feedback: ${postSync.data_root}`);
+  if (postSync?.error) console.error(`Feedback sync warning: ${postSync.error}`);
+}
+
+async function runFeedbackUndo(args) {
   const key = getProjectApiKey();
   if (!key) {
     console.error("Missing MYTE_API_KEY (project key) in environment/.env");
@@ -5754,11 +5886,15 @@ async function runFeedback(args) {
     await runFeedbackReviewDecision(args);
     return;
   }
-  if (subcommand === "move") {
-    await runFeedbackMove(args);
-    return;
-  }
-  if (subcommand === "undo") {
+  if (subcommand === "move") {
+    await runFeedbackMove(args);
+    return;
+  }
+  if (subcommand === "comment" || subcommand === "comments") {
+    await runFeedbackComment(args);
+    return;
+  }
+  if (subcommand === "undo") {
     await runFeedbackUndo(args);
     return;
   }
@@ -5774,7 +5910,7 @@ async function runFeedback(args) {
     await runFeedbackGetOrHistory(args, subcommand);
     return;
   }
-  console.error("Unknown feedback command. Use status, edit, assign, archive, submit, revise, reviews, review, move, undo, prd-versions, prd-diff, get, history, validate, or apply.");
+  console.error("Unknown feedback command. Use status, edit, assign, archive, submit, revise, reviews, review, move, comment, undo, prd-versions, prd-diff, get, history, validate, or apply.");
   process.exit(1);
 }
 

package/lib/mytecody-release-public-key.pem

@@ -0,0 +1,11 @@
+-----BEGIN PUBLIC KEY-----
+MIIBojANBgkqhkiG9w0BAQEFAAOCAY8AMIIBigKCAYEAi+YAnayqofu0kdLQlgO3
+TWcyp6NC6U5O8/MPubmqv36Zg9yHca/PndK+yvIiFqi6ReYziM9x2xb7mPlfZ+ia
+EBz7WPvd9OFUOxSngsHOAaM7jYwGzCdbJm+aJ/4NXw7kjv22Sj7FtOrJUFbA3ePW
+WZIXiyl1MH144sHAG8hkPvTov/BIiEGh2G0IDUXH0n4Ksab+FQp/Z+MDRoxwhqEP
+HlqJwhF6vQhfq1nFHFetaop8y0DoFe5AFXLOMdgPq90gYkVTe+9PFIx8ISi+0RyN
+6dS0sEb3Z0frLGyzDxgtJseGGCe5XWyxVfBCb/uztB395EtIB4ZWHi4Oyy9XcP3c
+hPGJgJiX83tSgVO/bQzk43Yl/LIKBxh1mFa9zJACU7Gx0s4DvwBug5rZvpAUddgX
+v7v/8kjN/YYLwSf+VsMZ+Vedy51dPkwyCVOUk8y1MW1vvwaLFYfqVAJ//FNjC+Jf
+51G2zxYxLXcDOFvvrra988Ng4ybfDMOy/qalWxHU0AOpAgMBAAE=
+-----END PUBLIC KEY-----