feedbackbasket-cli 0.10.0 → 0.11.0

package/README.md

@@ -39,6 +39,7 @@ feedbackbasket feedback list --category BUG --agent
 feedbackbasket feedback create "Login button is broken" --content "Clicking Log in does nothing in Safari." --project myapp --type bug --agent
 feedbackbasket feedback update <id> --status PLANNED --agent
 feedbackbasket widget script myproject --agent
+feedbackbasket mobile setup myproject --bundle-id com.example.app --include-publishable-key --agent
 ```
 
 When installing or configuring a widget for the current app, agents should not rely on the CLI default project. First run `feedbackbasket projects list --agent`, match the current app by its real website URL or clearly matching project name, and only create a new project after confirming no existing project belongs to this app. If the only known URL is `localhost`, ask for the production, staging, preview, or intended public URL before creating the project.
@@ -100,6 +101,7 @@ feedbackbasket feedback update <id> --status PLANNED       # Update status
 feedbackbasket feedback update <id> --category BUG         # Update category
 feedbackbasket feedback reply <id> "Thanks!" --delivery email --reply-to support@example.com
 feedbackbasket feedback reply <id> "Thanks!" --delivery widget
+feedbackbasket feedback reply <id> "Thanks!" --delivery in-app
 feedbackbasket feedback reply <id> "Thanks!" --delivery both --reply-to support@example.com
 feedbackbasket feedback replies <id>                       # List sent replies
 feedbackbasket feedback note <id> "Investigating this..."  # Add internal note
@@ -202,6 +204,34 @@ The default widget experience is a basic modal. Only switch to popup mode or ena
 }
 ```
 
+### Mobile Apps
+
+Mobile setup is additive and does not change the website widget. The `fb_mobile_` value is a publishable, write-only project identifier designed to ship in an app; it is not a CLI token or private API key. Mobile commands mask it unless `--include-publishable-key` is explicitly supplied.
+
+```bash
+# Enable mobile feedback and add allowed iOS bundle IDs
+feedbackbasket mobile setup myapp --bundle-id com.example.app
+
+# Return the publishable key and hosted form URL for an authorized app setup
+feedbackbasket mobile setup myapp --bundle-id com.example.app --include-publishable-key --agent
+
+# Inspect and verify the SDK heartbeat
+feedbackbasket mobile status myapp
+feedbackbasket mobile verify myapp --bundle-id com.example.app --wait 120
+
+# Add or remove bundle IDs without replacing the others
+feedbackbasket mobile bundle-ids myapp --add com.example.app.beta
+feedbackbasket mobile bundle-ids myapp --remove com.example.app.beta
+
+# Actions that can interrupt installed apps require explicit confirmation
+feedbackbasket mobile disable myapp --yes
+feedbackbasket mobile rotate-key myapp --yes --include-publishable-key
+```
+
+Agents should never repeat the full publishable key in their final response. They must never place `fb_cli_` or `fb_key_` credentials in a mobile app. Key rotation invalidates the previous key and therefore requires explicit user authorization.
+
+The native Swift SDK securely stores reply-thread credentials in the app Keychain and shows team replies in the same feedback sheet. Host apps do not need to build an inbox or manage reply tokens. Hosted-form integrations remain email-only.
+
 ### Team
 
 ```bash

package/dist/src/cli.js

@@ -12,6 +12,7 @@ import { createSetupCommand } from './commands/setup.js';
 import { createWidgetCommand } from './commands/widget.js';
 import { createTeamCommand } from './commands/team.js';
 import { createWaitlistCommand } from './commands/waitlist.js';
+import { createMobileCommand } from './commands/mobile.js';
 import { renderRootHelp } from './help.js';
 let writer;
 function resolveFormat(opts) {
@@ -64,6 +65,7 @@ export function run() {
     program.addCommand(createBugsCommand(getWriter));
     program.addCommand(createWidgetCommand(getWriter));
     program.addCommand(createWaitlistCommand(getWriter));
+    program.addCommand(createMobileCommand(getWriter));
     program.addCommand(createTeamCommand(getWriter));
     program.addCommand(createDoctorCommand(getWriter));
     program.addCommand(createSetupCommand(getWriter));

package/dist/src/client.d.ts

@@ -1,4 +1,4 @@
-import type { ProjectsResponse, FeedbackResponse, BugReportsResponse, FeedbackParams, FeedbackCreateInput, FeedbackCreateResponse, FeedbackReplyResponse, BugReportParams, UserProfile, Project, Feedback, WidgetSettings, WaitlistResponse } from './types.js';
+import type { ProjectsResponse, FeedbackResponse, BugReportsResponse, FeedbackParams, FeedbackCreateInput, FeedbackCreateResponse, FeedbackReplyResponse, BugReportParams, UserProfile, Project, Feedback, WidgetSettings, WaitlistResponse, MobileIntegrationResponse } from './types.js';
 export declare class FeedbackBasketClient {
     private readonly apiBaseUrl;
     private readonly token;
@@ -53,6 +53,13 @@ export declare class FeedbackBasketClient {
         embedCode: string;
         scriptUrl: string;
     }>;
+    getMobileIntegration(projectId: string, includePublishableKey?: boolean): Promise<MobileIntegrationResponse>;
+    updateMobileIntegration(projectId: string, data: {
+        enabled?: boolean;
+        addBundleIds?: string[];
+        removeBundleIds?: string[];
+    }, includePublishableKey?: boolean): Promise<MobileIntegrationResponse>;
+    rotateMobileProjectKey(projectId: string, includePublishableKey?: boolean): Promise<MobileIntegrationResponse>;
     getWaitlist(projectId: string, params?: {
         search?: string;
         limit?: number;

package/dist/src/client.js

@@ -56,6 +56,19 @@ export class FeedbackBasketClient {
     async getWidgetScript(projectId) {
         return this.request('GET', `/projects/${encodeURIComponent(projectId)}/widget-script`);
     }
+    // Mobile feedback
+    async getMobileIntegration(projectId, includePublishableKey = false) {
+        const query = includePublishableKey ? '?includePublishableKey=true' : '';
+        return this.request('GET', `/projects/${encodeURIComponent(projectId)}/mobile${query}`);
+    }
+    async updateMobileIntegration(projectId, data, includePublishableKey = false) {
+        const query = includePublishableKey ? '?includePublishableKey=true' : '';
+        return this.request('PATCH', `/projects/${encodeURIComponent(projectId)}/mobile${query}`, data);
+    }
+    async rotateMobileProjectKey(projectId, includePublishableKey = false) {
+        const query = includePublishableKey ? '?includePublishableKey=true' : '';
+        return this.request('POST', `/projects/${encodeURIComponent(projectId)}/mobile/rotate-key${query}`);
+    }
     async getWaitlist(projectId, params = {}) {
         const query = buildQuery(params);
         return this.request('GET', `/projects/${encodeURIComponent(projectId)}/waitlist${query}`);

package/dist/src/commands/feedback-reply.d.ts

@@ -1,4 +1,6 @@
 import { Command } from 'commander';
 import type { OutputWriter } from '../output/writer.js';
+import type { ReplyDelivery } from '../types.js';
 export declare function createFeedbackReplyCommand(getWriter: () => OutputWriter): Command;
 export declare function createFeedbackRepliesCommand(getWriter: () => OutputWriter): Command;
+export declare function replyDestinations(delivery: ReplyDelivery): Array<'email' | 'widget'>;

package/dist/src/commands/feedback-reply.js

@@ -5,14 +5,14 @@ import { loadConfig } from '../config/config.js';
 import { errAuth, errUsage } from '../output/errors.js';
 import { brand } from '../output/theme.js';
 import { ask } from '../prompt.js';
-const deliveryOptions = new Set(['email', 'widget', 'both']);
+const deliveryOptions = new Set(['email', 'widget', 'in-app', 'both']);
 export function createFeedbackReplyCommand(getWriter) {
     return new Command('reply')
         .argument('<id>', 'Feedback ID to reply to')
         .argument('[content]', 'Reply content (or use --content)')
-        .description('Reply to feedback by email, widget thread, or both')
+        .description('Reply to feedback by email, widget/in-app thread, or both')
         .option('--content <text>', 'Reply content (alternative to positional argument)')
-        .option('--delivery <delivery>', 'Reply delivery (email, widget, both)', 'email')
+        .option('--delivery <delivery>', 'Reply delivery (email, widget, in-app, both)', 'email')
         .option('--reply-to <email>', 'Reply-to email for email delivery')
         .action(async (id, contentArg, opts) => {
         const writer = getWriter();
@@ -22,19 +22,22 @@ export function createFeedbackReplyCommand(getWriter) {
             throw errUsage('Reply content is required', 'Example: feedbackbasket feedback reply <id> "Thanks for reporting this!" --delivery widget');
         }
         if (!deliveryOptions.has(delivery)) {
-            throw errUsage('Delivery must be email, widget, or both', 'Example: feedbackbasket feedback reply <id> "Thanks!" --delivery both --reply-to support@example.com');
+            throw errUsage('Delivery must be email, widget, in-app, or both', 'Example: feedbackbasket feedback reply <id> "Thanks!" --delivery both --reply-to support@example.com');
         }
         const client = requireClient();
         const feedback = await client.getFeedbackById(id);
-        const destinations = delivery === 'both'
-            ? ['email', 'widget']
-            : [delivery];
+        if (delivery === 'in-app' && feedback.replyChannel !== 'in_app') {
+            throw errUsage('This feedback does not have an in-app reply thread.', 'Use --delivery widget for website-widget feedback or --delivery email when an email address is available.');
+        }
+        const destinations = replyDestinations(delivery);
         const sendsEmail = destinations.includes('email');
         const sendsWidget = destinations.includes('widget');
         let replyTo = opts.replyTo ?? feedback.project.replyToEmail ?? undefined;
         if (sendsEmail) {
             if (!feedback.email) {
-                throw errUsage('This feedback has no email address; use --delivery widget if it has a widget thread.');
+                throw errUsage(feedback.replyChannel === 'in_app'
+                    ? 'This feedback has no email address; use --delivery in-app.'
+                    : 'This feedback has no email address; use --delivery widget if it has a widget thread.');
             }
             if (!replyTo) {
                 const isInteractive = !writer.isMachineOutput() && process.stdin.isTTY;
@@ -56,7 +59,7 @@ export function createFeedbackReplyCommand(getWriter) {
             }
         }
         if (sendsWidget && !feedback.hasWidgetAccess) {
-            throw errUsage('This feedback is not connected to a widget thread.', 'Use --delivery email for feedback with an email address, or ask the human how they want to respond.');
+            throw errUsage('This feedback has no in-app or widget reply thread.', 'Use --delivery email for feedback with an email address, or ask the human how they want to respond.');
         }
         const result = await client.sendReply(id, content, {
             replyToEmail: replyTo,
@@ -71,16 +74,16 @@ export function createFeedbackReplyCommand(getWriter) {
                 }
             }
             if (result.message) {
-                console.log(`  ${brand.success('[OK]')} Widget reply posted`);
+                console.log(`  ${brand.success('[OK]')} ${feedback.replyChannel === 'in_app' ? 'In-app' : 'Widget'} reply posted`);
                 console.log(`    ${brand.muted('By:')}   ${result.message.sentByName ?? 'CLI'}`);
             }
             console.log();
         }
         writer.ok(result, {
             summary: delivery === 'both'
-                ? 'Reply sent by email and widget'
-                : delivery === 'widget'
-                    ? 'Widget reply posted'
+                ? `Reply sent by email and ${feedback.replyChannel === 'in_app' ? 'in-app' : 'widget'}`
+                : sendsWidget
+                    ? `${feedback.replyChannel === 'in_app' ? 'In-app' : 'Widget'} reply posted`
                     : `Reply sent to ${result.sentTo}`,
             breadcrumbs: [
                 { action: 'View replies', cmd: `feedbackbasket feedback replies ${id}` },
@@ -139,6 +142,13 @@ export function createFeedbackRepliesCommand(getWriter) {
         });
     });
 }
+export function replyDestinations(delivery) {
+    if (delivery === 'both')
+        return ['email', 'widget'];
+    if (delivery === 'in-app')
+        return ['widget'];
+    return [delivery];
+}
 function requireClient() {
     const manager = new AuthManager();
     const token = manager.resolveToken();

package/dist/src/commands/feedback.js

@@ -186,7 +186,7 @@ function renderFeedbackDetail(item) {
         ['OS', item.os],
         ['Device', item.device],
         ['Language', item.language],
-        ['Widget Thread', item.hasWidgetAccess ? 'Yes' : null],
+        ['Reply Channel', item.replyChannel === 'in_app' ? 'In-app' : item.hasWidgetAccess ? 'Widget' : null],
         ['Created', item.createdAt],
     ];
     for (const [label, value] of fields) {

package/dist/src/commands/mobile.d.ts

@@ -0,0 +1,7 @@
+import { Command } from 'commander';
+import type { MobileIntegrationResponse } from '../types.js';
+import type { OutputWriter } from '../output/writer.js';
+export declare function createMobileCommand(getWriter: () => OutputWriter): Command;
+export declare function projectRef(projectArg: string | undefined, projectId: string): string;
+export declare function validateBundleIds(bundleIds: string[]): string[];
+export declare function isMobileConnectionVerified(result: MobileIntegrationResponse, expectedBundleId?: string): boolean;

package/dist/src/commands/mobile.js

@@ -0,0 +1,292 @@
+import { Command } from 'commander';
+import { FeedbackBasketClient } from '../client.js';
+import { AuthManager } from '../auth/manager.js';
+import { loadConfig } from '../config/config.js';
+import { errAuth, errUsage } from '../output/errors.js';
+import { brand, divider } from '../output/theme.js';
+import { confirm } from '../prompt.js';
+import { resolveProject } from '../resolve.js';
+const BUNDLE_ID_PATTERN = /^[A-Za-z0-9-]+(?:\.[A-Za-z0-9-]+)+$/;
+const SAFE_PROJECT_REF_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._-]*(?: [A-Za-z0-9][A-Za-z0-9._-]*)*$/;
+const VERIFY_POLL_INTERVAL_MS = 5_000;
+const MAX_VERIFY_WAIT_SECONDS = 300;
+export function createMobileCommand(getWriter) {
+    const mobile = new Command('mobile')
+        .description('Set up and verify mobile app feedback');
+    mobile
+        .command('status [project]')
+        .description('Show mobile feedback configuration and connection status')
+        .option('--include-publishable-key', 'Include the full publishable mobile project key')
+        .action(async (projectArg, opts) => {
+        const writer = getWriter();
+        const client = requireClient();
+        const projectId = await resolveProjectId(client, projectArg);
+        const ref = projectRef(projectArg, projectId);
+        const result = await client.getMobileIntegration(projectId, Boolean(opts.includePublishableKey));
+        if (!writer.isMachineOutput())
+            renderMobileStatus(result);
+        writer.ok(result, {
+            summary: `Mobile feedback for "${result.project.name}"`,
+            breadcrumbs: result.integration
+                ? [
+                    { action: 'Verify SDK connection', cmd: `feedbackbasket mobile verify ${ref}` },
+                    { action: 'Add a bundle ID', cmd: `feedbackbasket mobile bundle-ids ${ref} --add com.example.app` },
+                ]
+                : [
+                    { action: 'Enable mobile feedback', cmd: `feedbackbasket mobile setup ${ref}` },
+                ],
+        });
+    });
+    mobile
+        .command('setup [project]')
+        .description('Enable mobile feedback and add allowed bundle IDs')
+        .option('--bundle-id <bundle-id>', 'Allowed iOS bundle ID (repeatable)', collect, [])
+        .option('--include-publishable-key', 'Include the full publishable key required to configure the app')
+        .action(async (projectArg, opts) => {
+        const writer = getWriter();
+        const client = requireClient();
+        const projectId = await resolveProjectId(client, projectArg);
+        const bundleIds = validateBundleIds(opts.bundleId);
+        const result = await client.updateMobileIntegration(projectId, { enabled: true, addBundleIds: bundleIds }, Boolean(opts.includePublishableKey));
+        if (!writer.isMachineOutput()) {
+            console.log(`  ${brand.success('✓')} Mobile feedback enabled for ${brand.bold(result.project.name)}`);
+            if (!opts.includePublishableKey) {
+                console.log(`  ${brand.muted('The publishable key is masked. Re-run with --include-publishable-key when configuring the app.')}`);
+            }
+            console.log();
+        }
+        const ref = projectRef(projectArg, projectId);
+        writer.ok(withSetupGuidance(result), {
+            summary: `Mobile feedback ready for "${result.project.name}"`,
+            breadcrumbs: [
+                { action: 'Check connection', cmd: `feedbackbasket mobile verify ${ref}` },
+                { action: 'View mobile status', cmd: `feedbackbasket mobile status ${ref}` },
+            ],
+        });
+    });
+    mobile
+        .command('bundle-ids [project]')
+        .description('Add or remove allowed iOS bundle IDs')
+        .option('--add <bundle-id>', 'Bundle ID to add (repeatable)', collect, [])
+        .option('--remove <bundle-id>', 'Bundle ID to remove (repeatable)', collect, [])
+        .action(async (projectArg, opts) => {
+        const writer = getWriter();
+        const client = requireClient();
+        const additions = validateBundleIds(opts.add);
+        const removals = validateBundleIds(opts.remove);
+        if (additions.length === 0 && removals.length === 0) {
+            throw errUsage('Pass at least one --add or --remove bundle ID', 'Example: feedbackbasket mobile bundle-ids myapp --add com.example.app');
+        }
+        const overlap = additions.filter((bundleId) => removals.includes(bundleId));
+        if (overlap.length > 0) {
+            throw errUsage(`The same bundle ID cannot be added and removed: ${overlap.join(', ')}`);
+        }
+        const projectId = await resolveProjectId(client, projectArg);
+        const result = await client.updateMobileIntegration(projectId, {
+            addBundleIds: additions,
+            removeBundleIds: removals,
+        });
+        if (!writer.isMachineOutput()) {
+            console.log(`  ${brand.success('✓')} Allowed bundle IDs updated for ${brand.bold(result.project.name)}`);
+            console.log();
+        }
+        writer.ok(result, {
+            summary: `Updated mobile bundle IDs for "${result.project.name}"`,
+            breadcrumbs: [
+                { action: 'View mobile status', cmd: `feedbackbasket mobile status ${projectRef(projectArg, projectId)}` },
+            ],
+        });
+    });
+    mobile
+        .command('verify [project]')
+        .description('Verify that the SDK has connected from the expected app')
+        .option('--bundle-id <bundle-id>', 'Expected bundle ID')
+        .option('--wait <seconds>', 'Wait for the first matching heartbeat (maximum 300 seconds)', '0')
+        .action(async (projectArg, opts) => {
+        const writer = getWriter();
+        const client = requireClient();
+        const projectId = await resolveProjectId(client, projectArg);
+        const expectedBundleId = opts.bundleId
+            ? validateBundleIds([opts.bundleId])[0]
+            : undefined;
+        const waitSeconds = parseWaitSeconds(opts.wait);
+        const deadline = Date.now() + waitSeconds * 1_000;
+        let result = await client.getMobileIntegration(projectId);
+        while (!isMobileConnectionVerified(result, expectedBundleId) && Date.now() < deadline) {
+            await sleep(Math.min(VERIFY_POLL_INTERVAL_MS, deadline - Date.now()));
+            result = await client.getMobileIntegration(projectId);
+        }
+        const verified = isMobileConnectionVerified(result, expectedBundleId);
+        const verification = {
+            verified,
+            expectedBundleId: expectedBundleId ?? null,
+            project: result.project,
+            integration: result.integration,
+        };
+        if (!writer.isMachineOutput())
+            renderVerification(verification);
+        writer.ok(verification, {
+            summary: verified
+                ? `Verified mobile connection for "${result.project.name}"`
+                : `Mobile connection not yet verified for "${result.project.name}"`,
+            notice: verified
+                ? undefined
+                : 'Build and launch the app, then run this command again with --wait 120.',
+        });
+        if (!verified)
+            process.exitCode = 2;
+    });
+    mobile
+        .command('disable [project]')
+        .description('Disable mobile feedback without changing the website widget')
+        .option('--yes', 'Confirm disabling mobile feedback')
+        .action(async (projectArg, opts) => {
+        const writer = getWriter();
+        const client = requireClient();
+        const projectId = await resolveProjectId(client, projectArg);
+        await requireDestructiveConfirmation(writer, Boolean(opts.yes), 'Disable mobile feedback? Installed apps will stop submitting feedback.', '--yes is required to disable mobile feedback in agent mode');
+        const result = await client.updateMobileIntegration(projectId, { enabled: false });
+        if (!writer.isMachineOutput()) {
+            console.log(`  ${brand.success('✓')} Mobile feedback disabled for ${brand.bold(result.project.name)}`);
+            console.log();
+        }
+        writer.ok(result, {
+            summary: `Disabled mobile feedback for "${result.project.name}"`,
+            breadcrumbs: [
+                { action: 'Re-enable mobile feedback', cmd: `feedbackbasket mobile setup ${projectRef(projectArg, projectId)}` },
+            ],
+        });
+    });
+    mobile
+        .command('rotate-key [project]')
+        .description('Rotate the publishable mobile key (existing app builds will stop working)')
+        .option('--yes', 'Confirm key rotation')
+        .option('--include-publishable-key', 'Include the newly generated publishable key')
+        .action(async (projectArg, opts) => {
+        const writer = getWriter();
+        const client = requireClient();
+        const projectId = await resolveProjectId(client, projectArg);
+        await requireDestructiveConfirmation(writer, Boolean(opts.yes), 'Rotate the mobile project key? Existing app builds will stop submitting feedback.', '--yes is required to rotate a mobile project key in agent mode');
+        const result = await client.rotateMobileProjectKey(projectId, Boolean(opts.includePublishableKey));
+        if (!writer.isMachineOutput()) {
+            console.log(`  ${brand.warning('!')} Mobile project key rotated for ${brand.bold(result.project.name)}`);
+            console.log('  Update and release every installed app that used the previous key.');
+            console.log();
+        }
+        writer.ok(result, {
+            summary: `Rotated mobile project key for "${result.project.name}"`,
+            notice: 'Existing app builds using the previous key can no longer submit feedback.',
+        });
+    });
+    return mobile;
+}
+function requireClient() {
+    const manager = new AuthManager();
+    const token = manager.resolveToken();
+    if (!token)
+        throw errAuth();
+    return new FeedbackBasketClient(token, loadConfig().baseUrl);
+}
+async function resolveProjectId(client, projectArg) {
+    if (projectArg)
+        return (await resolveProject(client, projectArg)).id;
+    const config = loadConfig();
+    if (config.defaultProject)
+        return config.defaultProject;
+    throw errUsage('Project is required. Pass a project name/ID or set a default.', 'feedbackbasket mobile status <project>');
+}
+function collect(value, previous) {
+    return [...previous, value];
+}
+export function projectRef(projectArg, projectId) {
+    const ref = projectArg?.trim();
+    if (!ref || !SAFE_PROJECT_REF_PATTERN.test(ref))
+        return projectId;
+    return ref.includes(' ') ? `"${ref}"` : ref;
+}
+export function validateBundleIds(bundleIds) {
+    const normalized = Array.from(new Set(bundleIds.map((value) => value.trim()).filter(Boolean)));
+    const invalid = normalized.find((bundleId) => !BUNDLE_ID_PATTERN.test(bundleId));
+    if (invalid) {
+        throw errUsage(`Invalid bundle ID "${invalid}"`, 'Bundle IDs must look like com.example.app');
+    }
+    if (normalized.length > 20)
+        throw errUsage('A project can have at most 20 bundle IDs');
+    return normalized;
+}
+export function isMobileConnectionVerified(result, expectedBundleId) {
+    const integration = result.integration;
+    if (!integration?.enabled || !integration.connection.connected)
+        return false;
+    return !expectedBundleId || integration.connection.bundleId === expectedBundleId;
+}
+function parseWaitSeconds(value) {
+    const seconds = Number(value);
+    if (!Number.isInteger(seconds) || seconds < 0 || seconds > MAX_VERIFY_WAIT_SECONDS) {
+        throw errUsage(`--wait must be a whole number between 0 and ${MAX_VERIFY_WAIT_SECONDS}`);
+    }
+    return seconds;
+}
+function sleep(milliseconds) {
+    return new Promise((resolve) => setTimeout(resolve, Math.max(0, milliseconds)));
+}
+async function requireDestructiveConfirmation(writer, confirmedByFlag, question, agentHint) {
+    if (confirmedByFlag)
+        return;
+    if (writer.isMachineOutput() || !process.stdin.isTTY) {
+        throw errUsage(agentHint);
+    }
+    if (!(await confirm(`  ${question}`, false))) {
+        throw errUsage('Action cancelled');
+    }
+}
+function withSetupGuidance(result) {
+    return {
+        ...result,
+        setup: {
+            publishableKeyIncluded: result.integration?.publishableKeyIncluded ?? false,
+            supportedIntegrations: ['swiftui', 'uikit', 'react-native', 'flutter', 'hosted-form'],
+            nextSteps: result.integration?.publishableKeyIncluded
+                ? [
+                    'Detect the mobile framework and minimum supported platform version.',
+                    'Configure the app with the returned publishable mobile project key.',
+                    'Add an accessible Send feedback action to an existing Settings, Help, or Support screen.',
+                    'Build and launch the app, then verify its SDK heartbeat.',
+                ]
+                : [
+                    'Re-run setup with --include-publishable-key when you are ready to configure the app.',
+                ],
+        },
+    };
+}
+function renderMobileStatus(result) {
+    console.log(brand.bold(`Mobile feedback — ${result.project.name}`));
+    console.log(divider(54));
+    if (!result.integration) {
+        console.log(brand.muted('  Mobile feedback is not enabled.'));
+        console.log();
+        return;
+    }
+    const integration = result.integration;
+    console.log(`  ${brand.label('Status'.padEnd(18))} ${integration.enabled ? 'Enabled' : 'Disabled'}`);
+    console.log(`  ${brand.label('Publishable key'.padEnd(18))} ${integration.publishableKey}`);
+    console.log(`  ${brand.label('Bundle IDs'.padEnd(18))} ${integration.bundleIds.join(', ') || 'Any bundle ID'}`);
+    console.log(`  ${brand.label('Connection'.padEnd(18))} ${integration.connection.connected ? 'Connected' : 'Waiting for first heartbeat'}`);
+    if (integration.connection.lastSeenAt) {
+        console.log(`  ${brand.label('Last seen'.padEnd(18))} ${integration.connection.lastSeenAt}`);
+    }
+    if (integration.connection.bundleId) {
+        console.log(`  ${brand.label('Last bundle'.padEnd(18))} ${integration.connection.bundleId}`);
+    }
+    console.log();
+}
+function renderVerification(result) {
+    const icon = result.verified ? brand.success('✓') : brand.warning('!');
+    console.log(`  ${icon} ${result.verified ? 'Mobile SDK connection verified' : 'Mobile SDK connection not yet verified'}`);
+    if (result.expectedBundleId)
+        console.log(`  ${brand.muted(`Expected bundle: ${result.expectedBundleId}`)}`);
+    if (result.integration?.connection.lastSeenAt) {
+        console.log(`  ${brand.muted(`Last heartbeat: ${result.integration.connection.lastSeenAt}`)}`);
+    }
+    console.log();
+}

package/dist/src/help.js

@@ -17,7 +17,7 @@ export function renderRootHelp() {
     lines.push(`  ${logo()} CLI ${brand.muted(`v${VERSION}`)}`);
     lines.push('');
     lines.push(`  ${brand.muted('The command-line interface for FeedbackBasket.')}`);
-    lines.push(`  ${brand.muted('Manage projects, feedback, waitlists, widgets, and team from your terminal.')}`);
+    lines.push(`  ${brand.muted('Manage projects, feedback, mobile apps, waitlists, widgets, and team from your terminal.')}`);
     lines.push('');
     // Core Commands
     lines.push(section('  CORE COMMANDS'));
@@ -26,6 +26,7 @@ export function renderRootHelp() {
     lines.push(cmd('bugs', 'View bug reports with severity'));
     lines.push(cmd('widget', 'Manage feedback widget & get embed code'));
     lines.push(cmd('waitlist', 'View and export waitlist signups'));
+    lines.push(cmd('mobile', 'Set up and verify mobile app feedback'));
     lines.push(cmd('team', 'Manage organization members'));
     lines.push('');
     // Shortcuts
@@ -66,6 +67,8 @@ export function renderRootHelp() {
     lines.push(`${INDENT}${brand.muted('$')} feedbackbasket widget settings myapp --display modal`);
     lines.push(`${INDENT}${brand.muted('$')} feedbackbasket widget settings myapp --capture-mode waitlist`);
     lines.push(`${INDENT}${brand.muted('$')} feedbackbasket waitlist list myapp --search "@example.com"`);
+    lines.push(`${INDENT}${brand.muted('$')} feedbackbasket mobile setup myapp --bundle-id com.example.app`);
+    lines.push(`${INDENT}${brand.muted('$')} feedbackbasket mobile verify myapp --bundle-id com.example.app --wait 120`);
     lines.push(`${INDENT}${brand.muted('$')} feedbackbasket projects create "My App" --url https://myapp.com`);
     lines.push('');
     // Learn More

package/dist/src/types.d.ts

@@ -2,7 +2,7 @@ export type FeedbackStatus = 'OPEN' | 'UNDER_REVIEW' | 'PLANNED' | 'IN_PROGRESS'
 export type FeedbackCategory = 'BUG' | 'FEATURE_REQUEST' | 'IMPROVEMENT' | 'QUESTION';
 export type Sentiment = 'POSITIVE' | 'NEGATIVE' | 'NEUTRAL';
 export type Severity = 'high' | 'medium' | 'low';
-export type ReplyDelivery = 'email' | 'widget' | 'both';
+export type ReplyDelivery = 'email' | 'widget' | 'in-app' | 'both';
 export type FeedbackFlowQuestionType = 'text' | 'textarea' | 'single_choice';
 export interface FeedbackFlowQuestion {
     id: string;
@@ -60,6 +60,32 @@ export interface Project {
     byStatus: Record<string, number>;
     byCategory: Record<string, number>;
 }
+export interface MobileIntegrationResponse {
+    project: {
+        id: string;
+        name: string;
+        url: string;
+    };
+    integration: {
+        enabled: boolean;
+        publishableKey: string;
+        publishableKeyIncluded: boolean;
+        hostedFormUrl: string | null;
+        bundleIds: string[];
+        connection: {
+            connected: boolean;
+            lastSeenAt: string | null;
+            platform: string | null;
+            sdkVersion: string | null;
+            bundleId: string | null;
+        };
+    } | null;
+    sdk: {
+        swiftPackageUrl: string;
+        minimumIOSVersion: string;
+        productionBaseUrl: string;
+    };
+}
 export interface Feedback {
     id: string;
     content: string;
@@ -89,6 +115,7 @@ export interface Feedback {
     device?: string | null;
     language?: string | null;
     hasWidgetAccess?: boolean;
+    replyChannel?: 'widget' | 'in_app' | null;
     attachments?: FeedbackAttachment[];
     project: {
         id: string;

package/dist/src/version.d.ts

@@ -1,2 +1,2 @@
-export declare const VERSION = "0.10.0";
-export declare const USER_AGENT = "FeedbackBasket-CLI/0.10.0";
+export declare const VERSION = "0.11.0";
+export declare const USER_AGENT = "FeedbackBasket-CLI/0.11.0";

package/dist/src/version.js

@@ -1,2 +1,2 @@
-export const VERSION = '0.10.0';
+export const VERSION = '0.11.0';
 export const USER_AGENT = `FeedbackBasket-CLI/${VERSION}`;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "feedbackbasket-cli",
-  "version": "0.10.0",
+  "version": "0.11.0",
   "description": "Command-line interface for FeedbackBasket — manage feedback and waitlists from your terminal",
   "type": "module",
   "main": "dist/src/cli.js",
@@ -9,6 +9,7 @@
   },
   "scripts": {
     "build": "tsc",
+    "test": "tsx --test tests/*.test.ts",
     "dev": "tsx bin/feedbackbasket.ts",
     "start": "node dist/bin/feedbackbasket.js",
     "prepublishOnly": "npm run build"

package/skills/feedbackbasket/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: feedbackbasket
-description: Manage FeedbackBasket projects, feedback, bugs, feedback widgets, waitlist capture, and teams from the command line. Use when an agent needs to configure FeedbackBasket, collect feedback or waitlist signups, query feedback, or manage a FeedbackBasket project.
+description: Manage FeedbackBasket projects, feedback, bugs, website widgets, mobile app feedback, waitlist capture, and teams from the command line. Use whenever an agent needs to configure FeedbackBasket in a web or mobile app, install its Swift SDK or hosted mobile form, collect feedback or waitlist signups, query feedback, or manage a FeedbackBasket project.
 ---
 
 # FeedbackBasket CLI
@@ -55,6 +55,59 @@ All project commands accept **name or ID**. Names are matched case-insensitively
 
 **Capture-mode decision:** if the user asks for feedback, a feedback bubble, bug reports, or feature requests, use `--capture-mode feedback`. If they ask for a waitlist, launch list, early access, or email capture, use `--capture-mode waitlist`. If they ask to set up FeedbackBasket without choosing, explain both options and ask which they want. Do not switch an existing project without confirmation because only one capture mode is active at a time.
 
+**Mobile project selection rule:** resolve the FeedbackBasket project for the current app before running mobile commands. Prefer a clearly matching existing project name or product URL. If multiple projects are plausible, ask the user. If none exists, confirm a real product, support, marketing, or App Store URL before creating one; do not invent a URL or use a local development address.
+
+### Mobile App Feedback
+
+```bash
+feedbackbasket mobile status <project> --agent
+feedbackbasket mobile setup <project> --bundle-id com.example.app --agent
+feedbackbasket mobile setup <project> --bundle-id com.example.app --include-publishable-key --agent
+feedbackbasket mobile bundle-ids <project> --add com.example.app.beta --agent
+feedbackbasket mobile bundle-ids <project> --remove com.example.app.beta --agent
+feedbackbasket mobile verify <project> --bundle-id com.example.app --wait 120 --agent
+feedbackbasket mobile disable <project> --yes --agent
+feedbackbasket mobile rotate-key <project> --yes --include-publishable-key --agent
+```
+
+The `fb_mobile_` project key is a publishable, write-only identifier designed to ship in the app. It cannot read feedback or administer the project. It is still masked by default to reduce accidental disclosure in logs and transcripts. Use `--include-publishable-key` only while performing a mobile setup the user authorized, and never repeat the full value in the final response.
+
+Never put an `fb_cli_` CLI token or `fb_key_` MCP/API key in application source, build settings, prompts, logs, or generated configuration. Those are private credentials and are not interchangeable with the publishable mobile key.
+
+For SwiftUI apps targeting iOS 16 or later, use the Swift package returned by `mobile setup` and its native feedback sheet. For UIKit, use the package API or host the SwiftUI sheet. For React Native, Flutter, or unsupported stacks, use the returned hosted form URL in the app's existing in-app browser when available.
+
+Configure the Swift package once at app startup with the returned publishable key:
+
+```swift
+import FeedbackBasket
+
+FeedbackBasket.configure(
+    projectKey: "fb_mobile_returned_by_mobile_setup"
+)
+```
+
+Present its standard SwiftUI sheet from the selected Settings, Help, or Support view:
+
+```swift
+@State private var showingFeedback = false
+
+Button("Send feedback") {
+    showingFeedback = true
+}
+.feedbackBasketSheet(
+    isPresented: $showingFeedback,
+    context: ["screen": "Settings"]
+)
+```
+
+The native SDK stores each submission's reply-thread credential in the app Keychain and shows team replies in the same feedback sheet when it is opened again. Do not build a separate inbox, polling client, or token store in the host app. Hosted-form integrations remain email-only.
+
+Add an accessible Send feedback action to an appropriate existing Settings, Help, or Support screen. Attach only useful non-sensitive context. Do not send passwords, authentication tokens, payment information, private form contents, crash reports, analytics, session recordings, or automatic logs.
+
+Treat a supplied project key as production unless the user explicitly confirms a staging key and base URL. Build and launch the app so the SDK can send its heartbeat, then use `mobile verify`; do not submit test feedback to production. A prior matching heartbeat is a valid connection result because the SDK throttles successful heartbeat attempts.
+
+`mobile setup` is idempotent and adds bundle IDs without replacing existing entries. Do not rotate a key or disable mobile feedback unless the user explicitly requested that disruptive action. Rotation stops every released app using the previous key.
+
 ### Feedback
 ```bash
 # Read
@@ -71,9 +124,10 @@ feedbackbasket feedback note <id> "Investigating — appears related to auth flo
 feedbackbasket feedback delete <id> --yes
 feedbackbasket feedback bulk-update --status CLOSED --ids id1,id2,id3
 
-# Reply to submitter by email, widget thread, or both
+# Reply to submitter by email, widget/in-app thread, or both
 feedbackbasket feedback reply <id> "Thanks for reporting — we pushed a fix!" --delivery email --reply-to support@example.com
 feedbackbasket feedback reply <id> "<content>" --delivery widget
+feedbackbasket feedback reply <id> "<content>" --delivery in-app
 feedbackbasket feedback reply <id> "<content>" --delivery both --reply-to support@example.com
 feedbackbasket feedback replies <id>                                          # list past replies
 
@@ -257,17 +311,18 @@ feedbackbasket feedback show <id> --agent
 ### Close the loop — reply to the submitter
 ```bash
 # Agent reads context, asks which delivery method to use, then sends it
-feedbackbasket feedback show <id> --agent                    # read email, hasWidgetAccess, project.replyToEmail
+feedbackbasket feedback show <id> --agent                    # read email, replyChannel, project.replyToEmail
 feedbackbasket feedback reply <id> "<drafted response>" --delivery widget --agent
+feedbackbasket feedback reply <id> "<drafted response>" --delivery in-app --agent
 feedbackbasket feedback reply <id> "<drafted response>" --delivery email --reply-to support@example.com --agent
 feedbackbasket feedback reply <id> "<drafted response>" --delivery both --reply-to support@example.com --agent
 feedbackbasket feedback update <id> --status COMPLETE --agent
 feedbackbasket feedback note <id> "Replied via CLI" --agent
 ```
 **Important reply safety rules:**
-- Before replying, the agent MUST inspect `feedback show --agent`, then ask the human which delivery method to use: `email`, `widget`, or `both`, unless the human already specified it in the current conversation.
-- If `feedback show` returns `email: null`, do not use `--delivery email` or `--delivery both`. If `hasWidgetAccess: true`, use `--delivery widget`; otherwise ask the human how they want to respond.
-- If `hasWidgetAccess: false`, do not use `--delivery widget` or `--delivery both`.
+- Before replying, the agent MUST inspect `feedback show --agent`, including `replyChannel`, then ask the human which available delivery method to use unless the human already specified it in the current conversation.
+- If `replyChannel: "in_app"`, use `--delivery in-app`. If `replyChannel: "widget"`, use `--delivery widget`. Use `--delivery both` only when an email address and a reply channel are both available.
+- If `feedback show` returns `email: null`, do not use `--delivery email` or `--delivery both`. If `replyChannel: null`, do not use thread delivery.
 - If the delivery includes email and `project.replyToEmail: null`, the agent MUST ask the human which reply-to email to use before sending. Do not use the account owner's email, token owner's email, or any remembered address without explicit confirmation in the current conversation.
 - After the human confirms a reply-to address, pass it explicitly with `--reply-to <email>`, or set a project default first with `feedbackbasket projects update <project> --reply-to <email>`.