Keep the page's scroll position behind an embed when its body scrolls it

A page whose body carries the viewport's overflow (html and body at 100%
height, body with overflow-x hidden) jumped to the top while an embed
showed, and stayed there after: hiding the root's overflow made the body
a scroller of its own. The lock now hides the overflow of whichever
element the viewport uses, and restores a single-axis inline overflow.

.github/workflows/ai-provider-integration-tests.yaml

@@ -53,7 +53,7 @@ jobs:
             # step above fails; the tests skip themselves without the key.
             - name: Run live realtime conversation tests
               if: ${{ !cancelled() }}
-              run: npm run setupExtensions && (cd src/puter-js && npm run build) && npx vitest run --config src/puter-js/tests/api/vitest.config.ts src/puter-js/tests/api/realtime/convoLive.test.ts
+              run: npm run setupExtensions && (cd src/puter-js && npm run build) && npx vitest run --config src/puter-js/tests/api/vitest.config.ts src/puter-js/tests/api/realtime/realtimeLive.test.ts
               env:
                   CI: 'true'
                   PUTER_TEST_AI_OPENAI_API_KEY: ${{ secrets.PUTER_TEST_AI_OPENAI_API_KEY }}

.github/workflows/puterjs-tests.yaml

@@ -176,7 +176,10 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@v7
 
+      # Missing when the PR leg failed; `coverage (pr)` already reports that.
       - name: Download PR coverage
+        id: pr-coverage
+        continue-on-error: true
         uses: actions/download-artifact@v8
         with:
           name: puterjs-coverage-pr
@@ -186,6 +189,7 @@ jobs:
       # base run) — then report without the comparison column.
       - name: Download base coverage
         id: base-coverage
+        if: steps.pr-coverage.outcome == 'success'
         continue-on-error: true
         uses: actions/download-artifact@v8
         with:
@@ -193,7 +197,7 @@ jobs:
           path: coverage-base
 
       - name: Report coverage on PR
-        if: steps.base-coverage.outcome == 'success'
+        if: steps.pr-coverage.outcome == 'success' && steps.base-coverage.outcome == 'success'
         uses: davelosert/vitest-coverage-report-action@v2
         with:
           name: puter.js SDK
@@ -202,7 +206,7 @@ jobs:
           json-summary-compare-path: coverage-base/coverage-summary.json
 
       - name: Report coverage on PR (no base comparison)
-        if: steps.base-coverage.outcome != 'success'
+        if: steps.pr-coverage.outcome == 'success' && steps.base-coverage.outcome != 'success'
         uses: davelosert/vitest-coverage-report-action@v2
         with:
           name: puter.js SDK

CLAUDE.md

@@ -1 +1 @@
-FOLLOW ./AGENTS.md
+FOLLOW @AGENTS.md

doc/embedding-app-browser.md

@@ -14,11 +14,25 @@ to its normal sign-in. Apps that need the desktop (built-in and godmode apps,
 private apps the user can't open, or a failed token request) open `/app/<name>`
 on the GUI origin, cut off from the embed. Website shortcuts open their external
 destination with no opener.
+The embed follows the OS's light or dark setting. A host with a fixed theme adds
+`theme=dark` or `theme=light` to the fragment (`#user=<uuid>&theme=dark`), since
+Chromium doesn't pass an iframe's `color-scheme` on to the page inside it.
 Apps opened from the embed carry `utm_source=puter.com&utm_medium=referral&utm_campaign=app_browser_embed`;
 the desktop and dashboard send `utm_campaign=desktop` and `utm_campaign=dashboard`.
 
 ## Session and framing
 
+The embed shows the GUI session only to the user the host page is signed in as.
+The host names that user's `uuid` (from `puter.auth.getUser()`) in the iframe
+URL's fragment, as `/embed/apps#user=<uuid>`. The embed reads the session, asks
+`/whoami` which user it belongs to, and shows the signed-out view unless the two
+match. So a host that names no user, a malformed one, or a user other than the
+session's, gets the signed-out view, and so does a session the API refuses. A
+failed `/whoami` check shows the error state. The fragment never reaches the
+server and can only narrow what the embed shows: naming the session's own user
+gives the same view as a direct visit to the GUI. Changing the fragment of a
+loaded embed reloads it.
+
 The embed reads the existing GUI session from local storage on its own origin.
 If that storage holds no session, the embed gets the session from the GUI origin's session cookie through
 `/get-gui-token`. This matters in Safari, which gives a framed origin separate
@@ -29,7 +43,7 @@ does not create accounts, show a login dialog, or accept a token from its parent
 Being signed in on a subdomain alone does not create a session on the main GUI
 origin.
 
-Without a session, the embed shows the recommended apps (`RecommendedAppsService`)
+Without a session it can show, the embed shows the recommended apps (`RecommendedAppsService`)
 that the server put in the page, and nothing else: no installed apps, folders, or
 saved order, and no puter.js. Selecting one opens it at the same URL a signed-in
 launch uses, with no opener and no token on offer, so the app signs in on its own.
@@ -58,11 +72,18 @@ and popups to escape the sandbox.
 
 ## Host integration
 
+A first-party app that signs in with puter.js can place `<puter-user-menu>` from
+the SDK in its header instead (see `src/puter-js/src/ui/components.md`). It opens
+this embed with the signed-in user named and closes it when the app's sign-in
+changes. The rest of this section is for a host that builds the iframe itself.
+
 The iframe can be shown whether or not the user is signed in. Create it when
-“More apps” is opened, and remove it on close so reopening loads current apps
-and preferences. The host owns the modal and close control;
+“More apps” is opened, naming the signed-in user in its fragment, and remove it
+on close so reopening loads current apps and preferences. Remove it when the
+host's own sign-in changes too, such as on sign-out, so an open embed doesn't
+keep the previous user. The host owns the modal and close control;
 there is no parent messaging API and no app list or credential is sent to it.
-The app browser fills its iframe and responds to its size.
+The app browser fills its iframe and responds to its size. It shows a spinner until its apps load.
 
 This example assumes `puterOrigin` comes from the host app's deployment
 settings. Translate the button and frame labels using the host app's
@@ -84,10 +105,14 @@ localization system.
   const container = document.querySelector('#apps-frame');
   const trigger = document.querySelector('#more-apps');
 
-  trigger.addEventListener('click', () => {
+  trigger.addEventListener('click', async () => {
+    const url = new URL('/embed/apps', puterOrigin);
+    // Signed out, the embed shows the recommended apps.
+    const user = puter.auth.isSignedIn() ? await puter.auth.getUser().catch(() => null) : null;
+    if (user) url.hash = `user=${encodeURIComponent(user.uuid)}`;
     const frame = document.createElement('iframe');
     frame.title = 'Your apps';
-    frame.src = new URL('/embed/apps', puterOrigin).href;
+    frame.src = url.href;
     container.replaceChildren(frame);
     dialog.showModal();
   });
@@ -99,22 +124,149 @@ localization system.
 </script>
 ```
 
-## Implementation and checks
+## Implementation
 
 `createAppBrowser` in `src/gui/src/UI/Dashboard/AppBrowser.js` owns the shared UI
 and data behavior; its `guestApps` option is the signed-out list. `TabApps.js`
 injects desktop actions. `appsEmbed.js` supplies new-tab launching through
 `launchAppInTab` (signed in) and `guestAppLaunchUrl` (signed out) in
 `src/gui/src/helpers/appTabLaunch.js`, which build the same app URL as
-`launch_app`, and loads only the embed entry, its SDK, and shared styles.
-The normal GUI webpack build emits `bundle.min.js` and `apps-embed.min.js`.
+`launch_app`, and loads only the embed entry, its SDK, and shared styles. `embedHostUser` in
+`src/gui/src/helpers/embedHostUser.js` reads the host's user from the fragment, and
+`embedHostTheme.js` beside it applies the host's theme.
+The normal GUI webpack build emits `bundle.min.js`, `apps-embed.min.js`, and `feedback-embed.min.js`.
 The `/embed/apps` route puts the recommended list in the page's config as
 `guestApps`. No puter.js API or app-list endpoint changes are needed.
 
+## Feedback dialog
+
+`GET /embed/feedback` is the app feedback dialog (`puter.ui.showFeedbackDialog()`)
+for a first-party page, with the same framing rules, query redirect, and
+host-user binding as `/embed/apps`. It sends the feedback for the framing
+page's origin, which the server reads from the referrer and pins with
+`frame-ancestors`; opened top-level, it does nothing. Its page is transparent
+so the dialog's own scrim covers the host.
+
+puter.js uses it on a page one label under the GUI origin, other than the
+subdomains the server refuses, when the page is signed in, framing it in a
+modal `<dialog>` that stays hidden until the embed is ready. A session check that takes longer than 200ms shows a loading scrim
+with a spinner in its place; Escape or a click on it cancels. The embed posts `{ msg: 'feedbackEmbed', state }` to its parent
+(`loading`, then `ready` or `unavailable`) and finally
+`{ msg: 'feedbackDialogClosed', sent }`. It reports `unavailable` without the
+named user's session, or while that user's email still needs confirming, and
+puter.js then uses the `/action/send-feedback` popup, which can sign in. So does
+a frame that never answers, such as one the host's CSP blocks. `feedbackEmbed.js`
+is the entry, sharing `embedSession` in `src/gui/src/helpers/embedSession.js`
+with the app browser; `showFeedbackEmbed` in `src/puter-js/src/lib/guiEmbed.js`
+is the host side.
+
+## Sign-in and file pickers
+
+`GET /embed/sign-in`, `/embed/show-open-file-picker`, `/embed/show-save-file-picker`
+and `/embed/show-directory-picker` serve the same GUI popups as `/action/<action>`
+for a first-party page, with the same framing rules, query redirect, and
+`no-store` as `/embed/apps`. Any other spelling of the path (another case, a
+trailing slash) redirects to it, since the shell boots the desktop for it. They render the normal GUI shell, which names the
+framing page (read from the referrer, pinned with `frame-ancestors`) as
+`gui_params.embed_host_origin`. The GUI then runs the popup boot unchanged, with
+the framing page as `window.opener`, and `window.close()` asks the page to
+remove the frame (`src/gui/src/helpers/popupFrame.js`). Without a framing page
+to answer (opened top-level, or framed by a refused page) it does nothing. The
+popup's parameters come from the fragment instead of the query: `msg_id`,
+`options` and `request_auth`, plus `user` for a picker.
+
+The frame posts `{ msg: 'puterPopupFrame', state }` to its parent: `loading` as
+soon as the shell boots, `ready` once it shows a window or dialog, `unavailable`
+when the page has to use the popup, `provider` when the user picks a sign-in
+provider (below), and `closed` where a popup would close. Its
+answers (`puter.token`, `fileOpenPicked`, `directoryPicked`, `fileSaved`, the
+cancel messages, `sendMeFileData`) are the popup's.
+
+puter.js uses them on a page one label under the GUI origin, other than the
+subdomains the server refuses, unless the page is cross-origin isolated or in a
+frame of another site (which `frame-ancestors` refuses too).
+`showPopupFrame` in `src/puter-js/src/lib/guiEmbed.js` shows the frame in a box
+the size of the popup window, over a scrim, hidden until `ready` and behind the
+loading spinner after 200ms. Escape closes it, on the page or in the frame. One shows per popup, as each
+popup has its own window name: a second picker request of the same kind
+replaces the one showing, and a `signIn()` call made while a framed sign-in is
+open settles with it. On
+screens up to 600px wide the box fills the screen. A frame that is refused,
+never answers, or reports `unavailable` falls back to the popup, opened through
+a consent dialog when the click that asked for it has expired. A reload or navigation the frame
+starts itself (logging out, a sign-out in another tab) names the frame as its
+referrer, so the server refuses it; the page then shows its spinner and opens
+the frame again, once per `ready`.
+
+- **Sign-in** (`puter.auth.signIn()`) has no host-user binding: it is how the
+  page gets a user. The box has a close button, which rejects with
+  `auth_window_closed` as closing the popup does. Providers refuse to be
+  framed, so choosing one posts `{ state: 'provider', url }` with the
+  provider's start URL for this sign-in's `msg_id`, then `unavailable`. The
+  page opens the popup straight at that URL, once it checks the URL is the
+  GUI's `/auth/oidc/<provider>/start` for this `msg_id`, and the provider
+  returns it as this sign-in's popup. `attempt_temp_user_creation` keeps the popup, since
+  only the popup creates a temporary account.
+- **Pickers** frame only for a signed-in page. The GUI reports `unavailable`
+  unless its session belongs to the user named in `user`, and the page then uses
+  the popup, which can sign in and switch accounts. The token the GUI sends
+  before a picker's answer isn't adopted, since it is for the page's own user.
+  Dismissing the loading scrim settles the picker as cancelled.
+
+## Upgrade
+
+`GET /embed/upgrade` is the deployment's upgrade dialog for a first-party page,
+served like the popups above: the GUI shell with the same framing rules, query
+redirect, exact-path redirect and `no-store`, naming the framing page as
+`gui_params.embed_host_origin`. It runs only when framed by an allowed page.
+
+puter.js frames it on a signed-in first-party page (the same pages as the
+pickers) for `puter.ui.requestUpgrade(details)`, and for the Upgrade button of
+the usage limit dialog a refused call shows there. Elsewhere both keep their
+behavior: inside an app `requestUpgrade()` asks the desktop, and on any other
+page the usage limit dialog opens the dashboard's upgrade page in a new tab.
+
+The frame covers the page with no box or close button, and the GUI page is
+transparent (`html.popup-frame-transparent`) so the dialog's own scrim covers
+the host. The frame allows `payment` as well as `otp-credentials`. Escape on the
+page is left to the dialog, since one there shouldn't drop a payment in
+progress. Its fragment names `user` (the page's signed-in user) and, when the
+refusal gave them, `reason` (`funds`, `subscription` or `storage`) and `method`.
+
+The GUI reports `unavailable` unless its session belongs to `user`, the account
+has no verification or password change waiting (which the frame couldn't be
+closed from), and the deployment defines `window.UIUpgradeAccount` with
+`UIUpgradeAccount.embeddable === true`. Otherwise it runs:
+
+```js
+new UIUpgradeAccount({ attribution: { appUid, reason, method }, onClose }).open_as_window();
+```
+
+`appUid` is the app the framing page's origin resolves to, never one the
+fragment names. `open_as_window()` resolves once the dialog shows, and the GUI
+then posts `ready`. While the page still hides the frame, which Chromium and
+WebKit lay out at 0x0, the GUI posts `ready` first and opens the dialog once
+the frame has a viewport, so a window it opens doesn't center on 0x0.
+`onClose({ upgraded })` must run exactly once, when the
+dialog closes or when it declines to open for the account; the GUI then posts
+`{ msg: 'puterPopupFrame', state: 'closed', upgraded }` and the page removes
+the frame. If `open_as_window()` rejects, the GUI posts `unavailable` instead. `requestUpgrade()` resolves `{ upgraded }`. A call made while the
+frame shows settles with it rather than replacing it, and a call refused while
+it shows still rejects but opens no usage limit dialog over it.
+
+When the frame can't show the upgrade (refused, never ready, `unavailable`, or
+no user to name), puter.js opens the dashboard's upgrade page in a new tab with
+what was refused, through a consent dialog when the click has expired or the
+tab is blocked, and `requestUpgrade()` resolves `{ upgraded: false }`.
+
+## Checks
+
 Run the GUI component/browser tests (with the SDK bundle built and Playwright
 Chromium installed), and the backend route tests:
 
 ```sh
-npx vitest run --config src/gui/vitest.config.js src/gui/src/UI/Dashboard/AppBrowser
+npx vitest run --config src/gui/vitest.config.js src/gui/src/UI/Dashboard/AppBrowser src/feedbackEmbed
+npx vitest run src/puter-js/src/lib/guiEmbed.test.js src/puter-js/src/modules/UI.showFeedbackDialog.test.js src/puter-js/src/modules/Auth.signInFrame.test.js src/puter-js/src/modules/UI.pickerFrame.test.js src/puter-js/src/modules/UI.requestUpgrade.test.js src/puter-js/src/lib/upgradePrompt.test.js src/puter-js/src/modules/UsageLimitDialog.upgrade.test.js
+npx vitest run --config src/gui/vitest.config.js src/gui/src/helpers/popupFrame.test.js
 npx vitest run --config src/backend/vitest.config.ts src/backend/server.test.ts
 ```

src/backend/controllers/auth/oidcLoginReturn.ts

@@ -15,7 +15,6 @@ export interface OidcLoginContinuation {
     embeddedInPopup: boolean;
     openerOrigin: string | null;
     messageId: string | null;
-    switchedToLogin: boolean;
 }
 
 interface OidcReturnDeps {
@@ -56,7 +55,6 @@ export function completeOidcLoginReturn(
         data.userUuid !== user.uuid ||
         typeof data.redirectUri !== 'string' ||
         typeof data.embeddedInPopup !== 'boolean' ||
-        typeof data.switchedToLogin !== 'boolean' ||
         (data.openerOrigin !== null && typeof data.openerOrigin !== 'string') ||
         (data.messageId !== null && typeof data.messageId !== 'string')
     ) {
@@ -91,6 +89,5 @@ export function completeOidcLoginReturn(
             ),
         );
     }
-    if (data.switchedToLogin) append('oidc_switched', 'login');
     return target;
 }

src/backend/controllers/homepage/HomepageController.test.ts

@@ -27,7 +27,7 @@ import type { Actor } from '../../core/actor.js';
 import { PuterRouter } from '../../core/http/PuterRouter.js';
 import { PuterServer } from '../../server.js';
 import { setupTestServer } from '../../testUtil.js';
-import { embedFrameAncestors } from './HomepageController.js';
+import { embedFrameAncestors, embedHostOrigin } from './HomepageController.js';
 
 // ── Test harness ────────────────────────────────────────────────────
 //
@@ -550,3 +550,26 @@ describe('embedFrameAncestors', () => {
         ).toBe("'self'");
     });
 });
+
+describe('embedHostOrigin', () => {
+    const config = {
+        origin: 'https://example.test',
+        domain: 'example.test',
+        api_base_url: 'https://backend.example.test',
+        static_hosting_domain: 'site.example.test',
+    };
+
+    it.each([
+        ['https://sheets.example.test/doc/1', 'https://sheets.example.test'],
+        ['https://backend.example.test/x', null],
+        ['https://api.example.test/', null],
+        ['https://someone.site.example.test/', null],
+        ['https://a.sheets.example.test/', null],
+        ['http://sheets.example.test/', null],
+        ['https://example.test/', null],
+        ['not a url', null],
+        [undefined, null],
+    ])('%s frames as %s', (referer, expected) => {
+        expect(embedHostOrigin(config, referer)).toBe(expected);
+    });
+});

src/backend/controllers/homepage/HomepageController.ts

@@ -31,8 +31,22 @@ import type {
     PuterHomepageService,
     PageMeta,
     LaunchOptions,
+    PopupFrame,
 } from '../../services/homepage/PuterHomepageService';
 
+/**
+ * GUI popups a first-party page can show in a frame at `/embed/<action>`,
+ * instead of opening `/action/<action>` in a window, and the upgrade dialog,
+ * which it would otherwise open in a dashboard tab.
+ */
+export const FRAMED_POPUP_ACTIONS = [
+    'sign-in',
+    'show-open-file-picker',
+    'show-save-file-picker',
+    'show-directory-picker',
+    'upgrade',
+] as const;
+
 /** Longest description/og:description/twitter:description on `/app/<name>`. */
 export const APP_META_DESCRIPTION_MAX = 150;
 
@@ -61,32 +75,34 @@ export function appMetaDescription(text: string): string {
     return `${cut.replace(/[\s,;:.!?…—-]+$/, '')}…`;
 }
 
+type EmbedFramingConfig = Pick<
+    IConfig,
+    | 'origin'
+    | 'domain'
+    | 'api_base_url'
+    | 'static_hosting_domain'
+    | 'static_hosting_domain_alt'
+    | 'private_app_hosting_domain'
+    | 'private_app_hosting_domain_alt'
+>;
+
 /**
- * `frame-ancestors` for the app browser embed. A wildcard over `*.<domain>`
+ * The origin of a first-party page that may frame an `/embed/*` page, named
+ * exactly from the request's referrer, or null. A wildcard over `*.<domain>`
  * would also admit user-hosted sites whenever the hosting domains sit under it,
- * so the embedding page is named exactly, from the request's referrer. Only a
- * single label under `<domain>` qualifies, and not one this server answers
- * itself (the API, WebDAV, SDK and native-app hosts).
+ * so only a single label under `<domain>` qualifies, and not one this server
+ * answers itself (the API, WebDAV, SDK and native-app hosts).
  */
-export function embedFrameAncestors(
-    config: Pick<
-        IConfig,
-        | 'origin'
-        | 'domain'
-        | 'api_base_url'
-        | 'static_hosting_domain'
-        | 'static_hosting_domain_alt'
-        | 'private_app_hosting_domain'
-        | 'private_app_hosting_domain_alt'
-    >,
+export function embedHostOrigin(
+    config: EmbedFramingConfig,
     referer: string | undefined,
-): string {
+): string | null {
     const gui = new URL(config.origin ?? `https://${config.domain}`);
     let parent: URL;
     try {
         parent = new URL(referer ?? '');
     } catch {
-        return "'self'";
+        return null;
     }
     const host = parent.hostname.toLowerCase();
     const label = subdomainLabelOf(host, config.domain);
@@ -105,7 +121,16 @@ export function embedFrameAncestors(
         !isReservedSubdomain(label) &&
         host !== new URL(config.api_base_url).hostname &&
         !hostingDomains.some((d) => host === d || host.endsWith(`.${d}`));
-    return allowed ? `'self' ${parent.origin}` : "'self'";
+    return allowed ? parent.origin : null;
+}
+
+/** `frame-ancestors` for an `/embed/*` page: the GUI and {@link embedHostOrigin}. */
+export function embedFrameAncestors(
+    config: EmbedFramingConfig,
+    referer: string | undefined,
+): string {
+    const host = embedHostOrigin(config, referer);
+    return host ? `'self' ${host}` : "'self'";
 }
 
 /**
@@ -142,6 +167,7 @@ export class HomepageController extends PuterController {
             res: express.Response,
             metaOverrides: Partial<PageMeta> = {},
             launch: LaunchOptions = {},
+            popupFrame?: PopupFrame,
         ) => {
             const meta = { ...defaultMeta(req), ...metaOverrides };
             const actor =
@@ -150,19 +176,27 @@ export class HomepageController extends PuterController {
                         actor?: Parameters<typeof homepage.send>[0]['actor'];
                     }
                 ).actor ?? null;
-            await homepage.send({ req, res, actor }, meta, launch);
+            await homepage.send({ req, res, actor }, meta, launch, popupFrame);
         };
 
         // -- Root + path-aliased shell routes ------------------------
 
         router.get('/', {}, (req, res) => sendShell(req, res));
 
-        router.get('/embed/apps', {}, async (req, res) => {
-            // SDK bootstrap parameters must not change this page's account or API origin.
-            // Checked on the raw URL; `req.query` drops pairs past the parser's limit.
+        /**
+         * Headers shared by the `/embed/*` pages; false when the request was
+         * redirected instead. SDK bootstrap parameters must not change an
+         * embed's account or API origin, so a query string is dropped. Checked
+         * on the raw URL; `req.query` drops pairs past the parser's limit.
+         */
+        const prepareEmbed = (
+            req: express.Request,
+            res: express.Response,
+            path: string,
+        ): boolean => {
             if (req.originalUrl.includes('?')) {
-                res.redirect('/embed/apps');
-                return;
+                res.redirect(path);
+                return false;
             }
             res.removeHeader('X-Frame-Options');
             res.setHeader(
@@ -170,6 +204,11 @@ export class HomepageController extends PuterController {
                 `frame-ancestors ${embedFrameAncestors(this.config, req.get('referer'))}`,
             );
             res.setHeader('Cache-Control', 'no-store');
+            return true;
+        };
+
+        router.get('/embed/apps', {}, async (req, res) => {
+            if (!prepareEmbed(req, res, '/embed/apps')) return;
             // Shown to visitors without a session; a signed-in embed fetches
             // its own list, so a failure here only costs signed-out visitors.
             const guestApps = await this.services.recommendedApps
@@ -178,6 +217,48 @@ export class HomepageController extends PuterController {
             res.send(homepage.renderAppBrowserEmbed({ guestApps }));
         });
 
+        router.get('/embed/feedback', {}, (req, res) => {
+            if (!prepareEmbed(req, res, '/embed/feedback')) return;
+            // The feedback is recorded against this origin, which
+            // frame-ancestors has just pinned to the actual framing page.
+            res.send(
+                homepage.renderFeedbackEmbed({
+                    hostOrigin: embedHostOrigin(
+                        this.config,
+                        req.get('referer'),
+                    ),
+                }),
+            );
+        });
+
+        // The GUI runs the popup's own boot, answering the framing page
+        // instead of an opener.
+        for (const action of FRAMED_POPUP_ACTIONS) {
+            const embedPath = `/embed/${action}`;
+            router.get(embedPath, {}, async (req, res) => {
+                // Routes match case-insensitively and with a trailing slash,
+                // and the shell boots the desktop for any other spelling, so
+                // only the exact one may be framed.
+                if (req.originalUrl !== embedPath) {
+                    res.redirect(embedPath);
+                    return;
+                }
+                if (!prepareEmbed(req, res, embedPath)) return;
+                await sendShell(
+                    req,
+                    res,
+                    {},
+                    {},
+                    {
+                        hostOrigin: embedHostOrigin(
+                            this.config,
+                            req.get('referer'),
+                        ),
+                    },
+                );
+            });
+        }
+
         router.get('/settings', {}, (req, res) => sendShell(req, res));
         router.get('/settings/*splat', {}, (req, res) => sendShell(req, res));
 

src/backend/controllers/oidc/OIDCController.test.ts

@@ -1620,7 +1620,7 @@ describe('OIDCController signup callback', () => {
         expect(captured.redirectUrl).toContain('action=signup');
     });
 
-    it('creates a fresh user without oidc_switched on first signup', async () => {
+    it('creates a fresh user on first signup', async () => {
         const state = oidc().signState({
             provider: 'custom',
             redirect_uri: TEST_ORIGIN + '/',
@@ -1646,11 +1646,9 @@ describe('OIDCController signup callback', () => {
         );
         expect(captured.cookies).toHaveLength(1);
         expect(captured.redirectUrl).toBe(TEST_ORIGIN + '/');
-        // Fresh creation — must NOT advertise "you've actually been signed in".
-        expect(captured.redirectUrl).not.toContain('oidc_switched=login');
     });
 
-    it('adds oidc_switched=login when signup hits an already-linked account', async () => {
+    it('signs in to an already-linked account on signup, returning as a login would', async () => {
         // Seed an account linked on (provider, sub) so the signup callback
         // resolves to `linked-sub` rather than creating a new user.
         const sub = `sub-${Math.random().toString(36).slice(2, 8)}`;
@@ -1686,7 +1684,7 @@ describe('OIDCController signup callback', () => {
             res,
         );
         expect(captured.cookies).toHaveLength(1);
-        expect(captured.redirectUrl).toContain('oidc_switched=login');
+        expect(captured.redirectUrl).toBe(TEST_ORIGIN + '/');
     });
 
     it('redirects to action=signup with auth_error when user resolution fails (unconfirmed email)', async () => {

src/backend/controllers/oidc/OIDCController.ts

@@ -688,14 +688,7 @@ export class OIDCController extends PuterController {
                 );
             }
 
-            // If we landed on an existing account (either via the
-            // provider_sub or via email match), signal the GUI so it can
-            // render a "signed in" flow rather than "account created".
-            const extra =
-                resolved.origin === 'created'
-                    ? undefined
-                    : { oidc_switched: 'login' };
-            await this.#finishLogin(req, res, user, stateDecoded, extra);
+            await this.#finishLogin(req, res, user, stateDecoded);
         };
         router.get('/auth/oidc/callback/signup', cbOpts, signupCb);
         router.post('/auth/oidc/callback/signup', cbOpts, signupCb);
@@ -834,17 +827,14 @@ if (window.opener) {
         attempt = 0,
     ): Promise<
         | { error: string; code?: string; requestCode?: string }
-        | {
-              user: import('../../stores/user/UserStore.js').UserRow;
-              origin: 'linked-sub' | 'linked-email' | 'created';
-          }
+        | { user: import('../../stores/user/UserStore.js').UserRow }
     > {
         // 1. Existing provider/sub link.
         const linked = await this.services.oidc.findUserByProviderSub(
             provider,
             userinfo.sub,
         );
-        if (linked) return { user: linked, origin: 'linked-sub' };
+        if (linked) return { user: linked };
 
         // 2/3. Email match branch.
         const claimedEmail =
@@ -881,7 +871,7 @@ if (window.opener) {
                         error: outcome.error ?? 'Failed to link provider.',
                     };
                 }
-                return { user: byEmail, origin: 'linked-email' };
+                return { user: byEmail };
             }
         }
 
@@ -911,7 +901,7 @@ if (window.opener) {
                 requestCode: outcome.requestCode,
             };
         }
-        return { user: outcome.user, origin: 'created' };
+        return { user: outcome.user };
     }
 
     async #processCallback(
@@ -1000,7 +990,6 @@ if (window.opener) {
         res: Response,
         user: UserRow,
         stateDecoded: Record<string, unknown>,
-        extraQueryParams?: Record<string, string>,
     ): Promise<void> {
         const origin = (this.config.origin ?? '').replace(/\/$/, '');
         const continuation: OidcLoginContinuation = {
@@ -1018,7 +1007,6 @@ if (window.opener) {
                 stateDecoded.msg_id == null
                     ? null
                     : String(stateDecoded.msg_id),
-            switchedToLogin: extraQueryParams?.oidc_switched === 'login',
         };
         if (user.otp_enabled) {
             const challenge = this.services.token.sign(

src/backend/controllers/oidc/OIDCController.twoFactor.http.test.ts

@@ -139,7 +139,7 @@ describe('OIDC account second-factor login', () => {
             expect(await response.json()).toMatchObject({
                 proceed: true,
                 next_step: 'complete',
-                redirectUrl: `${env.origin}/dashboard${flow === 'signup' ? '?oidc_switched=login' : ''}`,
+                redirectUrl: `${env.origin}/dashboard`,
             });
             expect(
                 response.headers

src/backend/core/http/middleware/hostRedirects.test.ts

@@ -187,9 +187,9 @@ describe('createUserSubdomainNotFound', () => {
     });
 
     it('passes through reserved subdomains (api, js, native apps, etc.)', () => {
-        // `api`, `js`, `dav`, `docs`, `developer`, `editor`, `pdf`,
+        // `api`, `js`, `dav`, `docs`, `developer`, `about`, `apps`,
         // `puter-app-icons`, etc. all pass through.
-        for (const sub of ['api', 'js', 'docs', 'editor', 'puter-app-icons']) {
+        for (const sub of ['api', 'js', 'docs', 'about', 'puter-app-icons']) {
             const { out, next } = run(
                 createUserSubdomainNotFound(config),
                 makeReq({
@@ -865,13 +865,13 @@ describe('createNativeAppStatic', () => {
 
     beforeAll(() => {
         root = mkdtempSync(nodePath.join(tmpdir(), 'native-apps-'));
-        mkdirSync(nodePath.join(root, 'editor', 'assets'), { recursive: true });
+        mkdirSync(nodePath.join(root, 'about', 'assets'), { recursive: true });
         writeFileSync(
-            nodePath.join(root, 'editor', 'index.html'),
-            '<h1>editor</h1>',
+            nodePath.join(root, 'about', 'index.html'),
+            '<h1>about</h1>',
         );
         writeFileSync(
-            nodePath.join(root, 'editor', 'assets', 'app.js'),
+            nodePath.join(root, 'about', 'assets', 'app.js'),
             'console.log(1);',
         );
         mkdirSync(nodePath.join(root, 'docs', 'dist'), { recursive: true });
@@ -893,7 +893,7 @@ describe('createNativeAppStatic', () => {
 
     it('leaves a native app name alone on a host outside our domains', async () => {
         const req = staticReq({
-            subdomains: ['com', 'example', 'editor'],
+            subdomains: ['com', 'example', 'about'],
             path: '/index.html',
         });
         (req as Request & { is_custom_domain?: boolean }).is_custom_domain =
@@ -907,7 +907,7 @@ describe('createNativeAppStatic', () => {
         const { out, next } = await runStatic(
             createNativeAppStatic(config),
             staticReq({
-                subdomains: ['localhost', 'puter', 'editor'],
+                subdomains: ['localhost', 'puter', 'about'],
                 path: '/index.html',
             }),
         );
@@ -915,17 +915,24 @@ describe('createNativeAppStatic', () => {
         expect(next).toHaveBeenCalledTimes(1);
     });
 
-    it('passes through subdomains that are not native apps', async () => {
-        const { out, next } = await runStatic(
-            withRoot(),
-            staticReq({
-                subdomains: ['localhost', 'puter', 'api'],
-                path: '/index.html',
-            }),
-        );
-        expect(out.sent).toBeUndefined();
-        expect(next).toHaveBeenCalledTimes(1);
-    });
+    // `editor`, `markus` and `pdf` are web apps on standard host routing,
+    // even with a folder of their own under the native apps root.
+    it.each(['api', 'editor', 'markus', 'pdf'])(
+        'passes %s through, as it is not a native app',
+        async (sub) => {
+            mkdirSync(nodePath.join(root, sub), { recursive: true });
+            writeFileSync(nodePath.join(root, sub, 'index.html'), sub);
+            const { out, next } = await runStatic(
+                withRoot(),
+                staticReq({
+                    subdomains: ['localhost', 'puter', sub],
+                    path: '/index.html',
+                }),
+            );
+            expect(out.sent).toBeUndefined();
+            expect(next).toHaveBeenCalledTimes(1);
+        },
+    );
 
     it('passes through when there is no subdomain at all', async () => {
         const { next } = await runStatic(
@@ -939,13 +946,13 @@ describe('createNativeAppStatic', () => {
         const { out, next } = await runStatic(
             withRoot(),
             staticReq({
-                subdomains: ['localhost', 'puter', 'editor'],
+                subdomains: ['localhost', 'puter', 'about'],
                 path: '/index.html',
             }),
         );
         expect(out.sent).toEqual({
             path: '/index.html',
-            root: nodePath.join(root, 'editor'),
+            root: nodePath.join(root, 'about'),
         });
         expect(next).not.toHaveBeenCalled();
     });
@@ -954,11 +961,11 @@ describe('createNativeAppStatic', () => {
         const { out } = await runStatic(
             withRoot(),
             staticReq({
-                subdomains: ['localhost', 'puter', 'EDITOR'],
+                subdomains: ['localhost', 'puter', 'ABOUT'],
                 path: '/index.html',
             }),
         );
-        expect(out.sent?.root).toBe(nodePath.join(root, 'editor'));
+        expect(out.sent?.root).toBe(nodePath.join(root, 'about'));
     });
 
     it('serves docs out of its dist/ subdirectory, not the app root', async () => {
@@ -979,7 +986,7 @@ describe('createNativeAppStatic', () => {
         const { out, next } = await runStatic(
             withRoot(),
             staticReq({
-                subdomains: ['localhost', 'puter', 'editor'],
+                subdomains: ['localhost', 'puter', 'about'],
                 path: '/assets',
                 originalUrl: '/assets?v=2',
             }),
@@ -995,7 +1002,7 @@ describe('createNativeAppStatic', () => {
         const { out } = await runStatic(
             withRoot(),
             staticReq({
-                subdomains: ['localhost', 'puter', 'editor'],
+                subdomains: ['localhost', 'puter', 'about'],
                 path: '/assets/',
             }),
         );
@@ -1007,7 +1014,7 @@ describe('createNativeAppStatic', () => {
         const { out, next } = await runStatic(
             withRoot(),
             staticReq({
-                subdomains: ['localhost', 'puter', 'editor'],
+                subdomains: ['localhost', 'puter', 'about'],
                 path: '/nope.html',
             }),
         );
@@ -1019,7 +1026,7 @@ describe('createNativeAppStatic', () => {
         const { next } = await runStatic(
             withRoot(),
             staticReq({
-                subdomains: ['localhost', 'puter', 'editor'],
+                subdomains: ['localhost', 'puter', 'about'],
                 path: '/index.html',
             }),
             new Error('send failed'),
@@ -1032,7 +1039,7 @@ describe('createNativeAppStatic', () => {
             runStatic(
                 withRoot(),
                 staticReq({
-                    subdomains: ['localhost', 'puter', 'editor'],
+                    subdomains: ['localhost', 'puter', 'about'],
                     path: '/../../etc/passwd',
                 }),
             ),

src/backend/core/http/middleware/hostRedirects.ts

@@ -27,15 +27,7 @@ import { HttpError, isHttpError } from '../HttpError';
 import { isLocalWorkerHost } from './localWorkerProxy';
 
 /** Native-app subdomains served via `nativeAppStatic`. */
-const NATIVE_APP_SUBDOMAINS = [
-    'about',
-    'developer',
-    'docs',
-    'editor',
-    'markus',
-    'pdf',
-    'apps',
-] as const;
+const NATIVE_APP_SUBDOMAINS = ['about', 'developer', 'docs', 'apps'] as const;
 
 /** Subset served out of a `dist/` subdirectory rather than the app root. */
 const NATIVE_APPS_WITH_DIST = new Set(['docs', 'developer']);

src/backend/server.test.ts

@@ -368,12 +368,114 @@ describe('PuterServer host header validation', () => {
         expect(api.status).toBe(404);
     });
 
+    it('lets a deployment subdomain frame the feedback embed and names it', async () => {
+        const parent = `http://spreadsheet.puter.localhost:${port}`;
+        const res = await request('/embed/feedback', {
+            host: `puter.localhost:${port}`,
+            referer: `${parent}/sheet/1`,
+        });
+        expect(res.status).toBe(200);
+        expect(res.headers['x-frame-options']).toBeUndefined();
+        expect(res.headers['content-security-policy']).toBe(
+            `frame-ancestors 'self' ${parent}`,
+        );
+        expect(res.headers['cache-control']).toBe('no-store');
+        expect(res.body).toContain('/dist/feedback-embed.min.js');
+        expect(res.body).not.toContain('/dist/bundle.min.js');
+        const config = JSON.parse(
+            res.body.match(/id="feedback-embed-config">(.*?)<\/script>/)[1],
+        );
+        expect(config).toEqual({
+            apiOrigin: `http://api.puter.localhost:${port}`,
+            hostOrigin: parent,
+        });
+
+        const hosted = await request('/embed/feedback', {
+            host: `puter.localhost:${port}`,
+            referer: `http://someone.site.puter.localhost:${port}/`,
+        });
+        expect(hosted.headers['content-security-policy']).toBe("frame-ancestors 'self'");
+        expect(
+            JSON.parse(
+                hosted.body.match(/id="feedback-embed-config">(.*?)<\/script>/)[1],
+            ).hostOrigin,
+        ).toBeNull();
+
+        const redirected = await request('/embed/feedback?puter.api_origin=https://other.test', {
+            host: `puter.localhost:${port}`,
+        });
+        expect(redirected.status).toBe(302);
+        expect(redirected.headers.location).toBe('/embed/feedback');
+    });
+
+    it.each([
+        'sign-in',
+        'show-open-file-picker',
+        'show-save-file-picker',
+        'show-directory-picker',
+        'upgrade',
+    ])('lets a deployment subdomain frame the %s popup and names it to the GUI', async (action) => {
+        const parent = `http://spreadsheet.puter.localhost:${port}`;
+        const guiParams = (body: string) =>
+            JSON.parse(body.match(/gui\((\{.*\})\);/)[1]);
+        const res = await request(`/embed/${action}`, {
+            host: `puter.localhost:${port}`,
+            referer: `${parent}/sheet/1`,
+        });
+        expect(res.status).toBe(200);
+        expect(res.headers['x-frame-options']).toBeUndefined();
+        expect(res.headers['content-security-policy']).toBe(
+            `frame-ancestors 'self' ${parent}`,
+        );
+        expect(res.headers['cache-control']).toBe('no-store');
+        expect(guiParams(res.body).embed_host_origin).toBe(parent);
+
+        const hosted = await request(`/embed/${action}`, {
+            host: `puter.localhost:${port}`,
+            referer: `http://someone.site.puter.localhost:${port}/`,
+        });
+        expect(hosted.headers['content-security-policy']).toBe("frame-ancestors 'self'");
+        expect(guiParams(hosted.body).embed_host_origin).toBeNull();
+
+        const redirected = await request(`/embed/${action}?auth_token=x&embedded_in_popup=true`, {
+            host: `puter.localhost:${port}`,
+            referer: `${parent}/sheet/1`,
+        });
+        expect(redirected.status).toBe(302);
+        expect(redirected.headers.location).toBe(`/embed/${action}`);
+        expect(redirected.headers['x-frame-options']).toBe('SAMEORIGIN');
+    });
+
+    it.each(['/embed/SIGN-IN', '/embed/Show-Open-File-Picker', '/embed/sign-in/', '/embed/Upgrade', '/embed/upgrade/'])(
+        'lets a first-party page frame only the exact spelling of %s',
+        async (spelling) => {
+            const res = await request(spelling, {
+                host: `puter.localhost:${port}`,
+                referer: `http://spreadsheet.puter.localhost:${port}/`,
+            });
+            expect(res.status).toBe(302);
+            expect(res.headers.location).toBe(spelling.toLowerCase().replace(/\/$/, ''));
+            expect(res.headers['x-frame-options']).toBe('SAMEORIGIN');
+            expect(res.headers['content-security-policy']).toBeUndefined();
+        },
+    );
+
+    it('names no framing page to the popups it serves in a window', async () => {
+        const res = await request('/action/sign-in?embedded_in_popup=true', {
+            host: `puter.localhost:${port}`,
+            referer: `http://spreadsheet.puter.localhost:${port}/`,
+        });
+        expect(res.headers['x-frame-options']).toBe('SAMEORIGIN');
+        expect(res.headers['content-security-policy']).toBeUndefined();
+        expect(res.body).not.toContain('embed_host_origin');
+    });
+
     it.each([
         ['a user-hosted site', 'http://someone.site.puter.localhost:PORT/'],
         ['a private app host', 'http://someone.app.puter.localhost:PORT/'],
         ['the API host', 'http://api.puter.localhost:PORT/'],
         ['the WebDAV host', 'http://dav.puter.localhost:PORT/'],
-        ['a native app host', 'http://editor.puter.localhost:PORT/'],
+        ['a native app host', 'http://about.puter.localhost:PORT/'],
         ['a nested subdomain', 'http://a.spreadsheet.puter.localhost:PORT/'],
         ['another site', 'http://evil.test:PORT/'],
         ['another port', 'http://spreadsheet.puter.localhost:1/'],

src/backend/services/events/userHandlers.worker.integration.test.ts

@@ -144,11 +144,22 @@ const createInline = async (
     return String(response.body.subId);
 };
 
-const delivered = (count = 1): Promise<void> =>
-    vi.waitFor(() => expect(sinkPosts.length).toBeGreaterThanOrEqual(count), {
-        timeout: 30_000,
-        interval: 50,
-    });
+/**
+ * The post each label made, in order, once all have arrived. Matched by label
+ * since earlier tests' subscriptions stay live and post to the same sink.
+ */
+const delivered = async (...labels: string[]): Promise<SinkPost[]> => {
+    await vi.waitFor(
+        () =>
+            expect(sinkPosts.map((post) => post.label)).toEqual(
+                expect.arrayContaining(labels),
+            ),
+        { timeout: 30_000, interval: 50 },
+    );
+    return labels.map((label) =>
+        sinkPosts.find((post) => post.label === label)!,
+    );
+};
 
 beforeAll(async () => {
     env = await setupPuterTestEnv({
@@ -255,14 +266,11 @@ describe('an inline handler in a user scope, end to end', () => {
             await env.server.services.fs.touch(holder.id, {
                 path: `${holder.anchor}/note.txt`,
             });
-            await delivered();
+            const [post] = await delivered('inline');
 
-            expect(sinkPosts[0]).toMatchObject({
-                label: 'inline',
-                path: `${holder.anchor}/note.txt`,
-            });
+            expect(post.path).toBe(`${holder.anchor}/note.txt`);
             const { actor } = await env.server.services.auth.authenticate(
-                sinkPosts[0].token!,
+                post.token!,
             );
             expect(actor!.user?.id).toBe(holder.id);
             expect(actor!.effectiveApp?.uid).toBe(appUid);
@@ -297,14 +305,14 @@ describe('an inline handler in a user scope, end to end', () => {
                 await env.server.services.fs.touch(holder.id, {
                     path: `${holder.anchor}/shared-${i}.txt`,
                 });
-            await delivered(2);
-            const runAs = new Set<number>();
-            for (const post of sinkPosts)
-                runAs.add(
-                    (await env.server.services.auth.authenticate(post.token!))
-                        .actor!.user!.id,
+            // The first test's 'inline' handler also posts for holders[0].
+            const posts = await delivered('first', 'second');
+            for (const [i, post] of posts.entries()) {
+                const { actor } = await env.server.services.auth.authenticate(
+                    post.token!,
                 );
-            expect(runAs).toEqual(new Set(holders.map((h) => h.id)));
+                expect(actor!.user!.id).toBe(holders[i].id);
+            }
             create.mockRestore();
         },
     );

src/backend/services/homepage/PuterHomepageService.test.ts

@@ -107,6 +107,31 @@ describe('app browser embed shell', () => {
     });
 });
 
+describe('feedback embed shell', () => {
+    it('carries the framing page and API origin, and loads only its own script', () => {
+        const html = makeService({
+            api_base_url: 'https://api.deployment.test',
+            gui_bundle: '/static/bundle.min.js?v=42',
+        }).renderFeedbackEmbed({ hostOrigin: 'https://notes.deployment.test' });
+        const configJson = html.match(/id="feedback-embed-config">(.*?)<\/script>/)![1];
+        expect(JSON.parse(configJson)).toEqual({
+            apiOrigin: 'https://api.deployment.test',
+            hostOrigin: 'https://notes.deployment.test',
+        });
+        expect(html).toContain('<script defer src="/static/feedback-embed.min.js?v=42"></script>');
+        expect(html).toContain('<link rel="stylesheet" href="/css/feedback-embed.css">');
+        expect(html).toContain('<main id="feedback-embed"></main>');
+        expect(html).not.toContain('bundle.min.js');
+        expect(html).not.toContain('apps-embed');
+    });
+
+    it('carries no framing page when none is allowed', () => {
+        const html = makeService({}).renderFeedbackEmbed({ hostOrigin: null });
+        const configJson = html.match(/id="feedback-embed-config">(.*?)<\/script>/)![1];
+        expect(JSON.parse(configJson).hostOrigin).toBeNull();
+    });
+});
+
 /** Capture what the service sends, and return the rendered HTML. */
 const render = async (
     service: PuterHomepageService,

src/backend/services/homepage/PuterHomepageService.ts

@@ -48,6 +48,15 @@ export interface LaunchOptions {
     on_initialized?: Array<Record<string, unknown>>;
 }
 
+/**
+ * A GUI popup a first-party page frames at `/embed/<action>`. `hostOrigin` is
+ * that page, read from the referrer and pinned with frame-ancestors; null when
+ * no allowed page frames it.
+ */
+export interface PopupFrame {
+    hostOrigin: string | null;
+}
+
 interface PuterGuiAddonsEvent {
     req: Request;
     path: string;
@@ -171,15 +180,50 @@ export class PuterHomepageService extends PuterService {
     renderAppBrowserEmbed({
         guestApps = [],
     }: { guestApps?: Array<Record<string, unknown>> } = {}): string {
-        const configJson = JSON.stringify({
-            apiOrigin: this.config.api_base_url,
-            sdkUrl:
-                this.config.env === 'dev'
-                    ? '/sdk/puter.dev.js'
-                    : (this.config.gui_puterjs_bundle ??
-                      'https://js.puter.com/v2/'),
-            guestApps,
-        }).replace(/</g, '\\u003c');
+        return this.#renderEmbed({
+            rootId: 'app-browser',
+            rootClass: 'dashboard',
+            stylesheet: 'apps-embed.css',
+            script: 'apps-embed.min.js',
+            config: {
+                apiOrigin: this.config.api_base_url,
+                sdkUrl:
+                    this.config.env === 'dev'
+                        ? '/sdk/puter.dev.js'
+                        : (this.config.gui_puterjs_bundle ??
+                          'https://js.puter.com/v2/'),
+                guestApps,
+            },
+        });
+    }
+
+    /**
+     * `hostOrigin` is the first-party page framing the dialog, which the
+     * feedback is sent for; null when no allowed page frames it.
+     */
+    renderFeedbackEmbed({ hostOrigin }: { hostOrigin: string | null }): string {
+        return this.#renderEmbed({
+            rootId: 'feedback-embed',
+            stylesheet: 'feedback-embed.css',
+            script: 'feedback-embed.min.js',
+            config: { apiOrigin: this.config.api_base_url, hostOrigin },
+        });
+    }
+
+    #renderEmbed({
+        rootId,
+        rootClass,
+        stylesheet,
+        script,
+        config,
+    }: {
+        rootId: string;
+        rootClass?: string;
+        stylesheet: string;
+        script: string;
+        config: Record<string, unknown>;
+    }): string {
+        const configJson = JSON.stringify(config).replace(/</g, '\\u003c');
 
         return `<!DOCTYPE html>
 <html lang="en">
@@ -190,27 +234,27 @@ export class PuterHomepageService extends PuterService {
     <title>${encode(String(this.config.gui_params?.title ?? 'Puter'))}</title>
     <link rel="stylesheet" href="/css/normalize.css">
     <link rel="stylesheet" href="/css/dashboard.css">
-    <link rel="stylesheet" href="/css/apps-embed.css">
+    <link rel="stylesheet" href="/css/${stylesheet}">
 </head>
 <body>
-    <main id="app-browser" class="dashboard"></main>
-    <script type="application/json" id="app-browser-config">${configJson}</script>
-    <script defer src="${encode(this.#appBrowserEmbedScript())}"></script>
+    <main id="${rootId}"${rootClass ? ` class="${rootClass}"` : ''}></main>
+    <script type="application/json" id="${rootId}-config">${configJson}</script>
+    <script defer src="${encode(this.#embedScript(script))}"></script>
 </body>
 </html>`;
     }
 
     /**
-     * The embed's script is built beside the GUI bundle, so it is served from
+     * Embed scripts are built beside the GUI bundle, so they are served from
      * wherever `gui_bundle` is (a CDN in production), with the same query.
      */
-    #appBrowserEmbedScript(): string {
+    #embedScript(name: string): string {
         const base = 'http://relative.invalid';
         const bundle = new URL(
             this.config.gui_bundle ?? '/dist/bundle.min.js',
             base,
         );
-        const script = new URL('apps-embed.min.js', bundle);
+        const script = new URL(name, bundle);
         script.search = bundle.search;
         return script.origin === base
             ? `${script.pathname}${script.search}`
@@ -268,6 +312,7 @@ export class PuterHomepageService extends PuterService {
         ctx: { req: Request; res: Response; actor?: Actor | null },
         meta: PageMeta,
         launchOptions: LaunchOptions = {},
+        popupFrame?: PopupFrame,
     ): Promise<void> {
         const { req, res, actor } = ctx;
 
@@ -292,6 +337,7 @@ export class PuterHomepageService extends PuterService {
             { req, actor: actor ?? null },
             meta,
             launchOptions,
+            popupFrame,
         );
         res.send(html);
     }
@@ -302,6 +348,7 @@ export class PuterHomepageService extends PuterService {
         ctx: { req: Request; actor: Actor | null },
         meta: PageMeta,
         launchOptions: LaunchOptions,
+        popupFrame?: PopupFrame,
     ): Promise<string> {
         const { req, actor } = ctx;
         const env = this.config.env ?? 'prod';
@@ -347,6 +394,8 @@ export class PuterHomepageService extends PuterService {
             eventsNotifications: notificationsFoldInEnabled(this.config),
             ...meta,
             launch_options: launchOptions,
+            // After `meta`, so nothing page-specific can name the opener.
+            ...(popupFrame ? { embed_host_origin: popupFrame.hostOrigin } : {}),
         };
 
         const event: PuterGuiAddonsEvent = {

src/backend/services/localworker/LocalWorkerService.shutdown.test.ts

@@ -78,7 +78,10 @@ describe('LocalWorkerService shutdown disposal', () => {
         disposals[0].mockImplementationOnce(async () => {
             await held;
         });
-        vi.useFakeTimers();
+        vi.useFakeTimers({ toFake: ['setTimeout', 'clearTimeout'] });
+        // The test server keeps arming timers from real callbacks while fakes
+        // are installed, so only what shutdown arms synchronously is checked.
+        const arm = vi.spyOn(globalThis, 'setTimeout');
         try {
             let finished = false;
             const draining = Promise.resolve(service.onServerShutdown()).then(
@@ -86,12 +89,13 @@ describe('LocalWorkerService shutdown disposal', () => {
                     finished = true;
                 },
             );
+            expect(arm.mock.calls.map(([, ms]) => ms)).toEqual([5_000]);
             await vi.advanceTimersByTimeAsync(4_999);
             expect(finished).toBe(false);
             await vi.advanceTimersByTimeAsync(1);
             await draining;
-            expect(vi.getTimerCount()).toBe(0);
         } finally {
+            arm.mockRestore();
             release();
             vi.useRealTimers();
         }

src/backend/services/realtime/OpenAIRealtimeRelayService.test.ts

@@ -2860,8 +2860,12 @@ describe('OpenAIRealtimeRelayService relay', () => {
                 ),
             ).toHaveLength(64),
         );
+        // Holds are reserved and usage recorded one at a time, which a loaded
+        // runner takes past vi.waitFor's default second.
+        const settled = (check: () => Promise<void> | void) =>
+            vi.waitFor(check, { timeout: 5_000 });
         // The pool grew one item per commit, with nothing spare at the cap.
-        await vi.waitFor(async () =>
+        await settled(async () =>
             expect(
                 await server.services.metering.getOutstandingHolds(actor),
             ).toBe(64 * 10_896_000),
@@ -2890,7 +2894,7 @@ describe('OpenAIRealtimeRelayService relay', () => {
         for (let batch = 0; batch < 8; batch++) {
             for (let i = Math.max(1, batch * 8); i < (batch + 1) * 8; i++)
                 complete(i);
-            await vi.waitFor(() =>
+            await settled(() =>
                 expect(
                     recorded.mock.calls
                         .flatMap(([, rows]) => rows)
@@ -2906,13 +2910,13 @@ describe('OpenAIRealtimeRelayService relay', () => {
                 .filter((row) => row.usageType.includes('transcription_'))
                 .reduce((sum, row) => sum + row.costOverride!, 0),
         ).toBe(640);
-        await vi.waitFor(async () =>
+        await settled(async () =>
             expect(
                 await server.services.metering.getOutstandingHolds(actor),
             ).toBe(2 * 10_896_000),
         );
         c.ws.close();
-        await vi.waitFor(async () =>
+        await settled(async () =>
             expect(
                 await server.services.metering.getOutstandingHolds(actor),
             ).toBe(0),

src/backend/services/realtime/README.md

@@ -1,11 +1,11 @@
 # OpenAI Realtime relay
 
 The relay serves `/puterai/openai/v1/realtime` on the API host. The SDK exposes
-it through [`puter.ai.convo()`](../../../docs/src/AI/convo.md).
+it through [`puter.ai.realtime()`](../../../docs/src/AI/realtime.md).
 
 **Beta:** This API is incomplete. Its methods, options, events, and behavior may change abruptly, including breaking changes without notice.
 
-Direct clients are documented in the [Realtime WebSocket API reference](../../../docs/src/AI/realtime.md).
+Direct clients are documented in the [Realtime WebSocket API reference](../../../docs/src/AI/realtime-websocket.md).
 
 ## Transport
 
@@ -27,7 +27,7 @@ The socket opens before authentication completes. Authentication and model
 failures arrive as OpenAI-shaped error events followed by a close frame.
 
 ```js
-const conversation = await puter.ai.convo({ output: ['text'] });
+const conversation = await puter.ai.realtime({ output: ['text'] });
 conversation.on('error', (event) => console.error(event));
 conversation.on('text', ({ delta }) => console.log(delta));
 conversation.on('turn.done', () => conversation.close());

src/backend/stores/app/AppStore.test.js

@@ -1542,18 +1542,22 @@ describe('AppStore detailed stats', () => {
     let db;
 
     const APP_UID = `app-stats-${Date.now()}`;
-    const nowSeconds = Math.floor(Date.now() / 1000);
+    // The windows come from the clock, so it is pinned: mid-week and
+    // mid-month, and minutes clear of midnight in any time zone.
+    const NOW = new Date('2026-06-17T12:07:30Z');
+    const nowSeconds = Math.floor(NOW.getTime() / 1000);
 
     beforeAll(async () => {
         server = await setupTestServer();
         appStore = server.stores.app;
         db = server.clients.db;
         await clearAppCache(server.clients.redis);
+        vi.useFakeTimers({ toFake: ['Date'], now: NOW });
 
-        // Two users; the repeat shares a timestamp so it is always same-hour.
+        // Two users in one hour. Windows end at now, exclusive.
         for (const [userId, offset] of [
-            [1, 0],
-            [1, 0],
+            [1, 60],
+            [1, 60],
             [2, 120],
         ]) {
             await db.write(
@@ -1564,6 +1568,7 @@ describe('AppStore detailed stats', () => {
     });
 
     afterAll(async () => {
+        vi.useRealTimers();
         await server?.shutdown();
     });
 

src/backend/testUtil.ts

@@ -154,6 +154,9 @@ export const setupTestServer = async (
             redis: { useMock: true },
             // Suites run system jobs themselves, not on the poll timer.
             jobs: { enabled: false },
+            // The health loop's timed `SELECT 1` would land in tests that
+            // count queries.
+            server_health: { disabled_checks: ['database-liveness'] },
             s3: { localConfig: { inMemory: true } },
             no_default_user: true,
             no_devwatch: true,

src/backend/types.ts

@@ -1102,8 +1102,9 @@ interface IConfigOptional {
     /** Force the bundled GUI even in dev. Default: false. */
     use_bundled_gui: boolean;
     /**
-     * Override the GUI bundle JS path. Default: `/dist/bundle.min.js`. The app
-     * browser embed loads `apps-embed.min.js` from the same directory.
+     * Override the GUI bundle JS path. Default: `/dist/bundle.min.js`. The
+     * `/embed/*` pages load `apps-embed.min.js` and `feedback-embed.min.js`
+     * from the same directory.
      */
     gui_bundle: string;
     /** Override the GUI CSS path when bundled. Default: `/dist/bundle.min.css`. */

src/backend/vitest.config.ts

@@ -37,6 +37,9 @@ const repoRoot = path.resolve(backendDir, '../..');
 const isPgmockMode =
     (process.env.PUTER_TEST_DB_ENGINE ?? '').toLowerCase() === 'postgres';
 const pgmockTimeoutMs = 600_000;
+// Loaded CI runners stall timers well past the 5 s / 10 s defaults; a real
+// hang still fails, just later.
+const ciTimeouts = { testTimeout: 20_000, hookTimeout: 60_000 };
 
 // Tests that always boot pgmock regardless of PUTER_TEST_DB_ENGINE. Too slow
 // for CI; run locally or via `npm run test:backend:postgres`.
@@ -103,9 +106,11 @@ export const lowerDecoratorsPlugin = {
             loader: 'ts',
             target: 'es2024',
             sourcefile: id,
-            sourcemap: 'inline',
+            sourcemap: 'external',
         });
-        return { code: result.code, map: null };
+        // Without the map, coverage and stack traces report esbuild's
+        // output lines instead of the source's.
+        return { code: result.code, map: result.map };
     },
 };
 
@@ -145,7 +150,9 @@ export default defineConfig(({ mode }) => ({
                   hookTimeout: pgmockTimeoutMs,
                   fileParallelism: false,
               }
-            : {}),
+            : isCi
+              ? ciTimeouts
+              : {}),
         coverage: {
             provider: 'v8',
             reporter: isCi

src/docs/src/AI.md

@@ -200,8 +200,8 @@ These AI features are supported out of the box when using Puter.js:
 - **[`puter.ai.img2txt()`](/AI/img2txt/)** - Extract text from images (OCR)
 - **[`puter.ai.txt2vid()`](/AI/txt2vid/)** - Generate short video clips from text or a reference image with Wan, Seedance, Veo, Kling, MiniMax H3 and other models, or edit a video you supply with Gemini Omni, FLUX 3 or Kling Omni
 - **[`puter.ai.speech2speech()`](/AI/speech2speech/)** - Convert speech in one voice to another voice
-- **[`puter.ai.convo()`](/AI/convo/)** - Prepare a beta realtime conversation with optional text, microphone, playback, and interruption helpers
-- **[Realtime WebSocket API](/AI/realtime/)** - Connect directly without puter.js. This API is in beta and may change abruptly.
+- **[`puter.ai.realtime()`](/AI/realtime/)** - Prepare a beta realtime conversation with optional text, microphone, playback, and interruption helpers
+- **[Realtime WebSocket API](/AI/realtime-websocket/)** - Connect directly without puter.js. This API is in beta and may change abruptly.
 - **[`puter.ai.listModels()`](/AI/listModels/)** - List available AI chat models (and providers) that Puter currently exposes.
 - **[`puter.ai.listModelProviders()`](/AI/listModelProviders/)** - List the AI providers that Puter currently exposes.
 - **[`puter.ai.txt2speech.listEngines()`](/AI/txt2speech.listEngines/)** - List available TTS engines/models

src/docs/src/AI/convo.md

@@ -1,151 +0,0 @@
----
-title: puter.ai.convo()
-description: Prepare an OpenAI realtime conversation with optional audio and text helpers.
-platforms: [websites, apps, nodejs, workers]
----
-
-Prepares a realtime OpenAI conversation that your app can connect to when it's ready.
-
-Preparing the conversation verifies Puter sign-in. Realtime conversations require a paid Puter plan, and usage is billed to the signed-in user. Native OpenAI events and convenience methods use the same session. Microphone capture and speaker playback start when your app requests them.
-
-In Node.js, the SDK requires a global `WebSocket`, available in Node.js 22 or later.
-
-**Beta:** This API is incomplete. Its methods, options, events, and behavior may change abruptly, including breaking changes without notice.
-
-To connect without puter.js, see the [Realtime WebSocket API](/AI/realtime/).
-
-## Syntax
-
-```js
-const conversation = await puter.ai.convo(options = {});
-await conversation.connect();
-```
-
-## Parameters
-
-#### `options` (Object) (Optional)
-
-The options object accepts these fields.
-
-| Option | Type | Description |
-|--------|------|-------------|
-| `model` | `String` | The realtime model. Defaults to `gpt-realtime-2.1-mini`. Also accepts `gpt-realtime-2.1`, `gpt-realtime-2`, `gpt-realtime-1.5`, `gpt-realtime`, and `gpt-realtime-mini`. |
-| `instructions` | `String` | Session instructions, up to 8192 characters. Defaults to the provider's default. |
-| `output` | `Array<String>` | Accepts `['text']`, `['audio']`, or both. Defaults to `['audio']`. Audio includes a transcript. Requesting both uses audio output and emits transcript deltas through the `text` event. |
-| `voice` | `String` | OpenAI voice identifier, up to 128 characters. Defaults to the provider's default. |
-| `turnDetection` | `Boolean` | Whether the provider detects the end of spoken turns automatically. Defaults to `true`. Set to `false` for manual audio commits. |
-
-## Return value
-
-A Promise resolves to a prepared conversation after options and sign-in are checked. In a browser, preparation opens the Puter sign-in prompt if needed. Preparation opens no realtime connection and requests no microphone access.
-
-The conversation exposes these properties and methods.
-
-| Member | Behavior |
-| --- | --- |
-| `state` | `prepared`, `connecting`, `connected`, or `closed`. |
-| `model` | Resolved model name. |
-| `connect()` | Opens the connection and applies settings. Resolves after the provider acknowledges session configuration. Concurrent calls share one connection Promise, including bounded retries for transient setup failures. Calling it while connected opens no additional connection. During a reconnection, it resolves when the reconnection succeeds and rejects if the conversation closes instead. |
-| `configure(options)` | Updates the given session settings and resolves after the provider acknowledges this update. Settings it isn't given, including ones set through native events, are left alone. Accepts the factory options except `model`. One update can be pending at a time. Provider rules apply to changes such as switching a voice after audio has been generated. |
-| `sendText(text)` | Adds a user message and requests a response. Text must be nonempty and at most 8192 characters. |
-| `appendAudio(pcm)` | Appends an `Int16Array` containing PCM16, 24 kHz mono audio. A chunk contains at most 12000 samples. |
-| `commitAudio()` | Commits buffered audio and requests a response. Requires turn detection to be off, through `turnDetection: false` or a native session update. The provider requires at least 100 ms of buffered audio. |
-| `interrupt(position?)` | Stops built-in playback immediately and waits for cancellation and playback-history synchronization. A reply requested but not yet started is cancelled as soon as it starts. Custom players provide `{ itemId, contentIndex, playedMs }`. An idle call resolves immediately. Readiness failures reject the returned Promise with `session_not_ready` or `session_closed`. |
-| `send(event)` | Sends a native OpenAI JSON event. |
-| `on(type, handler)` | Registers a listener and returns an unsubscribe function. Use `'*'` to receive every native and convenience event. |
-| `off(type, handler)` | Removes a listener. |
-| `close()` | Closes the session, rejects pending operations, and releases SDK-owned capture and playback resources. Repeated calls have no additional effect. |
-
-Attach listeners before connecting to receive initial session events. Closing during connection rejects the pending attempt.
-
-If the connection drops because of network loss, a server restart or a provider error, the conversation reconnects on its own. Normal closes with code 1000 end the conversation. While it reconnects, `state` is `connecting`, a `reconnecting` event fires, and pending operations reject with `connection_lost`. The new session gets every setting the provider acknowledged, from the factory options, `configure()` and native `session.update` events. Then `ready` fires again with `reconnected: true`. Listeners, the microphone and the speaker carry over. Microphone audio captured while reconnecting is dropped.
-
-The conversation also restores recent context. Before `ready` fires, it adds back up to 40 of the most recent conversation items, 48 KiB in total. Restored items are user text, user speech that has a transcript, assistant replies as text, and function calls with their outputs. User speech has a transcript only when input transcription is configured through native session settings. An assistant reply that was interrupted, or still playing when the connection dropped, is cut to what the user saw or heard. The cut is estimated from how much of the audio played, so it can be off by a few words. Images, speech without a transcript, deleted items, and replies still generating when the connection dropped are left out. Restored items get new item IDs, don't fire item events, and count as input tokens on the next response. Item IDs from before the reconnect don't work in later events. Restoration uses a contiguous suffix of restorable items. An oversized newest item leaves that suffix empty. Older items left out to fit the window fire a `context_trimmed` event with the count in `omittedItems`; this is routine and not an error. A provider refusal or a failure to send the restored items fires one `error` event with code `context_restore_failed` per restoration. In both cases the conversation stays connected. Items are preserved without truncating text, function arguments or function results.
-
-When Puter knows ahead of time that the server a session runs on will restart, it sends a `puter.reconnect` event, which also reaches your listeners. Without that notice, a restart drops the connection and the conversation reconnects as above. Within a few seconds, the conversation opens a replacement session in the background while the current one keeps working. It switches once no reply is generating or playing, no user turn is being spoken or transcribed, no function call is waiting for its output, and nothing you sent is waiting on the provider. The switch goes through the same steps as a reconnect, and the `reconnecting` event has code 1012. If the replacement can't open yet, the conversation keeps the current session and tries again later. A refusal that retrying can't fix, such as `insufficient_funds`, stops the attempts. If the server closes the session first, the conversation switches to the replacement, or reconnects if none is open.
-
-The conversation makes up to ten attempts over about a minute. In a browser that reports being offline, it first waits up to two minutes for the connection to come back. If every attempt fails, or the server refuses with an error such as `insufficient_funds`, the conversation closes. A closed conversation cannot reconnect. To start another session, prepare a new one.
-
-Native event definitions are listed in the [OpenAI realtime reference](https://developers.openai.com/api/reference/resources/realtime/server-events). Native events retain their provider fields. Sending native events preserves direct control of the session. Puter refuses `conversation.item.retrieve` events and MCP tools (`"type": "mcp"`) in `session.update` and `response.create` events. Sending one fires an `error` event with code `invalid_event`, and the conversation closes with code 1008. Audio helpers expect the session to use PCM16 at 24 kHz.
-
-## Errors and limits
-
-Failures use objects containing `code` and `message`. Preparation can reject with `invalid_argument`, `model_not_found`, `auth_required`, `auth_canceled`, or `auth_failed`. Connection can reject with `subscription_required` or `insufficient_funds`, which also show the Puter upgrade prompt. Connection and asynchronous operations can reject with provider errors, `session_closed`, `connection_lost`, `operation_timeout`, or `operation_in_progress`. Sending before readiness, or while reconnecting, throws `session_not_ready`.
-
-Invalid input throws `invalid_argument`, `invalid_event`, or `input_too_large`. A full SDK send queue throws `queue_full`. Media helpers report `unsupported_environment`, `permission_denied`, `media_error`, `media_timeout`, or `queue_full`. Runtime media errors and `context_restore_failed` arrive through the `error` event. Provider errors also arrive as native `error` events with a nested `error` object.
-
-Each native event is capped at 64 KiB. The SDK bounds JSON traversal, outgoing queues, acknowledgment waits, microphone work, and playback. All numeric limits are listed on [rate limits and quotas](/rate-limits-and-quotas/).
-
-## Convenience events
-
-The conversation emits these events alongside native events.
-
-| Event | Fields |
-| --- | --- |
-| `ready` | `model`, `provider`, and `reconnected: true` after a reconnection |
-| `reconnecting` | `code`, `reason` of the dropped connection. After a `puter.reconnect` event, `code` is 1012. |
-| `context_trimmed` | `omittedItems`, the number of restorable items left out of the restored context after a reconnection. Fires before `ready`. |
-| `text` | `delta`, `responseId` |
-| `transcript` | `role`, `text`, `final`. Assistant deltas use `final: false`. Completed assistant and user transcripts use `final: true`. User transcripts require transcription to be configured through native session settings. |
-| `audio` | `pcm`, `sampleRate`, `responseId`, `itemId`, `contentIndex`. The PCM chunk is an `Int16Array`. |
-| `interrupted` | `source` (`manual` or `speech`), `responseId` |
-| `turn.done` | `responseId`, native provider `usage`, `status` |
-| `close` | `code`, `reason` |
-
-Each event includes its `type`. When the provider event leaves out an ID, `responseId` and `itemId` are empty strings and `contentIndex` is `0`. The `interrupted` event signals local interruption immediately. Its corresponding operation resolves after the provider acknowledges cancellation and any requested truncation. Late audio from a canceled response remains visible as native events and is excluded from convenience audio and built-in playback.
-
-## Browser media
-
-The optional microphone and speaker helpers require a browser with Web Audio support. Microphone capture also requires media permissions and a secure context. Start audio from a user action so the browser can allow playback.
-
-| Member | Behavior |
-| --- | --- |
-| `microphone.start()` | Requests microphone access and streams PCM16, resampled to 24 kHz, in 20 ms chunks through an AudioWorklet. If the page or network falls behind, chunks are dropped rather than stopping capture. |
-| `microphone.mute()` | Disables capture tracks and stops forwarding captured chunks. |
-| `microphone.unmute()` | Enables capture tracks and forwarding. |
-| `microphone.stop()` | Stops capture tracks and releases capture resources. A `start()` still waiting on the permission prompt rejects with `session_closed`. |
-| `speaker.start({ bargeIn: true })` | Starts playback. Barge-in defaults to `true`. With barge-in enabled, provider speech-start events interrupt playback and synchronize played audio with conversation history. Starting the speaker requests no microphone access. |
-| `speaker.stop()` | Clears playback and releases its audio context. |
-
-Both start methods require a connected session. Capture and playback are independent, so custom audio input can use the built-in speaker, and built-in capture can use custom playback.
-
-## Examples
-
-### Have a text conversation
-
-A text conversation uses convenience methods for input and streamed output.
-
-```js
-const conversation = await puter.ai.convo({
-    output: ['text'],
-    instructions: 'Keep replies short.',
-});
-
-conversation.on('text', ({ delta }) => console.log(delta));
-conversation.on('turn.done', () => conversation.close());
-conversation.on('error', (event) => console.error(event));
-
-await conversation.connect();
-conversation.sendText('Say hello in three words.');
-```
-
-### Have a voice conversation
-
-A voice conversation enables the microphone and speaker after connection.
-
-```js
-const conversation = await puter.ai.convo();
-conversation.on('transcript', ({ role, text }) => console.log(role, text));
-conversation.on('error', (event) => console.error(event));
-
-await conversation.connect();
-await conversation.speaker.start();
-await conversation.microphone.start();
-
-// To interrupt a response and submit a replacement text turn:
-await conversation.interrupt();
-conversation.sendText('Actually, make it Wednesday.');
-
-// When the user ends the conversation:
-conversation.close();
-```

src/docs/src/AI/realtime-websocket.md

@@ -0,0 +1,126 @@
+---
+title: Realtime WebSocket API (Beta)
+description: Connect to OpenAI realtime conversations through Puter without puter.js.
+platforms: [websites, apps, nodejs, workers]
+---
+
+The Realtime WebSocket API lets your client send and receive native OpenAI realtime JSON events through Puter.
+
+Puter authenticates the user and charges their account for usage.
+
+**Beta:** This API is incomplete. Its methods, options, events, and behavior may change abruptly, including breaking changes without notice.
+
+For optional text, microphone, playback, and interruption helpers, use [`puter.ai.realtime()`](/AI/realtime/).
+
+## Connection and authentication
+
+Connect to this URL on the Puter API host:
+
+```text
+wss://api.puter.com/puterai/openai/v1/realtime?model=gpt-realtime-2.1-mini
+```
+
+The `model` query parameter defaults to `gpt-realtime-2.1-mini`. The model is fixed for the connection. A session update that changes it is rejected. It also accepts `gpt-realtime-2.1`, `gpt-realtime-2`, `gpt-realtime-1.5`, `gpt-realtime`, and `gpt-realtime-mini`.
+
+Authenticate with a Puter session, app, or full-access API token. Puter supplies the provider credential. Server clients pass this header:
+
+```text
+Authorization: Bearer <PUTER_TOKEN>
+```
+
+Browser WebSocket clients pass `realtime` and `openai-insecure-api-key.<PUTER_TOKEN>` as subprotocols. The server echoes only `realtime`. The endpoint also accepts an `auth_token` query parameter. Prefer the authorization header where supported because URLs and subprotocols can appear in logs. Authentication takes precedence in this order, header, subprotocol, then query parameter.
+
+The socket can open before authentication and provider setup finish. Listen for errors and closure immediately. Wait for `session.created`, send your session settings, then wait for `session.updated` before submitting a turn.
+
+To open a replacement while another connection remains healthy, set the optional `purpose=handover` query parameter. These attempts share a smaller per-credential budget, checked before the general connection-attempt budget. Initial connections and dropped-connection recovery use the URL without this parameter. The limits are listed in [rate limits and quotas](/rate-limits-and-quotas/).
+
+## Text example
+
+Install the `ws` package and set `PUTER_TOKEN` to your Puter token. Run this example as a Node.js ES module:
+
+```js
+import WebSocket from 'ws';
+
+const socket = new WebSocket(
+    'wss://api.puter.com/puterai/openai/v1/realtime?model=gpt-realtime-2.1-mini',
+    { headers: { Authorization: `Bearer ${process.env.PUTER_TOKEN}` } },
+);
+const send = (event) => socket.send(JSON.stringify(event));
+
+socket.on('message', (data) => {
+    const event = JSON.parse(data.toString());
+
+    if (event.type === 'session.created') {
+        send({
+            type: 'session.update',
+            session: {
+                type: 'realtime',
+                output_modalities: ['text'],
+                instructions: 'Keep replies short.',
+            },
+        });
+    }
+    if (event.type === 'session.updated') {
+        send({
+            type: 'conversation.item.create',
+            item: {
+                type: 'message',
+                role: 'user',
+                content: [{ type: 'input_text', text: 'Hello!' }],
+            },
+        });
+        send({ type: 'response.create' });
+    }
+    if (event.type === 'response.output_text.delta')
+        process.stdout.write(event.delta);
+    if (event.type === 'error')
+        console.error(event.error);
+    if (event.type === 'response.done')
+        socket.close();
+});
+socket.on('error', console.error);
+socket.on('close', (code, reason) => console.log(code, reason.toString()));
+```
+
+## Events, audio, and interruption
+
+Each message contains one JSON object with a nonempty string `type` of at most 128 characters. Binary messages are rejected. Native events retain their provider fields. The endpoint doesn't deliver `rate_limits.updated`, which describes Puter's provider account rather than yours, and it removes provider organization IDs from error messages. The endpoint exposes the WebSocket event protocol. Your client manages capture, playback, acknowledgments, and timeouts.
+
+The endpoint refuses `conversation.item.retrieve` events and MCP tools (`"type": "mcp"`) in `session.update` and `response.create` events. A refused event isn't sent to the provider. The session gets an `invalid_event` error and closes with 1008.
+
+PCM16 audio configured at 24 kHz mono is sent as base64 chunks in `input_audio_buffer.append` events. Output arrives in `response.output_audio.delta` events. With manual turn detection, commit buffered input with `input_audio_buffer.commit`, then request a reply with `response.create`.
+
+To interrupt, stop local playback immediately and send `response.cancel` with the active `response_id`. If some generated audio was not played, send `conversation.item.truncate` with its `item_id`, `content_index`, and `audio_end_ms` set to the amount actually played. Wait for `response.done` and any requested `conversation.item.truncated` acknowledgment before submitting a replacement turn.
+
+Connection loss ends the session. Reconnecting creates a new conversation. Tool execution and automatic reconnection belong to your client.
+
+## Server restarts
+
+When Puter knows ahead of time that the server a session runs on will restart, it sends each open session this event, at most once a minute:
+
+```json
+{
+    "type": "puter.reconnect",
+    "event_id": "event_puter_1767225600000",
+    "reason": "server_restarting",
+    "close_in_ms": 90000
+}
+```
+
+The `reason` field is `server_restarting`. The `close_in_ms` field, when present, is about how long until the server closes the session itself. The session keeps working until then. Open a new connection after a short, randomized delay, and once it gets `session.created` and your client is idle, with no response generating and no user turn in progress, move to it and close the old one. A connection that reaches a server that is also restarting gets a `server_restarting` error and closes with 1012. In that case keep the old session and try again after a short, randomized delay. If the server closes the old session first, the close code is 1012, and your client reconnects the same way. A restart can also drop the connection without any notice, so treat an unexpected close the same way.
+
+A new connection starts an empty conversation. To keep context, add earlier items back with `conversation.item.create` before you request a response. Event types that start with `puter.` come from Puter, not the provider.
+
+## Errors, billing, and limits
+
+API errors arrive as `{ "type": "error", "error": { "code": "...", "message": "..." } }`. Handle socket errors and close frames too. Invalid, missing, or revoked credentials use `invalid_api_key`. If Puter can't check a credential or the account's plan, the error is `internal_error` and the session closes with 1011, so try again after a short, randomized delay. Other relay codes include `permission_denied`, `model_not_found`, `insufficient_funds`, `subscription_required`, `rate_limit_exceeded`, `invalid_event`, `connection_timeout`, `provider_unavailable`, `upstream_error`, and `server_restarting`.
+
+Policy failures generally close with 1008, oversized client messages with 1009, upstream or setup failures with 1011, server restarts with 1012, and temporary server overload with 1013. Reconnect after 1011, 1012, or 1013. Authentication and model failures can arrive after the WebSocket handshake succeeds.
+
+The endpoint requires a paid Puter plan. Usage is charged after completed responses and input transcriptions. While a response generates, part of your balance is held for it, so a session opens only if your balance covers one response. If the provider connection closes before a response reports its usage, the response is charged the full amount held for it. Each account can open 20 sessions at once by default. Each JSON message you send is limited to 64 KiB, including reassembled fragments. Messages from the provider can be up to 4 MiB. Stream audio in small chunks. All message rates, queue caps, timeouts, and other bounds are published in [rate limits and quotas](/rate-limits-and-quotas/).
+
+Input transcription holds a small amount of your balance per transcribed item, priced at the transcription model you select. Two items are reserved ahead of your audio and replenished as the provider commits them, so a session holds only its spare items plus the items still awaiting a transcript. Changing the transcription model reprices the spare items. If your balance can't cover another item, audio waits while earlier items settle; once none are left to settle, the session closes with `insufficient_funds`. Failed transcriptions, items without final usage, and audio whose commit the provider never acknowledges before the connection closes are each charged that model's fixed per-item amount. Unacknowledged audio is charged one item per started 160 seconds. With server turn detection, only detected speech counts, so silence is never charged. The amounts, timeout and audio limits are listed in [rate limits and quotas](/rate-limits-and-quotas/).
+
+Provider-reported realtime models must have a known price. A missing model uses the last known model. An explicitly unpriced model closes the connection with `upstream_error`.
+
+After recording usage, the connection can continue while settled credit is positive, including a fractional balance. Each new billable operation still needs its full reservation after accounting for other outstanding holds.

src/docs/src/AI/realtime.md

@@ -1,126 +1,151 @@
 ---
-title: Realtime WebSocket API (Beta)
-description: Connect to OpenAI realtime conversations through Puter without puter.js.
+title: puter.ai.realtime()
+description: Prepare an OpenAI realtime conversation with optional audio and text helpers.
 platforms: [websites, apps, nodejs, workers]
 ---
 
-The Realtime WebSocket API lets your client send and receive native OpenAI realtime JSON events through Puter.
+Prepares a realtime OpenAI conversation that your app can connect to when it's ready.
 
-Puter authenticates the user and charges their account for usage.
+Preparing the conversation verifies Puter sign-in. Realtime conversations require a paid Puter plan, and usage is billed to the signed-in user. Native OpenAI events and convenience methods use the same session. Microphone capture and speaker playback start when your app requests them.
+
+In Node.js, the SDK requires a global `WebSocket`, available in Node.js 22 or later.
 
 **Beta:** This API is incomplete. Its methods, options, events, and behavior may change abruptly, including breaking changes without notice.
 
-For optional text, microphone, playback, and interruption helpers, use [`puter.ai.convo()`](/AI/convo/).
+To connect without puter.js, see the [Realtime WebSocket API](/AI/realtime-websocket/).
 
-## Connection and authentication
-
-Connect to this URL on the Puter API host:
-
-```text
-wss://api.puter.com/puterai/openai/v1/realtime?model=gpt-realtime-2.1-mini
-```
-
-The `model` query parameter defaults to `gpt-realtime-2.1-mini`. The model is fixed for the connection. A session update that changes it is rejected. It also accepts `gpt-realtime-2.1`, `gpt-realtime-2`, `gpt-realtime-1.5`, `gpt-realtime`, and `gpt-realtime-mini`.
-
-Authenticate with a Puter session, app, or full-access API token. Puter supplies the provider credential. Server clients pass this header:
-
-```text
-Authorization: Bearer <PUTER_TOKEN>
-```
-
-Browser WebSocket clients pass `realtime` and `openai-insecure-api-key.<PUTER_TOKEN>` as subprotocols. The server echoes only `realtime`. The endpoint also accepts an `auth_token` query parameter. Prefer the authorization header where supported because URLs and subprotocols can appear in logs. Authentication takes precedence in this order, header, subprotocol, then query parameter.
-
-The socket can open before authentication and provider setup finish. Listen for errors and closure immediately. Wait for `session.created`, send your session settings, then wait for `session.updated` before submitting a turn.
-
-To open a replacement while another connection remains healthy, set the optional `purpose=handover` query parameter. These attempts share a smaller per-credential budget, checked before the general connection-attempt budget. Initial connections and dropped-connection recovery use the URL without this parameter. The limits are listed in [rate limits and quotas](/rate-limits-and-quotas/).
-
-## Text example
-
-Install the `ws` package and set `PUTER_TOKEN` to your Puter token. Run this example as a Node.js ES module:
+## Syntax
 
 ```js
-import WebSocket from 'ws';
+const conversation = await puter.ai.realtime(options = {});
+await conversation.connect();
+```
 
-const socket = new WebSocket(
-    'wss://api.puter.com/puterai/openai/v1/realtime?model=gpt-realtime-2.1-mini',
-    { headers: { Authorization: `Bearer ${process.env.PUTER_TOKEN}` } },
-);
-const send = (event) => socket.send(JSON.stringify(event));
+## Parameters
 
-socket.on('message', (data) => {
-    const event = JSON.parse(data.toString());
+#### `options` (Object) (Optional)
 
-    if (event.type === 'session.created') {
-        send({
-            type: 'session.update',
-            session: {
-                type: 'realtime',
-                output_modalities: ['text'],
-                instructions: 'Keep replies short.',
-            },
-        });
-    }
-    if (event.type === 'session.updated') {
-        send({
-            type: 'conversation.item.create',
-            item: {
-                type: 'message',
-                role: 'user',
-                content: [{ type: 'input_text', text: 'Hello!' }],
-            },
-        });
-        send({ type: 'response.create' });
-    }
-    if (event.type === 'response.output_text.delta')
-        process.stdout.write(event.delta);
-    if (event.type === 'error')
-        console.error(event.error);
-    if (event.type === 'response.done')
-        socket.close();
+The options object accepts these fields.
+
+| Option | Type | Description |
+|--------|------|-------------|
+| `model` | `String` | The realtime model. Defaults to `gpt-realtime-2.1-mini`. Also accepts `gpt-realtime-2.1`, `gpt-realtime-2`, `gpt-realtime-1.5`, `gpt-realtime`, and `gpt-realtime-mini`. |
+| `instructions` | `String` | Session instructions, up to 8192 characters. Defaults to the provider's default. |
+| `output` | `Array<String>` | Accepts `['text']`, `['audio']`, or both. Defaults to `['audio']`. Audio includes a transcript. Requesting both uses audio output and emits transcript deltas through the `text` event. |
+| `voice` | `String` | OpenAI voice identifier, up to 128 characters. Defaults to the provider's default. |
+| `turnDetection` | `Boolean` | Whether the provider detects the end of spoken turns automatically. Defaults to `true`. Set to `false` for manual audio commits. |
+
+## Return value
+
+A Promise resolves to a prepared conversation after options and sign-in are checked. In a browser, preparation opens the Puter sign-in prompt if needed. Preparation opens no realtime connection and requests no microphone access.
+
+The conversation exposes these properties and methods.
+
+| Member | Behavior |
+| --- | --- |
+| `state` | `prepared`, `connecting`, `connected`, or `closed`. |
+| `model` | Resolved model name. |
+| `connect()` | Opens the connection and applies settings. Resolves after the provider acknowledges session configuration. Concurrent calls share one connection Promise, including bounded retries for transient setup failures. Calling it while connected opens no additional connection. During a reconnection, it resolves when the reconnection succeeds and rejects if the conversation closes instead. |
+| `configure(options)` | Updates the given session settings and resolves after the provider acknowledges this update. Settings it isn't given, including ones set through native events, are left alone. Accepts the factory options except `model`. One update can be pending at a time. Provider rules apply to changes such as switching a voice after audio has been generated. |
+| `sendText(text)` | Adds a user message and requests a response. Text must be nonempty and at most 8192 characters. |
+| `appendAudio(pcm)` | Appends an `Int16Array` containing PCM16, 24 kHz mono audio. A chunk contains at most 12000 samples. |
+| `commitAudio()` | Commits buffered audio and requests a response. Requires turn detection to be off, through `turnDetection: false` or a native session update. The provider requires at least 100 ms of buffered audio. |
+| `interrupt(position?)` | Stops built-in playback immediately and waits for cancellation and playback-history synchronization. A reply requested but not yet started is cancelled as soon as it starts. Custom players provide `{ itemId, contentIndex, playedMs }`. An idle call resolves immediately. Readiness failures reject the returned Promise with `session_not_ready` or `session_closed`. |
+| `send(event)` | Sends a native OpenAI JSON event. |
+| `on(type, handler)` | Registers a listener and returns an unsubscribe function. Use `'*'` to receive every native and convenience event. |
+| `off(type, handler)` | Removes a listener. |
+| `close()` | Closes the session, rejects pending operations, and releases SDK-owned capture and playback resources. Repeated calls have no additional effect. |
+
+Attach listeners before connecting to receive initial session events. Closing during connection rejects the pending attempt.
+
+If the connection drops because of network loss, a server restart or a provider error, the conversation reconnects on its own. Normal closes with code 1000 end the conversation. While it reconnects, `state` is `connecting`, a `reconnecting` event fires, and pending operations reject with `connection_lost`. The new session gets every setting the provider acknowledged, from the factory options, `configure()` and native `session.update` events. Then `ready` fires again with `reconnected: true`. Listeners, the microphone and the speaker carry over. Microphone audio captured while reconnecting is dropped.
+
+The conversation also restores recent context. Before `ready` fires, it adds back up to 40 of the most recent conversation items, 48 KiB in total. Restored items are user text, user speech that has a transcript, assistant replies as text, and function calls with their outputs. User speech has a transcript only when input transcription is configured through native session settings. An assistant reply that was interrupted, or still playing when the connection dropped, is cut to what the user saw or heard. The cut is estimated from how much of the audio played, so it can be off by a few words. Images, speech without a transcript, deleted items, and replies still generating when the connection dropped are left out. Restored items get new item IDs, don't fire item events, and count as input tokens on the next response. Item IDs from before the reconnect don't work in later events. Restoration uses a contiguous suffix of restorable items. An oversized newest item leaves that suffix empty. Older items left out to fit the window fire a `context_trimmed` event with the count in `omittedItems`; this is routine and not an error. A provider refusal or a failure to send the restored items fires one `error` event with code `context_restore_failed` per restoration. In both cases the conversation stays connected. Items are preserved without truncating text, function arguments or function results.
+
+When Puter knows ahead of time that the server a session runs on will restart, it sends a `puter.reconnect` event, which also reaches your listeners. Without that notice, a restart drops the connection and the conversation reconnects as above. Within a few seconds, the conversation opens a replacement session in the background while the current one keeps working. It switches once no reply is generating or playing, no user turn is being spoken or transcribed, no function call is waiting for its output, and nothing you sent is waiting on the provider. The switch goes through the same steps as a reconnect, and the `reconnecting` event has code 1012. If the replacement can't open yet, the conversation keeps the current session and tries again later. A refusal that retrying can't fix, such as `insufficient_funds`, stops the attempts. If the server closes the session first, the conversation switches to the replacement, or reconnects if none is open.
+
+The conversation makes up to ten attempts over about a minute. In a browser that reports being offline, it first waits up to two minutes for the connection to come back. If every attempt fails, or the server refuses with an error such as `insufficient_funds`, the conversation closes. A closed conversation cannot reconnect. To start another session, prepare a new one.
+
+Native event definitions are listed in the [OpenAI realtime reference](https://developers.openai.com/api/reference/resources/realtime/server-events). Native events retain their provider fields. Sending native events preserves direct control of the session. Puter refuses `conversation.item.retrieve` events and MCP tools (`"type": "mcp"`) in `session.update` and `response.create` events. Sending one fires an `error` event with code `invalid_event`, and the conversation closes with code 1008. Audio helpers expect the session to use PCM16 at 24 kHz.
+
+## Errors and limits
+
+Failures use objects containing `code` and `message`. Preparation can reject with `invalid_argument`, `model_not_found`, `auth_required`, `auth_canceled`, or `auth_failed`. Connection can reject with `subscription_required` or `insufficient_funds`, which also show the Puter upgrade prompt. Connection and asynchronous operations can reject with provider errors, `session_closed`, `connection_lost`, `operation_timeout`, or `operation_in_progress`. Sending before readiness, or while reconnecting, throws `session_not_ready`.
+
+Invalid input throws `invalid_argument`, `invalid_event`, or `input_too_large`. A full SDK send queue throws `queue_full`. Media helpers report `unsupported_environment`, `permission_denied`, `media_error`, `media_timeout`, or `queue_full`. Runtime media errors and `context_restore_failed` arrive through the `error` event. Provider errors also arrive as native `error` events with a nested `error` object.
+
+Each native event is capped at 64 KiB. The SDK bounds JSON traversal, outgoing queues, acknowledgment waits, microphone work, and playback. All numeric limits are listed on [rate limits and quotas](/rate-limits-and-quotas/).
+
+## Convenience events
+
+The conversation emits these events alongside native events.
+
+| Event | Fields |
+| --- | --- |
+| `ready` | `model`, `provider`, and `reconnected: true` after a reconnection |
+| `reconnecting` | `code`, `reason` of the dropped connection. After a `puter.reconnect` event, `code` is 1012. |
+| `context_trimmed` | `omittedItems`, the number of restorable items left out of the restored context after a reconnection. Fires before `ready`. |
+| `text` | `delta`, `responseId` |
+| `transcript` | `role`, `text`, `final`. Assistant deltas use `final: false`. Completed assistant and user transcripts use `final: true`. User transcripts require transcription to be configured through native session settings. |
+| `audio` | `pcm`, `sampleRate`, `responseId`, `itemId`, `contentIndex`. The PCM chunk is an `Int16Array`. |
+| `interrupted` | `source` (`manual` or `speech`), `responseId` |
+| `turn.done` | `responseId`, native provider `usage`, `status` |
+| `close` | `code`, `reason` |
+
+Each event includes its `type`. When the provider event leaves out an ID, `responseId` and `itemId` are empty strings and `contentIndex` is `0`. The `interrupted` event signals local interruption immediately. Its corresponding operation resolves after the provider acknowledges cancellation and any requested truncation. Late audio from a canceled response remains visible as native events and is excluded from convenience audio and built-in playback.
+
+## Browser media
+
+The optional microphone and speaker helpers require a browser with Web Audio support. Microphone capture also requires media permissions and a secure context. Start audio from a user action so the browser can allow playback.
+
+| Member | Behavior |
+| --- | --- |
+| `microphone.start()` | Requests microphone access and streams PCM16, resampled to 24 kHz, in 20 ms chunks through an AudioWorklet. If the page or network falls behind, chunks are dropped rather than stopping capture. |
+| `microphone.mute()` | Disables capture tracks and stops forwarding captured chunks. |
+| `microphone.unmute()` | Enables capture tracks and forwarding. |
+| `microphone.stop()` | Stops capture tracks and releases capture resources. A `start()` still waiting on the permission prompt rejects with `session_closed`. |
+| `speaker.start({ bargeIn: true })` | Starts playback. Barge-in defaults to `true`. With barge-in enabled, provider speech-start events interrupt playback and synchronize played audio with conversation history. Starting the speaker requests no microphone access. |
+| `speaker.stop()` | Clears playback and releases its audio context. |
+
+Both start methods require a connected session. Capture and playback are independent, so custom audio input can use the built-in speaker, and built-in capture can use custom playback.
+
+## Examples
+
+### Have a text conversation
+
+A text conversation uses convenience methods for input and streamed output.
+
+```js
+const conversation = await puter.ai.realtime({
+    output: ['text'],
+    instructions: 'Keep replies short.',
 });
-socket.on('error', console.error);
-socket.on('close', (code, reason) => console.log(code, reason.toString()));
+
+conversation.on('text', ({ delta }) => console.log(delta));
+conversation.on('turn.done', () => conversation.close());
+conversation.on('error', (event) => console.error(event));
+
+await conversation.connect();
+conversation.sendText('Say hello in three words.');
 ```
 
-## Events, audio, and interruption
+### Have a voice conversation
 
-Each message contains one JSON object with a nonempty string `type` of at most 128 characters. Binary messages are rejected. Native events retain their provider fields. The endpoint doesn't deliver `rate_limits.updated`, which describes Puter's provider account rather than yours, and it removes provider organization IDs from error messages. The endpoint exposes the WebSocket event protocol. Your client manages capture, playback, acknowledgments, and timeouts.
+A voice conversation enables the microphone and speaker after connection.
 
-The endpoint refuses `conversation.item.retrieve` events and MCP tools (`"type": "mcp"`) in `session.update` and `response.create` events. A refused event isn't sent to the provider. The session gets an `invalid_event` error and closes with 1008.
+```js
+const conversation = await puter.ai.realtime();
+conversation.on('transcript', ({ role, text }) => console.log(role, text));
+conversation.on('error', (event) => console.error(event));
 
-PCM16 audio configured at 24 kHz mono is sent as base64 chunks in `input_audio_buffer.append` events. Output arrives in `response.output_audio.delta` events. With manual turn detection, commit buffered input with `input_audio_buffer.commit`, then request a reply with `response.create`.
+await conversation.connect();
+await conversation.speaker.start();
+await conversation.microphone.start();
 
-To interrupt, stop local playback immediately and send `response.cancel` with the active `response_id`. If some generated audio was not played, send `conversation.item.truncate` with its `item_id`, `content_index`, and `audio_end_ms` set to the amount actually played. Wait for `response.done` and any requested `conversation.item.truncated` acknowledgment before submitting a replacement turn.
+// To interrupt a response and submit a replacement text turn:
+await conversation.interrupt();
+conversation.sendText('Actually, make it Wednesday.');
 
-Connection loss ends the session. Reconnecting creates a new conversation. Tool execution and automatic reconnection belong to your client.
-
-## Server restarts
-
-When Puter knows ahead of time that the server a session runs on will restart, it sends each open session this event, at most once a minute:
-
-```json
-{
-    "type": "puter.reconnect",
-    "event_id": "event_puter_1767225600000",
-    "reason": "server_restarting",
-    "close_in_ms": 90000
-}
+// When the user ends the conversation:
+conversation.close();
 ```
-
-The `reason` field is `server_restarting`. The `close_in_ms` field, when present, is about how long until the server closes the session itself. The session keeps working until then. Open a new connection after a short, randomized delay, and once it gets `session.created` and your client is idle, with no response generating and no user turn in progress, move to it and close the old one. A connection that reaches a server that is also restarting gets a `server_restarting` error and closes with 1012. In that case keep the old session and try again after a short, randomized delay. If the server closes the old session first, the close code is 1012, and your client reconnects the same way. A restart can also drop the connection without any notice, so treat an unexpected close the same way.
-
-A new connection starts an empty conversation. To keep context, add earlier items back with `conversation.item.create` before you request a response. Event types that start with `puter.` come from Puter, not the provider.
-
-## Errors, billing, and limits
-
-API errors arrive as `{ "type": "error", "error": { "code": "...", "message": "..." } }`. Handle socket errors and close frames too. Invalid, missing, or revoked credentials use `invalid_api_key`. If Puter can't check a credential or the account's plan, the error is `internal_error` and the session closes with 1011, so try again after a short, randomized delay. Other relay codes include `permission_denied`, `model_not_found`, `insufficient_funds`, `subscription_required`, `rate_limit_exceeded`, `invalid_event`, `connection_timeout`, `provider_unavailable`, `upstream_error`, and `server_restarting`.
-
-Policy failures generally close with 1008, oversized client messages with 1009, upstream or setup failures with 1011, server restarts with 1012, and temporary server overload with 1013. Reconnect after 1011, 1012, or 1013. Authentication and model failures can arrive after the WebSocket handshake succeeds.
-
-The endpoint requires a paid Puter plan. Usage is charged after completed responses and input transcriptions. While a response generates, part of your balance is held for it, so a session opens only if your balance covers one response. If the provider connection closes before a response reports its usage, the response is charged the full amount held for it. Each account can open 20 sessions at once by default. Each JSON message you send is limited to 64 KiB, including reassembled fragments. Messages from the provider can be up to 4 MiB. Stream audio in small chunks. All message rates, queue caps, timeouts, and other bounds are published in [rate limits and quotas](/rate-limits-and-quotas/).
-
-Input transcription holds a small amount of your balance per transcribed item, priced at the transcription model you select. Two items are reserved ahead of your audio and replenished as the provider commits them, so a session holds only its spare items plus the items still awaiting a transcript. Changing the transcription model reprices the spare items. If your balance can't cover another item, audio waits while earlier items settle; once none are left to settle, the session closes with `insufficient_funds`. Failed transcriptions, items without final usage, and audio whose commit the provider never acknowledges before the connection closes are each charged that model's fixed per-item amount. Unacknowledged audio is charged one item per started 160 seconds. With server turn detection, only detected speech counts, so silence is never charged. The amounts, timeout and audio limits are listed in [rate limits and quotas](/rate-limits-and-quotas/).
-
-Provider-reported realtime models must have a known price. A missing model uses the last known model. An explicitly unpriced model closes the connection with `upstream_error`.
-
-After recording usage, the connection can continue while settled credit is positive, including a fractional balance. Each new billable operation still needs its full reservation after accounting for other outstanding holds.

src/docs/src/Auth/signIn.md

@@ -6,7 +6,7 @@ platforms: [websites]
 
 Initiates the sign in process for the user.
 
-This will open a popup window with the appropriate authentication method. Puter automatically handles the authentication process and will resolve the promise when the user has signed in.
+This will open a popup window with the appropriate authentication method. Puter automatically handles the authentication process and will resolve the promise when the user has signed in. Puter's own apps on puter.com subdomains show the sign-in in a frame over the page instead, and open the popup when the user picks a sign-in provider such as Google.
 
 It is important to note that all essential methods in Puter handle authentication automatically. This method is only necessary if you want to handle authentication manually, for example if you want to build your own custom authentication flow.
 

src/docs/src/UI/showFeedbackDialog.md

@@ -8,7 +8,7 @@ Opens a dialog where the user can send you, the app's developer, feedback about
 
 The message is delivered by Puter: it is stored and emailed to the email address on your Puter account. The feedback never passes through your app's code, and the dialog tells the user what is shared with you: their username, plus their email address (as the email's reply-to, so you can respond) when their email is verified.
 
-Inside Puter, the dialog is rendered by the desktop environment. On a website, a puter.com popup hosts the dialog (signing the user in first if needed).
+Inside Puter, the dialog is rendered by the desktop environment. On a website, a puter.com popup hosts the dialog (signing the user in first if needed). Puter's own apps on puter.com subdomains show it in a frame over the page instead, when the user is signed in to both.
 
 **Feedback is opt-in.** Users can only send feedback if it's enabled for your app. Apps created in the Dev Center have feedback enabled at creation — you can turn it off with the "User Feedback" toggle in the app's settings. Apps created through `puter.apps.create` default to off; enable it by setting `feedbackEnabled`:
 

src/docs/src/rate-limits-and-quotas.md

@@ -91,7 +91,7 @@ Gemini speech-to-text first counts the audio's tokens, which times out after 30
 
 The OpenAI- and Anthropic-compatible endpoints (`/puterai/openai/v1/*`, `/puterai/anthropic/v1/messages`) require a paid plan; a free account gets `402 subscription_required`. The same models are available to every account through `puter.ai.*` and `/drivers/call`, and the model catalogue endpoints are open to everyone.
 
-Realtime sessions ([`puter.ai.convo()`](/AI/convo/), `/puterai/openai/v1/realtime`) require a paid plan, like the other OpenAI-compatible endpoints, and are capped at 20 open at once per account. An account without a plan gets an `error` event with code `subscription_required`. A session over the cap gets `rate_limit_exceeded`. Both close with 1008.
+Realtime sessions ([`puter.ai.realtime()`](/AI/realtime/), `/puterai/openai/v1/realtime`) require a paid plan, like the other OpenAI-compatible endpoints, and are capped at 20 open at once per account. An account without a plan gets an `error` event with code `subscription_required`. A session over the cap gets `rate_limit_exceeded`. Both close with 1008.
 
 | Realtime transport limit | Value | Behavior at the limit |
 | --- | --- | --- |
@@ -131,7 +131,7 @@ Realtime sessions ([`puter.ai.convo()`](/AI/convo/), `/puterai/openai/v1/realtim
 
 Send audio as a stream of small chunks. The message cap applies to text, configuration, tool output, and audio alike.
 
-The [`puter.ai.convo()`](/AI/convo/) SDK also applies these limits before sending or retaining data.
+The [`puter.ai.realtime()`](/AI/realtime/) SDK also applies these limits before sending or retaining data.
 
 | Conversation SDK limit | Value | Behavior at the limit |
 | --- | --- | --- |

src/docs/src/sidebar.js

@@ -124,17 +124,17 @@ let sidebar = [
                 path: '/AI/speech2speech',
             },
             {
-                title: '<code>convo()</code>',
-                page_title: '<code>puter.ai.convo()</code>',
-                title_tag: 'puter.ai.convo()',
+                title: '<code>realtime()</code>',
+                page_title: '<code>puter.ai.realtime()</code>',
+                title_tag: 'puter.ai.realtime()',
                 icon: '/assets/img/function.svg',
-                source: '/AI/convo.md',
-                path: '/AI/convo',
+                source: '/AI/realtime.md',
+                path: '/AI/realtime',
             },
             {
                 title: 'Realtime WebSocket API (Beta)',
-                source: '/AI/realtime.md',
-                path: '/AI/realtime',
+                source: '/AI/realtime-websocket.md',
+                path: '/AI/realtime-websocket',
             },
             {
                 title: '<code>listModels()</code>',

src/gui/src/IPC.enablePush.test.js

@@ -46,7 +46,7 @@ vi.mock('./UI/UIWindowFontPicker.js', stub);
 vi.mock('./UI/UIPermissionDialog.js', () => ({ default: permissionDialog }));
 vi.mock('./UI/UIEnablePushDialog.js', () => ({ default: dialog }));
 vi.mock('./UI/UIWindowSaveAccount.js', stub);
-vi.mock('./UI/UIWindowSignup.js', stub);
+vi.mock('./UI/Auth/UIAuthSignup.js', stub);
 vi.mock('./UI/UINotification.js', stub);
 vi.mock('./helpers/godmodeTokens.js', () => ({ renewGodmodeToken: vi.fn() }));
 vi.mock('./helpers/watchItems.js', () => ({ addItemWatcher: vi.fn() }));

src/gui/src/IPC.errors.test.js

@@ -23,7 +23,7 @@ vi.mock('./UI/UIWindowEmailConfirmationRequired.js', stub);
 vi.mock('./UI/UIWindowFontPicker.js', stub);
 vi.mock('./UI/UIPermissionDialog.js', stub);
 vi.mock('./UI/UIWindowSaveAccount.js', stub);
-vi.mock('./UI/UIWindowSignup.js', stub);
+vi.mock('./UI/Auth/UIAuthSignup.js', stub);
 vi.mock('./UI/UINotification.js', stub);
 vi.mock('./helpers/godmodeTokens.js', () => ({ renewGodmodeToken: vi.fn() }));
 vi.mock('./helpers/watchItems.js', () => ({ addItemWatcher: vi.fn() }));

src/gui/src/IPC.js

@@ -36,7 +36,7 @@ import UIWindowFontPicker from './UI/UIWindowFontPicker.js';
 import UIPermissionDialog from './UI/UIPermissionDialog.js';
 import UIEnablePushDialog from './UI/UIEnablePushDialog.js';
 import UIWindowSaveAccount from './UI/UIWindowSaveAccount.js';
-import UIWindowSignup from './UI/UIWindowSignup.js';
+import UIAuthSignup from './UI/Auth/UIAuthSignup.js';
 import UINotification from './UI/UINotification.js';
 
 import { renewGodmodeToken } from './helpers/godmodeTokens.js';
@@ -611,7 +611,7 @@ const ipc_listener = async (event, handled) => {
     //--------------------------------------------------------
     else if ( event.data.msg === 'showOpenFilePicker' ) {
         // Auth
-        if ( !window.is_auth() && !(await UIWindowSignup({ referrer: app_name })) )
+        if ( !window.is_auth() && !(await UIAuthSignup({ referrer: app_name })) )
         {
             return;
         }
@@ -677,7 +677,7 @@ const ipc_listener = async (event, handled) => {
     //--------------------------------------------------------
     else if ( event.data.msg === 'showDirectoryPicker' ) {
         // Auth
-        if ( !window.is_auth() && !(await UIWindowSignup({ referrer: app_name })) )
+        if ( !window.is_auth() && !(await UIAuthSignup({ referrer: app_name })) )
         {
             return;
         }
@@ -783,7 +783,7 @@ const ipc_listener = async (event, handled) => {
     //--------------------------------------------------------
     else if ( event.data.msg === 'mouseMoved' ) {
         // Auth
-        if ( !window.is_auth() && !(await UIWindowSignup({ referrer: app_name })) )
+        if ( !window.is_auth() && !(await UIAuthSignup({ referrer: app_name })) )
         {
             return;
         }
@@ -818,7 +818,7 @@ const ipc_listener = async (event, handled) => {
     //--------------------------------------------------------
     else if ( event.data.msg === 'contextMenu' ) {
         // Auth
-        if ( !window.is_auth() && !(await UIWindowSignup({ referrer: app_name })) )
+        if ( !window.is_auth() && !(await UIAuthSignup({ referrer: app_name })) )
         {
             return;
         }
@@ -1384,7 +1384,7 @@ const ipc_listener = async (event, handled) => {
 
         // auth
         try {
-            if ( !window.is_auth() && !(await UIWindowSignup({ referrer: app_name })) )
+            if ( !window.is_auth() && !(await UIAuthSignup({ referrer: app_name })) )
             {
                 respond(false);
                 return;
@@ -1490,7 +1490,7 @@ const ipc_listener = async (event, handled) => {
         try {
             // auth
             try {
-                if ( !window.is_auth() && !(await UIWindowSignup({ referrer: app_name })) )
+                if ( !window.is_auth() && !(await UIAuthSignup({ referrer: app_name })) )
                 {
                     respond(false);
                     return;
@@ -1543,7 +1543,7 @@ const ipc_listener = async (event, handled) => {
         enable_push_dialog_guard.markOpened();
         try {
             try {
-                if ( !window.is_auth() && !(await UIWindowSignup({ referrer: app_name })) )
+                if ( !window.is_auth() && !(await UIAuthSignup({ referrer: app_name })) )
                 {
                     respond('unavailable');
                     return;
@@ -1592,7 +1592,7 @@ const ipc_listener = async (event, handled) => {
         custom_domain_dialog_guard.markOpened();
         try {
             try {
-                if ( !window.is_auth() && !(await UIWindowSignup({ referrer: app_name })) ) {
+                if ( !window.is_auth() && !(await UIAuthSignup({ referrer: app_name })) ) {
                     respond(null);
                     return;
                 }
@@ -1624,7 +1624,7 @@ const ipc_listener = async (event, handled) => {
     //--------------------------------------------------------
     else if ( event.data.msg === 'showFontPicker' ) {
         // auth
-        if ( !window.is_auth() && !(await UIWindowSignup({ referrer: app_name })) )
+        if ( !window.is_auth() && !(await UIAuthSignup({ referrer: app_name })) )
         {
             return;
         }
@@ -1657,7 +1657,7 @@ const ipc_listener = async (event, handled) => {
     //--------------------------------------------------------
     else if ( event.data.msg === 'showColorPicker' ) {
         // Auth
-        if ( !window.is_auth() && !(await UIWindowSignup({ referrer: app_name })) )
+        if ( !window.is_auth() && !(await UIAuthSignup({ referrer: app_name })) )
         {
             return;
         }
@@ -1699,7 +1699,7 @@ const ipc_listener = async (event, handled) => {
         }
 
         //auth
-        if ( !window.is_auth() && !(await UIWindowSignup({ referrer: app_name })) )
+        if ( !window.is_auth() && !(await UIAuthSignup({ referrer: app_name })) )
         {
             return;
         }

src/gui/src/UI/Auth/UIAuth2FA.js

@@ -0,0 +1,292 @@
+/*
+ * Copyright (C) 2024-present Puter Technologies Inc.
+ *
+ * This file is part of Puter.
+ *
+ * Puter is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published
+ * by the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <https://www.gnu.org/licenses/>.
+ */
+
+// The second factor of a login: a code from the user's authenticator app,
+// or one of their recovery codes. Verifies the challenge the first factor
+// (a password, or an identity provider) was answered with.
+
+import { SVG } from '../Dashboard/UIDashboardDialog.js';
+import openAuthFlow, { keepCurrentSession, setAuthStatus } from './authFlow.js';
+
+const CODE_LENGTH = 6;
+const RECOVERY_CODE_LENGTH = 8;
+// How long a wrong code stays on screen before the boxes clear for another try.
+const WRONG_CODE_MS = 1200;
+
+const SHIELD_ICON = SVG('<path d="M12 22s8-4 8-10V5l-8-3-8 3v7c0 6 8 10 8 10z"/>');
+
+/**
+ * Sends a code for the challenge. Both routes are `guiOriginOnly` and carry
+ * no `subdomain`, so they go to the root origin: on `api_origin` the
+ * subdomain gate skips them and Express 404s.
+ *
+ * @param {'otp'|'recovery-code'} route
+ * @param {string} token The first factor's challenge.
+ * @param {string} code
+ * @returns {Promise<{ ok: true, data: object } | { ok: false, error: string }>}
+ *   `error` is an i18n key.
+ */
+export const verifySecondFactor = async (route, token, code) => {
+    try {
+        const resp = await fetch(`${window.gui_origin}/login/${route}`, {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/json' },
+            body: JSON.stringify({ token, code }),
+        });
+        if ( resp.status === 429 ) return { ok: false, error: 'confirm_code_generic_too_many_requests' };
+        const data = await resp.json();
+        if ( ! data?.proceed ) return { ok: false, error: 'confirm_code_generic_incorrect' };
+        return { ok: true, data };
+    } catch {
+        return { ok: false, error: 'something_went_wrong' };
+    }
+};
+
+/**
+ * A screen's head: the shield, a title and what to do.
+ *
+ * @param {string} title i18n key.
+ * @param {string} instructions i18n key.
+ * @returns {string}
+ */
+const headHtml = (title, instructions) => '<div class="auth-head">'
+    + `<div class="auth-badge" aria-hidden="true">${SHIELD_ICON}</div>`
+    + `<h1 class="auth-title">${i18n(title)}</h1>`
+    + `<p class="auth-subtitle">${i18n(instructions)}</p>`
+    + '</div>';
+
+/**
+ * Shows the recovery code screen over the code screen; Back returns to it.
+ *
+ * @param {import('./authFlow.js').AuthFlow} flow
+ * @param {string} token
+ * @param {(data: object) => void} onVerified
+ */
+const pushRecoveryScreen = (flow, token, onVerified) => {
+    let h = '<div class="dashboard-dialog-body auth-body">';
+    h += headHtml('login2fa_recovery_title', 'login2fa_recovery_instructions');
+    h += '<form class="auth-form login-2fa-recovery-form" novalidate>';
+    h += '<div class="dashboard-form-status" role="status" aria-live="polite"></div>';
+    h += `<input type="text" class="dashboard-dialog-input login-2fa-recovery-input" maxlength="${RECOVERY_CODE_LENGTH}"`;
+    h += ` placeholder="${html_encode(i18n('login2fa_recovery_placeholder', [], false))}" aria-label="${i18n('login2fa_recovery_title')}"`;
+    h += ' autocomplete="off" autocapitalize="characters" autocorrect="off" spellcheck="false">';
+    h += '</form>';
+    h += '</div>';
+
+    const $screen = flow.push({ name: 'recovery-code', html: h });
+    const $input = $screen.find('.login-2fa-recovery-input');
+    let verifying = false;
+
+    const verify = async () => {
+        // Codes are 8-char base32; a pasted one usually carries the newline
+        // it was copied with.
+        const value = String($input.val() ?? '').trim().toUpperCase();
+        if ( value.length !== RECOVERY_CODE_LENGTH || verifying ) return;
+        verifying = true;
+        flow.setBusy(true);
+        setAuthStatus($screen, i18n('verifying', [], false), { kind: 'info' });
+        const result = await verifySecondFactor('recovery-code', token, value);
+        verifying = false;
+        if ( flow.isClosed() ) {
+            if ( result.ok ) keepCurrentSession();
+            return;
+        }
+        if ( result.ok ) {
+            onVerified(result.data);
+            return;
+        }
+        flow.setBusy(false);
+        setAuthStatus($screen, i18n(result.error, [], false), { field: '.login-2fa-recovery-input' });
+        $input.get(0)?.select();
+    };
+
+    $input.on('input', verify);
+    $screen.find('form').on('submit', (e) => {
+        e.preventDefault();
+        verify();
+    });
+};
+
+/**
+ * Shows the code screen in `flow`. Back leaves it unanswered.
+ *
+ * @param {import('./authFlow.js').AuthFlow} flow
+ * @param {string} token The first factor's challenge.
+ * @param {{ onBack?: () => void }} [opts] `onBack` makes Back available when
+ *   this is the flow's first screen.
+ * @returns {Promise<object | null>} What the server answered a verified code
+ *   with (the session's token and user, and where to go); null when the user
+ *   went back or the flow closed.
+ */
+export function pushTwoFactorScreen (flow, token, { onBack } = {}) {
+    return new Promise((resolve) => {
+        let done = false;
+        const finish = (value) => {
+            if ( done ) return;
+            done = true;
+            resolve(value);
+        };
+
+        let h = '<div class="dashboard-dialog-body auth-body">';
+        h += headHtml('login2fa_otp_title', 'login2fa_otp_instructions');
+        h += '<form class="auth-form login-2fa-form" novalidate>';
+        h += '<div class="dashboard-form-status" role="status" aria-live="polite"></div>';
+        h += `<div class="login-2fa-code-inputs" role="group" aria-label="${i18n('login2fa_otp_title')}">`;
+        for ( let i = 0; i < CODE_LENGTH; i++ ) {
+            // The first box takes a whole code from autofill or a paste.
+            h += `<input type="text" class="dashboard-dialog-input" inputmode="numeric" pattern="[0-9]*" data-idx="${i}"`;
+            h += ` aria-label="${i + 1}" autocomplete="${i === 0 ? 'one-time-code' : 'off'}">`;
+        }
+        h += '</div>';
+        h += `<div class="auth-link-row"><button type="button" class="auth-link login-2fa-to-recovery">${i18n('login2fa_use_recovery_code')}</button></div>`;
+        h += '</form>';
+        h += '</div>';
+
+        const $screen = flow.push({
+            name: 'two-factor',
+            html: h,
+            onBack: onBack ?? undefined,
+            onLeave: () => finish(null),
+        });
+        const $inputs = $screen.find('.login-2fa-code-inputs input');
+        let verifying = false;
+
+        const code = () => $inputs.map(function () {
+            return $(this).val();
+        }).get().join('');
+
+        const verified = (data) => finish(data);
+
+        const verify = async (value) => {
+            if ( verifying || value.length !== CODE_LENGTH ) return;
+            verifying = true;
+            flow.setBusy(true);
+            $inputs.prop('disabled', true);
+            setAuthStatus($screen, i18n('verifying', [], false), { kind: 'info' });
+            const result = await verifySecondFactor('otp', token, value);
+            verifying = false;
+            // Dismissed while the code was out: stay signed in as before.
+            if ( flow.isClosed() ) {
+                if ( result.ok ) keepCurrentSession();
+                return;
+            }
+            if ( result.ok ) {
+                verified(result.data);
+                return;
+            }
+            flow.setBusy(false);
+            $inputs.prop('disabled', false);
+            setAuthStatus($screen, i18n(result.error, [], false));
+            $inputs.addClass('login-2fa-wrong').attr('aria-invalid', 'true');
+            setTimeout(() => {
+                if ( verifying ) return;
+                $inputs.val('').removeClass('login-2fa-wrong').removeAttr('aria-invalid');
+                if ( ! $screen.prop('hidden') ) $inputs.first().trigger('focus');
+            }, WRONG_CODE_MS);
+        };
+
+        /** Spreads digits over the boxes from `start`, and verifies a full code. */
+        const fill = (digits, start) => {
+            for ( let i = 0; i < digits.length && start + i < CODE_LENGTH; i++ ) {
+                $inputs.eq(start + i).val(digits[i]);
+            }
+            const next = Math.min(start + digits.length, CODE_LENGTH - 1);
+            $inputs.eq(next).trigger('focus');
+            verify(code());
+        };
+
+        $inputs.on('input', function () {
+            const idx = Number($(this).attr('data-idx'));
+            const digits = String($(this).val() ?? '').replace(/\D/g, '');
+            $inputs.removeClass('login-2fa-wrong').removeAttr('aria-invalid');
+            if ( ! digits ) {
+                $(this).val('');
+                return;
+            }
+            // One digit typed, or a whole code autofilled into this box.
+            $(this).val(digits[0]);
+            if ( digits.length > 1 ) {
+                fill(digits.slice(1), idx + 1);
+                return;
+            }
+            if ( idx < CODE_LENGTH - 1 ) $inputs.eq(idx + 1).trigger('focus');
+            verify(code());
+        });
+
+        $inputs.on('keydown', function (e) {
+            const idx = Number($(this).attr('data-idx'));
+            if ( e.key === 'Backspace' && ! $(this).val() && idx > 0 ) {
+                e.preventDefault();
+                $inputs.eq(idx - 1).val('').trigger('focus');
+            } else if ( e.key === 'ArrowLeft' && idx > 0 ) {
+                e.preventDefault();
+                $inputs.eq(idx - 1).trigger('focus');
+            } else if ( e.key === 'ArrowRight' && idx < CODE_LENGTH - 1 ) {
+                e.preventDefault();
+                $inputs.eq(idx + 1).trigger('focus');
+            }
+        });
+
+        $inputs.on('focus', function () {
+            this.select();
+        });
+
+        $inputs.on('paste', function (e) {
+            e.preventDefault();
+            const clipboard = e.originalEvent?.clipboardData ?? window.clipboardData;
+            const pasted = String(clipboard?.getData('text') ?? '').replace(/\D/g, '').slice(0, CODE_LENGTH);
+            if ( ! pasted ) return;
+            $inputs.val('');
+            fill(pasted, 0);
+        });
+
+        $screen.find('form').on('submit', (e) => {
+            e.preventDefault();
+            verify(code());
+        });
+
+        $screen.find('.login-2fa-to-recovery').on('click', () => {
+            if ( flow.isBusy() ) return;
+            $inputs.val('').removeClass('login-2fa-wrong').removeAttr('aria-invalid');
+            setAuthStatus($screen, '');
+            pushRecoveryScreen(flow, token, verified);
+        });
+    });
+}
+
+/**
+ * Asks for the second factor of a login on a page of its own (an identity
+ * provider's login that came back needing one). The card stays up, busy,
+ * once the code is verified: the caller is expected to navigate.
+ *
+ * @param {string} token The first factor's challenge.
+ * @returns {Promise<object | null>} The server's answer to a verified code;
+ *   null when the user chose to go back to the login.
+ */
+export default function UIAuth2FA (token) {
+    const flow = openAuthFlow({ page: true });
+    const answer = pushTwoFactorScreen(flow, token, {
+        onBack: () => flow.settle(null),
+    });
+    answer.then((data) => {
+        if ( data ) flow.setBusy(true);
+        flow.settle(data);
+    });
+    return flow.result;
+}

src/gui/src/UI/Auth/UIAuthAccountPicker.js

@@ -0,0 +1,150 @@
+/*
+ * Copyright (C) 2024-present Puter Technologies Inc.
+ *
+ * This file is part of Puter.
+ *
+ * Puter is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published
+ * by the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <https://www.gnu.org/licenses/>.
+ */
+
+// The account picker: the accounts signed in on this browser, to continue
+// as one of them, log in to another, or create one. In a sign-in popup,
+// picking an account is the user's consent to sign the opener in.
+
+import { SVG } from '../Dashboard/UIDashboardDialog.js';
+import openAuthFlow, { authHeadHtml, joinAuthFlow, wireAuthHead } from './authFlow.js';
+import { pushLoginScreen } from './UIAuthLogin.js';
+import { pushSignupScreen } from './UIAuthSignup.js';
+
+const CHEVRON_ICON = SVG('<path d="M9 18l6-6-6-6"/>');
+
+/**
+ * One account's row.
+ *
+ * @param {{ uuid: string, username: string, email?: string, profile?: { picture?: string } }} account
+ * @returns {string}
+ */
+const accountRowHtml = (account) => {
+    const username = String(account.username ?? '');
+    const initial = username.charAt(0).toUpperCase();
+    let h = '<li>';
+    h += `<button type="button" class="auth-account" data-uuid="${html_encode(account.uuid)}">`;
+    h += `<span class="auth-account-avatar" aria-hidden="true">${html_encode(initial)}</span>`;
+    h += '<span class="auth-account-text">';
+    h += `<span class="auth-account-name">${html_encode(username)}</span>`;
+    if ( account.email ) h += `<span class="auth-account-detail">${html_encode(account.email)}</span>`;
+    h += '</span>';
+    h += '<span class="dashboard-form-spinner auth-account-spinner" aria-hidden="true"></span>';
+    h += `<span class="auth-account-chevron" aria-hidden="true">${CHEVRON_ICON}</span>`;
+    h += '</button>';
+    h += '</li>';
+    return h;
+};
+
+/**
+ * Lays each account's picture over its initial. Set as a property, never
+ * through markup; a picture that fails to load leaves the initial.
+ *
+ * @param {jQuery} $screen
+ * @param {Array<{ uuid: string, profile?: { picture?: string } }>} accounts
+ */
+const paintPictures = ($screen, accounts) => {
+    for ( const account of accounts ) {
+        const picture = account.profile?.picture;
+        if ( typeof picture !== 'string' || ! picture ) continue;
+        const el_avatar = $screen.find('.auth-account').filter((_, el) => el.dataset.uuid === String(account.uuid))
+            .find('.auth-account-avatar').get(0);
+        if ( ! el_avatar ) continue;
+        const img = document.createElement('img');
+        img.alt = '';
+        img.draggable = false;
+        img.addEventListener('error', () => img.remove(), { once: true });
+        img.src = picture;
+        el_avatar.appendChild(img);
+    }
+};
+
+/**
+ * Shows the account picker in `flow`.
+ *
+ * @param {import('./authFlow.js').AuthFlow} flow
+ * @returns {jQuery}
+ */
+export function pushAccountPickerScreen (flow) {
+    const accounts = Array.isArray(window.logged_in_users) ? window.logged_in_users : [];
+
+    let h = '<div class="dashboard-dialog-body auth-body">';
+    // Everyone here has signed in to Puter before; no need to explain it.
+    h += authHeadHtml(flow, i18n('sign_in_with_puter', [], false), { openerNotice: false });
+    h += `<ul class="auth-accounts" aria-label="${i18n('sign_in_with_puter')}">`;
+    h += accounts.map(accountRowHtml).join('');
+    h += '</ul>';
+    h += '</div>';
+    h += '<div class="dashboard-dialog-footer auth-footer">';
+    h += `<button type="button" class="auth-link auth-to-login">${i18n('add_another_account')}</button>`;
+    h += '<span class="auth-footer-sep" aria-hidden="true">·</span>';
+    h += `<button type="button" class="auth-link auth-to-signup">${i18n('create_account')}</button>`;
+    h += '</div>';
+
+    // Nothing to type here; focus lands on the card, not on an account.
+    const $screen = flow.push({ name: 'accounts', html: h, autofocus: false });
+    wireAuthHead($screen);
+    paintPictures($screen, accounts);
+
+    $screen.find('.auth-to-login').on('click', () => {
+        if ( flow.isBusy() ) return;
+        if ( ! flow.goTo('login') ) pushLoginScreen(flow);
+    });
+    $screen.find('.auth-to-signup').on('click', () => {
+        if ( flow.isBusy() ) return;
+        if ( ! flow.goTo('signup') ) pushSignupScreen(flow);
+    });
+
+    $screen.find('.auth-account').on('click', async function () {
+        if ( flow.isBusy() ) return;
+        const uuid = this.dataset.uuid;
+        const account = accounts.find((candidate) => String(candidate.uuid) === uuid);
+        if ( ! account ) return;
+        flow.setBusy(true);
+        $screen.find('.auth-account').prop('disabled', true);
+        $(this).addClass('dashboard-form-busy').attr('aria-busy', 'true');
+
+        await window.update_auth_data(account.auth_token, account);
+        if ( flow.options.reload_on_success ) {
+            // Disable the browser's own "leave this page?" prompt.
+            window.onbeforeunload = null;
+            location.reload();
+            return;
+        }
+        flow.finish(true);
+    });
+
+    return $screen;
+}
+
+/**
+ * Asks which of the accounts signed in on this browser to continue as.
+ *
+ * @param {Partial<import('./authFlow.js').AuthFlowOptions> & { page?: boolean }} [options]
+ *   The picker can't be dismissed: it stands between a sign-in popup and
+ *   the token it hands out, and on a signed-out boot it is the page.
+ * @returns {Promise<boolean>} True once an account is picked or signed in,
+ *   unless the page reloads first.
+ */
+export default function UIAuthAccountPicker (options = {}) {
+    const joined = joinAuthFlow();
+    if ( joined ) return joined;
+    const flow = openAuthFlow({ page: options.page, dismissable: false, options });
+    pushAccountPickerScreen(flow);
+    return flow.result;
+}

src/gui/src/UI/Auth/UIAuthLogin.js

@@ -0,0 +1,293 @@
+/*
+ * Copyright (C) 2024-present Puter Technologies Inc.
+ *
+ * This file is part of Puter.
+ *
+ * Puter is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published
+ * by the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <https://www.gnu.org/licenses/>.
+ */
+
+// The login screen: email or username and password, the identity provider
+// buttons, and the ways to the signup and password recovery screens.
+
+import { bindPasswordReveal, formFieldHtml } from '../Dashboard/UIDashboardFormDialog.js';
+import openAuthFlow, {
+    authHeadHtml,
+    joinAuthFlow,
+    keepCurrentSession,
+    navigateAfterSignIn,
+    setAuthStatus,
+    setFormBusy,
+    submitButtonHtml,
+    wireAuthHead,
+} from './authFlow.js';
+import { renderProviderButtons } from './authProviders.js';
+import { pushTwoFactorScreen } from './UIAuth2FA.js';
+import { pushRecoverPasswordScreen } from './UIAuthRecoverPassword.js';
+import { pushSignupScreen } from './UIAuthSignup.js';
+
+/**
+ * @typedef {object} LoginScreenOptions
+ * @property {string} [email_or_username] Prefills the first field.
+ * @property {string} [authError] Shown when the screen opens.
+ * @property {string} [auth_id] Sent with the login when it follows a
+ *   `reauth_required` 401, so the backend re-attaches the same identity.
+ * @property {string} [reauth_reason]
+ */
+
+/**
+ * Clears credentials a link may have put in the address bar.
+ */
+const clearCredentialsFromUrl = () => {
+    const search = window.location.search;
+    if ( search && (search.includes('password=') || search.includes('username=') || search.includes('email=')) ) {
+        history.replaceState({}, document.title, window.location.origin + window.location.pathname);
+    }
+};
+
+/**
+ * What to tell the user about a failed login request.
+ *
+ * @param {{ status?: number, responseText?: string }} err
+ * @returns {{ text?: string, html?: string }}
+ */
+export const loginErrorMessage = (err) => {
+    const response_text = err?.responseText || '';
+    try {
+        const json = JSON.parse(response_text);
+        if ( json?.message ) return { text: String(json.message) };
+    } catch {
+        // Not JSON.
+    }
+    if ( err?.status === 404 ) {
+        // Not the whole 404 page.
+        return { text: `Error 404: "${window.gui_origin}/login" not found` };
+    }
+    if ( response_text ) return { text: response_text };
+    // No answer at all usually means the server couldn't be reached; on a
+    // self-hosted instance that's most likely its configuration.
+    if ( window.app_domain !== 'puter.com' ) {
+        const origin = html_encode(window.gui_origin);
+        return {
+            html: '<div class="auth-status-help">'
+                + `<p>Error reaching "${origin}/login". This is likely to be a configuration issue.</p>`
+                + '<p>Make sure of the following:</p>'
+                + '<ul>'
+                + '<li><code>domain</code> in config.json is set to the domain you\'re using to access puter</li>'
+                + '<li>DNS resolves for the domain, and the <code>api.</code> subdomain on that domain</li>'
+                + '<li><code>http_port</code> is set to the port Puter is listening on (<code>auto</code> will use <code>4100</code> unless that port is in use)</li>'
+                + '<li><code>pub_port</code> is set to the external port (ex: <code>443</code> if you\'re using a reverse proxy that serves over https)</li>'
+                + '</ul></div>',
+        };
+    }
+    return { text: `Failed to log in: Error ${err?.status ?? ''}`.trim() };
+};
+
+/**
+ * Shows the login screen in `flow`.
+ *
+ * @param {import('./authFlow.js').AuthFlow} flow
+ * @param {LoginScreenOptions} [options]
+ * @returns {jQuery}
+ */
+export function pushLoginScreen (flow, options = {}) {
+    const id = `auth-login-${window.uuidv4?.() ?? Date.now()}`;
+
+    let h = '<div class="dashboard-dialog-body auth-body">';
+    // Logging in means already having a Puter account; no need to explain it.
+    h += authHeadHtml(flow, i18n('log_in', [], false), { openerNotice: false });
+    h += '<form class="auth-form login-form" novalidate>';
+    h += '<div class="dashboard-form-status" role="status" aria-live="polite"></div>';
+    h += formFieldHtml({
+        name: 'email_or_username',
+        label: i18n('email_or_username'),
+        value: options.email_or_username ?? '',
+        attrs: { autocomplete: 'username', autocapitalize: 'off', autocorrect: 'off', spellcheck: 'false' },
+    }, id);
+    h += formFieldHtml({
+        name: 'password',
+        type: 'password',
+        label: i18n('password'),
+        attrs: { autocomplete: 'current-password' },
+    }, id);
+    h += `<div class="auth-forgot-row"><button type="button" class="auth-link forgot-password-link">${i18n('forgot_pass_c2a')}</button></div>`;
+    h += submitButtonHtml(i18n('log_in', [], false), 'login-btn');
+    h += '</form>';
+    h += '<div class="auth-providers" hidden>';
+    h += `<div class="auth-divider"><span>${i18n('or')}</span></div>`;
+    h += '<div class="auth-provider-list"></div>';
+    h += '</div>';
+    h += '</div>';
+    if ( flow.options.show_signup_button ) {
+        h += '<div class="dashboard-dialog-footer auth-footer">';
+        h += `<button type="button" class="auth-link auth-to-signup">${i18n('create_free_account')}</button>`;
+        h += '</div>';
+    }
+
+    const $screen = flow.push({
+        name: 'login',
+        html: h,
+        autofocus: ! window.disable_login_autofocus,
+    });
+    const $form = $screen.find('.login-form');
+    const $user = $form.find('[name="email_or_username"]');
+    const $password = $form.find('[name="password"]');
+
+    wireAuthHead($screen);
+    bindPasswordReveal($form);
+    if ( options.authError ) setAuthStatus($screen, options.authError);
+
+    $form.on('input', '.dashboard-form-input', function () {
+        $(this).removeAttr('aria-invalid');
+    });
+
+    renderProviderButtons($screen.find('.auth-provider-list'), {
+        kind: 'login',
+        flow,
+        referrer: () => flow.options.referrer ?? window.referrerStr ?? window.openerOrigin,
+    }).then((offered) => {
+        if ( offered ) $screen.find('.auth-providers').prop('hidden', false);
+    });
+
+    $screen.find('.forgot-password-link').on('click', () => {
+        if ( flow.isBusy() ) return;
+        pushRecoverPasswordScreen(flow, { email_or_username: String($user.val() ?? '').trim() });
+    });
+
+    $screen.find('.auth-to-signup').on('click', () => {
+        if ( flow.isBusy() ) return;
+        if ( ! flow.goTo('signup') ) pushSignupScreen(flow);
+    });
+
+    // The form first, so the end of busy can hand focus back to a field.
+    const unlock = () => {
+        setFormBusy($form, false);
+        flow.setBusy(false);
+    };
+
+    $form.on('submit', async (e) => {
+        e.preventDefault();
+        e.stopPropagation();
+        if ( flow.isBusy() ) return;
+
+        const email_username = String($user.val() ?? '').trim();
+        const password = String($password.val() ?? '');
+        if ( ! email_username ) {
+            setAuthStatus($screen, i18n('login_email_username_required', [], false), { field: '[name="email_or_username"]' });
+            return;
+        }
+        if ( ! password ) {
+            setAuthStatus($screen, i18n('login_password_required', [], false), { field: '[name="password"]' });
+            return;
+        }
+        setAuthStatus($screen, '');
+
+        // After a `reauth_required` 401, the login re-attaches the same
+        // stable identity.
+        const reauth = options.auth_id ? { auth_id: options.auth_id, reauth_reason: options.reauth_reason } : {};
+        const body = window.is_email(email_username)
+            ? { email: email_username, password, ...reauth }
+            : { username: email_username, password, ...reauth };
+
+        flow.setBusy(true);
+        setFormBusy($form, true);
+
+        let data;
+        try {
+            data = await new Promise((resolve, reject) => {
+                $.ajax({
+                    url: `${window.gui_origin}/login`,
+                    type: 'POST',
+                    async: true,
+                    headers: window.custom_headers ?? {},
+                    contentType: 'application/json',
+                    data: JSON.stringify(body),
+                    success: resolve,
+                    error: reject,
+                });
+            });
+        } catch ( err ) {
+            clearCredentialsFromUrl();
+            unlock();
+            if ( flow.isClosed() ) return;
+            const message = loginErrorMessage(err);
+            setAuthStatus($screen, message.text ?? '', { html: message.html });
+            // A refused password is typed again; a refused name is fixed there.
+            $password.get(0)?.focus({ preventScroll: true });
+            $password.get(0)?.select?.();
+            return;
+        }
+        // Dismissed while the request was out: the caller already heard no,
+        // so this browser stays signed in as it was.
+        if ( flow.isClosed() ) {
+            if ( data?.token ) keepCurrentSession();
+            return;
+        }
+
+        if ( data?.next_step === 'otp' ) {
+            // The second factor is a screen of its own; Back returns here.
+            flow.setBusy(false);
+            const verified = await pushTwoFactorScreen(flow, data.otp_jwt_token);
+            if ( ! verified ) {
+                setFormBusy($form, false);
+                if ( ! flow.isClosed() ) flow.focus();
+                return;
+            }
+            flow.setBusy(true);
+            data = verified;
+        }
+
+        try {
+            await window.update_auth_data(data.token, data.user);
+        } catch ( err ) {
+            unlock();
+            // Back from a verified code, whose screen would otherwise stay up, busy.
+            if ( $screen.prop('hidden') ) flow.goTo('login');
+            setAuthStatus($screen, err?.message || i18n('something_went_wrong', [], false));
+            return;
+        }
+
+        if ( flow.options.reload_on_success ) {
+            // A clean URL, so no credentials stay in it. The card stays up,
+            // busy, while the page goes.
+            navigateAfterSignIn(flow.options.redirect_url || window.location.origin + window.location.pathname);
+            return;
+        }
+        flow.finish(true);
+    });
+
+    return $screen;
+}
+
+/**
+ * Asks the user to log in.
+ *
+ * @param {Partial<import('./authFlow.js').AuthFlowOptions> & LoginScreenOptions & {
+ *   page?: boolean, dismissable?: boolean, closeOnBackdrop?: boolean,
+ * }} [options] `page`, `dismissable` and `closeOnBackdrop` as in `openAuthFlow`.
+ * @returns {Promise<boolean>} True once signed in, unless the page reloads
+ *   first; false when the user dismisses it. Joins an auth flow that is
+ *   already open instead of opening another.
+ */
+export default function UIAuthLogin (options = {}) {
+    const joined = joinAuthFlow();
+    if ( joined ) return joined;
+    const flow = openAuthFlow({
+        page: options.page,
+        dismissable: options.dismissable,
+        closeOnBackdrop: options.closeOnBackdrop,
+        options,
+    });
+    pushLoginScreen(flow, options);
+    return flow.result;
+}

src/gui/src/UI/Auth/UIAuthLogin.test.js

@@ -0,0 +1,386 @@
+// @vitest-environment jsdom
+/*
+ * Copyright (C) 2024-present Puter Technologies Inc.
+ *
+ * This file is part of Puter.
+ *
+ * Puter is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published
+ * by the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <https://www.gnu.org/licenses/>.
+ */
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
+import { reply, resetAuthGlobals, screen, tick } from './authTestSetup.js';
+
+vi.mock('../UIWindowEmailConfirmationRequired.js', () => ({ default: vi.fn() }));
+vi.mock('../UIWindowPhoneVerificationRequired.js', () => ({ default: vi.fn() }));
+vi.mock('../UIWindowCardVerificationRequired.js', () => ({ default: vi.fn() }));
+
+const { activeAuthFlow } = await import('./authFlow.js');
+const { default: UIAuthLogin, loginErrorMessage } = await import('./UIAuthLogin.js');
+const { default: UIAuth2FA } = await import('./UIAuth2FA.js');
+
+const completed = { proceed: true, next_step: 'complete', token: 'gui-token', user: { username: 'user' }, redirectUrl: 'https://puter.test/dashboard' };
+
+/** Captures the login request; returns its callbacks. */
+const captureAjax = () => {
+    const calls = [];
+    vi.spyOn($, 'ajax').mockImplementation((opts) => {
+        calls.push(opts);
+    });
+    return calls;
+};
+
+const submitLogin = (user = 'user', password = 'correct-password') => {
+    $('[name="email_or_username"]').val(user);
+    $('[name="password"]').val(password);
+    $('.login-form').trigger('submit');
+};
+
+const enterOtp = (code) => {
+    const inputs = $('.login-2fa-code-inputs input');
+    [...code].forEach((digit, index) => inputs.eq(index).val(digit));
+    inputs.last().trigger('input');
+};
+
+beforeEach(() => {
+    resetAuthGlobals();
+});
+afterEach(() => {
+    activeAuthFlow()?.finish(false);
+    vi.restoreAllMocks();
+});
+
+describe('login screen', () => {
+    it('leaves out the opener notice in a sign-in popup', () => {
+        window.embedded_in_popup = true;
+        window.openerOrigin = 'https://builder.puter.com';
+        void UIAuthLogin({ reload_on_success: false });
+        expect(screen().find('.auth-title')).toHaveLength(1);
+        expect(screen().find('.auth-opener-notice')).toHaveLength(0);
+    });
+
+    it('asks for each field before sending anything', () => {
+        const calls = captureAjax();
+        void UIAuthLogin({ reload_on_success: false });
+        $('.login-form').trigger('submit');
+        expect(screen().find('.dashboard-form-status').text()).toBe('login_email_username_required');
+        expect($('[name="email_or_username"]').attr('aria-invalid')).toBe('true');
+        $('[name="email_or_username"]').val('user');
+        $('.login-form').trigger('submit');
+        expect(screen().find('.dashboard-form-status').text()).toBe('login_password_required');
+        expect(calls).toHaveLength(0);
+    });
+
+    it('logs in by username or email, forwarding a reauth identity', async () => {
+        const calls = captureAjax();
+        const result = UIAuthLogin({ reload_on_success: false, auth_id: 'aid', reauth_reason: 'rotated' });
+        submitLogin(' [email protected] ');
+        expect(JSON.parse(calls[0].data)).toEqual({ email: '[email protected]', password: 'correct-password', auth_id: 'aid', reauth_reason: 'rotated' });
+        expect($('.login-btn').hasClass('dashboard-form-busy')).toBe(true);
+        calls[0].success({ token: 't', user: { username: 'someone' } });
+        await expect(result).resolves.toBe(true);
+        expect(window.update_auth_data).toHaveBeenCalledWith('t', { username: 'someone' });
+        expect(activeAuthFlow()).toBeNull();
+    });
+
+    it('shows the server message, unlocks, and puts the user back on the password', async () => {
+        const calls = captureAjax();
+        void UIAuthLogin({ reload_on_success: false });
+        submitLogin('user', 'nope');
+        calls[0].error({ status: 400, responseText: JSON.stringify({ message: '<b>Wrong</b> password' }) });
+        await tick();
+        // Text, never markup from the server.
+        expect(screen().find('.dashboard-form-status').text()).toBe('<b>Wrong</b> password');
+        expect(screen().find('.dashboard-form-status b')).toHaveLength(0);
+        expect($('[name="password"]').prop('disabled')).toBe(false);
+        expect(activeAuthFlow().isBusy()).toBe(false);
+    });
+
+    it('stays signed in as before when dismissed while the login is out', async () => {
+        window.auth_token = 'current-token';
+        const calls = captureAjax();
+        const result = UIAuthLogin();
+        submitLogin();
+        $('.dashboard-dialog-close').trigger('click');
+        await expect(result).resolves.toBe(false);
+        calls[0].success({ token: 't', user: { username: 'other' } });
+        await tick();
+        expect(window.update_auth_data).not.toHaveBeenCalled();
+        // The server answered by moving the session cookie; it comes back.
+        expect(fetch).toHaveBeenCalledWith('https://puter.test/session/sync-cookie', expect.objectContaining({
+            headers: { Authorization: 'Bearer current-token' },
+        }));
+    });
+
+    it('leaves the session cookie alone when a dismissed login only asked for a code', async () => {
+        window.auth_token = 'current-token';
+        const calls = captureAjax();
+        void UIAuthLogin();
+        submitLogin();
+        $('.dashboard-dialog-close').trigger('click');
+        calls[0].success({ proceed: true, next_step: 'otp', otp_jwt_token: 'c' });
+        await tick();
+        expect(fetch.mock.calls.some(([url]) => String(url).endsWith('/session/sync-cookie'))).toBe(false);
+    });
+
+    it('encodes a prefilled username', () => {
+        void UIAuthLogin({ email_or_username: '"><img src=x onerror=alert(1)>' });
+        expect($('.auth-dialog img[src="x"]')).toHaveLength(0);
+        expect($('[name="email_or_username"]').val()).toBe('"><img src=x onerror=alert(1)>');
+    });
+
+    it('hides the signup link when asked to', () => {
+        void UIAuthLogin({ show_signup_button: false });
+        expect($('.auth-to-signup')).toHaveLength(0);
+    });
+
+    it('opens forgot password in place, prefilled, and comes back', () => {
+        void UIAuthLogin();
+        $('[name="email_or_username"]').val('someone');
+        $('.forgot-password-link').trigger('click');
+        expect(screen().attr('data-screen')).toBe('recover-password');
+        expect(screen().find('[name="email_or_username"]').val()).toBe('someone');
+        screen().find('.auth-to-login').trigger('click');
+        expect(screen().attr('data-screen')).toBe('login');
+        expect($('.auth-screen')).toHaveLength(1);
+    });
+
+    it('switches to signup and back without stacking screens', () => {
+        void UIAuthLogin();
+        $('.auth-to-signup').trigger('click');
+        expect(screen().attr('data-screen')).toBe('signup');
+        screen().find('.auth-to-login').trigger('click');
+        expect($('.auth-screen')).toHaveLength(1);
+    });
+
+    it('joins a login that is already open', async () => {
+        const first = UIAuthLogin({ reload_on_success: false });
+        const second = UIAuthLogin({ reload_on_success: false });
+        expect($('.auth-dialog')).toHaveLength(1);
+        $('.dashboard-dialog-close').trigger('click');
+        await expect(first).resolves.toBe(false);
+        await expect(second).resolves.toBe(false);
+    });
+
+    it('explains an unreachable self-hosted server', () => {
+        window.app_domain = 'my.host';
+        expect(loginErrorMessage({ status: 0 }).html).toContain('config.json');
+        window.app_domain = 'puter.com';
+        expect(loginErrorMessage({ status: 0 }).text).toBe('Failed to log in: Error 0');
+        expect(loginErrorMessage({ status: 404, responseText: '<html>' }).text).toContain('404');
+    });
+});
+
+describe('OIDC buttons on the login and signup screens', () => {
+    const PROVIDERS_URL = 'https://api.puter.test/auth/oidc/providers';
+    const asPopup = (query) => {
+        window.embedded_in_popup = true;
+        window.gui_action = 'sign-in';
+        window.url_query_params = new URLSearchParams(query);
+    };
+    const askedForProviders = () => fetch.mock.calls.some(([url]) => url === PROVIDERS_URL);
+
+    beforeEach(() => {
+        globalThis.fetch = vi.fn(async () => reply(200, { providers: ['google'] }));
+    });
+
+    it.each(['login', 'signup'])('hides them in a cross-origin-isolated relay popup (%s)', async (kind) => {
+        asPopup('embedded_in_popup=true&msg_id=1&cross_origin_isolated=true&signin_session=s');
+        void UIAuthLogin();
+        if ( kind === 'signup' ) $('.auth-to-signup').trigger('click');
+        await tick();
+        expect(askedForProviders()).toBe(false);
+        expect(screen().find('.oidc-google-btn')).toHaveLength(0);
+    });
+
+    it.each(['login', 'signup'])('keeps them in a regular sign-in popup (%s)', async (kind) => {
+        asPopup('embedded_in_popup=true&msg_id=1');
+        void UIAuthLogin();
+        if ( kind === 'signup' ) $('.auth-to-signup').trigger('click');
+        await vi.waitFor(() => expect(screen().find('.oidc-google-btn')).toHaveLength(1));
+    });
+
+    it('starts the provider login with where to come back to', async () => {
+        void UIAuthLogin({ referrer: 'ref' });
+        await vi.waitFor(() => expect($('.oidc-google-btn')).toHaveLength(1));
+        expect($('.auth-providers').prop('hidden')).toBe(false);
+        const assign = vi.fn();
+        const original = window.location;
+        delete window.location;
+        window.location = { ...original, set href (url) {
+            assign(url);
+        }, get href () {
+            return original.href;
+        } };
+        $('.oidc-google-btn').trigger('click');
+        window.location = original;
+        expect(assign.mock.calls[0][0]).toBe('https://puter.test/auth/oidc/google/start?flow=login&referrer=ref');
+    });
+
+    it('hands a framed sign-in to the popup instead of leaving for the provider', async () => {
+        asPopup('msg_id=1');
+        window.embedded_in_frame = true;
+        window.tell_popup_frame = vi.fn();
+        try {
+            void UIAuthLogin();
+            await vi.waitFor(() => expect($('.oidc-google-btn')).toHaveLength(1));
+            const href = window.location.href;
+            $('.oidc-google-btn').trigger('click');
+            expect(window.tell_popup_frame.mock.calls).toEqual([
+                ['provider', { url: expect.stringContaining('https://puter.test/auth/oidc/google/start?flow=login') }],
+                ['unavailable'],
+            ]);
+            const start = new URL(window.tell_popup_frame.mock.calls[0][1].url);
+            expect(start.searchParams.get('embedded_in_popup')).toBe('true');
+            expect(start.searchParams.get('msg_id')).toBe('1');
+            expect(window.location.href).toBe(href);
+        } finally {
+            delete window.embedded_in_frame;
+            delete window.tell_popup_frame;
+        }
+    });
+});
+
+describe('second factor', () => {
+    it('passes leading-zero codes to the verifier and keeps the continuation data', async () => {
+        fetch.mockResolvedValue(reply(200, completed));
+        const result = UIAuth2FA('first-factor-challenge');
+        enterOtp('001234');
+        await expect(result).resolves.toEqual(completed);
+        expect(fetch).toHaveBeenCalledWith('https://puter.test/login/otp', expect.objectContaining({
+            body: JSON.stringify({ token: 'first-factor-challenge', code: '001234' }),
+        }));
+    });
+
+    it('takes a whole code autofilled into the first box', async () => {
+        fetch.mockResolvedValue(reply(200, completed));
+        const result = UIAuth2FA('t');
+        $('.login-2fa-code-inputs input').first().val('987654').trigger('input');
+        await expect(result).resolves.toEqual(completed);
+        expect(JSON.parse(fetch.mock.calls[0][1].body).code).toBe('987654');
+    });
+
+    it('keeps a failed challenge open for a recovery-code retry', async () => {
+        fetch.mockResolvedValueOnce(reply(200, { proceed: false })).mockResolvedValueOnce(reply(200, completed));
+        const result = UIAuth2FA('first-factor-challenge');
+        enterOtp('001234');
+        await vi.waitFor(() => expect(screen().find('.dashboard-form-status').text()).toBe('confirm_code_generic_incorrect'));
+        $('.login-2fa-to-recovery').trigger('click');
+        expect(screen().attr('data-screen')).toBe('recovery-code');
+        $('.login-2fa-recovery-input').val(' abcdefg2\n').trigger('input');
+        await expect(result).resolves.toEqual(completed);
+        expect(fetch.mock.calls[1][0]).toBe('https://puter.test/login/recovery-code');
+        expect(JSON.parse(fetch.mock.calls[1][1].body)).toEqual({ token: 'first-factor-challenge', code: 'ABCDEFG2' });
+    });
+
+    it('reports throttling without completing', async () => {
+        fetch.mockResolvedValue(reply(429, {}));
+        const result = UIAuth2FA('t');
+        let settled = false;
+        result.then(() => {
+            settled = true;
+        });
+        enterOtp('001234');
+        await vi.waitFor(() => expect(screen().find('.dashboard-form-status').text()).toBe('confirm_code_generic_too_many_requests'));
+        expect(settled).toBe(false);
+    });
+
+    it('ignores incomplete recovery codes', () => {
+        void UIAuth2FA('t');
+        $('.login-2fa-to-recovery').trigger('click');
+        $('.login-2fa-recovery-input').val('ABC').trigger('input');
+        expect(fetch).not.toHaveBeenCalled();
+    });
+
+    it('resolves null when the user goes back from a standalone challenge', async () => {
+        const result = UIAuth2FA('t');
+        $('.auth-dialog-back').trigger('click');
+        await expect(result).resolves.toBeNull();
+        expect(fetch).not.toHaveBeenCalled();
+    });
+});
+
+describe('password login with a second factor', () => {
+    it('completes only after the challenge succeeds', async () => {
+        fetch.mockImplementation(async (url) => (String(url).endsWith('/providers') ? reply(200, { providers: [] }) : reply(200, completed)));
+        const calls = captureAjax();
+        const result = UIAuthLogin({ reload_on_success: false });
+        submitLogin();
+        const submitted = calls[0].success({ proceed: true, next_step: 'otp', otp_jwt_token: 'password-challenge' });
+        await vi.waitFor(() => expect(screen().attr('data-screen')).toBe('two-factor'));
+        expect(window.update_auth_data).not.toHaveBeenCalled();
+        enterOtp('001234');
+        await submitted;
+        await expect(result).resolves.toBe(true);
+        expect(window.update_auth_data).toHaveBeenCalledWith(completed.token, completed.user);
+        expect(JSON.parse(fetch.mock.calls.at(-1)[1].body).token).toBe('password-challenge');
+    });
+
+    it('shows a failure to finish signing in on the login screen, not a stuck code screen', async () => {
+        fetch.mockImplementation(async (url) => (String(url).endsWith('/providers') ? reply(200, { providers: [] }) : reply(200, completed)));
+        window.update_auth_data = vi.fn(async () => {
+            throw new Error('Storage is full');
+        });
+        const calls = captureAjax();
+        void UIAuthLogin({ reload_on_success: false });
+        submitLogin();
+        calls[0].success({ proceed: true, next_step: 'otp', otp_jwt_token: 'c' });
+        await vi.waitFor(() => expect(screen().attr('data-screen')).toBe('two-factor'));
+        enterOtp('001234');
+        await vi.waitFor(() => expect(screen().attr('data-screen')).toBe('login'));
+        expect(screen().find('.dashboard-form-status').text()).toBe('Storage is full');
+        expect($('.login-btn').prop('disabled')).toBe(false);
+        expect(activeAuthFlow().isBusy()).toBe(false);
+    });
+
+    it('stays signed in as before when dismissed while the code is out', async () => {
+        window.auth_token = 'current-token';
+        let answer;
+        fetch.mockImplementation(async (url) => {
+            if ( String(url).endsWith('/providers') ) return reply(200, { providers: [] });
+            if ( String(url).endsWith('/login/otp') ) return new Promise((resolve) => {
+                answer = resolve;
+            });
+            return reply(204, null);
+        });
+        const calls = captureAjax();
+        const result = UIAuthLogin({ reload_on_success: false });
+        submitLogin();
+        const submitted = calls[0].success({ proceed: true, next_step: 'otp', otp_jwt_token: 'c' });
+        await vi.waitFor(() => expect(screen().attr('data-screen')).toBe('two-factor'));
+        enterOtp('001234');
+        await vi.waitFor(() => expect(answer).toBeTypeOf('function'));
+        $('.dashboard-dialog-close').trigger('click');
+        await expect(result).resolves.toBe(false);
+        answer(reply(200, completed));
+        await submitted;
+        await vi.waitFor(() => expect(fetch).toHaveBeenCalledWith('https://puter.test/session/sync-cookie', expect.objectContaining({
+            headers: { Authorization: 'Bearer current-token' },
+        })));
+        expect(window.update_auth_data).not.toHaveBeenCalled();
+    });
+
+    it('returns to the enabled password form when the user goes back', async () => {
+        const calls = captureAjax();
+        const result = UIAuthLogin({ reload_on_success: false });
+        submitLogin();
+        const submitted = calls[0].success({ proceed: true, next_step: 'otp', otp_jwt_token: 'c' });
+        await vi.waitFor(() => expect(screen().attr('data-screen')).toBe('two-factor'));
+        $('.auth-dialog-back').trigger('click');
+        await submitted;
+        expect(screen().attr('data-screen')).toBe('login');
+        expect($('.login-btn').prop('disabled')).toBe(false);
+        expect(window.update_auth_data).not.toHaveBeenCalled();
+        $('.dashboard-dialog-close').trigger('click');
+        await expect(result).resolves.toBe(false);
+    });
+});

src/gui/src/UI/Auth/UIAuthRecoverPassword.js

@@ -0,0 +1,149 @@
+/*
+ * Copyright (C) 2024-present Puter Technologies Inc.
+ *
+ * This file is part of Puter.
+ *
+ * Puter is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published
+ * by the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <https://www.gnu.org/licenses/>.
+ */
+
+// The password recovery screen: mails a link to set a new password.
+
+import { formFieldHtml } from '../Dashboard/UIDashboardFormDialog.js';
+import { SVG } from '../Dashboard/UIDashboardDialog.js';
+import openAuthFlow, {
+    authHeadHtml,
+    joinAuthFlow,
+    setAuthStatus,
+    setFormBusy,
+    submitButtonHtml,
+    wireAuthHead,
+} from './authFlow.js';
+import { pushLoginScreen } from './UIAuthLogin.js';
+
+const SENT_ICON = SVG('<circle cx="12" cy="12" r="9"/><path d="M8 12.5l2.5 2.5L16 9.5"/>');
+
+/**
+ * The message of a failed request.
+ *
+ * @param {{ responseText?: string }} err
+ * @returns {string}
+ */
+const errorMessage = (err) => {
+    const text = err?.responseText || '';
+    try {
+        const json = JSON.parse(text);
+        return json.message || json.error || text;
+    } catch {
+        return text || i18n('something_went_wrong', [], false);
+    }
+};
+
+/**
+ * Shows the password recovery screen in `flow`.
+ *
+ * @param {import('./authFlow.js').AuthFlow} flow
+ * @param {{ email_or_username?: string }} [opts] Prefills the field.
+ * @returns {jQuery}
+ */
+export function pushRecoverPasswordScreen (flow, { email_or_username = '' } = {}) {
+    const id = `auth-recover-${window.uuidv4?.() ?? Date.now()}`;
+
+    let h = '<div class="dashboard-dialog-body auth-body">';
+    h += authHeadHtml(flow, i18n('recover_password', [], false));
+    h += '<form class="auth-form pass-recovery-form" novalidate>';
+    h += '<div class="dashboard-form-status" role="status" aria-live="polite"></div>';
+    h += formFieldHtml({
+        name: 'email_or_username',
+        label: i18n('email_or_username'),
+        value: email_or_username,
+        attrs: { autocomplete: 'username', autocapitalize: 'off', autocorrect: 'off', spellcheck: 'false' },
+    }, id);
+    h += submitButtonHtml(i18n('send_password_recovery_email', [], false), 'send-recovery-email');
+    h += '</form>';
+    h += '</div>';
+    h += '<div class="dashboard-dialog-footer auth-footer">';
+    h += `<button type="button" class="auth-link auth-to-login">${i18n('log_in')}</button>`;
+    h += '</div>';
+
+    const $screen = flow.push({ name: 'recover-password', html: h });
+    const $form = $screen.find('.pass-recovery-form');
+    const $input = $form.find('[name="email_or_username"]');
+    wireAuthHead($screen);
+
+    $screen.find('.auth-to-login').on('click', () => {
+        if ( flow.isBusy() ) return;
+        if ( ! flow.goTo('login') ) pushLoginScreen(flow, { email_or_username: String($input.val() ?? '').trim() });
+    });
+
+    $form.on('submit', async (e) => {
+        e.preventDefault();
+        e.stopPropagation();
+        if ( flow.isBusy() ) return;
+        const value = String($input.val() ?? '').trim();
+        if ( ! value ) {
+            setAuthStatus($screen, i18n('login_email_username_required', [], false), { field: '[name="email_or_username"]' });
+            return;
+        }
+        setAuthStatus($screen, '');
+        flow.setBusy(true);
+        setFormBusy($form, true);
+
+        let res;
+        try {
+            res = await new Promise((resolve, reject) => {
+                $.ajax({
+                    url: `${window.api_origin}/send-pass-recovery-email`,
+                    type: 'POST',
+                    async: true,
+                    contentType: 'application/json',
+                    data: JSON.stringify(window.is_email(value) ? { email: value } : { username: value }),
+                    statusCode: {
+                        401: (xhr) => window.handle401(xhr),
+                    },
+                    success: resolve,
+                    error: reject,
+                });
+            });
+        } catch ( err ) {
+            flow.setBusy(false);
+            setFormBusy($form, false);
+            setAuthStatus($screen, errorMessage(err), { field: '[name="email_or_username"]' });
+            return;
+        }
+        flow.setBusy(false);
+
+        // The form gives way to what the server said happened; the way back
+        // to the login stays below it.
+        $form.replaceWith('<div class="dashboard-form-done auth-done" role="status">'
+            + `${SENT_ICON}<p>${html_encode(res?.message ?? '')}</p></div>`);
+        $screen.find('.auth-to-login').get(0)?.focus({ preventScroll: true });
+    });
+
+    return $screen;
+}
+
+/**
+ * Asks for the account whose password to reset, on its own.
+ *
+ * @param {{ page?: boolean, dismissable?: boolean }} [options]
+ * @returns {Promise<unknown>} Settles only if the user dismisses the card or
+ *   signs in from it without the page reloading.
+ */
+export default function UIAuthRecoverPassword (options = {}) {
+    const joined = joinAuthFlow();
+    if ( joined ) return joined;
+    const flow = openAuthFlow({ page: options.page, dismissable: options.dismissable });
+    pushRecoverPasswordScreen(flow);
+    return flow.result;
+}

src/gui/src/UI/Auth/UIAuthSignup.js

@@ -0,0 +1,544 @@
+/*
+ * Copyright (C) 2024-present Puter Technologies Inc.
+ *
+ * This file is part of Puter.
+ *
+ * Puter is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published
+ * by the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <https://www.gnu.org/licenses/>.
+ */
+
+// The signup screen: the identity provider buttons, the email form behind
+// them, and the account checks (email, phone, card) a new account may have
+// to pass once created.
+
+import check_password_strength from '../../helpers/checkPasswordStrength.js';
+import { bonusRequirementsKey, checkSignupBonusCode } from '../../helpers/signupBonusCode.js';
+import { bindPasswordReveal, formFieldHtml } from '../Dashboard/UIDashboardFormDialog.js';
+import UIWindowCardVerificationRequired from '../UIWindowCardVerificationRequired.js';
+import UIWindowEmailConfirmationRequired from '../UIWindowEmailConfirmationRequired.js';
+import UIWindowPhoneVerificationRequired from '../UIWindowPhoneVerificationRequired.js';
+import openAuthFlow, {
+    authHeadHtml,
+    joinAuthFlow,
+    navigateAfterSignIn,
+    setAuthStatus,
+    setFormBusy,
+    submitButtonHtml,
+    wireAuthHead,
+} from './authFlow.js';
+import { mayOfferProviders, renderProviderButtons } from './authProviders.js';
+import { pushLoginScreen } from './UIAuthLogin.js';
+
+const SIGNUP_TIMEOUT_MS = 30000;
+const TURNSTILE_POLL_MS = 100;
+// How long the email form waits for the provider lookup before showing anyway.
+const PROVIDERS_WAIT_MS = 1500;
+
+/**
+ * @typedef {object} SignupScreenOptions
+ * @property {string} [username] Prefills the field.
+ * @property {string} [email] Prefills the field.
+ * @property {string} [authError] Shown when the screen opens.
+ */
+
+/**
+ * What a checked bonus code grants, above the form and the provider buttons.
+ *
+ * @param {jQuery} $screen
+ * @param {{ valid: boolean, display?: { title: string, description: string }, requirements?: object } | null} result
+ */
+const renderBonusNotice = ($screen, result) => {
+    const $notice = $screen.find('.signup-bonus-notice');
+    if ( ! result ) {
+        $notice.prop('hidden', true).empty();
+        return;
+    }
+    if ( ! result.valid ) {
+        $notice.addClass('signup-bonus-notice-invalid')
+            .html(`<p>${i18n('signup_bonus_code_invalid_retry')}</p>`)
+            .prop('hidden', false);
+        return;
+    }
+    const requirements_key = bonusRequirementsKey(result.requirements);
+    let h = `<strong>${html_encode(result.display.title)}</strong>`;
+    h += `<p>${html_encode(result.display.description)}</p>`;
+    if ( requirements_key ) h += `<p class="signup-bonus-requirements">${i18n(requirements_key)}</p>`;
+    $notice.removeClass('signup-bonus-notice-invalid').html(h).prop('hidden', false);
+};
+
+/**
+ * Covers the page with the reason signups are refused here.
+ *
+ * @param {string} message Plain text.
+ */
+const showSignupBlocked = (message) => {
+    const overlay = document.createElement('div');
+    overlay.classList.add('signup-blocked-overlay');
+    overlay.innerHTML = `
+        <div class="signup-blocked-content">
+            <img src="${html_encode(window.icons['logo.svg'] || window.icons['logo-white.svg'] || '')}" style="width:64px;margin-bottom:24px;" alt="" />
+            <p>${html_encode(message || 'Signup Not Allowed')}</p>
+            <p>If you already have an account, try <a href="/action/login">logging in</a>. Otherwise, contact <a href="mailto:support@puter.com">support@puter.com</a> for assistance.</p>
+        </div>
+    `;
+    document.body.appendChild(overlay);
+};
+
+/**
+ * Runs the checks a new account has to pass, in the server's order (see
+ * assertVerifiedAccount): email → phone (SMS) → card, or card → phone →
+ * email when the account clears email last.
+ *
+ * @param {object} user The new account, as the signup answered.
+ * @param {boolean} show_email Ask for the emailed code here.
+ * @param {boolean} reload_on_success
+ * @param {boolean} page Signup was a page, so the checks cover it too
+ *   rather than float over whatever was under it.
+ * @returns {Promise<boolean>} Whether the email was confirmed (true when not asked).
+ */
+const runVerificationGates = async (user, show_email, reload_on_success, page) => {
+    const window_options = page ? { cover_page: true, has_head: false } : {};
+    let email_verified = true;
+    const emailGate = async () => {
+        if ( ! show_email ) return;
+        // Its ✕ would close it without an answer, leaving the caller
+        // waiting on a card that is already gone.
+        email_verified = await UIWindowEmailConfirmationRequired({
+            show_close_button: false,
+            stay_on_top: true,
+            has_head: true,
+            reload_on_success,
+            window_options,
+        });
+    };
+    // A user the SMS path keeps failing may take the card fallback instead;
+    // that resolves 'card' and clears the card gate along with the phone
+    // gate (see UIWindowPhoneVerificationRequired).
+    let card_cleared_by_fallback = false;
+    const phoneGate = async () => {
+        if ( ! user?.requires_phone_verification ) return;
+        let phone_ok = false;
+        do {
+            phone_ok = await UIWindowPhoneVerificationRequired({
+                show_close_button: false,
+                stay_on_top: true,
+                has_head: true,
+                window_options,
+            });
+        } while ( ! phone_ok );
+        card_cleared_by_fallback = phone_ok === 'card';
+    };
+    const cardGate = async () => {
+        if ( ! user?.requires_card_verification || card_cleared_by_fallback ) return;
+        let card_ok = false;
+        do {
+            card_ok = await UIWindowCardVerificationRequired({
+                show_close_button: false,
+                stay_on_top: true,
+                has_head: true,
+                window_options,
+            });
+        } while ( ! card_ok );
+    };
+    if ( user?.email_gate_last ) {
+        await cardGate();
+        await phoneGate();
+        await emailGate();
+    } else {
+        await emailGate();
+        await phoneGate();
+        await cardGate();
+    }
+    return email_verified;
+};
+
+/**
+ * Where to go after a signup that reloads. Signup can interrupt a direct app
+ * landing (the login cover page's "Sign up", the account picker's "Create
+ * Account", the must_login_or_signup fallback); landing on '/' afterwards
+ * would drop the app the URL asked for, so app landings are kept and the
+ * reloaded boot replays them. The query string is left behind, as login
+ * does, so no credentials stay in it.
+ *
+ * @param {string | undefined} redirect_url
+ * @returns {string}
+ */
+export const signupRedirectUrl = (redirect_url) => {
+    if ( redirect_url ) return redirect_url;
+    const on_app_landing = /^\/(?:desktop\/)?app\/[^/]+\/?$/.test(window.location.pathname);
+    return on_app_landing ? window.location.origin + window.location.pathname : '/';
+};
+
+/**
+ * Shows the signup screen in `flow`.
+ *
+ * @param {import('./authFlow.js').AuthFlow} flow
+ * @param {SignupScreenOptions} [options]
+ * @returns {jQuery}
+ */
+export function pushSignupScreen (flow, options = {}) {
+    const id = `auth-signup-${window.uuidv4?.() ?? Date.now()}`;
+    const turnstile_key = window.gui_params?.turnstileSiteKey;
+    // The email form stays hidden until the providers are known, so it
+    // doesn't show and then fold away behind "Sign up with email".
+    let awaiting_providers = mayOfferProviders() && ! options.username && ! options.email;
+
+    let h = '<div class="dashboard-dialog-body auth-body">';
+    h += authHeadHtml(flow, i18n('create_free_account', [], false));
+    // Above the provider buttons, not in the form: the form hides behind
+    // them, and an identity provider's refusal shows here too.
+    h += '<div class="dashboard-form-status auth-screen-status" role="status" aria-live="polite"></div>';
+    h += '<div class="signup-bonus-notice" hidden></div>';
+    h += '<div class="auth-providers oidc-providers-wrapper" hidden>';
+    h += '<div class="auth-provider-list"></div>';
+    h += '</div>';
+    h += '<div class="signup-with-email-wrapper" hidden>';
+    h += `<button type="button" class="dashboard-dialog-btn auth-provider-btn signup-with-email-btn">${i18n('sign_up_with_email')}</button>`;
+    h += '</div>';
+    h += `<form class="auth-form signup-form" novalidate${awaiting_providers ? ' hidden' : ''}>`;
+    h += formFieldHtml({
+        name: 'username',
+        label: i18n('username'),
+        value: options.username ?? '',
+        attrs: { autocomplete: 'username', autocapitalize: 'off', autocorrect: 'off', spellcheck: 'false', 'data-gramm_editor': 'false' },
+    }, id);
+    h += formFieldHtml({
+        name: 'email',
+        type: 'email',
+        label: i18n('email'),
+        value: options.email ?? '',
+        attrs: { autocomplete: 'email', inputmode: 'email', autocapitalize: 'off', autocorrect: 'off', spellcheck: 'false', 'data-gramm_editor': 'false' },
+    }, id);
+    h += formFieldHtml({
+        name: 'password',
+        type: 'password',
+        label: i18n('password'),
+        attrs: { autocomplete: 'new-password' },
+    }, id);
+    h += formFieldHtml({
+        name: 'confirm_password',
+        type: 'password',
+        label: i18n('signup_confirm_password'),
+        attrs: { autocomplete: 'new-password' },
+    }, id);
+    // Bot trap: the server ignores a request that fills it in.
+    h += '<input type="text" name="p102xyzname" class="p102xyzname" value="" tabindex="-1" autocomplete="off" aria-hidden="true">';
+    if ( turnstile_key ) {
+        h += `<div class="auth-turnstile"><div class="cf-turnstile" data-sitekey="${html_encode(turnstile_key)}" data-appearance="interaction-only"></div></div>`;
+    }
+    h += submitButtonHtml(i18n('create_free_account', [], false), 'signup-btn');
+    h += '</form>';
+    h += `<p class="signup-terms">${i18n('tos_fineprint', [], false)}</p>`;
+    h += '</div>';
+    h += '<div class="dashboard-dialog-footer auth-footer">';
+    h += `<button type="button" class="auth-link auth-to-login">${i18n('log_in')}</button>`;
+    h += '</div>';
+
+    const $screen = flow.push({
+        name: 'signup',
+        html: h,
+        autofocus: ! window.disable_signup_autofocus,
+    });
+    const $form = $screen.find('.signup-form');
+    const field = (name) => $form.find(`[name="${name}"]`);
+    const $turnstile = $form.find('.cf-turnstile');
+    let turnstile_widget = null;
+    let offers_providers = false;
+
+    wireAuthHead($screen);
+    bindPasswordReveal($form);
+    if ( options.authError ) setAuthStatus($screen, options.authError);
+
+    $form.on('input', '.dashboard-form-input', function () {
+        $(this).removeAttr('aria-invalid');
+    });
+
+    const showForm = () => {
+        $form.prop('hidden', false);
+        $screen.find('.signup-with-email-wrapper').prop('hidden', true);
+    };
+
+    // Form signups are closed here, so the providers are the only way in.
+    const showOidcOnly = () => {
+        $form.prop('hidden', true);
+        $screen.find('.signup-with-email-wrapper').prop('hidden', true);
+        $screen.find('.oidc-providers-wrapper').prop('hidden', false);
+    };
+
+    // Turnstile renders into the form once its script has loaded.
+    const initTurnstile = () => {
+        if ( ! turnstile_key || ! $turnstile.length || flow.isClosed() ) return;
+        if ( ! window.turnstile ) {
+            setTimeout(initTurnstile, TURNSTILE_POLL_MS);
+            return;
+        }
+        turnstile_widget = window.turnstile.render($turnstile.get(0), {
+            sitekey: turnstile_key,
+            callback: (token) => {
+                $turnstile.attr('data-token', token).addClass('captcha-completed');
+            },
+            'expired-callback': () => {
+                $turnstile.removeAttr('data-token').removeClass('captcha-completed');
+            },
+        });
+    };
+    initTurnstile();
+
+    if ( window.signup_bonus_code ) {
+        (async () => {
+            let fingerprint = null;
+            try {
+                fingerprint = await window.getDeviceFingerprint?.();
+            } catch {
+                // The check works without device signals.
+            }
+            const result = await checkSignupBonusCode(window.signup_bonus_code, {
+                origin: window.gui_origin,
+                fingerprint,
+            });
+            // Unknown (null) keeps the code; signup has the final say.
+            if ( result && ! result.valid ) window.signup_bonus_code = null;
+            renderBonusNotice($screen, result);
+        })();
+    }
+
+    // With focus on the card itself, nothing on the screen was focusable yet.
+    const focusWasParked = () => document.activeElement === flow.$dialog.get(0);
+    const stopAwaitingProviders = () => {
+        const was_awaiting = awaiting_providers;
+        awaiting_providers = false;
+        clearTimeout(form_fallback);
+        return was_awaiting;
+    };
+    const revealForm = () => {
+        if ( ! stopAwaitingProviders() || flow.isClosed() ) return;
+        showForm();
+        if ( focusWasParked() ) flow.focus();
+    };
+    const form_fallback = awaiting_providers ? setTimeout(revealForm, PROVIDERS_WAIT_MS) : undefined;
+
+    renderProviderButtons($screen.find('.auth-provider-list'), {
+        kind: 'signup',
+        flow,
+        referrer: () => flow.options.referrer ?? window.referrerStr,
+    }).then((offered) => {
+        if ( ! offered ) {
+            revealForm();
+            return;
+        }
+        stopAwaitingProviders();
+        if ( flow.isClosed() ) return;
+        offers_providers = true;
+        $screen.find('.oidc-providers-wrapper').prop('hidden', false);
+        if ( offered.signupOidcOnly ) {
+            showOidcOnly();
+            return;
+        }
+        // The email form waits behind its own button, unless the user has
+        // already typed into it.
+        const started = $form.find('.dashboard-form-input').filter(function () {
+            return !! $(this).val();
+        }).length > 0;
+        if ( started ) return;
+        const had_focus = $form.get(0).contains(document.activeElement);
+        $form.prop('hidden', true);
+        $screen.find('.signup-with-email-wrapper').prop('hidden', false);
+        if ( had_focus || focusWasParked() ) flow.focus();
+    });
+
+    $screen.find('.signup-with-email-btn').on('click', () => {
+        showForm();
+        field('username').get(0)?.focus({ preventScroll: true });
+    });
+
+    $screen.find('.auth-to-login').on('click', () => {
+        if ( flow.isBusy() ) return;
+        if ( ! flow.goTo('login') ) pushLoginScreen(flow);
+    });
+
+    const resetTurnstile = () => {
+        try {
+            if ( window.turnstile && turnstile_widget !== null ) {
+                window.turnstile.reset(turnstile_widget);
+                $turnstile.removeAttr('data-token').removeClass('captcha-completed');
+            }
+        } catch ( e ) {
+            console.log(e);
+        }
+    };
+
+    const fail = (text, field_name) => {
+        setAuthStatus($screen, text, field_name ? { field: `[name="${field_name}"]` } : {});
+    };
+
+    $form.on('submit', async (e) => {
+        e.preventDefault();
+        e.stopPropagation();
+        if ( flow.isBusy() ) return;
+
+        const username = String(field('username').val() ?? '').trim();
+        const email = String(field('email').val() ?? '').trim();
+        const password = String(field('password').val() ?? '');
+        const confirm_password = String(field('confirm_password').val() ?? '');
+
+        if ( ! username ) return fail(i18n('username_required', [], false), 'username');
+        if ( ! email ) return fail(i18n('email_required', [], false), 'email');
+        if ( ! window.is_email(email) ) return fail(i18n('email_invalid', [], false), 'email');
+        if ( ! password ) return fail(i18n('password_required', [], false), 'password');
+        if ( ! check_password_strength(password).overallPass ) return fail(i18n('password_strength_error', [], false), 'password');
+        if ( ! confirm_password ) return fail(i18n('confirm_password_required', [], false), 'confirm_password');
+        if ( password !== confirm_password ) return fail(i18n('passwords_do_not_match', [], false), 'confirm_password');
+
+        let turnstile_token = null;
+        if ( window.turnstile && turnstile_key ) {
+            turnstile_token = $turnstile.attr('data-token');
+            if ( ! turnstile_token ) return fail(i18n('captcha_required', [], false));
+        }
+        setAuthStatus($screen, '');
+
+        flow.setBusy(true);
+        setFormBusy($form, true);
+
+        // A device signal for abuse prevention; signup never waits on or
+        // fails because of it.
+        let fingerprint = null;
+        try {
+            fingerprint = await window.getDeviceFingerprint?.();
+        } catch {
+            // Omitted.
+        }
+
+        const request = {
+            username,
+            email,
+            password,
+            referrer: flow.options.referrer ?? window.referrerStr,
+            send_confirmation_code: flow.options.send_confirmation_code,
+            p102xyzname: String($form.find('.p102xyzname').val() ?? ''),
+            'cf-turnstile-response': turnstile_token,
+        };
+        if ( fingerprint ) request.fingerprint = fingerprint;
+        if ( window.signup_bonus_code ) request.bonusCode = window.signup_bonus_code;
+
+        let data;
+        try {
+            data = await new Promise((resolve, reject) => {
+                $.ajax({
+                    url: `${window.gui_origin}/signup`,
+                    type: 'POST',
+                    async: true,
+                    headers: window.custom_headers ?? {},
+                    contentType: 'application/json',
+                    data: JSON.stringify(request),
+                    success: resolve,
+                    error: reject,
+                    timeout: SIGNUP_TIMEOUT_MS,
+                });
+            });
+        } catch ( err ) {
+            setFormBusy($form, false);
+            flow.setBusy(false);
+            resetTurnstile();
+            handleError(err);
+            return;
+        }
+
+        try {
+            await window.update_auth_data(data.token, data.user);
+        } catch ( err ) {
+            setFormBusy($form, false);
+            flow.setBusy(false);
+            fail(err?.message || i18n('signup_error', [], false));
+            return;
+        }
+
+        const reload_on_success = flow.options.reload_on_success;
+        const show_email = ! reload_on_success
+            && !! (flow.options.send_confirmation_code || data.user?.requires_email_confirmation);
+        let email_verified = true;
+        if ( data.user?.requires_phone_verification || data.user?.requires_card_verification || show_email ) {
+            // The checks are windows of their own; the card makes way for them.
+            flow.close();
+            email_verified = await runVerificationGates(data.user, show_email, reload_on_success, flow.page);
+        }
+
+        if ( reload_on_success ) {
+            navigateAfterSignIn(signupRedirectUrl(flow.options.redirect_url));
+            return;
+        }
+        flow.finish(email_verified);
+    });
+
+    const handleError = (err) => {
+        const error_text = err?.responseText || '';
+        let json = null;
+        try {
+            json = JSON.parse(error_text);
+        } catch {
+            // Not JSON.
+        }
+
+        if ( json?.code === 'signup_blocked' ) {
+            showSignupBlocked(json.message);
+            return;
+        }
+        // Form signups closed after this screen loaded. Without provider
+        // buttons (some popups), the server's message below says so instead.
+        if ( json?.code === 'signup_oidc_only' && offers_providers ) {
+            showOidcOnly();
+            return;
+        }
+        if ( json?.code === 'bonus_code_invalid' ) {
+            // The next attempt signs up without it; the offer no longer applies.
+            window.signup_bonus_code = null;
+            renderBonusNotice($screen, null);
+            fail(i18n('signup_bonus_code_invalid_retry', [], false));
+            return;
+        }
+        if ( json?.code === 'response_timeout' || err?.statusText === 'timeout' || error_text.includes('timeout') ) {
+            fail(i18n('server_timeout', [], false));
+            return;
+        }
+        if ( json?.message ) {
+            fail(String(json.message));
+            return;
+        }
+        fail(error_text || i18n('signup_error', [], false));
+    };
+
+    return $screen;
+}
+
+/**
+ * Asks the user to create an account.
+ *
+ * @param {Partial<import('./authFlow.js').AuthFlowOptions> & SignupScreenOptions & {
+ *   page?: boolean, dismissable?: boolean, closeOnBackdrop?: boolean,
+ * }} [options] `page`, `dismissable` and `closeOnBackdrop` as in `openAuthFlow`.
+ * @returns {Promise<boolean>} True once signed up (or false if a requested
+ *   email confirmation wasn't completed), unless the page reloads first;
+ *   false when the user dismisses it. Joins an auth flow that is already
+ *   open instead of opening another.
+ */
+export default function UIAuthSignup (options = {}) {
+    const joined = joinAuthFlow();
+    if ( joined ) return joined;
+    const flow = openAuthFlow({
+        page: options.page,
+        dismissable: options.dismissable,
+        closeOnBackdrop: options.closeOnBackdrop,
+        options,
+    });
+    pushSignupScreen(flow, options);
+    return flow.result;
+}

src/gui/src/UI/Auth/UIAuthSignup.test.js

@@ -0,0 +1,378 @@
+// @vitest-environment jsdom
+/*
+ * Copyright (C) 2024-present Puter Technologies Inc.
+ *
+ * This file is part of Puter.
+ *
+ * Puter is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published
+ * by the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <https://www.gnu.org/licenses/>.
+ */
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
+import { reply, resetAuthGlobals, screen, tick } from './authTestSetup.js';
+
+const gates = vi.hoisted(() => ({ email: vi.fn(), phone: vi.fn(), card: vi.fn() }));
+vi.mock('../UIWindowEmailConfirmationRequired.js', () => ({ default: gates.email }));
+vi.mock('../UIWindowPhoneVerificationRequired.js', () => ({ default: gates.phone }));
+vi.mock('../UIWindowCardVerificationRequired.js', () => ({ default: gates.card }));
+
+const { activeAuthFlow } = await import('./authFlow.js');
+const { default: UIAuthSignup, signupRedirectUrl } = await import('./UIAuthSignup.js');
+const { default: UIAuthAccountPicker } = await import('./UIAuthAccountPicker.js');
+const { default: UIAuthRecoverPassword } = await import('./UIAuthRecoverPassword.js');
+const { default: UIAuthLogin } = await import('./UIAuthLogin.js');
+
+const providers = (body) => {
+    globalThis.fetch = vi.fn(async () => reply(200, body));
+};
+
+const fillForm = () => {
+    $('[name="username"]').val('someone');
+    $('[name="email"]').val('[email protected]');
+    $('[name="password"]').val('a-Strong-pass-1');
+    $('[name="confirm_password"]').val('a-Strong-pass-1');
+};
+
+const captureAjax = () => {
+    const calls = [];
+    vi.spyOn($, 'ajax').mockImplementation((opts) => {
+        calls.push(opts);
+    });
+    return calls;
+};
+
+beforeEach(() => {
+    resetAuthGlobals();
+    gates.email.mockReset();
+    gates.phone.mockReset();
+    gates.card.mockReset();
+});
+afterEach(() => {
+    activeAuthFlow()?.finish(false);
+    vi.restoreAllMocks();
+});
+
+describe('signup when only OIDC signups are open', () => {
+    const open = async () => {
+        void UIAuthSignup({ reload_on_success: false });
+        await vi.waitFor(() => expect($('.oidc-google-btn')).toHaveLength(1));
+    };
+
+    it('offers the email form behind a button normally', async () => {
+        providers({ providers: ['google'], signupOidcOnly: false });
+        await open();
+        expect($('.signup-with-email-wrapper').prop('hidden')).toBe(false);
+        expect($('.signup-form').prop('hidden')).toBe(true);
+        $('.signup-with-email-btn').trigger('click');
+        expect($('.signup-form').prop('hidden')).toBe(false);
+    });
+
+    it('drops the email form', async () => {
+        providers({ providers: ['google'], signupOidcOnly: true });
+        await open();
+        expect($('.signup-form').prop('hidden')).toBe(true);
+        expect($('.signup-with-email-wrapper').prop('hidden')).toBe(true);
+    });
+
+    it('switches to the providers when a form signup is refused for it', async () => {
+        providers({ providers: ['google'], signupOidcOnly: false });
+        await open();
+        const calls = captureAjax();
+        $('.signup-with-email-btn').trigger('click');
+        fillForm();
+        $('.signup-form').trigger('submit');
+        await vi.waitFor(() => expect(calls).toHaveLength(1));
+        calls[0].error({ responseText: JSON.stringify({ code: 'signup_oidc_only', message: 'closed' }) });
+        await tick();
+        expect($('.signup-form').prop('hidden')).toBe(true);
+    });
+
+    it.each([false, true])('keeps an error it opened with in view (OIDC only: %s)', async (signupOidcOnly) => {
+        providers({ providers: ['google'], signupOidcOnly });
+        void UIAuthSignup({ authError: 'Your account could not be created.' });
+        await vi.waitFor(() => expect($('.oidc-google-btn')).toHaveLength(1));
+        expect($('.signup-form').prop('hidden')).toBe(true);
+        const $status = screen().find('.dashboard-form-status');
+        expect($status.text()).toBe('Your account could not be created.');
+        expect($status.closest('[hidden]')).toHaveLength(0);
+    });
+
+    it('leaves a form the user already typed into', async () => {
+        let answer;
+        globalThis.fetch = vi.fn(() => new Promise((resolve) => {
+            answer = resolve;
+        }));
+        vi.useFakeTimers({ toFake: ['setTimeout', 'clearTimeout'] });
+        void UIAuthSignup();
+        // A slow lookup gives up the wait and shows the form.
+        vi.advanceTimersByTime(1500);
+        vi.useRealTimers();
+        expect($('.signup-form').prop('hidden')).toBe(false);
+        $('[name="username"]').val('started');
+        answer(reply(200, { providers: ['google'] }));
+        await vi.waitFor(() => expect($('.oidc-google-btn')).toHaveLength(1));
+        expect($('.signup-form').prop('hidden')).toBe(false);
+    });
+});
+
+describe('signup while the providers are looked up', () => {
+    /** Lets promise callbacks run, but no timer, so nothing a paint could show in between. */
+    const settlePromises = async () => {
+        for ( let i = 0; i < 10; i++ ) await Promise.resolve();
+    };
+
+    it('keeps the email form hidden until the providers are known', async () => {
+        let answer;
+        globalThis.fetch = vi.fn(() => new Promise((resolve) => {
+            answer = resolve;
+        }));
+        void UIAuthSignup();
+        expect($('.signup-form').prop('hidden')).toBe(true);
+        answer(reply(200, { providers: ['google'] }));
+        await vi.waitFor(() => expect($('.oidc-google-btn')).toHaveLength(1));
+        expect($('.signup-form').prop('hidden')).toBe(true);
+        expect($('.signup-with-email-wrapper').prop('hidden')).toBe(false);
+    });
+
+    it('shows the email form when no providers are offered', async () => {
+        void UIAuthSignup();
+        await vi.waitFor(() => expect($('.signup-form').prop('hidden')).toBe(false));
+        expect($('.signup-with-email-wrapper').prop('hidden')).toBe(true);
+    });
+
+    it('shows a prefilled email form straight away', () => {
+        globalThis.fetch = vi.fn(() => new Promise(() => {}));
+        void UIAuthSignup({ email: '[email protected]' });
+        expect($('.signup-form').prop('hidden')).toBe(false);
+    });
+
+    it('reuses the login screen\'s lookup, drawing the providers before any paint', async () => {
+        providers({ providers: ['google'], signupOidcOnly: false });
+        void UIAuthLogin({ reload_on_success: false });
+        await vi.waitFor(() => expect(screen().find('.oidc-google-btn')).toHaveLength(1));
+        screen().find('.auth-to-signup').trigger('click');
+        await settlePromises();
+        expect(screen().attr('data-screen')).toBe('signup');
+        expect(screen().find('.oidc-google-btn')).toHaveLength(1);
+        expect(screen().find('.signup-with-email-wrapper').prop('hidden')).toBe(false);
+        expect(fetch).toHaveBeenCalledOnce();
+    });
+});
+
+describe('signup form', () => {
+    it.each([
+        [{}, 'username_required', 'username'],
+        [{ username: 'a' }, 'email_required', 'email'],
+        [{ username: 'a', email: 'nope' }, 'email_invalid', 'email'],
+        [{ username: 'a', email: '[email protected]' }, 'password_required', 'password'],
+        [{ username: 'a', email: '[email protected]', password: 'weak' }, 'password_strength_error', 'password'],
+        [{ username: 'a', email: '[email protected]', password: 'a-Strong-pass-1' }, 'confirm_password_required', 'confirm_password'],
+        [{ username: 'a', email: '[email protected]', password: 'a-Strong-pass-1', confirm_password: 'other' }, 'passwords_do_not_match', 'confirm_password'],
+    ])('checks %j before sending', (values, message, field) => {
+        const calls = captureAjax();
+        void UIAuthSignup();
+        for ( const [name, value] of Object.entries(values) ) $(`[name="${name}"]`).val(value);
+        $('.signup-form').trigger('submit');
+        expect(screen().find('.dashboard-form-status').text()).toBe(message);
+        expect($(`[name="${field}"]`).attr('aria-invalid')).toBe('true');
+        expect(calls).toHaveLength(0);
+    });
+
+    it('asks for the CAPTCHA when Turnstile is on', async () => {
+        window.gui_params = { turnstileSiteKey: 'key' };
+        window.turnstile = { render: vi.fn(() => 'widget'), reset: vi.fn() };
+        const calls = captureAjax();
+        void UIAuthSignup();
+        expect(window.turnstile.render).toHaveBeenCalledWith($('.cf-turnstile').get(0), expect.objectContaining({ sitekey: 'key' }));
+        fillForm();
+        $('.signup-form').trigger('submit');
+        expect(screen().find('.dashboard-form-status').text()).toBe('captcha_required');
+        window.turnstile.render.mock.calls[0][1].callback('tok');
+        $('.signup-form').trigger('submit');
+        await vi.waitFor(() => expect(calls).toHaveLength(1));
+        expect(JSON.parse(calls[0].data)['cf-turnstile-response']).toBe('tok');
+        calls[0].error({ responseText: '{"message":"no"}' });
+        await tick();
+        expect(window.turnstile.reset).toHaveBeenCalledWith('widget');
+    });
+
+    it('sends the honeypot, referrer, bonus code and confirmation setting', async () => {
+        window.signup_bonus_code = 'BONUS';
+        globalThis.fetch = vi.fn(async () => reply(200, { valid: true, display: { title: 'T', description: 'D' } }));
+        const calls = captureAjax();
+        void UIAuthSignup({ referrer: 'app-x', send_confirmation_code: true });
+        fillForm();
+        $('.p102xyzname').val('bot');
+        $('.signup-form').trigger('submit');
+        await vi.waitFor(() => expect(calls).toHaveLength(1));
+        expect(JSON.parse(calls[0].data)).toMatchObject({
+            username: 'someone',
+            email: '[email protected]',
+            referrer: 'app-x',
+            send_confirmation_code: true,
+            p102xyzname: 'bot',
+            bonusCode: 'BONUS',
+        });
+        expect(calls[0].timeout).toBe(30000);
+    });
+
+    it('drops a refused bonus code and says so', async () => {
+        window.signup_bonus_code = 'BAD';
+        const calls = captureAjax();
+        void UIAuthSignup();
+        fillForm();
+        $('.signup-form').trigger('submit');
+        await vi.waitFor(() => expect(calls).toHaveLength(1));
+        calls[0].error({ responseText: JSON.stringify({ code: 'bonus_code_invalid' }) });
+        await tick();
+        expect(window.signup_bonus_code).toBeNull();
+        expect(screen().find('.dashboard-form-status').text()).toBe('signup_bonus_code_invalid_retry');
+        expect($('.signup-btn').prop('disabled')).toBe(false);
+    });
+
+    it('puts focus back in the form after the server refuses, so Enter can retry', async () => {
+        const calls = captureAjax();
+        void UIAuthSignup();
+        fillForm();
+        $('[name="confirm_password"]').get(0).focus();
+        $('.signup-form').trigger('submit');
+        await vi.waitFor(() => expect(calls).toHaveLength(1));
+        calls[0].error({ responseText: '{"message":"This username is not available."}' });
+        await tick();
+        expect(screen().find('.dashboard-form-status').text()).toBe('This username is not available.');
+        expect(document.activeElement).toBe($('[name="confirm_password"]').get(0));
+    });
+
+    it('covers the page when signups are blocked here', async () => {
+        const calls = captureAjax();
+        void UIAuthSignup();
+        fillForm();
+        $('.signup-form').trigger('submit');
+        await vi.waitFor(() => expect(calls).toHaveLength(1));
+        calls[0].error({ responseText: JSON.stringify({ code: 'signup_blocked', message: '<i>No</i>' }) });
+        await tick();
+        expect($('.signup-blocked-overlay').text()).toContain('<i>No</i>');
+        expect($('.signup-blocked-overlay i')).toHaveLength(0);
+    });
+
+    it('runs the account checks after the card makes way, then settles', async () => {
+        gates.email.mockResolvedValue(true);
+        gates.phone.mockResolvedValueOnce(false).mockResolvedValueOnce('card');
+        const calls = captureAjax();
+        const result = UIAuthSignup({ reload_on_success: false, send_confirmation_code: true });
+        fillForm();
+        $('.signup-form').trigger('submit');
+        await vi.waitFor(() => expect(calls).toHaveLength(1));
+        calls[0].success({ token: 't', user: { requires_phone_verification: true, requires_card_verification: true } });
+        await expect(result).resolves.toBe(true);
+        expect($('.auth-dialog-overlay.dashboard-dialog-show')).toHaveLength(0);
+        // email → phone (retried until passed) → card, which the phone's card fallback cleared.
+        expect(gates.email).toHaveBeenCalledOnce();
+        // Closing a check without an answer would strand the caller.
+        for ( const gate of [gates.email, gates.phone] ) {
+            expect(gate.mock.calls[0][0].show_close_button).toBe(false);
+        }
+        expect(gates.phone).toHaveBeenCalledTimes(2);
+        expect(gates.card).not.toHaveBeenCalled();
+    });
+
+    it.each([
+        [true, { cover_page: true, has_head: false }],
+        [false, {}],
+    ])('covers the page with the account checks when signup was a page (%s)', async (page, window_options) => {
+        gates.email.mockResolvedValue(true);
+        gates.phone.mockResolvedValue(true);
+        gates.card.mockResolvedValue(true);
+        const calls = captureAjax();
+        const result = UIAuthSignup({ page, reload_on_success: false, send_confirmation_code: true });
+        fillForm();
+        $('.signup-form').trigger('submit');
+        await vi.waitFor(() => expect(calls).toHaveLength(1));
+        calls[0].success({ token: 't', user: { requires_phone_verification: true, requires_card_verification: true } });
+        await result;
+        for ( const gate of [gates.email, gates.phone, gates.card] ) {
+            expect(gate.mock.calls[0][0].window_options).toEqual(window_options);
+        }
+    });
+
+    it('keeps an app landing after a signup that reloads', () => {
+        expect(signupRedirectUrl('/x')).toBe('/x');
+        expect(signupRedirectUrl(undefined)).toBe('/');
+    });
+});
+
+describe('account picker', () => {
+    beforeEach(() => {
+        window.logged_in_users = [
+            { uuid: 'u1', username: 'alice', email: '[email protected]', auth_token: 'ta', profile: { picture: 'data:image/png;base64,AA' } },
+            { uuid: 'u2', username: '<b>bob</b>', auth_token: 'tb' },
+        ];
+    });
+
+    it('lists the accounts, encoded, and can not be dismissed', () => {
+        void UIAuthAccountPicker({ reload_on_success: false, page: true });
+        expect($('.auth-account')).toHaveLength(2);
+        expect($('.auth-account b')).toHaveLength(0);
+        expect($('.auth-account-avatar img').attr('src')).toBe('data:image/png;base64,AA');
+        expect($('.dashboard-dialog-close')).toHaveLength(0);
+    });
+
+    it('signs in as the picked account', async () => {
+        const result = UIAuthAccountPicker({ reload_on_success: false });
+        $('.auth-account[data-uuid="u2"]').trigger('click');
+        await expect(result).resolves.toBe(true);
+        expect(window.update_auth_data).toHaveBeenCalledWith('tb', window.logged_in_users[1]);
+    });
+
+    it('logs in to another account with a way back to the list', async () => {
+        captureAjax();
+        void UIAuthAccountPicker({ reload_on_success: false });
+        $('.auth-to-login').trigger('click');
+        expect(screen().attr('data-screen')).toBe('login');
+        $('.auth-dialog-back').trigger('click');
+        expect(screen().attr('data-screen')).toBe('accounts');
+        $('.auth-to-signup').trigger('click');
+        expect(screen().attr('data-screen')).toBe('signup');
+    });
+});
+
+describe('password recovery', () => {
+    it('asks for the account, then shows what the server said', async () => {
+        const calls = captureAjax();
+        void UIAuthRecoverPassword({ page: true });
+        $('.pass-recovery-form').trigger('submit');
+        expect(screen().find('.dashboard-form-status').text()).toBe('login_email_username_required');
+        $('[name="email_or_username"]').val('[email protected]');
+        $('.pass-recovery-form').trigger('submit');
+        expect(calls[0].url).toBe('https://api.puter.test/send-pass-recovery-email');
+        expect(JSON.parse(calls[0].data)).toEqual({ email: '[email protected]' });
+        calls[0].success({ message: 'Sent <b>it</b>' });
+        await tick();
+        expect($('.auth-done').text()).toBe('Sent <b>it</b>');
+        expect($('.pass-recovery-form')).toHaveLength(0);
+        // The page has a way on to the login.
+        $('.auth-to-login').trigger('click');
+        expect(screen().attr('data-screen')).toBe('login');
+    });
+
+    it('shows a refusal on the form', async () => {
+        const calls = captureAjax();
+        void UIAuthRecoverPassword();
+        $('[name="email_or_username"]').val('someone');
+        $('.pass-recovery-form').trigger('submit');
+        expect(JSON.parse(calls[0].data)).toEqual({ username: 'someone' });
+        calls[0].error({ responseText: JSON.stringify({ message: 'Too many' }) });
+        await tick();
+        expect(screen().find('.dashboard-form-status').text()).toBe('Too many');
+        expect($('[name="email_or_username"]').prop('disabled')).toBe(false);
+    });
+});

src/gui/src/UI/Auth/authFlow.js

@@ -0,0 +1,500 @@
+/*
+ * Copyright (C) 2024-present Puter Technologies Inc.
+ *
+ * This file is part of Puter.
+ *
+ * Puter is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published
+ * by the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <https://www.gnu.org/licenses/>.
+ */
+
+// The card that sign-in, sign-up, the account picker, password recovery and
+// the second factor share: a dashboard dialog whose screens replace each
+// other in place, with a Back button, instead of opening windows over each
+// other. One flow is open at a time.
+//
+// Two presentations. A dialog dims what is under it, and docks as a bottom
+// sheet on phones. A page (a cover page, or any sign-in popup) has nothing
+// to go back to: an opaque page under a centered card, and the whole screen
+// on phones and in popups.
+
+import { isAttestedOrigin } from '../../helpers/attestedOrigin.js';
+import { authLogoHeader, wireAuthLogoHeader } from '../../helpers/authLogoHeader.js';
+import { get_auth_redirect_url } from '../../helpers/authRedirect.js';
+import { syncSessionCookie } from '../../util/sessionAuth.js';
+import { isTouchPrimaryDevice } from '../Dashboard/ContextMenu/ContextMenu.js';
+import mountDashboardOverlay from '../Dashboard/dashboardOverlay.js';
+import { ICONS, SVG } from '../Dashboard/UIDashboardDialog.js';
+
+const BACK_ICON = SVG('<path d="M15 18l-6-6 6-6"/>');
+
+/** @type {AuthFlow | null} */
+let active_flow = null;
+
+/**
+ * @typedef {object} AuthScreen
+ * @property {string} name Matched by `goTo`.
+ * @property {string} html The screen's markup. A `.auth-title` names the
+ *   dialog while the screen shows.
+ * @property {boolean} [autofocus] Focus the first field on show; default true.
+ * @property {() => void} [onBack] Makes Back available on the first screen,
+ *   where it runs this instead of returning to an earlier screen.
+ * @property {() => void} [onLeave] Runs when the screen is taken off the
+ *   stack: by Back, `goTo`, or the flow closing.
+ */
+
+/**
+ * What every screen of a flow does once the user is signed in. Set from the
+ * options of the call that opened the flow; screens it leads to share them.
+ *
+ * @typedef {object} AuthFlowOptions
+ * @property {boolean} reload_on_success Navigate to `redirect_url` on success,
+ *   rather than settle the flow with `true`.
+ * @property {string} [redirect_url] Defaults to the page the flow started on.
+ * @property {string} [referrer] Sent with a signup, for user acquisition.
+ * @property {boolean} send_confirmation_code Ask a new account to confirm its
+ *   email with a code.
+ * @property {boolean} show_signup_button Offer to create an account from
+ *   the login screen.
+ */
+
+/**
+ * @param {Partial<AuthFlowOptions>} [options]
+ * @returns {AuthFlowOptions}
+ */
+export const authFlowOptions = (options = {}) => ({
+    reload_on_success: options.reload_on_success ?? true,
+    // Stay on the page the flow started from (e.g. an /app/<name> landing);
+    // standalone auth pages go to the root dashboard.
+    redirect_url: options.redirect_url === undefined ? get_auth_redirect_url() : options.redirect_url,
+    referrer: options.referrer,
+    send_confirmation_code: options.send_confirmation_code ?? false,
+    show_signup_button: options.show_signup_button ?? true,
+});
+
+/**
+ * Leaves for `url` once signed in. A URL that differs from this page's only
+ * in its hash (a dashboard `#tab`) would just scroll, never reload, so the
+ * page reloads at it instead.
+ *
+ * @param {string} url
+ */
+export const navigateAfterSignIn = (url) => {
+    window.onbeforeunload = null;
+    const target = new URL(url, window.location.href);
+    const here = new URL(window.location.href);
+    target.hash = '';
+    here.hash = '';
+    if ( target.href !== here.href ) {
+        window.location.replace(url);
+        return;
+    }
+    history.replaceState(history.state, '', new URL(url, window.location.href).href);
+    window.location.reload();
+};
+
+/**
+ * Hands the session cookie back to the account this page is signed in as.
+ * A sign-in the server completes after the user dismissed the card has
+ * already moved the cookie to the other account, and the endpoints that
+ * read the cookie (password, 2FA) would act on that one.
+ */
+export const keepCurrentSession = () => {
+    void syncSessionCookie({ origin: window.gui_origin || window.location.origin, authToken: window.auth_token });
+};
+
+/**
+ * @typedef {object} AuthFlow
+ * @property {AuthFlowOptions} options
+ * @property {jQuery} $overlay
+ * @property {jQuery} $dialog
+ * @property {boolean} page Whether it shows as a page rather than a dialog.
+ * @property {boolean} dismissable
+ * @property {Promise<unknown>} result Settles once, with `settle`/`finish`'s
+ *   value, or `false` when the user dismisses the flow.
+ * @property {(screen: AuthScreen) => jQuery} push Shows a screen over the
+ *   current one; returns its element.
+ * @property {() => void} back
+ * @property {(name: string) => boolean} goTo Returns to an earlier screen by
+ *   name, if there is one.
+ * @property {(busy: boolean) => void} setBusy While busy, only ✕ dismisses
+ *   the flow and Back is disabled. Ending it returns focus to where it was,
+ *   once that control is enabled again.
+ * @property {() => boolean} isBusy
+ * @property {() => void} close Takes the card down without settling.
+ * @property {(value: unknown) => void} settle
+ * @property {(value: unknown) => void} finish `close`, then `settle`.
+ * @property {() => boolean} isClosed
+ * @property {() => void} focus Brings focus back to the current screen.
+ */
+
+/** The open flow, if any. */
+export const activeAuthFlow = () => (active_flow && ! active_flow.isClosed() ? active_flow : null);
+
+/**
+ * The first enabled, visible field of a screen.
+ *
+ * @param {jQuery} $screen
+ * @returns {HTMLElement | undefined}
+ */
+const firstField = ($screen) => $screen
+    .find('input:not([type=hidden]):not(.p102xyzname), select, textarea')
+    .filter(':visible:not(:disabled):not([readonly])')
+    .get(0);
+
+/**
+ * @param {object} opts
+ * @param {boolean} [opts.page] Show as a page; see the top of this file.
+ *   Sign-in popups always are.
+ * @param {boolean} [opts.dismissable] Offer ✕ and Escape; defaults to
+ *   `!page`.
+ * @param {boolean} [opts.closeOnBackdrop] A press on the dimmed area
+ *   dismisses it too. Off by default: a stray click must not lose typed
+ *   credentials.
+ * @param {Partial<AuthFlowOptions>} [opts.options]
+ * @returns {AuthFlow}
+ */
+export default function openAuthFlow ({ page = false, dismissable = ! page, closeOnBackdrop = false, options } = {}) {
+    // A newer flow wins; the old one's caller hears it was dismissed.
+    activeAuthFlow()?.finish(false);
+
+    const id = `auth-${window.uuidv4?.() ?? Date.now()}`;
+    const as_page = !! page || !! window.embedded_in_popup;
+
+    let h = '<div class="dashboard-dialog auth-dialog" role="dialog" aria-modal="true" tabindex="-1">';
+    h += '<div class="auth-dialog-bar">';
+    h += `<button type="button" class="auth-dialog-back" hidden aria-label="${i18n('back')}" title="${i18n('back')}">${BACK_ICON}</button>`;
+    if ( dismissable ) {
+        h += `<button type="button" class="dashboard-dialog-close" aria-label="${i18n('close')}" title="${i18n('close')}">${ICONS.close}</button>`;
+    }
+    h += '</div>';
+    h += '</div>';
+
+    let resolve;
+    const result = new Promise((r) => {
+        resolve = r;
+    });
+    let busy = false;
+    /** @type {HTMLElement | null} */
+    let el_busy_return = null;
+    let settled = false;
+    let torn_down = false;
+    /** @type {Array<AuthScreen & { $el: jQuery, el_return?: Element | null }>} */
+    const stack = [];
+
+    // A frame's focus() calls do nothing until the framing page focuses it,
+    // so the screen takes focus then, unless something already has it.
+    const onFrameFocus = () => {
+        if ( ! document.activeElement || document.activeElement === document.body ) flow.focus();
+    };
+    const teardown = () => {
+        if ( torn_down ) return;
+        torn_down = true;
+        window.removeEventListener('focus', onFrameFocus);
+        if ( active_flow === flow ) active_flow = null;
+        // Screens waiting on the user (the second factor) hear they won't get an answer.
+        while ( stack.length ) stack.pop().onLeave?.();
+    };
+
+    const { $overlay, $dialog, close: closeOverlay, isClosed } = mountDashboardOverlay({
+        html: h,
+        // A page already fills the screen. Resizing it under iOS's own pan to
+        // the focused field makes the form jump up and down as the keyboard opens.
+        fitKeyboard: ! as_page,
+        canDismiss: (via) => dismissable
+            && (via === 'close' || (! busy && (via !== 'backdrop' || closeOnBackdrop))),
+        onDismiss: () => {
+            teardown();
+            flow.settle(false);
+        },
+    });
+    $overlay.addClass('auth-dialog-overlay');
+    if ( as_page ) $overlay.addClass('auth-dialog-page');
+
+    const $back = $dialog.find('.auth-dialog-back');
+    const top = () => stack[stack.length - 1];
+
+    const focusScreen = (screen) => {
+        if ( ! screen || isClosed() ) return;
+        // A keyboard popping up mid-animation on a phone hides half the
+        // card; there the user taps the field they want.
+        const el_field = screen.autofocus !== false && ! isTouchPrimaryDevice()
+            ? firstField(screen.$el) ?? screen.$el.find('.auth-provider-btn').filter(':visible').get(0)
+            : undefined;
+        (el_field ?? $dialog.get(0))?.focus({ preventScroll: true });
+    };
+
+    // Back and ✕ float over the top of the screen. Once it scrolls, the bar
+    // under them turns opaque, so what passes beneath neither shows through
+    // nor takes their taps.
+    const syncScrolled = () => {
+        const el_body = top()?.$el.find('.auth-body').get(0);
+        $dialog.toggleClass('auth-dialog-scrolled', !! el_body && el_body.scrollTop > 0);
+    };
+    $dialog.get(0).addEventListener('scroll', syncScrolled, { capture: true, passive: true });
+
+    const refresh = () => {
+        const screen = top();
+        syncScrolled();
+        $back.prop('hidden', ! (stack.length > 1 || screen?.onBack));
+        $back.prop('disabled', busy);
+        const el_title = screen?.$el.find('.auth-title').get(0);
+        $dialog.attr('aria-labelledby', el_title?.id || null);
+    };
+
+    /** Takes the top screen off the stack and shows the one under it. */
+    const pop = () => {
+        const screen = stack.pop();
+        screen.$el.remove();
+        screen.onLeave?.();
+        const under = top();
+        under.$el.prop('hidden', false);
+        return under;
+    };
+
+    /** @type {AuthFlow} */
+    const flow = {
+        options: authFlowOptions(options),
+        $overlay,
+        $dialog,
+        page: as_page,
+        dismissable,
+        result,
+        push (screen) {
+            const under = top();
+            if ( under ) {
+                under.el_return = $dialog.get(0).contains(document.activeElement) ? document.activeElement : null;
+                under.$el.prop('hidden', true);
+            }
+            const $el = $(`<section class="auth-screen" data-screen="${html_encode(screen.name)}">${screen.html}</section>`);
+            $el.find('.auth-title').first().attr('id', `${id}-title-${stack.length}`);
+            $dialog.append($el);
+            const record = { ...screen, $el };
+            stack.push(record);
+            refresh();
+            focusScreen(record);
+            return $el;
+        },
+        back () {
+            if ( busy || isClosed() ) return;
+            if ( stack.length > 1 ) {
+                const under = pop();
+                refresh();
+                const el_return = under.el_return;
+                if ( el_return && under.$el.get(0).contains(el_return) && ! el_return.disabled ) {
+                    el_return.focus({ preventScroll: true });
+                } else {
+                    focusScreen(under);
+                }
+                return;
+            }
+            top()?.onBack?.();
+        },
+        goTo (name) {
+            const index = stack.findIndex((screen) => screen.name === name);
+            if ( index === -1 ) return false;
+            while ( stack.length > index + 1 ) pop();
+            refresh();
+            focusScreen(top());
+            return true;
+        },
+        setBusy (value) {
+            const was_busy = busy;
+            busy = !! value;
+            // Busy screens lock their fields, and a disabled field drops focus
+            // to the page, where the desktop's shortcuts would take the keys.
+            const el_dialog = $dialog.get(0);
+            const el_active = document.activeElement;
+            if ( busy && ! was_busy ) {
+                el_busy_return = el_active !== el_dialog && el_dialog.contains(el_active) ? el_active : null;
+            }
+            if ( busy && el_dialog.contains(el_active) ) el_dialog.focus({ preventScroll: true });
+            $dialog.toggleClass('auth-dialog-busy', busy).attr('aria-busy', busy ? 'true' : null);
+            refresh();
+            if ( busy || ! was_busy ) return;
+            // A failed request hands the keys back to where the user was, so
+            // Enter can retry. A screen that already moved focus keeps it.
+            const el_return = el_busy_return;
+            el_busy_return = null;
+            if ( el_return && document.activeElement === el_dialog && el_dialog.contains(el_return)
+                && ! el_return.disabled && ! el_return.closest('[hidden]') ) {
+                el_return.focus({ preventScroll: true });
+            }
+        },
+        isBusy: () => busy,
+        close () {
+            if ( isClosed() ) return;
+            teardown();
+            closeOverlay();
+        },
+        settle (value) {
+            if ( settled ) return;
+            settled = true;
+            resolve(value);
+        },
+        finish (value) {
+            flow.close();
+            flow.settle(value);
+        },
+        isClosed,
+        focus: () => focusScreen(top()),
+    };
+
+    $back.on('click', () => flow.back());
+
+    // Keys typed here are the card's. The desktop's shortcuts listen on the
+    // document (Enter opens the selected item, Delete trashes it, letters
+    // search the desktop), so they must not reach it. Escape is handled here
+    // for the same reason.
+    $overlay.on('keydown keyup keypress', function (e) {
+        e.stopPropagation();
+        if ( e.type !== 'keydown' || e.key !== 'Escape' ) return;
+        // An Escape that cancels an IME conversion is the IME's; jQuery's
+        // event doesn't carry isComposing, the browser's does.
+        if ( e.originalEvent?.isComposing || e.keyCode === 229 ) return;
+        e.preventDefault();
+        if ( busy ) return;
+        if ( dismissable ) $dialog.find('.dashboard-dialog-close').trigger('click');
+        // A framed sign-in's ✕ is the framing page's, which close() asks.
+        else if ( window.embedded_in_frame ) window.close();
+    });
+    // A press on the backdrop (or a page's background) would move focus to
+    // the page, and with it the keys; it stays where it was.
+    $overlay.on('mousedown', function (e) {
+        if ( e.target === this ) e.preventDefault();
+    });
+
+    if ( window.embedded_in_frame ) window.addEventListener('focus', onFrameFocus);
+
+    active_flow = flow;
+    return flow;
+}
+
+/**
+ * Joins the flow that is already open, if any: a second sign-in prompt
+ * (an app asking while the user is mid-login) waits on the first rather than
+ * stacking another card over it.
+ *
+ * @returns {Promise<unknown> | null}
+ */
+export const joinAuthFlow = () => {
+    const open = activeAuthFlow();
+    if ( ! open ) return null;
+    // Bring focus back to the card, without taking it from a field the
+    // user is typing in there.
+    if ( ! open.$dialog.get(0).contains(document.activeElement) ) open.focus();
+    return open.result;
+};
+
+/**
+ * The top of a screen: the Puter logo (beside the opener's, in a sign-in
+ * popup), the screen's title, and, in a popup, which site sent the user.
+ *
+ * @param {AuthFlow} flow
+ * @param {string} title Plain text.
+ * @param {{ openerNotice?: boolean }} [opts] `openerNotice: false` leaves out
+ *   the line explaining that the site uses Puter, for screens shown to someone
+ *   who already has an account here.
+ * @returns {string}
+ */
+export const authHeadHtml = (flow, title, { openerNotice = true } = {}) => {
+    const opener = window.embedded_in_popup && isAttestedOrigin(window.openerOrigin) ? window.openerOrigin : '';
+    let h = '<div class="auth-head">';
+    h += authLogoHeader({
+        logoSrc: window.icons['logo-white.svg'],
+        logoHref: logoHref(flow),
+        openerOrigin: opener,
+        openerFallbackSrc: window.icons['website.svg'],
+    });
+    h += `<h1 class="auth-title">${html_encode(title)}</h1>`;
+    if ( opener && openerNotice ) {
+        h += `<p class="auth-opener-notice">${i18n('popup_opener_uses_puter', [new URL(opener).hostname])}</p>`;
+    }
+    h += '</div>';
+    return h;
+};
+
+/**
+ * On a cover page, the logo is a way out: desktop users stay on the desktop,
+ * everyone else goes to the root dashboard.
+ *
+ * @param {AuthFlow} flow
+ * @returns {string} Empty where the logo leads nowhere.
+ */
+const logoHref = (flow) => {
+    if ( ! flow.page || window.embedded_in_popup ) return '';
+    return window.location.pathname === '/desktop' ? '/desktop' : '/';
+};
+
+/**
+ * Wires a screen's head once it is on the page.
+ *
+ * @param {jQuery} $screen
+ */
+export const wireAuthHead = ($screen) => {
+    wireAuthLogoHeader($screen.get(0));
+};
+
+/**
+ * Sets a screen's status line. Plain text unless `html` is given, which the
+ * caller has already encoded.
+ *
+ * @param {jQuery} $screen
+ * @param {string} text Empty clears it.
+ * @param {{ kind?: 'error'|'info'|'success', html?: string, field?: string }} [opts]
+ *   `field` is a selector for the control to mark invalid and focus.
+ */
+export const setAuthStatus = ($screen, text, { kind = 'error', html, field } = {}) => {
+    const $status = $screen.find('.dashboard-form-status').first();
+    if ( html !== undefined ) $status.html(html);
+    else $status.text(text ?? '');
+    const shown = !! (text || html);
+    $status
+        .toggleClass('dashboard-form-status-error', shown && kind === 'error')
+        .toggleClass('dashboard-form-status-info', shown && kind === 'info')
+        .toggleClass('auth-status-success', shown && kind === 'success');
+    $screen.find('[aria-invalid]').removeAttr('aria-invalid');
+    if ( ! shown ) return;
+    const el_status = $status.get(0);
+    el_status?.scrollIntoView?.({ block: 'nearest' });
+    if ( field ) {
+        const el_field = $screen.find(field).attr('aria-invalid', 'true').get(0);
+        if ( el_field && ! el_field.disabled ) el_field.focus({ preventScroll: true });
+    }
+};
+
+/**
+ * Shows a form's submit button as working, and locks the form's fields,
+ * while `busy`.
+ *
+ * @param {jQuery} $form
+ * @param {boolean} busy
+ */
+export const setFormBusy = ($form, busy) => {
+    $form.find('input, select, textarea, button').prop('disabled', busy);
+    $form.find('.auth-submit')
+        .toggleClass('dashboard-form-busy', busy)
+        .attr('aria-busy', busy ? 'true' : null);
+};
+
+/**
+ * The submit button of an auth form: full width, with a spinner while busy.
+ *
+ * @param {string} label Plain text.
+ * @param {string} [extraClass]
+ * @returns {string}
+ */
+export const submitButtonHtml = (label, extraClass = '') =>
+    `<button type="submit" class="dashboard-dialog-btn dashboard-dialog-btn-primary auth-submit ${extraClass}">`
+    + '<span class="dashboard-form-spinner" aria-hidden="true"></span>'
+    + `<span class="dashboard-form-submit-label">${html_encode(label)}</span>`
+    + '</button>';

src/gui/src/UI/Auth/authFlow.test.js

@@ -0,0 +1,365 @@
+// @vitest-environment jsdom
+/*
+ * Copyright (C) 2024-present Puter Technologies Inc.
+ *
+ * This file is part of Puter.
+ *
+ * Puter is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published
+ * by the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <https://www.gnu.org/licenses/>.
+ */
+import { beforeEach, describe, expect, it, vi } from 'vitest';
+import { resetAuthGlobals, tick } from './authTestSetup.js';
+
+const { default: openAuthFlow, activeAuthFlow, authFlowOptions, authHeadHtml, joinAuthFlow, navigateAfterSignIn } = await import('./authFlow.js');
+
+const key = (target, k) => target.dispatchEvent(new KeyboardEvent('keydown', { key: k, bubbles: true }));
+const backdropClick = () => {
+    const el = $('.auth-dialog-overlay').last().get(0);
+    el.dispatchEvent(new MouseEvent('mousedown', { bubbles: true, detail: 1 }));
+    el.dispatchEvent(new MouseEvent('click', { bubbles: true, detail: 1 }));
+};
+
+beforeEach(() => {
+    resetAuthGlobals();
+    activeAuthFlow()?.finish(false);
+});
+
+describe('openAuthFlow', () => {
+    it('mounts one card over everything, not a window', async () => {
+        const flow = openAuthFlow();
+        flow.push({ name: 'a', html: '<h1 class="auth-title">A</h1>' });
+        await tick();
+        expect($('.auth-dialog-overlay.dashboard-dialog-overlay')).toHaveLength(1);
+        expect($('.window')).toHaveLength(0);
+        expect($('.auth-dialog').attr('aria-labelledby')).toBe($('.auth-title').attr('id'));
+    });
+
+    it('shows as a page, without ✕, for cover pages and every popup', () => {
+        openAuthFlow({ page: true }).finish(false);
+        window.embedded_in_popup = true;
+        const flow = openAuthFlow();
+        expect(flow.page).toBe(true);
+        expect($('.auth-dialog-overlay').last().hasClass('auth-dialog-page')).toBe(true);
+    });
+
+    it('lets ✕ and Escape dismiss a dialog, settling false', async () => {
+        const flow = openAuthFlow();
+        flow.push({ name: 'a', html: '<input>' });
+        key($('.auth-dialog input').get(0), 'Escape');
+        await expect(flow.result).resolves.toBe(false);
+        expect(activeAuthFlow()).toBeNull();
+
+        const second = openAuthFlow();
+        second.push({ name: 'a', html: '' });
+        $('.dashboard-dialog-close').last().trigger('click');
+        await expect(second.result).resolves.toBe(false);
+    });
+
+    it('keeps a page up: no ✕, Escape and backdrop do nothing', async () => {
+        const flow = openAuthFlow({ page: true });
+        flow.push({ name: 'a', html: '<input>' });
+        await tick();
+        expect($('.dashboard-dialog-close')).toHaveLength(0);
+        key($('.auth-dialog input').get(0), 'Escape');
+        backdropClick();
+        expect(flow.isClosed()).toBe(false);
+    });
+
+    it('lets Escape ask the framing page to close a framed sign-in, unless busy', async () => {
+        window.embedded_in_frame = true;
+        const close = vi.spyOn(window, 'close').mockImplementation(() => {});
+        try {
+            const flow = openAuthFlow({ page: true });
+            flow.push({ name: 'a', html: '<input>' });
+            await tick();
+            flow.setBusy(true);
+            key($('.auth-dialog input').get(0), 'Escape');
+            expect(close).not.toHaveBeenCalled();
+            flow.setBusy(false);
+            // Escape that cancels an IME conversion is the IME's.
+            $('.auth-dialog input').get(0).dispatchEvent(new KeyboardEvent('keydown', { key: 'Escape', isComposing: true, bubbles: true }));
+            expect(close).not.toHaveBeenCalled();
+            key($('.auth-dialog input').get(0), 'Escape');
+            expect(close).toHaveBeenCalledTimes(1);
+            flow.finish(false);
+        } finally {
+            close.mockRestore();
+            delete window.embedded_in_frame;
+        }
+    });
+
+    it('focuses a framed screen once the framing page focuses the frame', async () => {
+        window.embedded_in_frame = true;
+        try {
+            const flow = openAuthFlow({ page: true });
+            flow.push({ name: 'a', html: '<input>' });
+            // What a frame's focus() amounts to before the page focuses it.
+            document.activeElement.blur();
+            window.dispatchEvent(new FocusEvent('focus'));
+            // jsdom lays nothing out, so the screen's fallback, the card, takes it.
+            expect($('.auth-dialog').get(0).contains(document.activeElement)).toBe(true);
+
+            // Focus the user moved elsewhere stays there.
+            const el_outside = $('<button class="outside">').appendTo('body').get(0);
+            el_outside.focus();
+            window.dispatchEvent(new FocusEvent('focus'));
+            expect(document.activeElement).toBe(el_outside);
+            el_outside.remove();
+
+            flow.finish(false);
+            document.activeElement.blur();
+            window.dispatchEvent(new FocusEvent('focus'));
+            expect(document.activeElement).toBe(document.body);
+        } finally {
+            delete window.embedded_in_frame;
+        }
+    });
+
+    it('ignores the backdrop unless asked, so a stray click keeps typed credentials', async () => {
+        const kept = openAuthFlow();
+        kept.push({ name: 'a', html: '' });
+        await tick();
+        backdropClick();
+        expect(kept.isClosed()).toBe(false);
+        kept.finish(false);
+
+        const closing = openAuthFlow({ closeOnBackdrop: true });
+        closing.push({ name: 'a', html: '' });
+        await tick();
+        backdropClick();
+        await expect(closing.result).resolves.toBe(false);
+    });
+
+    it('holds Escape while busy; only ✕ dismisses then', async () => {
+        const flow = openAuthFlow();
+        flow.push({ name: 'a', html: '<input>' });
+        flow.setBusy(true);
+        key($('.auth-dialog input').get(0), 'Escape');
+        expect(flow.isClosed()).toBe(false);
+        $('.dashboard-dialog-close').trigger('click');
+        await expect(flow.result).resolves.toBe(false);
+    });
+
+    it('keeps typed keys from reaching the desktop shortcuts on the document', () => {
+        const flow = openAuthFlow({ page: true });
+        flow.push({ name: 'a', html: '<input>' });
+        const seen = vi.fn();
+        document.addEventListener('keydown', seen);
+        key($('.auth-dialog input').get(0), 'Delete');
+        key($('.auth-dialog input').get(0), 'Enter');
+        document.removeEventListener('keydown', seen);
+        expect(seen).not.toHaveBeenCalled();
+    });
+
+    it('keeps focus in the card while busy, since a locked field would drop it to the page', () => {
+        const flow = openAuthFlow();
+        flow.push({ name: 'a', html: '<input>' });
+        const el_input = $('.auth-dialog input').get(0);
+        el_input.focus();
+        flow.setBusy(true);
+        el_input.disabled = true;
+        expect(document.activeElement).toBe($('.auth-dialog').get(0));
+    });
+
+    it('hands focus back to where it was once busy ends, so Enter can retry', () => {
+        const flow = openAuthFlow();
+        flow.push({ name: 'a', html: '<input class="one"><input class="two">' });
+        const el_two = $('.auth-dialog .two').get(0);
+        el_two.focus();
+        flow.setBusy(true);
+        el_two.disabled = true;
+        el_two.disabled = false;
+        flow.setBusy(false);
+        expect(document.activeElement).toBe(el_two);
+
+        // A screen that moved focus on its own keeps it there.
+        flow.setBusy(true);
+        $('.auth-dialog .one').get(0).focus();
+        flow.setBusy(false);
+        expect(document.activeElement).toBe($('.auth-dialog .one').get(0));
+    });
+
+    it('keeps focus in the card when the backdrop is pressed', async () => {
+        const flow = openAuthFlow();
+        flow.push({ name: 'a', html: '<input>' });
+        const press = new MouseEvent('mousedown', { bubbles: true, cancelable: true, detail: 1 });
+        $('.auth-dialog-overlay').get(0).dispatchEvent(press);
+        expect(press.defaultPrevented).toBe(true);
+        $('.auth-dialog-overlay').get(0).dispatchEvent(new MouseEvent('click', { bubbles: true, detail: 1 }));
+        expect(flow.isClosed()).toBe(false);
+
+        const inside = new MouseEvent('mousedown', { bubbles: true, cancelable: true, detail: 1 });
+        $('.auth-dialog input').get(0).dispatchEvent(inside);
+        expect(inside.defaultPrevented).toBe(false);
+    });
+
+    it('stacks screens, keeping what was typed, with Back and goTo', () => {
+        const flow = openAuthFlow();
+        flow.push({ name: 'login', html: '<input class="typed">' });
+        $('.typed').val('kept');
+        expect($('.auth-dialog-back').prop('hidden')).toBe(true);
+
+        const left = vi.fn();
+        flow.push({ name: 'signup', html: '<p>signup</p>', onLeave: left });
+        expect($('[data-screen="login"]').prop('hidden')).toBe(true);
+        expect($('.auth-dialog-back').prop('hidden')).toBe(false);
+
+        flow.back();
+        expect(left).toHaveBeenCalledOnce();
+        expect($('[data-screen="signup"]')).toHaveLength(0);
+        expect($('[data-screen="login"]').prop('hidden')).toBe(false);
+        expect($('.typed').val()).toBe('kept');
+
+        flow.push({ name: 'signup', html: '' });
+        flow.push({ name: 'recover', html: '' });
+        expect(flow.goTo('login')).toBe(true);
+        expect($('.auth-screen')).toHaveLength(1);
+        expect(flow.goTo('nope')).toBe(false);
+    });
+
+    it('marks the card scrolled while the showing screen is, so the bar covers what passes under it', () => {
+        const flow = openAuthFlow();
+        const scroll = (screen, top) => {
+            const el = $(`[data-screen="${screen}"] .auth-body`).get(0);
+            el.scrollTop = top;
+            el.dispatchEvent(new Event('scroll'));
+        };
+        flow.push({ name: 'a', html: '<div class="auth-body"></div>' });
+        expect($('.auth-dialog').hasClass('auth-dialog-scrolled')).toBe(false);
+        scroll('a', 40);
+        expect($('.auth-dialog').hasClass('auth-dialog-scrolled')).toBe(true);
+        flow.push({ name: 'b', html: '<div class="auth-body"></div>' });
+        expect($('.auth-dialog').hasClass('auth-dialog-scrolled')).toBe(false);
+        flow.back();
+        expect($('.auth-dialog').hasClass('auth-dialog-scrolled')).toBe(true);
+        scroll('a', 0);
+        expect($('.auth-dialog').hasClass('auth-dialog-scrolled')).toBe(false);
+    });
+
+    it('offers Back on a first screen that asks for it', () => {
+        const flow = openAuthFlow({ page: true });
+        const back = vi.fn();
+        flow.push({ name: 'only', html: '', onBack: back });
+        expect($('.auth-dialog-back').prop('hidden')).toBe(false);
+        $('.auth-dialog-back').trigger('click');
+        expect(back).toHaveBeenCalledOnce();
+    });
+
+    it('tells waiting screens when the flow closes', () => {
+        const flow = openAuthFlow();
+        const left = vi.fn();
+        flow.push({ name: 'a', html: '', onLeave: left });
+        flow.finish(true);
+        expect(left).toHaveBeenCalledOnce();
+    });
+
+    it('lets a second prompt join the open flow instead of stacking another card', async () => {
+        expect(joinAuthFlow()).toBeNull();
+        const flow = openAuthFlow();
+        flow.push({ name: 'a', html: '' });
+        const joined = joinAuthFlow();
+        expect($('.auth-dialog')).toHaveLength(1);
+        flow.finish(true);
+        await expect(joined).resolves.toBe(true);
+    });
+
+    it('leaves the field being typed in when a second prompt joins', () => {
+        const flow = openAuthFlow();
+        flow.push({ name: 'a', html: '<input class="first"><input class="second">' });
+        $('.second').get(0).focus();
+        joinAuthFlow();
+        expect(document.activeElement).toBe($('.second').get(0));
+
+        // Focus that wandered off the card is brought back to it.
+        $('.second').get(0).blur();
+        joinAuthFlow();
+        expect($('.auth-dialog').get(0).contains(document.activeElement)).toBe(true);
+    });
+});
+
+describe('authHeadHtml', () => {
+    it('makes the logo a keyboard-reachable way out only on a cover page', () => {
+        const page = openAuthFlow({ page: true });
+        const $page_head = $(authHeadHtml(page, 'Log in'));
+        expect($page_head.find('a.auth-logo-link').attr('href')).toBe('/');
+        expect($page_head.find('.auth-logo').attr('alt')).toBe('Puter');
+        page.finish(false);
+
+        const dialog = openAuthFlow();
+        const $dialog_head = $(authHeadHtml(dialog, 'Log in'));
+        expect($dialog_head.find('a')).toHaveLength(0);
+        expect($dialog_head.find('.auth-logo').attr('alt')).toBe('');
+    });
+
+    it('explains the opener in a sign-in popup unless told not to', () => {
+        window.embedded_in_popup = true;
+        window.openerOrigin = 'https://builder.puter.com';
+        const flow = openAuthFlow();
+        const $notice = $(authHeadHtml(flow, 'Log in')).find('.auth-opener-notice');
+        expect($notice).toHaveLength(1);
+        expect($notice.text()).toContain('builder.puter.com');
+        expect($(authHeadHtml(flow, 'Log in', { openerNotice: false })).find('.auth-opener-notice')).toHaveLength(0);
+    });
+});
+
+describe('authFlowOptions', () => {
+    it('defaults to reloading on success, to the page the flow started on', () => {
+        const options = authFlowOptions();
+        expect(options.reload_on_success).toBe(true);
+        expect(options.redirect_url).toBe(window.location.href);
+        expect(options.show_signup_button).toBe(true);
+        expect(options.send_confirmation_code).toBe(false);
+    });
+
+    it('keeps an explicit empty redirect', () => {
+        expect(authFlowOptions({ redirect_url: '' }).redirect_url).toBe('');
+    });
+});
+
+describe('navigateAfterSignIn', () => {
+    const withLocation = (href, run) => {
+        const original = window.location;
+        const replace = vi.fn();
+        const reload = vi.fn();
+        delete window.location;
+        window.location = { href, replace, reload };
+        const spy = vi.spyOn(history, 'replaceState').mockImplementation(() => {});
+        let states;
+        try {
+            run();
+        } finally {
+            window.location = original;
+            states = spy.mock.calls.map((call) => call[2]);
+            spy.mockRestore();
+        }
+        return { replace, reload, states };
+    };
+
+    it('goes to another page by replacing this one', () => {
+        const { replace, reload } = withLocation('https://puter.test/action/login', () => {
+            navigateAfterSignIn('/');
+        });
+        expect(replace).toHaveBeenCalledWith('/');
+        expect(reload).not.toHaveBeenCalled();
+    });
+
+    // Replacing with a hash-only change would scroll, never reload.
+    it('reloads when only the hash would change, as on a dashboard tab', () => {
+        const { replace, reload, states } = withLocation('https://puter.test/#files', () => {
+            navigateAfterSignIn('https://puter.test/#files');
+        });
+        expect(replace).not.toHaveBeenCalled();
+        expect(reload).toHaveBeenCalledOnce();
+        expect(states).toEqual(['https://puter.test/#files']);
+    });
+});

src/gui/src/UI/Auth/authProviders.js

@@ -0,0 +1,148 @@
+/*
+ * Copyright (C) 2024-present Puter Technologies Inc.
+ *
+ * This file is part of Puter.
+ *
+ * Puter is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published
+ * by the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <https://www.gnu.org/licenses/>.
+ */
+
+// The "Sign in with Google" (and other identity provider) buttons of the
+// login and signup screens. A button navigates to the backend's OIDC start
+// route, which comes back to the page the flow started from.
+
+import { get_oidc_return_to } from '../../helpers/authRedirect.js';
+import { KNOWN_OIDC_PROVIDERS, OIDC_GENERIC_PROVIDER_ICON, humanizeOidcProviderId } from '../../util/openid.js';
+import { offersFederatedSignInInPopup } from '../../util/popupAuth.js';
+
+const GOOGLE_ICON = '<img alt="" src="data:image/webp;base64,UklGRu4GAABXRUJQVlA4WAoAAAAQAAAAXwAAXwAAQUxQSAUDAAABoATJtmnbGs+23+vZtm3btm3btnHxjG/btm3bnI197tljzjXjtSNiAnAjmbNs8x5DR40e2qtFhTzuVJ2e+rrE/ODKwsZe5J90n9CfXVw6vLEvifIH87OHVOK0mLxSLpSyd4vZhyuGkP+amL45j7lVYn6+rQpfSYDvFzO0QgIdYeZJCTbNRpnfJeDXLTSQsH/X6yiBj1TrIoEPgnZzCXwwtMtL4AOhnfP/wPpC/X0Jux/Uj4jySzsGVskJADkq9dn4JKEP1NuJ6gMDELvrrTF6QP9fjX0FQc2xLZme0E8Tfko20LOmZdAD+tWF/lVlqNb7I9IFBt+hpUD9CZGuMNhT2ONh8GJvWPyK1QZedhdyS7j5Bqkf3Kwo3A3w8yTneTgq3NyOdOZMhqPplM/h6Z+Urp6UF+ZX8HQGZZIrVylw9SvGnRqP33ev2QdSEwlzpIaYTlCOUtSLQpGujN/hRePIFMZDbgyOrGUcdGNe5CBjoRtbIimMMW4ciVxgDHQjxb0LkRTGGF8OMha6kRZZyzjkxrHIFMbDbmyPdGX84cbiSDmGFPNiZASU0V60SvAV4y4vyiS4yhCNSuXZxb5lIOEMyngFRSF+nqg85YsAOjNuSoQ/GdLJXhpjfgbplE/tCbN2Bp0pMtHaBAoy5khOY78yHkjiJOdZW3OEOSmJihxZaymPUPMlgTc40sfQy5RnkWx3kjQ3c0ioI5LClyRpZWSRcJF8T5aMNbFKuHti4B2WnDVwUcj541SnyVeVlCp/KeQ0xE6jiZzNppD1jNDzxcO/PJG9BUhF9gl/B4jtNEQeGBAv55gnRfFfUI+oiMhLOwZWyRnJXKbltLOfim4nDt5XMn0N5Jz/e/Eb6OW9KMtDcx8GQrOLB6ug2zG8fdBuENoB6Jf5PaiVMPlkQP1hdEUov5aH2QpfBXETTK+y91dnGM9/zdh2BFj2bkNn8iHMEqeN7MiJgMe+pPZwP4Sef9J9vL8vD8oMH6tOT309zo+P7BlcAs7mLNu8x9BRY4b1aVO9MG4cAQBWUDggwgMAABAVAJ0BKmAAYAA+bSyTRqQiIaEtVEyQgA2JbAC++hZa3jl94/Jj2rrA/Tvv9y7x+OzH+L5o/8p7APMA/TPpD+YD+bf4T9bPfW/mfqo/wHqAf0v/hdYB6AH7Aemp+5HwS/uN+6XtXdQB1N/Rj+m/RWYp6GESYsQNCm+TZ3BvtEgBK+isF38GQzHNMrw+tkbAm5lUM4rWqU9srOS+RuAUa8nFYoFrGH73Fzd++s+LPyEGAAD+Yg+gQRuJCapqteWj86DdkHmfHdS+mWVn7Ue8RiK5AaWCIe7RXaDKn0baNe80expR5tTBclgnd+SEzNZ6N3NL1suPhGwRqKzB5wNnWUXD7R0IkT5uIwUhTsO/1ucVEMKvTZRe4j7WwrA+e53P8J1/cdIvKtrtZv9AH5u1heZ1dGQELuxMxbQUnrw6IUh0YLBKEjNnR3JIsFNwkC+WLw4wkCMati73lcMjT6U2KIYsr0g5bPzSmo3ir9qRjtIqthpPIvuvYt8AbMewSj96NIqTM14M6ABtOaY87d8HOU7baFGGQjU1f8vf7SV5AjDrfW0VVzQcBez+PYiPApyQUAozEmZFKBDvX9ifFFacoulG9NCPDXa1mRPVwzrKuN3VfwUfv8Bx8QJ88prsOCDd8UvNDnUzbRqBXOmQ4co+/xYy/iQV89GHs4pb0D2LYwv6aY8yPLCrYyAPUe4dKEh/FBqRBJ/716CJVMTCrvB+gSgPwNjN5LlnNQqkBsHnSqdUFddjvBKNdm6zm8ggLFJl14S37sJW1fAEbiB0IqxcqlJOWol+ecJy9xdESchmlROmo/4/9V34VN2cw8NUB5POPUNzivyMFfgF27QTFXgya/LF3OsfHMF6Itejgy4ab38VPFjez5f8Z/b/dhYV21SflE4KtUj8LZDrQXRp+Pzdf/gWfvm2oLh0x+Fr+ggo2jjG3DFn95Wj1P3ra1RtzYE8ffXBeR2lDhL+GPJiiZaVinGMkjVYup0AghAhIfVgFtsL8lhMyJY84ccksHz92o1/J3NfrGSM8NwOv7ieeBjq2eqCOmrUHpG3mlr8Hj/fR4d+orLlpipLTh3+cRY7suXQXw9SPYZieoKS/JE9y0f+BcWCzdNshWl2oVpeK2qm36iFltfGZUvXdfBKufE9RkZcyOBDUVeONlBchjuaLPNd6fSlk41Pp57nF5MmES2Kl7HqY+f2pvS71eIgUXpqtAFIY94JSmNre+g49tL8VnZlJNqgVhj/De//5zH/84h//5uJfunlawY99GgDkm8cYFbIAAAA">';
+const MICROSOFT_ICON = '<svg aria-hidden="true" viewBox="0 0 23 23" fill="none"><rect x="1" y="1" width="10" height="10" fill="#f25022"/><rect x="12" y="1" width="10" height="10" fill="#7fba00"/><rect x="1" y="12" width="10" height="10" fill="#00a4ef"/><rect x="12" y="12" width="10" height="10" fill="#ffb900"/></svg>';
+const APPLE_ICON = '<svg aria-hidden="true" viewBox="0 0 384 512" fill="currentColor"><path d="M318.7 268.7c-.2-36.7 16.4-64.4 50-84.8-18.8-26.9-47.2-41.7-84.7-44.6-35.5-2.8-74.3 20.7-88.5 20.7-15 0-49.4-19.7-76.4-19.7C63.3 141.2 4 184.8 4 273.5q0 39.3 14.4 81.2c12.8 36.7 59 126.7 107.2 125.2 25.2-.6 43-17.9 75.8-17.9 31.8 0 48.3 17.9 76.4 17.9 48.6-.7 90.4-82.5 102.6-119.3-65.2-30.7-61.7-90-61.7-91.9zm-56.6-164.2c27.3-32.4 24.8-61.9 24-72.5-24.1 1.4-52 16.4-67.9 34.9-17.5 19.8-27.8 44.3-25.6 71.9 26.1 2 49.9-11.4 69.5-34.3z"/></svg>';
+
+const KNOWN = {
+    google: { icon: GOOGLE_ICON, login: 'sign_in_with_google', signup: 'sign_up_with_google' },
+    microsoft: { icon: MICROSOFT_ICON, login: 'sign_in_with_microsoft', signup: 'sign_up_with_microsoft' },
+    apple: { icon: APPLE_ICON, login: 'sign_in_with_apple', signup: 'sign_up_with_apple' },
+};
+
+// Shown in this order whatever order the server lists them in.
+const KNOWN_ORDER = ['google', 'microsoft', 'apple'];
+
+/**
+ * Whether this page may offer a federated sign-in at all. A federated hop
+ * navigates a popup away and the provider returns it as a plain sign-in
+ * popup, losing whatever the popup was opened to do (and, for a permission
+ * prompt, handing the opener a token instead of a decision). A
+ * cross-origin-isolated opener can only get the token through the session
+ * relay, which the provider's return doesn't keep.
+ *
+ * @returns {boolean}
+ */
+export const mayOfferProviders = () => ! (window.embedded_in_popup
+    && ( ! offersFederatedSignInInPopup(window.gui_action)
+        || window.url_query_params?.get('cross_origin_isolated') === 'true'));
+
+/**
+ * The URL that starts a provider's sign-in.
+ *
+ * @param {string} provider
+ * @param {'login'|'signup'} kind
+ * @param {string | undefined} referrer
+ * @returns {string}
+ */
+export const providerStartUrl = (provider, kind, referrer) => {
+    let url = `${window.gui_origin}/auth/oidc/${encodeURIComponent(provider)}/start?flow=${kind}`;
+    // Return to the interface the flow started from (the backend whitelists the path).
+    const return_to = get_oidc_return_to();
+    if ( return_to ) url += `&return_to=${encodeURIComponent(return_to)}`;
+    if ( referrer ) url += `&referrer=${encodeURIComponent(referrer)}`;
+    // A provider sign-in can create the account, so a signup link's code rides along.
+    if ( window.signup_bonus_code ) url += `&bonusCode=${encodeURIComponent(window.signup_bonus_code)}`;
+    if ( window.embedded_in_popup && window.url_query_params?.get('msg_id') ) {
+        url += `&embedded_in_popup=true&msg_id=${encodeURIComponent(window.url_query_params.get('msg_id'))}`;
+        if ( window.openerOrigin ) url += `&opener_origin=${encodeURIComponent(window.openerOrigin)}`;
+    }
+    return url;
+};
+
+/** @type {WeakMap<import('./authFlow.js').AuthFlow, Promise<{ providers?: string[], signupOidcOnly?: boolean } | null>>} */
+const lookups = new WeakMap();
+
+/**
+ * The configured providers, looked up once per auth flow so moving between
+ * its screens draws them straight away instead of after another round trip.
+ *
+ * @param {import('./authFlow.js').AuthFlow} flow
+ */
+const lookUpProviders = (flow) => {
+    let lookup = lookups.get(flow);
+    if ( ! lookup ) {
+        lookup = (async () => {
+            try {
+                const res = await fetch(`${window.api_origin}/auth/oidc/providers`);
+                return res.ok ? await res.json() : null;
+            } catch {
+                return null;
+            }
+        })();
+        lookups.set(flow, lookup);
+    }
+    return lookup;
+};
+
+/**
+ * Fills `$list` with a button for each configured provider. A self-hosted
+ * instance's own provider gets a generic button.
+ *
+ * @param {jQuery} $list Where the buttons go.
+ * @param {object} opts
+ * @param {'login'|'signup'} opts.kind
+ * @param {() => string | undefined} opts.referrer Read when a button is pressed.
+ * @param {import('./authFlow.js').AuthFlow} opts.flow The flow showing `$list`.
+ * @returns {Promise<{ providers: string[], signupOidcOnly: boolean } | null>}
+ *   Null when none are offered here or the lookup failed.
+ */
+export async function renderProviderButtons ($list, { kind, referrer, flow }) {
+    if ( ! mayOfferProviders() ) return null;
+    const data = await lookUpProviders(flow);
+    if ( ! Array.isArray(data?.providers) || ! data.providers.length ) return null;
+
+    const ordered = [
+        ...KNOWN_ORDER.filter((provider) => data.providers.includes(provider)),
+        ...data.providers.filter((provider) => ! KNOWN_OIDC_PROVIDERS.includes(provider)),
+    ];
+    let h = '';
+    for ( const provider of ordered ) {
+        const known = KNOWN[provider];
+        const label = known
+            ? i18n(known[kind])
+            : i18n(kind === 'login' ? 'sign_in_with_provider' : 'sign_up_with_provider', [humanizeOidcProviderId(provider)]);
+        const icon = known ? known.icon : OIDC_GENERIC_PROVIDER_ICON;
+        h += `<button type="button" class="dashboard-dialog-btn auth-provider-btn oidc-${known ? provider : 'custom'}-btn" data-provider="${html_encode(provider)}">`;
+        h += `<span class="auth-provider-icon" aria-hidden="true">${icon}</span><span>${label}</span>`;
+        h += '</button>';
+    }
+    $list.html(h);
+    $list.on('click', '.auth-provider-btn', function () {
+        const url = providerStartUrl($(this).attr('data-provider'), kind, referrer());
+        // A provider won't load in a frame, so the framing page opens this
+        // in a popup instead. `unavailable` covers an SDK that can't.
+        if ( window.embedded_in_frame ) {
+            window.tell_popup_frame('provider', { url });
+            window.tell_popup_frame('unavailable');
+            return;
+        }
+        window.location.href = url;
+    });
+    return { providers: ordered, signupOidcOnly: data.signupOidcOnly === true };
+}

src/gui/src/UI/Auth/authTestSetup.js

@@ -0,0 +1,66 @@
+/*
+ * Copyright (C) 2024-present Puter Technologies Inc.
+ *
+ * This file is part of Puter.
+ *
+ * Puter is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published
+ * by the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <https://www.gnu.org/licenses/>.
+ */
+
+// Shared jsdom setup for the auth dialog tests: the globals the GUI
+// installs at boot, reset between tests.
+
+import { vi } from 'vitest';
+import jQuery from '../../lib/jquery-3.6.1/jquery-3.6.1.min.js';
+
+globalThis.def = globalThis.def ?? ((value) => value);
+globalThis.$ = jQuery;
+globalThis.jQuery = jQuery;
+globalThis.i18n = (key, args) => (Array.isArray(args) && args.length ? `${key}:${args.join(',')}` : key);
+globalThis.html_encode = (value) => String(value ?? '')
+    .replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;').replace(/"/g, '&quot;');
+window.html_encode = globalThis.html_encode;
+window.requestAnimationFrame = (fn) => setTimeout(fn, 0);
+window.matchMedia = () => ({ matches: false });
+
+export const tick = () => new Promise((resolve) => setTimeout(resolve, 0));
+
+/** A JSON fetch response. */
+export const reply = (status, data) => new Response(JSON.stringify(data), { status });
+
+/** Resets the boot globals the screens read. */
+export const resetAuthGlobals = () => {
+    document.body.innerHTML = '';
+    window.gui_origin = 'https://puter.test';
+    window.api_origin = 'https://api.puter.test';
+    window.app_domain = 'puter.com';
+    window.gui_params = {};
+    window.icons = {};
+    window.uuidv4 = () => `id-${Math.random().toString(36).slice(2)}`;
+    window.is_email = (value) => String(value).includes('@');
+    window.embedded_in_popup = false;
+    window.gui_action = undefined;
+    window.openerOrigin = undefined;
+    window.referrerStr = undefined;
+    window.signup_bonus_code = null;
+    window.url_query_params = new URLSearchParams('');
+    window.custom_headers = undefined;
+    window.turnstile = undefined;
+    window.logged_in_users = [];
+    window.auth_token = undefined;
+    window.update_auth_data = vi.fn(async () => {});
+    globalThis.fetch = vi.fn(async () => reply(200, { providers: [] }));
+};
+
+/** The screen showing in the auth card. */
+export const screen = () => $('.auth-dialog .auth-screen:not([hidden])');

src/gui/src/UI/Dashboard/AppBrowser.browser.test.js

@@ -16,6 +16,8 @@ const requests = [];
 const guiRoot = fileURLToPath(new URL('../../../', import.meta.url));
 const sessionToken = 'app-browser-test-session';
 const sessionCookie = 'app-browser-test-cookie';
+const sessionUser = '0b1c9a52-3f0e-4c7a-9a65-2f6d1e8b7c40';
+const otherUser = '7d2e4f10-8a3b-4c5d-9e6f-0a1b2c3d4e5f';
 const appRows = Array.from({ length: 105 }, (_, i) => ({
     name: `app-${i}`, title: `App ${i}`, icon: null,
 }));
@@ -62,6 +64,25 @@ beforeAll(async () => {
         if ( ! req.headers.cookie?.includes(`puter_auth_token=${sessionCookie}`) ) return res.sendStatus(401);
         res.json({ token: sessionToken });
     });
+    // The GUI session's token and the tokens of apps signed in on a sibling subdomain.
+    const whoamiByToken = {
+        [sessionToken]: { uuid: sessionUser, username: 'session-user' },
+        'app-token-session-user': { uuid: sessionUser, username: 'session-user' },
+        'app-token-other-user': { uuid: otherUser, username: 'other-user' },
+    };
+    // The SDK on a sibling subdomain sends credentialed cross-origin requests.
+    app.use(['/whoami', '/profile', '/rao'], (req, res, next) => {
+        if ( req.headers.origin ) res.set('Access-Control-Allow-Origin', req.headers.origin);
+        res.set('Access-Control-Allow-Credentials', 'true');
+        res.set('Access-Control-Allow-Headers', 'Authorization, Content-Type');
+        if ( req.method === 'OPTIONS' ) return res.sendStatus(204);
+        next();
+    });
+    app.get('/whoami', (req, res) => {
+        const user = whoamiByToken[req.headers.authorization?.replace(/^Bearer /, '')];
+        if ( ! user ) return res.sendStatus(401);
+        res.json(user);
+    });
     app.get('/get-launch-apps', (_req, res) => res.json({ recommended: [{ name: 'removed', title: 'Removed' }] }));
     app.get('/cache/last-change-timestamp', (_req, res) => res.json({ timestamp: 0 }));
     app.post('/drivers/call', (req, res) => {
@@ -81,9 +102,15 @@ beforeAll(async () => {
     app.get('/index', (_req, res) => res.send(`<title>App</title>
         <script>window.PUTER_ORIGIN = '${origin}'; window.PUTER_API_ORIGIN = '${origin}';</script>
         <script src="/sdk.js"></script>`));
-    app.get('/host', (_req, res) => res.send(`<!DOCTYPE html><html><body style="margin:0">
-        <iframe title="More apps" src="${origin}/embed/apps" style="border:0;width:100vw;height:100vh"></iframe>
+    // The host page names its signed-in user as `?user=`, as puter.js does in the fragment.
+    app.get('/host', (req, res) => res.send(`<!DOCTYPE html><html><body style="margin:0">
+        <iframe title="More apps" src="${origin}/embed/apps${req.query.user ? `#user=${req.query.user}` : ''}" style="border:0;width:100vw;height:100vh"></iframe>
     </body></html>`));
+    // An app on a sibling subdomain, signed in with puter.js, with the SDK's user menu.
+    app.get('/menu-host', (_req, res) => res.send(`<!DOCTYPE html><html><head>
+        <script>window.PUTER_ORIGIN = '${origin}'; window.PUTER_API_ORIGIN = '${origin}';</script>
+        <script src="${origin}/sdk.js"></script></head>
+        <body><header><puter-user-menu></puter-user-menu></header></body></html>`));
     app.get('/embed/apps', (_req, res) => {
         res.setHeader('Content-Security-Policy', `frame-ancestors 'self' http://*.puter.localhost:${port}`);
         res.send(`<!DOCTYPE html><html><head><meta name="viewport" content="width=device-width, initial-scale=1">
@@ -122,7 +149,7 @@ describe('embedded app browser', () => {
             page.on('pageerror', error => errors.push(error.message));
             requests.length = 0;
             try {
-                const parentUrl = `http://spreadsheet.puter.localhost:${port}/host`;
+                const parentUrl = `http://spreadsheet.puter.localhost:${port}/host?user=${sessionUser}`;
                 await page.goto(parentUrl);
                 const frame = page.frameLocator('iframe');
                 await frame.locator('.myapps-group-tile').waitFor();
@@ -182,7 +209,7 @@ describe('embedded app browser', () => {
         try {
             const page = await context.newPage();
             page.setDefaultTimeout(6000);
-            await page.goto(`http://spreadsheet.puter.localhost:${port}/host`);
+            await page.goto(`http://spreadsheet.puter.localhost:${port}/host?user=${sessionUser}`);
             const frame = page.frameLocator('iframe');
             await frame.locator('.myapps-group-tile').waitFor();
             expect(await frame.locator('[data-app-name="app-104"]').count()).toBe(1);
@@ -200,7 +227,7 @@ describe('embedded app browser', () => {
         try {
             const page = await context.newPage();
             page.setDefaultTimeout(6000);
-            await page.goto(`${origin}/embed/apps`);
+            await page.goto(`${origin}/embed/apps#user=${sessionUser}`);
             await page.locator('.myapps-search').fill('App 104');
             const popupPromise = context.waitForEvent('page');
             await page.locator('.myapps-tile').click();
@@ -275,7 +302,7 @@ describe('embedded app browser', () => {
             });
             const page = await context.newPage();
             page.setDefaultTimeout(6000);
-            await page.goto(`${origin}/embed/apps`);
+            await page.goto(`${origin}/embed/apps#user=${sessionUser}`);
             await page.locator('[data-app-name="notes"]').waitFor();
         } finally {
             guestApps = [];
@@ -290,7 +317,7 @@ describe('embedded app browser', () => {
             const page = await context.newPage();
             page.setDefaultTimeout(6000);
             await page.route('**/get-gui-token', route => route.fulfill({ status }));
-            await page.goto(`${origin}/embed/apps`);
+            await page.goto(`${origin}/embed/apps#user=${sessionUser}`);
             await page.getByRole('status').waitFor();
             expect(await page.getByRole('status').textContent()).toContain('Apps are unavailable');
             expect(await page.locator('.myapps-tile').count()).toBe(0);
@@ -300,6 +327,351 @@ describe('embedded app browser', () => {
         }
     });
 
+    describe('only shows the session to the host\'s own user', () => {
+        const notes = () => ({ name: 'notes', title: 'Notes', uuid: 'uid-notes', index_url: `http://notes.puter.localhost:${port}/index`, icon: null });
+        const signedInContext = () => browser.newContext({ storageState: {
+            cookies: [], origins: [{ origin, localStorage: [{ name: 'auth_token_v2', value: sessionToken }] }],
+        } });
+
+        it.each([
+            ['names no user', ''],
+            ['names another user', `?user=${otherUser}`],
+            ['names a malformed user', '?user=session-user'],
+        ])('shows the signed-out list when the host %s', async (_label, query) => {
+            guestApps = [notes()];
+            const context = await signedInContext();
+            requests.length = 0;
+            try {
+                const page = await context.newPage();
+                page.setDefaultTimeout(6000);
+                await page.goto(`http://spreadsheet.puter.localhost:${port}/host${query}`);
+                const frame = page.frameLocator('iframe');
+                await frame.locator('[data-app-name="notes"]').waitFor();
+                expect(await frame.locator('.myapps-tile').count()).toBe(1);
+                expect(requests.some(req => ['/sdk.js', '/installedApps', '/drivers/call'].includes(req.path))).toBe(false);
+
+                const popupPromise = context.waitForEvent('page');
+                await frame.locator('[data-app-name="notes"]').click();
+                const popup = await popupPromise;
+                await popup.waitForURL(/\/index\?/);
+                expect(await popup.evaluate(() => window.opener)).toBeNull();
+                expect(requests.some(req => ['/auth/get-user-app-token', '/rao'].includes(req.path))).toBe(false);
+            } finally {
+                guestApps = [];
+                await context.close();
+            }
+        });
+
+        it('shows the signed-out list when the API refuses the stored session', async () => {
+            guestApps = [notes()];
+            const context = await browser.newContext({ storageState: {
+                cookies: [], origins: [{ origin, localStorage: [{ name: 'auth_token_v2', value: 'revoked-session' }] }],
+            } });
+            try {
+                const page = await context.newPage();
+                page.setDefaultTimeout(6000);
+                await page.goto(`${origin}/embed/apps#user=${sessionUser}`);
+                await page.locator('[data-app-name="notes"]').waitFor();
+                expect(await page.locator('.myapps-tile').count()).toBe(1);
+            } finally {
+                guestApps = [];
+                await context.close();
+            }
+        });
+
+        it('shows a spinner while it checks the session', async () => {
+            const context = await signedInContext();
+            let respond;
+            try {
+                const page = await context.newPage();
+                page.setDefaultTimeout(6000);
+                await page.route('**/whoami', route => { respond = () => route.continue(); });
+                await page.goto(`${origin}/embed/apps#user=${sessionUser}`);
+                await expect.poll(() => typeof respond).toBe('function');
+                const spinner = () => page.locator('#app-browser').evaluate(root => getComputedStyle(root, '::after').animationName);
+                expect(await spinner()).not.toBe('none');
+                await respond();
+                await page.locator('[data-app-name="app-104"]').waitFor();
+                expect(await spinner()).toBe('none');
+            } finally {
+                await context.close();
+            }
+        });
+
+        it('shows an unavailable state when the session check fails', async () => {
+            guestApps = [notes()];
+            const context = await signedInContext();
+            try {
+                const page = await context.newPage();
+                page.setDefaultTimeout(6000);
+                await page.route('**/whoami', route => route.fulfill({ status: 503 }));
+                await page.goto(`${origin}/embed/apps#user=${sessionUser}`);
+                await page.getByRole('status').waitFor();
+                expect(await page.getByRole('status').textContent()).toContain('Apps are unavailable');
+                expect(await page.locator('.myapps-tile').count()).toBe(0);
+            } finally {
+                guestApps = [];
+                await context.close();
+            }
+        });
+
+        it('reloads for the user a changed fragment names', async () => {
+            guestApps = [notes()];
+            const context = await signedInContext();
+            try {
+                const page = await context.newPage();
+                page.setDefaultTimeout(6000);
+                await page.goto(`${origin}/embed/apps#user=${sessionUser}`);
+                await page.locator('[data-app-name="app-104"]').waitFor();
+                await page.evaluate(user => { window.location.hash = `user=${user}`; }, otherUser);
+                await page.locator('[data-app-name="notes"]').waitFor();
+                expect(await page.locator('[data-app-name="app-104"]').count()).toBe(0);
+            } finally {
+                guestApps = [];
+                await context.close();
+            }
+        });
+    });
+
+    describe('opened from the SDK\'s user menu', () => {
+        const menuContext = async (appToken, options = {}) => {
+            guestApps = [{ name: 'notes', title: 'Notes', uuid: 'uid-notes', index_url: `http://notes.puter.localhost:${port}/index`, icon: null }];
+            const host = `http://spreadsheet.puter.localhost:${port}`;
+            return browser.newContext({ ...options, storageState: {
+                cookies: [],
+                origins: [
+                    { origin, localStorage: [{ name: 'auth_token_v2', value: sessionToken }] },
+                    { origin: host, localStorage: appToken ? [
+                        { name: 'puter.auth.token.v2', value: appToken },
+                        { name: 'puter.auth.token.origin.v2', value: origin },
+                    ] : [] },
+                ],
+            } });
+        };
+
+        it('shows the user\'s apps to the same user and the signed-out list once the app signs out', async () => {
+            const context = await menuContext('app-token-session-user');
+            try {
+                const page = await context.newPage();
+                page.setDefaultTimeout(6000);
+                const errors = [];
+                page.on('pageerror', error => errors.push(error.message));
+                await page.goto(`http://spreadsheet.puter.localhost:${port}/menu-host`);
+                await page.locator('puter-user-menu .avatar').waitFor();
+                expect(await page.locator('puter-user-menu .avatar').textContent()).toBe('S');
+
+                await page.locator('puter-user-menu .apps-button').click();
+                const iframe = page.locator('puter-user-menu iframe');
+                expect(await iframe.getAttribute('src')).toBe(`${origin}/embed/apps#user=${sessionUser}`);
+                await page.frameLocator('puter-user-menu iframe').locator('[data-app-name="app-104"]').waitFor();
+
+                // The panel hangs under its button, inside the viewport.
+                const button = await page.locator('puter-user-menu .apps-button').boundingBox();
+                const panel = await page.locator('puter-user-menu .apps-panel').boundingBox();
+                const viewport = page.viewportSize();
+                expect(panel.y).toBeGreaterThan(button.y + button.height);
+                expect(panel.x).toBeGreaterThanOrEqual(0);
+                expect(panel.x + panel.width).toBeLessThanOrEqual(viewport.width);
+
+                // Closing keeps the embed, so reopening shows the same page.
+                const embed = page.frames().find(frame => frame.url().startsWith(`${origin}/embed/apps`));
+                await embed.evaluate(() => { window.keptAcrossOpens = true; });
+                await page.locator('puter-user-menu .apps-close').click();
+                await page.locator('puter-user-menu .apps-panel').waitFor({ state: 'hidden' });
+                await page.locator('puter-user-menu .apps-button').click();
+                expect(await embed.evaluate(() => window.keptAcrossOpens)).toBe(true);
+
+                await page.evaluate(() => puter.auth.signOut());
+                await iframe.waitFor({ state: 'detached' });
+                await page.locator('puter-user-menu .sign-in').waitFor();
+                await page.locator('puter-user-menu .apps-button').click();
+                expect(await iframe.getAttribute('src')).toBe(`${origin}/embed/apps`);
+                const frame = page.frameLocator('puter-user-menu iframe');
+                await frame.locator('[data-app-name="notes"]').waitFor();
+                expect(await frame.locator('[data-app-name="app-104"]').count()).toBe(0);
+                expect(errors).toEqual([]);
+            } finally {
+                guestApps = [];
+                await context.close();
+            }
+        });
+
+        it('shows the signed-out list to an app signed in as another user', async () => {
+            const context = await menuContext('app-token-other-user');
+            try {
+                const page = await context.newPage();
+                page.setDefaultTimeout(6000);
+                await page.goto(`http://spreadsheet.puter.localhost:${port}/menu-host`);
+                await page.locator('puter-user-menu .avatar').waitFor();
+                await page.locator('puter-user-menu .apps-button').click();
+                const frame = page.frameLocator('puter-user-menu iframe');
+                await frame.locator('[data-app-name="notes"]').waitFor();
+                expect(await frame.locator('[data-app-name="app-104"]').count()).toBe(0);
+            } finally {
+                guestApps = [];
+                await context.close();
+            }
+        });
+
+        it('closes the account menu when Tab leaves it', async () => {
+            const context = await menuContext('app-token-session-user');
+            try {
+                const page = await context.newPage();
+                page.setDefaultTimeout(6000);
+                await page.goto(`http://spreadsheet.puter.localhost:${port}/menu-host`);
+                await page.evaluate(() => document.body.insertAdjacentHTML('beforeend', '<button id="after">After</button>'));
+                const menu = page.locator('puter-user-menu .menu');
+                await page.locator('puter-user-menu .avatar').click();
+                await menu.waitFor();
+                await page.keyboard.press('Tab');
+                await menu.waitFor({ state: 'hidden' });
+                expect(await page.evaluate(() => document.activeElement.id)).toBe('after');
+
+                await page.locator('puter-user-menu .avatar').click();
+                await menu.waitFor();
+                await page.keyboard.press('Shift+Tab');
+                await menu.waitFor({ state: 'hidden' });
+                expect(await page.evaluate(() => document.activeElement.shadowRoot?.activeElement?.className)).toBe('apps-button');
+            } finally {
+                guestApps = [];
+                await context.close();
+            }
+        });
+
+        it('moves focus to Sign in after signing out from the keyboard', async () => {
+            const context = await menuContext('app-token-session-user');
+            try {
+                const page = await context.newPage();
+                page.setDefaultTimeout(6000);
+                await page.goto(`http://spreadsheet.puter.localhost:${port}/menu-host`);
+                await page.locator('puter-user-menu .avatar').focus();
+                await page.keyboard.press('Enter');
+                await page.locator('puter-user-menu .menu').waitFor();
+                await page.keyboard.press('Enter');
+                await page.locator('puter-user-menu .sign-in').waitFor();
+                await expect.poll(() => page.evaluate(() => document.activeElement.shadowRoot?.activeElement?.className)).toBe('sign-in');
+            } finally {
+                guestApps = [];
+                await context.close();
+            }
+        });
+
+        it('shows the app browser in a theme the page forces', async () => {
+            const context = await menuContext('app-token-session-user');
+            try {
+                const page = await context.newPage();
+                page.setDefaultTimeout(6000);
+                await page.emulateMedia({ colorScheme: 'light' });
+                await page.goto(`http://spreadsheet.puter.localhost:${port}/menu-host`);
+                const menu = page.locator('puter-user-menu');
+                await menu.evaluate(el => el.setAttribute('theme', 'dark'));
+                await page.locator('puter-user-menu .apps-button').click();
+                const frame = page.frameLocator('puter-user-menu iframe');
+                await frame.locator('[data-app-name="app-104"]').waitFor();
+                const background = () => frame.locator('body').evaluate(body => getComputedStyle(body).backgroundColor);
+                expect(await background()).toBe('rgb(30, 30, 30)');
+
+                await menu.evaluate(el => el.setAttribute('theme', 'light'));
+                await expect.poll(background).toBe('rgb(255, 255, 255)');
+                await frame.locator('[data-app-name="app-104"]').waitFor();
+                expect(await page.locator('puter-user-menu .apps-panel').isVisible()).toBe(true);
+            } finally {
+                guestApps = [];
+                await context.close();
+            }
+        });
+
+        it('leaves no hover shading on the Apps button once a tap closes it', async () => {
+            const context = await menuContext('app-token-session-user', {
+                viewport: { width: 390, height: 700 }, hasTouch: true, isMobile: true,
+            });
+            try {
+                const page = await context.newPage();
+                page.setDefaultTimeout(6000);
+                await page.goto(`http://spreadsheet.puter.localhost:${port}/menu-host`);
+                const button = page.locator('puter-user-menu .apps-button');
+                await button.tap();
+                await page.locator('puter-user-menu .apps-panel').waitFor();
+                await button.tap();
+                await page.locator('puter-user-menu .apps-panel').waitFor({ state: 'hidden' });
+                expect(await button.evaluate(el => getComputedStyle(el).backgroundColor)).toBe('rgba(0, 0, 0, 0)');
+            } finally {
+                guestApps = [];
+                await context.close();
+            }
+        });
+
+        it('shows Sign in pressed and the account hovered', async () => {
+            const context = await menuContext(null);
+            try {
+                const page = await context.newPage();
+                page.setDefaultTimeout(6000);
+                await page.goto(`http://spreadsheet.puter.localhost:${port}/menu-host`);
+                const signIn = page.locator('puter-user-menu .sign-in');
+                await signIn.hover();
+                await page.mouse.down();
+                expect(await signIn.evaluate(el => getComputedStyle(el).color)).toBe('rgb(190, 222, 245)');
+                await page.mouse.move(0, 0);
+                await page.mouse.up();
+
+                await page.evaluate(() => puter.setAuthToken('app-token-session-user'));
+                const avatar = page.locator('puter-user-menu .avatar');
+                await avatar.waitFor();
+                expect(await avatar.evaluate(el => getComputedStyle(el).boxShadow)).toBe('none');
+                await avatar.hover();
+                expect(await avatar.evaluate(el => getComputedStyle(el).boxShadow)).not.toBe('none');
+            } finally {
+                guestApps = [];
+                await context.close();
+            }
+        });
+
+        it('shows the account before its picture arrives', async () => {
+            const context = await menuContext('app-token-session-user');
+            let respond;
+            try {
+                const page = await context.newPage();
+                page.setDefaultTimeout(6000);
+                await page.route('**/profile', route => { respond = () => route.fulfill({
+                    status: 200,
+                    headers: { 'Access-Control-Allow-Origin': `http://spreadsheet.puter.localhost:${port}`, 'Access-Control-Allow-Credentials': 'true' },
+                    contentType: 'application/json',
+                    body: JSON.stringify({ picture: 'data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAADUlEQVR42mNk+M9QDwADhgGAWjR9awAAAABJRU5ErkJggg==' }),
+                }); });
+                await page.goto(`http://spreadsheet.puter.localhost:${port}/menu-host`);
+                await page.locator('puter-user-menu .avatar').waitFor({ timeout: 2000 });
+                expect(await page.locator('puter-user-menu .avatar').textContent()).toBe('S');
+                expect(await page.locator('puter-user-menu .apps-button').isVisible()).toBe(true);
+                await expect.poll(() => typeof respond).toBe('function');
+                await respond();
+                await page.locator('puter-user-menu .avatar img').waitFor();
+            } finally {
+                guestApps = [];
+                await context.close();
+            }
+        });
+
+        it('names the user an app signs in as after loading', async () => {
+            const context = await menuContext(null);
+            try {
+                const page = await context.newPage();
+                page.setDefaultTimeout(6000);
+                await page.goto(`http://spreadsheet.puter.localhost:${port}/menu-host`);
+                await page.locator('puter-user-menu .sign-in').waitFor();
+                // What `puter.auth.signIn()` does with the token its popup hands back.
+                await page.evaluate(() => puter.setAuthToken('app-token-session-user'));
+                await page.locator('puter-user-menu .avatar').waitFor();
+                await expect.poll(() => page.locator('puter-user-menu .avatar').textContent()).toBe('S');
+                await page.locator('puter-user-menu .apps-button').click();
+                expect(await page.locator('puter-user-menu iframe').getAttribute('src')).toBe(`${origin}/embed/apps#user=${sessionUser}`);
+                await page.frameLocator('puter-user-menu iframe').locator('[data-app-name="app-104"]').waitFor();
+            } finally {
+                guestApps = [];
+                await context.close();
+            }
+        });
+    });
+
     it('shows an unavailable state if the SDK cannot load', async () => {
         const context = await browser.newContext({ storageState: {
             cookies: [], origins: [{ origin, localStorage: [{ name: 'auth_token_v2', value: sessionToken }] }],
@@ -307,7 +679,7 @@ describe('embedded app browser', () => {
         try {
             const page = await context.newPage();
             await page.route('**/sdk.js', route => route.abort());
-            await page.goto(`${origin}/embed/apps`);
+            await page.goto(`${origin}/embed/apps#user=${sessionUser}`);
             await page.getByRole('status').waitFor();
             expect(await page.getByRole('status').textContent()).toContain('Apps are unavailable');
         } finally {

src/gui/src/UI/Dashboard/AppBrowser.js

@@ -383,7 +383,7 @@ export function createAppBrowser ({ editable = true, onLaunch, actions = {}, gue
     function trapModalTab ($overlay) {
         $overlay.on('keydown', function (e) {
             if ( e.key !== 'Tab' ) return;
-            const focusables = $overlay.find('button, textarea').toArray()
+            const focusables = $overlay.find('button, textarea, input:not([type="hidden"]), select, a[href]').toArray()
                 .filter(el => ! el.disabled && el.offsetParent !== null);
             if ( focusables.length === 0 ) return;
             const first = focusables[0];
@@ -456,6 +456,12 @@ export function createAppBrowser ({ editable = true, onLaunch, actions = {}, gue
             // restores its position if it comes back.
             const deleteData = $overlay.find('.myapps-modal-delete-data').is(':checked');
             const removedIndex = self._apps.findIndex(a => a.name === appName);
+            // Uninstalled from inside an open folder: where focus goes after.
+            const fromGroupId = $el_window.find('.myapps-group-panel-grid .myapps-tile').toArray()
+                .some(el => el.dataset.appName === appName) ? self._openGroupId : null;
+            const groupMates = fromGroupId
+                ? (findGroupById(self._groups, fromGroupId)?.apps ?? []).filter(name => name !== appName)
+                : [];
             const removedApp = removedIndex === -1 ? null : self._apps[removedIndex];
             // A running instance would be stranded: the tile is a headless
             // app's only switcher, so once it's gone a minimized window could
@@ -463,6 +469,9 @@ export function createAppBrowser ({ editable = true, onLaunch, actions = {}, gue
             // also consumes the app's URL entry if it owns one).
             $(`.window[data-app="${html_encode(appName)}"]`).close();
             self._invalidateInFlightLoads();
+            // Until the revoke lands the server still lists the app as
+            // installed, so loads started meanwhile leave it out themselves.
+            self._pendingUninstalls.add(appName);
             self._setAppRemoved(appName, true);
             close({ restoreFocus: false });
 
@@ -494,9 +503,19 @@ export function createAppBrowser ({ editable = true, onLaunch, actions = {}, gue
                 self.renderApps($el_window, { preservePage: true, instant: true });
                 // The confirm button left with the modal; keep a keyboard user on
                 // the grid, at the slot the app vacated.
-                if ( slot !== -1 && (! document.activeElement || document.activeElement === document.body) ) {
-                    const tiles = $el_window.find('.myapps-page .myapps-tile').toArray();
-                    tiles[Math.min(slot, tiles.length - 1)]?.focus({ preventScroll: true });
+                if ( ! document.activeElement || document.activeElement === document.body ) {
+                    if ( slot !== -1 ) {
+                        const tiles = $el_window.find('.myapps-page .myapps-tile').toArray();
+                        tiles[Math.min(slot, tiles.length - 1)]?.focus({ preventScroll: true });
+                    } else if ( fromGroupId ) {
+                        // The folder may still be open, closed, or dissolved
+                        // into the one app left in it.
+                        const target = $el_window.find('.myapps-group-panel-grid .myapps-tile')[0]
+                            ?? $el_window.find(`.myapps-group-tile[data-group-id="${CSS.escape(fromGroupId)}"]`)[0]
+                            ?? $el_window.find('.myapps-page .myapps-tile').toArray()
+                                .find(el => groupMates.includes(el.dataset.appName));
+                        target?.focus({ preventScroll: true });
+                    }
                 }
                 // FLIP the survivors from their old boxes into the new layout.
                 const moved = [];
@@ -546,6 +565,9 @@ export function createAppBrowser ({ editable = true, onLaunch, actions = {}, gue
             puter.perms.revokeApp(appUid, '*', { deleteData }).then(async (result) => {
                 // revokeApp resolves (never rejects) with `error` set on failure.
                 if ( result?.error ) throw result;
+                // Loads started before now may have read the app as installed.
+                self._invalidateInFlightLoads();
+                self._pendingUninstalls.delete(appName);
                 // Clearing the grants is only half of it. An app the user already
                 // opened holds a token that authenticates against a session row,
                 // and that row outlives the permission rows — so without this an
@@ -567,6 +589,7 @@ export function createAppBrowser ({ editable = true, onLaunch, actions = {}, gue
                 }
             }).catch(async err => {
                 console.error('Failed to uninstall app:', err);
+                self._pendingUninstalls.delete(appName);
                 await removalSettled;
                 self._invalidateInFlightLoads();
                 // The uninstall didn't happen — take the name back off the
@@ -693,6 +716,8 @@ export function createAppBrowser ({ editable = true, onLaunch, actions = {}, gue
         $overlay.on('click', '.myapps-add-back', () => showPane('options'));
         $(document).on('keydown.add-app-modal', function (e) {
             if ( e.key !== 'Escape' ) return;
+            // Escape while composing (CJK input) cancels the composition only.
+            if ( e.originalEvent?.isComposing || e.keyCode === 229 ) return;
             // Escape steps back out of the form before it closes the modal, so a
             // half-written request survives a mis-hit key.
             if ( currentPane() === 'request' ) showPane('options');
@@ -917,6 +942,8 @@ export function createAppBrowser ({ editable = true, onLaunch, actions = {}, gue
         // The last uninstalled-apps list a read returned, for loads whose read fails.
         _lastRemovedApps: null,
         _launchingApps: new Set(),
+        // Apps whose uninstall was confirmed but hasn't landed on the server.
+        _pendingUninstalls: new Set(),
         // A deep-link install mid-arrival ({ name, $el_window }) — its tile is
         // parked invisible until the intro's arrival beat (see
         // _spliceDeepLinkApp); and the session's landing-installed apps, kept
@@ -1362,7 +1389,7 @@ export function createAppBrowser ({ editable = true, onLaunch, actions = {}, gue
                 // account dialog, the touch action sheet, or the phone drawer.
                 if ( $('.dashboard-notifications-panel.open, .dashboard-dialog-overlay, .context-menu-modal-backdrop, .dashboard-sidebar.open').length ) return;
 
-                const $panelGrid = $el_window.find('.myapps-group-panel-grid');
+                const $panelGrid = $el_window.find('.myapps-group-overlay:not([inert]) .myapps-group-panel-grid');
                 const pageTiles = ($panelGrid.length
                     ? $panelGrid
                     : $el_window.find('.myapps-page').eq(self._page)
@@ -2237,6 +2264,8 @@ export function createAppBrowser ({ editable = true, onLaunch, actions = {}, gue
             // removal below, so the tile a user reaches for the instant a folder
             // shuts would do nothing.
             $overlay.css('pointer-events', 'none');
+            // Nor may its tiles take focus (Tab, the arrow keys) on the way out.
+            $overlay.attr('inert', '');
 
             // Back into the tile it grew out of; if that tile is gone (the folder
             // dissolved, the page flipped) the card simply recedes where it is.
@@ -2334,14 +2363,32 @@ export function createAppBrowser ({ editable = true, onLaunch, actions = {}, gue
             // boundary so their stale snapshot can't replay over it (see
             // _resolveGroups).
             this._groupsSavedAtSeq = this._loadSeq || 0;
-            try {
-                const p = puter.kv.set(APP_GROUPS_KV_KEY, JSON.stringify(groups));
-                if ( p && typeof p.catch === 'function' ) {
-                    p.catch(err => console.error('Failed to save app folders:', err));
+            this._persistLatest(APP_GROUPS_KV_KEY, JSON.stringify(groups), 'Failed to save app folders:');
+        },
+
+        // Saves `value` under `key` one write at a time, sending only the
+        // newest value once the write before it lands: two writes of a key in
+        // flight together (an eject's save, then the drop's) can land in
+        // either order, leaving the older layout stored.
+        _persistLatest (key, value, failureMessage) {
+            this._kvWrites ??= new Map();
+            let slot = this._kvWrites.get(key);
+            if ( ! slot ) this._kvWrites.set(key, slot = { pending: undefined, running: false });
+            slot.pending = value;
+            if ( slot.running ) return;
+            slot.running = true;
+            (async () => {
+                while ( slot.pending !== undefined ) {
+                    const next = slot.pending;
+                    slot.pending = undefined;
+                    try {
+                        await puter.kv.set(key, next);
+                    } catch ( err ) {
+                        console.error(failureMessage, err);
+                    }
                 }
-            } catch ( err ) {
-                console.error('Failed to save app folders:', err);
-            }
+                slot.running = false;
+            })();
         },
 
         // -- Drag-to-reorder --
@@ -3269,14 +3316,7 @@ export function createAppBrowser ({ editable = true, onLaunch, actions = {}, gue
             // boundary so their stale snapshot can't replay over it (see
             // _resolveOrderNames).
             this._orderSavedAtSeq = this._loadSeq || 0;
-            try {
-                const p = puter.kv.set(APPS_ORDER_KV_KEY, JSON.stringify(names));
-                if ( p && typeof p.catch === 'function' ) {
-                    p.catch(err => console.error('Failed to save app order:', err));
-                }
-            } catch ( err ) {
-                console.error('Failed to save app order:', err);
-            }
+            this._persistLatest(APPS_ORDER_KV_KEY, JSON.stringify(names), 'Failed to save app order:');
         },
 
         loadApps ($el_window) {
@@ -3444,7 +3484,7 @@ export function createAppBrowser ({ editable = true, onLaunch, actions = {}, gue
 
                 // Append installed apps that aren't already in the list
                 for ( const app of installedApps ) {
-                    if ( seen.has(app.name) ) continue;
+                    if ( seen.has(app.name) || this._pendingUninstalls.has(app.name) ) continue;
                     seen.add(app.name);
                     merged.push(app);
                 }

src/gui/src/UI/Dashboard/AppBrowser.test.js

@@ -68,6 +68,86 @@ async function mount (options = {}) {
 }
 
 describe('shared app browser', () => {
+    it('keeps an app off the grid while its uninstall is still on its way to the server', async () => {
+        const actions = { showAlert: vi.fn(), revokeAppSessions: vi.fn(async () => {}) };
+        await mount({ editable: true, actions });
+        let finishRevoke;
+        puter.perms = { revokeApp: vi.fn(() => new Promise(resolve => { finishRevoke = resolve; })) };
+        // The app's windows are closed first; the test has none.
+        $.fn.close ??= function () { return this; };
+        window.matchMedia = () => ({ matches: true });
+        browser._setReorderMode($root, true);
+        $('.myapps-tile[data-app-name="editor"] .myapps-tile-remove').trigger('click');
+        $('.myapps-modal-confirm').trigger('click');
+        expect(puter.perms.revokeApp).toHaveBeenCalled();
+
+        // A refresh before the revoke lands still lists the app as installed.
+        await browser.loadApps($root);
+        expect(browser._apps.map(app => app.name)).not.toContain('editor');
+
+        installed = installed.filter(app => app.name !== 'editor');
+        finishRevoke({});
+        await vi.waitFor(() => expect(browser._pendingUninstalls.size).toBe(0));
+        await browser.loadApps($root);
+        expect(browser._apps.map(app => app.name)).not.toContain('editor');
+        expect(actions.showAlert).not.toHaveBeenCalled();
+    });
+
+    it('saves one layout at a time, sending only the newest once the last write lands', async () => {
+        await mount({ editable: true });
+        const writes = [];
+        puter.kv.set = vi.fn((key, value) => new Promise(resolve => writes.push({ key, value, resolve })));
+        const orderWrites = () => writes.filter(w => w.key === APPS_ORDER_KV_KEY);
+
+        browser._apps = [{ name: 'a' }, { name: 'b' }];
+        browser.saveOrder();
+        browser._apps = [{ name: 'b' }, { name: 'a' }];
+        browser.saveOrder();
+        browser._apps = [{ name: 'a' }, { name: 'b' }, { name: 'c' }];
+        browser.saveOrder();
+        expect(orderWrites()).toHaveLength(1);
+
+        orderWrites()[0].resolve();
+        await vi.waitFor(() => expect(orderWrites()).toHaveLength(2));
+        expect(orderWrites()[1].value).toBe(JSON.stringify(browser._savedOrderNames));
+        expect(orderWrites()[1].value).not.toBe(orderWrites()[0].value);
+        orderWrites()[1].resolve();
+        await new Promise(resolve => setTimeout(resolve, 0));
+        expect(orderWrites()).toHaveLength(2);
+    });
+
+    it('leaves the app request form open on an Escape that ends an IME composition', async () => {
+        await mount({ editable: true });
+        $('.myapps-add-tile').trigger('click');
+        $('.myapps-add-option[data-add-option="request"]').trigger('click');
+        const pane = () => $('.myapps-add-pane:not([hidden])').attr('data-pane');
+        expect(pane()).toBe('request');
+
+        $('.myapps-add-message')[0].dispatchEvent(new KeyboardEvent('keydown', { key: 'Escape', isComposing: true, bubbles: true }));
+        expect(pane()).toBe('request');
+        $('.myapps-add-message')[0].dispatchEvent(new KeyboardEvent('keydown', { key: 'Escape', bubbles: true }));
+        expect(pane()).toBe('options');
+        $(document).off('keydown.add-app-modal');
+    });
+
+    it('lets Tab reach the delete-data option in the Uninstall dialog', async () => {
+        // jsdom lays nothing out; the focus trap skips elements with no offsetParent.
+        vi.spyOn(HTMLElement.prototype, 'offsetParent', 'get').mockReturnValue(document.body);
+        await mount({ editable: true });
+        browser._setReorderMode($root, true);
+        $('.myapps-tile[data-app-name="editor"] .myapps-tile-remove').trigger('click');
+        const $overlay = $('.myapps-modal-overlay');
+        expect(document.activeElement.classList.contains('myapps-modal-cancel')).toBe(true);
+
+        // Tab from the last control wraps to the first, the checkbox.
+        $overlay.find('.myapps-modal-confirm')[0].focus();
+        $overlay.trigger($.Event('keydown', { key: 'Tab', shiftKey: false }));
+        expect(document.activeElement.classList.contains('myapps-modal-delete-data')).toBe(true);
+        // Shift+Tab from it wraps back to the last.
+        $overlay.trigger($.Event('keydown', { key: 'Tab', shiftKey: true }));
+        expect(document.activeElement.classList.contains('myapps-modal-confirm')).toBe(true);
+    });
+
     it('uses saved order, folders, and removed recommendations in read-only mode', async () => {
         await mount();
         expect(browser._apps.map(app => app.name)).toEqual(['notes', 'sheet', 'editor']);

src/gui/src/UI/Dashboard/TabApps.test.js

@@ -68,7 +68,7 @@ describe('TabApps.beginDeepLinkLaunch', () => {
 });
 
 describe('TabApps cancelling a drag out of a folder', () => {
-    it('puts the folder and the order back as they were', () => {
+    it('puts the folder and the order back as they were', async () => {
         document.body.innerHTML = '<div class="window"><div class="dashboard-section-apps active"><div class="myapps-container"><div class="myapps-page"><div class="myapps-tile" data-app-name="a"></div></div></div></div></div>';
         window.puter = { kv: { set: vi.fn(async () => {}), get: vi.fn(async () => null) } };
         TabApps._groupsLoaded = true;
@@ -91,7 +91,9 @@ describe('TabApps cancelling a drag out of a folder', () => {
         TabApps._endDrag(false);
 
         expect(TabApps._groups).toEqual([{ id: 'g1', name: 'Work', apps: ['a', 'b'] }]);
-        expect(JSON.parse(window.puter.kv.set.mock.calls.at(-2)[1])).toEqual([{ id: 'g1', name: 'Work', apps: ['a', 'b'] }]);
+        // The restore is written once the eject's own write lands.
+        const lastSaved = key => JSON.parse(window.puter.kv.set.mock.calls.filter(([k]) => k === key).at(-1)[1]);
+        await vi.waitFor(() => expect(lastSaved('dashboard_app_groups')).toEqual([{ id: 'g1', name: 'Work', apps: ['a', 'b'] }]));
         vi.restoreAllMocks();
     });
 });

src/gui/src/UI/Dashboard/TabFiles.js

@@ -37,6 +37,7 @@ import UIItemPropertiesModal from './UIItemPropertiesModal.js';
 import UIShareModal from './UIShareModal.js';
 import { openPublishWebsiteDialog, openPublishWorkerDialog } from './UIPublishDialogs.js';
 import { dedupedName } from '../../helpers/dedupedName.js';
+import { runLimited } from '../../helpers/runLimited.js';
 import { compareEntries, compareNames } from './sortEntries.js';
 import { middleTruncate } from './middleTruncate.js';
 import { resolveTypedPath } from './typedPath.js';
@@ -54,6 +55,14 @@ import { paintAvatars } from '../../helpers/profilePictures.js';
 
 const { html_encode, SelectionArea } = window;
 
+// Permanent deletes in flight at once: a browser's connections to one host.
+const DELETE_CONCURRENCY = 6;
+
+// The "New" menu's stand-ins for window.create_file, one per create in
+// flight (newest last), and the function they stand in for.
+const createFileInterceptors = [];
+let realCreateFile = null;
+
 /**
  * `p` with the folder `from` (itself, or anything under it) moved to `to`;
  * any other path, or a non-string, comes back as it was.
@@ -1242,8 +1251,9 @@ const TabFiles = {
                 return false;
             }
 
-            // Arrow keys, Home/End and PageUp/PageDown - Navigate items
-            if ( e.which >= 33 && e.which <= 40 ) {
+            // Arrow keys, Home/End and PageUp/PageDown - Navigate items. Not
+            // with Alt or Cmd: those are the browser's (Alt+Left is Back).
+            if ( e.which >= 33 && e.which <= 40 && ! e.altKey && ! e.metaKey ) {
                 e.preventDefault();
                 e.stopPropagation();
 
@@ -1907,9 +1917,9 @@ const TabFiles = {
         if ( confirmed !== 'delete' ) return;
         // The phone selection bar acts on rows that are going away.
         this.$el_window.find('.files-selection-actions').removeClass('visible');
-        for ( const row of list ) {
-            await window.delete_item(row);
-        }
+        // A few at a time rather than one after another: a few hundred items
+        // took a round trip each. delete_item reports its own failures.
+        await runLimited(list, DELETE_CONCURRENCY, row => window.delete_item(row));
         await window.refresh_trash_state();
     },
 
@@ -2383,11 +2393,19 @@ const TabFiles = {
         };
 
         if ( isList ) {
-            for ( const el of names ) {
-                // 8px padding on each side; an auto-width column shows the
-                // full name, clipped by CSS.
-                write(el, nameWidth ? truncateFilenameToWidth(fullNameOf(el), nameWidth - 16, font) : fullNameOf(el));
-            }
+            // The name's padding (8px a side) takes room from a set width. An
+            // auto-width column fills the row, so its room is read off the
+            // name's wrapper, less the wrapper's padding: all reads before any
+            // write, so the writes don't force a layout each.
+            const paddingOf = s => (parseFloat(s.paddingLeft) || 0) + (parseFloat(s.paddingRight) || 0);
+            const padding = paddingOf(style);
+            const wrapperPadding = nameWidth ? 0 : paddingOf(getComputedStyle(names[0].parentElement));
+            const rooms = nameWidth ? null : names.map(el => el.parentElement.clientWidth - wrapperPadding);
+            names.forEach((el, i) => {
+                const room = (nameWidth || rooms[i]) - padding;
+                // A listing that isn't laid out yet (hidden tab) has no room to fit to.
+                write(el, room > 0 ? truncateFilenameToWidth(fullNameOf(el), room, font) : fullNameOf(el));
+            });
             return;
         }
 
@@ -3312,6 +3330,9 @@ const TabFiles = {
         // the directories sidebar is hidden — Home carries a row for each.
         this.renderPlaceRows();
 
+        // Something that ran while the listing loaded (a restore finishing,
+        // a failed mkdir) may have found the pane empty and said so.
+        $files.find('.files-empty-notice').remove();
         if ( directoryContents.length === 0 ) {
             this.renderEmptyPlaceholderIfNeeded();
             this.updateFooterStats();
@@ -4433,11 +4454,14 @@ const TabFiles = {
         const metadata = metadataStr ? JSON.parse(metadataStr) : {};
 
         // Only a direct child of Trash carries restore metadata.
+        const name = $(el_item).attr('data-name') || '';
         if ( path.dirname($(el_item).attr('data-path') || '') !== window.trash_path ) {
-            throw new Error('Cannot restore: only top-level Trash items can be restored');
+            throw new Error(i18n('restore_only_trash_items', { name }, false));
         }
+        // An item an app or the API moved into the Trash has no record of
+        // where it came from.
         if ( ! metadata.original_path ) {
-            throw new Error('Cannot restore: original path not found in metadata');
+            throw new Error(i18n('restore_location_unknown', { name }, false));
         }
 
         const destPath = path.dirname(metadata.original_path);
@@ -5370,10 +5394,14 @@ const TabFiles = {
                     return async () => {
                         $('.context-menu').remove();
 
+                        // Where the user was, so an upload that lands after
+                        // they've moved on neither pulls them back nor draws
+                        // its row into another folder's listing.
+                        const pathAtClick = _this.currentPath;
+
                         // Temporarily intercept create_file to capture the upload promise
                         let uploadPromise = null;
-                        const origCreateFile = window.create_file;
-                        window.create_file = (options) => {
+                        const createFile = (options) => {
                             // Counted from here, not from the click: Web Link
                             // waits on a prompt first, and other items added
                             // to the folder meanwhile must still show up.
@@ -5384,6 +5412,12 @@ const TabFiles = {
                             // a caller that awaits this.
                             return uploadPromise.catch(() => undefined);
                         };
+                        // Creates can overlap. Each one's interceptor stays
+                        // installed until it finishes, the newest on top, and
+                        // the real create_file comes back once none is left.
+                        if ( createFileInterceptors.length === 0 ) realCreateFile = window.create_file;
+                        createFileInterceptors.push(createFile);
+                        window.create_file = createFile;
 
                         try {
                             await originalOnClick();
@@ -5401,7 +5435,10 @@ const TabFiles = {
                                     operation: 'create_file',
                                     data: $('<div>').attr({ 'data-uid': result.uid, 'data-path': result.path }),
                                 });
-                                if ( targetPath === _this.currentPath ) {
+                                // Not mid-way to another folder (currentPath
+                                // only moves once its listing arrives).
+                                const settled = ! _this.loadingFolder;
+                                if ( settled && targetPath === _this.currentPath ) {
                                     // Remove empty-directory placeholder if present
                                     _this.$el_window.find('.files-tab .files > div:not(.item):not(.place-row):not(.tabfiles-selection-area)').remove();
                                     // Add the new file incrementally
@@ -5412,11 +5449,15 @@ const TabFiles = {
                                         _this.applyColumnWidths();
                                         _this.updateFooterStats();
                                     }
-                                } else {
+                                } else if ( settled && _this.currentPath === pathAtClick ) {
                                     // Same navigate-to-target treatment as New
                                     // Folder above.
                                     _this.pushNavHistory(targetPath);
                                     await _this.renderDirectory(targetPath, { consistency: 'strong' });
+                                } else {
+                                    // The user went elsewhere meanwhile; the
+                                    // file is there when they come back.
+                                    return;
                                 }
                                 const $newRow = _this.$el_window.find(`.files-tab .files .item[data-uid='${result.uid}']`);
                                 if ( $newRow.length > 0 ) {
@@ -5427,7 +5468,8 @@ const TabFiles = {
                         } catch ( err ) {
                             UIAlert(err?.message || i18n('error_unknown_cause', [], false));
                         } finally {
-                            window.create_file = origCreateFile;
+                            createFileInterceptors.splice(createFileInterceptors.indexOf(createFile), 1);
+                            window.create_file = createFileInterceptors.at(-1) ?? realCreateFile;
                             if ( uploadPromise ) _this.doneCreating();
                         }
                     };

src/gui/src/UI/Dashboard/TabFiles.test.js

@@ -116,6 +116,131 @@ describe('TabFiles emptying the Trash', () => {
     });
 });
 
+describe('TabFiles restoring from the Trash', () => {
+    beforeEach(() => {
+        window.trash_path = TRASH;
+        window.byte_format = bytes => `${bytes} B`;
+        window.refresh_trash_state = vi.fn(async () => {});
+        window.puter = { fs: { move: vi.fn(async () => ({})) } };
+    });
+
+    afterEach(() => vi.restoreAllMocks());
+
+    it('says in the user\'s language when an item has no record of where it came from', async () => {
+        const { default: UIAlert } = await import('../UIAlert.js');
+        UIAlert.mockClear();
+        mountListing(['uid-1']);
+        const row = $('.files .row')[0];
+        row.setAttribute('data-name', 'notes.txt');
+        row.setAttribute('data-uid', 'uid-1');
+
+        vi.spyOn(console, 'error').mockImplementation(() => {});
+        await TabFiles.restoreRows([row]);
+
+        expect(puter.fs.move).not.toHaveBeenCalled();
+        expect(UIAlert).toHaveBeenCalledWith('“notes.txt” can’t be restored because where it was deleted from isn’t known.');
+        expect($('.files .row')).toHaveLength(1);
+    });
+});
+
+describe('TabFiles New menu creates', () => {
+    const menuItem = (pattern, folder) => TabFiles.generateFolderContextMenu(folder)
+        .find(item => item && item.items).items.find(item => item && pattern.test(item.html));
+    let uploads;
+
+    beforeEach(() => {
+        mountListing([], '/alice/Documents');
+        window.user = { username: 'alice' };
+        window.trash_path = TRASH;
+        window.shared_path = '/alice/Shared';
+        window.file_templates = [];
+        window.sites = [];
+        window.actions_history = [];
+        window.activate_item_name_editor = vi.fn();
+        vi.spyOn(TabFiles, 'pushNavHistory').mockImplementation(() => {});
+        uploads = [];
+        window.puter = { fs: { upload: vi.fn((file, dirname) => new Promise(resolve => {
+            uploads.push(() => resolve({ uid: `u${uploads.length}`, name: file.name, path: `${dirname}/${file.name}` }));
+        })) } };
+        vi.spyOn(TabFiles, 'acceptsNewItemsHere').mockReturnValue(true);
+        vi.spyOn(TabFiles, 'acceptsNewItems').mockReturnValue(true);
+        vi.spyOn(TabFiles, 'renderItem').mockResolvedValue();
+        TabFiles.loadingFolder = false;
+        TabFiles._creatingItem = 0;
+        TabFiles.trashedNames ??= new Map();
+        TabFiles.deferredAdds ??= [];
+    });
+
+    afterEach(() => vi.restoreAllMocks());
+
+    it('puts the real create_file back when two overlap, whichever finishes first', async () => {
+        const real = vi.fn();
+        window.create_file = real;
+
+        const first = menuItem(/text_document|Text/).onClick();
+        const second = menuItem(/html_document|HTML/).onClick();
+        await new Promise(resolve => setTimeout(resolve, 0));
+        expect(uploads).toHaveLength(2);
+        uploads[0]();
+        await first;
+        uploads[1]();
+        await second;
+
+        expect(window.create_file).toBe(real);
+        expect(TabFiles._creatingItem).toBe(0);
+
+        const third = menuItem(/text_document|Text/).onClick();
+        const fourth = menuItem(/html_document|HTML/).onClick();
+        await new Promise(resolve => setTimeout(resolve, 0));
+        uploads[3]();
+        await fourth;
+        uploads[2]();
+        await third;
+
+        expect(window.create_file).toBe(real);
+        expect(TabFiles._creatingItem).toBe(0);
+    });
+
+    it('leaves a listing the user moved to alone when the upload lands after', async () => {
+        window.create_file = vi.fn();
+        vi.spyOn(TabFiles, 'renderDirectory').mockResolvedValue();
+        const created = menuItem(/text_document|Text/).onClick();
+        await new Promise(resolve => setTimeout(resolve, 0));
+
+        // The user opened Pictures; its listing is still loading.
+        TabFiles.loadingFolder = true;
+        uploads[0]();
+        await created;
+        expect(TabFiles.renderItem).not.toHaveBeenCalled();
+        expect(TabFiles.renderDirectory).not.toHaveBeenCalled();
+        expect(window.activate_item_name_editor).not.toHaveBeenCalled();
+    });
+
+    it('does not pull the user back once they are in another folder', async () => {
+        window.create_file = vi.fn();
+        vi.spyOn(TabFiles, 'renderDirectory').mockResolvedValue();
+        const created = menuItem(/text_document|Text/).onClick();
+        await new Promise(resolve => setTimeout(resolve, 0));
+
+        TabFiles.currentPath = '/alice/Pictures';
+        uploads[0]();
+        await created;
+        expect(TabFiles.renderDirectory).not.toHaveBeenCalled();
+        expect(TabFiles.renderItem).not.toHaveBeenCalled();
+    });
+
+    it('still goes to the folder whose menu made the file', async () => {
+        window.create_file = vi.fn();
+        vi.spyOn(TabFiles, 'renderDirectory').mockResolvedValue();
+        const created = menuItem(/text_document|Text/, '/alice/Videos').onClick();
+        await new Promise(resolve => setTimeout(resolve, 0));
+
+        uploads[0]();
+        await created;
+        expect(TabFiles.renderDirectory).toHaveBeenCalledWith('/alice/Videos', { consistency: 'strong' });
+    });
+});
+
 describe('failedUploadsMessage', () => {
     it('puts each failed item on its own line', () => {
         const message = failedUploadsMessage({ failedItems: [
@@ -1086,6 +1211,57 @@ describe('TabFiles names in a narrow listing', () => {
     });
 });
 
+describe('TabFiles names in an auto-width name column', () => {
+    const mountNames = (names) => {
+        document.body.innerHTML = `
+            <div class="window"><div class="files-tab">
+                <div class="header"><div class="columns"></div></div>
+                <div class="files files-list-view">${names.map(name => `
+                    <div class="row item" data-name="${name}">
+                        <div class="item-name-wrapper" style="padding: 0 40px 0 0"><pre class="item-name" style="padding: 0 8px"></pre></div>
+                    </div>`).join('')}
+                </div>
+            </div></div>`;
+        TabFiles.$el_window = $('.window');
+        TabFiles.currentView = 'list';
+        TabFiles.appliedColumnWidths = { name: null, sharedBy: 160, size: 60, modified: 80 };
+    };
+
+    beforeEach(() => {
+        // 10px a character; jsdom has no canvas.
+        vi.spyOn(HTMLCanvasElement.prototype, 'getContext').mockReturnValue({ measureText: text => ({ width: text.length * 10 }) });
+    });
+
+    afterEach(() => vi.restoreAllMocks());
+
+    it('cut a long name in the middle to the room its wrapper leaves, keeping the end', () => {
+        const long = `${'x'.repeat(60)} (1).txt`;
+        mountNames([long, 'short.txt']);
+        // 256px wrapper, less its 40px and the name's 16px of padding: 200px, 20 characters.
+        vi.spyOn(HTMLElement.prototype, 'clientWidth', 'get').mockReturnValue(256);
+
+        TabFiles.fitItemNames($('.files .item-name'));
+
+        const [$long, $short] = $('.files .item-name').toArray().map(el => $(el));
+        expect($long.text().length).toBeLessThanOrEqual(20);
+        expect($long.text().length).toBeGreaterThan(15);
+        expect($long.text()).toMatch(/^x+…x* \(1\)\.txt$/);
+        expect($long.attr('title')).toBe(long);
+        expect($short.text()).toBe('short.txt');
+        expect($short.attr('title') ?? '').toBe('');
+    });
+
+    it('show the full name while the listing has no width yet', () => {
+        const long = 'y'.repeat(80);
+        mountNames([long]);
+        vi.spyOn(HTMLElement.prototype, 'clientWidth', 'get').mockReturnValue(0);
+
+        TabFiles.fitItemNames($('.files .item-name'));
+
+        expect($('.files .item-name').text()).toBe(long);
+    });
+});
+
 describe('TabFiles uploads', () => {
     beforeEach(async () => {
         vi.restoreAllMocks();
@@ -1369,6 +1545,22 @@ describe('TabFiles keyboard', () => {
         expect(selected()).toEqual(['/alice/Documents/a.txt']);
     });
 
+    it('leaves Alt and Cmd arrows to the browser', () => {
+        mountKeyboard(['a.txt', 'b.txt']);
+        $('.files .row').first().addClass('selected');
+
+        const back = new KeyboardEvent('keydown', { key: 'ArrowLeft', which: 37, keyCode: 37, altKey: true, bubbles: true, cancelable: true });
+        document.body.dispatchEvent(back);
+        const down = new KeyboardEvent('keydown', { key: 'ArrowDown', which: 40, keyCode: 40, metaKey: true, bubbles: true, cancelable: true });
+        document.body.dispatchEvent(down);
+
+        expect(back.defaultPrevented).toBe(false);
+        expect(down.defaultPrevented).toBe(false);
+        expect(selected()).toEqual(['/alice/Documents/a.txt']);
+        press(document.body, 'ArrowDown', { which: 40, keyCode: 40 });
+        expect(selected()).toEqual(['/alice/Documents/b.txt']);
+    });
+
     it('takes a space typed into a name as part of it', () => {
         mountKeyboard(['my notes.txt', 'my zebra.txt']);
         for ( const key of ['m', 'y', ' ', 'z'] ) press(document.body, key, { which: key.toUpperCase().charCodeAt(0) });

src/gui/src/UI/Dashboard/TabHome.js

@@ -168,15 +168,19 @@ function buildUsageHTML() {
 // what the badge carries: a date says when, only a countdown says how long
 // there is to decide. Returns null when the subscription carries no end date,
 // so callers fall back to unqualified "Free trial" wording.
-function formatTrialEnd(trialEndsAt) {
+export function formatTrialEnd(trialEndsAt, now = Date.now()) {
     if (!Number.isFinite(trialEndsAt)) return null;
     const date = new Date(trialEndsAt);
     if (Number.isNaN(date.getTime())) return null;
-    // Rounded up, so a trial with any time on it never reads "0 days left"
-    // before the day it actually converts.
+    // Calendar days in the user's time zone, so the countdown agrees with the
+    // date beside it: a trial ending this afternoon ends "today", and one
+    // ending tomorrow morning has one day left. Rounded, for the 23- and
+    // 25-hour days daylight saving makes.
+    const startOfDay = (d) =>
+        new Date(d.getFullYear(), d.getMonth(), d.getDate()).getTime();
     const days = Math.max(
         0,
-        Math.ceil((date.getTime() - Date.now()) / 86400000),
+        Math.round((startOfDay(date) - startOfDay(new Date(now))) / 86400000),
     );
     // In the dashboard's language, which the sentences around it are in.
     const locale = intlLocale(window.locale);

src/gui/src/UI/Dashboard/TabHome.test.js

@@ -31,7 +31,7 @@ globalThis.i18n = key => key;
 window.icons = {};
 window.launch_apps = { recent: [] };
 
-const { default: TabHome } = await import('./TabHome.js');
+const { default: TabHome, formatTrialEnd } = await import('./TabHome.js');
 const { openAppInNewTab } = await import('../../helpers/dashboardAppLaunch.js');
 
 describe('TabHome recently used', () => {
@@ -96,3 +96,25 @@ describe('TabHome recent app clicks', () => {
         expect(openAppInNewTab).toHaveBeenCalledTimes(1);
     });
 });
+
+describe('formatTrialEnd', () => {
+    const at = (day, hour) => new Date(2026, 10, day, hour).getTime();
+
+    it('counts calendar days, so the countdown agrees with the date', () => {
+        // Ends at 3pm today: today, not "1 day left".
+        expect(formatTrialEnd(at(8, 15), at(8, 9)).days).toBe(0);
+        // Ends tomorrow at 11am: one day, not two.
+        expect(formatTrialEnd(at(9, 11), at(8, 9)).days).toBe(1);
+        expect(formatTrialEnd(at(9, 11), at(8, 23)).days).toBe(1);
+        expect(formatTrialEnd(at(15, 0), at(8, 23)).days).toBe(7);
+    });
+
+    it('reads an end that has passed as today', () => {
+        expect(formatTrialEnd(at(7, 12), at(8, 9)).days).toBe(0);
+    });
+
+    it('has nothing to say without an end date', () => {
+        expect(formatTrialEnd(undefined)).toBeNull();
+        expect(formatTrialEnd(NaN)).toBeNull();
+    });
+});

src/gui/src/UI/Dashboard/TabNotifications.js

@@ -49,7 +49,9 @@ const ICONS = {
     puter: svg('<rect x="3" y="3" width="18" height="18" rx="4"/><path d="M8 12h8M12 8v8"/>'),
 };
 
-const PLATFORM_KEYS = { web: 'push_platform_web', ios: 'push_platform_ios', android: 'push_platform_android' };
+// `webpush` is Puter's own Web Push (see webPushClient.js); both are browsers.
+const PLATFORM_KEYS = { web: 'push_platform_web', webpush: 'push_platform_web', ios: 'push_platform_ios', android: 'push_platform_android' };
+const BROWSER_PLATFORMS = new Set(['web', 'webpush']);
 
 /** @param {{ pushEnabled?: boolean }|undefined} params - `window.gui_params` */
 export const notificationsTabEnabled = (params) => params?.pushEnabled === true;
@@ -106,7 +108,7 @@ export const deviceCardHtml = (device, now) => {
         ? i18n('push_device_last_seen', { time: formatRelativeTime(seenAt, now, locale) })
         : '';
     return card({
-        icon: device.platform === 'web' ? ICONS.laptop : ICONS.phone,
+        icon: BROWSER_PLATFORMS.has(device.platform) ? ICONS.laptop : ICONS.phone,
         title: html_encode(deviceName(device)),
         badge: device.current ? i18n('push_this_browser') : '',
         detail: [platform, seen].filter(Boolean).join(' · '),
@@ -230,11 +232,18 @@ const TabNotifications = {
                 ? devices.map(device => deviceCardHtml(device, now)).join('')
                 : emptyHtml('push_devices_empty'));
         };
+        // Only the newest listing draws, and a local removal outdates any
+        // listing still in flight: it may predate the removal.
+        let devicesSeq = 0;
         const refreshDevices = async () => {
+            const seq = ++devicesSeq;
             try {
-                devices = await listPushDevices();
+                const listed = await listPushDevices();
+                if ( seq !== devicesSeq ) return;
+                devices = listed;
                 renderDevices();
             } catch ( e ) {
+                if ( seq !== devicesSeq ) return;
                 console.warn('[push] device list failed', e);
                 $section.find('.push-devices-list').html(emptyHtml(loadFailedKey(e)));
             }
@@ -245,11 +254,16 @@ const TabNotifications = {
                 ? apps.map(appCardHtml).join('')
                 : emptyHtml('push_apps_empty'));
         };
+        let appsSeq = 0;
         const refreshApps = async () => {
+            const seq = ++appsSeq;
             try {
-                apps = await listPushApps();
+                const listed = await listPushApps();
+                if ( seq !== appsSeq ) return;
+                apps = listed;
                 renderApps();
             } catch ( e ) {
+                if ( seq !== appsSeq ) return;
                 console.warn('[push] app list failed', e);
                 $section.find('.push-apps-list').html(emptyHtml(loadFailedKey(e)));
             }
@@ -257,12 +271,15 @@ const TabNotifications = {
 
         const refreshPreference = async () => {
             const $toggle = $section.find('.push-puter-toggle');
+            const $hint = $section.find('.push-puter-card .dashboard-settings-card-info > span');
             try {
                 $toggle.prop('checked', await getPuterPushPreference()).prop('disabled', false);
+                // A failed earlier read replaced the hint.
+                $hint.html(i18n('push_puter_notifications_hint'));
             } catch ( e ) {
                 console.warn('[push] preference read failed', e);
                 $toggle.prop('checked', false).prop('disabled', true);
-                $section.find('.push-puter-card .dashboard-settings-card-info > span').html(i18n(loadFailedKey(e)));
+                $hint.html(i18n(loadFailedKey(e)));
             }
         };
 
@@ -362,13 +379,21 @@ const TabNotifications = {
             if ( confirmed !== true ) return;
             // disable() drops the token and record; the DELETE covers a lost record.
             const client = device.current ? getPushClient() : null;
+            let disabled = false;
             try {
-                if ( client ) await client.disable();
+                if ( client ) {
+                    await client.disable();
+                    disabled = true;
+                    // Push is off here even if the DELETE fails; without the
+                    // opt-out the next load would turn it back on.
+                    setBrowserPushOptOut(window.user?.uuid, true);
+                }
                 await removePushDevice(uid);
             } catch ( e ) {
                 if ( e?.status !== 404 || e?.code === PUSH_UNAVAILABLE ) {
                     console.warn('[push] device removal failed', e);
                     showError('push_device_remove_failed', $el_window);
+                    if ( disabled ) refreshBrowser();
                     return;
                 }
             }
@@ -377,6 +402,7 @@ const TabNotifications = {
                 await Promise.all([refreshBrowser(), refreshDevices()]);
                 return;
             }
+            devicesSeq++;
             devices = devices.filter(d => d.uid !== uid);
             renderDevices();
             if ( device.current ) refreshBrowser();
@@ -393,6 +419,7 @@ const TabNotifications = {
                 showError('push_app_turn_off_failed', $el_window);
                 return;
             }
+            appsSeq++;
             apps = apps.filter(app => app.uid !== appUid);
             renderApps();
         });

src/gui/src/UI/Dashboard/TabNotifications.test.js

@@ -412,6 +412,26 @@ describe('Puter notifications', () => {
         expect($('.push-puter-card').text()).toContain('push_load_failed');
     });
 
+    it('puts the hint back once a later visit reads the preference', async () => {
+        serve({
+            'GET /push/devices': { devices: [] },
+            'GET /push/apps': { apps: [] },
+            'GET /push/preferences': () => reply(500, {}),
+        });
+        await open();
+        serve({
+            'GET /push/devices': { devices: [] },
+            'GET /push/apps': { apps: [] },
+            'GET /push/preferences': { puter: true },
+        });
+        await tab.onActivate($('.win'));
+        await settle();
+
+        expect($('.push-puter-toggle').prop('disabled')).toBe(false);
+        expect($('.push-puter-card').text()).toContain('push_puter_notifications_hint');
+        expect($('.push-puter-card').text()).not.toContain('push_load_failed');
+    });
+
     it('puts the switch back when the save fails', async () => {
         serve({
             'GET /push/devices': { devices: [] },
@@ -471,6 +491,21 @@ describe('your devices', () => {
         expect($cards.eq(2).find('strong').text()).toBe('push_device_unknown');
     });
 
+    it('labels a browser on Puter\'s own Web Push as a browser', async () => {
+        serve({
+            'GET /push/devices': { devices: [device({ uid: 'a', platform: 'webpush' }), device({ uid: 'b', platform: 'ios' })] },
+            'GET /push/apps': { apps: [] },
+            'GET /push/preferences': { puter: true },
+        });
+        await open();
+
+        const $cards = $('.push-device-card');
+        expect($cards.eq(0).find('.dashboard-settings-card-info > span').text()).toContain('push_platform_web');
+        // Laptop, not phone.
+        expect($cards.eq(0).find('svg rect').attr('width')).toBe('18');
+        expect($cards.eq(1).find('svg rect').attr('width')).toBe('12');
+    });
+
     it('removes a device once the user confirms', async () => {
         const remove = vi.fn(() => reply(200, { removed: true }));
         serve({
@@ -522,6 +557,30 @@ describe('your devices', () => {
         expect(pushClient.browserPushOptedOut('u-1')).toBe(true);
     });
 
+    it('keeps this browser opted out when its push is off but the server removal fails', async () => {
+        const client = fakeClient({ permission: 'granted', registered: true, deviceUid: 'a' });
+        pushClient.registerPushClient(client);
+        serve({
+            'GET /push/devices': { devices: [device({ uid: 'a', current: true })] },
+            'GET /push/apps': { apps: [] },
+            'GET /push/preferences': { puter: true },
+            'DELETE /push/devices/a': () => reply(500, {}),
+        });
+        await open();
+        client.disable.mockImplementation(async () => {
+            client.status.mockResolvedValue({ permission: 'granted', registered: false });
+        });
+
+        $('.push-remove-device[data-uid="a"]').trigger('click');
+        await settle();
+        dialogButton('push_device_remove').trigger('click');
+        await settle();
+
+        expect(dialog('.dashboard-dialog-message').text()).toContain('push_device_remove_failed');
+        expect(pushClient.browserPushOptedOut('u-1')).toBe(true);
+        expect(browserCard().hasClass('push-browser-off')).toBe(true);
+    });
+
     it('still removes this browser on the server when it has no local record', async () => {
         const client = fakeClient({ permission: 'granted', registered: false });
         pushClient.registerPushClient(client);
@@ -548,6 +607,36 @@ describe('your devices', () => {
         expect($('.push-device-card')).toHaveLength(0);
     });
 
+    it('does not bring back a removed device when an older listing lands after the removal', async () => {
+        const both = [device({ uid: 'a' }), device({ uid: 'b', label: 'Phone' })];
+        let releaseListing;
+        let deferred = false;
+        serve({
+            'GET /push/devices': () => (deferred
+                ? new Promise(resolve => { releaseListing = () => resolve(reply(200, { devices: both })); })
+                : reply(200, { devices: both })),
+            'GET /push/apps': { apps: [] },
+            'GET /push/preferences': { puter: true },
+            'DELETE /push/devices/b': () => reply(200, { removed: true }),
+        });
+        await open();
+        // Coming back to the tab starts a listing that is slow to answer.
+        deferred = true;
+        void tab.onActivate($('.win'));
+        await settle();
+
+        $('.push-remove-device[data-uid="b"]').trigger('click');
+        await settle();
+        dialogButton('push_device_remove').trigger('click');
+        await settle();
+        expect($('.push-remove-device[data-uid="b"]')).toHaveLength(0);
+
+        releaseListing();
+        await settle();
+        expect($('.push-remove-device[data-uid="b"]')).toHaveLength(0);
+        expect($('.push-device-card')).toHaveLength(1);
+    });
+
     it('removes another device with the server alone', async () => {
         const client = fakeClient({ permission: 'granted', registered: true, deviceUid: 'a' });
         pushClient.registerPushClient(client);

src/gui/src/UI/Dashboard/TabUsage.js

@@ -17,7 +17,7 @@
  * along with this program.  If not, see <https://www.gnu.org/licenses/>.
  */
 
-import { formatCredits, formatDollarsFromMicrocents, usageIsCredits } from './credits.js';
+import { formatCount, formatCredits, formatDollarsFromMicrocents, usageIsCredits } from './credits.js';
 import { isOrgSeat } from './orgSeat.js';
 import { addonCreditsRemaining, meterPercent, monthlyUsageOrThrow, usageBudget } from './usageBudget.js';
 import { getMonthlyUsage, getStorageSpace } from './usageRequests.js';
@@ -281,7 +281,7 @@ function renderUsageTable () {
     for ( const row of rowsToShow ) {
         h += `
         <tr>
-            <td>${window.html_encode(row.resource.replaceAll('_dot_', '.'))}</td>
+            <td title="${window.html_encode(row.resource.replaceAll('_dot_', '.'))}">${window.html_encode(row.resource.replaceAll('_dot_', '.'))}</td>
             <td>${row.formattedUnits}</td>
             <td>${row.formattedCost}</td>
         </tr>`;
@@ -351,7 +351,7 @@ async function update_usage_details ($el_window) {
             if ( key.endsWith(':bytes') ) {
                 formattedUnits = window.byte_format(rawUnits);
             } else {
-                formattedUnits = window.number_format(rawUnits, { decimals: 0, thousandSeparator: ',' });
+                formattedUnits = formatCount(rawUnits);
             }
 
             usageTableData.push({

src/gui/src/UI/Dashboard/UIDashboard.js

@@ -23,11 +23,11 @@ import UIWindow from '../UIWindow.js';
 import UIContextMenu from '../UIContextMenu.js';
 import UIAlert from '../UIAlert.js';
 import UIWindowSaveAccount from '../UIWindowSaveAccount.js';
-import UIWindowLogin from '../UIWindowLogin.js';
-import UIWindowFeedback from '../UIWindowFeedback.js';
+import UIAuthLogin from '../Auth/UIAuthLogin.js';
 import apply_item_added_to_containers from '../../helpers/applyItemAddedToContainers.js';
 import { clear_shared_param } from '../../helpers/parseSharedPath.js';
 import UIDashboardNotifications from './UIDashboardNotifications.js';
+import UIDashboardContactDialog from './UIDashboardContactDialog.js';
 import {
     answerNotificationReceipts,
     notificationSocketAcks,
@@ -514,9 +514,9 @@ async function UIDashboard (options) {
 
     if ( sharedLinkNeedsLogin ) {
         // Not awaited: the dashboard is already up underneath the cover page.
-        UIWindowLogin({
+        UIAuthLogin({
             reload_on_success: true,
-            window_options: { cover_page: true, has_head: false },
+            page: true,
         }).then(() => {
             // Dismissed without signing in: drop the link rather than loop.
             if ( window.user?.is_temp ) clear_shared_param();
@@ -548,12 +548,13 @@ async function UIDashboard (options) {
         const filePath = route.path;
         notifications.close({ restoreFocus: false });
         // What was open over the tab being left goes with it, as on a
-        // sidebar click: the phone drawer, a menu, and Files' Share and
+        // sidebar click: the phone drawer, a menu, Files' Share and
         // Properties, which act on its rows (their changes are already saved),
-        // and its image preview.
+        // its image preview, and a dialog or the photo crop, each through its
+        // own close button.
         setMobileSidebar(false);
         $('.context-menu').remove();
-        $el_window.find('.share-modal-close, .item-props-close').trigger('click');
+        $el_window.find('.share-modal-close, .item-props-close, .dashboard-dialog-overlay .dashboard-dialog-close, .profile-crop-close').trigger('click');
         if ( tab !== 'files' && TabFiles.previewOpen ) TabFiles.closeImagePreview();
 
         // Switch to correct tab
@@ -875,21 +876,10 @@ async function UIDashboard (options) {
             items.push({
                 html: i18n('add_another_account'),
                 onClick: async function () {
-                    await UIWindowLogin({
+                    await UIAuthLogin({
                         reload_on_success: true,
                         send_confirmation_code: false,
-                        window_options: {
-                            has_head: false,
-                            backdrop: true,
-                            close_on_backdrop_click: true,
-                            parent_center: true,
-                            // Phones/tablets pin every .window to one z-index
-                            // (style.css), which puts the fullpage dashboard
-                            // above this dialog's backdrop wrapper; stay_on_top
-                            // lifts the dialog into the 99999999+ band like
-                            // every other backdropped dashboard dialog.
-                            stay_on_top: true,
-                        },
+                        closeOnBackdrop: true,
                     });
                 },
             });
@@ -911,16 +901,8 @@ async function UIDashboard (options) {
             // Contact Us
             {
                 html: i18n('contact_us'),
-                onClick: async function () {
-                    UIWindowFeedback({
-                        window_options: {
-                            backdrop: true,
-                            close_on_backdrop_click: true,
-                            parent_center: true,
-                            stay_on_top: true,
-                            has_head: false,
-                        },
-                    });
+                onClick: function () {
+                    UIDashboardContactDialog({ $container: $el_window, returnFocusTo: $btn.get(0) });
                 },
             },
             '-',

src/gui/src/UI/Dashboard/UIDashboardContactDialog.js

@@ -0,0 +1,277 @@
+/*
+ * Copyright (C) 2024-present Puter Technologies Inc.
+ *
+ * This file is part of Puter.
+ *
+ * Puter is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published
+ * by the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <https://www.gnu.org/licenses/>.
+ */
+
+// The dashboard's Contact Us form: a dashboard form dialog with screenshots
+// and screen recordings attached by picking, dropping or pasting them. The
+// desktop keeps UIWindowFeedback.
+
+import {
+    ATTACHMENT_ACCEPT_ATTRIBUTE,
+    MAX_ATTACHMENTS,
+    MAX_ATTACHMENT_BYTES,
+    MAX_TOTAL_ATTACHMENT_BYTES,
+    checkAttachment,
+} from '../../helpers/contact_attachments.js';
+import { isTouchPrimaryDevice } from './ContextMenu/ContextMenu.js';
+import { ICONS, SVG } from './UIDashboardDialog.js';
+import UIDashboardFormDialog from './UIDashboardFormDialog.js';
+
+const MB = 1024 * 1024;
+
+// Keep in sync with SystemController on the backend.
+const MESSAGE_MAX_LENGTH = 100_000;
+
+// Numbers interpolated into each error message, taken from the enforced limits.
+const ERROR_VALUES = {
+    contact_us_attachment_too_many: [MAX_ATTACHMENTS],
+    contact_us_attachment_too_large: [MAX_ATTACHMENT_BYTES / MB],
+    contact_us_attachment_total_too_large: [MAX_TOTAL_ATTACHMENT_BYTES / MB],
+};
+
+const CONTACT_ICONS = {
+    attach: SVG('<path d="M21.4 11.1l-9.2 9.2a6 6 0 0 1-8.5-8.5l9.2-9.2a4 4 0 0 1 5.7 5.7l-9.2 9.2a2 2 0 0 1-2.8-2.8l8.5-8.5"/>'),
+    video: SVG('<rect x="2" y="5" width="14" height="14" rx="2"/><path d="M16 10l6-3.5v11L16 14"/>'),
+};
+
+const t = (key, values = []) => i18n(key, values, false);
+
+/**
+ * Whether a drag carries files, rather than text or a link from the page.
+ *
+ * @param {DragEvent} e
+ * @returns {boolean}
+ */
+const dragHasFiles = (e) => Array.from(e.originalEvent?.dataTransfer?.types ?? []).includes('Files');
+
+/**
+ * @param {File} file
+ * @returns {string}
+ */
+const attachmentHtml = (file) => {
+    const name = html_encode(file.name);
+    // The preview's URL is let go once it has drawn; the <img> keeps the pixels.
+    const thumb = file.type.startsWith('image/')
+        ? `<img src="${html_encode(URL.createObjectURL(file))}" alt="" draggable="false">`
+        : CONTACT_ICONS.video;
+    const remove = html_encode(t('contact_us_attachment_remove_named', [file.name]));
+    return '<li class="dashboard-contact-file">'
+        + `<span class="dashboard-contact-file-thumb" aria-hidden="true">${thumb}</span>`
+        + '<span class="dashboard-contact-file-text">'
+        + `<span class="dashboard-contact-file-name" title="${name}">${name}</span>`
+        + `<span class="dashboard-contact-file-size">${html_encode(window.byte_format(file.size))}</span>`
+        + '</span>'
+        + `<button type="button" class="dashboard-contact-file-remove" aria-label="${remove}" title="${i18n('contact_us_attachment_remove')}">${ICONS.close}</button>`
+        + '</li>';
+};
+
+/**
+ * Opens the Contact Us form; the message goes to support, with any
+ * attachments as multipart form data. The checks here only fail fast: the
+ * server enforces the limits.
+ *
+ * @param {object} [opts]
+ * @param {jQuery} [opts.$container] Where the overlay mounts.
+ * @param {HTMLElement} [opts.returnFocusTo] Where focus goes on close.
+ * @returns {import('./UIDashboardFormDialog.js').FormDialog}
+ */
+export default function UIDashboardContactDialog ({ $container, returnFocusTo } = {}) {
+    /** @type {File[]} */
+    const attachments = [];
+    let sending = false;
+    // Once sent, the form is gone and a drop or paste has nothing to join.
+    let sent = false;
+
+    const dialog = UIDashboardFormDialog({
+        $container,
+        returnFocusTo,
+        title: t('contact_us'),
+        intro: `<p>${i18n('feedback_c2a')}</p>`,
+        submitLabel: t('send'),
+        fields: [{
+            name: 'message',
+            type: 'textarea',
+            label: i18n('contact_us_message'),
+            placeholder: i18n('contact_us_message_placeholder'),
+            attrs: { rows: 6, maxlength: MESSAGE_MAX_LENGTH },
+        }],
+        async onSubmit () {
+            const { message } = dialog.values();
+            if ( ! message.trim() ) {
+                dialog.setStatus(t('contact_us_message_required'), { field: 'message' });
+                return;
+            }
+
+            setSending(true);
+            try {
+                const body = new FormData();
+                body.append('message', message);
+                for ( const file of attachments ) body.append('attachments', file, file.name);
+
+                // No Content-Type: the browser sets it with the boundary.
+                const resp = await fetch(`${window.api_origin}/contactUs`, {
+                    method: 'POST',
+                    headers: { Authorization: `Bearer ${window.auth_token}` },
+                    body,
+                });
+                if ( ! resp.ok ) {
+                    dialog.setStatus(t(resp.status === 429 ? 'contact_us_rate_limited' : 'contact_us_error'));
+                    return;
+                }
+                sent = true;
+                dialog.finish({ message: t('feedback_sent_confirmation') });
+            } catch ( err ) {
+                console.error('contact-us: submit failed', err);
+                dialog.setStatus(t('contact_us_error'));
+            } finally {
+                setSending(false);
+            }
+        },
+    });
+
+    const { $dialog } = dialog;
+    const $overlay = $dialog.parent();
+    const hint_id = `${$dialog.attr('aria-labelledby')}-attach-hint`;
+
+    let h = '<div class="dashboard-contact-attachments">';
+    h += `<input type="file" class="dashboard-contact-file-input" accept="${html_encode(ATTACHMENT_ACCEPT_ATTRIBUTE)}" multiple hidden tabindex="-1">`;
+    h += `<button type="button" class="dashboard-contact-dropzone" aria-describedby="${hint_id}">`;
+    h += `<span class="dashboard-contact-dropzone-icon" aria-hidden="true">${CONTACT_ICONS.attach}</span>`;
+    h += '<span class="dashboard-contact-dropzone-text">';
+    h += `<span class="dashboard-contact-dropzone-label">${i18n(isTouchPrimaryDevice() ? 'contact_us_attach' : 'contact_us_attach_or_drop')}</span>`;
+    h += `<span class="dashboard-contact-dropzone-drop" aria-hidden="true">${i18n('contact_us_drop_to_attach')}</span>`;
+    h += `<span class="dashboard-contact-dropzone-hint" id="${hint_id}">${i18n('contact_us_attach_hint', [MAX_ATTACHMENTS, MAX_ATTACHMENT_BYTES / MB])}</span>`;
+    h += '</span>';
+    h += '</button>';
+    h += `<ul class="dashboard-contact-files" aria-label="${i18n('contact_us_attachments')}" hidden></ul>`;
+    h += '</div>';
+    $dialog.addClass('dashboard-contact-dialog')
+        .find('.dashboard-form-field[data-field="message"]').after(h);
+
+    const $dropzone = $dialog.find('.dashboard-contact-dropzone');
+    const $fileInput = $dialog.find('.dashboard-contact-file-input');
+    const $list = $dialog.find('.dashboard-contact-files');
+
+    const syncControls = () => {
+        $list.prop('hidden', attachments.length === 0);
+        // Nothing left to add once the count cap is reached.
+        $dropzone.prop('disabled', sending || attachments.length >= MAX_ATTACHMENTS);
+        $list.find('.dashboard-contact-file-remove').prop('disabled', sending);
+    };
+
+    function setSending (value) {
+        sending = value;
+        $dialog.toggleClass('dashboard-contact-sending', value);
+        syncControls();
+    }
+
+    /** @param {File[]} files */
+    const addFiles = (files) => {
+        if ( sending || sent || ! files.length ) return;
+        let rejection = null;
+        for ( const file of files ) {
+            const verdict = checkAttachment(file, attachments);
+            if ( ! verdict.ok ) {
+                // Report the first rejection but keep the files that fit.
+                rejection = rejection ?? verdict.error;
+                continue;
+            }
+            attachments.push(file);
+            const $item = $(attachmentHtml(file));
+            $item.find('img').one('load error', function () {
+                URL.revokeObjectURL(this.src);
+            });
+            $list.append($item);
+        }
+        dialog.setStatus(rejection ? t(rejection, ERROR_VALUES[rejection] ?? []) : '');
+        syncControls();
+    };
+
+    $dropzone.on('click', () => $fileInput.trigger('click'));
+    $fileInput.on('change', function () {
+        addFiles(Array.from(this.files ?? []));
+        // Reset so re-picking the same file fires `change` again.
+        this.value = '';
+    });
+
+    $list.on('click', '.dashboard-contact-file-remove', function () {
+        if ( sending ) return;
+        const $item = $(this).closest('.dashboard-contact-file');
+        const index = $list.children().index($item);
+        attachments.splice(index, 1);
+        // Focus stays in the list rather than falling back to the page.
+        const $next = $item.next().length ? $item.next() : $item.prev();
+        $item.remove();
+        dialog.setStatus('');
+        syncControls();
+        ($next.length ? $next.find('.dashboard-contact-file-remove') : $dropzone).get(0)?.focus({ preventScroll: true });
+    });
+
+    // The whole overlay takes the drop, and keeps it from the window under it.
+    let drag_depth = 0;
+    const endDrag = () => {
+        drag_depth = 0;
+        $dialog.removeClass('dashboard-contact-dragging');
+    };
+    $overlay.on('dragenter', (e) => {
+        if ( ! dragHasFiles(e) ) return;
+        e.preventDefault();
+        e.stopPropagation();
+        drag_depth++;
+        if ( ! sending && ! sent ) $dialog.addClass('dashboard-contact-dragging');
+    });
+    $overlay.on('dragover', (e) => {
+        if ( ! dragHasFiles(e) ) return;
+        e.preventDefault();
+        e.stopPropagation();
+        e.originalEvent.dataTransfer.dropEffect = sending || sent ? 'none' : 'copy';
+    });
+    $overlay.on('dragleave', (e) => {
+        // Matched to the dragenters counted, whatever this one says it carries.
+        if ( drag_depth === 0 ) return;
+        e.stopPropagation();
+        if ( --drag_depth <= 0 ) endDrag();
+    });
+    $overlay.on('drop', (e) => {
+        if ( ! dragHasFiles(e) ) return;
+        e.preventDefault();
+        e.stopPropagation();
+        endDrag();
+        addFiles(Array.from(e.originalEvent.dataTransfer.files ?? []));
+    });
+
+    // A screenshot pasted into the message is attached to it.
+    $dialog.on('paste', '.dashboard-form-input[name="message"]', (e) => {
+        const clipboard = e.originalEvent?.clipboardData;
+        const files = Array.from(clipboard?.files ?? []);
+        if ( ! files.length ) return;
+        // Some apps put the image's name or markup alongside it; that text still pastes.
+        if ( ! clipboard.getData('text/plain') ) e.preventDefault();
+        addFiles(files);
+    });
+
+    // Enter alone is a new line in the message; with Cmd or Ctrl, it sends.
+    $dialog.on('keydown', '.dashboard-form-input[name="message"]', (e) => {
+        if ( e.key !== 'Enter' || ! (e.metaKey || e.ctrlKey) ) return;
+        e.preventDefault();
+        $dialog.trigger('submit');
+    });
+
+    syncControls();
+    return dialog;
+}

src/gui/src/UI/Dashboard/UIDashboardContactDialog.test.js

@@ -0,0 +1,255 @@
+// @vitest-environment jsdom
+/*
+ * Copyright (C) 2024-present Puter Technologies Inc.
+ *
+ * This file is part of Puter.
+ *
+ * Puter is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published
+ * by the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <https://www.gnu.org/licenses/>.
+ */
+import { beforeEach, describe, expect, it, vi } from 'vitest';
+import jQuery from '../../lib/jquery-3.6.1/jquery-3.6.1.min.js';
+import { MAX_ATTACHMENTS } from '../../helpers/contact_attachments.js';
+
+globalThis.$ = jQuery;
+globalThis.jQuery = jQuery;
+globalThis.i18n = (key, values = []) => [key, ...values].join(' ');
+globalThis.html_encode = (value) => String(value ?? '')
+    .replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;').replace(/"/g, '&quot;');
+window.html_encode = globalThis.html_encode;
+window.requestAnimationFrame = (fn) => setTimeout(fn, 0);
+window.matchMedia = () => ({ matches: false });
+window.byte_format = (bytes) => `${bytes} B`;
+URL.createObjectURL = vi.fn(() => 'blob:preview');
+URL.revokeObjectURL = vi.fn();
+
+const { default: UIDashboardContactDialog } = await import('./UIDashboardContactDialog.js');
+
+const settle = async () => {
+    for ( let i = 0; i < 10; i++ ) await new Promise(resolve => setTimeout(resolve, 0));
+};
+const message = () => $('.dashboard-form-input[name="message"]');
+const status = () => $('.dashboard-form-status').text();
+const fileNames = () => $('.dashboard-contact-file-name').map((_, el) => el.textContent).get();
+const png = (name = 'shot.png', size = 1024) => new File([new Uint8Array(size)], name, { type: 'image/png' });
+const mp4 = (name = 'clip.mp4') => new File([new Uint8Array(2048)], name, { type: 'video/mp4' });
+
+/** Picks files through the hidden file input, as the system picker would. */
+const pick = (...files) => {
+    const input = $('.dashboard-contact-file-input').get(0);
+    Object.defineProperty(input, 'files', { value: files, configurable: true });
+    $(input).trigger('change');
+};
+
+/** A native-event stand-in for jQuery to wrap, carrying `fields`. */
+const nativeEvent = (fields) => ({ preventDefault () {}, stopPropagation () {}, ...fields });
+
+/** A file drag event carrying `files`, as the browser sends it. */
+const fileDrag = (type, files = []) => $.Event(type, {
+    originalEvent: nativeEvent({ dataTransfer: { types: ['Files'], files, dropEffect: 'none' } }),
+});
+
+const submit = async () => {
+    $('.dashboard-form-dialog').trigger('submit');
+    await settle();
+};
+
+beforeEach(() => {
+    document.body.innerHTML = '';
+    globalThis.fetch = vi.fn(async () => new Response('{}', { status: 200 }));
+    window.api_origin = 'https://api.puter.test';
+    window.auth_token = 'tok-1';
+});
+
+describe('Contact Us dialog', () => {
+    it('opens as a dashboard form dialog with no attachments listed', () => {
+        UIDashboardContactDialog();
+        expect($('.dashboard-dialog-overlay .dashboard-contact-dialog').length).toBe(1);
+        expect(message().length).toBe(1);
+        expect($('.dashboard-contact-files').prop('hidden')).toBe(true);
+    });
+
+    it('asks for a message before sending', async () => {
+        UIDashboardContactDialog();
+        message().val('   ');
+        await submit();
+        expect(fetch).not.toHaveBeenCalled();
+        expect(status()).toBe('contact_us_message_required');
+        expect(message().attr('aria-invalid')).toBe('true');
+    });
+
+    it('posts the message and attachments as multipart and confirms', async () => {
+        UIDashboardContactDialog();
+        pick(png(), mp4());
+        message().val('It broke');
+        await submit();
+
+        const [url, init] = fetch.mock.calls[0];
+        expect(url).toBe('https://api.puter.test/contactUs');
+        expect(init.headers).toEqual({ Authorization: 'Bearer tok-1' });
+        expect(init.body.get('message')).toBe('It broke');
+        expect(init.body.getAll('attachments').map(f => f.name)).toEqual(['shot.png', 'clip.mp4']);
+        expect($('.dashboard-form-done').text()).toContain('feedback_sent_confirmation');
+        expect($('.dashboard-contact-attachments').length).toBe(0);
+    });
+
+    it('says when the sender is rate limited and keeps the form', async () => {
+        fetch.mockResolvedValueOnce(new Response('{}', { status: 429 }));
+        UIDashboardContactDialog();
+        message().val('Hello');
+        await submit();
+        expect(status()).toBe('contact_us_rate_limited');
+        expect(message().val()).toBe('Hello');
+        expect(message().prop('disabled')).toBe(false);
+    });
+
+    it('shows a generic error when the request fails', async () => {
+        fetch.mockRejectedValueOnce(new TypeError('offline'));
+        vi.spyOn(console, 'error').mockImplementation(() => {});
+        UIDashboardContactDialog();
+        message().val('Hello');
+        await submit();
+        expect(status()).toBe('contact_us_error');
+    });
+
+    it('locks the attachments while sending', async () => {
+        let respond;
+        fetch.mockReturnValueOnce(new Promise(resolve => {
+            respond = resolve;
+        }));
+        UIDashboardContactDialog();
+        pick(png());
+        message().val('Hello');
+        $('.dashboard-form-dialog').trigger('submit');
+        await settle();
+
+        expect($('.dashboard-contact-dropzone').prop('disabled')).toBe(true);
+        expect($('.dashboard-contact-file-remove').prop('disabled')).toBe(true);
+        pick(png('late.png'));
+        expect(fileNames()).toEqual(['shot.png']);
+
+        respond(new Response('{}', { status: 500 }));
+        await settle();
+        expect($('.dashboard-contact-dropzone').prop('disabled')).toBe(false);
+        expect($('.dashboard-contact-file-remove').prop('disabled')).toBe(false);
+    });
+});
+
+describe('attachments', () => {
+    it('lists picked files with a preview for images', () => {
+        UIDashboardContactDialog();
+        pick(png('a.png'), mp4('b.mp4'));
+        expect(fileNames()).toEqual(['a.png', 'b.mp4']);
+        expect($('.dashboard-contact-files').prop('hidden')).toBe(false);
+        expect($('.dashboard-contact-file').eq(0).find('img').attr('src')).toBe('blob:preview');
+        expect($('.dashboard-contact-file').eq(1).find('img').length).toBe(0);
+        expect($('.dashboard-contact-file-remove').eq(0).attr('aria-label')).toBe('contact_us_attachment_remove_named a.png');
+    });
+
+    it('keeps the files that fit and reports the first rejection', () => {
+        UIDashboardContactDialog();
+        const text = new File(['x'], 'notes.txt', { type: 'text/plain' });
+        pick(png('a.png'), text, png('b.png'));
+        expect(fileNames()).toEqual(['a.png', 'b.png']);
+        expect(status()).toBe('contact_us_attachment_unsupported');
+    });
+
+    it('stops offering to attach once the count cap is reached', () => {
+        UIDashboardContactDialog();
+        pick(...Array.from({ length: MAX_ATTACHMENTS }, (_, i) => png(`${i}.png`)));
+        expect($('.dashboard-contact-dropzone').prop('disabled')).toBe(true);
+        pick(png('extra.png'));
+        expect(fileNames()).toHaveLength(MAX_ATTACHMENTS);
+        expect(status()).toBe(`contact_us_attachment_too_many ${MAX_ATTACHMENTS}`);
+    });
+
+    it('removes the file whose button is pressed and moves focus to the next one', async () => {
+        UIDashboardContactDialog();
+        pick(png('a.png'), png('b.png'), png('c.png'));
+        $('.dashboard-contact-file-remove').eq(1).trigger('click');
+        expect(fileNames()).toEqual(['a.png', 'c.png']);
+        expect(document.activeElement).toBe($('.dashboard-contact-file-remove').get(1));
+
+        message().val('Hello');
+        await submit();
+        expect(fetch.mock.calls[0][1].body.getAll('attachments').map(f => f.name)).toEqual(['a.png', 'c.png']);
+    });
+
+    it('returns focus to the attach button when the last file is removed', () => {
+        UIDashboardContactDialog();
+        pick(png());
+        $('.dashboard-contact-file-remove').trigger('click');
+        expect($('.dashboard-contact-files').prop('hidden')).toBe(true);
+        expect(document.activeElement).toBe($('.dashboard-contact-dropzone').get(0));
+    });
+
+    it('takes files dropped anywhere on the overlay, without letting the drop through', () => {
+        const onWindowDrop = vi.fn();
+        const $win = $('<div class="window"></div>').appendTo('body').on('drop', onWindowDrop);
+        UIDashboardContactDialog({ $container: $win });
+        const $overlay = $('.dashboard-dialog-overlay');
+
+        $overlay.trigger(fileDrag('dragenter'));
+        expect($('.dashboard-contact-dialog').hasClass('dashboard-contact-dragging')).toBe(true);
+        const drop = fileDrag('drop', [png('dropped.png')]);
+        $overlay.trigger(drop);
+
+        expect(drop.isDefaultPrevented()).toBe(true);
+        expect(onWindowDrop).not.toHaveBeenCalled();
+        expect(fileNames()).toEqual(['dropped.png']);
+        expect($('.dashboard-contact-dialog').hasClass('dashboard-contact-dragging')).toBe(false);
+    });
+
+    it('clears the drop highlight when the drag leaves', () => {
+        UIDashboardContactDialog();
+        const $overlay = $('.dashboard-dialog-overlay');
+        $overlay.trigger(fileDrag('dragenter'));
+        $overlay.find('.dashboard-contact-dropzone').trigger(fileDrag('dragenter'));
+        $overlay.find('.dashboard-contact-dropzone').trigger($.Event('dragleave', { originalEvent: nativeEvent({}) }));
+        expect($('.dashboard-contact-dialog').hasClass('dashboard-contact-dragging')).toBe(true);
+        $overlay.trigger($.Event('dragleave', { originalEvent: nativeEvent({}) }));
+        expect($('.dashboard-contact-dialog').hasClass('dashboard-contact-dragging')).toBe(false);
+    });
+
+    it('ignores drags that carry no files', () => {
+        UIDashboardContactDialog();
+        const drag = $.Event('dragenter', { originalEvent: nativeEvent({ dataTransfer: { types: ['text/plain'] } }) });
+        $('.dashboard-dialog-overlay').trigger(drag);
+        expect(drag.isDefaultPrevented()).toBe(false);
+        expect($('.dashboard-contact-dialog').hasClass('dashboard-contact-dragging')).toBe(false);
+    });
+
+    it('attaches an image pasted into the message', () => {
+        UIDashboardContactDialog();
+        const paste = $.Event('paste', {
+            originalEvent: nativeEvent({ clipboardData: { files: [png('pasted.png')], getData: () => '' } }),
+        });
+        message().trigger(paste);
+        expect(fileNames()).toEqual(['pasted.png']);
+        expect(paste.isDefaultPrevented()).toBe(true);
+    });
+});
+
+describe('keyboard', () => {
+    it('sends on Cmd/Ctrl+Enter but not on Enter alone', async () => {
+        UIDashboardContactDialog();
+        message().val('Hello');
+        message().trigger($.Event('keydown', { key: 'Enter' }));
+        await settle();
+        expect(fetch).not.toHaveBeenCalled();
+
+        message().trigger($.Event('keydown', { key: 'Enter', ctrlKey: true }));
+        await settle();
+        expect(fetch).toHaveBeenCalledTimes(1);
+    });
+});

src/gui/src/UI/Dashboard/UIDashboardFormDialog.js

@@ -76,7 +76,14 @@ const attrs_html = (attrs) => Object.entries(attrs ?? {})
     .map(([key, value]) => (value === true ? ` ${key}` : ` ${key}="${html_encode(String(value))}"`))
     .join('');
 
-const field_html = (field, id) => {
+/**
+ * A labelled form field's markup, as the form dialog draws it.
+ *
+ * @param {FormDialogField} field
+ * @param {string} id Prefix for the control's id, unique to the dialog.
+ * @returns {string}
+ */
+export const formFieldHtml = (field, id) => {
     const control_id = `${id}-${field.name}`;
     const hint_id = `${control_id}-hint`;
     const suffix_id = `${control_id}-suffix`;
@@ -127,6 +134,25 @@ const field_html = (field, id) => {
         + '</div>';
 };
 
+/**
+ * Wires the show/hide toggles of the password fields under `$root`.
+ *
+ * @param {jQuery} $root
+ */
+export const bindPasswordReveal = ($root) => {
+    // Keep the field focused (and a phone's keyboard up) while toggling. The
+    // label names the action, so the button carries no aria-pressed as well.
+    $root.on('pointerdown mousedown', '.dashboard-form-reveal', (e) => e.preventDefault());
+    $root.on('click', '.dashboard-form-reveal', function () {
+        const $input = $(this).siblings('input');
+        const reveal = $input.attr('type') === 'password';
+        const label = i18n(reveal ? 'hide_password' : 'show_password', [], false);
+        $input.attr('type', reveal ? 'text' : 'password');
+        $(this).attr({ 'aria-label': label, title: label })
+            .html(reveal ? FORM_ICONS.hide : FORM_ICONS.show);
+    });
+};
+
 /**
  * A read-only value with a Copy button, for a `finish` screen. The dialog
  * wires the button.
@@ -179,7 +205,7 @@ export default function UIDashboardFormDialog ({ title, intro, tone, fields = []
     if ( danger ) h += `<div class="dashboard-dialog-icon">${ICONS.danger}</div>`;
     h += '<div class="dashboard-dialog-content">';
     if ( intro ) h += `<div class="dashboard-dialog-message" id="${id}-intro">${intro}</div>`;
-    h += fields.map((field) => field_html(field, id)).join('');
+    h += fields.map((field) => formFieldHtml(field, id)).join('');
     h += '<div class="dashboard-form-status" role="status" aria-live="polite"></div>';
     h += '</div></div>';
     h += '<div class="dashboard-dialog-footer">';
@@ -317,17 +343,7 @@ export default function UIDashboardFormDialog ({ title, intro, tone, fields = []
         input.setSelectionRange(input.value.length, input.value.length);
     });
 
-    // Keep the field focused (and a phone's keyboard up) while toggling. The
-    // label names the action, so the button carries no aria-pressed as well.
-    $dialog.on('pointerdown mousedown', '.dashboard-form-reveal', (e) => e.preventDefault());
-    $dialog.on('click', '.dashboard-form-reveal', function () {
-        const $input = $(this).siblings('input');
-        const reveal = $input.attr('type') === 'password';
-        const label = i18n(reveal ? 'hide_password' : 'show_password', [], false);
-        $input.attr('type', reveal ? 'text' : 'password');
-        $(this).attr({ 'aria-label': label, title: label })
-            .html(reveal ? FORM_ICONS.hide : FORM_ICONS.show);
-    });
+    bindPasswordReveal($dialog);
 
     $dialog.on('submit', async (e) => {
         e.preventDefault();

src/gui/src/UI/Dashboard/UIDashboardNotifications.js

@@ -33,6 +33,7 @@ import { startPushWorker } from '../../helpers/pushWorker.js';
 import { syncBrowserPush } from '../../helpers/pushSync.js';
 import { get_app_by_uid } from '../../helpers/getAppByUid.js';
 import launch_app from '../../helpers/launchApp.js';
+import { runLimited } from '../../helpers/runLimited.js';
 import {
     badgeLabel,
     glyphKey,
@@ -46,6 +47,7 @@ import {
     senderNameFor,
     setReadAt,
     takeMarksSince,
+    titleBadge,
     titleWithBadge,
     toEntry,
     unreadCount,
@@ -144,27 +146,6 @@ const whenFilesIdle = async (filesTab, timeoutMs = 4_000) => {
     }
 };
 
-/**
- * Run `task` over `items`, at most `limit` at a time. Resolves to the items
- * whose task rejected.
- */
-const runLimited = async (items, limit, task) => {
-    const failed = [];
-    let index = 0;
-    const worker = async () => {
-        while ( index < items.length ) {
-            const item = items[index++];
-            try {
-                await task(item);
-            } catch {
-                failed.push(item);
-            }
-        }
-    };
-    await Promise.all(Array.from({ length: Math.min(limit, items.length) }, worker));
-    return failed;
-};
-
 /**
  * The dashboard's notification center: a bell in the sidebar with the unread
  * count, a panel listing the most recent notifications read or not, and
@@ -360,7 +341,26 @@ export default function UIDashboardNotifications ({ $el_window, socket }) {
         target.focus({ preventScroll: true });
     };
 
+    // The badge last put in front of the title, the only prefix replaced.
+    let appliedBadge = '';
+    const applyTitleBadge = () => {
+        const count = unreadCount(entries);
+        const wanted = titleWithBadge(document.title, count, appliedBadge);
+        appliedBadge = titleBadge(count);
+        if ( document.title !== wanted ) document.title = wanted;
+    };
+
+    // Changes made in other tabs arrive one socket event per notification
+    // (Mark all read there sends one ack each), so they redraw once a beat.
+    // Not a frame: a hidden tab's title still carries the count.
+    let renderTimer = null;
+    const scheduleRender = () => {
+        renderTimer ??= setTimeout(render, 50);
+    };
+
     const render = () => {
+        clearTimeout(renderTimer);
+        renderTimer = null;
         const hadFocus = $panel[0].contains(document.activeElement);
         const count = unreadCount(entries);
         const label = badgeLabel(count);
@@ -373,7 +373,7 @@ export default function UIDashboardNotifications ({ $el_window, socket }) {
         $sidebarToggle.toggleClass('has-unread', count > 0);
         $count.text(label);
         $markAll.attr('hidden', count > 0 ? null : '');
-        document.title = titleWithBadge(document.title, count);
+        applyTitleBadge();
 
         const showLoading = ! loaded && loading !== null;
         const showError = ! loaded && loadFailed && loading === null;
@@ -582,9 +582,12 @@ export default function UIDashboardNotifications ({ $el_window, socket }) {
             timeout: TOAST_TIMEOUT_MS,
             // With nothing to open on the dashboard, a click only dismisses;
             // it mustn't send the apps the user is working in away.
+            // A regrouped notification rewrites the toast under the same uid,
+            // so a click acts on what it says now.
             click: () => {
-                if ( notificationTarget(notification) === null ) void markRead(entry.uid);
-                else void reveal_dashboard().then(() => actOn(entry));
+                const current = entries.find((e) => e.uid === entry.uid) ?? entry;
+                if ( notificationTarget(current.notification) === null ) void markRead(current.uid);
+                else void reveal_dashboard().then(() => actOn(current));
             },
             // The ✕ is a dismissal; timing out is not, so `close` alone acks.
             close: () => void markRead(entry.uid),
@@ -798,10 +801,8 @@ export default function UIDashboardNotifications ({ $el_window, socket }) {
     // same title again is a no-op, so this can't loop.
     const titleEl = document.querySelector('title');
     if ( titleEl ) {
-        new MutationObserver(() => {
-            const wanted = titleWithBadge(document.title, unreadCount(entries));
-            if ( document.title !== wanted ) document.title = wanted;
-        }).observe(titleEl, { childList: true, characterData: true, subtree: true });
+        new MutationObserver(applyTitleBadge)
+            .observe(titleEl, { childList: true, characterData: true, subtree: true });
     }
 
     // -- Arrivals -----------------------------------------------------------------
@@ -840,7 +841,7 @@ export default function UIDashboardNotifications ({ $el_window, socket }) {
         acked.set(uid, now);
         if ( ! entries.some((e) => e.uid === uid && isUnread(e)) ) return;
         entries = setReadAt(entries, uid, now);
-        render();
+        scheduleRender();
     });
     // Removed in another tab. Not gated, for the same reason as the ack.
     socket.on('notif.removed', ({ uid }) => {
@@ -848,7 +849,7 @@ export default function UIDashboardNotifications ({ $el_window, socket }) {
         removed.set(uid, Date.now());
         const listed = entries.some((e) => e.uid === uid);
         dropEntry(uid);
-        if ( listed ) render();
+        if ( listed ) scheduleRender();
     });
     // Every (re)connection: anything read elsewhere while this tab was
     // offline is marked so in the server's list, and anything new is in it.

src/gui/src/UI/Dashboard/UIItemPropertiesModal.js

@@ -291,10 +291,24 @@ export default function UIItemPropertiesModal ({ name, path: item_path, uid, $co
                 const $link = $(this);
                 if ( $link.prop('disabled') ) return;
                 $link.prop('disabled', true);
-                puter.hosting.update($link.attr('data-subdomain'), null).then(() => {
+                const subdomain = $link.attr('data-subdomain');
+                puter.hosting.update(subdomain, null).then(() => {
                     const $entry = $link.closest('.item-props-website-entry');
                     const $row = $entry.closest('.item-props-row');
                     $entry.remove();
+                    // Rows inside the folder carry addresses under the site:
+                    // work them out again without it (another site may still
+                    // serve them).
+                    if ( Array.isArray(window.sites) ) {
+                        window.sites = window.sites.filter((site) => site.subdomain !== subdomain);
+                    }
+                    $('.item').each(function () {
+                        const path = this.dataset.path ?? '';
+                        if ( ! path.startsWith(`${item_path}/`) ) return;
+                        const url = window.determine_website_url?.(path) || '';
+                        $(this).attr('data-website_url', url)
+                            .find('.item-has-website-url-badge').css('display', url ? 'block' : 'none');
+                    });
                     // The focused button just left the DOM; keep focus in the dialog.
                     el_modal.focus({ preventScroll: true });
                     if ( $row.find('.item-props-website-entry').length > 0 ) return;

src/gui/src/UI/Dashboard/UIItemPropertiesModal.test.js

@@ -68,4 +68,40 @@ describe('UIItemPropertiesModal', () => {
         expect(window.update_sites_cache).toHaveBeenCalled();
         expect(puter._cache.del).toHaveBeenCalledWith('readdir:/alice');
     });
+
+    it('takes the site address off rows inside the folder, keeping one another site serves', async () => {
+        const fsentry = { uid: 'u1', name: 'site', path: '/alice/site', is_dir: true, has_website: true };
+        $('<div class="item" data-uid="u1" data-has_website="1"><img class="item-has-website-badge"></div>')
+            .data('fsentry', fsentry).appendTo('body');
+        const child = (path, url) => $(`<div class="item" data-path="${path}" data-website_url="${url}"><img class="item-has-website-url-badge" style="display:block"></div>`).appendTo('body');
+        const $inside = child('/alice/site/a.txt', 'https://mysite.puter.site/a.txt');
+        const $nested = child('/alice/site/docs/b.txt', 'https://docs.puter.site/b.txt');
+        const site = (subdomain, path) => ({ subdomain, root_dir: { path, subdomains: [{ subdomain, address: `https://${subdomain}.puter.site` }] } });
+        window.sites = [site('mysite', '/alice/site'), site('docs', '/alice/site/docs')];
+        window.determine_website_url = (path) => {
+            const match = window.sites.find((s) => path.startsWith(`${s.root_dir.path}/`));
+            return match ? `https://${match.subdomain}.puter.site${path.slice(match.root_dir.path.length)}` : null;
+        };
+        window.extractSubdomain = () => 'mysite';
+        window.update_sites_cache = vi.fn();
+        globalThis.puter = {
+            fs: { stat: vi.fn(({ success }) => {
+                success({ ...fsentry, id: 'u1', modified: 1700000000, created: 1700000000, subdomains: [{ uuid: 's1', address: 'https://mysite.puter.site' }] });
+                return Promise.resolve();
+            }) },
+            hosting: { update: vi.fn(async () => ({})) },
+            fsCacheKey: (kind, path) => `${kind}:${path}`,
+            _cache: { del: vi.fn() },
+        };
+
+        UIItemPropertiesModal({ name: 'site', path: '/alice/site', uid: 'u1' });
+        await tick();
+        $('.item-props-disassociate').trigger('click');
+        await tick();
+
+        expect($inside.attr('data-website_url')).toBe('');
+        expect($inside.find('.item-has-website-url-badge').css('display')).toBe('none');
+        expect($nested.attr('data-website_url')).toBe('https://docs.puter.site/b.txt');
+        expect($nested.find('.item-has-website-url-badge').css('display')).toBe('block');
+    });
 });

src/gui/src/UI/Dashboard/UIPublishDialogs.js

@@ -17,13 +17,14 @@
  * along with this program.  If not, see <https://www.gnu.org/licenses/>.
  */
 
-// The Files tab's publish flows, a folder as a website and a .js file as a
-// worker: dashboard form dialogs rather than desktop windows.
+// The Files tab's publish flows, a folder as a website (optionally on a
+// custom domain) and a .js file as a worker: dashboard form dialogs rather
+// than desktop windows.
 
 import ensure_can_publish from '../../helpers/ensureCanPublish.js';
 import forget_parent_listing from '../../helpers/forgetParentListing.js';
-import { SVG } from './UIDashboardDialog.js';
 import UIDashboardFormDialog, { copyRowHtml } from './UIDashboardFormDialog.js';
+import { openLinkHtml, publishDomainFields, setupPublishDomain } from './publishDomain.js';
 import { finalizePublishName, normalizePublishName, PUBLISH_NAME_RULES } from './publishName.js';
 
 /**
@@ -36,8 +37,6 @@ import { finalizePublishName, normalizePublishName, PUBLISH_NAME_RULES } from '.
 
 const t = (key) => i18n(key, [], false);
 
-const OPEN_ICON = SVG('<path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><path d="M15 3h6v6"/><path d="M10 14L21 3"/>');
-
 /** Rows showing `path` or anything under it, on the dashboard or the desktop. */
 const each_item_at = (path, fn) => $('.item').each(function () {
     const item_path = this.dataset.path ?? '';
@@ -54,6 +53,8 @@ const KINDS = {
         nameErrors: new Set(['conflict', 'subdomain_reserved']),
         suffix: () => `.${window.hosting_domain}`,
         requiresVerification: () => !! window.require_email_verification_to_publish_website,
+        extraFields: publishDomainFields,
+        setup: setupPublishDomain,
         async publish (name, path) {
             const site = await puter.hosting.create(name, path);
             // The server's address carries the deployment's real scheme (a
@@ -136,6 +137,11 @@ const open_publish_dialog = async (kind_name, { name, path, ...opts }) => {
     }];
     fields.push(...(kind.extraFields?.() ?? []));
 
+    /** Set once the site is live; a retry for a step after it skips publishing. */
+    let published = null;
+    /** @type {import('./publishDomain.js').PublishDomain | undefined} */
+    let extra;
+
     const dialog = UIDashboardFormDialog({
         ...opts,
         title: t(kind.title),
@@ -144,30 +150,52 @@ const open_publish_dialog = async (kind_name, { name, path, ...opts }) => {
         fields,
         async onSubmit () {
             const values = dialog.values();
-            const subdomain = finalizePublishName(values.name, kind.rule);
-            dialog.field('name').val(subdomain);
-            if ( ! subdomain ) {
-                dialog.setStatus(t('publish_name_required'), { field: 'name' });
-                return;
+            const hostname = extra?.prepare(!! published) ?? null;
+            if ( hostname === false ) return;
+            if ( ! published ) {
+                const subdomain = finalizePublishName(values.name, kind.rule);
+                dialog.field('name').val(subdomain);
+                if ( ! subdomain ) {
+                    dialog.setStatus(t('publish_name_required'), { field: 'name' });
+                    return;
+                }
+                let url;
+                try {
+                    url = await kind.publish(subdomain, path, values);
+                } catch ( err ) {
+                    const code = err?.error?.code ?? err?.code;
+                    dialog.setStatus(error_message(err), kind.nameErrors.has(code) ? { field: 'name' } : undefined);
+                    return;
+                }
+                kind.markPublished(path, url);
+                published = { name: subdomain, url };
+                // The address is taken now; what's left to retry is the domain.
+                dialog.field('name').prop('readOnly', true).attr('aria-readonly', 'true');
+                update_submit_label();
             }
-            let url;
-            try {
-                url = await kind.publish(subdomain, path, values);
-            } catch ( err ) {
-                const code = err?.error?.code ?? err?.code;
-                dialog.setStatus(error_message(err), kind.nameErrors.has(code) ? { field: 'name' } : undefined);
-                return;
-            }
-            kind.markPublished(path, url);
-            const open_link = `<a class="dashboard-dialog-btn dashboard-dialog-btn-quiet dashboard-icon-btn dashboard-publish-open" href="${html_encode(url)}"`
-                + ` target="_blank" rel="noopener noreferrer" aria-label="${i18n('open_in_new_tab')}" title="${i18n('open_in_new_tab')}">${OPEN_ICON}</a>`;
+            const domain = hostname ? await extra.attach(hostname, published) : null;
+            if ( hostname && ! domain ) return;
             dialog.finish({
                 message: t(kind.published),
-                html: copyRowHtml({ value: url, label: t('publish_address'), compact: true, after: open_link }),
+                html: copyRowHtml({ value: published.url, label: t('publish_address'), compact: true, after: openLinkHtml(published.url) })
+                    + (domain ? extra.doneHtml(domain) : ''),
+                // The DNS records are shown only here.
+                keepOnBackdrop: !! domain,
             });
         },
     });
 
+    // Before the site is live the button publishes; after, it adds the domain.
+    const update_submit_label = () => {
+        let key = 'publish';
+        if ( published ) {
+            if ( extra?.claiming() ) key = 'custom_domain_verify_and_add';
+            else key = extra?.addable() ? 'custom_domain_add' : 'done';
+        }
+        dialog.$dialog.find('.dashboard-form-submit-label').text(t(key));
+    };
+    extra = kind.setup?.(dialog, { onChange: update_submit_label });
+
     // Shape the name as it's typed, keeping the caret where it was.
     const el_name = dialog.field('name').get(0);
     if ( document.activeElement === el_name ) el_name.select();

src/gui/src/UI/Dashboard/UIPublishDialogs.test.js

@@ -35,13 +35,59 @@ const { openPublishWebsiteDialog, openPublishWorkerDialog } = await import('./UI
 const { default: ensure_can_publish } = await import('../../helpers/ensureCanPublish.js');
 
 const settle = () => new Promise(resolve => setTimeout(resolve, 0));
+const flush = async () => {
+    for ( let i = 0; i < 5; i++ ) await settle();
+};
 const nameField = () => $('.dashboard-form-input[name="name"]');
 const status = () => $('.dashboard-form-status').text();
 
 const submitWith = async (name) => {
     if ( name !== undefined ) nameField().val(name);
     $('.dashboard-form-dialog').trigger('submit');
-    for ( let i = 0; i < 5; i++ ) await settle();
+    await flush();
+};
+
+const json = (code, data) => new Response(JSON.stringify(data), {
+    status: code,
+    headers: { 'Content-Type': 'application/json' },
+});
+
+/**
+ * Stands in for the `/custom-domains` API. The list call answers with
+ * `list`; anything else with its entry in `routes` (keyed `METHOD /path`),
+ * or a 404.
+ */
+const serveDomains = ({ list = { items: [], canAdd: true, pricing: { amount: 0.5, currency: 'USD' } }, routes = {} } = {}) => {
+    globalThis.fetch = vi.fn(async (url, opts = {}) => {
+        const key = `${opts.method ?? 'GET'} ${String(url).split('/custom-domains')[1]}`;
+        if ( key === 'GET ' ) return json(200, typeof list === 'function' ? list() : list);
+        return routes[key]?.(opts.body ? JSON.parse(opts.body) : undefined) ?? json(404, {});
+    });
+};
+const requests = (method) => fetch.mock.calls
+    .filter(([, opts = {}]) => (opts.method ?? 'GET') === method)
+    .map(([url, opts]) => ({ path: String(url).split('/custom-domains')[1], body: opts.body ? JSON.parse(opts.body) : undefined }));
+
+const pendingDomain = (overrides = {}) => ({
+    uuid: 'd1',
+    hostname: 'www.example.com',
+    site: 'my-site',
+    status: 'pending',
+    isApex: false,
+    records: [{ type: 'CNAME', name: 'www', value: 'my-site.puter.site', purpose: 'routing', required: true }],
+    ...overrides,
+});
+
+const domainSwitch = () => $('.dashboard-form-input[name="useDomain"]');
+const domainField = () => $('.dashboard-form-input[name="domain"]');
+const shown = (name) => $(`.dashboard-form-field[data-field="${name}"]`).prop('hidden') === false;
+const submitLabel = () => $('.dashboard-form-submit-label').text();
+const turnOnDomain = () => domainSwitch().prop('checked', true).trigger('change');
+
+/** Opens the website dialog and waits for the custom domain list. */
+const openWebsite = async () => {
+    await openPublishWebsiteDialog({ name: 'Site', path: '/alice/Site' });
+    await flush();
 };
 
 const addRow = (path) => {
@@ -59,6 +105,10 @@ beforeEach(() => {
     window.generate_identifier = () => 'clever-idea-42';
     window.update_sites_cache = vi.fn();
     window.require_email_verification_to_publish_website = false;
+    window.api_origin = 'https://api.puter.test';
+    delete window.UIUpgradeAccount;
+    // A Puter without custom domains, unless a test serves them.
+    globalThis.fetch = vi.fn(async () => json(404, {}));
     globalThis.puter = {
         fsCacheKey: (kind, path) => `${kind}:${path}`,
         _cache: { del: vi.fn() },
@@ -126,7 +176,7 @@ describe('publish website', () => {
         expect(nameField().val()).toBe('cafe');
     });
 
-        it('asks for an address when nothing usable was typed', async () => {
+    it('asks for an address when nothing usable was typed', async () => {
         await openPublishWebsiteDialog({ name: 'Site', path: '/alice/Site' });
         await submitWith('---');
         expect(status()).toBe('publish_name_required');
@@ -164,6 +214,358 @@ describe('publish website', () => {
     });
 });
 
+describe('publish website on a custom domain', () => {
+    it('leaves the option out where the server has no custom domains', async () => {
+        await openWebsite();
+        expect(shown('useDomain')).toBe(false);
+        expect(shown('domain')).toBe(false);
+        await submitWith('my-site');
+        expect(puter.hosting.create).toHaveBeenCalledWith('my-site', '/alice/Site');
+        expect(requests('POST')).toEqual([]);
+    });
+
+    it('asks for the domain once the switch is on, with what it costs', async () => {
+        serveDomains();
+        await openWebsite();
+        expect(shown('useDomain')).toBe(true);
+        expect(shown('domain')).toBe(false);
+
+        turnOnDomain();
+
+        expect(shown('domain')).toBe(true);
+        expect(document.activeElement).toBe(domainField().get(0));
+        expect($('.dashboard-form-field[data-field="domain"] .dashboard-form-hint').text())
+            .toBe('publish_custom_domain_dns_hint custom_domain_price_note');
+        expect($('.dashboard-publish-upsell').prop('hidden')).toBe(true);
+    });
+
+    it('publishes the site, adds the domain, and shows the records to set', async () => {
+        serveDomains({ routes: { 'POST ': () => json(201, pendingDomain()) } });
+        await openWebsite();
+        turnOnDomain();
+        domainField().val('https://WWW.Example.com/about');
+
+        await submitWith('my-site');
+
+        expect(puter.hosting.create).toHaveBeenCalledWith('my-site', '/alice/Site');
+        expect(requests('POST')).toEqual([{ path: '', body: { site: 'my-site', hostname: 'www.example.com' } }]);
+        expect($('.dashboard-form-done p').text()).toBe('website_published');
+        expect($('.dashboard-copy-value').first().val()).toBe('https://my-site.puter.site');
+        expect($('.dashboard-publish-domain-host').text()).toBe('www.example.com');
+        expect($('.dashboard-publish-domain-badge').attr('data-status')).toBe('pending');
+        expect($('.dashboard-dns-record-type').text()).toBe('CNAME');
+        expect($('.dashboard-dns-record .dashboard-copy-value').map((_, el) => el.value).get())
+            .toEqual(['www', 'my-site.puter.site']);
+    });
+
+    it('keeps the records up through a stray click outside the card', async () => {
+        serveDomains({ routes: { 'POST ': () => json(201, pendingDomain()) } });
+        await openWebsite();
+        turnOnDomain();
+        domainField().val('www.example.com');
+        await submitWith('my-site');
+
+        const $backdrop = $('.dashboard-dialog-overlay');
+        $backdrop.trigger('mousedown').trigger('click');
+        await flush();
+        expect($backdrop.hasClass('dashboard-dialog-show')).toBe(true);
+        expect($('.dashboard-dns-record')).toHaveLength(1);
+    });
+
+    it('checks the domain again and shows its address once connected', async () => {
+        serveDomains({
+            routes: {
+                'POST ': () => json(201, pendingDomain()),
+                'GET /d1': () => json(200, pendingDomain({ status: 'active', records: [] })),
+            },
+        });
+        await openWebsite();
+        turnOnDomain();
+        domainField().val('www.example.com');
+        await submitWith('my-site');
+
+        $('.dashboard-publish-domain-check').trigger('click');
+        await flush();
+
+        expect(requests('GET').map((r) => r.path)).toContain('/d1');
+        expect($('.dashboard-publish-domain-badge').attr('data-status')).toBe('active');
+        expect($('.dashboard-publish-domain .dashboard-copy-value').val()).toBe('https://www.example.com');
+        expect($('.dashboard-publish-domain-status').text()).toBe('custom_domain_success_note');
+        expect($('.dashboard-publish-domain-check')).toHaveLength(0);
+    });
+
+    it('announces a check in the status region already on screen', async () => {
+        serveDomains({
+            routes: {
+                'POST ': () => json(201, pendingDomain()),
+                'GET /d1': () => json(200, pendingDomain()),
+            },
+        });
+        await openWebsite();
+        turnOnDomain();
+        domainField().val('www.example.com');
+        await submitWith('my-site');
+        const el_status = $('.dashboard-publish-domain-status').get(0);
+
+        $('.dashboard-publish-domain-check').trigger('click');
+        await flush();
+
+        expect($('.dashboard-publish-domain-status').get(0)).toBe(el_status);
+        expect(el_status.textContent).toBe('custom_domain_status_pending');
+        // The redrawn records are not read out again.
+        expect($('.dashboard-dns-record').closest('[aria-live]').attr('aria-live')).toBe('off');
+    });
+
+    it('runs one domain action at a time on the done screen', async () => {
+        let answer_check;
+        serveDomains({
+            routes: {
+                'POST ': () => json(201, pendingDomain({ hostname: 'example.com', isApex: true })),
+                'GET /d1': () => new Promise((resolve) => {
+                    answer_check = () => resolve(json(200, pendingDomain({ hostname: 'example.com', isApex: true })));
+                }),
+                'POST /d1/use-www': () => json(200, pendingDomain({ redirectFrom: 'example.com' })),
+            },
+        });
+        await openWebsite();
+        turnOnDomain();
+        domainField().val('example.com');
+        await submitWith('my-site');
+
+        $('.dashboard-publish-domain-check').trigger('click');
+        await flush();
+        expect($('.dashboard-publish-domain-www').prop('disabled')).toBe(true);
+        $('.dashboard-publish-domain-www').trigger('click');
+        await flush();
+        expect(requests('POST').map((r) => r.path)).not.toContain('/d1/use-www');
+
+        answer_check();
+        await flush();
+        expect($('.dashboard-publish-domain-www').prop('disabled')).toBe(false);
+    });
+
+    it('stops before publishing when the domain is not one', async () => {
+        serveDomains();
+        await openWebsite();
+        turnOnDomain();
+        domainField().val('localhost');
+
+        await submitWith('my-site');
+
+        expect(status()).toBe('custom_domain_error_invalid');
+        expect(domainField().attr('aria-invalid')).toBe('true');
+        expect(puter.hosting.create).not.toHaveBeenCalled();
+    });
+
+    it('keeps the live site and retries only the domain when adding it fails', async () => {
+        const add = vi.fn()
+            .mockReturnValueOnce(json(409, { code: 'custom_domain_taken', message: 'That hostname is already in use' }))
+            .mockReturnValueOnce(json(201, pendingDomain({ hostname: 'www.example.org' })));
+        serveDomains({ routes: { 'POST ': add } });
+        await openWebsite();
+        turnOnDomain();
+        domainField().val('www.example.com');
+
+        await submitWith('my-site');
+
+        expect(status()).toBe('publish_domain_failed\ncustom_domain_error_taken');
+        expect(domainField().attr('aria-invalid')).toBe('true');
+        expect(nameField().prop('readOnly')).toBe(true);
+        expect(submitLabel()).toBe('custom_domain_add');
+        // Published now, so the hint no longer speaks of "after publishing".
+        expect($('.dashboard-form-field[data-field="domain"] .dashboard-form-hint').text()).toBe('custom_domain_price_note');
+
+        domainField().val('www.example.org');
+        await submitWith();
+
+        expect(puter.hosting.create).toHaveBeenCalledTimes(1);
+        expect(add).toHaveBeenLastCalledWith({ site: 'my-site', hostname: 'www.example.org' });
+        expect($('.dashboard-publish-domain-host').text()).toBe('www.example.org');
+    });
+
+    it('finishes with just the site when the domain is turned off after a failure', async () => {
+        serveDomains({ routes: { 'POST ': () => json(409, { code: 'custom_domain_taken' }) } });
+        await openWebsite();
+        turnOnDomain();
+        domainField().val('www.example.com');
+        await submitWith('my-site');
+
+        domainSwitch().prop('checked', false).trigger('change');
+        expect(submitLabel()).toBe('done');
+        await submitWith();
+
+        expect(puter.hosting.create).toHaveBeenCalledTimes(1);
+        expect($('.dashboard-form-done p').text()).toBe('website_published');
+        expect($('.dashboard-publish-domain')).toHaveLength(0);
+    });
+
+    it('moves a domain already on the account instead of adding it again', async () => {
+        serveDomains({
+            list: { items: [pendingDomain({ site: 'old-site', status: 'active' })], canAdd: true },
+            routes: { 'PATCH /d1': () => json(200, pendingDomain({ status: 'active' })) },
+        });
+        await openWebsite();
+        turnOnDomain();
+        expect($(`#${domainField().attr('list')} option`).map((_, el) => el.value).get()).toEqual(['www.example.com']);
+        domainField().val('www.example.com').trigger('input');
+        expect($('.dashboard-form-field[data-field="domain"] .dashboard-form-hint').text()).toBe('publish_custom_domain_moves');
+
+        await submitWith('my-site');
+
+        expect(requests('POST')).toEqual([]);
+        expect(requests('PATCH')).toEqual([{ path: '/d1', body: { site: 'my-site' } }]);
+        expect($('.dashboard-publish-domain-badge').attr('data-status')).toBe('active');
+    });
+
+    it('says the www hostname serves the site and the root domain forwards to it', async () => {
+        serveDomains({
+            routes: {
+                'POST ': () => json(201, pendingDomain({
+                    redirectFrom: 'example.com',
+                    records: [
+                        { type: 'CNAME', name: 'www', value: 'my-site.puter.site', purpose: 'routing', required: true },
+                        { type: 'A', name: '@', value: '192.0.2.1', purpose: 'redirect', required: true },
+                    ],
+                })),
+            },
+        });
+        await openWebsite();
+        turnOnDomain();
+        domainField().val('www.example.com');
+        const i18n_stub = globalThis.i18n;
+        globalThis.i18n = (key, replacements) => (Array.isArray(replacements) && replacements.length ? `${key}:${replacements.join('|')}` : key);
+        try {
+            await submitWith('my-site');
+        } finally {
+            globalThis.i18n = i18n_stub;
+        }
+
+        expect($('.dashboard-publish-domain .dashboard-form-hint').last().text())
+            .toBe('custom_domain_redirect_note:www.example.com|example.com');
+    });
+
+    it('shows the ownership record for a domain held by another account', async () => {
+        const add = vi.fn(() => json(409, {
+            code: 'custom_domain_claim_required',
+            verification: { name: '_puter.www.example.com', value: 'token-1' },
+        }));
+        serveDomains({ routes: { 'POST ': add } });
+        await openWebsite();
+        turnOnDomain();
+        domainField().val('www.example.com');
+
+        await submitWith('my-site');
+
+        expect($('.dashboard-publish-claim').prop('hidden')).toBe(false);
+        expect($('.dashboard-publish-claim .dashboard-dns-record-type').text()).toBe('TXT');
+        expect($('.dashboard-publish-claim .dashboard-copy-value').map((_, el) => el.value).get())
+            .toEqual(['_puter.www.example.com', 'token-1']);
+        expect(submitLabel()).toBe('custom_domain_verify_and_add');
+        expect(status()).toBe('publish_site_live');
+
+        await submitWith();
+        expect(status()).toBe('publish_domain_failed\ncustom_domain_claim_not_found');
+
+        // A claim is for one hostname; editing it starts over.
+        domainField().val('www.example.net').trigger('input');
+        expect($('.dashboard-publish-claim').prop('hidden')).toBe(true);
+        expect(submitLabel()).toBe('custom_domain_add');
+
+        // Back to the claimed hostname, its record and the verify step return together.
+        domainField().val('www.example.com').trigger('input');
+        expect($('.dashboard-publish-claim').prop('hidden')).toBe(false);
+        expect(submitLabel()).toBe('custom_domain_verify_and_add');
+    });
+
+    describe('on a plan without custom domains', () => {
+        beforeEach(() => {
+            window.UIUpgradeAccount = vi.fn(function () {
+                this.open_as_window = vi.fn();
+            });
+        });
+
+        it('offers the upgrade in place of the field, leaving focus on the switch', async () => {
+            serveDomains({ list: { items: [], canAdd: false } });
+            await openWebsite();
+            domainSwitch().get(0).focus();
+            turnOnDomain();
+
+            expect(shown('domain')).toBe(false);
+            expect($('.dashboard-publish-upsell').prop('hidden')).toBe(false);
+            expect(document.activeElement).toBe(domainSwitch().get(0));
+            $('.dashboard-publish-upgrade').trigger('click');
+            expect(window.UIUpgradeAccount).toHaveBeenCalled();
+        });
+
+        it('does not publish while the switch asks for a domain it cannot add', async () => {
+            serveDomains({ list: { items: [], canAdd: false } });
+            await openWebsite();
+            turnOnDomain();
+            await submitWith('my-site');
+            expect(status()).toBe('publish_custom_domain_needs_plan');
+            expect(puter.hosting.create).not.toHaveBeenCalled();
+        });
+
+        it('unlocks the field once the upgrade goes through', async () => {
+            let can_add = false;
+            serveDomains({ list: () => ({ items: [], canAdd: can_add }) });
+            await openWebsite();
+            turnOnDomain();
+            $('.dashboard-publish-upgrade').trigger('click');
+
+            can_add = true;
+            window.dispatchEvent(new CustomEvent('puter:subscription:changed'));
+            await flush();
+
+            expect(shown('domain')).toBe(true);
+            expect($('.dashboard-publish-upsell').prop('hidden')).toBe(true);
+            expect(document.activeElement).toBe(domainField().get(0));
+        });
+
+        it('only listens for a plan change once it has offered the upgrade', async () => {
+            serveDomains({ list: { items: [], canAdd: false } });
+            const listen = vi.spyOn(window, 'addEventListener');
+            try {
+                await openWebsite();
+                turnOnDomain();
+                expect(listen.mock.calls.map(([type]) => type)).not.toContain('puter:subscription:changed');
+                $('.dashboard-publish-upgrade').trigger('click');
+                expect(listen.mock.calls.map(([type]) => type)).toContain('puter:subscription:changed');
+            } finally {
+                listen.mockRestore();
+            }
+        });
+
+        it('explains the plan without a button where there is no upgrade flow', async () => {
+            delete window.UIUpgradeAccount;
+            serveDomains({ list: { items: [], canAdd: false } });
+            await openWebsite();
+            turnOnDomain();
+            expect($('.dashboard-publish-upgrade')).toHaveLength(0);
+            await submitWith('my-site');
+            expect(status()).toBe('custom_domain_error_plan');
+        });
+
+        it('finishes with the live site when adding the domain turns out to need a plan', async () => {
+            serveDomains({ routes: { 'POST ': () => json(402, { code: 'subscription_required' }) } });
+            await openWebsite();
+            turnOnDomain();
+            domainField().val('www.example.com');
+            await submitWith('my-site');
+
+            expect(status()).toBe('publish_domain_failed\ncustom_domain_error_plan');
+            expect($('.dashboard-publish-upsell').prop('hidden')).toBe(false);
+            expect(submitLabel()).toBe('done');
+
+            await submitWith();
+            expect(puter.hosting.create).toHaveBeenCalledTimes(1);
+            expect(requests('POST')).toHaveLength(1);
+            expect($('.dashboard-form-done p').text()).toBe('website_published');
+            expect($('.dashboard-publish-domain')).toHaveLength(0);
+        });
+    });
+});
+
 describe('publish worker', () => {
     it('always needs a verified account', async () => {
         await openPublishWorkerDialog({ name: 'api.js', path: '/alice/api.js' });

src/gui/src/UI/Dashboard/UIShareModal.js

@@ -651,17 +651,25 @@ export default function UIShareModal ({ items, path: item_path, name, owner, fse
     // One request per run of MAX_ITEMS_PER_REQUEST, in series so a large
     // selection can't burst through the share rate limit. Resolves with every
     // grant that landed, the way a single call would.
+    // A run that fails after others landed rejects with those grants on the
+    // error as `landed`.
     const grant_access = async (recipient, mode, paths) => {
         const created = [];
-        for ( const run of chunk(paths, MAX_ITEMS_PER_REQUEST) ) {
-            created.push(...(await with_verification_gate(
-                () => puter.fs.share({ paths: run, recipient, mode }),
-            ) ?? []));
-        }
-        // A selection too large to list again (see refresh) learns which rows
-        // are now shared from the grants themselves.
-        if ( total > MAX_ITEMS_PER_REQUEST ) {
-            for ( const share of created ) mark_item_shared(share.path, true);
+        try {
+            for ( const run of chunk(paths, MAX_ITEMS_PER_REQUEST) ) {
+                created.push(...(await with_verification_gate(
+                    () => puter.fs.share({ paths: run, recipient, mode }),
+                ) ?? []));
+            }
+        } catch (err) {
+            if ( created.length && err && typeof err === 'object' ) err.landed = created;
+            throw err;
+        } finally {
+            // A selection too large to list again (see refresh) learns which
+            // rows are now shared from the grants themselves.
+            if ( total > MAX_ITEMS_PER_REQUEST ) {
+                for ( const share of created ) mark_item_shared(share.path, true);
+            }
         }
         return created;
     };
@@ -848,8 +856,16 @@ export default function UIShareModal ({ items, path: item_path, name, owner, fse
             if ( ! focus_moved_on() ) $recipient.get(0)?.focus({ preventScroll: true });
         } catch (err) {
             sharing = false;
-            show_error(error_html(err));
+            // Runs that landed before the failure are shared all the same.
+            const landed = err?.landed?.length ?? 0;
+            show_error(landed
+                ? `${i18n('share_shared_with_partial', { recipient, count: landed, total })}. ${error_html(err)}`
+                : error_html(err));
             sync_add_actions();
+            if ( landed ) {
+                invalidate_shared_roots();
+                await refresh();
+            }
             // Disabling the clicked button dropped focus to <body>; put it
             // where the correction happens.
             $recipient.get(0)?.focus({ preventScroll: true });

src/gui/src/UI/Dashboard/UIShareModal.test.js

@@ -226,4 +226,28 @@ describe('UIShareModal adding people', () => {
         await settle();
         expect($('.share-modal-submit').prop('disabled')).toBe(false);
     });
+
+    it('says how many items were shared when a later run fails, and badges those rows', async () => {
+        const selection = Array.from({ length: 60 }, (_, i) => ({ path: `/alice/f${i}.txt` }));
+        document.body.insertAdjacentHTML('beforeend', selection
+            .map(item => `<div class="item" data-path="${item.path}" data-is_shared="0"></div>`).join(''));
+        let call = 0;
+        puter.fs.share = vi.fn(async ({ paths }) => {
+            if ( ++call === 2 ) throw { message: 'Daily share limit reached', code: 'share_daily_limit_reached' };
+            return paths.map(p => ({ path: p }));
+        });
+        UIShareModal({ items: selection });
+        await settle();
+        picked.recipient = { value: 'bob', label: 'bob' };
+        picked.onChange();
+
+        $('.share-modal-add').trigger('submit');
+        await settle();
+
+        expect(puter.fs.share).toHaveBeenCalledTimes(2);
+        const status = $('.share-modal-status').text();
+        expect(status).toContain('Shared with bob on 50 of 60 items');
+        expect(status).toContain('Daily share limit reached');
+        expect($('.item[data-is_shared="1"]')).toHaveLength(50);
+    });
 });

src/gui/src/UI/Dashboard/credits.js

@@ -36,6 +36,16 @@ const numberFormat = (options) => {
     }
 };
 
+/**
+ * A whole count (usage units) in the dashboard's language: "1,234,567" in
+ * English, "1.234.567" in German.
+ *
+ * @param {number} count
+ * @returns {string}
+ */
+export const formatCount = (count) =>
+    numberFormat({ maximumFractionDigits: 0 }).format(Number.isFinite(count) ? count : 0);
+
 /** Whether a `getMonthlyUsage()` response reports credits. */
 export const usageIsCredits = (allowanceInfo) =>
     allowanceInfo?.unit === 'credits';

src/gui/src/UI/Dashboard/credits.test.js

@@ -19,6 +19,7 @@
 
 import { describe, expect, it, beforeEach, afterEach } from 'vitest';
 import {
+    formatCount,
     formatCredits,
     formatDollarsFromMicrocents,
     usageIsCredits,
@@ -86,6 +87,14 @@ describe('amounts in the dashboard\'s language', () => {
         expect(formatCredits(2.5)).toBe('2,5');
         expect(formatCredits(0.001)).toBe('<0,01');
         expect(formatDollarsFromMicrocents(123_450_000_000).replace(/\s/g, ' ')).toBe('1.234,50 $');
+        expect(formatCount(1234567)).toBe('1.234.567');
+    });
+
+    it('counts usage units in English by default', () => {
+        delete globalThis.window.locale;
+        expect(formatCount(1234567)).toBe('1,234,567');
+        expect(formatCount(12.6)).toBe('13');
+        expect(formatCount(undefined)).toBe('0');
     });
 
     it("reads Puter's codes that aren't BCP 47 tags", () => {

src/gui/src/UI/Dashboard/dashboardOverlay.js

@@ -72,9 +72,11 @@ export function bindBackdropDismiss ($overlay, isBackdrop, dismiss) {
  *   overlay, after it has closed. Not called for `close()`.
  * @param {(via: 'escape'|'close'|'backdrop') => boolean} [opts.canDismiss]
  *   Consulted before each dismissal; returning false keeps the overlay up.
+ * @param {boolean} [opts.fitKeyboard] Shrink to the part of the screen an
+ *   on-screen keyboard leaves visible. Defaults to true.
  * @returns {{ $overlay: jQuery, $dialog: jQuery, close: () => void, isClosed: () => boolean }}
  */
-export default function mountDashboardOverlay ({ html, $container, returnFocusTo, onDismiss, canDismiss }) {
+export default function mountDashboardOverlay ({ html, $container, returnFocusTo, onDismiss, canDismiss, fitKeyboard = true }) {
     const $root = $container && $container.length ? $container : $('body');
     const ns = `.dashboard-overlay-${++overlay_seq}`;
     const el_previous_focus = document.activeElement;
@@ -87,7 +89,7 @@ export default function mountDashboardOverlay ({ html, $container, returnFocusTo
     // iOS lays its keyboard over the page rather than resizing it, which
     // would leave a bottom sheet's fields and buttons underneath. Pin the
     // overlay to the part of the screen that is still visible.
-    const viewport = window.visualViewport;
+    const viewport = fitKeyboard ? window.visualViewport : null;
     const fitToViewport = () => {
         const covered = window.innerHeight - viewport.height - viewport.offsetTop;
         const pinned = covered > 1 || viewport.offsetTop > 1;

src/gui/src/UI/Dashboard/dashboardOverlay.test.js

@@ -150,6 +150,13 @@ describe('mountDashboardOverlay', () => {
         close();
         expect(window.visualViewport.removeEventListener).toHaveBeenCalledWith('resize', listeners.resize);
     });
+
+    it('leaves its size alone under a keyboard when told not to fit it', () => {
+        window.visualViewport = { height: window.innerHeight, offsetTop: 0, addEventListener: vi.fn(), removeEventListener: vi.fn() };
+        const { close } = mountDashboardOverlay({ html: card, fitKeyboard: false });
+        expect(window.visualViewport.addEventListener).not.toHaveBeenCalled();
+        close();
+    });
 });
 
 describe('bindBackdropDismiss', () => {

src/gui/src/UI/Dashboard/notificationCenter.js

@@ -346,20 +346,26 @@ export const badgeLabel = (count) => {
     return count > 99 ? '99+' : String(count);
 };
 
-const TITLE_BADGE = /^\((\d+\+?)\) /;
+/** What the unread count puts in front of the title: "(3) ", or nothing. */
+export const titleBadge = (count) => {
+    const label = badgeLabel(count);
+    return label ? `(${label}) ` : '';
+};
 
 /**
- * The document title with the unread count in front, replacing any count
- * already there so repeated application never stacks prefixes.
+ * The document title with the unread count in front. Only `applied`, the
+ * badge this page last put there, is replaced, so repeated application never
+ * stacks prefixes and an app's own "(3) Inbox" title keeps its count.
  *
  * @param {string} title
  * @param {number} count
+ * @param {string} [applied]
  * @returns {string}
  */
-export const titleWithBadge = (title, count) => {
-    const base = String(title ?? '').replace(TITLE_BADGE, '');
-    const label = badgeLabel(count);
-    return label ? `(${label}) ${base}` : base;
+export const titleWithBadge = (title, count, applied = '') => {
+    let base = String(title ?? '');
+    if ( applied && base.startsWith(applied) ) base = base.slice(applied.length);
+    return titleBadge(count) + base;
 };
 
 /**
@@ -370,16 +376,17 @@ export const titleWithBadge = (title, count) => {
 export const MAX_BURST_TOASTS = 3;
 
 /**
- * Split a burst into the entries that get their own toast and the number
- * that don't.
+ * Split a burst into the entries that get their own toast, newest first, and
+ * the number that don't. Bursts arrive in either order (a catch-up listing is
+ * oldest first), and the newest are the ones worth a toast.
  *
- * @param {NotificationEntry[]} entries - Newest first
+ * @param {NotificationEntry[]} entries
  * @param {number} [max]
  * @returns {{ shown: NotificationEntry[], folded: number }}
  */
 export const planBurstToasts = (entries, max = MAX_BURST_TOASTS) => {
-    if ( entries.length <= max ) return { shown: entries, folded: 0 };
+    const newestFirst = sortEntries(entries);
     // One over the cap is no quieter shown as a summary than as a toast.
-    if ( entries.length === max + 1 ) return { shown: entries, folded: 0 };
-    return { shown: entries.slice(0, max), folded: entries.length - max };
+    if ( newestFirst.length <= max + 1 ) return { shown: newestFirst, folded: 0 };
+    return { shown: newestFirst.slice(0, max), folded: newestFirst.length - max };
 };

src/gui/src/UI/Dashboard/notificationCenter.test.js

@@ -35,6 +35,7 @@ import {
     setReadAt,
     sortEntries,
     takeMarksSince,
+    titleBadge,
     titleWithBadge,
     toEntry,
     unreadCount,
@@ -424,16 +425,24 @@ describe('titleWithBadge', () => {
         expect(titleWithBadge('Puter', 3)).toBe('(3) Puter');
     });
 
-    it('replaces an existing count instead of stacking', () => {
-        expect(titleWithBadge('(2) Puter', 5)).toBe('(5) Puter');
-        expect(titleWithBadge('(99+) Puter', 1)).toBe('(1) Puter');
+    it('replaces the count it put there instead of stacking', () => {
+        expect(titleWithBadge('(2) Puter', 5, '(2) ')).toBe('(5) Puter');
+        expect(titleWithBadge('(99+) Puter', 1, '(99+) ')).toBe('(1) Puter');
     });
 
     it('clears the prefix at zero', () => {
-        expect(titleWithBadge('(2) Puter', 0)).toBe('Puter');
+        expect(titleWithBadge('(2) Puter', 0, '(2) ')).toBe('Puter');
         expect(titleWithBadge('Puter', 0)).toBe('Puter');
     });
 
+    it('leaves a count that is part of an app\'s own title alone', () => {
+        expect(titleWithBadge('(3) Inbox', 0)).toBe('(3) Inbox');
+        expect(titleWithBadge('(3) Inbox', 2)).toBe('(2) (3) Inbox');
+        // The app rewrote the title after the badge was applied.
+        expect(titleWithBadge('(3) Inbox', 2, '(2) ')).toBe('(2) (3) Inbox');
+        expect(titleWithBadge('(2) (3) Inbox', 0, '(2) ')).toBe('(3) Inbox');
+    });
+
     it('leaves a parenthesised title that is not a badge alone', () => {
         expect(titleWithBadge('(draft) Notes', 0)).toBe('(draft) Notes');
         expect(titleWithBadge('(draft) Notes', 2)).toBe('(2) (draft) Notes');
@@ -445,6 +454,14 @@ describe('titleWithBadge', () => {
     });
 });
 
+describe('titleBadge', () => {
+    it('is the prefix a count puts in front of the title', () => {
+        expect(titleBadge(3)).toBe('(3) ');
+        expect(titleBadge(120)).toBe('(99+) ');
+        expect(titleBadge(0)).toBe('');
+    });
+});
+
 describe('planBurstToasts', () => {
     const many = (n) => Array.from({ length: n }, (_, i) => entry(`n${i}`, NOW - i));
 
@@ -463,6 +480,12 @@ describe('planBurstToasts', () => {
         expect(shown.map((e) => e.uid)).toEqual(['n0', 'n1', 'n2']);
         expect(folded).toBe(9);
     });
+
+    it('toasts the newest of a burst that arrives oldest first', () => {
+        const { shown, folded } = planBurstToasts(many(6).reverse());
+        expect(shown.map((e) => e.uid)).toEqual(['n0', 'n1', 'n2']);
+        expect(folded).toBe(3);
+    });
 });
 
 describe('senderNameFor', () => {

src/gui/src/UI/Dashboard/publishDomain.js

@@ -0,0 +1,425 @@
+/*
+ * Copyright (C) 2024-present Puter Technologies Inc.
+ *
+ * This file is part of Puter.
+ *
+ * Puter is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published
+ * by the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <https://www.gnu.org/licenses/>.
+ */
+
+// The custom domain part of the Publish Website dialog: a switch that asks
+// for a domain, an upgrade prompt where the plan doesn't include one, and,
+// once the site is live, the domain's DNS records with a status check.
+
+import { isPlausibleHostname, normalizeHostnameInput } from '../../helpers/customDomainHostname.js';
+import {
+    CUSTOM_DOMAIN_HOSTNAME_ERRORS,
+    customDomainErrorText,
+    customDomainsRequest,
+    customDomainStatus,
+    formatCustomDomainPrice,
+    mergeCustomDomainRefresh,
+} from '../../helpers/customDomains.js';
+import { has_upgrade_flow, open_upgrade_flow } from '../../helpers/planGate.js';
+import { SVG } from './UIDashboardDialog.js';
+import { copyRowHtml } from './UIDashboardFormDialog.js';
+
+/** @typedef {import('../../helpers/customDomains.js').CustomDomain} CustomDomain */
+/** @typedef {import('../../helpers/customDomains.js').CustomDomainRecord} CustomDomainRecord */
+/** @typedef {import('./UIDashboardFormDialog.js').FormDialog} FormDialog */
+/** @typedef {import('./UIDashboardFormDialog.js').FormDialogField} FormDialogField */
+
+const t = (key, args = []) => i18n(key, args, false);
+
+const ICONS = {
+    open: SVG('<path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"/><path d="M15 3h6v6"/><path d="M10 14L21 3"/>'),
+    globe: SVG('<circle cx="12" cy="12" r="9"/><path d="M3 12h18"/><path d="M12 3a14 14 0 0 1 0 18a14 14 0 0 1 0-18z"/>'),
+    sparkle: SVG('<path d="M12 3l1.9 5.1L19 10l-5.1 1.9L12 17l-1.9-5.1L5 10l5.1-1.9z"/><path d="M19 16l.8 2.2L22 19l-2.2.8L19 22l-.8-2.2L16 19l2.2-.8z"/>'),
+};
+
+const BADGE_KEYS = {
+    active: 'custom_domain_badge_active',
+    pending: 'custom_domain_badge_pending',
+    failed: 'custom_domain_badge_failed',
+};
+
+/**
+ * An icon link opening `url` in a new tab, beside a compact copy row.
+ *
+ * @param {string} url
+ * @returns {string}
+ */
+export const openLinkHtml = (url) =>
+    `<a class="dashboard-dialog-btn dashboard-dialog-btn-quiet dashboard-icon-btn dashboard-publish-open" href="${html_encode(url)}"`
+    + ` target="_blank" rel="noopener noreferrer" aria-label="${i18n('open_in_new_tab')}" title="${i18n('open_in_new_tab')}">${ICONS.open}</a>`;
+
+/**
+ * DNS records as cards: the type, then the name and value, each with a Copy
+ * button the form dialog wires.
+ *
+ * @param {CustomDomainRecord[]} records
+ * @param {{ isApex?: boolean }} [domain] A root domain's routing record can
+ *   be any of the record types that alias a root.
+ * @returns {string}
+ */
+export const dnsRecordsHtml = (records, { isApex = false } = {}) => records.map((record) => {
+    const type = isApex && record.purpose === 'routing' ? t('custom_domain_record_type_apex') : record.type;
+    const field = (labelKey, value) => '<div class="dashboard-dns-record-field">'
+        + `<span class="dashboard-dns-record-label">${i18n(labelKey)}</span>`
+        + copyRowHtml({ value, label: `${type} ${t(labelKey)}`, compact: true })
+        + '</div>';
+    return '<div class="dashboard-dns-record">'
+        + '<div class="dashboard-dns-record-head">'
+        + `<span class="dashboard-dns-record-type">${html_encode(type)}</span>`
+        + (record.required === false ? `<span class="dashboard-dns-record-optional">${i18n('custom_domain_optional')}</span>` : '')
+        + '</div>'
+        + field('name', record.name)
+        + field('custom_domain_record_value', record.value)
+        + '</div>';
+}).join('');
+
+/**
+ * The done screen's account of a domain: its status, and until it's
+ * connected, the records still to set.
+ *
+ * @param {CustomDomain} domain
+ * @returns {string}
+ */
+export const domainSummaryHtml = (domain) => {
+    const status = customDomainStatus(domain);
+    let h = '<div class="dashboard-publish-domain-head">'
+        + `<span class="dashboard-publish-domain-icon">${ICONS.globe}</span>`
+        + `<span class="dashboard-publish-domain-host">${html_encode(domain.hostname)}</span>`
+        + `<span class="dashboard-publish-domain-badge" data-status="${status}">${i18n(BADGE_KEYS[status])}</span>`
+        + '</div>';
+    if ( status === 'active' ) {
+        const url = `https://${domain.hostname}`;
+        h += copyRowHtml({ value: url, label: domain.hostname, compact: true, after: openLinkHtml(url) });
+    } else {
+        if ( status === 'failed' && domain.statusDetail ) {
+            h += `<p class="dashboard-publish-domain-detail">${html_encode(domain.statusDetail)}</p>`;
+        }
+        h += `<p class="dashboard-form-hint">${i18n('custom_domain_records_c2a')}</p>`;
+        h += `<div class="dashboard-dns-records">${dnsRecordsHtml(domain.records ?? [], domain)}</div>`;
+        if ( domain.isApex ) {
+            h += `<p class="dashboard-form-hint">${i18n('custom_domain_apex_hint')}</p>`;
+            h += `<button type="button" class="dashboard-publish-link-btn dashboard-publish-domain-www">${i18n('custom_domain_no_root_alias')}</button>`;
+        }
+    }
+    if ( domain.redirectFrom ) {
+        h += `<p class="dashboard-form-hint">${i18n('custom_domain_redirect_note', [domain.hostname, domain.redirectFrom])}</p>`;
+    }
+    if ( status !== 'active' ) {
+        h += '<div class="dashboard-publish-domain-actions">'
+            + '<button type="button" class="dashboard-dialog-btn dashboard-dialog-btn-quiet dashboard-publish-domain-check">'
+            + '<span class="dashboard-form-spinner" aria-hidden="true"></span>'
+            + `<span>${i18n('custom_domain_check_status')}</span>`
+            + '</button>'
+            + '</div>';
+    }
+    return h;
+};
+
+/**
+ * The switch and the domain field. Both start hidden: the switch shows once
+ * the server answers that it has custom domains.
+ *
+ * @returns {FormDialogField[]}
+ */
+export const publishDomainFields = () => [
+    {
+        name: 'useDomain',
+        type: 'switch',
+        label: i18n('publish_custom_domain'),
+        hint: i18n('publish_custom_domain_hint'),
+        hidden: true,
+    },
+    {
+        name: 'domain',
+        label: i18n('custom_domain_hostname_label'),
+        placeholder: 'www.example.com',
+        hint: i18n('publish_custom_domain_dns_hint'),
+        hidden: true,
+        attrs: {
+            inputmode: 'url',
+            enterkeyhint: 'go',
+            autocomplete: 'off',
+            autocapitalize: 'off',
+            autocorrect: 'off',
+            spellcheck: 'false',
+            'data-gramm_editor': 'false',
+        },
+    },
+];
+
+/**
+ * @typedef {object} PublishDomain
+ * @property {() => boolean} addable Whether the switch is on and the plan
+ *   lets a domain be added.
+ * @property {(live: boolean) => string | null | false} prepare Before each
+ *   submit: null when no domain is to be added (including when the site is
+ *   `live` and the plan can't add one), false when the form can't go ahead
+ *   (the dialog says why), else the hostname to add.
+ * @property {(hostname: string, site: { name: string, url: string }) => Promise<CustomDomain | null>} attach
+ *   Adds the hostname to the live site, or moves it there when it's already
+ *   on the account. Null when it didn't; the dialog says why.
+ * @property {(domain: CustomDomain) => string} doneHtml The done screen's domain part.
+ * @property {() => boolean} claiming Whether an ownership record for the
+ *   typed hostname is on screen, waiting to be verified.
+ */
+
+/**
+ * Wires the custom domain fields of a publish form dialog.
+ *
+ * @param {FormDialog} dialog
+ * @param {object} opts
+ * @param {() => void} opts.onChange Runs when what the submit button does may
+ *   have changed: the switch, the plan, or a claim to verify.
+ * @returns {PublishDomain}
+ */
+export const setupPublishDomain = (dialog, { onChange }) => {
+    const { $dialog } = dialog;
+    const $switch = dialog.field('useDomain');
+    const $input = dialog.field('domain');
+    const $field = $input.closest('.dashboard-form-field');
+    const $hint = $field.find('.dashboard-form-hint');
+    const id = $input.attr('id');
+
+    const upgradable = has_upgrade_flow();
+    $field.after(
+        `<div class="dashboard-publish-upsell" hidden>`
+        + `<span class="dashboard-publish-upsell-icon">${ICONS.sparkle}</span>`
+        + '<div class="dashboard-publish-upsell-text">'
+        + `<p class="dashboard-publish-upsell-title">${i18n('publish_custom_domain_upsell_title')}</p>`
+        + (upgradable ? `<p class="dashboard-form-hint">${i18n('publish_custom_domain_upsell_text')}</p>` : '')
+        + '</div>'
+        + (upgradable ? `<button type="button" class="dashboard-dialog-btn dashboard-dialog-btn-primary dashboard-publish-upgrade">${i18n('billing.upgrade')}</button>` : '')
+        + '</div>'
+        + '<div class="dashboard-publish-claim" hidden>'
+        + `<p class="dashboard-publish-claim-text">${i18n('custom_domain_claim_c2a')}</p>`
+        + '<div class="dashboard-dns-records"></div>'
+        + '</div>'
+        + `<datalist id="${id}-owned"></datalist>`,
+    );
+    const $upsell = $dialog.find('.dashboard-publish-upsell');
+    const $claim = $dialog.find('.dashboard-publish-claim');
+    const $owned = $dialog.find(`#${id}-owned`);
+    $input.attr('list', `${id}-owned`);
+
+    let available = false;
+    let can_add = true;
+    let price = null;
+    /** @type {CustomDomain[]} */
+    let owned = [];
+    /** The hostname whose ownership record is on screen. */
+    let claim_for = null;
+    /** @type {CustomDomain | null} */
+    let shown = null;
+    /** Whether the site is published, so the domain is all that's left. */
+    let live = false;
+
+    const typed = () => normalizeHostnameInput($input.val());
+    const owned_named = (hostname) => owned.find((domain) => domain.hostname === hostname);
+    const wanted = () => available && $switch.prop('checked');
+    const addable = () => wanted() && can_add;
+
+    const update_hint = () => {
+        const existing = owned_named(typed());
+        $hint.text(existing
+            ? t('publish_custom_domain_moves', [`${existing.site}.${window.hosting_domain}`])
+            : [! live && t('publish_custom_domain_dns_hint'), price && t('custom_domain_price_note', [price])].filter(Boolean).join(' '));
+    };
+
+    const sync = () => {
+        const on = wanted();
+        dialog.showField('domain', on && can_add);
+        $upsell.prop('hidden', ! on || can_add);
+        $claim.prop('hidden', ! on || ! can_add || claim_for !== typed());
+        update_hint();
+        onChange();
+    };
+
+    const load = async () => {
+        let res;
+        try {
+            res = await customDomainsRequest('GET');
+        } catch {
+            return;
+        }
+        // No custom domain API on this Puter, or none for this account:
+        // the option stays out of the way.
+        if ( ! res.ok || ! Array.isArray(res.data?.items) ) return;
+        owned = res.data.items;
+        can_add = res.data.canAdd !== false;
+        price = formatCustomDomainPrice(res.data.pricing);
+        $owned.html(owned.map((domain) => `<option value="${html_encode(domain.hostname)}"></option>`).join(''));
+        if ( ! available ) {
+            available = true;
+            dialog.showField('useDomain', true);
+        }
+        sync();
+    };
+    load();
+
+    // The field takes focus as the switch reveals it. The upgrade prompt
+    // doesn't: a second Space meant for the switch would open the upgrade.
+    $switch.on('change', () => {
+        sync();
+        if ( addable() ) $input.get(0)?.focus({ preventScroll: true });
+    });
+    // A claim's record shows only while its hostname is the one typed.
+    $input.on('input', sync);
+
+    // Once an upgrade lands, the field unlocks where the prompt was. The
+    // dialog is modal, so only its own prompt can change the plan meanwhile.
+    const on_plan_change = async () => {
+        if ( ! document.contains($dialog.get(0)) ) {
+            window.removeEventListener('puter:subscription:changed', on_plan_change);
+            return;
+        }
+        const had = can_add;
+        await load();
+        if ( ! had && addable() ) $input.get(0)?.focus({ preventScroll: true });
+    };
+    $dialog.on('click', '.dashboard-publish-upgrade', () => {
+        if ( ! open_upgrade_flow() ) return;
+        window.addEventListener('puter:subscription:changed', on_plan_change);
+    });
+
+    // -- Done screen --
+
+    /** Encoded HTML into the done screen's status line; empty clears it. */
+    const set_done_status = (html, error = false) => {
+        $dialog.find('.dashboard-publish-domain-status').html(html)
+            .toggleClass('dashboard-publish-domain-status-error', error);
+    };
+    const render_done = (focus_selector) => {
+        const $section = $dialog.find('.dashboard-publish-domain-summary');
+        $section.html(domainSummaryHtml(shown));
+        const el = $section.find(focus_selector).get(0)
+            ?? $section.find('.dashboard-copy-value').get(0)
+            ?? $dialog.find('.dashboard-form-done-btn').get(0);
+        el?.focus({ preventScroll: true });
+    };
+    const DONE_ACTIONS = '.dashboard-publish-domain-check, .dashboard-publish-domain-www';
+    let done_busy = false;
+    /**
+     * Runs a done-screen request with `$btn` busy and the other actions held,
+     * since each answer redraws the domain; resolves with the response, or null.
+     */
+    const done_request = async ($btn, method, path) => {
+        done_busy = true;
+        $dialog.find(DONE_ACTIONS).prop('disabled', true);
+        $btn.addClass('dashboard-form-busy').attr('aria-busy', 'true');
+        set_done_status('');
+        try {
+            const res = await customDomainsRequest(method, path);
+            if ( res.ok ) return res;
+            set_done_status(html_encode(customDomainErrorText(res)), true);
+        } catch {
+            set_done_status(i18n('custom_domain_error_generic'), true);
+        } finally {
+            done_busy = false;
+            $dialog.find(DONE_ACTIONS).prop('disabled', false);
+            $btn.removeClass('dashboard-form-busy').removeAttr('aria-busy');
+        }
+        return null;
+    };
+    $dialog.on('click', '.dashboard-publish-domain-check', async function () {
+        if ( ! shown || done_busy ) return;
+        const res = await done_request($(this), 'GET', `/${encodeURIComponent(shown.uuid)}`);
+        if ( ! res ) return;
+        shown = mergeCustomDomainRefresh(shown, res.data);
+        render_done('.dashboard-publish-domain-check');
+        const status = customDomainStatus(shown);
+        set_done_status(status === 'active'
+            ? i18n('custom_domain_success_note', [shown.hostname, `${shown.site}.${window.hosting_domain}`])
+            : i18n(status === 'failed' ? 'custom_domain_status_failed' : 'custom_domain_status_pending', [shown.hostname]));
+    });
+    // Same domain, so the month already paid covers the www hostname.
+    $dialog.on('click', '.dashboard-publish-domain-www', async function () {
+        if ( ! shown || done_busy ) return;
+        const res = await done_request($(this), 'POST', `/${encodeURIComponent(shown.uuid)}/use-www`);
+        if ( ! res ) return;
+        shown = res.data;
+        render_done('.dashboard-publish-domain-check');
+    });
+
+    return {
+        addable,
+        prepare (live) {
+            if ( ! wanted() || (live && ! can_add) ) return null;
+            if ( ! can_add ) {
+                dialog.setStatus(t(upgradable ? 'publish_custom_domain_needs_plan' : 'custom_domain_error_plan'));
+                return false;
+            }
+            const hostname = typed();
+            $input.val(hostname);
+            if ( ! isPlausibleHostname(hostname) ) {
+                dialog.setStatus(t('custom_domain_error_invalid'), { field: 'domain' });
+                return false;
+            }
+            return hostname;
+        },
+        async attach (hostname, site) {
+            if ( ! live ) {
+                live = true;
+                update_hint();
+            }
+            const existing = owned_named(hostname);
+            const failed = (reason, field) => {
+                dialog.setStatus(`${t('publish_domain_failed', [site.url])}\n${reason}`, field ? { field } : undefined);
+                return null;
+            };
+            let res;
+            try {
+                res = existing
+                    ? await customDomainsRequest('PATCH', `/${encodeURIComponent(existing.uuid)}`, { site: site.name })
+                    : await customDomainsRequest('POST', '', { site: site.name, hostname });
+            } catch {
+                return failed(t('custom_domain_error_generic'));
+            }
+            if ( res.ok ) {
+                claim_for = null;
+                return res.data;
+            }
+            // Held by another account: shown its ownership record the first
+            // time; a retry that still can't see the record says so.
+            const verification = res.data?.verification;
+            if ( res.data?.code === 'custom_domain_claim_required' && verification ) {
+                const retry = claim_for === hostname;
+                claim_for = hostname;
+                $claim.find('.dashboard-dns-records').html(dnsRecordsHtml([{ type: 'TXT', name: verification.name, value: verification.value }]));
+                sync();
+                if ( retry ) return failed(t('custom_domain_claim_not_found'));
+                dialog.setStatus(t('publish_site_live', [site.url]), { kind: 'info' });
+                return null;
+            }
+            if ( res.status === 402 && res.data?.code === 'subscription_required' ) {
+                can_add = false;
+                sync();
+            }
+            return failed(customDomainErrorText(res), CUSTOM_DOMAIN_HOSTNAME_ERRORS.has(res.data?.code) ? 'domain' : undefined);
+        },
+        doneHtml (domain) {
+            shown = domain;
+            // The summary is redrawn after each check; the status line stays,
+            // so screen readers announce what changed and not the records again.
+            return '<section class="dashboard-publish-domain">'
+                + `<div class="dashboard-publish-domain-summary" aria-live="off">${domainSummaryHtml(domain)}</div>`
+                + '<p class="dashboard-publish-domain-status" role="status" aria-live="polite"></p>'
+                + '</section>';
+        },
+        claiming: () => addable() && claim_for !== null && claim_for === typed(),
+    };
+};

src/gui/src/UI/UIDesktop.js

@@ -27,7 +27,7 @@ import UIWindowSaveAccount from './UIWindowSaveAccount.js';
 import UIWindowDesktopBGSettings from './UIWindowDesktopBGSettings.js';
 import UIWindowMyWebsites from './UIWindowMyWebsites.js';
 import UIWindowFeedback from './UIWindowFeedback.js';
-import UIWindowLogin from './UIWindowLogin.js';
+import UIAuthLogin from './Auth/UIAuthLogin.js';
 import UIWindowQR from './UIWindowQR.js';
 
 import UIWindowProgress from './UIWindowProgress.js';
@@ -1901,9 +1901,9 @@ async function UIDesktop (options) {
                 await open_path_target(stat.path ?? shared_path, stat);
                 return;
             }
-            await UIWindowLogin({
+            await UIAuthLogin({
                 reload_on_success: true,
-                window_options: { cover_page: true, has_head: false },
+                page: true,
             });
             // Dismissed without signing in: drop the link rather than loop.
             if ( window.user?.is_temp ) clear_shared_param();
@@ -2235,12 +2235,9 @@ $(document).on('click', '.user-options-menu-btn', async function (e) {
             html: i18n('add_another_account'),
             // icon: l_user.username === user.username ? '✓' : '',
             onClick: async function (val) {
-                await UIWindowLogin({
+                await UIAuthLogin({
                     reload_on_success: true,
                     send_confirmation_code: false,
-                    window_options: {
-                        has_head: true,
-                    },
                 });
             },
         });
@@ -2423,16 +2420,12 @@ $(document).on('click', '.user-options-login-btn', async function (e) {
         });
         if ( saved )
         {
-            UIWindowLogin({ show_signup_button: false, reload_on_success: true });
+            UIAuthLogin({ show_signup_button: false, reload_on_success: true });
         }
     } else if ( alert_resp === 'login' ) {
-        UIWindowLogin({
+        UIAuthLogin({
             show_signup_button: false,
             reload_on_success: true,
-            window_options: {
-                backdrop: true,
-                close_on_backdrop_click: false,
-            },
         });
     }
 });

src/gui/src/UI/UIWindow.js

@@ -21,7 +21,7 @@ import UIAlert from './UIAlert.js';
 import UIContextMenu from './UIContextMenu.js';
 import path from '../lib/path.js';
 import UITaskbarItem from './UITaskbarItem.js';
-import UIWindowLogin from './UIWindowLogin.js';
+import UIAuthLogin from './Auth/UIAuthLogin.js';
 import UIWindowItemProperties from './UIWindowItemProperties.js';
 import new_context_menu_item from '../helpers/newContextMenuItem.js';
 import refresh_item_container from '../helpers/refreshItemContainer.js';
@@ -1288,7 +1288,7 @@ async function UIWindow (options) {
         // directory content
         // --------------------------------------------------------
         //auth
-        if ( !window.is_auth() && !(await UIWindowLogin()) )
+        if ( !window.is_auth() && !(await UIAuthLogin()) )
         {
             return;
         }
@@ -3446,6 +3446,10 @@ window.update_window_path = async function (el_window, target_path) {
     else if ( target_path !== '/' ) {
         try {
             puter.fs.stat({ path: target_path, consistency: 'eventual' }).then(fsentry => {
+                // the window may have moved on while this stat was in flight
+                if ( $(el_window).attr('data-path') !== html_encode(target_path) ) {
+                    return;
+                }
                 $(el_window).removeClass(`window-${ $(el_window).attr('data-uid')}`);
                 $(el_window).addClass(`window-${ fsentry.id}`);
                 $(el_window).attr('data-uid', fsentry.id);

src/gui/src/UI/UIWindow2FASetup.js

@@ -666,22 +666,22 @@ const UIWindow2FASetup = async function UIWindow2FASetup () {
     h += '<div class="tfa-progress" style="display:none;">';
     h += '  <div class="tfa-progress-step">';
     h += '    <div class="tfa-progress-dot active" data-step="1">1</div>';
-    h += '    <span class="tfa-progress-label active">Scan</span>';
+    h += `    <span class="tfa-progress-label active">${i18n('setup2fa_step_scan')}</span>`;
     h += '  </div>';
     h += '  <div class="tfa-progress-line"><div class="tfa-progress-line-fill"></div></div>';
     h += '  <div class="tfa-progress-step">';
     h += '    <div class="tfa-progress-dot" data-step="2">2</div>';
-    h += '    <span class="tfa-progress-label">Backup</span>';
+    h += `    <span class="tfa-progress-label">${i18n('setup2fa_step_backup')}</span>`;
     h += '  </div>';
     h += '  <div class="tfa-progress-line"><div class="tfa-progress-line-fill"></div></div>';
     h += '  <div class="tfa-progress-step">';
     h += '    <div class="tfa-progress-dot" data-step="3">3</div>';
-    h += '    <span class="tfa-progress-label">Verify</span>';
+    h += `    <span class="tfa-progress-label">${i18n('setup2fa_step_verify')}</span>`;
     h += '  </div>';
     h += '  <div class="tfa-progress-line"><div class="tfa-progress-line-fill"></div></div>';
     h += '  <div class="tfa-progress-step">';
     h += `    <div class="tfa-progress-dot" data-step="4">${SVG_CHECK}</div>`;
-    h += '    <span class="tfa-progress-label">Done</span>';
+    h += `    <span class="tfa-progress-label">${i18n('done')}</span>`;
     h += '  </div>';
     h += '</div>';
 
@@ -703,7 +703,7 @@ const UIWindow2FASetup = async function UIWindow2FASetup () {
     // Manual secret key, filled in once setup returns it
     h += '<div class="tfa-secret-row" style="display:none;">';
     h += '  <span class="tfa-secret-key"></span>';
-    h += `  <button class="tfa-copy-secret" title="Copy secret key">${SVG_COPY}</button>`;
+    h += `  <button class="tfa-copy-secret" title="${i18n('setup2fa_copy_secret')}" aria-label="${i18n('setup2fa_copy_secret')}">${SVG_COPY}</button>`;
     h += '</div>';
 
     h += `<button class="tfa-btn tfa-btn-primary tfa-scan-continue-btn">${i18n('continue')}</button>`;
@@ -747,7 +747,7 @@ const UIWindow2FASetup = async function UIWindow2FASetup () {
     }
     h += '  </div>';
     h += '  <div class="tfa-code-error"></div>';
-    h += `  <div class="tfa-code-spinner"><div class="tfa-spinner-icon"></div><span>Enabling...</span></div>`;
+    h += `  <div class="tfa-code-spinner"><div class="tfa-spinner-icon"></div><span>${i18n('setup2fa_enabling')}</span></div>`;
     h += '</div>';
     h += '</div>'; // end screen 3
 
@@ -755,8 +755,8 @@ const UIWindow2FASetup = async function UIWindow2FASetup () {
     h += '<div class="tfa-screen" data-screen="4">';
     h += `<div class="tfa-success-icon">${SVG_SHIELD_CHECK}</div>`;
     h += `<div class="tfa-success-title">${i18n('two_factor_enabled')}</div>`;
-    h += '<p class="tfa-success-text">Your account is now protected with two-factor authentication. You\'ll be asked for a verification code each time you sign in.</p>';
-    h += `<button class="tfa-btn tfa-btn-success tfa-done-btn">Done</button>`;
+    h += `<p class="tfa-success-text">${i18n('setup2fa_success_text')}</p>`;
+    h += `<button class="tfa-btn tfa-btn-success tfa-done-btn">${i18n('done')}</button>`;
     h += '</div>'; // end screen 4
 
     h += '</div>'; // end tfa-setup
@@ -1019,7 +1019,7 @@ const UIWindow2FASetup = async function UIWindow2FASetup () {
         navigator.clipboard.writeText(setup_data.codes.join('\n'));
         const $span = $(this).find('span');
         const orig = $span.text();
-        $span.text('Copied!');
+        $span.text(i18n('copied', [], false));
         $(this).addClass('copied');
         setTimeout(() => {
             $span.text(orig);
@@ -1031,7 +1031,7 @@ const UIWindow2FASetup = async function UIWindow2FASetup () {
         const grid_html = $w.find('.tfa-codes-grid').get(0).outerHTML;
         const print_frame = $w.find('.tfa-print-frame').get(0);
         const style = '<style>body{font-family:monospace;padding:20px} .tfa-codes-grid{display:grid;grid-template-columns:1fr 1fr;gap:8px} .tfa-code-item{padding:8px;font-size:14px;display:flex;gap:8px} .tfa-code-item-idx{color:#999}</style>';
-        print_frame.contentWindow.document.body.innerHTML = style + '<h2>Recovery Codes</h2>' + grid_html;
+        print_frame.contentWindow.document.body.innerHTML = `${style}<h2>${i18n('setup2fa_recovery_codes')}</h2>${grid_html}`;
         print_frame.contentWindow.focus();
         print_frame.contentWindow.print();
     });

src/gui/src/UI/UIWindowAppFeedback.js

@@ -40,7 +40,9 @@ let feedback_modal_seq = 0;
  * server is the authority on the app's canonical title — then submits to
  * `POST /app-feedback`.
  *
- * @param {{ app?: string, origin?: string, source?: 'app' | 'web' }} options
+ * @param {{ app?: string, origin?: string, source?: 'app' | 'web', fullpage?: boolean }} options
+ *   `fullpage` fills the viewport instead of floating over it, for a popup
+ *   window that exists only to host this dialog.
  * @returns {Promise<boolean>} true iff feedback was submitted successfully.
  *   Resolves false on cancel/close/unavailable — never rejects, so IPC and
  *   popup callers can always report an answer.
@@ -54,7 +56,8 @@ async function UIWindowAppFeedback (options) {
         let sending = false;
         let closed = false;
 
-        const authToken = puter.authToken ?? window.auth_token;
+        // The feedback embed runs without puter.js.
+        const authToken = globalThis.puter?.authToken ?? window.auth_token;
         const target_params = options.app
             ? { app: options.app }
             : { origin: options.origin };
@@ -70,7 +73,7 @@ async function UIWindowAppFeedback (options) {
 
         const titleId = `${modal_id}-title`;
         const h = `
-            <div class="app-feedback-overlay" role="dialog" aria-modal="true" aria-labelledby="${titleId}">
+            <div class="app-feedback-overlay${options.fullpage ? ' app-feedback-fullpage' : ''}" role="dialog" aria-modal="true" aria-labelledby="${titleId}">
                 <div class="app-feedback-modal" tabindex="-1">
                     <div class="app-feedback-head">
                         <h2 class="app-feedback-title" id="${titleId}">${i18n('app_feedback_title')}</h2>
@@ -79,16 +82,16 @@ async function UIWindowAppFeedback (options) {
                         </button>
                     </div>
                     <div class="app-feedback-body">
-                        <div class="app-feedback-loading">${i18n('loading')}…</div>
+                        <div class="app-feedback-pane app-feedback-loading">${i18n('loading')}…</div>
 
-                        <div class="app-feedback-unavailable" style="display:none;">
+                        <div class="app-feedback-pane app-feedback-unavailable" style="display:none;">
                             <p class="app-feedback-unavailable-message"></p>
                             <div class="app-feedback-actions">
                                 <button type="button" class="app-feedback-btn app-feedback-btn-primary app-feedback-close-btn">${i18n('close')}</button>
                             </div>
                         </div>
 
-                        <div class="app-feedback-form" style="display:none;">
+                        <div class="app-feedback-pane app-feedback-form" style="display:none;">
                             <div class="app-feedback-target">
                                 <div class="app-feedback-target-title"></div>
                                 <div class="app-feedback-target-name"></div>
@@ -104,7 +107,7 @@ async function UIWindowAppFeedback (options) {
                             </div>
                         </div>
 
-                        <div class="app-feedback-success" style="display:none;">
+                        <div class="app-feedback-pane app-feedback-success" style="display:none;">
                             <div class="app-feedback-success-check" aria-hidden="true">
                                 <svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.4" stroke-linecap="round" stroke-linejoin="round"><path d="M20 6 9 17l-5-5"/></svg>
                             </div>

src/gui/src/UI/UIWindowAppFeedback.test.js

@@ -0,0 +1,68 @@
+/*
+ * Copyright (C) 2024-present Puter Technologies Inc.
+ *
+ * This file is part of Puter.
+ *
+ * Puter is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published
+ * by the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <https://www.gnu.org/licenses/>.
+ */
+
+// @vitest-environment jsdom
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
+import jQuery from '../lib/jquery-3.6.1/jquery-3.6.1.min.js';
+
+const { default: UIWindowAppFeedback } = await import('./UIWindowAppFeedback.js');
+
+const flush = () => new Promise((r) => setTimeout(r, 0));
+const $ = (sel) => jQuery(sel);
+const visiblePanes = () => $('.app-feedback-pane').filter((_, el) => el.style.display !== 'none');
+
+/** Opens the dialog against an app that accepts feedback and waits for the form. */
+const open = async (options) => {
+    globalThis.fetch = vi.fn(async () => new Response(JSON.stringify({
+        enabled: true,
+        app: { title: 'Build with AI', name: 'builder' },
+    }), { status: 200, headers: { 'Content-Type': 'application/json' } }));
+    UIWindowAppFeedback({ origin: 'https://builder.puter.test', source: 'web', ...options });
+    await flush();
+    await flush();
+};
+
+beforeEach(() => {
+    document.body.innerHTML = '';
+    globalThis.$ = jQuery;
+    globalThis.i18n = (key) => key;
+    globalThis.html_encode = (value) => jQuery('<div>').text(value).html();
+    window.api_origin = 'https://api.puter.test';
+    window.auth_token = 'token';
+});
+
+afterEach(() => {
+    $(document).off('keydown');
+});
+
+describe('UIWindowAppFeedback', () => {
+    it('floats over the page by default', async () => {
+        await open();
+        expect($('.app-feedback-overlay').hasClass('app-feedback-fullpage')).toBe(false);
+        expect(visiblePanes().hasClass('app-feedback-form')).toBe(true);
+    });
+
+    it('fills the page when hosted in its own popup', async () => {
+        await open({ fullpage: true });
+        expect($('.app-feedback-overlay').hasClass('app-feedback-fullpage')).toBe(true);
+        expect(visiblePanes()).toHaveLength(1);
+        expect(visiblePanes().hasClass('app-feedback-form')).toBe(true);
+        expect($('.app-feedback-target-title').text()).toBe('Build with AI');
+    });
+});

src/gui/src/UI/UIWindowAttachCustomDomain.js

@@ -18,31 +18,25 @@
  */
 
 import { isPlausibleHostname, normalizeHostnameInput } from '../helpers/customDomainHostname.js';
+import {
+    customDomainErrorText,
+    customDomainsRequest,
+    customDomainStatus as statusOf,
+    formatCustomDomainPrice,
+    mergeCustomDomainRefresh,
+} from '../helpers/customDomains.js';
 
 let attach_modal_seq = 0;
 
 const SUCCESS_AUTOCLOSE_MS = 1800;
 const COPIED_RESET_MS = 1400;
 
-/** API error code → message key; anything unlisted gets the generic error. */
-const ERROR_KEYS = {
-    invalid_hostname: 'custom_domain_error_invalid',
-    custom_domain_taken: 'custom_domain_error_taken',
-    custom_domain_limit_reached: 'custom_domain_error_limit',
-    custom_domain_rejected: 'custom_domain_error_rejected',
-    site_not_found: 'custom_domain_error_site',
-    custom_domain_not_found: 'custom_domain_error_not_found',
-    custom_domains_not_enabled: 'custom_domain_not_enabled',
-    custom_domains_permission_required: 'custom_domain_error_generic',
-};
-
-/** Domain status → the badge shown for it; anything else reads as pending. */
+/** Domain status → the badge shown for it. */
 const STATUS_BADGE_KEYS = {
     active: 'custom_domain_badge_active',
     pending: 'custom_domain_badge_pending',
     failed: 'custom_domain_badge_failed',
 };
-const statusOf = (domain) => (domain?.status in STATUS_BADGE_KEYS ? domain.status : 'pending');
 
 const svg = (body, strokeWidth = 2) =>
     `<svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="${strokeWidth}" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true">${body}</svg>`;
@@ -55,19 +49,6 @@ const ICON_ALERT = svg('<circle cx="12" cy="12" r="9"/><path d="M12 7.5v5"/><pat
 const ICON_PLUS = svg('<path d="M12 5v14M5 12h14"/>', 2.2);
 const ICON_X = svg('<line x1="6" y1="6" x2="18" y2="18"/><line x1="18" y1="6" x2="6" y2="18"/>', 2.2);
 
-const format_price = (pricing) => {
-    if ( ! pricing || typeof pricing.amount !== 'number' ) return null;
-    try {
-        return new Intl.NumberFormat(undefined, {
-            style: 'currency',
-            currency: pricing.currency || 'USD',
-            minimumFractionDigits: 2,
-        }).format(pricing.amount);
-    } catch {
-        return null;
-    }
-};
-
 /**
  * "Connect a custom domain to this site" modal, behind
  * `puter.hosting.attach()`. The user picks one of their domains (moving it
@@ -102,7 +83,7 @@ async function UIWindowAttachCustomDomain (options) {
         const titleId = `${modal_id}-title`;
         const closeLabel = html_encode(i18n('close'));
         const h = `
-            <div class="app-feedback-overlay custom-domain-overlay${options.fullpage ? ' custom-domain-fullpage' : ''}" role="dialog" aria-modal="true" aria-labelledby="${titleId}">
+            <div class="app-feedback-overlay custom-domain-overlay${options.fullpage ? ' app-feedback-fullpage' : ''}" role="dialog" aria-modal="true" aria-labelledby="${titleId}">
                 <div class="app-feedback-modal custom-domain-modal" tabindex="-1">
                     <div class="app-feedback-head custom-domain-head">
                         <div class="custom-domain-head-icon">${ICON_GLOBE}</div>
@@ -114,13 +95,13 @@ async function UIWindowAttachCustomDomain (options) {
                         <button type="button" class="app-feedback-x" aria-label="${closeLabel}" title="${closeLabel}">${ICON_X}</button>
                     </div>
                     <div class="app-feedback-body custom-domain-body">
-                        <div class="custom-domain-pane" data-pane="loading" aria-busy="true">
+                        <div class="app-feedback-pane custom-domain-pane" data-pane="loading" aria-busy="true">
                             <span class="custom-domain-sr">${i18n('loading')}…</span>
                             <div class="custom-domain-skeleton"><span></span><span></span></div>
                             <div class="custom-domain-skeleton"><span></span><span></span></div>
                         </div>
 
-                        <div class="custom-domain-pane custom-domain-state" data-pane="unavailable" style="display:none;">
+                        <div class="app-feedback-pane custom-domain-pane custom-domain-state" data-pane="unavailable" style="display:none;">
                             <div class="custom-domain-state-icon">${ICON_ALERT}</div>
                             <p class="app-feedback-unavailable-message"></p>
                             <div class="app-feedback-actions">
@@ -128,7 +109,7 @@ async function UIWindowAttachCustomDomain (options) {
                             </div>
                         </div>
 
-                        <div class="custom-domain-pane" data-pane="list" style="display:none;">
+                        <div class="app-feedback-pane custom-domain-pane" data-pane="list" style="display:none;">
                             <ul class="custom-domain-list"></ul>
                             <div class="custom-domain-state custom-domain-empty" style="display:none;">
                                 <div class="custom-domain-state-icon">${ICON_GLOBE}</div>
@@ -143,7 +124,7 @@ async function UIWindowAttachCustomDomain (options) {
                             </div>
                         </div>
 
-                        <form class="custom-domain-pane" data-pane="add" style="display:none;" novalidate>
+                        <form class="app-feedback-pane custom-domain-pane" data-pane="add" style="display:none;" novalidate>
                             <label class="custom-domain-label" for="${modal_id}-hostname">${i18n('custom_domain_hostname_label')}</label>
                             <div class="custom-domain-field">
                                 ${ICON_GLOBE}
@@ -162,7 +143,7 @@ async function UIWindowAttachCustomDomain (options) {
                             </div>
                         </form>
 
-                        <div class="custom-domain-pane" data-pane="records" style="display:none;">
+                        <div class="app-feedback-pane custom-domain-pane" data-pane="records" style="display:none;">
                             <div class="custom-domain-status-card">
                                 <div class="custom-domain-status-icon"></div>
                                 <div class="custom-domain-status-main">
@@ -184,7 +165,7 @@ async function UIWindowAttachCustomDomain (options) {
                             </div>
                         </div>
 
-                        <div class="custom-domain-pane app-feedback-success custom-domain-success" data-pane="success" role="status" style="display:none;">
+                        <div class="app-feedback-pane custom-domain-pane app-feedback-success custom-domain-success" data-pane="success" role="status" style="display:none;">
                             <div class="app-feedback-success-check">${ICON_CHECK}</div>
                             <p class="app-feedback-success-text custom-domain-success-text"></p>
                             <p class="app-feedback-note custom-domain-success-note"></p>
@@ -254,35 +235,7 @@ async function UIWindowAttachCustomDomain (options) {
             focusedBeforeBusy = null;
         };
 
-        const api = async (method, path = '', body) => {
-            const res = await fetch(`${window.api_origin}/custom-domains${path}`, {
-                method,
-                headers: {
-                    'Authorization': `Bearer ${authToken}`,
-                    ...(body ? { 'Content-Type': 'application/json' } : {}),
-                },
-                body: body ? JSON.stringify(body) : undefined,
-            });
-            let data = null;
-            try {
-                data = await res.json();
-            } catch {
-                // Non-JSON body; callers go by the status.
-            }
-            return { status: res.status, ok: res.ok, data };
-        };
-        // A known code gets our wording; anything else shows what the server
-        // said, which beats a generic message when something is misconfigured.
-        const errorFor = (res) => {
-            if ( res.status === 402 ) return text('custom_domain_error_plan');
-            if ( res.status === 429 ) return text('custom_domain_error_rate_limited');
-            const key = ERROR_KEYS[res.data?.code];
-            if ( key ) return text(key);
-            if ( typeof res.data?.message === 'string' && res.data.message ) {
-                return res.data.message;
-            }
-            return `${text('custom_domain_error_generic')} (HTTP ${res.status})`;
-        };
+        const api = (method, path = '', body) => customDomainsRequest(method, path, body, authToken);
 
         // Escape backs out of a pending confirmation first. Escape, the
         // backdrop and the close buttons all dismiss, except while a request
@@ -503,7 +456,7 @@ async function UIWindowAttachCustomDomain (options) {
             try {
                 const res = await api('PATCH', `/${encodeURIComponent(item.uuid)}`, { site: subdomain });
                 if ( ! res.ok ) {
-                    showError('list', errorFor(res));
+                    showError('list', customDomainErrorText(res));
                     return;
                 }
                 settleOn(res.data);
@@ -524,7 +477,7 @@ async function UIWindowAttachCustomDomain (options) {
             try {
                 const res = await api('DELETE', `/${encodeURIComponent(item.uuid)}`);
                 if ( ! res.ok && res.status !== 404 ) {
-                    showError(pane, errorFor(res));
+                    showError(pane, customDomainErrorText(res));
                     return false;
                 }
                 // A removed domain is no answer to hand the caller.
@@ -611,7 +564,7 @@ async function UIWindowAttachCustomDomain (options) {
                     return;
                 }
                 if ( ! res.ok ) {
-                    showError('add', errorFor(res));
+                    showError('add', customDomainErrorText(res));
                     return;
                 }
                 hideClaim();
@@ -650,7 +603,7 @@ async function UIWindowAttachCustomDomain (options) {
                 .toggle(!!domain.statusDetail && status !== 'active');
             const $redirect = $overlay.find('.custom-domain-redirect').toggle(!!domain.redirectFrom);
             if ( domain.redirectFrom ) {
-                $redirect.html(i18n('custom_domain_redirect_note', [domain.redirectFrom, domain.hostname]));
+                $redirect.html(i18n('custom_domain_redirect_note', [domain.hostname, domain.redirectFrom]));
             }
             $overlay.find('.custom-domain-apex').toggle(domain.isApex === true);
             $overlay.find('.custom-domain-use-www').toggle(domain.isApex === true && status !== 'active');
@@ -670,22 +623,10 @@ async function UIWindowAttachCustomDomain (options) {
             try {
                 const res = await api('GET', `/${encodeURIComponent(chosen.uuid)}`);
                 if ( ! res.ok ) {
-                    showError('records', errorFor(res));
+                    showError('records', customDomainErrorText(res));
                     return;
                 }
-                // A domain that is no longer pending comes back with only its
-                // routing record, and a GET never repeats the provider or the
-                // redirect; keep what was shown when it was added.
-                const known = chosen.records ?? [];
-                const redirect = known.filter((r) => r.purpose === 'redirect');
-                const fresh = (res.data.records?.length > 1 ? res.data.records : known)
-                    .filter((r) => r.purpose !== 'redirect');
-                const next = {
-                    ...res.data,
-                    dnsProvider: chosen.dnsProvider,
-                    redirectFrom: chosen.redirectFrom,
-                    records: [...fresh.slice(0, 1), ...redirect, ...fresh.slice(1)],
-                };
+                const next = mergeCustomDomainRefresh(chosen, res.data);
                 if ( statusOf(next) === 'active' ) {
                     showSuccess(next);
                     return;
@@ -706,7 +647,7 @@ async function UIWindowAttachCustomDomain (options) {
             try {
                 const res = await api('POST', `/${encodeURIComponent(chosen.uuid)}/use-www`);
                 if ( ! res.ok ) {
-                    showError('records', errorFor(res));
+                    showError('records', customDomainErrorText(res));
                     return;
                 }
                 chosen = res.data;
@@ -758,7 +699,7 @@ async function UIWindowAttachCustomDomain (options) {
                     return;
                 }
                 renderList(res.data?.items ?? []);
-                const price = format_price(res.data?.pricing);
+                const price = formatCustomDomainPrice(res.data?.pricing);
                 if ( price ) {
                     $overlay.find('.custom-domain-price').text(text('custom_domain_price_note', [price])).show();
                 }

src/gui/src/UI/UIWindowLogin.js

@@ -1,460 +0,0 @@
-/*
- * Copyright (C) 2024-present Puter Technologies Inc.
- *
- * This file is part of Puter.
- *
- * Puter is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Affero General Public License as published
- * by the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU Affero General Public License for more details.
- *
- * You should have received a copy of the GNU Affero General Public License
- * along with this program.  If not, see <https://www.gnu.org/licenses/>.
- */
-
-import UIWindowLogin2FA from './UIWindowLogin2FA.js';
-import UIWindow from './UIWindow.js';
-import UIWindowRecoverPassword from './UIWindowRecoverPassword.js';
-import UIWindowSignup from './UIWindowSignup.js';
-import { KNOWN_OIDC_PROVIDERS, OIDC_GENERIC_PROVIDER_ICON, humanizeOidcProviderId } from '../util/openid.js';
-import { offersFederatedSignInInPopup } from '../util/popupAuth.js';
-import { get_auth_redirect_url, get_oidc_return_to } from '../helpers/authRedirect.js';
-import { authLogoHeader, wireAuthLogoHeader } from '../helpers/authLogoHeader.js';
-import { isAttestedOrigin } from '../helpers/attestedOrigin.js';
-
-async function UIWindowLogin (options) {
-    options = options ?? {};
-
-    if ( options.reload_on_success === undefined )
-    {
-        options.reload_on_success = true;
-    }
-
-    if ( options.redirect_url === undefined )
-    {
-        // stay on the page the login started from (e.g. an /app/<name>
-        // landing), with standalone auth pages going to the root dashboard
-        options.redirect_url = get_auth_redirect_url();
-    }
-
-    return new Promise(async (resolve) => {
-        const internal_id = window.uuidv4();
-
-        let h = '';
-        h += '<div style="max-width:100%; width:100%; height:100%; min-height:0; box-sizing:border-box; display:flex; flex-direction:column; justify-content:center; align-items:stretch; padding:0; overflow:auto; color:var(--color-text);">';
-        // logo
-        const logo_clickable = !!options.window_options?.cover_page && !window.embedded_in_popup;
-        h += '<div class="logo-wrapper" style="display:flex; justify-content:center; padding:20px 20px 0 20px; margin-bottom: 0;">';
-        h += authLogoHeader({
-            logoSrc: window.icons['logo-white.svg'],
-            logoClickable: logo_clickable,
-            openerOrigin: window.embedded_in_popup && isAttestedOrigin(window.openerOrigin) ? window.openerOrigin : '',
-            openerFallbackSrc: window.icons['website.svg'],
-        });
-        h += '</div>';
-        // title
-        h += '<div style="padding:10px 20px; text-align:center; margin-bottom:0;">';
-        h += `<h1 class="login-form-title">${i18n('log_in')}</h1>`;
-        // In a sign-in popup, say which site brought the user here.
-        if (window.embedded_in_popup && isAttestedOrigin(window.openerOrigin)) {
-            h += `<p class="auth-opener-notice">${i18n('popup_opener_uses_puter', [new URL(window.openerOrigin).hostname])}</p>`;
-        }
-        h += '</div>';
-        // form
-        h += '<div style="padding:20px; overflow-y:auto; overflow-x:hidden;">';
-        h += '<form class="login-form" style="width:100%; width: 100%; max-width: 400px; margin: 0 auto;">';
-        // server messages
-        h += '<div class="login-error-msg" style="color:#e74c3c; display:none; margin-bottom:10px; line-height:15px; font-size:13px;"></div>';
-        // email or username
-        h += '<div style="position: relative; margin-bottom: 20px;">';
-        h += `<label style="display:block; margin-bottom:5px;">${i18n('email_or_username')}</label>`;
-        if ( options.email_or_username ) {
-            h += `<input type="text" class="email_or_username" value="${options.email_or_username}" autocomplete="username"/>`;
-        } else {
-            h += '<input type="text" class="email_or_username" autocomplete="username"/>';
-        }
-        h += '</div>';
-        // password
-        h += '<div style="position: relative; margin-bottom: 20px;">';
-        h += '<div style="display:flex; justify-content:space-between; align-items:baseline; margin-bottom:5px;">';
-        h += `<label style="margin-bottom:0;">${i18n('password')}</label>`;
-        h += `<span class="forgot-password-link" style="font-size:13px;">${i18n('forgot_pass_c2a')}</span>`;
-        h += '</div>';
-        h += `<input id="password-${internal_id}" class="password" type="${options.show_password ? 'text' : 'password'}" name="password" autocomplete="current-password"/>`;
-        // show/hide icon
-        h += `<span style="position: absolute; right: 5%; top: 50%; cursor: pointer;" id="toggle-show-password-${internal_id}">
-                                <img class="toggle-show-password-icon" src="${options.show_password ? window.icons['eye-closed.svg'] : window.icons['eye-open.svg']}" width="20" height="20">
-                            </span>`;
-        h += '</div>';
-        // login
-        h += `<button type="submit" class="login-btn button button-primary button-block button-normal">${i18n('log_in')}</button>`;
-        // OIDC
-        h += '<div class="oidc-providers-wrapper" style="display:none; padding: 0 0 10px 0;">';
-        h += `<div style="display:flex; align-items:center; gap:10px; margin: 10px 0; font-size:13px; color:#888;"><div style="flex:1; height:1px; background-color:#d0d0d0;"></div><span>${ i18n('or') }</span><div style="flex:1; height:1px; background-color:#d0d0d0;"></div></div>`;
-        h += `<button type="button" class="oidc-google-btn oidc-btn button button-block button-normal" style="display:none; align-items:center; justify-content:center; gap:8px;"><img style="width: 20px; height: 20px;" src="data:image/webp;base64,UklGRu4GAABXRUJQVlA4WAoAAAAQAAAAXwAAXwAAQUxQSAUDAAABoATJtmnbGs+23+vZtm3btm3btnHxjG/btm3bnI197tljzjXjtSNiAnAjmbNs8x5DR40e2qtFhTzuVJ2e+rrE/ODKwsZe5J90n9CfXVw6vLEvifIH87OHVOK0mLxSLpSyd4vZhyuGkP+amL45j7lVYn6+rQpfSYDvFzO0QgIdYeZJCTbNRpnfJeDXLTSQsH/X6yiBj1TrIoEPgnZzCXwwtMtL4AOhnfP/wPpC/X0Jux/Uj4jySzsGVskJADkq9dn4JKEP1NuJ6gMDELvrrTF6QP9fjX0FQc2xLZme0E8Tfko20LOmZdAD+tWF/lVlqNb7I9IFBt+hpUD9CZGuMNhT2ONh8GJvWPyK1QZedhdyS7j5Bqkf3Kwo3A3w8yTneTgq3NyOdOZMhqPplM/h6Z+Urp6UF+ZX8HQGZZIrVylw9SvGnRqP33ev2QdSEwlzpIaYTlCOUtSLQpGujN/hRePIFMZDbgyOrGUcdGNe5CBjoRtbIimMMW4ciVxgDHQjxb0LkRTGGF8OMha6kRZZyzjkxrHIFMbDbmyPdGX84cbiSDmGFPNiZASU0V60SvAV4y4vyiS4yhCNSuXZxb5lIOEMyngFRSF+nqg85YsAOjNuSoQ/GdLJXhpjfgbplE/tCbN2Bp0pMtHaBAoy5khOY78yHkjiJOdZW3OEOSmJihxZaymPUPMlgTc40sfQy5RnkWx3kjQ3c0ioI5LClyRpZWSRcJF8T5aMNbFKuHti4B2WnDVwUcj541SnyVeVlCp/KeQ0xE6jiZzNppD1jNDzxcO/PJG9BUhF9gl/B4jtNEQeGBAv55gnRfFfUI+oiMhLOwZWyRnJXKbltLOfim4nDt5XMn0N5Jz/e/Eb6OW9KMtDcx8GQrOLB6ug2zG8fdBuENoB6Jf5PaiVMPlkQP1hdEUov5aH2QpfBXETTK+y91dnGM9/zdh2BFj2bkNn8iHMEqeN7MiJgMe+pPZwP4Sef9J9vL8vD8oMH6tOT309zo+P7BlcAs7mLNu8x9BRY4b1aVO9MG4cAQBWUDggwgMAABAVAJ0BKmAAYAA+bSyTRqQiIaEtVEyQgA2JbAC++hZa3jl94/Jj2rrA/Tvv9y7x+OzH+L5o/8p7APMA/TPpD+YD+bf4T9bPfW/mfqo/wHqAf0v/hdYB6AH7Aemp+5HwS/uN+6XtXdQB1N/Rj+m/RWYp6GESYsQNCm+TZ3BvtEgBK+isF38GQzHNMrw+tkbAm5lUM4rWqU9srOS+RuAUa8nFYoFrGH73Fzd++s+LPyEGAAD+Yg+gQRuJCapqteWj86DdkHmfHdS+mWVn7Ue8RiK5AaWCIe7RXaDKn0baNe80expR5tTBclgnd+SEzNZ6N3NL1suPhGwRqKzB5wNnWUXD7R0IkT5uIwUhTsO/1ucVEMKvTZRe4j7WwrA+e53P8J1/cdIvKtrtZv9AH5u1heZ1dGQELuxMxbQUnrw6IUh0YLBKEjNnR3JIsFNwkC+WLw4wkCMati73lcMjT6U2KIYsr0g5bPzSmo3ir9qRjtIqthpPIvuvYt8AbMewSj96NIqTM14M6ABtOaY87d8HOU7baFGGQjU1f8vf7SV5AjDrfW0VVzQcBez+PYiPApyQUAozEmZFKBDvX9ifFFacoulG9NCPDXa1mRPVwzrKuN3VfwUfv8Bx8QJ88prsOCDd8UvNDnUzbRqBXOmQ4co+/xYy/iQV89GHs4pb0D2LYwv6aY8yPLCrYyAPUe4dKEh/FBqRBJ/716CJVMTCrvB+gSgPwNjN5LlnNQqkBsHnSqdUFddjvBKNdm6zm8ggLFJl14S37sJW1fAEbiB0IqxcqlJOWol+ecJy9xdESchmlROmo/4/9V34VN2cw8NUB5POPUNzivyMFfgF27QTFXgya/LF3OsfHMF6Itejgy4ab38VPFjez5f8Z/b/dhYV21SflE4KtUj8LZDrQXRp+Pzdf/gWfvm2oLh0x+Fr+ggo2jjG3DFn95Wj1P3ra1RtzYE8ffXBeR2lDhL+GPJiiZaVinGMkjVYup0AghAhIfVgFtsL8lhMyJY84ccksHz92o1/J3NfrGSM8NwOv7ieeBjq2eqCOmrUHpG3mlr8Hj/fR4d+orLlpipLTh3+cRY7suXQXw9SPYZieoKS/JE9y0f+BcWCzdNshWl2oVpeK2qm36iFltfGZUvXdfBKufE9RkZcyOBDUVeONlBchjuaLPNd6fSlk41Pp57nF5MmES2Kl7HqY+f2pvS71eIgUXpqtAFIY94JSmNre+g49tL8VnZlJNqgVhj/De//5zH/84h//5uJfunlawY99GgDkm8cYFbIAAAA" />${i18n('sign_in_with_google')}</button>`;
-        h += `<button type="button" class="oidc-microsoft-btn oidc-btn button button-block button-normal" style="display:none; align-items:center; justify-content:center; gap:8px; margin-top:8px;"><svg style="width:20px; height:20px;" viewBox="0 0 23 23" fill="none"><rect x="1" y="1" width="10" height="10" fill="#f25022"/><rect x="12" y="1" width="10" height="10" fill="#7fba00"/><rect x="1" y="12" width="10" height="10" fill="#00a4ef"/><rect x="12" y="12" width="10" height="10" fill="#ffb900"/></svg>${i18n('sign_in_with_microsoft')}</button>`;
-        h += `<button type="button" class="oidc-apple-btn oidc-btn button button-block button-normal" style="display:none; align-items:center; justify-content:center; gap:8px; margin-top:8px;"><svg style="width:20px; height:20px;" viewBox="0 0 384 512" fill="currentColor"><path d="M318.7 268.7c-.2-36.7 16.4-64.4 50-84.8-18.8-26.9-47.2-41.7-84.7-44.6-35.5-2.8-74.3 20.7-88.5 20.7-15 0-49.4-19.7-76.4-19.7C63.3 141.2 4 184.8 4 273.5q0 39.3 14.4 81.2c12.8 36.7 59 126.7 107.2 125.2 25.2-.6 43-17.9 75.8-17.9 31.8 0 48.3 17.9 76.4 17.9 48.6-.7 90.4-82.5 102.6-119.3-65.2-30.7-61.7-90-61.7-91.9zm-56.6-164.2c27.3-32.4 24.8-61.9 24-72.5-24.1 1.4-52 16.4-67.9 34.9-17.5 19.8-27.8 44.3-25.6 71.9 26.1 2 49.9-11.4 69.5-34.3z"/></svg>${i18n('sign_in_with_apple')}</button>`;
-        h += '<div class="oidc-custom-providers"></div>';
-        h += '</div>';
-        h += '</form>';
-        h += '</div>';
-        // create account link
-
-        // If show_signup_button is undefined, the default behavior is to show it.
-        // If show_signup_button is set to false, the button will not be shown.
-        if ( options.show_signup_button === undefined || options.show_signup_button ) {
-            h += '<div class="c2a-wrapper" style="padding:20px;">';
-            h += `<button class="signup-c2a-clickable">${i18n('create_free_account')}</button>`;
-            h += '</div>';
-        }
-        h += '</div>';
-
-        const el_window = await UIWindow({
-            title: null,
-            app: 'login',
-            single_instance: true,
-            icon: null,
-            uid: null,
-            is_dir: false,
-            body_content: h,
-            has_head: true,
-            selectable_body: false,
-            draggable_body: false,
-            allow_context_menu: false,
-            is_draggable: options.is_draggable ?? true,
-            is_droppable: false,
-            is_resizable: false,
-            stay_on_top: false,
-            allow_native_ctxmenu: true,
-            allow_user_select: true,
-            ...options.window_options,
-            width: 350,
-            dominant: true,
-            on_close: () => {
-                resolve(false);
-            },
-            onAppend: function (this_window) {
-                if ( options.authError ) {
-                    $(this_window).find('.login-error-msg').html(html_encode(options.authError)).fadeIn();
-                }
-                if ( ! window.disable_login_autofocus )
-                {
-                    $(this_window).find('.email_or_username').get(0).focus({ preventScroll: true });
-                }
-            },
-            window_class: 'window-login',
-            window_css: {
-                height: 'initial',
-            },
-            body_css: {
-                width: 'initial',
-                padding: '0',
-                'background-color': 'rgb(255 255 255)',
-                'backdrop-filter': 'blur(3px)',
-                'display': 'flex',
-                'flex-direction': 'column',
-                'justify-content': 'center',
-                'align-items': 'center',
-            },
-        });
-
-        wireAuthLogoHeader(el_window);
-
-        if ( logo_clickable ) {
-            $(el_window).find('.auth-logo').on('click', function () {
-                // keep desktop users on the desktop; everyone else goes to the root dashboard
-                window.location.href = window.location.pathname === '/desktop' ? '/desktop' : '/';
-            });
-        }
-
-        $(el_window).find('.forgot-password-link').on('click', function (e) {
-            UIWindowRecoverPassword({
-                window_options: {
-                    backdrop: true,
-                    // A stay-on-top login window (dashboard mode) sits in the
-                    // 99999999+ band; this dialog must join it there or it
-                    // opens buried under the login window's backdrop.
-                    stay_on_top: isMobile.phone || !!options.window_options?.stay_on_top,
-                    close_on_backdrop_click: false,
-                },
-            });
-        });
-
-        (async () => {
-            try {
-                // A federated hop navigates this popup away and the provider
-                // returns it as a plain sign-in popup, losing whatever the popup
-                // was opened to do — and, for a permission prompt, handing the
-                // opener a token instead of a decision. Don't offer it there.
-                // A cross-origin-isolated opener can only get the token through
-                // the session relay, which the provider's return doesn't keep.
-                if ( window.embedded_in_popup
-                    && ( ! offersFederatedSignInInPopup(window.gui_action)
-                        || window.url_query_params?.get('cross_origin_isolated') === 'true' ) ) {
-                    return;
-                }
-                const res = await fetch(`${window.api_origin}/auth/oidc/providers`);
-                if ( ! res.ok ) return;
-                const data = await res.json();
-                if ( ! data.providers ) return;
-
-                const wireOidcBtn = (provider, btnClass) => {
-                    $(el_window).find(btnClass).css('display', 'flex');
-                    $(el_window).find(btnClass).on('click', function () {
-                        let url = `${window.gui_origin}/auth/oidc/${provider}/start?flow=login`;
-
-                        // return to the interface the login started from (backend whitelists the path)
-                        const return_to = get_oidc_return_to();
-                        if ( return_to ) {
-                            url += `&return_to=${encodeURIComponent(return_to)}`;
-                        }
-
-                        const referrer = options.referrer ?? window.referrerStr ?? window.openerOrigin;
-                        if ( referrer ) {
-                            url += `&referrer=${encodeURIComponent(referrer)}`;
-                        }
-                        // A provider login can create the account, so a signup link's code rides along.
-                        if ( window.signup_bonus_code ) {
-                            url += `&bonusCode=${encodeURIComponent(window.signup_bonus_code)}`;
-                        }
-                        if ( window.embedded_in_popup && window.url_query_params?.get('msg_id') ) {
-                            url += `&embedded_in_popup=true&msg_id=${encodeURIComponent(window.url_query_params.get('msg_id'))}`;
-                            if ( window.openerOrigin ) {
-                                url += `&opener_origin=${encodeURIComponent(window.openerOrigin)}`;
-                            }
-                        }
-                        window.location.href = url;
-                    });
-                };
-
-                let hasProvider = false;
-                if ( data.providers.includes('google') ) { hasProvider = true; wireOidcBtn('google', '.oidc-google-btn'); }
-                if ( data.providers.includes('apple') ) { hasProvider = true; wireOidcBtn('apple', '.oidc-apple-btn'); }
-                if ( data.providers.includes('microsoft') ) { hasProvider = true; wireOidcBtn('microsoft', '.oidc-microsoft-btn'); }
-
-                // Any other configured provider (e.g. a self-hosted admin's
-                // custom OIDC IdP) gets a generic button.
-                data.providers
-                    .filter(provider => !KNOWN_OIDC_PROVIDERS.includes(provider))
-                    .forEach((provider, idx) => {
-                        hasProvider = true;
-                        const btnClass = `oidc-custom-btn-${idx}`;
-                        const label = humanizeOidcProviderId(provider);
-                        $(el_window).find('.oidc-custom-providers').append(
-                            `<button type="button" class="${btnClass} button button-block button-normal" style="display:flex; align-items:center; justify-content:center; gap:8px; margin-top:8px;">${OIDC_GENERIC_PROVIDER_ICON}${i18n('sign_in_with_provider', [label])}</button>`,
-                        );
-                        wireOidcBtn(provider, `.${btnClass}`);
-                    });
-
-                if ( hasProvider ) $(el_window).find('.oidc-providers-wrapper').show();
-            } catch (_) {
-            }
-        })();
-
-        $(el_window).find('.login-btn').on('click', function (e) {
-            // Prevent default button behavior (important for async requests)
-            e.preventDefault();
-
-            // Clear previous error states
-            $(el_window).find('.login-error-msg').hide();
-
-            const email_username = $(el_window).find('.email_or_username').val();
-            const password = $(el_window).find('.password').val();
-
-            // Basic validation for email/username and password
-            if ( ! email_username ) {
-                $(el_window).find('.login-error-msg').html(i18n('login_email_username_required'));
-                $(el_window).find('.login-error-msg').fadeIn();
-                return;
-            }
-
-            if ( ! password ) {
-                $(el_window).find('.login-error-msg').html(i18n('login_password_required'));
-                $(el_window).find('.login-error-msg').fadeIn();
-                return;
-            }
-
-            // Prepare data for the request
-            // When this login was triggered by a 401 reauth_required,
-            // forward `auth_id` (and the originating reason) so the
-            // backend can re-attach the user/session to the same
-            // stable identity.
-            const reauth_payload = options.auth_id
-                ? { auth_id: options.auth_id, reauth_reason: options.reauth_reason }
-                : {};
-            let data;
-            if ( window.is_email(email_username) ) {
-                data = JSON.stringify({
-                    email: email_username,
-                    password: password,
-                    ...reauth_payload,
-                });
-            } else {
-                data = JSON.stringify({
-                    username: email_username,
-                    password: password,
-                    ...reauth_payload,
-                });
-            }
-
-            let headers = {};
-            if ( window.custom_headers )
-            {
-                headers = window.custom_headers;
-            }
-
-            // Disable the login button to prevent multiple submissions
-            $(el_window).find('.login-btn').prop('disabled', true);
-
-            $.ajax({
-                url: `${window.gui_origin }/login`,
-                type: 'POST',
-                async: true,
-                headers: headers,
-                contentType: 'application/json',
-                data: data,
-                success: async function (data) {
-                    // Keep the button disabled on success since we're redirecting or closing
-                    if ( data.next_step === 'otp' ) {
-                        const verified = await UIWindowLogin2FA(data.otp_jwt_token);
-                        if ( ! verified ) {
-                            $(el_window).find('.login-btn').prop('disabled', false);
-                            return;
-                        }
-                        data = verified;
-                    }
-
-                    await window.update_auth_data(data.token, data.user);
-
-                    if ( options.reload_on_success ) {
-                        window.onbeforeunload = null;
-                        // Replace with a clean URL to prevent password leakage
-                        const cleanUrl = options.redirect_url || window.location.origin + window.location.pathname;
-                        window.location.replace(cleanUrl);
-                    } else
-                    {
-                        resolve(true);
-                    }
-                    $(el_window).close();
-                },
-                error: function (err) {
-                    // First, ensure URL is clean in case of error (prevent password leakage)
-                    if ( window.location.search && (
-                        window.location.search.includes('password=') ||
-                        window.location.search.includes('username=') ||
-                        window.location.search.includes('email=')
-                    ) ) {
-                        const cleanUrl = window.location.origin + window.location.pathname;
-                        history.replaceState({}, document.title, cleanUrl);
-                    }
-
-                    // Enable 'Log In' button
-                    $(el_window).find('.login-btn').prop('disabled', false);
-
-                    // Handle captcha-specific errors
-                    const errorText = err.responseText || '';
-
-                    // Try to parse error as JSON
-                    try {
-                        const errorJson = JSON.parse(errorText);
-
-                        // If it's a message in the JSON, use that
-                        if ( errorJson.message ) {
-                            $(el_window).find('.login-error-msg').html(errorJson.message);
-                            $(el_window).find('.login-error-msg').fadeIn();
-                            return;
-                        }
-                    } catch (e) {
-                        // Not JSON, continue with text analysis
-                    }
-
-                    // Fall back to original error handling
-                    const $errorMessage = $(el_window).find('.login-error-msg');
-                    if ( err.status === 404 ) {
-                        // Don't include the whole 404 page
-                        $errorMessage.html(`Error 404: "${window.gui_origin}/login" not found`);
-                    } else if ( err.responseText ) {
-                        $errorMessage.html(html_encode(err.responseText));
-                    } else {
-                        // No message was returned. *Probably* this means we couldn't reach the server.
-                        // If this is a self-hosted instance, it's probably a configuration issue.
-                        if ( window.app_domain !== 'puter.com' ) {
-                            $errorMessage.html(`<div style="text-align: left;">
-                                <p>Error reaching "${window.gui_origin}/login". This is likely to be a configuration issue.</p>
-                                <p>Make sure of the following:</p>
-                                <ul style="padding-left: 2em;">
-                                    <li><code>domain</code> in config.json is set to the domain you're using to access puter</li>
-                                    <li>DNS resolves for the domain, and the <code>api.</code> subdomain on that domain</li>
-                                    <li><code>http_port</code> is set to the port Puter is listening on (<code>auto</code> will use <code>4100</code> unless that port is in use)</li>
-                                    <li><code>pub_port</code> is set to the external port (ex: <code>443</code> if you're using a reverse proxy that serves over https)</li>
-                                </ul>
-                            </div>`);
-                        } else {
-                            $errorMessage.html(`Failed to log in: Error ${html_encode(err.status)}`);
-                        }
-                    }
-                    $(el_window).find('.login-error-msg').fadeIn();
-                },
-            });
-        });
-
-        $(el_window).find('.login-form').on('submit', function (e) {
-            e.preventDefault();
-            e.stopPropagation();
-
-            // Instead of triggering the click event, process the login directly
-            const email_username = $(el_window).find('.email_or_username').val();
-            const password = $(el_window).find('.password').val();
-
-            // Basic validation
-            if ( ! email_username ) {
-                $(el_window).find('.login-error-msg').html(i18n('login_email_username_required'));
-                $(el_window).find('.login-error-msg').fadeIn();
-                return false;
-            }
-
-            if ( ! password ) {
-                $(el_window).find('.login-error-msg').html(i18n('password_required') || 'Password is required');
-                $(el_window).find('.login-error-msg').fadeIn();
-                return false;
-            }
-
-            // Process login using the same function as the button click
-            $(el_window).find('.login-btn').click();
-
-            return false;
-        });
-
-        $(el_window).find('.signup-c2a-clickable').on('click', async function (e) {
-            //destroy this window
-            $(el_window).close();
-            // create Signup window
-            const signup = await UIWindowSignup({
-                referrer: options.referrer,
-                show_close_button: options.show_close_button,
-                reload_on_success: options.reload_on_success,
-                redirect_url: options.redirect_url,
-                window_options: options.window_options,
-                send_confirmation_code: options.send_confirmation_code,
-            });
-            if ( signup )
-            {
-                resolve(true);
-            }
-        });
-
-        $(el_window).find(`#toggle-show-password-${internal_id}`).on('click', function (e) {
-            options.show_password = !options.show_password;
-            // hide/show password and update icon
-            $(el_window).find('.password').attr('type', options.show_password ? 'text' : 'password');
-            $(el_window).find('.toggle-show-password-icon').attr('src', options.show_password ? window.icons['eye-closed.svg'] : window.icons['eye-open.svg']);
-        });
-    });
-}
-
-export default UIWindowLogin;

src/gui/src/UI/UIWindowLogin.oidcPopup.test.js

@@ -1,118 +0,0 @@
-// @vitest-environment jsdom
-import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
-import jQuery from '../lib/jquery-3.6.1/jquery-3.6.1.min.js';
-
-const state = vi.hoisted(() => ({ el: null }));
-vi.mock('./UIWindowRecoverPassword.js', () => ({ default: vi.fn() }));
-vi.mock('./UIWindowEmailConfirmationRequired.js', () => ({ default: vi.fn() }));
-vi.mock('./UIWindowPhoneVerificationRequired.js', () => ({ default: vi.fn() }));
-vi.mock('./UIWindowCardVerificationRequired.js', () => ({ default: vi.fn() }));
-vi.mock('../helpers/authLogoHeader.js', () => ({
-    authLogoHeader: () => '',
-    wireAuthLogoHeader: vi.fn(),
-}));
-vi.mock('./UIWindow.js', () => ({
-    default: async (options) => {
-        state.el = document.createElement('div');
-        state.el.innerHTML = options.body_content;
-        document.body.append(state.el);
-        options.onAppend?.(state.el);
-        return state.el;
-    },
-}));
-globalThis.def = globalThis.def ?? ((value) => value);
-const { default: UIWindowLogin } = await import('./UIWindowLogin.js');
-const { default: UIWindowSignup } = await import('./UIWindowSignup.js');
-
-const PROVIDERS_URL = 'https://api.puter.test/auth/oidc/providers';
-const RELAY_POPUP =
-    'embedded_in_popup=true&msg_id=1&cross_origin_isolated=true&signin_session=s';
-const PLAIN_POPUP = 'embedded_in_popup=true&msg_id=1';
-
-const asPopup = (query) => {
-    window.embedded_in_popup = true;
-    window.gui_action = 'sign-in';
-    window.url_query_params = new URLSearchParams(query);
-};
-
-const askedForProviders = () =>
-    fetch.mock.calls.some(([url]) => url === PROVIDERS_URL);
-
-beforeEach(() => {
-    document.body.innerHTML = '';
-    globalThis.$ = jQuery;
-    jQuery.fn.close = vi.fn();
-    globalThis.i18n = (key) => key;
-    globalThis.html_encode = (value) => jQuery('<div>').text(value).html();
-    globalThis.fetch = vi.fn(
-        async () => new Response(JSON.stringify({ providers: ['google'] })),
-    );
-    window.gui_origin = 'https://puter.test';
-    window.api_origin = 'https://api.puter.test';
-    window.gui_params = { turnstileSiteKey: 'site-key' };
-    window.turnstile = { render: vi.fn() };
-    window.icons = {};
-    window.uuidv4 = () => 'oidc-popup-test';
-    window.embedded_in_popup = false;
-    window.gui_action = undefined;
-    window.url_query_params = new URLSearchParams('');
-    state.el = null;
-});
-afterEach(() => {
-    vi.restoreAllMocks();
-});
-
-describe.each([
-    [
-        'login',
-        () => UIWindowLogin({ reload_on_success: false, redirect_url: '/' }),
-        '.login-btn',
-    ],
-    [
-        'signup',
-        () => UIWindowSignup({ reload_on_success: false, redirect_url: '/' }),
-        '.signup-btn',
-    ],
-])('OIDC buttons in the %s window', (_name, open, formButton) => {
-    const rendered = async () => {
-        void open();
-        await vi.waitFor(() =>
-            expect(jQuery(state.el).find(formButton)).toHaveLength(1),
-        );
-    };
-
-    // The provider's return drops the relay that hands the token to an
-    // isolated opener, so only password sign-in can finish there.
-    it('hides them in a cross-origin-isolated relay popup', async () => {
-        asPopup(RELAY_POPUP);
-        await rendered();
-        await new Promise((resolve) => setTimeout(resolve, 0));
-
-        expect(askedForProviders()).toBe(false);
-        expect(jQuery(state.el).find('.oidc-google-btn').css('display')).toBe(
-            'none',
-        );
-    });
-
-    it('keeps them in a regular sign-in popup', async () => {
-        asPopup(PLAIN_POPUP);
-        await rendered();
-
-        await vi.waitFor(() =>
-            expect(
-                jQuery(state.el).find('.oidc-google-btn').css('display'),
-            ).toBe('flex'),
-        );
-    });
-
-    it('keeps them outside a popup', async () => {
-        await rendered();
-
-        await vi.waitFor(() =>
-            expect(
-                jQuery(state.el).find('.oidc-google-btn').css('display'),
-            ).toBe('flex'),
-        );
-        expect(askedForProviders()).toBe(true);
-    });
-});

src/gui/src/UI/UIWindowLogin2FA.js

@@ -1,474 +0,0 @@
-/*
- * Copyright (C) 2024-present Puter Technologies Inc.
- *
- * This file is part of Puter.
- *
- * Puter is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Affero General Public License as published
- * by the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU Affero General Public License for more details.
- *
- * You should have received a copy of the GNU Affero General Public License
- * along with this program.  If not, see <https://www.gnu.org/licenses/>.
- */
-
-import TeePromise from '../util/TeePromise.js';
-import UIWindow from './UIWindow.js';
-
-// ── 2FA Login CSS (injected once) ───────────────────────────────────────────
-const LOGIN_2FA_CSS = `
-.login-2fa {
-    display: flex;
-    flex-direction: column;
-    align-items: center;
-    font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, Helvetica, Arial, sans-serif;
-    color: #1a2233;
-    user-select: none;
-    -webkit-user-select: none;
-}
-
-.login-2fa-icon {
-    width: 52px;
-    height: 52px;
-    border-radius: 50%;
-    background: #eff6ff;
-    display: flex;
-    align-items: center;
-    justify-content: center;
-    margin-bottom: 20px;
-    flex-shrink: 0;
-}
-
-/* ── Screens ──────────────────────────────────────────────────────────── */
-.login-2fa-screen {
-    display: none;
-    flex-direction: column;
-    align-items: center;
-    width: 100%;
-    animation: login-2fa-fade-in 0.25s ease;
-}
-.login-2fa-screen.active {
-    display: flex;
-}
-@keyframes login-2fa-fade-in {
-    from { opacity: 0; transform: translateY(6px); }
-    to   { opacity: 1; transform: translateY(0); }
-}
-
-.login-2fa-title {
-    font-size: 18px;
-    font-weight: 700;
-    color: #1a2233;
-    text-align: center;
-    margin: 0 0 6px;
-}
-.login-2fa-desc {
-    font-size: 14px;
-    line-height: 1.6;
-    color: #64748b;
-    text-align: center;
-    margin: 0 0 24px;
-    padding: 0;
-}
-
-/* ── OTP code inputs ──────────────────────────────────────────────────── */
-.login-2fa-code-inputs {
-    display: flex;
-    gap: 8px;
-    justify-content: center;
-    margin-bottom: 8px;
-    width: 100%;
-    max-width: 300px;
-}
-.login-2fa-code-inputs input {
-    width: 44px;
-    height: 52px;
-    text-align: center;
-    font-size: 22px;
-    font-weight: 600;
-    font-family: 'SF Mono', 'Fira Code', 'Consolas', monospace;
-    border: 2px solid #e2e8f0;
-    border-radius: 10px;
-    background: #fff;
-    color: #1a2233;
-    outline: none;
-    transition: border-color 0.15s ease, box-shadow 0.15s ease;
-    caret-color: #3b82f6;
-    -moz-appearance: textfield;
-}
-.login-2fa-code-inputs input::-webkit-outer-spin-button,
-.login-2fa-code-inputs input::-webkit-inner-spin-button {
-    -webkit-appearance: none;
-    margin: 0;
-}
-.login-2fa-code-inputs input:focus {
-    border-color: #3b82f6;
-    box-shadow: 0 0 0 3px rgba(59, 130, 246, 0.15);
-}
-.login-2fa-code-inputs input.error {
-    border-color: #ef4444;
-    box-shadow: 0 0 0 3px rgba(239, 68, 68, 0.1);
-    animation: login-2fa-shake 0.4s ease;
-}
-@keyframes login-2fa-shake {
-    0%, 100% { transform: translateX(0); }
-    20% { transform: translateX(-4px); }
-    40% { transform: translateX(4px); }
-    60% { transform: translateX(-3px); }
-    80% { transform: translateX(2px); }
-}
-
-/* ── Error message ────────────────────────────────────────────────────── */
-.login-2fa-error {
-    font-size: 13px;
-    color: #ef4444;
-    text-align: center;
-    min-height: 20px;
-    margin-bottom: 4px;
-}
-
-/* ── Spinner ──────────────────────────────────────────────────────────── */
-.login-2fa-spinner {
-    display: none;
-    justify-content: center;
-    align-items: center;
-    gap: 8px;
-    padding: 8px 0;
-    font-size: 13px;
-    color: #64748b;
-}
-.login-2fa-spinner.visible {
-    display: flex;
-}
-.login-2fa-spinner-icon {
-    width: 16px;
-    height: 16px;
-    border: 2px solid #e2e8f0;
-    border-top-color: #3b82f6;
-    border-radius: 50%;
-    animation: login-2fa-spin 0.6s linear infinite;
-}
-@keyframes login-2fa-spin {
-    to { transform: rotate(360deg); }
-}
-
-/* ── Link button ──────────────────────────────────────────────────────── */
-.login-2fa-link-btn {
-    background: none;
-    border: none;
-    color: #3b82f6;
-    font-size: 13px;
-    font-weight: 500;
-    cursor: pointer;
-    padding: 8px 0;
-    margin-top: 8px;
-    transition: color 0.15s ease;
-}
-.login-2fa-link-btn:hover {
-    color: #2563eb;
-    text-decoration: underline;
-}
-
-/* ── Recovery input ───────────────────────────────────────────────────── */
-.login-2fa-recovery-input {
-    width: 100%;
-    max-width: 300px;
-    box-sizing: border-box;
-    height: 52px;
-    font-size: 22px;
-    font-weight: 600;
-    text-align: center;
-    font-family: 'SF Mono', 'Fira Code', 'Consolas', monospace;
-    letter-spacing: 2px;
-    border: 2px solid #e2e8f0;
-    border-radius: 10px;
-    background: #fff;
-    color: #1a2233;
-    outline: none;
-    transition: border-color 0.15s ease, box-shadow 0.15s ease;
-    caret-color: #3b82f6;
-}
-.login-2fa-recovery-input:focus {
-    border-color: #3b82f6;
-    box-shadow: 0 0 0 3px rgba(59, 130, 246, 0.15);
-}
-
-/* ── Recovery error ───────────────────────────────────────────────────── */
-.login-2fa-recovery-error {
-    display: none;
-    font-size: 13px;
-    color: #ef4444;
-    text-align: center;
-    padding: 8px 14px;
-    background: #fef2f2;
-    border: 1px solid #fecaca;
-    border-radius: 8px;
-    margin-bottom: 12px;
-    width: 100%;
-    max-width: 300px;
-    box-sizing: border-box;
-}
-
-/* ── Responsive ───────────────────────────────────────────────────────── */
-@media (max-width: 420px) {
-    .login-2fa-code-inputs {
-        gap: 6px;
-    }
-    .login-2fa-code-inputs input {
-        width: 38px;
-        height: 46px;
-        font-size: 19px;
-        border-radius: 8px;
-    }
-    .login-2fa-recovery-input {
-        height: 46px;
-        font-size: 19px;
-    }
-    .login-2fa-title {
-        font-size: 16px;
-    }
-    .login-2fa-desc {
-        font-size: 13px;
-        margin-bottom: 18px;
-    }
-}
-`;
-
-let login2faCssInjected = false;
-const injectLogin2faCss = () => {
-    if ( login2faCssInjected ) return;
-    login2faCssInjected = true;
-    $('<style/>').text(LOGIN_2FA_CSS).appendTo('head');
-};
-
-/** Verify an existing first-factor challenge with TOTP or a recovery code. */
-export default async function UIWindowLogin2FA (challengeToken) {
-    injectLogin2faCss();
-    const p = new TeePromise();
-    let win;
-
-    // ── Build 2FA verification HTML ──
-    let h2fa = '';
-    h2fa += '<div class="login-2fa">';
-
-    // ── Shield icon ──
-    h2fa += '<div class="login-2fa-icon">';
-    h2fa += '<svg width="28" height="28" viewBox="0 0 24 24" fill="none" stroke="#3b82f6" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M12 22s8-4 8-10V5l-8-3-8 3v7c0 6 8 10 8 10z"/></svg>';
-    h2fa += '</div>';
-
-    // ── OTP screen ──
-    h2fa += '<div class="login-2fa-screen active" data-screen="otp">';
-    h2fa += `<h3 class="login-2fa-title">${i18n('login2fa_otp_title')}</h3>`;
-    h2fa += `<p class="login-2fa-desc">${i18n('login2fa_otp_instructions')}</p>`;
-    h2fa += '<div class="login-2fa-code-inputs">';
-    for ( let i = 0; i < 6; i++ ) {
-        h2fa += `<input type="text" inputmode="numeric" maxlength="1" autocomplete="off" data-idx="${i}" />`;
-    }
-    h2fa += '</div>';
-    h2fa += '<div class="login-2fa-error"></div>';
-    h2fa += `<div class="login-2fa-spinner"><div class="login-2fa-spinner-icon"></div><span>${i18n('verifying')}</span></div>`;
-    h2fa += `<button type="button" class="login-2fa-link-btn login-2fa-to-recovery">${i18n('login2fa_use_recovery_code')}</button>`;
-    h2fa += '</div>';
-
-    // ── Recovery screen ──
-    h2fa += '<div class="login-2fa-screen" data-screen="recovery">';
-    h2fa += `<h3 class="login-2fa-title">${i18n('login2fa_recovery_title')}</h3>`;
-    h2fa += `<p class="login-2fa-desc">${i18n('login2fa_recovery_instructions')}</p>`;
-    h2fa += '<div class="login-2fa-recovery-error"></div>';
-    h2fa += `<input type="text" class="login-2fa-recovery-input" placeholder="${html_encode(i18n('login2fa_recovery_placeholder'))}" maxlength="8" autocomplete="off" />`;
-    h2fa += `<button type="button" class="login-2fa-link-btn login-2fa-to-otp">${i18n('login2fa_recovery_back')}</button>`;
-    h2fa += '</div>';
-
-    h2fa += '</div>';
-
-    win = await UIWindow({
-        title: null,
-        app: 'login-2fa',
-        single_instance: true,
-        icon: null,
-        uid: null,
-        is_dir: false,
-        body_content: h2fa,
-        has_head: false,
-        selectable_body: false,
-        draggable_body: false,
-        allow_context_menu: false,
-        is_resizable: false,
-        is_droppable: false,
-        init_center: true,
-        allow_native_ctxmenu: false,
-        allow_user_select: false,
-        width: Math.min(400, window.innerWidth - 24),
-        height: 'auto',
-        dominant: true,
-        show_in_taskbar: false,
-        is_draggable: false,
-        backdrop: true,
-        stay_on_top: true,
-        window_class: 'window-login-2fa',
-        body_css: {
-            width: 'initial',
-            height: '100%',
-            'background-color': '#f8fafc',
-            padding: '32px 28px 24px',
-        },
-        on_close: () => p.resolve(null),
-    });
-
-    const $w = $(win);
-
-    // ── Screen navigation ──
-    function showScreen (name) {
-        $w.find('.login-2fa-screen').removeClass('active');
-        $w.find(`.login-2fa-screen[data-screen="${name}"]`).addClass('active');
-        if ( name === 'otp' ) {
-            setTimeout(() => $w.find('.login-2fa-code-inputs input').first().focus(), 80);
-        } else {
-            setTimeout(() => $w.find('.login-2fa-recovery-input').focus(), 80);
-        }
-    }
-
-    $w.find('.login-2fa-to-recovery').on('click', () => {
-        $w.find('.login-2fa-code-inputs input').val('').removeClass('error');
-        $w.find('.login-2fa-error').text('');
-        showScreen('recovery');
-    });
-    $w.find('.login-2fa-to-otp').on('click', () => {
-        $w.find('.login-2fa-recovery-input').val('');
-        $w.find('.login-2fa-recovery-error').text('').hide();
-        showScreen('otp');
-    });
-
-    // ── OTP code input handling ──
-    const $inputs = $w.find('.login-2fa-code-inputs input');
-    let is_verifying = false;
-
-    $inputs.on('input', function () {
-        const val = $(this).val().replace(/\D/g, '');
-        $(this).val(val.slice(0, 1));
-        $(this).removeClass('error');
-        $w.find('.login-2fa-error').text('');
-
-        if ( val && $(this).data('idx') < 5 ) {
-            $inputs.eq($(this).data('idx') + 1).focus();
-        }
-
-        const code = $inputs.map(function () { return $(this).val(); }).get().join('');
-        if ( code.length === 6 && ! is_verifying ) {
-            verifyOtp(code);
-        }
-    });
-
-    $inputs.on('keydown', function (e) {
-        const idx = $(this).data('idx');
-        if ( e.key === 'Backspace' && ! $(this).val() && idx > 0 ) {
-            $inputs.eq(idx - 1).focus().val('');
-        }
-        if ( e.key === 'ArrowLeft' && idx > 0 ) {
-            e.preventDefault();
-            $inputs.eq(idx - 1).focus();
-        }
-        if ( e.key === 'ArrowRight' && idx < 5 ) {
-            e.preventDefault();
-            $inputs.eq(idx + 1).focus();
-        }
-    });
-
-    $inputs.on('paste', function (e) {
-        e.preventDefault();
-        const pasted = (e.originalEvent.clipboardData || window.clipboardData)
-            .getData('text').replace(/\D/g, '').slice(0, 6);
-        if ( ! pasted ) return;
-        for ( let i = 0; i < 6; i++ ) {
-            $inputs.eq(i).val(pasted[i] || '');
-        }
-        $inputs.eq(Math.min(pasted.length, 6) - 1).focus();
-        if ( pasted.length === 6 && ! is_verifying ) {
-            verifyOtp(pasted);
-        }
-    });
-
-    async function verifyOtp (code) {
-        is_verifying = true;
-        $inputs.attr('disabled', true);
-        $w.find('.login-2fa-spinner').addClass('visible');
-        $w.find('.login-2fa-error').text('');
-        let error_i18n_key = 'something_went_wrong';
-        try {
-            const resp = await fetch(`${window.gui_origin}/login/otp`, {
-                method: 'POST',
-                headers: { 'Content-Type': 'application/json' },
-                body: JSON.stringify({
-                    token: challengeToken,
-                    code: code,
-                }),
-            });
-            if ( resp.status === 429 ) {
-                error_i18n_key = 'confirm_code_generic_too_many_requests';
-                throw new Error('expected error');
-            }
-            const next_data = await resp.json();
-            if ( ! next_data.proceed ) {
-                error_i18n_key = 'confirm_code_generic_incorrect';
-                throw new Error('expected error');
-            }
-            $w.find('.login-2fa-spinner').removeClass('visible');
-            p.resolve(next_data);
-            $(win).close();
-        } catch (e) {
-            $w.find('.login-2fa-spinner').removeClass('visible');
-            $w.find('.login-2fa-error').text(i18n(error_i18n_key));
-            $inputs.addClass('error').attr('disabled', false);
-            setTimeout(() => {
-                $inputs.val('').removeClass('error');
-                $inputs.first().focus();
-            }, 1200);
-        }
-        is_verifying = false;
-    }
-
-    // ── Recovery code handling ──
-    $w.find('.login-2fa-recovery-input').on('input', async function () {
-        // Codes are 8-char base32; a pasted one usually
-        // carries the newline it was copied with.
-        const value = $(this).val().trim().toUpperCase();
-        if ( value.length !== 8 ) return;
-        let error_i18n_key = 'something_went_wrong';
-        try {
-            // Root origin, like `/login/otp` above: the
-            // route is `guiOriginOnly` and carries no
-            // `subdomain`, so on `api_origin` the
-            // subdomain gate skips it and Express 404s.
-            const resp = await fetch(`${window.gui_origin}/login/recovery-code`, {
-                method: 'POST',
-                headers: { 'Content-Type': 'application/json' },
-                body: JSON.stringify({
-                    token: challengeToken,
-                    code: value,
-                }),
-            });
-            if ( resp.status === 429 ) {
-                error_i18n_key = 'confirm_code_generic_too_many_requests';
-                throw new Error('expected error');
-            }
-            const next_data = await resp.json();
-            if ( ! next_data.proceed ) {
-                error_i18n_key = 'confirm_code_generic_incorrect';
-                throw new Error('expected error');
-            }
-            p.resolve(next_data);
-            $(win).close();
-        } catch (e) {
-            $w.find('.login-2fa-recovery-error').text(i18n(error_i18n_key)).show();
-        }
-    });
-
-    // Focus first OTP input
-    setTimeout(() => $inputs.first().focus(), 150);
-    return p;
-}

src/gui/src/UI/UIWindowLogin2FA.test.js

@@ -1,143 +0,0 @@
-// @vitest-environment jsdom
-import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
-import jQuery from '../lib/jquery-3.6.1/jquery-3.6.1.min.js';
-
-const state = vi.hoisted(() => ({ el: null, options: null }));
-vi.mock('./UIWindowRecoverPassword.js', () => ({ default: vi.fn() }));
-vi.mock('./UIWindowSignup.js', () => ({ default: vi.fn() }));
-vi.mock('../helpers/authLogoHeader.js', () => ({ authLogoHeader: () => '', wireAuthLogoHeader: vi.fn() }));
-vi.mock('./UIWindow.js', () => ({ default: async options => {
-    state.options = options;
-    state.el = document.createElement('div');
-    state.el.innerHTML = options.body_content;
-    document.body.append(state.el);
-    options.onAppend?.(state.el);
-    return state.el;
-} }));
-globalThis.def = globalThis.def ?? (value => value);
-const { default: UIWindowLogin2FA } = await import('./UIWindowLogin2FA.js');
-const { default: UIWindowLogin } = await import('./UIWindowLogin.js');
-const reply = (status, data) => new Response(JSON.stringify(data), { status });
-const completed = { proceed: true, next_step: 'complete', token: 'gui-token', user: { username: 'user' }, redirectUrl: 'https://puter.test/dashboard' };
-
-beforeEach(() => {
-    document.body.innerHTML = '';
-    globalThis.$ = jQuery;
-    jQuery.fn.close = vi.fn(function () { state.options.on_close?.(); });
-    globalThis.i18n = key => key;
-    globalThis.html_encode = value => jQuery('<div>').text(value).html();
-    globalThis.fetch = vi.fn();
-    window.gui_origin = 'https://puter.test';
-    window.api_origin = 'https://api.puter.test';
-    window.icons = {};
-    window.uuidv4 = () => 'login-test';
-    window.is_email = () => false;
-    window.update_auth_data = vi.fn();
-    state.el = null;
-});
-afterEach(() => { vi.restoreAllMocks(); });
-
-const open = async () => {
-    const result = UIWindowLogin2FA('first-factor-challenge');
-    await vi.waitFor(() => expect(jQuery(state.el).find('.login-2fa-code-inputs input')).toHaveLength(6));
-    return { result };
-};
-const enterOtp = code => {
-    const inputs = jQuery(state.el).find('.login-2fa-code-inputs input');
-    [...code].forEach((digit, index) => inputs.eq(index).val(digit));
-    inputs.last().trigger('input');
-};
-
-describe('shared login second-factor dialog', () => {
-    it('passes leading-zero codes to the existing verifier and preserves continuation data', async () => {
-        fetch.mockResolvedValue(reply(200, completed));
-        const { result } = await open();
-        enterOtp('001234');
-        await expect(result).resolves.toEqual(completed);
-        expect(fetch).toHaveBeenCalledWith('https://puter.test/login/otp', expect.objectContaining({ body: JSON.stringify({ token: 'first-factor-challenge', code: '001234' }) }));
-        expect(jQuery.fn.close).toHaveBeenCalledOnce();
-    });
-
-    it('keeps failed challenges available for a recovery-code retry', async () => {
-        fetch.mockResolvedValueOnce(reply(200, { proceed: false })).mockResolvedValueOnce(reply(200, completed));
-        const { result } = await open();
-        enterOtp('001234');
-        await vi.waitFor(() => expect(jQuery(state.el).find('.login-2fa-error').text()).toBe('confirm_code_generic_incorrect'));
-        expect(jQuery.fn.close).not.toHaveBeenCalled();
-        jQuery(state.el).find('.login-2fa-to-recovery').trigger('click');
-        jQuery(state.el).find('.login-2fa-recovery-input').val(' abcdefg2\n').trigger('input');
-        await expect(result).resolves.toEqual(completed);
-        expect(fetch.mock.calls[1][0]).toBe('https://puter.test/login/recovery-code');
-        expect(JSON.parse(fetch.mock.calls[1][1].body)).toEqual({ token: 'first-factor-challenge', code: 'ABCDEFG2' });
-    });
-
-    it('reports throttling without closing or completing login', async () => {
-        fetch.mockResolvedValue(reply(429, {}));
-        const { result } = await open();
-        enterOtp('001234');
-        await vi.waitFor(() => expect(jQuery(state.el).find('.login-2fa-error').text()).toBe('confirm_code_generic_too_many_requests'));
-        expect(jQuery.fn.close).not.toHaveBeenCalled();
-        state.options.on_close();
-        await expect(result).resolves.toBeNull();
-    });
-
-    it('closing the challenge cancels without authenticating', async () => {
-        const { result } = await open();
-        state.options.on_close();
-        await expect(result).resolves.toBeNull();
-        expect(fetch).not.toHaveBeenCalled();
-    });
-
-    it('ignores incomplete recovery codes', async () => {
-        const { result } = await open();
-        jQuery(state.el).find('.login-2fa-recovery-input').val('ABC').trigger('input');
-        expect(fetch).not.toHaveBeenCalled();
-        state.options.on_close();
-        await expect(result).resolves.toBeNull();
-    });
-});
-
-
-describe('password login using the shared second-factor dialog', () => {
-    it('completes password login only after its challenge succeeds', async () => {
-        fetch.mockResolvedValueOnce(reply(200, { providers: [] })).mockResolvedValueOnce(reply(200, completed));
-        let success;
-        vi.spyOn(jQuery, 'ajax').mockImplementation(options => { success = options.success; });
-        const result = UIWindowLogin({ reload_on_success: false, redirect_url: '/' });
-        await vi.waitFor(() => expect(jQuery(state.el).find('.login-btn')).toHaveLength(1));
-        const login = state.el;
-        jQuery(login).find('.email_or_username').val('user');
-        jQuery(login).find('.password').val('correct-password');
-        jQuery(login).find('.login-btn').trigger('click');
-        expect(success).toBeTypeOf('function');
-        const submitted = success({ proceed: true, next_step: 'otp', otp_jwt_token: 'password-challenge' });
-        await vi.waitFor(() => expect(jQuery(state.el).find('.login-2fa-code-inputs input')).toHaveLength(6));
-        expect(window.update_auth_data).not.toHaveBeenCalled();
-        enterOtp('001234');
-        await submitted;
-        await expect(result).resolves.toBe(true);
-        expect(window.update_auth_data).toHaveBeenCalledWith(completed.token, completed.user);
-        expect(JSON.parse(fetch.mock.calls[1][1].body).token).toBe('password-challenge');
-    });
-
-    it('returns to the enabled password form when the second-factor dialog is dismissed', async () => {
-        fetch.mockResolvedValue(reply(200, { providers: [] }));
-        let success;
-        vi.spyOn(jQuery, 'ajax').mockImplementation(options => { success = options.success; });
-        const result = UIWindowLogin({ reload_on_success: false, redirect_url: '/' });
-        await vi.waitFor(() => expect(jQuery(state.el).find('.login-btn')).toHaveLength(1));
-        const login = state.el;
-        const loginOptions = state.options;
-        jQuery(login).find('.email_or_username').val('user');
-        jQuery(login).find('.password').val('correct-password');
-        jQuery(login).find('.login-btn').trigger('click');
-        const submitted = success({ proceed: true, next_step: 'otp', otp_jwt_token: 'password-challenge' });
-        await vi.waitFor(() => expect(jQuery(state.el).find('.login-2fa-code-inputs input')).toHaveLength(6));
-        state.options.on_close();
-        await submitted;
-        expect(window.update_auth_data).not.toHaveBeenCalled();
-        expect(jQuery(login).find('.login-btn').prop('disabled')).toBe(false);
-        loginOptions.on_close();
-        await expect(result).resolves.toBe(false);
-    });
-});

src/gui/src/UI/UIWindowNewPassword.js

@@ -19,7 +19,7 @@
 
 import UIWindow from './UIWindow.js';
 import UIAlert from './UIAlert.js';
-import UIWindowLogin from './UIWindowLogin.js';
+import UIAuthLogin from './Auth/UIAuthLogin.js';
 import check_password_strength from '../helpers/checkPasswordStrength.js';
 
 async function UIWindowNewPassword (options) {
@@ -183,11 +183,9 @@ async function UIWindowNewPassword (options) {
                             close_on_backdrop_click: false,
                         },
                     });
-                    await UIWindowLogin({
+                    await UIAuthLogin({
                         reload_on_success: true,
-                        window_options: {
-                            has_head: false,
-                        },
+                        dismissable: false,
                     });
                 },
                 error: function (err) {

src/gui/src/UI/UIWindowRecoverPassword.js

@@ -1,138 +0,0 @@
-/*
- * Copyright (C) 2024-present Puter Technologies Inc.
- *
- * This file is part of Puter.
- *
- * Puter is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Affero General Public License as published
- * by the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU Affero General Public License for more details.
- *
- * You should have received a copy of the GNU Affero General Public License
- * along with this program.  If not, see <https://www.gnu.org/licenses/>.
- */
-
-import UIWindow from './UIWindow.js';
-import UIAlert from './UIAlert.js';
-
-function UIWindowRecoverPassword (options) {
-    return new Promise(async (resolve) => {
-        options = options ?? {};
-
-        let h = '';
-        h += '<div style="-webkit-font-smoothing: antialiased; -moz-osx-font-smoothing: grayscale; color: #3e5362;">';
-        h += `<h3 style="text-align:center; font-weight: 400; font-size: 20px;">${i18n('recover_password')}</h3>`;
-        h += '<form class="pass-recovery-form">';
-        h += '<p style="text-align:center; padding: 0 20px;"></p>';
-        h += '<div class="error"></div>';
-        h += `<label>${i18n('email_or_username')}</label>`;
-        h += '<input class="pass-recovery-username-or-email" type="text"/>';
-        h += `<button type="submit" class="send-recovery-email button button-block button-primary" style="margin-top:10px;">${i18n('send_password_recovery_email')}</button>`;
-        h += '</form>';
-        h += '</div>';
-
-        const el_window = await UIWindow({
-            title: null,
-            backdrop: options.backdrop ?? false,
-            icon: null,
-            uid: null,
-            is_dir: false,
-            body_content: h,
-            has_head: options.has_head ?? true,
-            selectable_body: false,
-            draggable_body: true,
-            allow_context_menu: false,
-            is_draggable: options.is_draggable ?? true,
-            is_droppable: false,
-            is_resizable: false,
-            stay_on_top: options.stay_on_top ?? false,
-            allow_native_ctxmenu: true,
-            allow_user_select: true,
-            width: 350,
-            dominant: true,
-            ...options.window_options,
-            onAppend: function (el_window) {
-                $(el_window).find('.pass-recovery-username-or-email').first().focus();
-            },
-            window_class: 'window-recover-password',
-            window_css: {
-                height: 'initial',
-            },
-            body_css: {
-                padding: '10px',
-                width: 'initial',
-                height: 'initial',
-                'background-color': 'rgba(231, 238, 245)',
-                'backdrop-filter': 'blur(3px)',
-            },
-        });
-        $(el_window).find('.pass-recovery-form').on('submit', function (e) {
-            e.preventDefault();
-            e.stopPropagation();
-            return false;
-        });
-
-        // Send recovery email
-        $(el_window).find('.send-recovery-email').on('click', function (e) {
-            let email, username;
-            let input = $(el_window).find('.pass-recovery-username-or-email').val();
-            if ( window.is_email(input) )
-            {
-                email = input;
-            }
-            else
-            {
-                username = input;
-            }
-
-            // todo validation before sending
-            $.ajax({
-                url: `${window.api_origin }/send-pass-recovery-email`,
-                type: 'POST',
-                async: true,
-                contentType: 'application/json',
-                data: JSON.stringify({
-                    email: email,
-                    username: username,
-                }),
-                statusCode: {
-                    401: function (xhr) {
-                        window.handle401(xhr);
-                    },
-                },
-                success: async function (res) {
-                    $(el_window).close();
-                    await UIAlert({
-                        message: res.message,
-                        body_icon: window.icons['c-check.svg'],
-                        stay_on_top: true,
-                        backdrop: true,
-                        window_options: {
-                            backdrop: true,
-                            close_on_backdrop_click: false,
-                        },
-                    });
-                },
-                error: function (err) {
-                    const errorText = err.responseText || '';
-                    let msg = errorText;
-                    try {
-                        const errorJson = JSON.parse(errorText);
-                        msg = errorJson.message || errorJson.error || errorText;
-                    } catch (_) { /* not JSON, use responseText */ }
-                    $(el_window).find('.error').html(html_encode(msg));
-                    $(el_window).find('.error').fadeIn();
-                },
-                complete: function () {
-                },
-            });
-        });
-    });
-}
-
-export default UIWindowRecoverPassword;

src/gui/src/UI/UIWindowSessionList.js

@@ -1,186 +0,0 @@
-/*
- * Copyright (C) 2024-present Puter Technologies Inc.
- *
- * This file is part of Puter.
- *
- * Puter is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Affero General Public License as published
- * by the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU Affero General Public License for more details.
- *
- * You should have received a copy of the GNU Affero General Public License
- * along with this program.  If not, see <https://www.gnu.org/licenses/>.
- */
-
-import UIWindow from './UIWindow.js';
-import UIWindowLogin from './UIWindowLogin.js';
-import UIWindowSignup from './UIWindowSignup.js';
-
-async function UIWindowSessionList (options) {
-    options = options ?? {};
-    options.reload_on_success = options.reload_on_success ?? true;
-
-    return new Promise(async (resolve) => {
-        let h = '';
-        h += '<div style="margin:10px;">';
-        // loading indicator with spinner
-        h += `<div class="loading" style="z-index: 999999999;">
-            <div style="display: flex; flex-direction: column; align-items: center; gap: 15px;">
-                <div style="
-                    width: 40px;
-                    height: 40px;
-                    border: 3px solid #e0e0e0;
-                    border-top-color: #3b82f6;
-                    border-radius: 50%;
-                    animation: spin 0.8s linear infinite;
-                "></div>
-                <div style="
-                    font-size: 15px;
-                    color: #555;
-                    font-weight: 500;
-                ">${i18n('signing_in')}</div>
-            </div>
-        </div>`;
-        // session list
-        h += '<div class="hide-scrollbar" style="overflow-y: scroll; max-width: 400px; margin: 0 auto;">';
-        h += `<h1 style="text-align: center; font-size: 18px; font-weight: normal; color: #757575; margin-bottom: 30px;"><img src="${window.icons['logo-white.svg']}" style="padding: 4px; background-color: blue; border-radius: 5px; width: 25px; box-sizing: border-box; margin-bottom: -6px; margin-right: 6px;">${i18n('sign_in_with_puter')}</h1>`;
-        for ( let index = 0; index < window.logged_in_users.length; index++ ) {
-            const l_user = window.logged_in_users[index];
-            h += `<div data-uuid="${l_user.uuid}" class="session-entry" style="display: flex; padding: 15px 10px;">`;
-            // profile picture
-            h += `<div class="profile-picture" style="background-color: #cbced1; width: 30px; height: 30px; margin:0; margin-right: 10px; background-image: url('${l_user.profile.picture ?? window.icons['profile.svg']}');"></div>`;
-            h += `<div style="display: flex; align-items: center;">${l_user.username}</div>`;
-            h += '</div>';
-        }
-        h += '</div>';
-        // c2a
-        h += `<div style="margin-top: 20px; margin-bottom: 20px; text-align:center;"><span class="login-c2a-session-list">Log Into Another Account</span> &bull; <span class="signup-c2a-session-list">${i18n('create_account')}</span></div>`;
-        h += '</div>';
-
-        const el_window = await UIWindow({
-            title: i18n('window_title_session_list'),
-            app: 'session-list',
-            single_instance: true,
-            icon: null,
-            uid: null,
-            is_dir: false,
-            body_content: h,
-            has_head: false,
-            selectable_body: false,
-            draggable_body: options.draggable_body ?? true,
-            allow_context_menu: false,
-            is_resizable: false,
-            is_droppable: false,
-            init_center: true,
-            allow_native_ctxmenu: false,
-            allow_user_select: false,
-            width: 350,
-            height: 'auto',
-            dominant: true,
-            show_in_taskbar: false,
-            update_window_url: false,
-            cover_page: options.cover_page ?? false,
-            window_class: 'window-session-list',
-            body_css: {
-                width: 'initial',
-                height: '100%',
-                'background-color': 'rgb(245 247 249)',
-                'backdrop-filter': 'blur(3px)',
-                'display': 'flex',
-                'flex-direction': 'column',
-                'justify-content': 'center',
-            },
-        });
-        $(el_window).find('.login-c2a-session-list').on('click', async function (e) {
-            // The login window is a centered cover and this picker would
-            // otherwise float on top of it, hiding its username field. Only
-            // the reload flows close it: in the no-reload (popup) flows the
-            // picker doubles as the fallback UI when the login window is
-            // abandoned, and the resolve() below still needs a live promise
-            // chain either way.
-            if ( options.reload_on_success ) $(el_window).close();
-            const login = await UIWindowLogin({
-                referrer: options.referrer,
-                reload_on_success: options.reload_on_success,
-                cover_page: options.cover_page ?? false,
-                has_head: options.has_head,
-                send_confirmation_code: options.send_confirmation_code,
-                window_options: {
-                    has_head: false,
-                    cover_page: options.cover_page ?? false,
-                },
-            });
-            if ( login ) {
-                if ( options.reload_on_success ) {
-                    // disable native browser exit confirmation
-                    window.onbeforeunload = null;
-                    // refresh
-                    location.reload();
-                } else {
-                    resolve(login);
-                }
-            }
-        });
-        $(el_window).find('.signup-c2a-session-list').on('click', async function (e) {
-            // Same picker-over-cover overlap as the login c2a above, same
-            // reload-flows-only close. (The selector this replaces —
-            // '.signup-c2a-clickable', the LOGIN window's c2a class —
-            // matched nothing in this window and closed nothing.)
-            if ( options.reload_on_success ) $(el_window).close();
-            // create Signup window
-            const signup = await UIWindowSignup({
-                referrer: options.referrer,
-                reload_on_success: options.reload_on_success,
-                send_confirmation_code: options.send_confirmation_code,
-                window_options: {
-                    has_head: false,
-                    cover_page: options.cover_page ?? false,
-                },
-
-            });
-            if ( signup ) {
-                if ( options.reload_on_success ) {
-                    // disable native browser exit confirmation
-                    window.onbeforeunload = null;
-                    // refresh
-                    location.reload();
-                } else {
-                    resolve(signup);
-                }
-            }
-        });
-
-        $(el_window).find('.session-entry').on('click', function (e) {
-            $(el_window).find('.loading').css({ display: 'flex' });
-
-            setTimeout(async () => {
-                let selected_uuid = $(this).attr('data-uuid');
-                let selected_user;
-                for ( let index = 0; index < window.logged_in_users.length; index++ ) {
-                    const l_user = window.logged_in_users[index];
-                    if ( l_user.uuid === selected_uuid ) {
-                        selected_user = l_user;
-                    }
-                }
-
-                // new logged in user
-                await window.update_auth_data(selected_user.auth_token, selected_user);
-                if ( options.reload_on_success ) {
-                    // disable native browser exit confirmation
-                    window.onbeforeunload = null;
-                    // refresh
-                    location.reload();
-                } else {
-                    resolve(true);
-                }
-            }, 500);
-        });
-    });
-}
-
-export default UIWindowSessionList;

src/gui/src/UI/UIWindowSignup.js

@@ -1,861 +0,0 @@
-/*
- * Copyright (C) 2024-present Puter Technologies Inc.
- *
- * This file is part of Puter.
- *
- * Puter is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Affero General Public License as published
- * by the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU Affero General Public License for more details.
- *
- * You should have received a copy of the GNU Affero General Public License
- * along with this program.  If not, see <https://www.gnu.org/licenses/>.
- */
-
-import check_password_strength from '../helpers/checkPasswordStrength.js';
-import UIWindow from './UIWindow.js';
-import UIWindowEmailConfirmationRequired from './UIWindowEmailConfirmationRequired.js';
-import UIWindowPhoneVerificationRequired from './UIWindowPhoneVerificationRequired.js';
-import UIWindowCardVerificationRequired from './UIWindowCardVerificationRequired.js';
-import UIWindowLogin from './UIWindowLogin.js';
-import { KNOWN_OIDC_PROVIDERS, OIDC_GENERIC_PROVIDER_ICON, humanizeOidcProviderId } from '../util/openid.js';
-import { offersFederatedSignInInPopup } from '../util/popupAuth.js';
-import { get_auth_redirect_url, get_oidc_return_to } from '../helpers/authRedirect.js';
-import { authLogoHeader, wireAuthLogoHeader } from '../helpers/authLogoHeader.js';
-import { isAttestedOrigin } from '../helpers/attestedOrigin.js';
-import { bonusRequirementsKey, checkSignupBonusCode } from '../helpers/signupBonusCode.js';
-
-// What a checked bonus code grants, above the form (and the provider buttons).
-function renderBonusNotice(el_window, result) {
-    const $notice = $(el_window).find('.signup-bonus-notice');
-    if (!result) {
-        $notice.hide().empty();
-        return;
-    }
-    if (!result.valid) {
-        $notice
-            .addClass('signup-bonus-notice-invalid')
-            .html(`<p>${i18n('signup_bonus_code_invalid_retry')}</p>`)
-            .show();
-        return;
-    }
-    const requirementsKey = bonusRequirementsKey(result.requirements);
-    let h = `<strong>${html_encode(result.display.title)}</strong>`;
-    h += `<p>${html_encode(result.display.description)}</p>`;
-    if (requirementsKey) {
-        h += `<p class="signup-bonus-requirements">${i18n(requirementsKey)}</p>`;
-    }
-    $notice.removeClass('signup-bonus-notice-invalid').html(h).show();
-}
-
-function UIWindowSignup(options) {
-    options = options ?? {};
-    options.reload_on_success = options.reload_on_success ?? true;
-    options.has_head = options.has_head ?? true;
-    options.send_confirmation_code = options.send_confirmation_code ?? false;
-    options.show_close_button = options.show_close_button ?? true;
-    if (options.redirect_url === undefined) {
-        // stay on the page the signup started from (e.g. an /app/<name>
-        // landing), with standalone auth pages going to the root dashboard
-        options.redirect_url = get_auth_redirect_url();
-    }
-
-    return new Promise(async (resolve) => {
-        const internal_id = window.uuidv4();
-
-        let offersProviders = false;
-        // Form signups are closed, so the providers are the only way in.
-        const showOidcOnly = (el_window) => {
-            $(el_window).find('.signup-form').hide();
-            $(el_window).find('.signup-with-email-wrapper').hide();
-            $(el_window).find('.oidc-providers-wrapper').show();
-            $(el_window).find('.signup-oidc-only-notice').show();
-        };
-
-        const logo_clickable =
-            !!options.window_options?.cover_page && !window.embedded_in_popup;
-
-        let h = '';
-        h +=
-            '<div style="margin: 0 auto;">';
-        // logo
-        h += authLogoHeader({
-            logoSrc: window.icons['logo-white.svg'],
-            logoClickable: logo_clickable,
-            openerOrigin: window.embedded_in_popup && isAttestedOrigin(window.openerOrigin) ? window.openerOrigin : '',
-            openerFallbackSrc: window.icons['website.svg'],
-        });
-        // close button
-        if (!options.has_head && options.show_close_button !== false) {
-            h += '<div class="generic-close-window-button"> &times; </div>';
-        }
-
-        // Form
-        h += '<div style="padding: 15px;">';
-
-        // title
-        h += `<h1 class="signup-form-title">${i18n('create_free_account')}</h1>`;
-        // In a sign-in popup, say which site brought the user here.
-        if (window.embedded_in_popup && isAttestedOrigin(window.openerOrigin)) {
-            h += `<p class="auth-opener-notice">${i18n('popup_opener_uses_puter', [new URL(window.openerOrigin).hostname])}</p>`;
-        }
-        h += '<div class="signup-bonus-notice" style="display:none;"></div>';
-        // signup form
-        h += '<form class="signup-form">';
-        // error msg
-        h += '<div class="signup-error-msg"></div>';
-        // username
-        h += '<div style="overflow: hidden;">';
-        h += `<label for="username-${internal_id}">${i18n('username')}</label>`;
-        h += `<input id="username-${internal_id}" value="${html_encode(options.username ?? '')}" class="username" type="text" autocomplete="username" spellcheck="false" autocorrect="off" autocapitalize="off" data-gramm_editor="false"/>`;
-        h += '</div>';
-        // email
-        h += '<div style="overflow: hidden; margin-top: 10px;">';
-        h += `<label for="email-${internal_id}">${i18n('email')}</label>`;
-        h += `<input id="email-${internal_id}" value="${html_encode(options.email ?? '')}" class="email" type="email" autocomplete="email" spellcheck="false" autocorrect="off" autocapitalize="off" data-gramm_editor="false"/>`;
-        h += '</div>';
-        // password
-        h +=
-            '<div style="overflow: hidden; margin-top: 10px; position: relative;">';
-        h += `<label for="password-${internal_id}">${i18n('password')}</label>`;
-        h += `<input id="password-${internal_id}" class="password" type="${options.show_password ? 'text' : 'password'}" name="password" autocomplete="new-password" />`;
-        // show/hide icon
-        h += `<span style="position: absolute; right: 5%; top: 50%; cursor: pointer;" id="toggle-show-password-${internal_id}">
-                                    <img class="toggle-show-password-icon" src="${options.show_password ? window.icons['eye-closed.svg'] : window.icons['eye-open.svg']}" width="20" height="20">
-                              </span>`;
-        h += '</div>';
-        // confirm password
-        h +=
-            '<div style="overflow: hidden; margin-top: 10px; margin-bottom: 10px; position: relative">';
-        h += `<label for="confirm-password-${internal_id}">${i18n('signup_confirm_password')}</label>`;
-        h += `<input id="confirm-password-${internal_id}" class="confirm-password" type="${options.show_password ? 'text' : 'password'}" name="confirm-password" autocomplete="new-password" />`;
-        // show/hide icon
-        h += `<span style="position: absolute; right: 5%; top: 50%; cursor: pointer;" id="toggle-show-password-${internal_id}">
-                                     <img class="toggle-show-password-icon" src="${options.show_password ? window.icons['eye-closed.svg'] : window.icons['eye-open.svg']}" width="20" height="20">
-                              </span>`;
-        h += '</div>';
-        // bot trap - if this value is submitted server will ignore the request
-        h +=
-            '<input type="text" name="p102xyzname" class="p102xyzname" value="">';
-
-        // Turnstile widget (only when enabled)
-        if (window.gui_params?.turnstileSiteKey) {
-            h +=
-                '<div style="min-height: 20px; display: flex; justify-content: center;">';
-            // appearance: always/execute/interaction-only
-            // docs: https://developers.cloudflare.com/turnstile/get-started/client-side-rendering/widget-configurations/?utm_source=chatgpt.com#appearance-modes
-            h += `<div class="cf-turnstile" data-sitekey="${window.gui_params.turnstileSiteKey}" data-appearance="interaction-only"></div>`;
-            h += '</div>';
-        }
-
-        // Create Account
-        h += `<button class="signup-btn button button-primary button-block button-normal">${i18n('create_free_account')}</button>`;
-        h += '</form>';
-        h +=
-            '<div class="oidc-providers-wrapper" style="display:none; padding: 10px 0;">';
-        h += `<p class="signup-oidc-only-notice" style="display:none;">${i18n('signup_oidc_only')}</p>`;
-        h += `<button type="button" class="oidc-google-btn oidc-btn button button-block button-normal" style="display:none; align-items:center; justify-content:center; gap:8px;"><img style="width: 20px; height: 20px;" src="data:image/webp;base64,UklGRu4GAABXRUJQVlA4WAoAAAAQAAAAXwAAXwAAQUxQSAUDAAABoATJtmnbGs+23+vZtm3btm3btnHxjG/btm3bnI197tljzjXjtSNiAnAjmbNs8x5DR40e2qtFhTzuVJ2e+rrE/ODKwsZe5J90n9CfXVw6vLEvifIH87OHVOK0mLxSLpSyd4vZhyuGkP+amL45j7lVYn6+rQpfSYDvFzO0QgIdYeZJCTbNRpnfJeDXLTSQsH/X6yiBj1TrIoEPgnZzCXwwtMtL4AOhnfP/wPpC/X0Jux/Uj4jySzsGVskJADkq9dn4JKEP1NuJ6gMDELvrrTF6QP9fjX0FQc2xLZme0E8Tfko20LOmZdAD+tWF/lVlqNb7I9IFBt+hpUD9CZGuMNhT2ONh8GJvWPyK1QZedhdyS7j5Bqkf3Kwo3A3w8yTneTgq3NyOdOZMhqPplM/h6Z+Urp6UF+ZX8HQGZZIrVylw9SvGnRqP33ev2QdSEwlzpIaYTlCOUtSLQpGujN/hRePIFMZDbgyOrGUcdGNe5CBjoRtbIimMMW4ciVxgDHQjxb0LkRTGGF8OMha6kRZZyzjkxrHIFMbDbmyPdGX84cbiSDmGFPNiZASU0V60SvAV4y4vyiS4yhCNSuXZxb5lIOEMyngFRSF+nqg85YsAOjNuSoQ/GdLJXhpjfgbplE/tCbN2Bp0pMtHaBAoy5khOY78yHkjiJOdZW3OEOSmJihxZaymPUPMlgTc40sfQy5RnkWx3kjQ3c0ioI5LClyRpZWSRcJF8T5aMNbFKuHti4B2WnDVwUcj541SnyVeVlCp/KeQ0xE6jiZzNppD1jNDzxcO/PJG9BUhF9gl/B4jtNEQeGBAv55gnRfFfUI+oiMhLOwZWyRnJXKbltLOfim4nDt5XMn0N5Jz/e/Eb6OW9KMtDcx8GQrOLB6ug2zG8fdBuENoB6Jf5PaiVMPlkQP1hdEUov5aH2QpfBXETTK+y91dnGM9/zdh2BFj2bkNn8iHMEqeN7MiJgMe+pPZwP4Sef9J9vL8vD8oMH6tOT309zo+P7BlcAs7mLNu8x9BRY4b1aVO9MG4cAQBWUDggwgMAABAVAJ0BKmAAYAA+bSyTRqQiIaEtVEyQgA2JbAC++hZa3jl94/Jj2rrA/Tvv9y7x+OzH+L5o/8p7APMA/TPpD+YD+bf4T9bPfW/mfqo/wHqAf0v/hdYB6AH7Aemp+5HwS/uN+6XtXdQB1N/Rj+m/RWYp6GESYsQNCm+TZ3BvtEgBK+isF38GQzHNMrw+tkbAm5lUM4rWqU9srOS+RuAUa8nFYoFrGH73Fzd++s+LPyEGAAD+Yg+gQRuJCapqteWj86DdkHmfHdS+mWVn7Ue8RiK5AaWCIe7RXaDKn0baNe80expR5tTBclgnd+SEzNZ6N3NL1suPhGwRqKzB5wNnWUXD7R0IkT5uIwUhTsO/1ucVEMKvTZRe4j7WwrA+e53P8J1/cdIvKtrtZv9AH5u1heZ1dGQELuxMxbQUnrw6IUh0YLBKEjNnR3JIsFNwkC+WLw4wkCMati73lcMjT6U2KIYsr0g5bPzSmo3ir9qRjtIqthpPIvuvYt8AbMewSj96NIqTM14M6ABtOaY87d8HOU7baFGGQjU1f8vf7SV5AjDrfW0VVzQcBez+PYiPApyQUAozEmZFKBDvX9ifFFacoulG9NCPDXa1mRPVwzrKuN3VfwUfv8Bx8QJ88prsOCDd8UvNDnUzbRqBXOmQ4co+/xYy/iQV89GHs4pb0D2LYwv6aY8yPLCrYyAPUe4dKEh/FBqRBJ/716CJVMTCrvB+gSgPwNjN5LlnNQqkBsHnSqdUFddjvBKNdm6zm8ggLFJl14S37sJW1fAEbiB0IqxcqlJOWol+ecJy9xdESchmlROmo/4/9V34VN2cw8NUB5POPUNzivyMFfgF27QTFXgya/LF3OsfHMF6Itejgy4ab38VPFjez5f8Z/b/dhYV21SflE4KtUj8LZDrQXRp+Pzdf/gWfvm2oLh0x+Fr+ggo2jjG3DFn95Wj1P3ra1RtzYE8ffXBeR2lDhL+GPJiiZaVinGMkjVYup0AghAhIfVgFtsL8lhMyJY84ccksHz92o1/J3NfrGSM8NwOv7ieeBjq2eqCOmrUHpG3mlr8Hj/fR4d+orLlpipLTh3+cRY7suXQXw9SPYZieoKS/JE9y0f+BcWCzdNshWl2oVpeK2qm36iFltfGZUvXdfBKufE9RkZcyOBDUVeONlBchjuaLPNd6fSlk41Pp57nF5MmES2Kl7HqY+f2pvS71eIgUXpqtAFIY94JSmNre+g49tL8VnZlJNqgVhj/De//5zH/84h//5uJfunlawY99GgDkm8cYFbIAAAA" />${i18n('sign_up_with_google')}</button>`;
-        h += `<button type="button" class="oidc-microsoft-btn oidc-btn button button-block button-normal" style="display:none; align-items:center; justify-content:center; gap:8px; margin-top:8px;"><svg style="width:20px; height:20px;" viewBox="0 0 23 23" fill="none"><rect x="1" y="1" width="10" height="10" fill="#f25022"/><rect x="12" y="1" width="10" height="10" fill="#7fba00"/><rect x="1" y="12" width="10" height="10" fill="#00a4ef"/><rect x="12" y="12" width="10" height="10" fill="#ffb900"/></svg>${i18n('sign_up_with_microsoft')}</button>`;
-        h += `<button type="button" class="oidc-apple-btn oidc-btn button button-block button-normal" style="display:none; align-items:center; justify-content:center; gap:8px; margin-top:8px;"><svg style="width:20px; height:20px;" viewBox="0 0 384 512" fill="currentColor"><path d="M318.7 268.7c-.2-36.7 16.4-64.4 50-84.8-18.8-26.9-47.2-41.7-84.7-44.6-35.5-2.8-74.3 20.7-88.5 20.7-15 0-49.4-19.7-76.4-19.7C63.3 141.2 4 184.8 4 273.5q0 39.3 14.4 81.2c12.8 36.7 59 126.7 107.2 125.2 25.2-.6 43-17.9 75.8-17.9 31.8 0 48.3 17.9 76.4 17.9 48.6-.7 90.4-82.5 102.6-119.3-65.2-30.7-61.7-90-61.7-91.9zm-56.6-164.2c27.3-32.4 24.8-61.9 24-72.5-24.1 1.4-52 16.4-67.9 34.9-17.5 19.8-27.8 44.3-25.6 71.9 26.1 2 49.9-11.4 69.5-34.3z"/></svg>${i18n('sign_up_with_apple')}</button>`;
-        h += '<div class="oidc-custom-providers"></div>';
-        h += '</div>';
-        // "Sign up with email" button, shown only when OIDC providers are available
-        h += `<div class="signup-with-email-wrapper" style="display:none;">`;
-        h += `<button class="signup-with-email-btn oidc-btn button button-block button-normal">${i18n('sign_up_with_email')}</button>`;
-        h += `</div>`;
-        // terms and privacy
-        h += `<p class="signup-terms">${i18n('tos_fineprint', [], false)}</p>`;
-        h += '</div>';
-        // login link
-        // create account link
-        h += '<div class="c2a-wrapper" style="padding:15px;">';
-        h += `<button class="login-c2a-clickable">${i18n('log_in')}</button>`;
-        h += '</div>';
-        h += '</div>';
-
-        const el_window = await UIWindow({
-            title: null,
-            app: 'signup',
-            single_instance: true,
-            icon: null,
-            uid: null,
-            is_dir: false,
-            body_content: h,
-            draggable_body: false,
-            has_head: true,
-            selectable_body: false,
-            allow_context_menu: false,
-            is_draggable: true,
-            is_droppable: false,
-            is_resizable: false,
-            stay_on_top: false,
-            allow_native_ctxmenu: true,
-            allow_user_select: true,
-            ...options.window_options,
-            dominant: true,
-            center: true,
-            onAppend: function (el_window) {
-                if (options.authError) {
-                    $(el_window)
-                        .find('.signup-error-msg')
-                        .html(html_encode(options.authError))
-                        .fadeIn();
-                }
-                if (!window.disable_signup_autofocus) {
-                    $(el_window)
-                        .find('.username')
-                        .get(0)
-                        .focus({ preventScroll: true });
-                }
-                wireAuthLogoHeader(el_window);
-                if (logo_clickable) {
-                    $(el_window)
-                        .find('.auth-logo')
-                        .on('click', function () {
-                            // keep desktop users on the desktop; everyone else goes to the root dashboard
-                            window.location.href =
-                                window.location.pathname === '/desktop'
-                                    ? '/desktop'
-                                    : '/';
-                        });
-                }
-
-                // Initialize Turnstile widget with callback to capture token
-                const initTurnstile = () => {
-                    if (
-                        window.turnstile &&
-                        window.gui_params?.turnstileSiteKey
-                    ) {
-                        window.turnstile.render('.cf-turnstile', {
-                            sitekey: window.gui_params.turnstileSiteKey,
-                            callback: function (token) {
-                                // Store the token for the signup request
-                                $(el_window)
-                                    .find('.cf-turnstile')
-                                    .attr('data-token', token);
-                                // Enable the signup button once CAPTCHA is completed
-                                $(el_window)
-                                    .find('.signup-btn')
-                                    .prop('disabled', false);
-                                // Add visual feedback
-                                $(el_window)
-                                    .find('.cf-turnstile')
-                                    .addClass('captcha-completed');
-                            },
-                            'expired-callback': function () {
-                                // Reset when token expires
-                                $(el_window)
-                                    .find('.cf-turnstile')
-                                    .removeAttr('data-token');
-                                $(el_window)
-                                    .find('.cf-turnstile')
-                                    .removeClass('captcha-completed');
-                                $(el_window)
-                                    .find('.signup-btn')
-                                    .prop('disabled', true);
-                            },
-                        });
-                    } else {
-                        // If Turnstile isn't loaded yet, wait for it
-                        setTimeout(initTurnstile, 100);
-                    }
-                };
-
-                initTurnstile();
-
-                if (window.signup_bonus_code) {
-                    (async () => {
-                        let fingerprint = null;
-                        try {
-                            fingerprint =
-                                await window.getDeviceFingerprint?.();
-                        } catch (_) {
-                            // the check works without device signals
-                        }
-                        const result = await checkSignupBonusCode(
-                            window.signup_bonus_code,
-                            { origin: window.gui_origin, fingerprint },
-                        );
-                        // Unknown (null) keeps the code; signup has the final say.
-                        if (result && !result.valid) {
-                            window.signup_bonus_code = null;
-                        }
-                        renderBonusNotice(el_window, result);
-                    })();
-                }
-
-                (async () => {
-                    try {
-                        // A federated hop navigates this popup away and the
-                        // provider returns it as a plain sign-in popup, losing
-                        // whatever the popup was opened to do — and, for a
-                        // permission prompt, handing the opener a token instead
-                        // of a decision. Don't offer it there. A
-                        // cross-origin-isolated opener can only get the token
-                        // through the session relay, which the provider's
-                        // return doesn't keep.
-                        if (
-                            window.embedded_in_popup &&
-                            (!offersFederatedSignInInPopup(window.gui_action) ||
-                                window.url_query_params?.get(
-                                    'cross_origin_isolated',
-                                ) === 'true')
-                        ) {
-                            return;
-                        }
-                        const res = await fetch(
-                            `${window.api_origin}/auth/oidc/providers`,
-                        );
-                        if (!res.ok) return;
-                        const data = await res.json();
-                        if (!data.providers) return;
-
-                        const wireOidcBtn = (provider, btnClass) => {
-                            $(el_window).find(btnClass).css('display', 'flex');
-                            $(el_window)
-                                .find(btnClass)
-                                .on('click', function () {
-                                    let url = `${window.gui_origin}/auth/oidc/${provider}/start?flow=signup`;
-                                    // return to the interface the signup started from (backend whitelists the path)
-                                    const return_to = get_oidc_return_to();
-                                    if (return_to) {
-                                        url += `&return_to=${encodeURIComponent(return_to)}`;
-                                    }
-                                    const referrer =
-                                        options.referrer ?? window.referrerStr;
-                                    if (referrer) {
-                                        url += `&referrer=${encodeURIComponent(referrer)}`;
-                                    }
-                                    if (window.signup_bonus_code) {
-                                        url += `&bonusCode=${encodeURIComponent(window.signup_bonus_code)}`;
-                                    }
-                                    if (
-                                        window.embedded_in_popup &&
-                                        window.url_query_params?.get('msg_id')
-                                    ) {
-                                        url += `&embedded_in_popup=true&msg_id=${encodeURIComponent(window.url_query_params.get('msg_id'))}`;
-                                        if (window.openerOrigin) {
-                                            url += `&opener_origin=${encodeURIComponent(window.openerOrigin)}`;
-                                        }
-                                    }
-                                    window.location.href = url;
-                                });
-                        };
-
-                        let hasProvider = false;
-                        if (data.providers.includes('google')) {
-                            hasProvider = true;
-                            wireOidcBtn('google', '.oidc-google-btn');
-                        }
-                        if (data.providers.includes('apple')) {
-                            hasProvider = true;
-                            wireOidcBtn('apple', '.oidc-apple-btn');
-                        }
-                        if (data.providers.includes('microsoft')) {
-                            hasProvider = true;
-                            wireOidcBtn('microsoft', '.oidc-microsoft-btn');
-                        }
-
-                        // Any other configured provider (e.g. a self-hosted
-                        // admin's custom OIDC IdP) gets a generic button.
-                        data.providers
-                            .filter(
-                                provider =>
-                                    !KNOWN_OIDC_PROVIDERS.includes(provider),
-                            )
-                            .forEach((provider, idx) => {
-                                hasProvider = true;
-                                const btnClass = `oidc-custom-btn-${idx}`;
-                                const label =
-                                    humanizeOidcProviderId(provider);
-                                $(el_window)
-                                    .find('.oidc-custom-providers')
-                                    .append(
-                                        `<button type="button" class="${btnClass} button button-block button-normal" style="display:flex; align-items:center; justify-content:center; gap:8px; margin-top:8px;">${OIDC_GENERIC_PROVIDER_ICON}${i18n('sign_up_with_provider', [label])}</button>`,
-                                    );
-                                wireOidcBtn(provider, `.${btnClass}`);
-                            });
-
-                        if (hasProvider) {
-                            offersProviders = true;
-                            $(el_window).find('.oidc-providers-wrapper').show();
-                            // Hide the signup form and show the "Sign up with email" button
-                            $(el_window).find('.signup-form').hide();
-                            $(el_window).find('.signup-form-title').hide();
-                            $(el_window)
-                                .find('.signup-with-email-wrapper')
-                                .show();
-                            $(el_window)
-                                .find('.signup-with-email-btn')
-                                .on('click', function () {
-                                    $(el_window).find('.signup-form').show();
-                                    $(el_window)
-                                        .find('.signup-form-title')
-                                        .show();
-                                    $(el_window)
-                                        .find('.signup-with-email-wrapper')
-                                        .hide();
-                                    $(el_window)
-                                        .find('.username')
-                                        .get(0)
-                                        ?.focus({ preventScroll: true });
-                                });
-                        }
-
-                        if (data.signupOidcOnly === true && hasProvider) {
-                            showOidcOnly(el_window);
-                        }
-                    } catch (_) {}
-                })();
-            },
-            window_class: 'window-signup',
-            window_css: {
-                height: 'initial',
-            },
-            body_css: {
-                width: 'initial',
-                'background-color': 'white',
-                'backdrop-filter': 'blur(3px)',
-                display: 'flex',
-                'flex-direction': 'column',
-                'justify-content': 'center',
-                'align-items': 'center',
-                padding: '20px 10px 10px 10px',
-            },
-            // Add custom CSS for CAPTCHA states
-            custom_css: `
-                .cf-turnstile.captcha-completed {
-                    border: 2px solid #4CAF50;
-                    border-radius: 4px;
-                    padding: 2px;
-                }
-                .signup-btn:disabled {
-                    opacity: 0.6;
-                    cursor: not-allowed;
-                }
-            `,
-        });
-
-        $(el_window)
-            .find('.login-c2a-clickable')
-            .on('click', async function (e) {
-                $('.login-c2a-clickable').parents('.window').close();
-                const login = await UIWindowLogin({
-                    referrer: options.referrer,
-                    reload_on_success: options.reload_on_success,
-                    redirect_url: options.redirect_url,
-                    window_options: options.window_options,
-                    show_close_button: options.show_close_button,
-                    send_confirmation_code: options.send_confirmation_code,
-                    show_password: false,
-                });
-                if (login) {
-                    resolve(true);
-                }
-            });
-
-        $(el_window)
-            .find('.signup-btn')
-            .on('click', async function (e) {
-                // Clear previous error states
-                $(el_window).find('.signup-error-msg').hide();
-
-                //Username
-                let username = $(el_window).find('.username').val();
-
-                if (!username) {
-                    $(el_window)
-                        .find('.signup-error-msg')
-                        .html(i18n('username_required'));
-                    $(el_window).find('.signup-error-msg').fadeIn();
-                    return;
-                }
-
-                //Email
-                let email = $(el_window).find('.email').val();
-
-                // must have an email
-                if (!email) {
-                    $(el_window)
-                        .find('.signup-error-msg')
-                        .html(i18n('email_required'));
-                    $(el_window).find('.signup-error-msg').fadeIn();
-                    return;
-                }
-                // must be a valid email
-                else if (!window.is_email(email)) {
-                    $(el_window)
-                        .find('.signup-error-msg')
-                        .html(i18n('email_invalid'));
-                    $(el_window).find('.signup-error-msg').fadeIn();
-                    return;
-                }
-
-                //Password
-                let password = $(el_window).find('.password').val();
-
-                // must have a password
-                if (!password) {
-                    $(el_window)
-                        .find('.signup-error-msg')
-                        .html(i18n('password_required'));
-                    $(el_window).find('.signup-error-msg').fadeIn();
-                    return;
-                }
-                // check password strength
-                const pass_strength = check_password_strength(password);
-                if (!pass_strength.overallPass) {
-                    $(el_window)
-                        .find('.signup-error-msg')
-                        .html(i18n('password_strength_error'));
-                    $(el_window).find('.signup-error-msg').fadeIn();
-                    return;
-                }
-                // get confirm password value
-                const confirmPassword = $(el_window)
-                    .find('.confirm-password')
-                    .val();
-                if (!confirmPassword) {
-                    $(el_window)
-                        .find('.signup-error-msg')
-                        .html(i18n('confirm_password_required'));
-                    $(el_window).find('.signup-error-msg').fadeIn();
-                    return;
-                }
-                // check if passwords match
-                if (password !== confirmPassword) {
-                    $(el_window)
-                        .find('.signup-error-msg')
-                        .html(i18n('passwords_do_not_match'));
-                    $(el_window).find('.signup-error-msg').fadeIn();
-                    return;
-                }
-
-                // Check if Cloudflare Turnstile CAPTCHA was completed
-                let turnstileToken = null;
-                if (window.turnstile && window.gui_params?.turnstileSiteKey) {
-                    turnstileToken = $(el_window)
-                        .find('.cf-turnstile')
-                        .attr('data-token');
-                    if (!turnstileToken) {
-                        $(el_window)
-                            .find('.signup-error-msg')
-                            .html(
-                                i18n('captcha_required') ||
-                                    'Please complete the CAPTCHA verification',
-                            );
-                        $(el_window).find('.signup-error-msg').fadeIn();
-                        return;
-                    }
-                }
-
-                //xyzname
-                let p102xyzname = $(el_window).find('.p102xyzname').val();
-
-                // disable 'Create Account' button
-                $(el_window).find('.signup-btn').prop('disabled', true);
-
-                let headers = {};
-                if (window.custom_headers) {
-                    headers = window.custom_headers;
-                }
-
-                // Device signal for abuse prevention; omitted when unavailable
-                let fingerprint = null;
-                try {
-                    fingerprint = await window.getDeviceFingerprint?.();
-                } catch (_) {
-                    // signup must never block or fail because of device signals
-                }
-
-                // Include captcha in request only if required
-                const requestData = {
-                    username: username,
-                    email: email,
-                    password: password,
-                    referrer: options.referrer ?? window.referrerStr,
-                    send_confirmation_code: options.send_confirmation_code,
-                    p102xyzname: p102xyzname,
-                    'cf-turnstile-response': turnstileToken,
-                };
-                if (fingerprint) {
-                    requestData.fingerprint = fingerprint;
-                }
-                if (window.signup_bonus_code) {
-                    requestData.bonusCode = window.signup_bonus_code;
-                }
-
-                $.ajax({
-                    url: `${window.gui_origin}/signup`,
-                    type: 'POST',
-                    async: true,
-                    headers: headers,
-                    contentType: 'application/json',
-                    data: JSON.stringify(requestData),
-                    success: async function (data) {
-                        await window.update_auth_data(data.token, data.user);
-
-                        let email_verified = true;
-                        const show_email_dialog =
-                            !options.reload_on_success &&
-                            (options.send_confirmation_code ||
-                                data.user?.requires_email_confirmation);
-                        if (
-                            data.user?.requires_phone_verification ||
-                            data.user?.requires_card_verification ||
-                            show_email_dialog
-                        ) {
-                            $(el_window).close();
-                            // Verification gates run in the server's order
-                            // (see assertVerifiedAccount): email → phone
-                            // (SMS) → card, or card → phone → email when the
-                            // account clears email last.
-                            const emailGate = async () => {
-                                if (show_email_dialog) {
-                                    email_verified =
-                                        await UIWindowEmailConfirmationRequired({
-                                            stay_on_top: true,
-                                            has_head: true,
-                                            reload_on_success:
-                                                options.reload_on_success,
-                                            window_options:
-                                                options.window_options ?? {},
-                                        });
-                                }
-                            };
-                            // A user the SMS path keeps failing may take the
-                            // card fallback instead; that resolves 'card' and
-                            // clears the card gate along with the phone gate
-                            // (see UIWindowPhoneVerificationRequired).
-                            let card_gate_cleared_by_fallback = false;
-                            const phoneGate = async () => {
-                                if (!data.user?.requires_phone_verification)
-                                    return;
-                                let phone_ok = false;
-                                do {
-                                    phone_ok =
-                                        await UIWindowPhoneVerificationRequired(
-                                            {
-                                                show_close_button: false,
-                                                stay_on_top: true,
-                                                has_head: true,
-                                                window_options:
-                                                    options.window_options ??
-                                                    {},
-                                            },
-                                        );
-                                } while (!phone_ok);
-                                card_gate_cleared_by_fallback =
-                                    phone_ok === 'card';
-                            };
-                            const cardGate = async () => {
-                                if (
-                                    !data.user?.requires_card_verification ||
-                                    card_gate_cleared_by_fallback
-                                )
-                                    return;
-                                let card_ok = false;
-                                do {
-                                    card_ok =
-                                        await UIWindowCardVerificationRequired({
-                                            show_close_button: false,
-                                            stay_on_top: true,
-                                            has_head: true,
-                                            window_options:
-                                                options.window_options ?? {},
-                                        });
-                                } while (!card_ok);
-                            };
-                            if (data.user?.email_gate_last) {
-                                await cardGate();
-                                await phoneGate();
-                                await emailGate();
-                            } else {
-                                await emailGate();
-                                await phoneGate();
-                                await cardGate();
-                            }
-                        }
-
-                        if (options.reload_on_success) {
-                            window.onbeforeunload = null;
-                            // Signup can interrupt a direct app landing (the
-                            // login cover page's "Sign up", the session
-                            // picker's "Create Account", the
-                            // must_login_or_signup fallback) — landing on '/'
-                            // afterwards would silently drop the app the URL
-                            // asked for, so app landings are preserved and
-                            // the reloaded boot replays them, launch and
-                            // dashboard intro included (the query string is
-                            // deliberately left behind, mirroring login's
-                            // credential-leak hygiene). Every other route
-                            // keeps the historical '/' — notably
-                            // /action/signup, where coming back to the same
-                            // path would just show this window again.
-                            const on_app_landing =
-                                /^\/(?:desktop\/)?app\/[^/]+\/?$/.test(
-                                    window.location.pathname,
-                                );
-                            const redirectUrl =
-                                options.redirect_url ||
-                                (on_app_landing
-                                    ? window.location.origin +
-                                      window.location.pathname
-                                    : '/');
-                            window.location.replace(redirectUrl);
-                        } else {
-                            resolve(email_verified);
-                        }
-                    },
-                    error: function (err) {
-                        // re-enable 'Create Account' button so user can try again
-                        $(el_window)
-                            .find('.signup-btn')
-                            .prop('disabled', false);
-
-                        // Reset Turnstile widget for retry
-                        try {
-                            if (window.turnstile) {
-                                window.turnstile?.reset('.cf-turnstile');
-                                $(el_window)
-                                    .find('.cf-turnstile')
-                                    .removeAttr('data-token');
-                                $(el_window)
-                                    .find('.cf-turnstile')
-                                    .removeClass('captcha-completed');
-                            }
-                        } catch (e) {
-                            console.log(e);
-                        }
-
-                        // Process error response
-                        const errorText = err.responseText || '';
-
-                        // Handle JSON error response
-                        try {
-                            // Try to parse error as JSON
-                            const errorJson = JSON.parse(errorText);
-
-                            // Handle signup blocked with full-screen overlay
-                            if (errorJson?.code === 'signup_blocked') {
-                                const overlay = document.createElement('div');
-                                overlay.classList.add('signup-blocked-overlay');
-                                const blockedMsg =
-                                    errorJson.message || 'Signup Not Allowed';
-                                overlay.innerHTML = `
-                                <div class="signup-blocked-content">
-                                    <img src="${window.icons['logo.svg'] || window.icons['logo-white.svg'] || ''}" style="width:64px;margin-bottom:24px;" />
-                                    <p>${html_encode(blockedMsg)}</p>
-                                    <p>If you already have an account, try <a href="/action/login">logging in</a>. Otherwise, contact <a href="mailto:support@puter.com">support@puter.com</a> for assistance.</p>
-                                </div>
-                            `;
-                                document.body.appendChild(overlay);
-                                return;
-                            }
-
-                            // Form signups closed after this window loaded.
-                            // Without provider buttons (some popups), the
-                            // server's message below says it instead.
-                            if (
-                                errorJson?.code === 'signup_oidc_only' &&
-                                offersProviders
-                            ) {
-                                showOidcOnly(el_window);
-                                return;
-                            }
-
-                            // Drop the code so the next attempt signs up without it.
-                            if (errorJson?.code === 'bonus_code_invalid') {
-                                window.signup_bonus_code = null;
-                                // The error below says it; the offer no longer applies.
-                                renderBonusNotice(el_window, null);
-                                $(el_window)
-                                    .find('.signup-error-msg')
-                                    .html(i18n('signup_bonus_code_invalid_retry'));
-                                $(el_window).find('.signup-error-msg').fadeIn();
-                                return;
-                            }
-
-                            // Handle timeout specifically
-                            if (
-                                errorJson?.code === 'response_timeout' ||
-                                errorText.includes('timeout')
-                            ) {
-                                $(el_window)
-                                    .find('.signup-error-msg')
-                                    .html(
-                                        i18n('server_timeout') ||
-                                            'The server took too long to respond. Please try again.',
-                                    );
-                                $(el_window).find('.signup-error-msg').fadeIn();
-                                return;
-                            }
-
-                            // If it's a message in the JSON, use that
-                            if (errorJson.message) {
-                                $(el_window)
-                                    .find('.signup-error-msg')
-                                    .html(errorJson.message);
-                                $(el_window).find('.signup-error-msg').fadeIn();
-                                return;
-                            }
-                        } catch (e) {
-                            console.log(e);
-                            // Not JSON, continue with text analysis
-                        }
-
-                        // Default general error handling
-                        $(el_window)
-                            .find('.signup-error-msg')
-                            .html(
-                                errorText ||
-                                    i18n('signup_error') ||
-                                    'An error occurred during signup. Please try again.',
-                            );
-                        $(el_window).find('.signup-error-msg').fadeIn();
-                    },
-                    timeout: 30000, // Add a reasonable timeout
-                });
-            });
-
-        $(el_window)
-            .find('.signup-form')
-            .on('submit', function (e) {
-                e.preventDefault();
-                e.stopPropagation();
-                return false;
-            });
-
-        $(el_window)
-            .find(
-                `#toggle-show-password-${internal_id}, #toggle-show-password-${internal_id}-confirm`,
-            )
-            .on('click', function (e) {
-                // hide/show password/confirm password and update icon
-                let inputField = $(this).siblings('input');
-                let isPasswordVisible = inputField.attr('type') === 'text';
-                inputField.attr(
-                    'type',
-                    isPasswordVisible ? 'password' : 'text',
-                );
-                $(this)
-                    .find('.toggle-show-password-icon')
-                    .attr(
-                        'src',
-                        isPasswordVisible
-                            ? window.icons['eye-open.svg']
-                            : window.icons['eye-closed.svg'],
-                    );
-            });
-
-        //remove login window
-        $('.signup-c2a-clickable').parents('.window').close();
-    });
-}
-
-export default UIWindowSignup;

src/gui/src/UI/UIWindowSignup.oidcOnly.test.js

@@ -1,100 +0,0 @@
-// @vitest-environment jsdom
-import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
-import jQuery from '../lib/jquery-3.6.1/jquery-3.6.1.min.js';
-
-const state = vi.hoisted(() => ({ el: null }));
-vi.mock('./UIWindowLogin.js', () => ({ default: vi.fn() }));
-vi.mock('./UIWindowEmailConfirmationRequired.js', () => ({ default: vi.fn() }));
-vi.mock('./UIWindowPhoneVerificationRequired.js', () => ({ default: vi.fn() }));
-vi.mock('./UIWindowCardVerificationRequired.js', () => ({ default: vi.fn() }));
-vi.mock('../helpers/authLogoHeader.js', () => ({
-    authLogoHeader: () => '',
-    wireAuthLogoHeader: vi.fn(),
-}));
-vi.mock('../helpers/checkPasswordStrength.js', () => ({
-    default: () => ({ overallPass: true }),
-}));
-vi.mock('./UIWindow.js', () => ({
-    default: async (options) => {
-        state.el = document.createElement('div');
-        state.el.innerHTML = options.body_content;
-        document.body.append(state.el);
-        options.onAppend?.(state.el);
-        return state.el;
-    },
-}));
-globalThis.def = globalThis.def ?? ((value) => value);
-const { default: UIWindowSignup } = await import('./UIWindowSignup.js');
-
-const providers = (body) => {
-    globalThis.fetch = vi.fn(async () => new Response(JSON.stringify(body)));
-};
-const find = (selector) => jQuery(state.el).find(selector);
-const shown = (selector) => find(selector).css('display') !== 'none';
-
-const open = async () => {
-    void UIWindowSignup({ reload_on_success: false, redirect_url: '/' });
-    await vi.waitFor(() => expect(find('.oidc-google-btn').css('display')).toBe('flex'));
-};
-
-beforeEach(() => {
-    document.body.innerHTML = '';
-    globalThis.$ = jQuery;
-    jQuery.fn.close = vi.fn();
-    globalThis.i18n = (key) => key;
-    globalThis.html_encode = (value) => jQuery('<div>').text(value).html();
-    window.gui_origin = 'https://puter.test';
-    window.api_origin = 'https://api.puter.test';
-    window.gui_params = {};
-    window.icons = {};
-    window.uuidv4 = () => 'oidc-only-test';
-    window.is_email = () => true;
-    window.embedded_in_popup = false;
-    window.url_query_params = new URLSearchParams('');
-    state.el = null;
-});
-afterEach(() => {
-    vi.restoreAllMocks();
-});
-
-describe('signup window when only OIDC signups are open', () => {
-    it('offers the email form behind a button normally', async () => {
-        providers({ providers: ['google'], signupOidcOnly: false });
-        await open();
-
-        expect(shown('.signup-with-email-wrapper')).toBe(true);
-        expect(shown('.signup-oidc-only-notice')).toBe(false);
-    });
-
-    it('drops the email form and says why', async () => {
-        providers({ providers: ['google'], signupOidcOnly: true });
-        await open();
-
-        await vi.waitFor(() => expect(shown('.signup-oidc-only-notice')).toBe(true));
-        expect(shown('.signup-form')).toBe(false);
-        expect(shown('.signup-with-email-wrapper')).toBe(false);
-    });
-
-    it('switches to the providers when a form signup is refused for it', async () => {
-        providers({ providers: ['google'], signupOidcOnly: false });
-        await open();
-        jQuery.ajax = vi.fn((opts) =>
-            opts.error({
-                responseText: JSON.stringify({
-                    code: 'signup_oidc_only',
-                    message: 'closed',
-                }),
-            }));
-
-        find('.signup-with-email-btn').trigger('click');
-        find('.username').val('someone');
-        find('.email').val('[email protected]');
-        find('.password').val('a-Strong-pass-1');
-        find('.confirm-password').val('a-Strong-pass-1');
-        find('.signup-btn').trigger('click');
-
-        await vi.waitFor(() => expect(shown('.signup-oidc-only-notice')).toBe(true));
-        expect(shown('.signup-form')).toBe(false);
-        expect(shown('.signup-with-email-wrapper')).toBe(false);
-    });
-});

src/gui/src/appsEmbed.js

@@ -24,6 +24,8 @@ import { createAppBrowser } from './UI/Dashboard/AppBrowser.js';
 import { appTileLink } from './UI/Dashboard/appLink.js';
 import { installAppIconFallback } from './helpers/appIcon.js';
 import { guestAppLaunchUrl, launchAppInTab } from './helpers/appTabLaunch.js';
+import { embedHostTheme, forceColorScheme } from './helpers/embedHostTheme.js';
+import { embedSession } from './helpers/embedSession.js';
 
 window.$ = window.jQuery = jQuery;
 window.html_encode = value => encode(String(value ?? ''), { mode: 'nonAsciiPrintable' });
@@ -45,6 +47,10 @@ try {
     window.locale = JSON.parse(localStorage.getItem('user_preferences') || '{}')?.language || 'en';
 } catch { /* Corrupt preferences must not prevent loading apps. */ }
 const localeReady = loadLocale(window.locale);
+// The host names its user and theme in the fragment, which can change without a reload.
+window.addEventListener('hashchange', () => window.location.reload());
+const hostTheme = embedHostTheme(window.location.hash);
+if ( hostTheme ) forceColorScheme(document, hostTheme);
 // Apps whose launch is still fetching; a second click would open a second tab.
 const launching = new Set();
 
@@ -98,31 +104,12 @@ function launchTile ({ appName, targetLink }) {
         .finally(() => launching.delete(appName));
 }
 
-/**
- * The GUI session, from local storage or else the session cookie. Safari keys a
- * frame's local storage by the top-level origin, so under a sibling subdomain
- * the GUI's stored token is out of reach while its cookie is still sent.
- */
-async function readSession () {
-    let stored = null;
-    try {
-        stored = localStorage.getItem('auth_token_v2');
-    } catch { /* Storage the browser refuses holds no session; the cookie may. */ }
-    if ( stored ) return stored;
-    const response = await fetch('/get-gui-token', { credentials: 'include' });
-    // Only a 401 means there is no session; a rate limit or server error
-    // must not pass a signed-in user off as signed out.
-    if ( response.status === 401 ) return null;
-    if ( ! response.ok ) throw new Error(`Session lookup responded ${response.status}`);
-    return (await response.json())?.token || null;
-}
-
 /**
  * Signed in, the user's own apps through the SDK. Without a session, the
  * recommended apps the page was rendered with, and no SDK.
  */
 async function mount () {
-    window.auth_token = await readSession();
+    window.auth_token = (await embedSession(config.apiOrigin, window.location.hash))?.token ?? null;
     const guestApps = window.auth_token ? undefined : config.guestApps;
     if ( !window.auth_token && !guestApps?.length ) throw new Error('No apps to show without a session');
 

src/gui/src/css/apps-embed.css

@@ -15,6 +15,39 @@ body {
     height: 100%;
 }
 
+/* Empty until the session check and the SDK finish; matches <puter-user-menu>'s spinner. */
+#app-browser:empty {
+    display: flex;
+    align-items: center;
+    justify-content: center;
+}
+
+#app-browser:empty::after {
+    content: '';
+    width: 22px;
+    height: 22px;
+    box-sizing: border-box;
+    border: 2px solid rgba(0, 0, 0, .12);
+    border-top-color: #555;
+    border-radius: 50%;
+    animation: app-browser-spin .7s linear infinite;
+}
+
+@keyframes app-browser-spin {
+    to { transform: rotate(360deg); }
+}
+
+@media (prefers-reduced-motion: reduce) {
+    #app-browser:empty::after { animation-duration: 1.6s; }
+}
+
+@media (prefers-color-scheme: dark) {
+    #app-browser:empty::after {
+        border-color: rgba(255, 255, 255, .15);
+        border-top-color: #ccc;
+    }
+}
+
 #app-browser .dashboard-section-apps {
     width: 100%;
 }

src/gui/src/css/feedback-embed.css

@@ -0,0 +1,17 @@
+/* Transparent, so the dialog's own scrim covers the framing page. */
+html,
+body {
+    margin: 0;
+    width: 100%;
+    height: 100%;
+    overflow: hidden;
+    background: transparent;
+    font-family: "Inter", "Helvetica Neue", Helvetica, Arial, sans-serif;
+}
+
+/* A scroll over the scrim must not scroll the framing page behind it. */
+html {
+    overscroll-behavior: none;
+    /* Matches the frame's, so it stays transparent and follows the OS theme. */
+    color-scheme: light dark;
+}

src/gui/src/css/style.css

@@ -140,6 +140,21 @@ body {
     background-color: #ccccccbe !important;
 }
 
+/* A popup framed over its whole page, such as the upgrade, shows the page
+   around its own dialog. The root's color scheme matches the frame's, or the
+   browser paints the frame opaque; the GUI inside keeps the light scheme it
+   has everywhere else, so its form fields don't turn dark. */
+html.popup-frame-transparent,
+html.popup-frame-transparent body {
+    background: transparent !important;
+}
+html.popup-frame-transparent {
+    color-scheme: light dark;
+}
+html.popup-frame-transparent body {
+    color-scheme: light;
+}
+
 .disable-user-select {
     cursor: default;
     -webkit-touch-callout: none !important;
@@ -181,6 +196,20 @@ input[type=text], input[type=password], input[type=email], select {
     font-size: 14px;
 }
 
+@media (prefers-color-scheme: dark) {
+    input[type=text], input[type=password], input[type=email], select {
+        background-color: #2d2d2d;
+        border: 1px solid #555;
+        color: #e6e6e6;
+    }
+
+    input[type=text]::placeholder,
+    input[type=password]::placeholder,
+    input[type=email]::placeholder {
+        color: #999;
+    }
+}
+
 /* to prevent auto-zoom on input focus in mobile */
 .device-phone input[type=text], .device-phone input[type=password], .device-phone input[type=email], .device-phone select {
     font-size: 17px;
@@ -1478,6 +1507,18 @@ span.header-sort-icon img {
     align-items: center;
 }
 
+/* The file name shrinks so the buttons stay on one line, on screen, in a narrow dialog. */
+.window-filedialog-prompt > div {
+    min-width: 0;
+    white-space: nowrap;
+}
+
+@media (max-width: 480px) {
+    .window-filedialog-prompt .button-small {
+        padding: 0 16px;
+    }
+}
+
 .savefiledialog-filename {
     float: left;
     margin-right: 10px;
@@ -1485,10 +1526,21 @@ span.header-sort-icon img {
     border-width: 1px !important;
     height: 31px;
     flex-grow: 1;
+    min-width: 0;
     width: initial !important;
 }
 
+/* In a narrow open dialog, the upload label gives way so its buttons stay whole. */
+.window-filedialog-upload-here + div {
+    flex-shrink: 0;
+}
+
 .window-filedialog-upload-here {
+    min-width: 0;
+    margin-right: 10px;
+    overflow: hidden;
+    text-overflow: ellipsis;
+    white-space: nowrap;
     -webkit-font-smoothing: antialiased;
     opacity: 0.7;
     font-size: 14px;
@@ -1925,6 +1977,60 @@ span.header-sort-icon img {
     background: transparent;
 }
 
+/* Dark mode: same surfaces as the dashboard's dark cards. The translucent
+   background is also set in the backdrop-filter @supports block below. */
+@media (prefers-color-scheme: dark) {
+    .context-menu {
+        color: #d4d4d4;
+        background-color: rgb(38 38 38 / 85%);
+        border-color: #3d3d3d;
+        box-shadow: 0px 3px 20px #00000066;
+    }
+
+    .context-menu .context-menu-divider>hr {
+        border-top-color: #ffffff26;
+    }
+
+    .context-menu .has-open-context-menu-submenu {
+        background-color: #3a3a3a;
+    }
+
+    /* `color: initial` resolves to black, unreadable on the dark surface. */
+    .context-menu .context-menu-item-active-blurred {
+        background-color: #404650;
+        color: inherit;
+    }
+
+    .context-menu .context-menu-item-disabled, .context-menu .context-menu-item-disabled:hover {
+        color: inherit;
+    }
+
+    /* The resting chevron is black; the active one is already white. */
+    .context-menu .submenu-arrow:not(.submenu-arrow-active) {
+        filter: invert(1);
+    }
+
+    /* Full-color icons (file types, app icons) keep their colors; only
+       monochrome dark glyphs are inverted. */
+    .context-menu .context-menu-item .ctx-item-icon-monochrome {
+        filter: invert(1);
+    }
+
+    .context-menu.context-menu-sheet {
+        background-color: rgba(38, 38, 38, 0.96) !important;
+        box-shadow: 0 -6px 24px rgba(0, 0, 0, 0.5) !important;
+    }
+
+    .context-menu.context-menu-sheet .context-menu-item-active:not(.context-menu-divider) {
+        background-color: rgba(10, 132, 255, 0.24) !important;
+        color: #d4d4d4 !important;
+    }
+
+    .context-menu.context-menu-sheet .context-menu-divider > hr {
+        border-top-color: rgba(235, 235, 245, 0.18);
+    }
+}
+
 .draggable-count-badge {
     background-color: red;
     border: 2px solid white;
@@ -2260,13 +2366,6 @@ label {
     color: #611a15;
 }
 
-.signup-oidc-only-notice {
-    text-align: center;
-    margin: 0 0 10px;
-    font-size: 14px;
-    color: #5f6368;
-}
-
 /* -- Logo strip above the login / signup forms -- */
 .auth-logo-header {
     display: flex;
@@ -2662,32 +2761,6 @@ label {
     -webkit-font-smoothing: antialiased;
 }
 
-.session-entry {
-    cursor: pointer;
-    padding: 20px;
-    border: 1px solid #CCC;
-    border-radius: 3px;
-    margin-bottom: 10px;
-    background-color: white;
-    font-weight: 500;
-    color: #394d5c;
-}
-
-.session-entry:hover {
-    border-color: #00a6ff;
-}
-
-.login-c2a-session-list, .signup-c2a-session-list {
-    cursor: pointer;
-    font-size: 15px;
-    color: #636363;
-}
-
-.login-c2a-session-list:hover, .signup-c2a-session-list:hover {
-    text-decoration: underline;
-    ;
-}
-
 /*****************************************************
  * Taskbar
  *****************************************************/
@@ -3958,6 +4031,12 @@ fieldset[name=number-code] {
         backdrop-filter: blur(3px);
     }
 
+    @media (prefers-color-scheme: dark) {
+        .context-menu {
+            background-color: rgb(38 38 38 / 92%);
+        }
+    }
+
     .popover:not(.device-phone .popover) {
         background-color: rgb(238, 243, 248);
         backdrop-filter: blur(10px);
@@ -5142,11 +5221,16 @@ html.dark-mode .usage-table-fade-overlay {
 }
 
 /* On a phone, units and cost keep every digit; the resource name is the
-   column that gives way. */
+   column that gives way, wrapping rather than cut off, since a touch screen
+   has no hover to show the rest. */
 @media (max-width: 480px) {
     .dashboard-section-usage .driver-usage-details-content-table td:not(:first-child) {
         max-width: none;
     }
+    .dashboard-section-usage .driver-usage-details-content-table td:first-child {
+        white-space: normal;
+        overflow-wrap: anywhere;
+    }
 }
 .version {
     font-size: 9px;
@@ -6139,13 +6223,6 @@ html.dark-mode .usage-table-fade-overlay {
     border-radius: 0;
 }
 
-.device-phone .window.window-login-2fa {
-    left: 50% !important;
-    transform: translate(-50%) !important;
-    height: initial !important;
-    max-width: calc(100% - 30px);
-}
-
 .device-phone .window.window-explorer {
     transform: none;
     width: 100%;
@@ -6165,15 +6242,6 @@ html.dark-mode .usage-table-fade-overlay {
     border-radius: 0;
 }
 
-.device-phone .window-signup {
-    transform: none;
-    width: 100%;
-    left: 0;
-    top: 50%;
-    transform: translateY(-50%);
-    border-radius: 0;
-}
-
 .device-phone .send-feedback-btn {
     width: 100%;
 }
@@ -6404,17 +6472,6 @@ html.dark-mode .usage-table-fade-overlay {
     height: 20px;
 }
 
-.window-recover-password.window-cover-page .window-body{
-    background-color: white !important;
-}
-.window-recover-password .window-body{
-    display: flex;
-    flex-direction: column;
-    justify-content: center;
-    align-items: center;
-    height: 100%;
-    width: 100%;
-}
 /* -------------------------------------------------------------------------
    Permission Request Dialog (UIPermissionDialog)
    Standalone top-layer <dialog>; follows the OS light/dark scheme.

src/gui/src/feedbackEmbed.browser.test.js

@@ -0,0 +1,252 @@
+import { afterAll, beforeAll, describe, expect, it } from 'vitest';
+import { chromium } from '@playwright/test';
+import express from 'express';
+import webpack from 'webpack';
+import { mkdtemp, rm } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { inflateSync } from 'node:zlib';
+
+let browser;
+let server;
+let directory;
+let origin;
+let hostOrigin;
+let port;
+const requests = [];
+const guiRoot = fileURLToPath(new URL('../', import.meta.url));
+const sessionToken = 'feedback-embed-test-session';
+const unconfirmedToken = 'feedback-embed-test-unconfirmed';
+const sessionUser = '0b1c9a52-3f0e-4c7a-9a65-2f6d1e8b7c40';
+const unconfirmedUser = '1c2d3e4f-5a6b-4c7d-8e9f-0a1b2c3d4e5f';
+const otherUser = '7d2e4f10-8a3b-4c5d-9e6f-0a1b2c3d4e5f';
+
+beforeAll(async () => {
+    directory = await mkdtemp(path.join(tmpdir(), 'puter-feedback-embed-'));
+    await new Promise((resolve, reject) => {
+        const compiler = webpack({
+            mode: 'development',
+            entry: { 'feedback-embed': path.join(guiRoot, 'src/feedbackEmbed.js') },
+            output: { path: directory, filename: '[name].min.js' },
+            module: { rules: [{ test: /jquery-3\.6\.1\.min\.js$/, type: 'javascript/auto' }] },
+        });
+        compiler.run((error, stats) => compiler.close(closeError => {
+            if ( error || closeError ) return reject(error || closeError);
+            if ( stats.hasErrors() ) return reject(new Error(stats.toString()));
+            resolve();
+        }));
+    });
+    const app = express();
+    app.use(express.json());
+    app.use((req, res, next) => {
+        requests.push({ path: req.path, query: req.query, body: req.body, auth: req.headers.authorization });
+        next();
+    });
+    app.use('/dist', express.static(directory));
+    app.use('/css', express.static(path.join(guiRoot, 'src/css')));
+    app.get('/get-gui-token', (_req, res) => res.sendStatus(401));
+    const whoamiByToken = {
+        [sessionToken]: { uuid: sessionUser, username: 'session-user', email: '[email protected]', email_confirmed: true },
+        [unconfirmedToken]: {
+            uuid: unconfirmedUser, username: 'new-user', email_confirmed: false, requires_email_confirmation: true,
+        },
+    };
+    app.get('/whoami', (req, res) => {
+        const user = whoamiByToken[req.headers.authorization?.replace(/^Bearer /, '')];
+        if ( ! user ) return res.sendStatus(401);
+        res.json(user);
+    });
+    app.get('/app-feedback/target', (req, res) => {
+        if ( req.headers.authorization !== `Bearer ${sessionToken}` ) return res.sendStatus(401);
+        if ( req.query.origin !== hostOrigin ) return res.json({ enabled: false });
+        res.json({ enabled: true, app: { name: 'notes', title: 'Notes' } });
+    });
+    app.post('/app-feedback', (req, res) => {
+        if ( req.headers.authorization !== `Bearer ${sessionToken}` ) return res.sendStatus(401);
+        res.json({});
+    });
+    // A first-party page that frames the dialog as puter.js does, recording what the embed tells it.
+    app.get('/host', (req, res) => res.send(`<!DOCTYPE html><html><body style="margin:0;background:rgb(255,0,0)">
+        <script>
+            window.received = [];
+            addEventListener('message', (e) => {
+                if ( e.origin === '${origin}' ) window.received.push(e.data);
+            });
+        </script>
+        <iframe referrerpolicy="origin" title="Send feedback" src="${origin}/embed/feedback#user=${req.query.user ?? ''}"
+            style="display:block;border:0;width:100vw;height:100vh;color-scheme:light dark"></iframe>
+        <div style="height:3000px"></div>
+    </body></html>`));
+    app.get('/embed/feedback', (_req, res) => {
+        res.setHeader('Content-Security-Policy', `frame-ancestors 'self' ${hostOrigin}`);
+        res.send(`<!DOCTYPE html><html><head><meta name="viewport" content="width=device-width, initial-scale=1">
+            <link rel="stylesheet" href="/css/normalize.css"><link rel="stylesheet" href="/css/dashboard.css">
+            <link rel="stylesheet" href="/css/feedback-embed.css"></head><body>
+            <main id="feedback-embed"></main>
+            <script type="application/json" id="feedback-embed-config">${JSON.stringify({ apiOrigin: origin, hostOrigin })}</script>
+            <script defer src="/dist/feedback-embed.min.js"></script></body></html>`);
+    });
+    server = await new Promise(resolve => {
+        const listener = app.listen(0, '127.0.0.1', () => resolve(listener));
+    });
+    port = server.address().port;
+    origin = `http://puter.localhost:${port}`;
+    hostOrigin = `http://notes.puter.localhost:${port}`;
+    browser = await chromium.launch();
+}, 60000);
+
+afterAll(async () => {
+    await browser?.close();
+    if ( server ) await new Promise(resolve => server.close(resolve));
+    if ( directory ) await rm(directory, { recursive: true, force: true });
+});
+
+/** A browser whose GUI origin is signed in with `token`, if any. */
+const signedIn = (token, options = {}) => browser.newContext({ ...options, storageState: {
+    cookies: [],
+    origins: token ? [{ origin, localStorage: [{ name: 'auth_token_v2', value: token }] }] : [],
+} });
+
+const received = page => page.evaluate(() => window.received);
+
+/** The [r, g, b] of one pixel of the page, from a screenshot. */
+const pixel = async (page, x, y) => {
+    const png = await page.screenshot({ clip: { x, y, width: 1, height: 1 }, animations: 'disabled' });
+    const data = [];
+    for ( let at = 8; at < png.length; ) {
+        const length = png.readUInt32BE(at);
+        if ( png.toString('ascii', at + 4, at + 8) === 'IDAT' ) data.push(png.subarray(at + 8, at + 8 + length));
+        at += 12 + length;
+    }
+    // One pixel: a filter byte, then its channels unchanged.
+    return [...inflateSync(Buffer.concat(data)).subarray(1, 4)];
+};
+
+describe('feedback embed', () => {
+    it('sends feedback for the framing page as the user it names, then tells it', async () => {
+        const context = await signedIn(sessionToken);
+        try {
+            const page = await context.newPage();
+            page.setDefaultTimeout(6000);
+            const errors = [];
+            page.on('pageerror', error => errors.push(error.message));
+            requests.length = 0;
+            await page.goto(`${hostOrigin}/host?user=${sessionUser}`);
+            const frame = page.frameLocator('iframe');
+            await frame.locator('.app-feedback-form').waitFor();
+            expect(await frame.locator('.app-feedback-target-title').textContent()).toBe('Notes');
+            expect(await received(page)).toEqual([
+                { msg: 'feedbackEmbed', state: 'loading' },
+                { msg: 'feedbackEmbed', state: 'ready' },
+            ]);
+            // The page behind shows through around the dialog, under its scrim.
+            expect(await frame.locator('body').evaluate(el => getComputedStyle(el).backgroundColor)).toBe('rgba(0, 0, 0, 0)');
+            await page.screenshot({ path: path.join(tmpdir(), 'puter-feedback-embed.png'), animations: 'disabled' });
+
+            await frame.locator('.app-feedback-message').fill('Love the new editor');
+            await frame.locator('.app-feedback-send-btn').click();
+            await frame.locator('.app-feedback-success').waitFor();
+            await page.waitForFunction(() => window.received.some(m => m.msg === 'feedbackDialogClosed'));
+            expect((await received(page)).at(-1)).toEqual({ msg: 'feedbackDialogClosed', sent: true });
+            expect(await frame.locator('.app-feedback-overlay').count()).toBe(0);
+
+            const submit = requests.find(req => req.path === '/app-feedback');
+            expect(submit.body).toEqual({ origin: hostOrigin, message: 'Love the new editor', context: 'web' });
+            expect(submit.auth).toBe(`Bearer ${sessionToken}`);
+            expect(errors).toEqual([]);
+        } finally {
+            await context.close();
+        }
+    }, 30000);
+
+    it('answers not sent when the user dismisses it', async () => {
+        const context = await signedIn(sessionToken);
+        try {
+            const page = await context.newPage();
+            page.setDefaultTimeout(6000);
+            await page.goto(`${hostOrigin}/host?user=${sessionUser}`);
+            const frame = page.frameLocator('iframe');
+            await frame.locator('.app-feedback-form').waitFor();
+            await frame.locator('.app-feedback-message').press('Escape');
+            await page.waitForFunction(() => window.received.some(m => m.msg === 'feedbackDialogClosed'));
+            expect((await received(page)).at(-1)).toEqual({ msg: 'feedbackDialogClosed', sent: false });
+        } finally {
+            await context.close();
+        }
+    }, 30000);
+
+    it.each(['light', 'dark'])('lets the page show through under the scrim in %s mode', async (colorScheme) => {
+        const context = await signedIn(sessionToken, { colorScheme });
+        try {
+            const page = await context.newPage();
+            page.setDefaultTimeout(6000);
+            await page.goto(`${hostOrigin}/host?user=${sessionUser}`);
+            const frame = page.frameLocator('iframe');
+            await frame.locator('.app-feedback-form').waitFor();
+            expect(await frame.locator('body').evaluate(() => matchMedia('(prefers-color-scheme: dark)').matches))
+                .toBe(colorScheme === 'dark');
+            await page.waitForTimeout(300);
+            // The red page, dimmed by the scrim, rather than an opaque frame.
+            const [red, green, blue] = await pixel(page, 10, 10);
+            expect(red).toBeGreaterThan(green + 40);
+            expect(green).toBe(blue);
+        } finally {
+            await context.close();
+        }
+    }, 30000);
+
+    it('keeps the page behind from scrolling under the scrim', async () => {
+        const context = await signedIn(sessionToken);
+        try {
+            const page = await context.newPage();
+            page.setDefaultTimeout(6000);
+            await page.goto(`${hostOrigin}/host?user=${sessionUser}`);
+            await page.frameLocator('iframe').locator('.app-feedback-form').waitFor();
+            await page.mouse.move(10, 10);
+            await page.mouse.wheel(0, 600);
+            await page.waitForTimeout(300);
+            expect(await page.evaluate(() => window.scrollY)).toBe(0);
+        } finally {
+            await context.close();
+        }
+    }, 30000);
+
+    it.each([
+        ['no Puter session', null, sessionUser],
+        ['a session for another user', sessionToken, otherUser],
+        ['a host that names no user', sessionToken, ''],
+        ['an email still to confirm', unconfirmedToken, unconfirmedUser],
+    ])('tells the host it is unavailable with %s', async (_label, token, user) => {
+        const context = await signedIn(token);
+        try {
+            const page = await context.newPage();
+            page.setDefaultTimeout(6000);
+            requests.length = 0;
+            await page.goto(`${hostOrigin}/host?user=${user}`);
+            await page.waitForFunction(() => window.received.length >= 2);
+            expect(await received(page)).toEqual([
+                { msg: 'feedbackEmbed', state: 'loading' },
+                { msg: 'feedbackEmbed', state: 'unavailable' },
+            ]);
+            expect(await page.frameLocator('iframe').locator('.app-feedback-overlay').count()).toBe(0);
+            expect(requests.some(req => req.path.startsWith('/app-feedback'))).toBe(false);
+        } finally {
+            await context.close();
+        }
+    }, 30000);
+
+    it('does nothing when opened on its own', async () => {
+        const context = await signedIn(sessionToken);
+        try {
+            const page = await context.newPage();
+            requests.length = 0;
+            await page.goto(`${origin}/embed/feedback#user=${sessionUser}`);
+            await page.waitForLoadState('networkidle');
+            expect(await page.locator('.app-feedback-overlay').count()).toBe(0);
+            expect(requests.some(req => req.path === '/whoami')).toBe(false);
+        } finally {
+            await context.close();
+        }
+    }, 30000);
+});

src/gui/src/feedbackEmbed.js

@@ -0,0 +1,86 @@
+/*
+ * Copyright (C) 2024-present Puter Technologies Inc.
+ *
+ * This file is part of Puter.
+ *
+ * Puter is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published
+ * by the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <https://www.gnu.org/licenses/>.
+ */
+
+import jQuery from './lib/jquery-3.6.1/jquery-3.6.1.min.js';
+import { encode } from 'html-entities';
+import { loadLocale } from './i18n/embedI18n.js';
+import UIWindowAppFeedback from './UI/UIWindowAppFeedback.js';
+import { embedSession } from './helpers/embedSession.js';
+
+window.$ = window.jQuery = jQuery;
+window.html_encode = value => encode(String(value ?? ''), { mode: 'nonAsciiPrintable' });
+
+const config = JSON.parse(document.querySelector('#feedback-embed-config').textContent);
+window.api_origin = config.apiOrigin;
+window.locale = 'en';
+try {
+    window.locale = JSON.parse(localStorage.getItem('user_preferences') || '{}')?.language || 'en';
+} catch { /* Corrupt preferences must not prevent sending feedback. */ }
+const localeReady = loadLocale(window.locale);
+
+/** Answers only the page frame-ancestors pinned, which the feedback is for. */
+const tellHost = (data) => window.parent.postMessage(data, config.hostOrigin);
+
+/** Resolves once the dialog's overlay has left the page, after its success pane and exit. */
+const overlayGone = () => new Promise((resolve) => {
+    const gone = () => !document.querySelector('.app-feedback-overlay');
+    if ( gone() ) return resolve();
+    const observer = new MutationObserver(() => {
+        if ( ! gone() ) return;
+        observer.disconnect();
+        resolve();
+    });
+    observer.observe(document.body, { childList: true });
+});
+
+/**
+ * Shows the app feedback dialog for the framing page, as the signed-in user it
+ * names. Without that user's session, or with an email still to confirm, the
+ * host is told the embed is unavailable and uses the popup, which can sign in.
+ */
+async function run () {
+    tellHost({ msg: 'feedbackEmbed', state: 'loading' });
+    let session = null;
+    try {
+        session = await embedSession(config.apiOrigin, window.location.hash);
+    } catch (e) {
+        console.error('feedback embed: session check failed', e);
+    }
+    const user = session?.user;
+    if ( !user || (user.requires_email_confirmation && !user.email_confirmed) ) {
+        tellHost({ msg: 'feedbackEmbed', state: 'unavailable' });
+        return;
+    }
+    window.auth_token = session.token;
+    window.user = user;
+    await localeReady;
+
+    tellHost({ msg: 'feedbackEmbed', state: 'ready' });
+    let sent = false;
+    try {
+        sent = await UIWindowAppFeedback({ origin: config.hostOrigin, source: 'web' });
+        await overlayGone();
+    } catch (e) {
+        console.error('feedback embed: dialog failed', e);
+    }
+    tellHost({ msg: 'feedbackDialogClosed', sent: sent === true });
+}
+
+// Opened on its own, there is no page to send feedback for or answer.
+if ( config.hostOrigin && window.parent !== window ) run();

src/gui/src/globals.js

@@ -70,7 +70,7 @@ if ( window.logged_in_users.length === 0 && window.user !== null ) {
     let tuser = window.user;
     tuser.auth_token = window.auth_token;
     window.logged_in_users.push(tuser);
-    localStorage.setItem('logged_in_users', window.logged_in_users);
+    localStorage.setItem('logged_in_users', JSON.stringify(window.logged_in_users));
 }
 
 window.last_window_zindex = 1;

src/gui/src/helpers.determineWebsiteUrl.test.js

@@ -23,7 +23,7 @@ import jQuery from './lib/jquery-3.6.1/jquery-3.6.1.min.js';
 
 vi.mock('./UI/UIAlert.js', () => ({ default: vi.fn() }));
 vi.mock('./UI/UIItem.js', () => ({ default: vi.fn() }));
-vi.mock('./UI/UIWindowLogin.js', () => ({ default: vi.fn() }));
+vi.mock('./UI/Auth/UIAuthLogin.js', () => ({ default: vi.fn() }));
 vi.mock('./UI/UIWindowProgress.js', () => ({ default: vi.fn() }));
 vi.mock('./UI/UIWindowSaveAccount.js', () => ({ default: vi.fn() }));
 

src/gui/src/helpers.handle401.test.js

@@ -23,7 +23,7 @@ import jQuery from './lib/jquery-3.6.1/jquery-3.6.1.min.js';
 
 vi.mock('./UI/UIAlert.js', () => ({ default: vi.fn() }));
 vi.mock('./UI/UIItem.js', () => ({ default: vi.fn() }));
-vi.mock('./UI/UIWindowLogin.js', () => ({ default: vi.fn() }));
+vi.mock('./UI/Auth/UIAuthLogin.js', () => ({ default: vi.fn() }));
 vi.mock('./UI/UIWindowProgress.js', () => ({ default: vi.fn() }));
 vi.mock('./UI/UIWindowSaveAccount.js', () => ({ default: vi.fn() }));
 

src/gui/src/helpers.js

@@ -36,7 +36,7 @@ import mime from './lib/mime.js';
 import path from './lib/path.js';
 import UIAlert from './UI/UIAlert.js';
 import UIItem from './UI/UIItem.js';
-import UIWindowLogin from './UI/UIWindowLogin.js';
+import UIAuthLogin from './UI/Auth/UIAuthLogin.js';
 import UIWindowProgress from './UI/UIWindowProgress.js';
 import UIWindowSaveAccount from './UI/UIWindowSaveAccount.js';
 
@@ -67,7 +67,7 @@ window.is_auth = () => {
  *   1. Snapshot enough state to land back where we were after sign-in.
  *   2. Clear the token key (and the retired one, if a value lingers).
  *   3. Show a soft modal explaining what happened.
- *   4. Re-open UIWindowLogin, forwarding `auth_id` so temp users can
+ *   4. Re-open the login dialog, forwarding `auth_id` so temp users can
  *      re-attach to the same identity.
  *
  * Idempotent: parallel 401s while the modal is already open are dropped.
@@ -106,12 +106,12 @@ window.handleReauthRequired = async (signal = {}) => {
             });
         } catch ( e ) {
             // If the alert surface isn't available (very early in boot),
-            // fall through to UIWindowLogin directly.
+            // fall through to the login dialog directly.
         }
 
         // Open the login window, forwarding auth_id.
         try {
-            const login = await UIWindowLogin({
+            const login = await UIAuthLogin({
                 reload_on_success: true,
                 auth_id: signal.auth_id,
                 reauth_reason: signal.reason,
@@ -224,10 +224,11 @@ window.suggest_apps_for_fsentry = async (options) => {
  */
 window.byte_format = (bytes) => {
     const sizes = ['Bytes', 'KB', 'MB', 'GB', 'TB', 'PB', 'EB'];
-    if ( bytes === 0 ) return '0 Byte';
     let i = parseInt(Math.floor(Math.log(bytes) / Math.log(1024)));
-    if ( i < 0 ) i = 0;
+    if ( ! (i > 0) ) i = 0;
     if ( i >= sizes.length ) i = sizes.length - 1;
+    // Whole bytes have no fraction: "0 Bytes", "1 Byte", "512 Bytes".
+    if ( i === 0 ) return `${bytes} ${bytes === 1 ? 'Byte' : 'Bytes'}`;
     return `${(bytes / Math.pow(1024, i)).toFixed(2) } ${ sizes[i]}`;
 };
 
@@ -643,8 +644,11 @@ window.update_auth_data = async (auth_token, user) => {
             });
         } catch (e) {
             console.error('Failed to sync session cookie:', e);
+            // Sign-in waits on this with its card still up, above every
+            // ordinary window.
             await UIAlert({
                 message: `Failed to sync session cookie: ${ e.message}`,
+                stay_on_top: true,
             });
         }
     }
@@ -660,33 +664,20 @@ window.update_auth_data = async (auth_token, user) => {
         $('.user-email').html(html_encode(user.email));
     }
 
-    // ----------------------------------------------------
-    // load the user's profile
-    // ----------------------------------------------------
-    user.profile = {};
-    puter.auth.getProfile().then((profile) => {
-        window.user.profile.displayName = profile?.displayName ?? null;
-        window.user.profile.bio = profile?.bio ?? null;
-        if ( profile?.displayName ) {
-            $('.dashboard-profile-display-name').text(profile.displayName);
-        }
-        if ( profile?.picture ) {
-            window.user.profile.picture = html_encode(profile.picture);
-            $('.profile-pic').css('background-image', `url(${window.user.profile.picture})`);
-            // the account tab may have rendered before the profile arrived
-            $('.dashboard-profile-remove-picture').prop('hidden', false);
-        }
-    }).catch((error) => {
-        console.error('Error loading profile:', error);
-    });
-
-    // ----------------------------------------------------
+    // Keep this account's last known profile until the fresh one loads below;
+    // the account picker reads pictures from the stored copy.
+    const known_profile = window.logged_in_users.find(known => known.uuid === user.uuid)?.profile;
+    user.profile = { ...(known_profile ?? user.profile ?? {}) };
 
     const to_storable_user = user => {
         const storable_user = { ...user };
         delete storable_user.taskbar_items;
         return storable_user;
     };
+    const store_users = () => {
+        localStorage.setItem('user', JSON.stringify(to_storable_user(window.user)));
+        localStorage.setItem('logged_in_users', JSON.stringify(window.logged_in_users.map(to_storable_user)));
+    };
 
     // update this session's user data
     window.user = user;
@@ -712,10 +703,33 @@ window.update_auth_data = async (auth_token, user) => {
             userobj.auth_token = window.auth_token;
             window.logged_in_users.push(userobj);
         }
-        // update local storage
-        localStorage.setItem('logged_in_users', JSON.stringify(window.logged_in_users.map(to_storable_user)));
+        store_users();
     }
 
+    // Loaded only after puter.js holds this account's token, so it can't
+    // return the previous account's profile.
+    puter.auth.getProfile().then((profile) => {
+        // Another account may have signed in while this was loading.
+        if ( !profile || window.user !== user ) return;
+        const shown_picture = user.profile.picture ?? null;
+        user.profile = {
+            displayName: profile.displayName ?? null,
+            bio: profile.bio ?? null,
+            picture: profile.picture ? html_encode(profile.picture) : null,
+        };
+        store_users();
+        if ( profile.displayName ) {
+            $('.dashboard-profile-display-name').text(profile.displayName);
+        }
+        // the account tab may have rendered before the profile arrived
+        if ( user.profile.picture !== shown_picture ) {
+            $('.profile-pic').css('background-image', `url(${user.profile.picture || window.icons['profile.svg']})`);
+            $('.dashboard-profile-remove-picture').prop('hidden', !user.profile.picture);
+        }
+    }).catch((error) => {
+        console.error('Error loading profile:', error);
+    });
+
     window.desktop_path = `/${ window.user.username }/Desktop`;
     window.trash_path = `/${ window.user.username }/Trash`;
     window.appdata_path = `/${ window.user.username }/AppData`;
@@ -1077,15 +1091,10 @@ window.show_save_account_notice_if_needed = function (message) {
                     });
 
                 } else if ( alert_resp === 'login' ) {
-                    let login_result = await UIWindowLogin({
+                    let login_result = await UIAuthLogin({
                         show_signup_button: false,
                         reload_on_success: true,
                         send_confirmation_code: false,
-                        window_options: {
-                            show_in_taskbar: false,
-                            backdrop: true,
-                            close_on_backdrop_click: false,
-                        },
                     });
                     // FIXME: Report login error.
                 }