fix: sanitize user data (#3552)

* refactor(permissions): drop hardcoded group permission map for a flat default

* test(drivers): assert credential-gate intent instead of a 403 proxy

BUG-BOUNTY.md

@@ -6,33 +6,33 @@ We at **Puter** are committed to maintaining a secure experience for our users a
 
 The following are in scope for this program:
 
-* **The Puter open-source project** (available at [github.com/HeyPuter/puter](https://github.com/HeyPuter/puter))
-* **`puter.com`**
-* **`api.puter.com`**
+- **The Puter open-source project** (available at [github.com/HeyPuter/puter](https://github.com/HeyPuter/puter))
+- **`puter.com`**
+- **`api.puter.com`**
 
 Out-of-scope:
 
-* Third-party services, applications, or libraries not maintained by Puter.
-* Social engineering attacks (e.g., phishing against staff).
-* Denial of Service (DoS), spam, or volumetric attacks.
-* Physical security issues.
+- Third-party services, applications, or libraries not maintained by Puter.
+- Social engineering attacks (e.g., phishing against staff).
+- Denial of Service (DoS), spam, or volumetric attacks.
+- Physical security issues.
 
 ## Known Non-Issues (Please Check Before Submitting)
 
 The following have already been reviewed and determined **not to be vulnerabilities**. Reports that only re-describe one of these are **not eligible for a reward** and will be closed as non-issues — even if they include new code references. Please review this list before submitting:
 
-* **XSS / CORS / token issues scoped to `api.puter.com`.** The primary user session cookie lives on `puter.com`, not on the API origin, so reflected/stored XSS, CORS, or token handling on `api.puter.com` is generally out of scope. Two exceptions we *do* evaluate on their merits — please report these: (a) attacker-controlled content served **inline** (e.g. an HTML `Content-Type`) from API file/response endpoints, and (b) anything that abuses the app-scoped `puter_token_v2` companion cookie set on the API host.
-* **SSRF via `secureFetch`.** Production routes outbound requests through an isolated proxy that has no access to internal/SSRF-sensitive resources.
-* **Attacks that depend on guessing an `appInstanceID` or app UID.** These are random 128-bit secret values and are not considered guessable.
-* **Apps invoking drivers, creating workers, or using KV.** Applications are intended to do this; worker permissions are scoped to the owning app. This is by design.
-* **App metadata or app user-count "leaks".** This information is currently public by design.
-* **General "token in a URL" / token-lifetime designs** — signed directory URLs exposing children, a write signature implying read, or app tokens outliving a web session. These are current intended behaviors.
-* **Missing PKCE, unverified `id_token` signatures, or other OIDC hardening.** Provider tokens are obtained through a server-to-server authorization-code exchange with the provider's token endpoint over TLS, so the resulting `id_token` / userinfo claims are trusted from that channel rather than from local JWKS signature verification — the callback never accepts a caller-supplied `id_token`. Adding local signature / `aud` / `iss` / `exp` checks is welcome defense-in-depth (please open a GitHub issue/PR), but their absence is not an account-takeover vector on its own.
-* **JWT "algorithm confusion" / unpinned `algorithms` in `jwt.verify`.** Puter's session tokens are HMAC-signed (HS256) with a server-side secret, and there is no asymmetric public key anywhere in the verification path, so `alg`-substitution attacks do not apply. Explicitly pinning `algorithms` is a fine hardening PR, but it is not a vulnerability.
-* **Static-source "SQL injection" in internal pagination.** Findings such as `LIMIT ${limit}` in list/notification queries: the limit is numerically coerced and clamped before it reaches the query, so it is not reachable with attacker-controlled string input. Hardening PRs to the internal stores are welcome, but these are not exploitable as reported.
-* **Deprecated `saveTo*` GUI app messages.** The legacy `saveToDesktop` / `saveToDocuments` / etc. app-IPC handlers can create — never overwrite — new files in standard user folders. The behavior is non-destructive, path-traversal-safe, and deprecated (slated for removal); it is not treated as a sandbox escape.
-* **Best-practice suggestions** such as login/registration username enumeration (kept intentionally for UX) or unauthenticated unsubscribe links (industry norm).
-* **Rate-limiting suggestions for TURN credential issuance** (intentional; not billed per tunnel).
+- **XSS / CORS / token issues scoped to `api.puter.com`.** The primary user session cookie lives on `puter.com`, not on the API origin, so reflected/stored XSS, CORS, or token handling on `api.puter.com` is generally out of scope. Two exceptions we _do_ evaluate on their merits — please report these: (a) attacker-controlled content served **inline** (e.g. an HTML `Content-Type`) from API file/response endpoints, and (b) anything that abuses the app-scoped `puter_token_v2` companion cookie set on the API host.
+- **SSRF via `secureFetch`.** Production routes outbound requests through an isolated proxy that has no access to internal/SSRF-sensitive resources.
+- **Attacks that depend on guessing an `appInstanceID` or app UID.** These are random 128-bit secret values and are not considered guessable.
+- **Apps invoking drivers, creating workers, or using KV.** Applications are intended to do this; worker permissions are scoped to the owning app. This is by design.
+- **App metadata or app user-count "leaks".** This information is currently public by design.
+- **General "token in a URL" / token-lifetime designs** — signed directory URLs exposing children, a write signature implying read, or app tokens outliving a web session. These are current intended behaviors.
+- **Missing PKCE, unverified `id_token` signatures, or other OIDC hardening.** Provider tokens are obtained through a server-to-server authorization-code exchange with the provider's token endpoint over TLS, so the resulting `id_token` / userinfo claims are trusted from that channel rather than from local JWKS signature verification — the callback never accepts a caller-supplied `id_token`. Adding local signature / `aud` / `iss` / `exp` checks is welcome defense-in-depth (please open a GitHub issue/PR), but their absence is not an account-takeover vector on its own.
+- **JWT "algorithm confusion" / unpinned `algorithms` in `jwt.verify`.** Puter's session tokens are HMAC-signed (HS256) with a server-side secret, and there is no asymmetric public key anywhere in the verification path, so `alg`-substitution attacks do not apply. Explicitly pinning `algorithms` is a fine hardening PR, but it is not a vulnerability.
+- **Static-source "SQL injection" in internal pagination.** Findings such as `LIMIT ${limit}` in list/notification queries: the limit is numerically coerced and clamped before it reaches the query, so it is not reachable with attacker-controlled string input. Hardening PRs to the internal stores are welcome, but these are not exploitable as reported.
+- **Deprecated `saveTo*` GUI app messages.** The legacy `saveToDesktop` / `saveToDocuments` / etc. app-IPC handlers can create — never overwrite — new files in standard user folders. The behavior is non-destructive, path-traversal-safe, and deprecated (slated for removal); it is not treated as a sandbox escape.
+- **Best-practice suggestions** such as login/registration username enumeration (kept intentionally for UX) or unauthenticated unsubscribe links (industry norm).
+- **Rate-limiting suggestions for TURN credential issuance** (intentional; not billed per tunnel).
 
 If you believe you have a **genuinely new** exploit chain that defeats one of these rationales (for example, demonstrating a sensitive credential that really is reachable on `api.puter.com`), say so explicitly and show why the reasoning above does not apply.
 
@@ -40,7 +40,7 @@ If you believe you have a **genuinely new** exploit chain that defeats one of th
 
 To participate, you must:
 
-1. **Report responsibly**: Provide detailed steps to reproduce the issue, including proof-of-concept code, screenshots, or a screen recording (see *Proof of Reproduction* below).
+1. **Report responsibly**: Provide detailed steps to reproduce the issue, including proof-of-concept code, screenshots, or a screen recording (see _Proof of Reproduction_ below).
 2. **Do no harm**: Do not exfiltrate, modify, or delete data. Only access your own account or test data.
 3. **Respect availability**: Do not perform denial-of-service attacks or automated scans that degrade service.
 4. **Follow disclosure policy**: Do not publicly disclose vulnerabilities until we have confirmed and patched the issue.
@@ -51,26 +51,30 @@ Reports that do not meet these guidelines may not be eligible for a reward.
 
 ## Proof of Reproduction
 
-Reports must demonstrate a **working, reproducible exploit with real impact** — not a theoretical or static-source-review finding. Please include:
+Reports **MUST** demonstrate a **working, reproducible exploit with real impact** — not a theoretical or static-source-review finding. Please include:
 
-* Exact steps to reproduce, the relevant request/response or code path, and the commit or version you tested.
-* The **observed** result versus the **expected** result.
-* For client-side, UI, or authentication-flow bugs: a short screen recording (≤ 2 minutes) showing the exploit working end-to-end on a real Puter instance.
-* For server-side bugs: a runnable proof-of-concept.
+- Exact steps to reproduce, the relevant request/response or code path, and the commit or version you tested.
+- The **observed** result versus the **expected** result.
+- For client-side, UI, or authentication-flow bugs: a short screen recording (≤ 2 minutes) showing the exploit working end-to-end on a real Puter instance.
+- For server-side bugs: a runnable proof-of-concept and screenshot or video showing the attack process.
 
-Reports based solely on reading the source ("source review only, not tested") or unverified AI/LLM-generated reports are the **lowest triage priority and are generally not eligible**. If you used an AI tool to help find an issue, you must personally verify that it actually reproduces before submitting.
+Reports based solely on reading the source ("source review only, not tested") or unverified AI/LLM-generated reports are the **lowest triage priority and not eligible for bounty**.
+If you used an AI tool to help find an issue, you must personally verify that it actually reproduces before submitting.
 
-Please submit **one issue per report**. Bundled "audit packs" of many speculative findings will be declined; send each confirmed issue separately.
+Please submit **one issue per report**.
+Bundled "audit packs" of many speculative findings will not be elligible for bounty; send each confirmed issue separately.
+Additionally please **DO NOT** submit too many issues at once; these will be treated as a bundled report, and will not be elligible for bounty.
 
 ## Reporting Process
 
 To report a vulnerability, email us at: **[[email protected]](mailto:[email protected])**.
 Include:
 
-* A description of the vulnerability
-* Steps to reproduce
-* Potential impact
-* Suggested remediation (if available)
+- A description of the vulnerability
+- Steps to reproduce
+- Potential impact
+- Suggested remediation (if available)
+- Paypal id where we can send the bounty (if eligible)
 
 We aim to acknowledge receipt within **72 hours** and provide a resolution timeline.
 
@@ -78,10 +82,10 @@ We aim to acknowledge receipt within **72 hours** and provide a resolution timel
 
 We offer monetary rewards based on the severity of the vulnerability, as determined by our internal assessment (using CVSS as a guide).
 
-* **Critical: \$1,000 – \$2,000**
-* **High: \$500 – \$1,000**
-* **Medium: \$200 – \$500**
-* **Low: \$50 – \$100**
+- **Critical: \$1,000 – \$2,000**
+- **High: \$500 – \$1,000**
+- **Medium: \$200 – \$500**
+- **Low: \$50 – \$100**
 
 Non-security issues, suggestions, and best practices feedback are always welcome, but may not qualify for a reward.
 If multiple researchers report the same issue, the bounty will be awarded to the first eligible report we receive.

extensions/whoami.test.ts

@@ -206,6 +206,84 @@ describe('whoami extension — handleWhoami', () => {
         expect(JSON.stringify(body)).not.toContain('bootstrap-secret');
     });
 
+    it('never exposes phone, card fingerprint or signup identity', async () => {
+        const user = await seedUser();
+        await server.stores.user.update(user.id as number, {
+            phone: '+15551234567',
+            card_fingerprint: 'fp_ABC123',
+            requires_phone_verification: false,
+            requires_card_verification: false,
+        });
+        // Guard against a vacuous assertion below: the columns really do hold
+        // the values we then expect never to see on the wire.
+        const stored = await server.stores.user.getById(user.id as number, {
+            cached: false,
+            force: true,
+        });
+        expect(stored?.phone).toBe('+15551234567');
+        expect(stored?.card_fingerprint).toBe('fp_ABC123');
+
+        for (const actor of [
+            { user: { uuid: user.uuid, id: user.id as number } },
+            {
+                user: { uuid: user.uuid, id: user.id as number },
+                app: { uid: 'app-test-actor' },
+            },
+        ]) {
+            const { res, captured } = makeRes();
+            await runWithContext({ actor }, () =>
+                handleWhoami(makeReq(), res),
+            );
+
+            const body = captured.body as Record<string, unknown>;
+            expect(body.phone).toBeUndefined();
+            expect(body.card_fingerprint).toBeUndefined();
+            expect(body.password).toBeUndefined();
+            expect(body.otp_secret).toBeUndefined();
+            expect(body.signup_ip).toBeUndefined();
+            // Not just absent as a key — the values must not appear anywhere
+            // in the payload (nested under metadata, taskbar items, …).
+            const serialized = JSON.stringify(body);
+            expect(serialized).not.toContain('5551234567');
+            expect(serialized).not.toContain('fp_ABC123');
+            // The verification flags, which the GUI acts on, still ship.
+            expect(body).toHaveProperty('requires_phone_verification');
+            expect(body).toHaveProperty('requires_card_verification');
+        }
+    });
+
+    it('scrubs sensitive keys added to metadata, and leaves the cached row intact', async () => {
+        const user = await seedUser();
+        await server.stores.user.updateMetadata(user.id as number, {
+            tmp_password: 'bootstrap-secret',
+            billing: { card_fingerprint: 'fp_NESTED', tier: 'pro' },
+        });
+
+        const { res, captured } = makeRes();
+        await runWithContext(
+            { actor: { user: { uuid: user.uuid, id: user.id as number } } },
+            () => handleWhoami(makeReq(), res),
+        );
+
+        const body = captured.body as Record<string, unknown>;
+        const metadata = body.metadata as Record<string, unknown>;
+        expect(metadata.tmp_password).toBeUndefined();
+        // Nested sensitive keys are removed too; siblings survive.
+        expect(metadata.billing).toEqual({ tier: 'pro' });
+        expect(JSON.stringify(body)).not.toContain('fp_NESTED');
+
+        // The scrub works on a copy — server-side state is untouched.
+        const fresh = await server.stores.user.getById(user.id as number, {
+            cached: false,
+            force: true,
+        });
+        expect(fresh?.metadata?.tmp_password).toBe('bootstrap-secret');
+        expect(
+            (fresh?.metadata?.billing as Record<string, unknown>)
+                ?.card_fingerprint,
+        ).toBe('fp_NESTED');
+    });
+
     it('marks the user as oidc_only when password is null', async () => {
         const slug = Math.random().toString(36).slice(2, 8);
         const oidcUser = await server.stores.user.create({

extensions/whoami.ts

@@ -33,6 +33,68 @@ const CLIENT_VISIBLE_FEATURE_FLAGS: ReadonlySet<string> = new Set([
     'prompt_user_when_navigation_away_from_puter',
 ]);
 
+// Keys that must never leave the server, whoever put them on the response.
+// `details` is an explicit pick, but the `whoami.details` event hands
+// listeners the full UserRow next to the object they may write to, and
+// `metadata` is a free-form blob — so any of these can arrive on the
+// response without an edit to the pick above. The scrub runs last, over the
+// whole payload, and is the one place that decides what "sensitive" means.
+//
+// Credentials and single-use tokens, the payment/phone identifiers used for
+// verification (`card_fingerprint` is the Stripe fingerprint, stable per
+// card number), the network identity recorded at signup, and internal
+// anti-abuse bookkeeping. `requires_phone_verification` /
+// `requires_card_verification` stay: they are the flags the GUI acts on, and
+// they carry no identifier.
+const SENSITIVE_KEYS: ReadonlySet<string> = new Set([
+    'password',
+    'tmp_password',
+    'pass_recovery_token',
+    'email_confirm_code',
+    'email_confirm_token',
+    'change_email_confirm_token',
+    'otp_secret',
+    'otp_recovery_codes',
+    'card_fingerprint',
+    'phone',
+    'clean_email',
+    'signup_ip',
+    'signup_ip_forwarded',
+    'signup_user_agent',
+    'signup_origin',
+    'signup_server',
+    'audit_metadata',
+]);
+
+// Depth-limited, cycle-safe walk deleting every SENSITIVE_KEYS entry it finds
+// at any level (`metadata` and `taskbar_items` are both nested structures).
+const scrubSensitive = (
+    value: unknown,
+    seen: Set<object> = new Set(),
+    depth = 0,
+): void => {
+    if (depth > 8 || value === null || typeof value !== 'object') return;
+    if (seen.has(value as object)) return;
+    seen.add(value as object);
+
+    if (Array.isArray(value)) {
+        for (const entry of value) scrubSensitive(entry, seen, depth + 1);
+        return;
+    }
+
+    for (const key of Object.keys(value as Record<string, unknown>)) {
+        if (SENSITIVE_KEYS.has(key)) {
+            delete (value as Record<string, unknown>)[key];
+            continue;
+        }
+        scrubSensitive(
+            (value as Record<string, unknown>)[key],
+            seen,
+            depth + 1,
+        );
+    }
+};
+
 export const handleWhoami = async (
     req: Request,
     res: Response,
@@ -74,8 +136,12 @@ export const handleWhoami = async (
         }
     }
 
-    const metadata = user.metadata ? { ...user.metadata } : user.metadata;
-    if (metadata) delete metadata.tmp_password;
+    // Deep-copied (it is decoded JSON) so the scrub below edits the response
+    // and not the cached UserRow. Sensitive keys inside it — tmp_password and
+    // anything else on the denylist — are removed by scrubSensitive.
+    const metadata = user.metadata
+        ? structuredClone(user.metadata)
+        : user.metadata;
 
     const details: Record<string, unknown> = {
         username: user.username,
@@ -84,7 +150,9 @@ export const handleWhoami = async (
         unconfirmed_email: user.email,
         email_confirmed: user.email_confirmed || user.username === 'admin',
         requires_email_confirmation: user.requires_email_confirmation,
-        phone: user.phone,
+        // The phone number itself is deliberately absent: nothing on the
+        // client reads it, and it is PII that would otherwise be handed to
+        // every app actor. Only the verification flag ships.
         requires_phone_verification: user.requires_phone_verification,
         requires_card_verification: user.requires_card_verification,
         desktop_bg_url: user.desktop_bg_url,
@@ -196,6 +264,9 @@ export const handleWhoami = async (
         delete subscription.offering.price_id;
     }
 
+    // Last word on what ships, after every listener has had its say.
+    scrubSensitive(details);
+
     res.json(details);
 };
 

src/backend/clients/database/SqliteDatabaseClient.test.ts

@@ -27,7 +27,7 @@ import { DatabaseClientFactory } from './index.js';
 import { SqliteDatabaseClient } from './SqliteDatabaseClient.js';
 
 /** Highest schema version the migration table can reach. */
-const CURRENT_SCHEMA_VERSION = 60;
+const CURRENT_SCHEMA_VERSION = 61;
 const SYSTEM_USER_UUID = '5d4adce0-a381-4982-9c02-6e2540026238';
 
 const sqliteConfig = (

src/backend/clients/database/SqliteDatabaseClient.ts

@@ -94,6 +94,7 @@ const AVAILABLE_MIGRATIONS: [number, string[]][] = [
     [57, ['0062_blocked-app-origins.sql']],
     [58, ['0063_add_suspended_reason.sql']],
     [59, ['0064_abuse-moderation-events.sql']],
+    [60, ['0065_app-feedback.sql']],
 ];
 
 export class SqliteDatabaseClient extends AbstractDatabaseClient {

src/backend/clients/database/migrations/mysql/mysql_mig_20.sql

@@ -0,0 +1,48 @@
+-- Copyright (C) 2024-present Puter Technologies Inc.
+--
+-- This file is part of Puter.
+--
+-- Puter is free software: you can redistribute it and/or modify
+-- it under the terms of the GNU Affero General Public License as published
+-- by the Free Software Foundation, either version 3 of the License, or
+-- (at your option) any later version.
+--
+-- This program is distributed in the hope that it will be useful,
+-- but WITHOUT ANY WARRANTY; without even the implied warranty of
+-- MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+-- GNU Affero General Public License for more details.
+--
+-- You should have received a copy of the GNU Affero General Public License
+-- along with this program.  If not, see <https://www.gnu.org/licenses/>.
+
+-- User-to-developer feedback for apps that opt in. Mirrors SQLite migration
+-- 0065. Opt-in is the new `apps.feedback_enabled` column (developer-writable
+-- through the regular `puter.apps.update` path). Each row of `app_feedback`
+-- is one message a signed-in user submitted through the GUI feedback dialog;
+-- a copy is emailed to the app owner unless the per-app daily email cap
+-- suppressed it (`email_sent` records which). `app_uid` is denormalized
+-- alongside `app_id` so rows stay attributable after an app is deleted.
+-- `created_at` is unix seconds.
+--
+-- Idempotent: the column add uses _puter_add_col (defined in mig_1, which
+-- always runs first) and the table uses `CREATE TABLE IF NOT EXISTS`, so the
+-- directory can replay safely.
+
+CALL _puter_add_col('apps', 'feedback_enabled', '`feedback_enabled` tinyint(1) DEFAULT ''0''');
+
+CREATE TABLE IF NOT EXISTS `app_feedback` (
+    `id` INT NOT NULL AUTO_INCREMENT,
+    `uid` CHAR(36) NOT NULL,
+    `app_id` INT NOT NULL,
+    `app_uid` CHAR(40) NOT NULL,
+    `user_id` INT NOT NULL,
+    `message` TEXT NOT NULL,
+    `source_env` VARCHAR(16) DEFAULT NULL,
+    `source_origin` VARCHAR(2048) DEFAULT NULL,
+    `email_sent` TINYINT(1) NOT NULL DEFAULT 0,
+    `created_at` BIGINT NOT NULL,
+    PRIMARY KEY (`id`),
+    UNIQUE KEY `uq_app_feedback_uid` (`uid`),
+    KEY `idx_app_feedback_app_created` (`app_id`, `created_at`),
+    KEY `idx_app_feedback_user_created` (`user_id`, `created_at`)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;

src/backend/clients/database/migrations/postgres/postgres_mig_9.sql

@@ -0,0 +1,47 @@
+-- Copyright (C) 2024-present Puter Technologies Inc.
+--
+-- This file is part of Puter.
+--
+-- Puter is free software: you can redistribute it and/or modify
+-- it under the terms of the GNU Affero General Public License as published
+-- by the Free Software Foundation, either version 3 of the License, or
+-- (at your option) any later version.
+--
+-- This program is distributed in the hope that it will be useful,
+-- but WITHOUT ANY WARRANTY; without even the implied warranty of
+-- MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+-- GNU Affero General Public License for more details.
+--
+-- You should have received a copy of the GNU Affero General Public License
+-- along with this program.  If not, see <https://www.gnu.org/licenses/>.
+
+-- User-to-developer feedback for apps that opt in. Mirrors SQLite migration
+-- 0065 / MySQL mysql_mig_20. Opt-in is the new `apps.feedback_enabled` column
+-- (developer-writable through the regular `puter.apps.update` path). Each row
+-- of `app_feedback` is one message a signed-in user submitted through the GUI
+-- feedback dialog; a copy is emailed to the app owner unless the per-app
+-- daily email cap suppressed it (`email_sent` records which). `app_uid` is
+-- denormalized alongside `app_id` so rows stay attributable after an app is
+-- deleted. `created_at` is unix seconds.
+--
+-- Idempotent via IF NOT EXISTS.
+
+ALTER TABLE apps ADD COLUMN IF NOT EXISTS feedback_enabled boolean NOT NULL DEFAULT FALSE;
+
+CREATE TABLE IF NOT EXISTS app_feedback (
+    id BIGSERIAL PRIMARY KEY,
+    uid CHAR(36) NOT NULL UNIQUE,
+    app_id BIGINT NOT NULL,
+    app_uid VARCHAR(40) NOT NULL,
+    user_id BIGINT NOT NULL,
+    message TEXT NOT NULL,
+    source_env VARCHAR(16) DEFAULT NULL,
+    source_origin VARCHAR(2048) DEFAULT NULL,
+    email_sent BOOLEAN NOT NULL DEFAULT FALSE,
+    created_at BIGINT NOT NULL
+);
+
+CREATE INDEX IF NOT EXISTS idx_app_feedback_app_created
+    ON app_feedback (app_id, created_at);
+CREATE INDEX IF NOT EXISTS idx_app_feedback_user_created
+    ON app_feedback (user_id, created_at);

src/backend/clients/database/migrations/sqlite/0065_app-feedback.sql

@@ -0,0 +1,51 @@
+-- Copyright (C) 2024-present Puter Technologies Inc.
+--
+-- This file is part of Puter.
+--
+-- Puter is free software: you can redistribute it and/or modify
+-- it under the terms of the GNU Affero General Public License as published
+-- by the Free Software Foundation, either version 3 of the License, or
+-- (at your option) any later version.
+--
+-- This program is distributed in the hope that it will be useful,
+-- but WITHOUT ANY WARRANTY; without even the implied warranty of
+-- MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+-- GNU Affero General Public License for more details.
+--
+-- You should have received a copy of the GNU Affero General Public License
+-- along with this program.  If not, see <https://www.gnu.org/licenses/>.
+
+-- User-to-developer feedback for apps that opt in. Opt-in is the new
+-- `apps.feedback_enabled` column (developer-writable through the regular
+-- `puter.apps.update` path; a dedicated column rather than a `metadata` key
+-- because Dev Center saves replace the whole metadata blob and would erase
+-- it). Each row of `app_feedback` is one message a signed-in user submitted
+-- through the GUI feedback dialog; a copy is emailed to the app owner unless
+-- the per-app daily email cap suppressed it (`email_sent` records which).
+-- `app_uid` is denormalized alongside `app_id` so rows stay attributable
+-- after an app is deleted (abuse forensics). `source_env` is 'app' (desktop
+-- dialog) or 'web' (puter.com popup opened from an external site);
+-- `source_origin` is the popup opener's browser-attested origin, null for
+-- desktop submissions. `created_at` is unix seconds. The (user_id,
+-- created_at) and (app_id, created_at) indexes serve the sliding-window
+-- rate-limit counts in AppFeedbackStore.
+
+ALTER TABLE apps ADD COLUMN "feedback_enabled" tinyint(1) DEFAULT '0';
+
+CREATE TABLE IF NOT EXISTS `app_feedback` (
+    "id" INTEGER PRIMARY KEY AUTOINCREMENT,
+    "uid" TEXT NOT NULL UNIQUE,
+    "app_id" INTEGER NOT NULL,
+    "app_uid" TEXT NOT NULL,
+    "user_id" INTEGER NOT NULL,
+    "message" TEXT NOT NULL,
+    "source_env" TEXT DEFAULT NULL,     -- 'app' | 'web'
+    "source_origin" TEXT DEFAULT NULL,  -- attested opener origin (web popups)
+    "email_sent" INTEGER NOT NULL DEFAULT 0,
+    "created_at" INTEGER NOT NULL       -- unix seconds
+);
+
+CREATE INDEX IF NOT EXISTS idx_app_feedback_app_created
+    ON `app_feedback` (`app_id`, `created_at`);
+CREATE INDEX IF NOT EXISTS idx_app_feedback_user_created
+    ON `app_feedback` (`user_id`, `created_at`);

src/backend/clients/email/EmailClient.test.ts

@@ -179,6 +179,29 @@ describe('EmailClient — template rendering', () => {
         expect(captured.html).toContain('<strong>424242</strong>');
     });
 
+    it('does not HTML-escape values in the plain-text subject header', async () => {
+        const client = startClient();
+        const captured: { subject?: string } = {};
+        vi.spyOn(client, 'sendRaw').mockImplementation(async (options) => {
+            captured.subject = options.subject;
+            return null;
+        });
+
+        await client.send('[email protected]', 'app-user-feedback', {
+            owner_username: 'dev',
+            sender_username: 'user',
+            sender_email: null,
+            app_title: "Bob's App & Games",
+            app_name: 'bobs-app',
+            app_link: 'https://puter.example/app/bobs-app',
+            message: 'hi',
+        });
+
+        // A subject is not HTML — entities would render literally in the
+        // recipient's mail client.
+        expect(captured.subject).toBe("New user feedback for Bob's App & Games");
+    });
+
     it('escapes html and converts newlines in nl2br values', async () => {
         const client = startClient();
         let html = '';

src/backend/clients/email/EmailClient.ts

@@ -152,11 +152,16 @@ export class EmailClient extends PuterClient {
 
     // -- Public API: sending ------------------------------------------
 
-    /** Render a template and send it to `to`. */
+    /**
+     * Render a template and send it to `to`. `options.replyTo` sets the
+     * Reply-To header (e.g. so a recipient can respond to the originator of the
+     * message rather than the no-reply From address).
+     */
     async send<T extends EmailTemplateName>(
         to: string,
         template: T,
         values: Record<string, unknown> = {},
+        options: { replyTo?: string } = {},
     ): Promise<void> {
         const compiled = this.compiledTemplates[template];
         if (!compiled) {
@@ -168,6 +173,7 @@ export class EmailClient extends PuterClient {
             to,
             subject: compiled.subject(values),
             html: compiled.html(values),
+            ...(options.replyTo ? { replyTo: options.replyTo } : {}),
         });
     }
 
@@ -285,7 +291,14 @@ export class EmailClient extends PuterClient {
     private compileTemplates(): void {
         for (const [name, template] of Object.entries(EMAIL_TEMPLATES)) {
             this.compiledTemplates[name as EmailTemplateName] = {
-                subject: handlebars.compile(template.subject),
+                // Subjects are plain-text headers: HTML-escaping would put
+                // literal entities in front of the recipient (&amp; etc.).
+                // Header safety is handled elsewhere — the transport encodes
+                // newlines, and free-form values (e.g. app_title) collapse
+                // whitespace upstream.
+                subject: handlebars.compile(template.subject, {
+                    noEscape: true,
+                }),
                 html: handlebars.compile(dedent(template.html)),
             };
         }

src/backend/clients/email/templates.ts

@@ -75,6 +75,25 @@ Please update <a href="https://puter.com/app/{{app_name}}">{{app_title}}</a>.
 <blockquote>{{nl2br message}}</blockquote>
 <p>Best,<br />
 The Puter Team
+</p>
+        `,
+    },
+    'app-user-feedback': {
+        subject: 'New user feedback for {{app_title}}',
+        html: `
+<p>Hi{{#if owner_username}} {{owner_username}}{{/if}},</p>
+<p>
+<strong>{{sender_username}}</strong>{{#if sender_email}} (<a href="mailto:{{sender_email}}">{{sender_email}}</a>){{/if}} sent feedback about <a href="{{app_link}}">{{app_title}}</a>:
+</p>
+<blockquote>{{{nl2br message}}}</blockquote>
+{{#if sender_email}}<p>Just reply to this email to respond to them directly.</p>{{/if}}
+<p>
+You're receiving this because feedback is enabled for
+<a href="{{app_link}}">{{app_title}}</a> — manage it in the
+<a href="{{dev_center_link}}">Dev Center</a> under your app's settings.
+</p>
+<p>Best,<br />
+The Puter Team
 </p>
         `,
     },

src/backend/clients/event/types.ts

@@ -540,11 +540,10 @@ export type EventKey = keyof EventMap & string;
 // Generates a wildcard for every non-final dot-separated prefix of K.
 export type WildcardPrefixes<K extends string> =
     K extends `${infer Head}.${infer Tail}`
-        ?
-              | `${Head}.*`
-              | (Tail extends `${string}.${string}`
-                    ? `${Head}.${WildcardPrefixes<Tail>}`
-                    : never)
+        ? | `${Head}.*`
+          | (Tail extends `${string}.${string}`
+                ? `${Head}.${WildcardPrefixes<Tail>}`
+                : never)
         : never;
 
 export type ListenKey = EventKey | WildcardPrefixes<EventKey>;

src/backend/controllers/auth/AuthController.ts

@@ -1101,8 +1101,7 @@ export class AuthController extends PuterController {
                     is_temp: user!.password === null && user!.email === null,
                     ip:
                         (req?.headers?.['x-forwarded-for'] as
-                            | string
-                            | undefined) ||
+                            string | undefined) ||
                         (
                             req as unknown as {
                                 connection?: { remoteAddress?: string };

src/backend/controllers/drivers/DriverController.test.ts

@@ -212,6 +212,30 @@ const makeRes = (): MockRes => {
     return res;
 };
 
+/**
+ * Run the call route and return the rejection, or null when it resolves.
+ * Lets a test assert on *which* gate rejected without depending on how far
+ * an admitted call gets afterwards.
+ */
+const callForError = async (
+    routes: Captured,
+    req: Request,
+    actor: Actor,
+): Promise<{ statusCode?: number; legacyCode?: string } | null> => {
+    try {
+        await runWithContext({ actor }, () =>
+            routes['POST /call'](
+                req,
+                makeRes() as unknown as Response,
+                () => {},
+            ),
+        );
+        return null;
+    } catch (e) {
+        return e as { statusCode?: number; legacyCode?: string };
+    }
+};
+
 const makeReq = (body: Record<string, unknown> = {}, actor?: Actor): Request =>
     ({
         body,
@@ -338,8 +362,7 @@ describe('DriverController.#handleCall (via captured router)', () => {
     it('admits a bare session ("root" token) actor on the AI drivers', async () => {
         // Privileged ("godmode") apps call AI with the user's own session
         // token, so the AI drivers no longer set `noUserSession`: the
-        // session actor reaches the permission scan (403 forbidden — no
-        // perms granted) instead of the credential-shape rejection.
+        // session actor must get past the credential-shape gate.
         const actor = await makeUserActor();
         const req = makeReq(
             {
@@ -349,18 +372,8 @@ describe('DriverController.#handleCall (via captured router)', () => {
             },
             actor,
         );
-        await expect(
-            runWithContext({ actor }, () =>
-                routes['POST /call'](
-                    req,
-                    makeRes() as unknown as Response,
-                    () => {},
-                ),
-            ),
-        ).rejects.toMatchObject({
-            statusCode: 403,
-            legacyCode: 'forbidden',
-        });
+        const err = await callForError(routes, req, actor);
+        expect(err?.legacyCode).not.toBe('app_or_api_token_required');
     });
 
     it('admits app and access-token actors on the AI drivers (they fail later on permission, not credential shape)', async () => {
@@ -385,29 +398,15 @@ describe('DriverController.#handleCall (via captured router)', () => {
                 },
                 actor,
             );
-            await expect(
-                runWithContext({ actor }, () =>
-                    routes['POST /call'](
-                        req,
-                        makeRes() as unknown as Response,
-                        () => {},
-                    ),
-                ),
-            ).rejects.toMatchObject({
-                statusCode: 403,
-                // Fresh actors hold no service:* perms, so the call still
-                // 403s — but at the permission scan, proving the
-                // credential-shape gate let the delegated actor through.
-                legacyCode: 'forbidden',
-            });
+            const err = await callForError(routes, req, actor);
+            expect(err?.legacyCode).not.toBe('app_or_api_token_required');
         }
     });
 
     it('admits a user-scoped worker session on the AI drivers', async () => {
         // Workers deployed without an app binding authenticate as a user
         // actor whose session row is kind='worker' — they must keep their
-        // AI access (they fail later on permission here, not on
-        // credential shape).
+        // AI access rather than be rejected for their credential shape.
         const base = await makeUserActor();
         const actor: Actor = {
             ...base,
@@ -421,24 +420,13 @@ describe('DriverController.#handleCall (via captured router)', () => {
             },
             actor,
         );
-        await expect(
-            runWithContext({ actor }, () =>
-                routes['POST /call'](
-                    req,
-                    makeRes() as unknown as Response,
-                    () => {},
-                ),
-            ),
-        ).rejects.toMatchObject({
-            statusCode: 403,
-            legacyCode: 'forbidden',
-        });
+        const err = await callForError(routes, req, actor);
+        expect(err?.legacyCode).not.toBe('app_or_api_token_required');
     });
 
     it('still allows bare session actors on drivers without the noUserSession flag', async () => {
-        // puter-kvstore doesn't set the flag; the session actor reaches
-        // the permission scan (403 forbidden — no perms granted) instead
-        // of being rejected for its credential shape.
+        // puter-kvstore doesn't set the flag, so the session actor must get
+        // past the credential-shape gate.
         const actor = await makeUserActor();
         const req = makeReq(
             {
@@ -448,24 +436,24 @@ describe('DriverController.#handleCall (via captured router)', () => {
             },
             actor,
         );
-        await expect(
-            runWithContext({ actor }, () =>
-                routes['POST /call'](
-                    req,
-                    makeRes() as unknown as Response,
-                    () => {},
-                ),
-            ),
-        ).rejects.toMatchObject({
-            statusCode: 403,
-            legacyCode: 'forbidden',
-        });
+        const err = await callForError(routes, req, actor);
+        expect(err?.legacyCode).not.toBe('app_or_api_token_required');
     });
 
     it('rejects with 403 when the actor lacks the service permission', async () => {
-        // A fresh user has no service:* perms → permission.check returns
-        // false → 403.
-        const actor = await makeUserActor();
+        // A scoped access token holds only the permissions written to its
+        // own row, so it is the actor shape that can still be denied — the
+        // `driver`/`service` grants every user inherits are resolved from
+        // the issuer only for full-access tokens.
+        const base = await makeUserActor();
+        const actor: Actor = {
+            ...base,
+            accessToken: {
+                uid: `tok-${uuidv4()}`,
+                issuer: base,
+                fullAccess: false,
+            },
+        };
         const req = makeReq(
             {
                 interface: 'puter-kvstore',
@@ -474,15 +462,8 @@ describe('DriverController.#handleCall (via captured router)', () => {
             },
             actor,
         );
-        await expect(
-            runWithContext({ actor }, () =>
-                routes['POST /call'](
-                    req,
-                    makeRes() as unknown as Response,
-                    () => {},
-                ),
-            ),
-        ).rejects.toMatchObject({ statusCode: 403 });
+        const err = await callForError(routes, req, actor);
+        expect(err).toMatchObject({ statusCode: 403 });
     });
 
     it('returns the wrapped {success, result, service} envelope on a successful call', async () => {

src/backend/controllers/drivers/DriverController.ts

@@ -297,8 +297,7 @@ export class DriverController extends PuterController {
 
         if (req.actor) {
             const permService = this.services.permission as unknown as
-                | PermissionService
-                | undefined;
+                PermissionService | undefined;
             if (permService) {
                 // Build via PermissionUtil.join so any `:` in a driver or
                 // interface name is escaped — raw interpolation would let a

src/backend/controllers/feedback/AppFeedbackController.test.ts

@@ -0,0 +1,594 @@
+/*
+ * Copyright (C) 2024-present Puter Technologies Inc.
+ *
+ * This file is part of Puter.
+ *
+ * Puter is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published
+ * by the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <https://www.gnu.org/licenses/>.
+ */
+
+import type { Request, RequestHandler, Response } from 'express';
+import {
+    afterAll,
+    afterEach,
+    beforeAll,
+    describe,
+    expect,
+    it,
+    vi,
+} from 'vitest';
+import { v4 as uuidv4 } from 'uuid';
+import type { Actor } from '../../core/actor.js';
+import { PuterRouter } from '../../core/http/PuterRouter.js';
+import { PuterServer } from '../../server.js';
+import { AppFeedbackService } from '../../services/feedback/AppFeedbackService.js';
+import { setupTestServer } from '../../testUtil.js';
+
+// Boots one real PuterServer (in-memory sqlite + mocked externals) and
+// registers AppFeedbackController's decorated routes onto a fresh
+// PuterRouter. Tests drive the captured handlers with stub req/res; the
+// stores/services underneath are the live wired ones, so rows land in the
+// real `app_feedback` table.
+
+let server: PuterServer;
+let router: PuterRouter;
+
+beforeAll(async () => {
+    server = await setupTestServer();
+    router = new PuterRouter();
+    server.controllers.appFeedback.registerRoutes(router);
+});
+
+afterAll(async () => {
+    await server?.shutdown();
+});
+
+afterEach(() => {
+    vi.restoreAllMocks();
+});
+
+const makeUser = async (): Promise<{ actor: Actor; userId: number }> => {
+    const username = `fdbk-${Math.random().toString(36).slice(2, 10)}`;
+    const created = await server.stores.user.create({
+        username,
+        uuid: uuidv4(),
+        password: null,
+        email: `${username}@test.local`,
+        free_storage: 100 * 1024 * 1024,
+        requires_email_confirmation: false,
+    });
+    const refreshed = (await server.stores.user.getById(created.id))!;
+    return {
+        userId: refreshed.id,
+        actor: {
+            user: {
+                id: refreshed.id,
+                uuid: refreshed.uuid,
+                username: refreshed.username,
+                email: refreshed.email ?? null,
+                email_confirmed: true,
+            } as Actor['user'],
+        },
+    };
+};
+
+const makeApp = async (
+    ownerUserId: number,
+    opts: { feedbackEnabled?: boolean; indexUrl?: string; name?: string } = {},
+) => {
+    const name =
+        opts.name ?? `fdbk-app-${Math.random().toString(36).slice(2, 10)}`;
+    return await server.stores.app.create(
+        {
+            name,
+            title: `Feedback Test ${name}`,
+            index_url: opts.indexUrl ?? `https://${name}.example.com`,
+            ...(opts.feedbackEnabled ? { feedback_enabled: 1 } : {}),
+        },
+        { ownerUserId },
+    );
+};
+
+// Feedback is only offered when the deployment can deliver it (email
+// transport configured); most tests want that baseline without asserting
+// anything about the mail itself.
+const mockEmailConfigured = () =>
+    vi.spyOn(server.clients.email, 'isConfigured', 'get').mockReturnValue(
+        true,
+    );
+
+const confirmOwnerEmail = async (userId: number) => {
+    await server.clients.db.write(
+        'UPDATE `user` SET `email_confirmed` = ? WHERE `id` = ?',
+        [server.clients.db.booleanValue(true), userId],
+    );
+    const user = await server.stores.user.getById(userId);
+    if (user) await server.stores.user.invalidate(user);
+};
+
+const makeReq = (init: {
+    body?: unknown;
+    actor?: Actor;
+    query?: Record<string, unknown>;
+}): Request => {
+    return {
+        body: init.body ?? {},
+        query: init.query ?? {},
+        headers: {},
+        actor: init.actor,
+    } as unknown as Request;
+};
+
+const makeRes = () => {
+    const captured: { statusCode: number; body: unknown } = {
+        statusCode: 200,
+        body: undefined,
+    };
+    const res = {
+        json: vi.fn((value: unknown) => {
+            captured.body = value;
+            return res;
+        }),
+        status: vi.fn((code: number) => {
+            captured.statusCode = code;
+            return res;
+        }),
+    };
+    return { res: res as unknown as Response, captured };
+};
+
+const findRoute = (method: string, path: string) => {
+    const route = router.routes.find(
+        (r) => r.method === method && r.path === path,
+    );
+    if (!route) throw new Error(`No ${method.toUpperCase()} ${path} route`);
+    return route;
+};
+
+const callRoute = async (
+    method: string,
+    path: string,
+    req: Request,
+    res: Response,
+) => {
+    const handler: RequestHandler = findRoute(method, path).handler;
+    await handler(req, res, () => {
+        throw new Error('handler called next() unexpectedly');
+    });
+};
+
+const submit = (actor: Actor, body: unknown) => {
+    const { res, captured } = makeRes();
+    return callRoute('post', '/', makeReq({ body, actor }), res).then(
+        () => captured,
+    );
+};
+
+// ── Route gates ─────────────────────────────────────────────────────
+
+describe('AppFeedbackController route options', () => {
+    it('rejects app actors and cross-origin pages on submit', () => {
+        const { options } = findRoute('post', '/');
+        // requireUserActor is what makes feedback impossible to submit
+        // programmatically with an app token; guiOriginOnly keeps
+        // cross-origin browser pages out even with a leaked user token.
+        expect(options.requireUserActor).toBe(true);
+        expect(options.guiOriginOnly).toBe(true);
+    });
+
+    it('stacks a per-user budget with a per-IP backstop', () => {
+        const { options } = findRoute('post', '/');
+        const limits = options.rateLimit;
+        expect(Array.isArray(limits)).toBe(true);
+        const keys = (limits as Array<{ key?: unknown }>).map((l) => l.key);
+        expect(keys).toContain('user');
+        expect(keys).toContain('ip');
+    });
+
+    it('requires a user actor on the target pre-flight too', () => {
+        const { options } = findRoute('get', '/target');
+        expect(options.requireUserActor).toBe(true);
+    });
+});
+
+// ── GET /app-feedback/target ────────────────────────────────────────
+
+describe('AppFeedbackController GET /target', () => {
+    it('throws 400 when neither or both of app/origin are given', async () => {
+        const { actor } = await makeUser();
+        for (const query of [
+            {},
+            { app: 'x', origin: 'https://x.example.com' },
+        ]) {
+            const { res } = makeRes();
+            await expect(
+                callRoute('get', '/target', makeReq({ query, actor }), res),
+            ).rejects.toMatchObject({ statusCode: 400 });
+        }
+    });
+
+    it('reports enabled:false for an unknown app', async () => {
+        const { actor } = await makeUser();
+        const { res, captured } = makeRes();
+        await callRoute(
+            'get',
+            '/target',
+            makeReq({ query: { app: 'no-such-app-xyz' }, actor }),
+            res,
+        );
+        expect(captured.body).toEqual({ enabled: false, app: null });
+    });
+
+    it('reports enabled:false for an app that has not opted in', async () => {
+        mockEmailConfigured();
+        const { userId: ownerId } = await makeUser();
+        const app = await makeApp(ownerId);
+        const { actor } = await makeUser();
+        const { res, captured } = makeRes();
+        await callRoute(
+            'get',
+            '/target',
+            makeReq({ query: { app: app.name }, actor }),
+            res,
+        );
+        expect(captured.body).toMatchObject({ enabled: false });
+    });
+
+    it('reports enabled:true with canonical title/name for an opted-in app', async () => {
+        mockEmailConfigured();
+        const { userId: ownerId } = await makeUser();
+        const app = await makeApp(ownerId, { feedbackEnabled: true });
+        const { actor } = await makeUser();
+        const { res, captured } = makeRes();
+        await callRoute(
+            'get',
+            '/target',
+            makeReq({ query: { app: app.uid }, actor }),
+            res,
+        );
+        expect(captured.body).toEqual({
+            enabled: true,
+            app: { name: app.name, title: app.title },
+        });
+    });
+
+    it('resolves an opted-in app whose name starts with "app-"', async () => {
+        mockEmailConfigured();
+        const { userId: ownerId } = await makeUser();
+        const name = `app-fdbk-${Math.random().toString(36).slice(2, 10)}`;
+        const app = await makeApp(ownerId, { feedbackEnabled: true, name });
+        const { actor } = await makeUser();
+        const { res, captured } = makeRes();
+        await callRoute(
+            'get',
+            '/target',
+            makeReq({ query: { app: name }, actor }),
+            res,
+        );
+        expect(captured.body).toEqual({
+            enabled: true,
+            app: { name: app.name, title: app.title },
+        });
+    });
+
+    it('resolves an origin to the app whose index_url it matches', async () => {
+        mockEmailConfigured();
+        const { userId: ownerId } = await makeUser();
+        const app = await makeApp(ownerId, { feedbackEnabled: true });
+        const origin = new URL(app.index_url).origin;
+        const { actor } = await makeUser();
+        const { res, captured } = makeRes();
+        await callRoute(
+            'get',
+            '/target',
+            makeReq({ query: { origin }, actor }),
+            res,
+        );
+        expect(captured.body).toEqual({
+            enabled: true,
+            app: { name: app.name, title: app.title },
+        });
+    });
+
+    it('reports enabled:false when the email transport is unconfigured', async () => {
+        // No mockEmailConfigured(): this is the self-hosted no-SMTP default.
+        // Feedback that can never be delivered must not be solicited.
+        const { userId: ownerId } = await makeUser();
+        const app = await makeApp(ownerId, { feedbackEnabled: true });
+        const { actor } = await makeUser();
+        const { res, captured } = makeRes();
+        await callRoute(
+            'get',
+            '/target',
+            makeReq({ query: { app: app.name }, actor }),
+            res,
+        );
+        expect(captured.body).toMatchObject({ enabled: false });
+    });
+
+    it('reports enabled:false for an origin with no registered app', async () => {
+        const { actor } = await makeUser();
+        const { res, captured } = makeRes();
+        await callRoute(
+            'get',
+            '/target',
+            makeReq({
+                query: { origin: 'https://nobody-registered.example.com' },
+                actor,
+            }),
+            res,
+        );
+        expect(captured.body).toEqual({ enabled: false, app: null });
+    });
+});
+
+// ── POST /app-feedback ──────────────────────────────────────────────
+
+describe('AppFeedbackController POST /', () => {
+    it('throws 400 when message is missing or not a string', async () => {
+        const { userId: ownerId } = await makeUser();
+        const app = await makeApp(ownerId, { feedbackEnabled: true });
+        const { actor } = await makeUser();
+        for (const message of [undefined, 12345, '']) {
+            await expect(
+                submit(actor, { app: app.name, message }),
+            ).rejects.toMatchObject({ statusCode: 400 });
+        }
+    });
+
+    it('throws 400 when both app and origin are given', async () => {
+        const { actor } = await makeUser();
+        await expect(
+            submit(actor, {
+                app: 'x',
+                origin: 'https://x.example.com',
+                message: 'hi',
+            }),
+        ).rejects.toMatchObject({ statusCode: 400 });
+    });
+
+    it('throws 400 when the origin exceeds the stored column size', async () => {
+        // source_origin is VARCHAR(2048) on MySQL/Postgres; a longer origin
+        // must be rejected up front, not fail (or silently truncate) at the
+        // INSERT after passing every other validation.
+        mockEmailConfigured();
+        const { userId: ownerId } = await makeUser();
+        const app = await makeApp(ownerId, { feedbackEnabled: true });
+        const origin = `${new URL(app.index_url).origin}/${'x'.repeat(2500)}`;
+        const { actor } = await makeUser();
+        await expect(
+            submit(actor, { origin, message: 'hi' }),
+        ).rejects.toMatchObject({ statusCode: 400 });
+    });
+
+    it('throws 403 feedback_not_enabled when the app has not opted in', async () => {
+        mockEmailConfigured();
+        const { userId: ownerId } = await makeUser();
+        const app = await makeApp(ownerId);
+        const { actor } = await makeUser();
+        await expect(
+            submit(actor, { app: app.name, message: 'hi there' }),
+        ).rejects.toMatchObject({
+            statusCode: 403,
+            legacyCode: 'feedback_not_enabled',
+        });
+    });
+
+    it('throws 403 for an unknown app and an unknown origin alike', async () => {
+        const { actor } = await makeUser();
+        await expect(
+            submit(actor, { app: 'no-such-app-xyz', message: 'hi' }),
+        ).rejects.toMatchObject({ statusCode: 403 });
+        await expect(
+            submit(actor, {
+                origin: 'https://nobody-registered.example.com',
+                message: 'hi',
+            }),
+        ).rejects.toMatchObject({ statusCode: 403 });
+    });
+
+    it('throws 403 feedback_not_enabled when the email transport is unconfigured', async () => {
+        // No mockEmailConfigured(): the opted-in app must still refuse — a
+        // stored row nothing can read, sold to the sender as delivered, is
+        // worse than an honest refusal.
+        const { userId: ownerId } = await makeUser();
+        const app = await makeApp(ownerId, { feedbackEnabled: true });
+        const { actor } = await makeUser();
+        await expect(
+            submit(actor, { app: app.name, message: 'into the void' }),
+        ).rejects.toMatchObject({
+            statusCode: 403,
+            legacyCode: 'feedback_not_enabled',
+        });
+    });
+
+    it('throws 400 when the message exceeds the length limit', async () => {
+        mockEmailConfigured();
+        const { userId: ownerId } = await makeUser();
+        const app = await makeApp(ownerId, { feedbackEnabled: true });
+        const { actor } = await makeUser();
+        await expect(
+            submit(actor, {
+                app: app.name,
+                message: 'x'.repeat(
+                    AppFeedbackService.MESSAGE_MAX_LENGTH + 1,
+                ),
+            }),
+        ).rejects.toMatchObject({ statusCode: 400 });
+    });
+
+    it('stores a normalized row and responds with an empty object', async () => {
+        mockEmailConfigured();
+        const { userId: ownerId } = await makeUser();
+        const app = await makeApp(ownerId, { feedbackEnabled: true });
+        const { actor, userId } = await makeUser();
+        const captured = await submit(actor, {
+            app: app.uid,
+            message: '  Great\r\napp!  ',
+            context: 'app',
+        });
+        expect(captured.body).toEqual({});
+
+        const rows = (await server.clients.db.read(
+            'SELECT * FROM `app_feedback` WHERE `user_id` = ?',
+            [userId],
+        )) as Array<Record<string, unknown>>;
+        expect(rows).toHaveLength(1);
+        expect(rows[0]).toMatchObject({
+            app_uid: app.uid,
+            message: 'Great\napp!',
+            source_env: 'app',
+            source_origin: null,
+        });
+        // Engine-agnostic reads: pg returns BIGINT as string and BOOLEAN as
+        // boolean, sqlite returns numbers for both.
+        expect(Number(rows[0].app_id)).toBe(app.id);
+        expect(Boolean(rows[0].email_sent)).toBe(false);
+        expect(typeof rows[0].uid).toBe('string');
+        expect(Number.isFinite(Number(rows[0].created_at))).toBe(true);
+    });
+
+    it('records the attested origin on web submissions', async () => {
+        mockEmailConfigured();
+        const { userId: ownerId } = await makeUser();
+        const app = await makeApp(ownerId, { feedbackEnabled: true });
+        const origin = new URL(app.index_url).origin;
+        const { actor, userId } = await makeUser();
+        await submit(actor, { origin, message: 'from the web', context: 'web' });
+
+        const rows = (await server.clients.db.read(
+            'SELECT `source_env`, `source_origin` FROM `app_feedback` WHERE `user_id` = ?',
+            [userId],
+        )) as Array<Record<string, unknown>>;
+        expect(rows).toHaveLength(1);
+        expect(rows[0]).toMatchObject({
+            source_env: 'web',
+            source_origin: origin,
+        });
+    });
+
+    it('enforces the per-user-per-app daily cap with 429', async () => {
+        mockEmailConfigured();
+        const { userId: ownerId } = await makeUser();
+        const app = await makeApp(ownerId, { feedbackEnabled: true });
+        const { actor, userId } = await makeUser();
+        const since = Math.floor(Date.now() / 1000);
+        for (let i = 0; i < AppFeedbackService.PER_USER_APP_DAILY_LIMIT; i++) {
+            await server.stores.appFeedback.create({
+                appId: app.id,
+                appUid: app.uid,
+                userId,
+                message: `seed ${i}`,
+            });
+        }
+        expect(
+            await server.stores.appFeedback.countByUserAndAppSince(
+                userId,
+                app.id,
+                since - 60,
+            ),
+        ).toBe(AppFeedbackService.PER_USER_APP_DAILY_LIMIT);
+        await expect(
+            submit(actor, { app: app.name, message: 'one too many' }),
+        ).rejects.toMatchObject({
+            statusCode: 429,
+            legacyCode: 'too_many_requests',
+        });
+    });
+
+    it('rolls back the stored row when a concurrent burst breaches the cap', async () => {
+        mockEmailConfigured();
+        const { userId: ownerId } = await makeUser();
+        const app = await makeApp(ownerId, { feedbackEnabled: true });
+        const { actor, userId } = await makeUser();
+        for (let i = 0; i < AppFeedbackService.PER_USER_APP_DAILY_LIMIT; i++) {
+            await server.stores.appFeedback.create({
+                appId: app.id,
+                appUid: app.uid,
+                userId,
+                message: `seed ${i}`,
+            });
+        }
+        // Simulate the losing side of the check-then-insert race: the
+        // pre-insert check reads a stale under-cap count; the post-insert
+        // recount (real implementation) sees the truth.
+        vi.spyOn(
+            server.stores.appFeedback,
+            'countByUserAndAppSince',
+        ).mockResolvedValueOnce(0);
+
+        await expect(
+            submit(actor, { app: app.name, message: 'raced past the cap' }),
+        ).rejects.toMatchObject({
+            statusCode: 429,
+            legacyCode: 'too_many_requests',
+        });
+
+        const rows = (await server.clients.db.read(
+            'SELECT COUNT(*) AS n FROM `app_feedback` WHERE `user_id` = ?',
+            [userId],
+        )) as Array<{ n: unknown }>;
+        expect(Number(rows[0]?.n)).toBe(
+            AppFeedbackService.PER_USER_APP_DAILY_LIMIT,
+        );
+    });
+
+    it('enforces the per-user daily cap across apps with 429', async () => {
+        mockEmailConfigured();
+        const { userId: ownerId } = await makeUser();
+        const target = await makeApp(ownerId, { feedbackEnabled: true });
+        const other = await makeApp(ownerId, { feedbackEnabled: true });
+        const { actor, userId } = await makeUser();
+        for (let i = 0; i < AppFeedbackService.PER_USER_DAILY_LIMIT; i++) {
+            await server.stores.appFeedback.create({
+                appId: other.id,
+                appUid: other.uid,
+                userId,
+                message: `seed ${i}`,
+            });
+        }
+        await expect(
+            submit(actor, { app: target.name, message: 'over the limit' }),
+        ).rejects.toMatchObject({ statusCode: 429 });
+    });
+});
+
+// ── Owner email delivery ────────────────────────────────────────────
+
+// Which submissions get emailed, and what the mail contains, is service
+// logic covered in AppFeedbackService.test.ts. What the controller owes the
+// caller is that mail trouble never becomes the sender's problem.
+describe('AppFeedbackController owner email', () => {
+    it('a failing email send never fails the request', async () => {
+        mockEmailConfigured();
+        vi.spyOn(server.clients.email, 'send').mockRejectedValue(
+            new Error('smtp down'),
+        );
+        const { userId: ownerId } = await makeUser();
+        await confirmOwnerEmail(ownerId);
+        const app = await makeApp(ownerId, { feedbackEnabled: true });
+        const { actor, userId } = await makeUser();
+
+        const captured = await submit(actor, {
+            app: app.name,
+            message: 'still stored',
+        });
+        expect(captured.body).toEqual({});
+        const rows = (await server.clients.db.read(
+            'SELECT `email_sent` FROM `app_feedback` WHERE `user_id` = ?',
+            [userId],
+        )) as Array<{ email_sent: unknown }>;
+        expect(rows).toHaveLength(1);
+        expect(Boolean(rows[0]?.email_sent)).toBe(false);
+    });
+});

src/backend/controllers/feedback/AppFeedbackController.ts

@@ -0,0 +1,169 @@
+/*
+ * Copyright (C) 2024-present Puter Technologies Inc.
+ *
+ * This file is part of Puter.
+ *
+ * Puter is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published
+ * by the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <https://www.gnu.org/licenses/>.
+ */
+
+import type { Request, Response } from 'express';
+import { Controller, Get, Post } from '../../core/http/decorators.js';
+import { HttpError } from '../../core/http/HttpError.js';
+import { AppFeedbackService } from '../../services/feedback/AppFeedbackService.js';
+import { PuterController } from '../types.js';
+
+/**
+ * Endpoints behind the "send feedback to this app's developer" dialog
+ * (`puter.ui.showFeedbackDialog()`). Only the GUI (desktop dialog or the
+ * puter.com popup) calls these; apps cannot — both routes reject app actors,
+ * which is what makes feedback impossible to submit programmatically on a
+ * user's behalf.
+ *
+ * The target may be named either by `app` (uid or name — the desktop knows
+ * which app asked) or by `origin` (external site — the popup passes its
+ * browser-attested opener origin). Exactly one must be provided.
+ */
+
+/** Sanity cap on the raw body field; the service enforces the real limit. */
+const RAW_MESSAGE_CAP = 50_000;
+
+// Upper bound on the `app`/`origin` target params. Must not exceed the
+// `source_origin` column (VARCHAR(2048) on MySQL/Postgres): the raw origin is
+// stored verbatim, and a longer value would fail the INSERT after passing
+// every validation — or be silently truncated on non-strict MySQL.
+const TARGET_PARAM_MAX_LENGTH = 2048;
+
+const readTargetParam = (value: unknown): string | undefined => {
+    return typeof value === 'string' &&
+        value.length > 0 &&
+        value.length <= TARGET_PARAM_MAX_LENGTH
+        ? value
+        : undefined;
+};
+
+@Controller('/app-feedback')
+export class AppFeedbackController extends PuterController {
+    /**
+     * GET /app-feedback/target — pre-flight for the dialog: whether the target
+     * app accepts feedback, plus its canonical title/name for display. Reveals
+     * nothing that `puter.apps.get` doesn't already.
+     */
+    @Get('/target', {
+        subdomain: 'api',
+        requireUserActor: true,
+        requireVerified: true,
+        rateLimit: {
+            scope: 'app-feedback-target',
+            limit: 60,
+            window: 60_000,
+            key: 'user',
+        },
+    })
+    async target(req: Request, res: Response): Promise<void> {
+        const app = readTargetParam(req.query.app);
+        const origin = readTargetParam(req.query.origin);
+        if (!app === !origin) {
+            throw new HttpError(
+                400,
+                'Exactly one of `app` and `origin` is required',
+                { legacyCode: 'bad_request' },
+            );
+        }
+
+        const service = this.services.appFeedback as AppFeedbackService;
+        res.json(await service.getTarget({ app, origin }));
+    }
+
+    /**
+     * POST /app-feedback — store one feedback message and email the app's
+     * developer. Strict limits: the route limits below are the cheap first
+     * line; AppFeedbackService enforces durable per-user/per-app daily caps
+     * from the database (the route limiter fails open, the DB caps don't).
+     */
+    @Post('/', {
+        subdomain: 'api',
+        requireUserActor: true,
+        requireVerified: true,
+        // Submissions only ever originate from our own GUI pages (desktop
+        // dialog / popup). Cross-origin browser pages get stopped here even
+        // if they somehow hold a user token; non-browser clients still pass
+        // and are handled by the caps.
+        guiOriginOnly: true,
+        rateLimit: [
+            {
+                scope: 'app-feedback-user',
+                limit: 5,
+                window: 30 * 60_000,
+                key: 'user',
+            },
+            // IP backstop so freshly minted accounts can't stack per-user
+            // budgets from one machine.
+            {
+                scope: 'app-feedback-ip',
+                limit: 30,
+                window: 24 * 60 * 60_000,
+                key: 'ip',
+            },
+        ],
+    })
+    async submit(req: Request, res: Response): Promise<void> {
+        const body = req.body ?? {};
+        const app = readTargetParam(body.app);
+        const origin = readTargetParam(body.origin);
+        if (!app === !origin) {
+            throw new HttpError(
+                400,
+                'Exactly one of `app` and `origin` is required',
+                { legacyCode: 'bad_request' },
+            );
+        }
+
+        const message = body.message;
+        if (typeof message !== 'string' || message.length === 0) {
+            throw new HttpError(400, '`message` is required', {
+                legacyCode: 'bad_request',
+            });
+        }
+        if (message.length > RAW_MESSAGE_CAP) {
+            throw new HttpError(
+                400,
+                `\`message\` is too long (max ${AppFeedbackService.MESSAGE_MAX_LENGTH} characters)`,
+                { legacyCode: 'bad_request' },
+            );
+        }
+
+        const sourceEnv =
+            body.context === 'app' || body.context === 'web'
+                ? body.context
+                : undefined;
+
+        const userId = req.actor?.user?.id;
+        if (!userId) {
+            throw new HttpError(401, 'Unauthorized', {
+                legacyCode: 'unauthorized',
+            });
+        }
+
+        const service = this.services.appFeedback as AppFeedbackService;
+        await service.submit({
+            userId,
+            app,
+            origin,
+            message,
+            sourceEnv,
+            sourceOrigin: origin ?? null,
+        });
+        res.json({});
+    }
+}

src/backend/controllers/fs/FSController.ts

@@ -2178,8 +2178,7 @@ export class FSController extends PuterController {
         // the ActorUser type. Access via the escape hatch until a proper
         // storage-quota mechanism is in place.
         const actorUser = req.actor?.user as
-            | Record<string, unknown>
-            | undefined;
+            Record<string, unknown> | undefined;
 
         const candidates = [
             this.#toStorageCapacityCandidate(actorUser?.free_storage),

src/backend/controllers/fs/LegacyFSController.ts

@@ -828,9 +828,7 @@ export class LegacyFSController extends PuterController {
             // Trash, and `null`/`{}` when restoring. See
             // `src/gui/src/helpers.js` → `window.move_items`.
             newMetadata: (body.new_metadata ?? undefined) as
-                | Record<string, unknown>
-                | null
-                | undefined,
+                Record<string, unknown> | null | undefined,
         });
         const oldPath = source.path;
         await this.#emitGuiEvent('outer.gui.item.moved', moved, {
@@ -1276,8 +1274,7 @@ export class LegacyFSController extends PuterController {
         }
 
         type SignedOrEmpty =
-            | (SignedFile & { path?: string })
-            | Record<string, never>;
+            (SignedFile & { path?: string }) | Record<string, never>;
         const result: { signatures: SignedOrEmpty[]; token?: string } = {
             signatures: [],
         };
@@ -1843,10 +1840,7 @@ export class LegacyFSController extends PuterController {
         const subjectRef = body.subject;
         const appRef = body.app;
         const mode = (getString(body, 'mode') ?? 'read') as
-            | 'see'
-            | 'list'
-            | 'read'
-            | 'write';
+            'see' | 'list' | 'read' | 'write';
         if (!subjectRef || !appRef)
             throw new HttpError(400, '`subject` and `app` are required', {
                 legacyCode: 'bad_request',

src/backend/controllers/index.ts

@@ -18,6 +18,7 @@
  */
 
 import { AppController } from './apps/AppController.js';
+import { AppFeedbackController } from './feedback/AppFeedbackController.js';
 import { AuthController } from './auth/AuthController.js';
 import { BroadcastController } from './broadcast/BroadcastController.js';
 import { DesktopController } from './desktop/DesktopController.js';
@@ -43,6 +44,7 @@ export const puterControllers = {
     staticPages: StaticPagesController,
     auth: AuthController,
     apps: AppController,
+    appFeedback: AppFeedbackController,
     desktop: DesktopController,
     hosting: HostingController,
     system: SystemController,

src/backend/controllers/notification/NotificationController.ts

@@ -64,8 +64,7 @@ export class NotificationController extends PuterController {
             });
 
         const notifService = this.services.notification as unknown as
-            | NotificationService
-            | undefined;
+            NotificationService | undefined;
         if (notifService?.markAcknowledged) {
             await notifService.markAcknowledged(uid, userId);
         } else {
@@ -115,8 +114,7 @@ export class NotificationController extends PuterController {
             });
 
         const notifService = this.services.notification as unknown as
-            | NotificationService
-            | undefined;
+            NotificationService | undefined;
         if (notifService?.markShown) {
             await notifService.markShown(uid, userId);
         } else {

src/backend/controllers/puterai/PuterAIController.ts

@@ -574,8 +574,7 @@ export class PuterAIController extends PuterController {
                     text: extractTextContent(
                         (
                             messageResult.message as
-                                | Record<string, unknown>
-                                | undefined
+                                Record<string, unknown> | undefined
                         )?.content,
                     ),
                     index: 0,

src/backend/core/http/types.ts

@@ -26,12 +26,7 @@ import type { Actor } from '../actor';
  * it instead of accepting any token that authenticates.
  */
 export type TokenSource =
-    | 'body'
-    | 'header'
-    | 'x-api-key'
-    | 'cookie'
-    | 'query'
-    | 'handshake';
+    'body' | 'header' | 'x-api-key' | 'cookie' | 'query' | 'handshake';
 
 /**
  * Every route method PuterRouter exposes. Mirrors the express router surface

src/backend/data/hardcoded-permissions.js

@@ -88,55 +88,22 @@ const implicit_user_app_permissions = [
     },
 ];
 
-// Pre-v2 each entry below carried a `policy: { 'rate-limit': { max, period } }`
-// block attached by a `policyPerm('temp.kv')` / `policyPerm('user.es')` helper,
-// and a `driverPolicies` table held the actual `{max, period}` values. Nothing
-// ever read those policy blocks in v2 — rate limiting is now declared
-// directly on each driver via `@Driver({ rateLimit })` / `readonly rateLimit`
-// (see KVStoreDriver, AppDriver, SubdomainDriver, NotificationDriver), with
-// per-subscription overrides via `bySubscription`. The grants themselves
-// stay so the permission scan still emits a path for each group/permission;
-// only the dead policy plumbing was removed.
-const hardcoded_user_group_permissions = {
-    system: {
-        'ca342a5e-b13d-4dee-9048-58b11a57cc55': {
-            driver: {},
-            service: {},
-            feature: {},
-            'local-terminal:access': {},
-        },
-        'b7220104-7905-4985-b996-649fdcdb3c8f': {
-            driver: {},
-            service: {},
-            'service:hello-world:ii:hello-world': {},
-            'service:puter-kvstore:ii:puter-kvstore': {},
-            'driver:puter-kvstore': {},
-            'service:puter-notifications:ii:crud-q': {},
-            'service:puter-apps:ii:crud-q': {},
-            'service:puter-subdomains:ii:crud-q': {},
-            'service:apps:ii:crud-q': {},
-            'service:es\\Cnotification:ii:crud-q': {},
-            'service:es\\Capp:ii:crud-q': {},
-            'service:app:ii:crud-q': {},
-            'service:es\\Csubdomain:ii:crud-q': {},
-        },
-        '78b1b1dd-c959-44d2-b02c-8735671f9997': {
-            driver: {},
-            service: {},
-            'service:hello-world:ii:hello-world': {},
-            'service:puter-kvstore:ii:puter-kvstore': {},
-            'driver:puter-kvstore': {},
-            'service:es\\Cnotification:ii:crud-q': {},
-            'service:es\\Capp:ii:crud-q': {},
-            'service:app:ii:crud-q': {},
-            'service:es\\Csubdomain:ii:crud-q': {},
-            'service:apps:ii:crud-q': {},
-        },
-    },
+// Permissions every user actor holds, regardless of group membership.
+//
+// Roots only: a grant subsumes everything beneath it, so `service` already
+// answers `service:puter-kvstore:ii:puter-kvstore`. Listing descendants adds
+// entries no check can ever need.
+//
+// A floor, not a ceiling — anything that depends on *who* the user is belongs
+// in the ACL as a `user_to_group_permissions` / `user_to_user_permissions`
+// row. Adding a root here grants it to every user, temp accounts included.
+const default_user_permissions = {
+    driver: {},
+    service: {},
 };
 
 module.exports = {
     implicit_user_app_permissions,
     default_implicit_user_app_permissions,
-    hardcoded_user_group_permissions,
+    default_user_permissions,
 };

src/backend/drivers/apps/AppDriver.js

@@ -686,6 +686,13 @@ export class AppDriver extends PuterDriver {
                 ? 1
                 : 0;
         }
+        if (object.feedback_enabled !== undefined) {
+            out.feedback_enabled = validateBool(object.feedback_enabled, {
+                key: 'feedback_enabled',
+            })
+                ? 1
+                : 0;
+        }
         if (object.metadata !== undefined) {
             const meta = validateJsonObject(object.metadata, {
                 key: 'metadata',
@@ -946,6 +953,7 @@ export class AppDriver extends PuterDriver {
             index_url: app.index_url,
             background: Boolean(app.background),
             maximize_on_start: Boolean(app.maximize_on_start),
+            feedback_enabled: Boolean(app.feedback_enabled),
             godmode: Boolean(app.godmode),
             is_private: Boolean(app.is_private),
             protected: Boolean(app.protected),

src/backend/services/apps/RecommendedAppsService.ts

@@ -75,6 +75,10 @@ function toAppSummary(
         godmode: Boolean(app.godmode),
         maximize_on_start: Boolean(app.maximize_on_start),
         index_url: app.index_url,
+        // Launched straight from this summary as `app_obj` — see
+        // SuggestedAppsService.toAppSummary; the drawer's feedback control
+        // renders off this flag.
+        feedback_enabled: Boolean(app.feedback_enabled),
         // An app with no owner isn't owned by a Puter user — it's an
         // "external" (origin-bootstrapped) app.
         external: app.owner_user_id == null || app.owner_user_id === '',

src/backend/services/apps/SuggestedAppsService.ts

@@ -338,5 +338,10 @@ function toAppSummary(
         godmode: Boolean(app.godmode),
         maximize_on_start: Boolean(app.maximize_on_start),
         index_url: app.index_url,
+        // The GUI launches straight from this summary as `app_obj` (no
+        // re-read through AppDriver), so any launch-relevant flag omitted
+        // here silently disappears on those paths — e.g. the dashboard
+        // drawer's feedback control renders off this.
+        feedback_enabled: Boolean(app.feedback_enabled),
     };
 }

src/backend/services/feedback/AppFeedbackService.test.ts

@@ -0,0 +1,681 @@
+/*
+ * Copyright (C) 2024-present Puter Technologies Inc.
+ *
+ * This file is part of Puter.
+ *
+ * Puter is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published
+ * by the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <https://www.gnu.org/licenses/>.
+ */
+
+import {
+    afterAll,
+    afterEach,
+    beforeAll,
+    describe,
+    expect,
+    it,
+    vi,
+} from 'vitest';
+import { v4 as uuidv4 } from 'uuid';
+import { PuterServer } from '../../server.js';
+import { setupTestServer } from '../../testUtil.js';
+import { AppFeedbackService } from './AppFeedbackService.js';
+
+// Drives the real wired service against the real stores and in-memory
+// database; only the email transport (a genuine external boundary) is
+// stubbed. The controller's own tests cover request parsing and route gates —
+// everything here is the business logic the controller delegates to.
+
+// The email links the service builds are rooted at `config.origin`, which the
+// default test config leaves unset.
+const TEST_ORIGIN = 'https://puter.test';
+
+let server: PuterServer;
+let service: AppFeedbackService;
+
+beforeAll(async () => {
+    server = await setupTestServer({ origin: TEST_ORIGIN } as never);
+    service = server.services.appFeedback;
+});
+
+afterAll(async () => {
+    await server?.shutdown();
+});
+
+afterEach(() => {
+    vi.restoreAllMocks();
+});
+
+const makeUser = async (): Promise<number> => {
+    const username = `fdbk-svc-${Math.random().toString(36).slice(2, 10)}`;
+    const user = await server.stores.user.create({
+        username,
+        uuid: uuidv4(),
+        password: null,
+        email: `${username}@test.local`,
+    });
+    return user.id;
+};
+
+const makeApp = async (
+    ownerUserId: number,
+    opts: { feedbackEnabled?: boolean; name?: string; title?: string } = {},
+) => {
+    const name =
+        opts.name ?? `fdbk-svc-app-${Math.random().toString(36).slice(2, 10)}`;
+    return await server.stores.app.create(
+        {
+            name,
+            title: opts.title ?? `Feedback Service Test ${name}`,
+            index_url: `https://${name}.example.com`,
+            ...(opts.feedbackEnabled ? { feedback_enabled: 1 } : {}),
+        },
+        { ownerUserId },
+    );
+};
+
+// Feedback is only offered when the deployment can deliver it; most tests
+// want that baseline without asserting anything about the mail itself.
+const mockEmailConfigured = () =>
+    vi.spyOn(server.clients.email, 'isConfigured', 'get').mockReturnValue(true);
+
+const mockEmailReady = () => {
+    mockEmailConfigured();
+    return vi.spyOn(server.clients.email, 'send').mockResolvedValue(undefined);
+};
+
+// Columns the user store has no setter for; written directly the way the
+// admin tooling does, then the cached row is dropped.
+const setUserFlags = async (
+    userId: number,
+    flags: Partial<{
+        email_confirmed: boolean;
+        suspended: boolean;
+        unsubscribed: boolean;
+    }>,
+) => {
+    for (const [column, value] of Object.entries(flags)) {
+        await server.clients.db.write(
+            `UPDATE \`user\` SET \`${column}\` = ? WHERE \`id\` = ?`,
+            [server.clients.db.booleanValue(Boolean(value)), userId],
+        );
+    }
+    await server.stores.user.invalidateById(userId);
+};
+
+// An owner who can actually receive mail: the default for delivery tests.
+const makeDeliverableOwner = async (): Promise<number> => {
+    const ownerId = await makeUser();
+    await setUserFlags(ownerId, { email_confirmed: true });
+    return ownerId;
+};
+
+const feedbackRows = async (userId: number) =>
+    (await server.clients.db.read(
+        'SELECT * FROM `app_feedback` WHERE `user_id` = ? ORDER BY `id`',
+        [userId],
+    )) as Array<Record<string, unknown>>;
+
+// -- Message normalization ---------------------------------------------
+
+describe('AppFeedbackService.normalizeMessage', () => {
+    it('unifies newlines, strips control chars, and trims', () => {
+        expect(service.normalizeMessage('  a\r\nb\rc   ')).toBe('a\nb\nc');
+        expect(service.normalizeMessage('keep\ttabs\nand\nnewlines')).toBe(
+            'keep\ttabs\nand\nnewlines',
+        );
+        expect(service.normalizeMessage('a\u0000b\u0007c\u007F')).toBe('abc');
+    });
+
+    it('returns null for non-strings and whitespace-only input', () => {
+        expect(service.normalizeMessage(42)).toBeNull();
+        expect(service.normalizeMessage('   \n\t  ')).toBeNull();
+        expect(service.normalizeMessage(null)).toBeNull();
+        expect(service.normalizeMessage(undefined)).toBeNull();
+        // Nothing but control characters normalizes away to nothing.
+        expect(service.normalizeMessage('\u0000\u0007')).toBeNull();
+    });
+});
+
+// -- Target resolution --------------------------------------------------
+
+describe('AppFeedbackService.resolveTargetApp', () => {
+    it('resolves by uid and by name, including names starting with "app-"', async () => {
+        const ownerId = await makeUser();
+        const app = await makeApp(ownerId);
+        const prefixed = await makeApp(ownerId, {
+            name: `app-fdbk-${Math.random().toString(36).slice(2, 10)}`,
+        });
+
+        expect(await service.resolveTargetApp({ app: app.uid })).toMatchObject({
+            id: app.id,
+        });
+        expect(await service.resolveTargetApp({ app: app.name })).toMatchObject(
+            { id: app.id },
+        );
+        // A "app-"-prefixed *name* must not be mistaken for a uid and lost.
+        expect(
+            await service.resolveTargetApp({ app: prefixed.name }),
+        ).toMatchObject({ id: prefixed.id });
+    });
+
+    it('returns null when neither app nor origin is given, and for unknown apps', async () => {
+        expect(await service.resolveTargetApp({})).toBeNull();
+        expect(
+            await service.resolveTargetApp({ app: 'no-such-app-xyz' }),
+        ).toBeNull();
+    });
+
+    it('resolves an origin to the app whose index_url it matches', async () => {
+        const ownerId = await makeUser();
+        const app = await makeApp(ownerId);
+        const origin = new URL(app.index_url).origin;
+        expect(await service.resolveTargetApp({ origin })).toMatchObject({
+            id: app.id,
+        });
+    });
+
+    it('treats a blocked origin as unknown rather than an error', async () => {
+        // To a feedback caller "blocked" and "unknown" mean the same thing:
+        // nobody is accepting feedback there. Surfacing the 403 would tell
+        // any page whether its origin is on the blocklist.
+        const ownerId = await makeUser();
+        const app = await makeApp(ownerId, { feedbackEnabled: true });
+        const origin = new URL(app.index_url).origin;
+        await server.clients.db.write(
+            'INSERT INTO `blocked_app_origins` (`domain`, `include_subdomains`, `reason`) VALUES (?, ?, ?)',
+            [new URL(origin).host, 0, 'test'],
+        );
+        server.services.appOriginBlocklist.invalidate();
+        try {
+            expect(await service.resolveTargetApp({ origin })).toBeNull();
+        } finally {
+            await server.clients.db.write(
+                'DELETE FROM `blocked_app_origins` WHERE `domain` = ?',
+                [new URL(origin).host],
+            );
+            server.services.appOriginBlocklist.invalidate();
+        }
+    });
+
+    it('throws 400 on an unparseable origin', async () => {
+        await expect(
+            service.resolveTargetApp({ origin: 'not a url' }),
+        ).rejects.toMatchObject({ statusCode: 400 });
+    });
+});
+
+// -- Eligibility --------------------------------------------------------
+
+describe('AppFeedbackService.acceptsFeedback', () => {
+    const app = { feedback_enabled: 1, owner_user_id: 7 };
+
+    it('requires opt-in, an owner, and a configured email transport', () => {
+        mockEmailConfigured();
+        expect(service.acceptsFeedback(app)).toBe(true);
+        expect(service.acceptsFeedback(null)).toBe(false);
+        expect(service.acceptsFeedback({ ...app, feedback_enabled: 0 })).toBe(
+            false,
+        );
+        expect(service.acceptsFeedback({ ...app, owner_user_id: null })).toBe(
+            false,
+        );
+    });
+
+    it('is false without an email transport, even for an opted-in app', () => {
+        // The self-hosted no-SMTP default. Feedback rows have no other read
+        // path, so soliciting them here would store-and-lose every message
+        // while telling the sender it was delivered.
+        expect(server.clients.email.isConfigured).toBe(false);
+        expect(service.acceptsFeedback(app)).toBe(false);
+    });
+});
+
+describe('AppFeedbackService.getTarget', () => {
+    it('returns the dialog fields for an opted-in app', async () => {
+        mockEmailConfigured();
+        const ownerId = await makeUser();
+        const app = await makeApp(ownerId, { feedbackEnabled: true });
+        expect(await service.getTarget({ app: app.uid })).toEqual({
+            enabled: true,
+            app: { name: app.name, title: app.title },
+        });
+    });
+
+    it('reports a resolved-but-ineligible app as disabled, still naming it', async () => {
+        // The dialog needs the name/title to say *which* app declined.
+        mockEmailConfigured();
+        const ownerId = await makeUser();
+        const app = await makeApp(ownerId);
+        expect(await service.getTarget({ app: app.name })).toEqual({
+            enabled: false,
+            app: { name: app.name, title: app.title },
+        });
+    });
+
+    it('reports an unknown target as disabled with no app', async () => {
+        mockEmailConfigured();
+        expect(await service.getTarget({ app: 'no-such-app-xyz' })).toEqual({
+            enabled: false,
+            app: null,
+        });
+    });
+});
+
+// -- Submission ---------------------------------------------------------
+
+describe('AppFeedbackService.submit', () => {
+    it('stores the normalized message and returns the row uid', async () => {
+        mockEmailConfigured();
+        const ownerId = await makeUser();
+        const app = await makeApp(ownerId, { feedbackEnabled: true });
+        const userId = await makeUser();
+
+        const result = await service.submit({
+            userId,
+            app: app.uid,
+            message: '  Great\r\napp!  ',
+            sourceEnv: 'app',
+        });
+
+        const rows = await feedbackRows(userId);
+        expect(rows).toHaveLength(1);
+        expect(rows[0]).toMatchObject({
+            uid: result.uid,
+            app_uid: app.uid,
+            message: 'Great\napp!',
+            source_env: 'app',
+            source_origin: null,
+        });
+        expect(Number(rows[0].app_id)).toBe(app.id);
+    });
+
+    it('stores the attested origin for web submissions', async () => {
+        mockEmailConfigured();
+        const ownerId = await makeUser();
+        const app = await makeApp(ownerId, { feedbackEnabled: true });
+        const origin = new URL(app.index_url).origin;
+        const userId = await makeUser();
+
+        await service.submit({
+            userId,
+            origin,
+            message: 'from the web',
+            sourceEnv: 'web',
+            sourceOrigin: origin,
+        });
+
+        expect((await feedbackRows(userId))[0]).toMatchObject({
+            source_env: 'web',
+            source_origin: origin,
+        });
+    });
+
+    it('throws 403 feedback_not_enabled for opted-out, unknown, and undeliverable targets', async () => {
+        const ownerId = await makeUser();
+        const userId = await makeUser();
+
+        mockEmailConfigured();
+        const optedOut = await makeApp(ownerId);
+        await expect(
+            service.submit({ userId, app: optedOut.name, message: 'hi' }),
+        ).rejects.toMatchObject({
+            statusCode: 403,
+            legacyCode: 'feedback_not_enabled',
+        });
+        await expect(
+            service.submit({ userId, app: 'no-such-app-xyz', message: 'hi' }),
+        ).rejects.toMatchObject({ statusCode: 403 });
+
+        // Same refusal when the deployment has no email transport at all.
+        vi.restoreAllMocks();
+        const enabled = await makeApp(ownerId, { feedbackEnabled: true });
+        await expect(
+            service.submit({ userId, app: enabled.name, message: 'hi' }),
+        ).rejects.toMatchObject({
+            statusCode: 403,
+            legacyCode: 'feedback_not_enabled',
+        });
+        expect(await feedbackRows(userId)).toHaveLength(0);
+    });
+
+    it('throws 400 for a message that is empty or too long after normalization', async () => {
+        mockEmailConfigured();
+        const ownerId = await makeUser();
+        const app = await makeApp(ownerId, { feedbackEnabled: true });
+        const userId = await makeUser();
+
+        for (const message of ['   ', '\u0000\u0007', '\r\n \t ']) {
+            await expect(
+                service.submit({ userId, app: app.name, message }),
+            ).rejects.toMatchObject({
+                statusCode: 400,
+                legacyCode: 'bad_request',
+            });
+        }
+        await expect(
+            service.submit({
+                userId,
+                app: app.name,
+                message: 'x'.repeat(AppFeedbackService.MESSAGE_MAX_LENGTH + 1),
+            }),
+        ).rejects.toMatchObject({ statusCode: 400 });
+
+        // A message at exactly the limit is fine — the cap is inclusive.
+        await expect(
+            service.submit({
+                userId,
+                app: app.name,
+                message: 'x'.repeat(AppFeedbackService.MESSAGE_MAX_LENGTH),
+            }),
+        ).resolves.toMatchObject({ uid: expect.any(String) });
+        expect(await feedbackRows(userId)).toHaveLength(1);
+    });
+
+    it('measures length after normalization, not before', async () => {
+        // Padding and \r\n line endings must not push an otherwise-legal
+        // message over the limit.
+        mockEmailConfigured();
+        const ownerId = await makeUser();
+        const app = await makeApp(ownerId, { feedbackEnabled: true });
+        const userId = await makeUser();
+        const body = 'a\r\n'.repeat(AppFeedbackService.MESSAGE_MAX_LENGTH / 2);
+
+        await expect(
+            service.submit({ userId, app: app.name, message: `  ${body}  ` }),
+        ).resolves.toMatchObject({ uid: expect.any(String) });
+    });
+
+    it('enforces the per-user-per-app daily cap with 429', async () => {
+        mockEmailConfigured();
+        const ownerId = await makeUser();
+        const app = await makeApp(ownerId, { feedbackEnabled: true });
+        const userId = await makeUser();
+
+        for (let i = 0; i < AppFeedbackService.PER_USER_APP_DAILY_LIMIT; i++) {
+            await expect(
+                service.submit({
+                    userId,
+                    app: app.name,
+                    message: `message ${i}`,
+                }),
+            ).resolves.toMatchObject({ uid: expect.any(String) });
+        }
+        await expect(
+            service.submit({ userId, app: app.name, message: 'one too many' }),
+        ).rejects.toMatchObject({
+            statusCode: 429,
+            legacyCode: 'too_many_requests',
+        });
+        expect(await feedbackRows(userId)).toHaveLength(
+            AppFeedbackService.PER_USER_APP_DAILY_LIMIT,
+        );
+    });
+
+    it('enforces the per-user daily cap across apps with 429', async () => {
+        mockEmailConfigured();
+        const ownerId = await makeUser();
+        const target = await makeApp(ownerId, { feedbackEnabled: true });
+        const userId = await makeUser();
+        const other = await makeApp(ownerId, { feedbackEnabled: true });
+
+        for (let i = 0; i < AppFeedbackService.PER_USER_DAILY_LIMIT; i++) {
+            await server.stores.appFeedback.create({
+                appId: other.id,
+                appUid: other.uid,
+                userId,
+                message: `seed ${i}`,
+            });
+        }
+        // Under the per-app cap for `target`, over the all-apps cap.
+        await expect(
+            service.submit({
+                userId,
+                app: target.name,
+                message: 'over the limit',
+            }),
+        ).rejects.toMatchObject({ statusCode: 429 });
+    });
+
+    it('counts only rows inside the 24h window toward the caps', async () => {
+        mockEmailConfigured();
+        const ownerId = await makeUser();
+        const app = await makeApp(ownerId, { feedbackEnabled: true });
+        const userId = await makeUser();
+        const yesterday = Math.floor(Date.now() / 1000) - 25 * 60 * 60;
+
+        for (let i = 0; i < AppFeedbackService.PER_USER_APP_DAILY_LIMIT; i++) {
+            const row = await server.stores.appFeedback.create({
+                appId: app.id,
+                appUid: app.uid,
+                userId,
+                message: `stale ${i}`,
+            });
+            await server.clients.db.write(
+                'UPDATE `app_feedback` SET `created_at` = ? WHERE `id` = ?',
+                [yesterday, row.id],
+            );
+        }
+
+        await expect(
+            service.submit({ userId, app: app.name, message: 'new day' }),
+        ).resolves.toMatchObject({ uid: expect.any(String) });
+    });
+
+    it('rolls the stored row back when a concurrent burst breaches the cap', async () => {
+        mockEmailConfigured();
+        const ownerId = await makeUser();
+        const app = await makeApp(ownerId, { feedbackEnabled: true });
+        const userId = await makeUser();
+        for (let i = 0; i < AppFeedbackService.PER_USER_APP_DAILY_LIMIT; i++) {
+            await server.stores.appFeedback.create({
+                appId: app.id,
+                appUid: app.uid,
+                userId,
+                message: `seed ${i}`,
+            });
+        }
+        // Simulate the losing side of the check-then-insert race: the
+        // pre-insert check reads a stale under-cap count; the post-insert
+        // recount sees the truth and must undo the insert.
+        vi.spyOn(
+            server.stores.appFeedback,
+            'countByUserAndAppSince',
+        ).mockResolvedValueOnce(0);
+
+        await expect(
+            service.submit({
+                userId,
+                app: app.name,
+                message: 'raced past the cap',
+            }),
+        ).rejects.toMatchObject({
+            statusCode: 429,
+            legacyCode: 'too_many_requests',
+        });
+        expect(await feedbackRows(userId)).toHaveLength(
+            AppFeedbackService.PER_USER_APP_DAILY_LIMIT,
+        );
+    });
+});
+
+// -- Owner email delivery -----------------------------------------------
+
+describe('AppFeedbackService owner email', () => {
+    it('emails the owner and shares a verified sender address as reply-to', async () => {
+        const send = mockEmailReady();
+        const ownerId = await makeDeliverableOwner();
+        const app = await makeApp(ownerId, { feedbackEnabled: true });
+        const userId = await makeUser();
+        // Only a verified sender email is shared and used as reply-to.
+        await setUserFlags(userId, { email_confirmed: true });
+        const sender = (await server.stores.user.getById(userId))!;
+        const owner = (await server.stores.user.getById(ownerId))!;
+
+        await service.submit({ userId, app: app.name, message: 'hello dev' });
+
+        expect(send).toHaveBeenCalledTimes(1);
+        expect(send).toHaveBeenCalledWith(
+            owner.email,
+            'app-user-feedback',
+            expect.objectContaining({
+                owner_username: owner.username,
+                sender_username: sender.username,
+                sender_email: sender.email,
+                app_name: app.name,
+                app_title: app.title,
+                message: 'hello dev',
+            }),
+            expect.objectContaining({ replyTo: sender.email }),
+        );
+        expect(Boolean((await feedbackRows(userId))[0].email_sent)).toBe(true);
+    });
+
+    it('builds app and Dev Center links from the deployment origin', async () => {
+        // Both links must follow config.origin so they resolve on
+        // self-hosted deployments, not just puter.com.
+        const send = mockEmailReady();
+        const ownerId = await makeDeliverableOwner();
+        const app = await makeApp(ownerId, { feedbackEnabled: true });
+        const userId = await makeUser();
+
+        await service.submit({ userId, app: app.name, message: 'links' });
+
+        const [, , values] = send.mock.calls[0];
+        expect(values).toMatchObject({
+            app_link: `${TEST_ORIGIN}/app/${encodeURIComponent(app.name)}`,
+            dev_center_link: `${TEST_ORIGIN}/app/dev-center`,
+        });
+    });
+
+    it('collapses whitespace in the app title so it cannot forge header lines', async () => {
+        // app_title lands in the subject; a newline there would let a
+        // developer-controlled title inject its own headers or body lines.
+        const send = mockEmailReady();
+        const ownerId = await makeDeliverableOwner();
+        const app = await makeApp(ownerId, {
+            feedbackEnabled: true,
+            title: 'Evil\r\nBcc: [email protected]\tApp',
+        });
+        const userId = await makeUser();
+
+        await service.submit({ userId, app: app.name, message: 'hi' });
+
+        const [, , values] = send.mock.calls[0];
+        expect((values as Record<string, unknown>).app_title).toBe(
+            'Evil Bcc: [email protected] App',
+        );
+    });
+
+    it('does not share an unverified sender email and sets no reply-to', async () => {
+        const send = mockEmailReady();
+        const ownerId = await makeDeliverableOwner();
+        const app = await makeApp(ownerId, { feedbackEnabled: true });
+        // Sender's email is left unverified — it could be anyone's, so
+        // pointing the developer's reply at it is not safe.
+        const userId = await makeUser();
+
+        await service.submit({ userId, app: app.name, message: 'hello dev' });
+
+        expect(send).toHaveBeenCalledTimes(1);
+        const [, , values, options] = send.mock.calls[0];
+        expect((values as Record<string, unknown>).sender_email).toBeNull();
+        expect(
+            (options as { replyTo?: string } | undefined)?.replyTo,
+        ).toBeUndefined();
+        // Delivery still happens; only the reply path is withheld.
+        expect(Boolean((await feedbackRows(userId))[0].email_sent)).toBe(true);
+    });
+
+    it('stores without emailing when the owner cannot or will not receive mail', async () => {
+        const cases: Array<[string, Parameters<typeof setUserFlags>[1]]> = [
+            ['unconfirmed email', { email_confirmed: false }],
+            ['suspended', { email_confirmed: true, suspended: true }],
+            ['unsubscribed', { email_confirmed: true, unsubscribed: true }],
+        ];
+        for (const [label, flags] of cases) {
+            const send = mockEmailReady();
+            const ownerId = await makeUser();
+            await setUserFlags(ownerId, flags);
+            const app = await makeApp(ownerId, { feedbackEnabled: true });
+            const userId = await makeUser();
+
+            await service.submit({
+                userId,
+                app: app.name,
+                message: `owner is ${label}`,
+            });
+
+            expect(send, label).not.toHaveBeenCalled();
+            const rows = await feedbackRows(userId);
+            expect(rows, label).toHaveLength(1);
+            expect(Boolean(rows[0].email_sent), label).toBe(false);
+            vi.restoreAllMocks();
+        }
+    });
+
+    it('stores but does not email past the per-app daily email cap', async () => {
+        const send = mockEmailReady();
+        const ownerId = await makeDeliverableOwner();
+        const app = await makeApp(ownerId, { feedbackEnabled: true });
+
+        // Seed the cap with already-emailed rows from other users — the cap
+        // bounds mail per app, not per sender.
+        for (let i = 0; i < AppFeedbackService.PER_APP_DAILY_EMAIL_LIMIT; i++) {
+            const row = await server.stores.appFeedback.create({
+                appId: app.id,
+                appUid: app.uid,
+                userId: await makeUser(),
+                message: `seed ${i}`,
+            });
+            await server.stores.appFeedback.markEmailSent(row.id);
+        }
+
+        const userId = await makeUser();
+        await expect(
+            service.submit({ userId, app: app.name, message: 'past the cap' }),
+        ).resolves.toMatchObject({ uid: expect.any(String) });
+
+        expect(send).not.toHaveBeenCalled();
+        const rows = await feedbackRows(userId);
+        expect(rows).toHaveLength(1);
+        // The claimed slot was released, so the cap count stays exact.
+        expect(Boolean(rows[0].email_sent)).toBe(false);
+        expect(
+            await server.stores.appFeedback.countEmailedByAppSince(
+                app.id,
+                Math.floor(Date.now() / 1000) - 24 * 60 * 60,
+            ),
+        ).toBe(AppFeedbackService.PER_APP_DAILY_EMAIL_LIMIT);
+    });
+
+    it('keeps the feedback and releases the email slot when the send fails', async () => {
+        mockEmailConfigured();
+        vi.spyOn(server.clients.email, 'send').mockRejectedValue(
+            new Error('smtp down'),
+        );
+        const ownerId = await makeDeliverableOwner();
+        const app = await makeApp(ownerId, { feedbackEnabled: true });
+        const userId = await makeUser();
+
+        await expect(
+            service.submit({ userId, app: app.name, message: 'still stored' }),
+        ).resolves.toMatchObject({ uid: expect.any(String) });
+
+        const rows = await feedbackRows(userId);
+        expect(rows).toHaveLength(1);
+        // Slot released — a failed send must not consume the app's daily
+        // email budget.
+        expect(Boolean(rows[0].email_sent)).toBe(false);
+    });
+});

src/backend/services/feedback/AppFeedbackService.ts

@@ -0,0 +1,359 @@
+/*
+ * Copyright (C) 2024-present Puter Technologies Inc.
+ *
+ * This file is part of Puter.
+ *
+ * Puter is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published
+ * by the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <https://www.gnu.org/licenses/>.
+ */
+
+import { HttpError } from '../../core/http/HttpError.js';
+import { PuterService } from '../types.js';
+
+/**
+ * User-to-developer app feedback ("send feedback to this app's developer").
+ *
+ * Feedback is gated per app by the `apps.feedback_enabled` column — off unless
+ * enabled. The Dev Center enables it when it creates an app (its "User
+ * Feedback" settings toggle turns it off); apps created through
+ * `puter.apps.create`/`update` default to off and opt in via `feedbackEnabled`
+ * in puter.js. Submissions are stored in `app_feedback` and a copy is emailed
+ * to the app owner's confirmed email, subject to the caps below.
+ *
+ * Trust model: the submit endpoint only accepts user actors (never app tokens),
+ * so an app cannot submit feedback programmatically — every message passes
+ * through the GUI dialog (desktop) or the puter.com popup (external sites),
+ * i.e. through a page the user actually typed into. App identity is likewise
+ * never taken from the app: the desktop resolves it from its own process
+ * registry, and the popup resolves it from the browser-attested opener origin
+ * via AuthService.appUidFromOrigin.
+ *
+ * Abuse posture, layered:
+ *
+ * 1. Route rate limits (controller) — cheap first line, but the limiter fails open
+ *    when its backend is down.
+ * 2. Durable DB-count caps (here) — per (user, app) and per user per day. These
+ *    read the `app_feedback` table itself, so they hold across restarts and
+ *    nodes, and fail closed with the insert.
+ * 3. Per-app daily email cap — bounds how much mail one app can generate to its
+ *    owner regardless of how many distinct users submit. Feedback past the cap
+ *    is still stored, just not emailed.
+ */
+export class AppFeedbackService extends PuterService {
+    /** Max feedback message length, in characters (after normalization). */
+    static readonly MESSAGE_MAX_LENGTH = 4000;
+    /** Max feedback rows one user may create for one app per day. */
+    static readonly PER_USER_APP_DAILY_LIMIT = 3;
+    /** Max feedback rows one user may create across all apps per day. */
+    static readonly PER_USER_DAILY_LIMIT = 10;
+    /** Max owner emails one app may generate per day; rest is store-only. */
+    static readonly PER_APP_DAILY_EMAIL_LIMIT = 20;
+
+    /**
+     * Normalize a raw feedback message: unify newlines, strip control
+     * characters (except newline and tab), and trim. Returns the normalized
+     * string, or null when nothing usable remains.
+     */
+    normalizeMessage(raw: unknown): string | null {
+        if (typeof raw !== 'string') return null;
+        const normalized = raw
+            .replace(/\r\n?/g, '\n')
+            // Strip C0 control chars (keeping \t and \n) and DEL.
+
+            .replace(/[\u0000-\u0008\u000B-\u001F\u007F]/g, '')
+            .trim();
+        return normalized.length > 0 ? normalized : null;
+    }
+
+    /**
+     * Resolve the target app for a feedback interaction. Exactly one of `app`
+     * (uid or name) / `origin` (external site origin, resolved through the same
+     * path token acquisition uses) must be provided.
+     *
+     * Returns the app row or null when no such app exists. Throws 400 on an
+     * unparseable origin. A blocked origin resolves to null rather than
+     * throwing — to a feedback caller "blocked" and "unknown" mean the same
+     * thing: nobody is accepting feedback there.
+     */
+    async resolveTargetApp({
+        app,
+        origin,
+    }: {
+        app?: string;
+        origin?: string;
+    }): Promise<Record<string, unknown> | null> {
+        if (app) {
+            // Names may legally start with "app-" (e.g. "app-center"), so a
+            // prefix heuristic would misroute them; try uid first, then name.
+            return await this.stores.app.resolveApp(app);
+        }
+        if (origin) {
+            let uid;
+            try {
+                uid = await this.services.auth.appUidFromOrigin(origin);
+            } catch (e) {
+                if (e instanceof HttpError && e.legacyCode === 'app_blocked') {
+                    return null;
+                }
+                throw e;
+            }
+            return await this.stores.app.getByUid(uid);
+        }
+        return null;
+    }
+
+    /**
+     * Whether `app` (a row from AppStore) currently accepts user feedback: the
+     * developer opted in, the app has an owner to deliver to, and this
+     * deployment can deliver at all (email transport configured). Without a
+     * transport every submission would be stored-and-lost — the rows have no
+     * other read path — while the sender is told it was sent, so the feature
+     * reports itself unavailable instead.
+     */
+    acceptsFeedback(app: Record<string, unknown> | null): boolean {
+        return Boolean(
+            this.clients.email.isConfigured &&
+            app &&
+            app.feedback_enabled &&
+            app.owner_user_id,
+        );
+    }
+
+    /**
+     * Pre-flight for the feedback dialog: does this target accept feedback, and
+     * what should the dialog display? `app` fields are limited to what the
+     * dialog needs — `name` is included because it's unique and
+     * format-restricted, so the dialog can show it under the free-form title as
+     * an anti-impersonation measure.
+     */
+    async getTarget(params: { app?: string; origin?: string }): Promise<{
+        enabled: boolean;
+        app: { name: string; title: string } | null;
+    }> {
+        const app = await this.resolveTargetApp(params);
+        return {
+            enabled: this.acceptsFeedback(app),
+            app: app
+                ? { name: String(app.name), title: String(app.title) }
+                : null,
+        };
+    }
+
+    /**
+     * Store one feedback message and email it to the app's owner (best effort).
+     * Caller (controller) has already authenticated the user and validated the
+     * message's type and raw length; this method owns the business rules.
+     *
+     * @returns The stored row's public uid.
+     */
+    async submit({
+        userId,
+        app,
+        origin,
+        message,
+        sourceEnv,
+        sourceOrigin,
+    }: {
+        userId: number;
+        app?: string;
+        origin?: string;
+        message: string;
+        sourceEnv?: 'app' | 'web';
+        sourceOrigin?: string | null;
+    }): Promise<{ uid: string }> {
+        const targetApp = await this.resolveTargetApp({ app, origin });
+        if (!this.acceptsFeedback(targetApp)) {
+            throw new HttpError(
+                403,
+                'This app is not accepting feedback right now',
+                { legacyCode: 'feedback_not_enabled' },
+            );
+        }
+        const appId = Number(targetApp!.id);
+        const appUid = String(targetApp!.uid);
+
+        const normalized = this.normalizeMessage(message);
+        if (!normalized) {
+            throw new HttpError(400, '`message` must not be empty', {
+                legacyCode: 'bad_request',
+            });
+        }
+        if (normalized.length > AppFeedbackService.MESSAGE_MAX_LENGTH) {
+            throw new HttpError(
+                400,
+                `\`message\` is too long (max ${AppFeedbackService.MESSAGE_MAX_LENGTH} characters)`,
+                { legacyCode: 'bad_request' },
+            );
+        }
+
+        // Durable caps. Deliberately DB-backed (see class doc); the counts
+        // ride the (user_id, created_at) / (app_id, created_at) indexes.
+        // `includeOwnRow` distinguishes the pre-insert check (this
+        // submission not yet counted) from the post-insert recount (it is).
+        const since = Math.floor(Date.now() / 1000) - 24 * 60 * 60;
+        const capsBreached = async (
+            includeOwnRow: boolean,
+        ): Promise<boolean> => {
+            const slack = includeOwnRow ? 1 : 0;
+            const [userAppCount, userCount] = await Promise.all([
+                this.stores.appFeedback.countByUserAndAppSince(
+                    userId,
+                    appId,
+                    since,
+                ),
+                this.stores.appFeedback.countByUserSince(userId, since),
+            ]);
+            return (
+                userAppCount >=
+                    AppFeedbackService.PER_USER_APP_DAILY_LIMIT + slack ||
+                userCount >= AppFeedbackService.PER_USER_DAILY_LIMIT + slack
+            );
+        };
+        const tooManyError = new HttpError(
+            429,
+            'You have sent a lot of feedback recently — please try again later',
+            { legacyCode: 'too_many_requests' },
+        );
+        if (await capsBreached(false)) {
+            throw tooManyError;
+        }
+
+        const row = await this.stores.appFeedback.create({
+            appId,
+            appUid,
+            userId,
+            message: normalized,
+            sourceEnv: sourceEnv ?? null,
+            sourceOrigin: sourceOrigin ?? null,
+        });
+
+        // The pre-check is check-then-insert, so parallel submissions (or
+        // multiple nodes) can all pass it on the same stale count. Recount
+        // with this row included and roll it back if a concurrent burst
+        // pushed past a cap — these caps must fail closed, not just usually
+        // hold.
+        if (await capsBreached(true)) {
+            await this.stores.appFeedback.deleteById(row.id);
+            throw tooManyError;
+        }
+
+        // Email delivery is best-effort: any failure past this point must
+        // not fail the request — the feedback is already stored.
+        try {
+            await this.#emailOwner({
+                app: targetApp!,
+                appId,
+                feedbackId: row.id,
+                message: normalized,
+                senderUserId: userId,
+                since,
+            });
+        } catch (e) {
+            console.warn('[app-feedback] owner email failed:', e);
+        }
+
+        return { uid: row.uid };
+    }
+
+    /**
+     * Deliver one feedback email to the app owner if every delivery
+     * precondition holds; otherwise silently skip (the row stays stored with
+     * `email_sent = 0`). Preconditions: transport configured, owner exists with
+     * a confirmed non-blocklisted email, owner not suspended and not
+     * unsubscribed, per-app daily email cap not reached.
+     */
+    async #emailOwner({
+        app,
+        appId,
+        feedbackId,
+        message,
+        senderUserId,
+        since,
+    }: {
+        app: Record<string, unknown>;
+        appId: number;
+        feedbackId: number;
+        message: string;
+        senderUserId: number;
+        since: number;
+    }): Promise<void> {
+        if (!this.clients.email.isConfigured) return;
+
+        const owner = await this.stores.user.getById(Number(app.owner_user_id));
+        if (
+            !owner ||
+            !owner.email ||
+            !owner.email_confirmed ||
+            owner.suspended ||
+            Boolean(owner.unsubscribed)
+        ) {
+            return;
+        }
+        if (!(await this.clients.email.validate(owner.email))) return;
+
+        // Claim an email-cap slot *before* sending: flip email_sent, recount
+        // with the claim included, and release the slot if a concurrent
+        // burst pushed past the cap. Counting before sending would fail
+        // open — parallel submissions could each read an under-cap count and
+        // all send. The cost is that a crash mid-send burns a slot without
+        // delivering; the cap is an upper bound, not a quota owed.
+        await this.stores.appFeedback.markEmailSent(feedbackId);
+        const emailedToday =
+            await this.stores.appFeedback.countEmailedByAppSince(appId, since);
+        if (emailedToday > AppFeedbackService.PER_APP_DAILY_EMAIL_LIMIT) {
+            await this.stores.appFeedback.unmarkEmailSent(feedbackId);
+            return;
+        }
+
+        const sender = await this.stores.user.getById(senderUserId);
+        // Share the sender's email so the developer can respond — but only
+        // when it's verified. An unverified address can be anyone's (typed at
+        // signup, never proven), so using it as Reply-To would let a sender
+        // point the developer's reply at a stranger's inbox. Unverified
+        // senders still get their feedback delivered, just without a
+        // reply path. The dialog's privacy note mirrors this split (see
+        // app_feedback_privacy_note / app_feedback_privacy_note_no_email).
+        const senderEmail =
+            sender?.email && sender.email_confirmed ? sender.email : null;
+
+        try {
+            await this.clients.email.send(
+                owner.email,
+                'app-user-feedback',
+                {
+                    owner_username: owner.username,
+                    sender_username: sender?.username ?? 'A Puter user',
+                    sender_email: senderEmail,
+                    // Collapse whitespace so a crafted title can't break the
+                    // subject header or spoof extra lines in the body.
+                    app_title: String(app.title ?? app.name).replace(
+                        /\s+/g,
+                        ' ',
+                    ),
+                    app_name: String(app.name),
+                    app_link: `${this.config.origin}/app/${encodeURIComponent(String(app.name))}`,
+                    // The footer's "manage it" pointer — built from
+                    // config.origin like app_link so it holds on self-hosted
+                    // deployments.
+                    dev_center_link: `${this.config.origin}/app/dev-center`,
+                    message,
+                },
+                senderEmail ? { replyTo: senderEmail } : {},
+            );
+        } catch (e) {
+            // Release the claimed slot — the mail never went out.
+            await this.stores.appFeedback.unmarkEmailSent(feedbackId);
+            throw e;
+        }
+    }
+}

src/backend/services/index.ts

@@ -27,6 +27,7 @@ import { AuthService } from './auth/AuthService';
 import { OIDCService } from './auth/OIDCService';
 import { TokenService } from './auth/TokenService';
 import { BroadcastService } from './broadcast/BroadcastService';
+import { AppFeedbackService } from './feedback/AppFeedbackService';
 import { FSService } from './fs/FSService';
 import { ServerHealthService } from './health/ServerHealthService';
 import { PuterHomepageService } from './homepage/PuterHomepageService';
@@ -61,6 +62,7 @@ declare module './types' {
         suggestedApps: SuggestedAppsService;
         socket: SocketService;
         notification: NotificationService;
+        appFeedback: AppFeedbackService;
         broadcast: BroadcastService;
         oidc: OIDCService;
         appIcon: AppIconService;
@@ -99,6 +101,9 @@ export const puterServices = {
     suggestedApps: SuggestedAppsService,
     socket: SocketService,
     notification: NotificationService,
+    // Declared after `auth` (origin → app uid resolution happens through
+    // AuthService.appUidFromOrigin).
+    appFeedback: AppFeedbackService,
     broadcast: BroadcastService,
     oidc: OIDCService,
     appIcon: AppIconService,

src/backend/services/permission/PermissionService.test.ts

@@ -222,14 +222,14 @@ describe('PermissionService (integration)', () => {
             const { actor } = await makeUserActor();
             const allowed = await permService.check(
                 actor,
-                `service:nope-${uuidv4()}:ii:read`,
+                `zztest:nope-${uuidv4()}:ii:read`,
             );
             expect(allowed).toBeFalsy();
         });
 
         it('canManagePermission delegates to check on manage:<perm>', async () => {
             const { user, actor } = await makeUserActor();
-            const perm = `service:manage-test-${uuidv4()}:ii:read`;
+            const perm = `zztest:manage-test-${uuidv4()}:ii:read`;
             // Grant manage:<perm> via the flat store.
             await server.stores.permission.setFlatUserPerm(
                 user.id,
@@ -253,7 +253,7 @@ describe('PermissionService (integration)', () => {
                 permService.grantUserUserPermission(
                     actor,
                     `does-not-exist-${uuidv4()}`,
-                    'service:foo:ii:read',
+                    'zztest:foo:ii:read',
                 ),
             ).rejects.toMatchObject({ statusCode: 404 });
         });
@@ -264,7 +264,7 @@ describe('PermissionService (integration)', () => {
                 permService.grantUserUserPermission(
                     actor,
                     user.username,
-                    'service:foo:ii:read',
+                    'zztest:foo:ii:read',
                 ),
             ).rejects.toMatchObject({ statusCode: 400 });
         });
@@ -277,7 +277,7 @@ describe('PermissionService (integration)', () => {
                     permService.grantUserUserPermission(
                         issuer,
                         target.username,
-                        `service:unmanaged-${uuidv4()}:ii:read`,
+                        `zztest:unmanaged-${uuidv4()}:ii:read`,
                     ),
                 ),
             ).rejects.toMatchObject({ statusCode: 403 });
@@ -286,7 +286,7 @@ describe('PermissionService (integration)', () => {
         it('grant persists when issuer holds manage:<permission>', async () => {
             const { user: issuer, actor: issuerActor } = await makeUserActor();
             const { user: target, actor: targetActor } = await makeUserActor();
-            const permission = `service:user-user-${uuidv4()}:ii:read`;
+            const permission = `zztest:user-user-${uuidv4()}:ii:read`;
             await server.stores.permission.setFlatUserPerm(
                 issuer.id,
                 `manage:${permission}`,
@@ -316,7 +316,7 @@ describe('PermissionService (integration)', () => {
                 permService.revokeUserUserPermission(
                     actor,
                     `does-not-exist-${uuidv4()}`,
-                    'service:foo:ii:read',
+                    'zztest:foo:ii:read',
                 ),
             ).rejects.toMatchObject({ statusCode: 404 });
         });
@@ -329,7 +329,7 @@ describe('PermissionService (integration)', () => {
                     permService.revokeUserUserPermission(
                         issuer,
                         target.username,
-                        `service:unmanaged-${uuidv4()}:ii:read`,
+                        `zztest:unmanaged-${uuidv4()}:ii:read`,
                     ),
                 ),
             ).rejects.toMatchObject({ statusCode: 403 });
@@ -359,7 +359,7 @@ describe('PermissionService (integration)', () => {
                     permService.grantUserAppPermission(
                         actor,
                         `does-not-exist-${uuidv4()}`,
-                        'service:foo:ii:read',
+                        'zztest:foo:ii:read',
                     ),
                 ),
             ).rejects.toMatchObject({ statusCode: 404 });
@@ -368,7 +368,7 @@ describe('PermissionService (integration)', () => {
         it('persists a user→app grant and is idempotent', async () => {
             const { user, actor } = await makeUserActor();
             const app = await makeApp(user.id);
-            const permission = `service:gua-${uuidv4()}:ii:read`;
+            const permission = `zztest:gua-${uuidv4()}:ii:read`;
 
             await runWithContext({ actor }, () =>
                 permService.grantUserAppPermission(actor, app.uid, permission),
@@ -389,7 +389,7 @@ describe('PermissionService (integration)', () => {
         it('revokeUserAppPermission removes the row', async () => {
             const { user, actor } = await makeUserActor();
             const app = await makeApp(user.id);
-            const permission = `service:rua-${uuidv4()}:ii:read`;
+            const permission = `zztest:rua-${uuidv4()}:ii:read`;
             await runWithContext({ actor }, () =>
                 permService.grantUserAppPermission(actor, app.uid, permission),
             );
@@ -417,7 +417,7 @@ describe('PermissionService (integration)', () => {
                 permService.revokeUserAppPermission(
                     appActor,
                     app.uid,
-                    'service:foo:ii:read',
+                    'zztest:foo:ii:read',
                 ),
             ).rejects.toMatchObject({ statusCode: 403 });
         });
@@ -448,8 +448,8 @@ describe('PermissionService (integration)', () => {
             const { user, actor } = await makeUserActor();
             const app = await makeApp(user.id);
             for (const p of [
-                `service:rua-${uuidv4()}:ii:read`,
-                `service:rua-${uuidv4()}:ii:write`,
+                `zztest:rua-${uuidv4()}:ii:read`,
+                `zztest:rua-${uuidv4()}:ii:write`,
             ]) {
                 await runWithContext({ actor }, () =>
                     permService.grantUserAppPermission(actor, app.uid, p),
@@ -488,7 +488,7 @@ describe('PermissionService (integration)', () => {
                     permService.grantDevAppPermission(
                         actor,
                         `does-not-exist-${uuidv4()}`,
-                        'service:foo:ii:read',
+                        'zztest:foo:ii:read',
                     ),
                 ),
             ).rejects.toMatchObject({ statusCode: 404 });
@@ -502,7 +502,7 @@ describe('PermissionService (integration)', () => {
                     permService.grantDevAppPermission(
                         actor,
                         app.uid,
-                        `service:unmanaged-${uuidv4()}:ii:read`,
+                        `zztest:unmanaged-${uuidv4()}:ii:read`,
                     ),
                 ),
             ).rejects.toMatchObject({ statusCode: 403 });
@@ -511,7 +511,7 @@ describe('PermissionService (integration)', () => {
         it('grant persists when manage:<perm> is held', async () => {
             const { user, actor } = await makeUserActor();
             const app = await makeApp(user.id);
-            const permission = `service:dev-${uuidv4()}:ii:read`;
+            const permission = `zztest:dev-${uuidv4()}:ii:read`;
             await server.stores.permission.setFlatUserPerm(
                 user.id,
                 `manage:${permission}`,
@@ -542,7 +542,7 @@ describe('PermissionService (integration)', () => {
                 permService.revokeDevAppPermission(
                     appActor,
                     app.uid,
-                    'service:foo:ii:read',
+                    'zztest:foo:ii:read',
                 ),
             ).rejects.toMatchObject({ statusCode: 403 });
         });
@@ -566,7 +566,7 @@ describe('PermissionService (integration)', () => {
                     permService.grantUserGroupPermission(
                         actor,
                         { id: 1, uid: 'grp-doesnt-matter' },
-                        `service:unmanaged-${uuidv4()}:ii:read`,
+                        `zztest:unmanaged-${uuidv4()}:ii:read`,
                     ),
                 ),
             ).rejects.toMatchObject({ statusCode: 403 });
@@ -577,7 +577,7 @@ describe('PermissionService (integration)', () => {
                 permService.revokeUserGroupPermission(
                     { user: undefined } as unknown as Actor,
                     { id: 1, uid: 'grp-x' },
-                    'service:foo:ii:read',
+                    'zztest:foo:ii:read',
                 ),
             ).rejects.toMatchObject({ statusCode: 403 });
         });
@@ -587,7 +587,7 @@ describe('PermissionService (integration)', () => {
         it('listUserPermissionIssuers returns the issuer who granted the target a perm', async () => {
             const { user: issuer, actor: issuerActor } = await makeUserActor();
             const { user: target } = await makeUserActor();
-            const permission = `service:lst-${uuidv4()}:ii:read`;
+            const permission = `zztest:lst-${uuidv4()}:ii:read`;
             await server.stores.permission.setFlatUserPerm(
                 issuer.id,
                 `manage:${permission}`,
@@ -666,7 +666,7 @@ describe('PermissionService (integration)', () => {
         it('revoke is visible immediately — a cached "granted" reading is not served', async () => {
             const { user: issuer, actor: issuerActor } = await makeUserActor();
             const { user: target, actor: targetActor } = await makeUserActor();
-            const permission = `service:revoke-now-${uuidv4()}:ii:read`;
+            const permission = `zztest:revoke-now-${uuidv4()}:ii:read`;
             await grantManage(issuer, permission);
 
             await runWithContext({ actor: issuerActor }, () =>
@@ -721,7 +721,7 @@ describe('PermissionService (integration)', () => {
         it('grant is visible immediately — a cached "denied" reading is not served', async () => {
             const { user: issuer, actor: issuerActor } = await makeUserActor();
             const { user: target, actor: targetActor } = await makeUserActor();
-            const permission = `service:grant-now-${uuidv4()}:ii:read`;
+            const permission = `zztest:grant-now-${uuidv4()}:ii:read`;
             await grantManage(issuer, permission);
 
             // Prime a "denied" reading into the cache.
@@ -780,7 +780,7 @@ describe('PermissionService (integration)', () => {
             const { user: issuer, actor: issuerActor } = await makeUserActor();
             const { user: target, actor: targetActor } = await makeUserActor();
             const app = await makeApp(target.id);
-            const permission = `service:app-revoke-now-${uuidv4()}:ii:read`;
+            const permission = `zztest:app-revoke-now-${uuidv4()}:ii:read`;
             await grantManage(issuer, permission);
 
             await runWithContext({ actor: issuerActor }, () =>
@@ -825,7 +825,7 @@ describe('PermissionService (integration)', () => {
             const { user: issuer, actor: issuerActor } = await makeUserActor();
             const { user: target, actor: targetActor } = await makeUserActor();
             const app = await makeApp(target.id);
-            const permission = `service:app-grant-now-${uuidv4()}:ii:read`;
+            const permission = `zztest:app-grant-now-${uuidv4()}:ii:read`;
             await grantManage(issuer, permission);
 
             // App is allowed to act with the permission, but the user does
@@ -874,7 +874,7 @@ describe('PermissionService (integration)', () => {
         it('revokeUserUserPermission deletes the linked SQL row before resolving', async () => {
             const { user: issuer, actor: issuerActor } = await makeUserActor();
             const { user: target } = await makeUserActor();
-            const permission = `service:rvk-sync-${uuidv4()}:ii:read`;
+            const permission = `zztest:rvk-sync-${uuidv4()}:ii:read`;
             await grantManage(issuer, permission);
             await runWithContext({ actor: issuerActor }, () =>
                 permService.grantUserUserPermission(
@@ -906,7 +906,7 @@ describe('PermissionService (integration)', () => {
         it('revokeUserUserPermission surfaces a failed SQL delete instead of swallowing it', async () => {
             const { user: issuer, actor: issuerActor } = await makeUserActor();
             const { user: target } = await makeUserActor();
-            const permission = `service:rvk-fail-${uuidv4()}:ii:read`;
+            const permission = `zztest:rvk-fail-${uuidv4()}:ii:read`;
             await grantManage(issuer, permission);
             await runWithContext({ actor: issuerActor }, () =>
                 permService.grantUserUserPermission(
@@ -946,7 +946,7 @@ describe('PermissionService (integration)', () => {
         it('scan-path warms of the flat view carry an expiry (grants are permanent)', async () => {
             const { user: issuer, actor: issuerActor } = await makeUserActor();
             const { user: target, actor: targetActor } = await makeUserActor();
-            const permission = `service:warm-ttl-${uuidv4()}:ii:read`;
+            const permission = `zztest:warm-ttl-${uuidv4()}:ii:read`;
             await grantManage(issuer, permission);
             // The linked (SQL) path is a delegation chain: it only grants
             // if the issuer holds the permission themselves. Give the
@@ -1088,47 +1088,78 @@ describe('PermissionService — scan paths', () => {
             { ownerUserId },
         );
 
-    describe('group-derived grants', () => {
-        it('members of the default user group inherit the system driver grants', async () => {
+    describe('default user permissions and group grants', () => {
+        it('grants the default permissions to a member of the default user group', async () => {
             const { actor } = await makeGroupedUser();
             expect(await permService.check(actor, 'driver:puter-kvstore')).toBe(
                 true,
             );
+            expect(
+                await permService.check(
+                    actor,
+                    'service:puter-kvstore:ii:puter-kvstore',
+                ),
+            ).toBe(true);
         });
 
-        it('a user in no group inherits nothing', async () => {
+        it('grants the default permissions to a user in no group at all', async () => {
+            // The floor does not depend on membership, which is what repairs
+            // the account whose best-effort group insert failed at signup —
+            // previously locked out of every driver call with no recovery.
             const { actor } = await makeLooseUser();
             expect(await permService.check(actor, 'driver:puter-kvstore')).toBe(
+                true,
+            );
+            expect(
+                await permService.check(
+                    actor,
+                    'service:puter-kvstore:ii:puter-kvstore',
+                ),
+            ).toBe(true);
+        });
+
+        it('grants the default permissions to a temp user', async () => {
+            const { row: temp, actor: tempActor } = await makeLooseUser();
+            await server.stores.group.addUsers(DEFAULT_TEMP_GROUP_UID, [
+                temp.username,
+            ]);
+            expect(
+                await permService.check(tempActor, 'driver:puter-kvstore'),
+            ).toBe(true);
+        });
+
+        it('does not grant a permission outside the default set', async () => {
+            // Both used to be admin-only entries in the group-keyed map.
+            // Nothing grants them now.
+            const { actor } = await makeLooseUser();
+            expect(await permService.check(actor, 'local-terminal:access')).toBe(
                 false,
             );
+            expect(
+                await permService.check(actor, `feature:${uuidv4()}`),
+            ).toBe(false);
         });
 
-        it('registerSystemGrantForUsers reaches the user group but not the temp group', async () => {
-            const permission = `feature:users-only-${uuidv4()}`;
-            const { actor: member } = await makeGroupedUser();
-            const { row: temp, actor: tempActor } = await makeLooseUser();
-            await server.stores.group.addUsers(DEFAULT_TEMP_GROUP_UID, [
-                temp.username,
-            ]);
-
-            permService.registerSystemGrantForUsers(permission);
-
-            expect(await permService.check(member, permission)).toBe(true);
-            expect(await permService.check(tempActor, permission)).toBe(false);
-        });
-
-        it('registerSystemGrantForEveryone reaches temp users too', async () => {
-            const permission = `feature:everyone-${uuidv4()}`;
-            const { row: temp, actor: tempActor } = await makeLooseUser();
-            await server.stores.group.addUsers(DEFAULT_TEMP_GROUP_UID, [
-                temp.username,
-            ]);
-
-            permService.registerSystemGrantForEveryone(permission, {
-                note: 'test',
-            });
-
-            expect(await permService.check(tempActor, permission)).toBe(true);
+        it('never queries group membership to resolve a user permission', async () => {
+            // The membership lookup existed only to re-derive the flattened
+            // constant above, so no scan should reach for it now.
+            const { actor } = await makeGroupedUser();
+            const spy = vi.spyOn(server.stores.group, 'listGroupsWithMember');
+            try {
+                expect(
+                    await permService.check(actor, 'driver:puter-kvstore', {
+                        noCache: true,
+                    }),
+                ).toBe(true);
+                expect(
+                    await permService.check(actor, `zztest:${uuidv4()}:read`, {
+                        noCache: true,
+                    }),
+                ).toBe(false);
+                expect(spy).not.toHaveBeenCalled();
+            } finally {
+                spy.mockRestore();
+            }
         });
 
         it('honours a group grant issued by a user, and drops it on revoke', async () => {
@@ -1372,6 +1403,22 @@ describe('PermissionService — scan paths', () => {
             ).toBe(false);
         });
 
+        it('a scoped token does not inherit the default user permissions', async () => {
+            // The floor applies to user actors only. A token must still carry
+            // its own row, or a scoped token would silently widen to every
+            // driver the moment its issuer held the `driver` root.
+            const { actor } = await makeGroupedUser();
+            expect(await permService.check(actor, 'driver:puter-kvstore')).toBe(
+                true,
+            );
+            expect(
+                await permService.check(
+                    scopedToken(actor, `tok-${uuidv4()}`),
+                    'driver:puter-kvstore',
+                ),
+            ).toBe(false);
+        });
+
         it('a scoped token resolves a permission it carries and its issuer holds', async () => {
             const { row, actor } = await makeGroupedUser();
             const permission = `zztest:tok-${uuidv4()}:ii:read`;
@@ -1731,3 +1778,53 @@ describe('PermissionService — scan paths', () => {
         });
     });
 });
+
+describe('PermissionService — default user permissions vs. group config', () => {
+    /** A user with no group membership, on an arbitrary server. */
+    const makeLooseActor = async (srv: PuterServer): Promise<Actor> => {
+        const username = `pdg${Math.random().toString(36).slice(2, 10)}`;
+        const u = await srv.stores.user.create({
+            username,
+            uuid: uuidv4(),
+            password: null,
+            email: `${username}@test.local`,
+            requires_email_confirmation: false,
+        });
+        return {
+            user: {
+                id: u.id,
+                uuid: u.uuid,
+                username: u.username,
+                email: u.email ?? null,
+            },
+        };
+    };
+
+    it('grants the default permissions with no default group configured', async () => {
+        // Self-hosted deployments may run without default groups. The floor
+        // is not group-derived, so it applies regardless — a deployment that
+        // clears both no longer has every driver call fail closed.
+        const bare = await setupTestServer({
+            default_user_group: '',
+            default_temp_group: '',
+        } as never);
+        try {
+            const perms = bare.services
+                .permission as unknown as PermissionService;
+            const actor = await makeLooseActor(bare);
+            expect(await perms.check(actor, 'driver:puter-kvstore')).toBe(true);
+            expect(
+                await perms.check(
+                    actor,
+                    'service:puter-kvstore:ii:puter-kvstore',
+                ),
+            ).toBe(true);
+            // Still only the roots the floor names.
+            expect(await perms.check(actor, 'local-terminal:access')).toBe(
+                false,
+            );
+        } finally {
+            await bare.shutdown();
+        }
+    }, 60_000);
+});

src/backend/services/permission/PermissionService.ts

@@ -41,7 +41,7 @@ import {
 // @ts-ignore — hardcoded-permissions.js is plain JS
 import {
     default_implicit_user_app_permissions,
-    hardcoded_user_group_permissions,
+    default_user_permissions,
     implicit_user_app_permissions,
 } from '../../data/hardcoded-permissions.js';
 import { UserRow } from '../../stores/user/UserStore';
@@ -81,16 +81,6 @@ export class PermissionService extends PuterService {
     private readonly rewriters: PermissionRewriter[] = [];
     private readonly implicators: PermissionImplicator[] = [];
     private readonly exploders: PermissionExploder[] = [];
-    /**
-     * System-issued grants registered at runtime by other services. Keyed by
-     * group UID, then by permission string. Merged with the imported
-     * `hardcoded_user_group_permissions.system` map during the hc-user-group
-     * scan.
-     */
-    private readonly systemGrantsByGroupUid: Record<
-        string,
-        Record<string, unknown>
-    > = {};
 
     // -- Extension hooks ----------------------------------------------
     //
@@ -110,38 +100,6 @@ export class PermissionService extends PuterService {
         this.exploders.push(exploder);
     }
 
-    /**
-     * Grant a permission (as issued by `system`) to everyone — members of both
-     * the default user group and the default temp group.
-     *
-     * Call from an owning service's `onServerStart` (or later).
-     */
-    registerSystemGrantForEveryone(
-        permission: string,
-        data: unknown = {},
-    ): void {
-        const userGroup = this.config.default_user_group;
-        const tempGroup = this.config.default_temp_group;
-        if (userGroup) this.#addSystemGrant(userGroup, permission, data);
-        if (tempGroup) this.#addSystemGrant(tempGroup, permission, data);
-    }
-
-    /**
-     * Grant a permission (as issued by `system`) to non-temp users only —
-     * members of the default user group, but not the default temp group.
-     */
-    registerSystemGrantForUsers(permission: string, data: unknown = {}): void {
-        const userGroup = this.config.default_user_group;
-        if (userGroup) this.#addSystemGrant(userGroup, permission, data);
-    }
-
-    #addSystemGrant(groupUid: string, permission: string, data: unknown): void {
-        if (!this.systemGrantsByGroupUid[groupUid]) {
-            this.systemGrantsByGroupUid[groupUid] = {};
-        }
-        this.systemGrantsByGroupUid[groupUid][permission] = data;
-    }
-
     // -- Rewrite / explode (pure-ish helpers) ------------------------
 
     async rewritePermission(permission: string): Promise<string> {
@@ -373,6 +331,38 @@ export class PermissionService extends PuterService {
         }
         options = exploded.flat();
 
+        // -- default user permissions --
+        // A group-independent floor every user actor holds, resolved in
+        // memory (see `default_user_permissions`). Derived actors are
+        // excluded: an app-under-user is gated by its own implicit grant map
+        // and an access token by its issuer, both of which recurse into a
+        // scan of the user actor and so still see this floor.
+        if (!actor.app && !actor.accessToken && actor.user?.id) {
+            const granted = options.find((option) =>
+                Object.prototype.hasOwnProperty.call(
+                    default_user_permissions,
+                    option,
+                ),
+            );
+            if (granted !== undefined) {
+                reading.push({
+                    $: 'option',
+                    key: 'default-user-permission',
+                    permission: granted,
+                    source: 'implied',
+                    by: 'default-user-permission',
+                    data: (default_user_permissions as Record<string, unknown>)[
+                        granted
+                    ],
+                    holder_username: actor.user.username,
+                    issuer_username: 'system',
+                });
+                reading.push({ $: 'time', value: Date.now() - startTs });
+                await this.#maybeCacheScan(cacheKey, reading);
+                return reading;
+            }
+        }
+
         // -- shortcut implicators --
         let shortCircuit = false;
         for (const permission of options) {
@@ -409,7 +399,6 @@ export class PermissionService extends PuterService {
                 this.#scanNonShortcutImplicators(actor, options, reading),
                 this.#scanAccessToken(actor, options, reading),
                 this.#scanUserUser(actor, options, reading, workingState),
-                this.#scanHcUserGroupUser(actor, options, reading),
                 this.#scanUserGroup(actor, options, reading),
                 this.#scanUserAppImplied(actor, options, reading),
                 this.#scanUserApp(actor, options, reading),
@@ -527,96 +516,6 @@ export class PermissionService extends PuterService {
         reading.push(...subReadings);
     }
 
-    /**
-     * Resolve permissions that a persistent group's members inherit from an
-     * issuer (typically `system`) via the hardcoded map in
-     * `hardcoded-permissions.js`, merged with any runtime grants registered
-     * through `registerSystemGrantForEveryone` /
-     * `registerSystemGrantForUsers`.
-     */
-    async #scanHcUserGroupUser(
-        actor: Actor,
-        options: string[],
-        reading: ReadingNode[],
-    ): Promise<void> {
-        if (actor.app || actor.accessToken) return;
-        if (!actor.user?.id) return;
-
-        const memberGroups = await this.stores.group.listGroupsWithMember(
-            actor.user.id,
-        );
-        if (memberGroups.length === 0) return;
-
-        const groupByUid: Record<string, { id: number; uid: string }> = {};
-        for (const g of memberGroups) {
-            groupByUid[g.uid] = { id: g.id, uid: g.uid };
-        }
-
-        // Compose the effective issuer → group → permission → data map by
-        // merging the imported hardcoded data with runtime-registered system
-        // grants. Runtime grants are always attributed to the `system` issuer.
-        const hcMap = hardcoded_user_group_permissions as Record<
-            string,
-            Record<string, Record<string, unknown>>
-        >;
-        const hasRuntimeGrants =
-            Object.keys(this.systemGrantsByGroupUid).length > 0;
-        const byIssuer: Record<
-            string,
-            Record<string, Record<string, unknown>>
-        > = hasRuntimeGrants
-            ? { ...hcMap, system: { ...(hcMap.system ?? {}) } }
-            : hcMap;
-        if (hasRuntimeGrants) {
-            for (const [gUid, perms] of Object.entries(
-                this.systemGrantsByGroupUid,
-            )) {
-                byIssuer.system[gUid] = {
-                    ...(byIssuer.system[gUid] ?? {}),
-                    ...perms,
-                };
-            }
-        }
-
-        for (const issuerUsername of Object.keys(byIssuer)) {
-            const issuerUser =
-                await this.stores.user.getByUsername(issuerUsername);
-            if (!issuerUser) continue;
-            const issuerActor = this.#userToActor(issuerUser);
-            const issuerGroups = byIssuer[issuerUsername];
-
-            for (const groupUid of Object.keys(issuerGroups)) {
-                if (!groupByUid[groupUid]) continue;
-                const issuerGroupPerms = issuerGroups[groupUid];
-
-                for (const permission of options) {
-                    if (
-                        !Object.prototype.hasOwnProperty.call(
-                            issuerGroupPerms,
-                            permission,
-                        )
-                    )
-                        continue;
-                    const issuerReading = await this.scan(
-                        issuerActor,
-                        permission,
-                    );
-                    reading.push({
-                        $: 'path',
-                        via: 'hc-user-group',
-                        has_terminal: readingHasTerminal(issuerReading),
-                        permission,
-                        data: issuerGroupPerms[permission],
-                        holder_username: actor.user.username,
-                        issuer_username: issuerUsername,
-                        reading: issuerReading,
-                        group_id: groupByUid[groupUid].id,
-                    });
-                }
-            }
-        }
-    }
-
     async #scanUserGroup(
         actor: Actor,
         options: string[],

src/backend/services/socket/SocketService.ts

@@ -298,8 +298,7 @@ export class SocketService extends PuterService {
             // `{ auth: { ... } }`, not the query string. puter-js uses
             // `io(url, { auth: { auth_token } })`.
             const handshakeAuth = socket.handshake.auth as
-                | Record<string, unknown>
-                | undefined;
+                Record<string, unknown> | undefined;
             const tokenRaw =
                 typeof handshakeAuth?.auth_token === 'string'
                     ? handshakeAuth.auth_token
@@ -622,8 +621,7 @@ export class SocketService extends PuterService {
                 // their next poll of /cache/last-change-timestamp.
                 const originalSocketId = (
                     data.response as
-                        | { original_client_socket_id?: string }
-                        | undefined
+                        { original_client_socket_id?: string } | undefined
                 )?.original_client_socket_id;
                 await this.send({ room: userId }, 'cache.updated', {
                     timestamp,
@@ -637,9 +635,7 @@ export class SocketService extends PuterService {
     #handleUploadProgress(data: UploadProgressPayload): void {
         const meta = data.meta ?? {};
         const userId = (meta.user_id ?? meta.userId) as
-            | number
-            | string
-            | undefined;
+            number | string | undefined;
         if (!userId) {
             console.warn('[socket] upload-progress missing user_id', { meta });
             return;

src/backend/stores/app/AppStore.js

@@ -127,6 +127,7 @@ const APP_BOOLEAN_COLUMNS = new Set([
     'background',
     'protected',
     'is_private',
+    'feedback_enabled',
 ]);
 
 export class AppStore extends PuterStore {
@@ -1017,6 +1018,7 @@ export class AppStore extends PuterStore {
             'approved_for_listing',
             'approved_for_opening_items',
             'approved_for_incentive_program',
+            'feedback_enabled',
         ]) {
             if (row[key] !== undefined) row[key] = Boolean(row[key]);
         }

src/backend/stores/appFeedback/AppFeedbackStore.test.ts

@@ -0,0 +1,330 @@
+/*
+ * Copyright (C) 2024-present Puter Technologies Inc.
+ *
+ * This file is part of Puter.
+ *
+ * Puter is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published
+ * by the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <https://www.gnu.org/licenses/>.
+ */
+
+import { afterAll, beforeAll, describe, expect, it } from 'vitest';
+import { v4 as uuidv4 } from 'uuid';
+import { PuterServer } from '../../server.js';
+import { setupTestServer } from '../../testUtil.js';
+import type { AppFeedbackStore } from './AppFeedbackStore.js';
+
+// Runs against the real in-memory database, so the SQL (and the engine's
+// boolean/bigint representations) is exercised rather than described.
+
+let server: PuterServer;
+let store: AppFeedbackStore;
+
+beforeAll(async () => {
+    server = await setupTestServer();
+    store = server.stores.appFeedback;
+});
+
+afterAll(async () => {
+    await server?.shutdown();
+});
+
+const makeUser = async (): Promise<number> => {
+    const username = `fdbk-store-${Math.random().toString(36).slice(2, 10)}`;
+    const user = await server.stores.user.create({
+        username,
+        uuid: uuidv4(),
+        password: null,
+        email: `${username}@test.local`,
+    });
+    return user.id;
+};
+
+const makeApp = async (ownerUserId: number) => {
+    const name = `fdbk-store-app-${Math.random().toString(36).slice(2, 10)}`;
+    return await server.stores.app.create(
+        {
+            name,
+            title: `Feedback Store Test ${name}`,
+            index_url: `https://${name}.example.com`,
+        },
+        { ownerUserId },
+    );
+};
+
+// Each test gets its own user and app so the counts can't see other tests'
+// rows — the table is shared across the whole file.
+const makeScope = async () => {
+    const ownerId = await makeUser();
+    const [app, userId] = await Promise.all([makeApp(ownerId), makeUser()]);
+    return { app, userId };
+};
+
+const readRow = async (id: number) => {
+    const rows = (await server.clients.db.read(
+        'SELECT * FROM `app_feedback` WHERE `id` = ?',
+        [id],
+    )) as Array<Record<string, unknown>>;
+    return rows[0] ?? null;
+};
+
+// Backdate a row so window-scoped counts can be tested without waiting.
+const setCreatedAt = async (id: number, createdAt: number) => {
+    await server.clients.db.write(
+        'UPDATE `app_feedback` SET `created_at` = ? WHERE `id` = ?',
+        [createdAt, id],
+    );
+};
+
+const HOUR = 60 * 60;
+const now = () => Math.floor(Date.now() / 1000);
+
+describe('AppFeedbackStore.create', () => {
+    it('inserts a row with a fresh uid, email_sent false, and a unix timestamp', async () => {
+        const { app, userId } = await makeScope();
+        const before = now();
+
+        const created = await store.create({
+            appId: app.id,
+            appUid: app.uid,
+            userId,
+            message: 'hello dev',
+        });
+
+        expect(created.id).toBeGreaterThan(0);
+        expect(created.uid).toMatch(
+            /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/,
+        );
+
+        const row = (await readRow(created.id))!;
+        expect(row).toMatchObject({
+            uid: created.uid,
+            app_uid: app.uid,
+            message: 'hello dev',
+        });
+        // Engine-agnostic reads: pg returns BIGINT as string and BOOLEAN as
+        // boolean, sqlite returns numbers for both.
+        expect(Number(row.app_id)).toBe(app.id);
+        expect(Number(row.user_id)).toBe(userId);
+        expect(Boolean(row.email_sent)).toBe(false);
+        expect(Number(row.created_at)).toBeGreaterThanOrEqual(before);
+        expect(Number(row.created_at)).toBeLessThanOrEqual(now());
+    });
+
+    it('persists source_env / source_origin and defaults them to null', async () => {
+        const { app, userId } = await makeScope();
+
+        const withSource = await store.create({
+            appId: app.id,
+            appUid: app.uid,
+            userId,
+            message: 'from the web',
+            sourceEnv: 'web',
+            sourceOrigin: 'https://example.com',
+        });
+        expect(await readRow(withSource.id)).toMatchObject({
+            source_env: 'web',
+            source_origin: 'https://example.com',
+        });
+
+        const withoutSource = await store.create({
+            appId: app.id,
+            appUid: app.uid,
+            userId,
+            message: 'from the desktop',
+        });
+        expect(await readRow(withoutSource.id)).toMatchObject({
+            source_env: null,
+            source_origin: null,
+        });
+    });
+
+    it('gives every row a distinct uid', async () => {
+        const { app, userId } = await makeScope();
+        const rows = await Promise.all(
+            [1, 2, 3].map((n) =>
+                store.create({
+                    appId: app.id,
+                    appUid: app.uid,
+                    userId,
+                    message: `msg ${n}`,
+                }),
+            ),
+        );
+        expect(new Set(rows.map((r) => r.uid)).size).toBe(3);
+    });
+});
+
+describe('AppFeedbackStore counts', () => {
+    it('countByUserSince counts only this user and only inside the window', async () => {
+        const { app, userId } = await makeScope();
+        const otherUserId = await makeUser();
+        const since = now() - 24 * HOUR;
+
+        const recent = await store.create({
+            appId: app.id,
+            appUid: app.uid,
+            userId,
+            message: 'recent',
+        });
+        const old = await store.create({
+            appId: app.id,
+            appUid: app.uid,
+            userId,
+            message: 'old',
+        });
+        await setCreatedAt(old.id, since - HOUR);
+        await store.create({
+            appId: app.id,
+            appUid: app.uid,
+            userId: otherUserId,
+            message: 'someone else',
+        });
+
+        expect(await store.countByUserSince(userId, since)).toBe(1);
+        // The boundary is inclusive — a row exactly at `since` still counts.
+        const row = (await readRow(recent.id))!;
+        expect(
+            await store.countByUserSince(userId, Number(row.created_at)),
+        ).toBe(1);
+        expect(await store.countByUserSince(otherUserId, since)).toBe(1);
+    });
+
+    it('countByUserSince spans apps, countByUserAndAppSince does not', async () => {
+        const { app, userId } = await makeScope();
+        const otherApp = await makeApp(await makeUser());
+        const since = now() - 24 * HOUR;
+
+        for (const target of [app, app, otherApp]) {
+            await store.create({
+                appId: target.id,
+                appUid: target.uid,
+                userId,
+                message: 'hi',
+            });
+        }
+
+        expect(await store.countByUserSince(userId, since)).toBe(3);
+        expect(await store.countByUserAndAppSince(userId, app.id, since)).toBe(
+            2,
+        );
+        expect(
+            await store.countByUserAndAppSince(userId, otherApp.id, since),
+        ).toBe(1);
+    });
+
+    it('countEmailedByAppSince counts only emailed rows in the window', async () => {
+        const { app, userId } = await makeScope();
+        const since = now() - 24 * HOUR;
+
+        const emailed = await store.create({
+            appId: app.id,
+            appUid: app.uid,
+            userId,
+            message: 'emailed',
+        });
+        await store.markEmailSent(emailed.id);
+        // Not emailed.
+        await store.create({
+            appId: app.id,
+            appUid: app.uid,
+            userId,
+            message: 'stored only',
+        });
+        // Emailed, but yesterday.
+        const stale = await store.create({
+            appId: app.id,
+            appUid: app.uid,
+            userId,
+            message: 'emailed long ago',
+        });
+        await store.markEmailSent(stale.id);
+        await setCreatedAt(stale.id, since - HOUR);
+
+        expect(await store.countEmailedByAppSince(app.id, since)).toBe(1);
+    });
+
+    it('returns 0 rather than null when an app has no feedback', async () => {
+        const { app, userId } = await makeScope();
+        const since = now() - 24 * HOUR;
+        expect(await store.countEmailedByAppSince(app.id, since)).toBe(0);
+        expect(await store.countByUserSince(userId, since)).toBe(0);
+        expect(await store.countByUserAndAppSince(userId, app.id, since)).toBe(
+            0,
+        );
+    });
+});
+
+describe('AppFeedbackStore email-sent claim', () => {
+    it('marks and unmarks a single row, and the count follows', async () => {
+        const { app, userId } = await makeScope();
+        const since = now() - 24 * HOUR;
+        const row = await store.create({
+            appId: app.id,
+            appUid: app.uid,
+            userId,
+            message: 'claimed',
+        });
+        const sibling = await store.create({
+            appId: app.id,
+            appUid: app.uid,
+            userId,
+            message: 'untouched',
+        });
+
+        await store.markEmailSent(row.id);
+        expect(Boolean((await readRow(row.id))!.email_sent)).toBe(true);
+        expect(Boolean((await readRow(sibling.id))!.email_sent)).toBe(false);
+        expect(await store.countEmailedByAppSince(app.id, since)).toBe(1);
+
+        await store.unmarkEmailSent(row.id);
+        expect(Boolean((await readRow(row.id))!.email_sent)).toBe(false);
+        expect(await store.countEmailedByAppSince(app.id, since)).toBe(0);
+    });
+});
+
+describe('AppFeedbackStore.deleteById', () => {
+    it('removes the row and leaves the rest of the app alone', async () => {
+        const { app, userId } = await makeScope();
+        const since = now() - 24 * HOUR;
+        const doomed = await store.create({
+            appId: app.id,
+            appUid: app.uid,
+            userId,
+            message: 'rolled back',
+        });
+        const kept = await store.create({
+            appId: app.id,
+            appUid: app.uid,
+            userId,
+            message: 'kept',
+        });
+
+        await store.deleteById(doomed.id);
+
+        expect(await readRow(doomed.id)).toBeNull();
+        expect(await readRow(kept.id)).not.toBeNull();
+        expect(await store.countByUserSince(userId, since)).toBe(1);
+    });
+
+    it('is a no-op for an id that no longer exists', async () => {
+        const { app, userId } = await makeScope();
+        const row = await store.create({
+            appId: app.id,
+            appUid: app.uid,
+            userId,
+            message: 'gone',
+        });
+        await store.deleteById(row.id);
+        await expect(store.deleteById(row.id)).resolves.toBeUndefined();
+    });
+});

src/backend/stores/appFeedback/AppFeedbackStore.ts

@@ -0,0 +1,158 @@
+/*
+ * Copyright (C) 2024-present Puter Technologies Inc.
+ *
+ * This file is part of Puter.
+ *
+ * Puter is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published
+ * by the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <https://www.gnu.org/licenses/>.
+ */
+
+import { v4 as uuidv4 } from 'uuid';
+import { PuterStore } from '../types';
+
+/** One row of the `app_feedback` table. Timestamps are unix seconds. */
+export interface AppFeedbackRow {
+    id: number;
+    uid: string;
+    app_id: number;
+    app_uid: string;
+    user_id: number;
+    message: string;
+    source_env: string | null;
+    source_origin: string | null;
+    email_sent: boolean;
+    created_at: number;
+}
+
+/**
+ * Persistence for user-to-developer app feedback (`app_feedback` table).
+ *
+ * The count methods back AppFeedbackService's durable abuse caps. They query
+ * the DB rather than a cache/limiter on purpose: the rate-limit middleware
+ * fails open when its backend is unreachable, and a feature that emails a third
+ * party needs limits that fail closed. Both counts are served by the (user_id,
+ * created_at) / (app_id, created_at) indexes.
+ */
+export class AppFeedbackStore extends PuterStore {
+    // -- Reads --------------------------------------------------------
+
+    /** Feedback rows this user submitted (any app) since `sinceUnixSeconds`. */
+    async countByUserSince(
+        userId: number,
+        sinceUnixSeconds: number,
+    ): Promise<number> {
+        const rows = await this.clients.db.read(
+            'SELECT COUNT(*) AS n FROM `app_feedback` WHERE `user_id` = ? AND `created_at` >= ?',
+            [userId, sinceUnixSeconds],
+        );
+        return Number(rows[0]?.n ?? 0);
+    }
+
+    /** Feedback rows this user submitted for one app since `sinceUnixSeconds`. */
+    async countByUserAndAppSince(
+        userId: number,
+        appId: number,
+        sinceUnixSeconds: number,
+    ): Promise<number> {
+        const rows = await this.clients.db.read(
+            'SELECT COUNT(*) AS n FROM `app_feedback` WHERE `user_id` = ? AND `app_id` = ? AND `created_at` >= ?',
+            [userId, appId, sinceUnixSeconds],
+        );
+        return Number(rows[0]?.n ?? 0);
+    }
+
+    /**
+     * Feedback rows for this app that were emailed to the owner since
+     * `sinceUnixSeconds`. Backs the per-app daily email cap.
+     */
+    async countEmailedByAppSince(
+        appId: number,
+        sinceUnixSeconds: number,
+    ): Promise<number> {
+        const rows = await this.clients.db.read(
+            'SELECT COUNT(*) AS n FROM `app_feedback` WHERE `app_id` = ? AND `email_sent` = ? AND `created_at` >= ?',
+            [appId, this.clients.db.booleanValue(true), sinceUnixSeconds],
+        );
+        return Number(rows[0]?.n ?? 0);
+    }
+
+    // -- Writes -------------------------------------------------------
+
+    /**
+     * Insert one feedback row. `email_sent` starts false; the service claims it
+     * with {@link markEmailSent} before sending and releases it with
+     * {@link unmarkEmailSent} if the cap was breached or the send failed, so the
+     * email cap fails closed under concurrent submissions.
+     */
+    async create(fields: {
+        appId: number;
+        appUid: string;
+        userId: number;
+        message: string;
+        sourceEnv?: string | null;
+        sourceOrigin?: string | null;
+    }): Promise<{ id: number; uid: string }> {
+        const uid = uuidv4();
+        const createdAt = Math.floor(Date.now() / 1000);
+        const result = await this.clients.db.write(
+            'INSERT INTO `app_feedback` (`uid`, `app_id`, `app_uid`, `user_id`, `message`, `source_env`, `source_origin`, `email_sent`, `created_at`) ' +
+                `VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)${this.clients.db.returningIdClause()}`,
+            [
+                uid,
+                fields.appId,
+                fields.appUid,
+                fields.userId,
+                fields.message,
+                fields.sourceEnv ?? null,
+                fields.sourceOrigin ?? null,
+                this.clients.db.booleanValue(false),
+                createdAt,
+            ],
+        );
+        const insertId = result?.insertId;
+        if (!insertId) {
+            throw new Error(
+                'Failed to record app feedback — no insertId returned',
+            );
+        }
+        return { id: Number(insertId), uid };
+    }
+
+    /** Record that the owner email for this row was sent (claim a cap slot). */
+    async markEmailSent(id: number): Promise<void> {
+        await this.#setEmailSent(id, true);
+    }
+
+    /**
+     * Revert {@link markEmailSent} — releases a claimed email-cap slot when the
+     * cap turned out breached or the send failed.
+     */
+    async unmarkEmailSent(id: number): Promise<void> {
+        await this.#setEmailSent(id, false);
+    }
+
+    async #setEmailSent(id: number, sent: boolean): Promise<void> {
+        await this.clients.db.write(
+            'UPDATE `app_feedback` SET `email_sent` = ? WHERE `id` = ?',
+            [this.clients.db.booleanValue(sent), id],
+        );
+    }
+
+    /** Delete one feedback row. Backs the service's cap-race rollback. */
+    async deleteById(id: number): Promise<void> {
+        await this.clients.db.write(
+            'DELETE FROM `app_feedback` WHERE `id` = ?',
+            [id],
+        );
+    }
+}

src/backend/stores/index.ts

@@ -17,6 +17,7 @@
  * along with this program.  If not, see <https://www.gnu.org/licenses/>.
  */
 
+import { AppFeedbackStore } from './appFeedback/AppFeedbackStore.js';
 import { AppStore } from './app/AppStore.js';
 import { FSEntryStore } from './fs/FSEntryStore.js';
 import { GroupStore } from './group/GroupStore.js';
@@ -45,6 +46,7 @@ declare module './types.js' {
         meteringBuffer: MeteringBufferStore;
         user: UserStore;
         app: AppStore;
+        appFeedback: AppFeedbackStore;
         fsEntry: FSEntryStore;
         s3Object: S3ObjectStore;
         subdomain: SubdomainStore;
@@ -71,6 +73,7 @@ export const puterStores = {
     meteringBuffer: MeteringBufferStore,
     user: UserStore,
     app: AppStore,
+    appFeedback: AppFeedbackStore,
     fsEntry: FSEntryStore,
     s3Object: S3ObjectStore,
     subdomain: SubdomainStore,

src/backend/stores/systemKv/SystemKVStore.ts

@@ -759,8 +759,7 @@ export class SystemKVStore extends PuterStore {
                 fetched = response.Item ? [response.Item as KvCachedItem] : [];
                 fetchUnits = Number(
                     (response.ConsumedCapacity?.CapacityUnits as
-                        | number
-                        | undefined) ?? 0,
+                        number | undefined) ?? 0,
                 );
             }
 
@@ -832,8 +831,7 @@ export class SystemKVStore extends PuterStore {
                 probeUsage,
                 writeUsage(
                     response.ConsumedCapacity?.CapacityUnits as
-                        | number
-                        | undefined,
+                        number | undefined,
                 ),
             ),
         };
@@ -927,8 +925,7 @@ export class SystemKVStore extends PuterStore {
                 probeUsage,
                 writeUsage(
                     (response.ConsumedCapacity?.CapacityUnits as
-                        | number
-                        | undefined) ?? 1,
+                        number | undefined) ?? 1,
                 ),
             ),
         };
@@ -960,9 +957,7 @@ export class SystemKVStore extends PuterStore {
             | { key: string; value: unknown }[]
             | {
                   items:
-                      | string[]
-                      | unknown[]
-                      | { key: string; value: unknown }[];
+                      string[] | unknown[] | { key: string; value: unknown }[];
                   cursor?: string;
                   total?: number;
               }
@@ -1041,8 +1036,7 @@ export class SystemKVStore extends PuterStore {
                 usage,
                 readUsage(
                     (response.ConsumedCapacity?.CapacityUnits as
-                        | number
-                        | undefined) ?? 1,
+                        number | undefined) ?? 1,
                 ),
             );
             return response;
@@ -1059,8 +1053,7 @@ export class SystemKVStore extends PuterStore {
                 const skip = await runQuery(remaining, startKey, 'COUNT');
                 remaining -= Number(skip.Count ?? 0);
                 startKey = skip.LastEvaluatedKey as
-                    | Record<string, unknown>
-                    | undefined;
+                    Record<string, unknown> | undefined;
                 if (!startKey) {
                     exhausted = remaining > 0;
                     break;
@@ -1083,8 +1076,7 @@ export class SystemKVStore extends PuterStore {
                     >),
                 );
                 nextKey = response.LastEvaluatedKey as
-                    | Record<string, unknown>
-                    | undefined;
+                    Record<string, unknown> | undefined;
                 pages++;
                 if (normalizedLimit === undefined) {
                     // Legacy full listing: follow continuation pages so the
@@ -1120,8 +1112,7 @@ export class SystemKVStore extends PuterStore {
                 const counted = await runQuery(0, countKey, 'COUNT');
                 total += Number(counted.Count ?? 0);
                 countKey = counted.LastEvaluatedKey as
-                    | Record<string, unknown>
-                    | undefined;
+                    Record<string, unknown> | undefined;
             } while (countKey);
         }
 
@@ -1473,8 +1464,7 @@ export class SystemKVStore extends PuterStore {
                     probeUsage,
                     writeUsage(
                         (response.ConsumedCapacity?.CapacityUnits as
-                            | number
-                            | undefined) ?? 1,
+                            number | undefined) ?? 1,
                     ),
                 ),
             };

src/backend/testUtil.ts

@@ -244,8 +244,9 @@ export const createTestUser = async (
         requires_email_confirmation: false,
     });
 
-    // Base driver permissions (kv, notifications, …) are system grants on
-    // the default user group — membership is what a verified signup gets.
+    // Driver permissions no longer come from here (see
+    // `default_user_permissions`), but group-issued ACL grants do, and a
+    // verified signup is a member of the default user group.
     const { default_user_group } = await loadDefaultConfig();
     if (default_user_group) {
         await server.stores.group.addUsers(default_user_group, [opts.username]);

src/dev-center/js/apps.js

@@ -191,6 +191,9 @@ async function create_app (title, source_path = null, items = null) {
         maximizeOnStart: false,
         background: false,
         dedupeName: true,
+        // New apps accept user feedback by default; developers can turn this
+        // off in the app's settings (the "User Feedback" toggle).
+        feedbackEnabled: true,
         metadata: {
             window_resizable: true,
             fullpage_on_landing: true,
@@ -509,6 +512,12 @@ function generate_edit_app_section (app) {
                 </div>
 
                 <h3 style="font-size: 23px; border-bottom: 1px solid #EEE; margin-top: 50px; margin-bottom: 0px;">Misc</h3>
+                <div style="margin-top:30px;">
+                    <input type="checkbox" id="edit-app-user-feedback" name="edit-app-user-feedback" value="true" ${app.feedback_enabled ? 'checked' : ''}>
+                    <label for="edit-app-user-feedback" style="display: inline;">User Feedback</label>
+                    <p>When enabled, users can send you feedback about this app from within Puter. Feedback is delivered to your account's email address.</p>
+                </div>
+
                 <div style="margin-top:30px;">
                     <input type="checkbox" id="edit-app-locked" name="edit-app-locked" value="true" ${app.metadata?.locked ? 'checked' : ''}>
                     <label for="edit-app-locked" style="display: inline;">Delete Protection${lock_svg}</label>
@@ -586,6 +595,7 @@ function trackOriginalValues () {
             locked: $('#edit-app-locked').is(':checked'),
             fullPageOnLanding: $('#edit-app-fullpage-on-landing').is(':checked'),
             setTitleToFile: $('#edit-app-set-title-to-file').is(':checked'),
+            userFeedback: $('#edit-app-user-feedback').is(':checked'),
         },
     };
 }
@@ -626,7 +636,8 @@ function hasChanges () {
         $('#edit-app-hide-titlebar').is(':checked') !== originalValues.checkboxes.hideTitleBar ||
         $('#edit-app-locked').is(':checked') !== originalValues.checkboxes.locked ||
         $('#edit-app-fullpage-on-landing').is(':checked') !== originalValues.checkboxes.fullPageOnLanding ||
-        $('#edit-app-set-title-to-file').is(':checked') !== originalValues.checkboxes.setTitleToFile
+        $('#edit-app-set-title-to-file').is(':checked') !== originalValues.checkboxes.setTitleToFile ||
+        $('#edit-app-user-feedback').is(':checked') !== originalValues.checkboxes.userFeedback
     );
 }
 
@@ -674,6 +685,7 @@ function resetToOriginalValues () {
     $('#edit-app-locked').prop('checked', originalValues.checkboxes.locked);
     $('#edit-app-fullpage-on-landing').prop('checked', originalValues.checkboxes.fullPageOnLanding);
     $('#edit-app-set-title-to-file').prop('checked', originalValues.checkboxes.setTitleToFile);
+    $('#edit-app-user-feedback').prop('checked', originalValues.checkboxes.userFeedback);
 
     if ( originalValues.icon ) {
         $('#edit-app-icon').css('background-image', `url(${originalValues.icon})`);
@@ -1284,6 +1296,7 @@ async function saveEditedApp (mode) {
         description: description,
         maximizeOnStart: $('#edit-app-maximize-on-start').is(':checked'),
         background: $('#edit-app-background').is(':checked'),
+        feedbackEnabled: $('#edit-app-user-feedback').is(':checked'),
         metadata: {
             fullpage_on_landing: $('#edit-app-fullpage-on-landing').is(':checked'),
             social_image: socialImageUrl,

src/docs/src/Apps/create.md

@@ -48,6 +48,7 @@ An object containing the options for the app to create. The object can contain t
 - `filetypeAssociations` (Array<String>) (optional): An array of strings representing the filetypes that the app can open. Defaults to `[]`. File extentions and MIME types are supported; For example, `[".txt", ".md", "application/pdf"]` would allow the app to open `.txt`, `.md`, and PDF files.
 - `dedupeName` (Boolean) (optional) - Whether to deduplicate the app name if it already exists. Defaults to `false`.
 - `background` (Boolean) (optional) - Whether the app should run in the background. Defaults to `false`.
+- `feedbackEnabled` (Boolean) (optional) - Whether users can send feedback to you through [`puter.ui.showFeedbackDialog()`](/UI/showFeedbackDialog/). Defaults to `false`.
 - `metadata` (Object) (optional) - An object containing custom metadata for the app. This can be used to store arbitrary key-value pairs associated with the app.
 
 ## Return value

src/docs/src/Apps/update.md

@@ -24,6 +24,7 @@ An object containing the attributes to update. The object can contain the follow
 - `icon` (optional): The new icon of the app.
 - `maximizeOnStart` (optional): Whether the app should be maximized when it is started. Defaults to `false`.
 - `background` (optional): Whether the app should run in the background. Defaults to `false`.
+- `feedbackEnabled` (optional): Whether users can send feedback to you through [`puter.ui.showFeedbackDialog()`](/UI/showFeedbackDialog/). Omitted leaves the app's current value unchanged.
 - `filetypeAssociations` (optional): An array of strings representing the filetypes that the app can open. Defaults to `[]`. File extentions and MIME types are supported; For example, `[".txt", ".md", "application/pdf"]` would allow the app to open `.txt`, `.md`, and PDF files.
 - `metadata` (optional): An object containing custom metadata for the app. This can be used to store arbitrary key-value pairs associated with the app.
 

src/docs/src/UI.md

@@ -14,6 +14,7 @@ The UI API provides a comprehensive set of tools for creating rich user interfac
 - **[`puter.ui.alert()`](/UI/alert/)** - Show alert dialogs
 - **[`puter.ui.notify()`](/UI/notify/)** - Show desktop notifications
 - **[`puter.ui.prompt()`](/UI/prompt/)** - Show input prompts
+- **[`puter.ui.showFeedbackDialog()`](/UI/showFeedbackDialog/)** - Let the user send feedback to your app's developer
 
 ### Window Management
 - **[`puter.ui.createWindow()`](/UI/createWindow/)** - Create new windows

src/docs/src/UI/showFeedbackDialog.md

@@ -0,0 +1,49 @@
+---
+title: puter.ui.showFeedbackDialog()
+description: Opens a dialog the user can use to send feedback to your app.
+platforms: [ websites, apps]
+---
+
+Opens a dialog the user can use to send you — the app's developer — feedback about your app. The message is delivered by Puter: it is stored and emailed to the email address on your Puter account. The feedback never passes through your app's code, and the dialog tells the user what is shared with you: their username, plus their email address (as the email's reply-to, so you can respond) when their email is verified.
+
+Inside Puter, the dialog is rendered by the desktop environment. On a website, a puter.com popup hosts the dialog (signing the user in first if needed).
+
+**Feedback is opt-in.** Users can only send feedback if it's enabled for your app. Apps created in the Dev Center have feedback enabled at creation — you can turn it off with the "User Feedback" toggle in the app's settings. Apps created through `puter.apps.create` default to off; enable it by setting `feedbackEnabled`:
+
+```js
+await puter.apps.update('my-app', { feedbackEnabled: true });
+```
+
+If feedback isn't enabled, the dialog tells the user the app isn't accepting feedback. To protect you and your users, Puter enforces limits on the size and frequency of feedback messages.
+
+## Syntax
+```js
+puter.ui.showFeedbackDialog()
+```
+
+## Parameters
+None.
+
+## Return value
+A `Promise` that resolves to `true` if the user submitted feedback, and `false` if the dialog was dismissed or feedback is unavailable. It never rejects.
+
+On a website that is cross-origin isolated (COOP severs the popup's connection to your page), the promise resolves `false` even though the popup stays open and the user may still submit their feedback there. Treat `false` as "not confirmed", not "not sent".
+
+## Examples
+
+```html;ui-show-feedback-dialog
+<html>
+<body>
+    <button id="feedback">Send us feedback</button>
+    <script src="https://js.puter.com/v2/"></script>
+    <script>
+        document.getElementById('feedback').addEventListener('click', async () => {
+            const sent = await puter.ui.showFeedbackDialog();
+            if (sent) {
+                puter.print('Thanks for your feedback!');
+            }
+        });
+    </script>
+</body>
+</html>
+```

src/docs/src/sidebar.js

@@ -942,6 +942,14 @@ let sidebar = [
                 source: '/UI/showDirectoryPicker.md',
                 path: '/UI/showDirectoryPicker',
             },
+            {
+                title: '<code>showFeedbackDialog()</code>',
+                page_title: '<code>puter.ui.showFeedbackDialog()</code>',
+                title_tag: 'puter.ui.showFeedbackDialog()',
+                icon: '/assets/img/function.svg',
+                source: '/UI/showFeedbackDialog.md',
+                path: '/UI/showFeedbackDialog',
+            },
             {
                 title: '<code>showFontPicker()</code>',
                 page_title: '<code>puter.ui.showFontPicker()</code>',

src/gui/src/IPC.js

@@ -28,6 +28,7 @@ import UIItem from './UI/UIItem.js';
 import UIPopover from './UI/UIPopover.js';
 import UIPrompt from './UI/UIPrompt.js';
 import UIWindow from './UI/UIWindow.js';
+import UIWindowAppFeedback from './UI/UIWindowAppFeedback.js';
 import UIWindowColorPicker from './UI/UIWindowColorPicker.js';
 import UIWindowEmailConfirmationRequired from './UI/UIWindowEmailConfirmationRequired.js';
 import UIWindowFontPicker from './UI/UIWindowFontPicker.js';
@@ -40,6 +41,39 @@ import { PROCESS_IPC_ATTACHED } from './definitions.js';
 import TeePromise from './util/TeePromise.js';
 
 window.ipc_handlers = {};
+
+// Abuse guard for the app-triggered feedback dialog (`showFeedbackDialog`
+// handler below). The dialog is a full-viewport modal reachable from app IPC
+// with no user-gesture requirement, so an unguarded loop of
+// `showFeedbackDialog()` calls would cover the desktop — taskbar and the
+// app's own close button included — forever. One dialog may be open at a
+// time, and every dismissal that sent nothing backs off the app's next open
+// (10s, then 60s, then blocked until the page reloads); a successful send
+// resets the backoff.
+const FEEDBACK_DISMISS_BACKOFF_MS = [10_000, 60_000, Infinity];
+let feedback_dialog_open = false;
+const feedback_dialog_backoff = new Map(); // app uid/name -> { dismissals, until }
+
+const feedback_dialog_may_open = (app_key) => {
+    if ( feedback_dialog_open ) return false;
+    const entry = feedback_dialog_backoff.get(app_key);
+    return ! entry || Date.now() >= entry.until;
+};
+
+const record_feedback_dialog_outcome = (app_key, sent) => {
+    if ( sent ) {
+        feedback_dialog_backoff.delete(app_key);
+        return;
+    }
+    const dismissals = (feedback_dialog_backoff.get(app_key)?.dismissals ?? 0) + 1;
+    const backoff = FEEDBACK_DISMISS_BACKOFF_MS[
+        Math.min(dismissals, FEEDBACK_DISMISS_BACKOFF_MS.length) - 1
+    ];
+    feedback_dialog_backoff.set(app_key, {
+        dismissals,
+        until: Date.now() + backoff,
+    });
+};
 /**
  * In Puter, apps are loaded in iframes and communicate with the graphical user interface (GUI), and each other, using the postMessage API.
  * The following sets up an Inter-Process Messaging System between apps and the GUI that enables communication
@@ -1391,6 +1425,70 @@ const ipc_listener = async (event, handled) => {
         $(target_iframe).get(0)?.focus({ preventScroll: true });
     }
     //--------------------------------------------------------
+    // showFeedbackDialog
+    //--------------------------------------------------------
+    else if ( event.data.msg === 'showFeedbackDialog' ) {
+        // Always respond, even on failure, so the SDK's promise settles
+        // instead of hanging forever. The app can close its own window while
+        // the dialog is up, which tears down the iframe — posting into it
+        // must not throw.
+        const respond = (sent) => {
+            target_iframe?.contentWindow?.postMessage({
+                msg: 'feedbackDialogClosed',
+                sent: sent === true,
+                original_msg_id: msg_id,
+            }, '*');
+        };
+
+        // Re-entry / dismissal-backoff guard (see the state at the top of
+        // this file). Checked before the auth gate too: for a signed-out
+        // user the gate opens a full-page signup window, which an
+        // unguarded loop could spam just as effectively as the dialog.
+        const guard_key = app_uuid || app_name;
+        if ( ! feedback_dialog_may_open(guard_key) ) {
+            respond(false);
+            return;
+        }
+
+        feedback_dialog_open = true;
+        let sent = false;
+        try {
+            // auth
+            try {
+                if ( !window.is_auth() && !(await UIWindowSignup({ referrer: app_name })) )
+                {
+                    respond(false);
+                    return;
+                }
+            } catch ( e ) {
+                // `ipc_listener` has no outer catch, so a throw from the signup
+                // window would escape before any reply and hang the app.
+                console.error('IPC showFeedbackDialog: auth gate failed', e);
+                respond(false);
+                return;
+            }
+
+            try {
+                // The target app is this message's sender — identified by the
+                // GUI's own registry (`data-app_uuid` on the window that owns the
+                // validated source iframe), never by anything in the message, so
+                // an app can only ever open the feedback dialog for itself.
+                sent = await UIWindowAppFeedback({
+                    app: app_uuid || app_name,
+                    source: 'app',
+                });
+            } catch ( e ) {
+                console.error('IPC showFeedbackDialog failed', e);
+            }
+
+            respond(sent === true);
+            $(target_iframe).get(0)?.focus({ preventScroll: true });
+        } finally {
+            feedback_dialog_open = false;
+            record_feedback_dialog_outcome(guard_key, sent);
+        }
+    }
+    //--------------------------------------------------------
     // showFontPicker
     //--------------------------------------------------------
     else if ( event.data.msg === 'showFontPicker' ) {

src/gui/src/UI/UIWindow.js

@@ -25,6 +25,7 @@ import UIWindowLogin from './UIWindowLogin.js';
 import UIWindowItemProperties from './UIWindowItemProperties.js';
 import new_context_menu_item from '../helpers/new_context_menu_item.js';
 import refresh_item_container from '../helpers/refresh_item_container.js';
+import UIWindowAppFeedback from './UIWindowAppFeedback.js';
 import launch_app from '../helpers/launch_app.js';
 import publish_as_website from '../helpers/publish_as_website.js';
 
@@ -4589,18 +4590,32 @@ function attach_dashboard_app_drawer (el_window, options) {
         : launch_icon;
     const title = options.title || app_name;
 
+    // A "Send Feedback" control, shown only when the developer opted the app
+    // in (apps.feedbackEnabled → options.feedback_enabled). The dialog also
+    // re-checks opt-in server-side, so a stale flag can't send anywhere.
+    const feedback_enabled = options.feedback_enabled === true
+        || options.feedback_enabled === 1;
+    const feedback_label = i18n('app_feedback_title');
+    // A message/comment glyph (bubble with text lines) — clearer at this size
+    // than a bare speech bubble, which reads as a magnifier.
+    const feedback_btn = feedback_enabled ? `
+                    <button type="button" class="dashboard-app-drawer-btn dashboard-app-drawer-feedback" title="${feedback_label}" aria-label="${feedback_label}">
+                        <svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true"><path d="M21 15a2 2 0 0 1-2 2H7l-4 4V5a2 2 0 0 1 2-2h14a2 2 0 0 1 2 2z"/><line x1="7.5" y1="9" x2="16.5" y2="9"/><line x1="7.5" y1="12.5" x2="13" y2="12.5"/></svg>
+                    </button>` : '';
+
     // The toggle comes FIRST in the DOM so Tab reaches it before the
     // controls' buttons; both layers are absolutely positioned (see
-    // dashboard.css), so DOM order doesn't affect the visuals.
+    // dashboard.css), so DOM order doesn't affect the visuals. `has-feedback`
+    // widens the surface so the extra control doesn't clip the close button.
     const $drawer = $(`
-        <div class="dashboard-app-drawer collapsed">
+        <div class="dashboard-app-drawer collapsed${feedback_enabled ? ' has-feedback' : ''}">
             <button type="button" class="dashboard-app-drawer-toggle" aria-expanded="false" title="App controls" aria-label="App controls">
                 <span class="dashboard-app-drawer-grabber" aria-hidden="true"></span>
             </button>
             <div class="dashboard-app-drawer-clip">
                 <div class="dashboard-app-drawer-controls">
                     <img class="dashboard-app-drawer-icon" src="${html_encode(icon)}" alt="" draggable="false">
-                    <span class="dashboard-app-drawer-title">${html_encode(title)}</span>
+                    <span class="dashboard-app-drawer-title">${html_encode(title)}</span>${feedback_btn}
                     <button type="button" class="dashboard-app-drawer-btn dashboard-app-drawer-minimize" title="Minimize to Dashboard" aria-label="Minimize to Dashboard">
                         <svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.4" stroke-linecap="round" aria-hidden="true"><line x1="5" y1="12" x2="19" y2="12"/></svg>
                     </button>
@@ -4727,6 +4742,17 @@ function attach_dashboard_app_drawer (el_window, options) {
         e.stopPropagation();
         $(el_window).close();
     });
+    // Opens the feedback dialog for THIS app. Identify it by uid when we
+    // have one (unique, unspoofable) and fall back to the name; the dialog
+    // is modal over the app window it belongs to.
+    $drawer.find('.dashboard-app-drawer-feedback').on('click', function (e) {
+        e.stopPropagation();
+        collapse();
+        UIWindowAppFeedback({
+            app: options.app_uuid || app_name,
+            source: 'app',
+        });
+    });
 
     // showWindow forces the drawer shut when the window is restored — the
     // intro already ran on open, and a restore should bring back the app,

src/gui/src/UI/UIWindowAppFeedback.js

@@ -0,0 +1,254 @@
+/*
+ * Copyright (C) 2024-present Puter Technologies Inc.
+ *
+ * This file is part of Puter.
+ *
+ * Puter is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published
+ * by the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <https://www.gnu.org/licenses/>.
+ */
+
+// Keep in sync with AppFeedbackService.MESSAGE_MAX_LENGTH on the backend.
+const MESSAGE_MAX_LENGTH = 4000;
+const SUCCESS_AUTOCLOSE_MS = 1600;
+
+let feedback_modal_seq = 0;
+
+/**
+ * "Send feedback to this app's developer" modal, behind
+ * `puter.ui.showFeedbackDialog()`. Not to be confused with UIWindowFeedback,
+ * which is Puter's own Contact Us form.
+ *
+ * Deliberately NOT a UIWindow: it's a from-scratch, theme-aware overlay in
+ * the same spirit as the dashboard modals (uninstall, add-app), so it renders
+ * consistently in every context it's opened from — the desktop (app IPC), the
+ * dashboard app-drawer, and the standalone puter.com popup.
+ *
+ * The target is named by exactly one of `options.app` (app uid or name — the
+ * desktop/drawer paths know which app asked) or `options.origin` (the popup
+ * path's browser-attested opener origin). The modal pre-flights the target
+ * against `GET /app-feedback/target` — feedback is opt-in per app, and the
+ * server is the authority on the app's canonical title — then submits to
+ * `POST /app-feedback`.
+ *
+ * @param {{ app?: string, origin?: string, source?: 'app' | 'web' }} options
+ * @returns {Promise<boolean>} true iff feedback was submitted successfully.
+ *   Resolves false on cancel/close/unavailable — never rejects, so IPC and
+ *   popup callers can always report an answer.
+ */
+async function UIWindowAppFeedback (options) {
+    options = options ?? {};
+
+    return new Promise((resolve) => {
+        const modal_id = `app-feedback-${++feedback_modal_seq}`;
+        let settled = false;
+        let sending = false;
+        let closed = false;
+
+        const authToken = puter.authToken ?? window.auth_token;
+        const target_params = options.app
+            ? { app: options.app }
+            : { origin: options.origin };
+
+        // Mirror what AppFeedbackService actually shares: the username
+        // always, the sender's email only when it exists and is verified
+        // (unverified addresses get no Reply-To, so the developer cannot
+        // respond). The note must not promise either more or less.
+        const shares_email = Boolean(window.user?.email && window.user?.email_confirmed);
+        const privacy_note_key = shares_email
+            ? 'app_feedback_privacy_note'
+            : 'app_feedback_privacy_note_no_email';
+
+        const titleId = `${modal_id}-title`;
+        const h = `
+            <div class="app-feedback-overlay" role="dialog" aria-modal="true" aria-labelledby="${titleId}">
+                <div class="app-feedback-modal" tabindex="-1">
+                    <div class="app-feedback-head">
+                        <h2 class="app-feedback-title" id="${titleId}">${i18n('app_feedback_title')}</h2>
+                        <button type="button" class="app-feedback-x" aria-label="${html_encode(i18n('close'))}" title="${html_encode(i18n('close'))}">
+                            <svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.2" stroke-linecap="round" aria-hidden="true"><line x1="6" y1="6" x2="18" y2="18"/><line x1="18" y1="6" x2="6" y2="18"/></svg>
+                        </button>
+                    </div>
+                    <div class="app-feedback-body">
+                        <div class="app-feedback-loading">${i18n('loading')}…</div>
+
+                        <div class="app-feedback-unavailable" style="display:none;">
+                            <p class="app-feedback-unavailable-message"></p>
+                            <div class="app-feedback-actions">
+                                <button type="button" class="app-feedback-btn app-feedback-btn-primary app-feedback-close-btn">${i18n('close')}</button>
+                            </div>
+                        </div>
+
+                        <div class="app-feedback-form" style="display:none;">
+                            <div class="app-feedback-target">
+                                <div class="app-feedback-target-title"></div>
+                                <div class="app-feedback-target-name"></div>
+                            </div>
+                            <p class="app-feedback-c2a">${i18n('app_feedback_c2a')}</p>
+                            <textarea class="app-feedback-message" maxlength="${MESSAGE_MAX_LENGTH}" placeholder="${html_encode(i18n('app_feedback_placeholder'))}"></textarea>
+                            <div class="app-feedback-counter">0 / ${MESSAGE_MAX_LENGTH}</div>
+                            <p class="app-feedback-note">${i18n(privacy_note_key)}</p>
+                            <p class="app-feedback-error" role="alert" style="display:none;"></p>
+                            <div class="app-feedback-actions">
+                                <button type="button" class="app-feedback-btn app-feedback-cancel-btn">${i18n('cancel')}</button>
+                                <button type="button" class="app-feedback-btn app-feedback-btn-primary app-feedback-send-btn" disabled>${i18n('send')}</button>
+                            </div>
+                        </div>
+
+                        <div class="app-feedback-success" style="display:none;">
+                            <div class="app-feedback-success-check" aria-hidden="true">
+                                <svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.4" stroke-linecap="round" stroke-linejoin="round"><path d="M20 6 9 17l-5-5"/></svg>
+                            </div>
+                            <p class="app-feedback-success-text">${i18n('app_feedback_sent')}</p>
+                        </div>
+                    </div>
+                </div>
+            </div>
+        `;
+
+        const $overlay = $(h);
+        $('body').append($overlay);
+        // Kick the entrance transition on the next frame.
+        requestAnimationFrame(() => $overlay.addClass('app-feedback-open'));
+
+        const settle = (sent) => {
+            if ( settled ) return;
+            settled = true;
+            resolve(sent === true);
+        };
+        const close = () => {
+            if ( closed ) return;
+            closed = true;
+            $(document).off(`keydown.${modal_id}`);
+            $overlay.removeClass('app-feedback-open');
+            // Let the exit transition play, then remove.
+            setTimeout(() => $overlay.remove(), 160);
+            settle(false); // no-op if already settled true on success
+        };
+
+        const showPane = (pane) => {
+            $overlay.find('.app-feedback-loading, .app-feedback-unavailable, .app-feedback-form, .app-feedback-success').hide();
+            $overlay.find(`.app-feedback-${pane}`).show();
+        };
+        const showUnavailable = (messageKey) => {
+            $overlay.find('.app-feedback-unavailable-message').text(i18n(messageKey));
+            showPane('unavailable');
+        };
+
+        // Escape closes (unless a submit is in flight); backdrop click closes.
+        $(document).on(`keydown.${modal_id}`, (e) => {
+            if ( e.key === 'Escape' && ! sending ) close();
+        });
+        $overlay.on('mousedown', (e) => {
+            if ( e.target === $overlay.get(0) && ! sending ) close();
+        });
+        // Same in-flight gate as Escape/backdrop: closing while the POST is
+        // pending would settle false for a submission that still lands
+        // server-side — the developer gets the email while the app is told
+        // nothing was sent.
+        $overlay.find('.app-feedback-x, .app-feedback-close-btn, .app-feedback-cancel-btn').on('click', () => {
+            if ( ! sending ) close();
+        });
+
+        $overlay.find('.app-feedback-message').on('input', function () {
+            $overlay.find('.app-feedback-counter').text(`${this.value.length} / ${MESSAGE_MAX_LENGTH}`);
+            $overlay.find('.app-feedback-send-btn').prop('disabled', sending || this.value.trim() === '');
+        });
+
+        const send = async () => {
+            const $btn = $overlay.find('.app-feedback-send-btn');
+            const message = String($overlay.find('.app-feedback-message').val() || '').trim();
+            if ( ! message || sending ) return;
+            sending = true;
+            $btn.prop('disabled', true);
+            $overlay.find('.app-feedback-x, .app-feedback-cancel-btn').prop('disabled', true);
+            $overlay.find('.app-feedback-error').hide();
+            try {
+                const res = await fetch(`${window.api_origin}/app-feedback`, {
+                    method: 'POST',
+                    headers: {
+                        'Content-Type': 'application/json',
+                        'Authorization': `Bearer ${authToken}`,
+                    },
+                    body: JSON.stringify({
+                        ...target_params,
+                        message,
+                        context: options.source,
+                    }),
+                });
+                if ( ! res.ok ) {
+                    let code;
+                    try {
+                        code = (await res.json())?.code;
+                    } catch ( _e ) {
+                        // Non-JSON error body; fall through to the generic message.
+                    }
+                    if ( code === 'feedback_not_enabled' ) {
+                        showUnavailable('app_feedback_not_available');
+                        return;
+                    }
+                    const key = res.status === 429 ? 'app_feedback_rate_limited' : 'app_feedback_error';
+                    $overlay.find('.app-feedback-error').text(i18n(key)).show();
+                    return;
+                }
+                settle(true);
+                showPane('success');
+                setTimeout(close, SUCCESS_AUTOCLOSE_MS);
+            } catch ( e ) {
+                // Shown inside the form so the message survives for a retry.
+                console.error('app-feedback: submit failed', e);
+                $overlay.find('.app-feedback-error').text(i18n('app_feedback_error')).show();
+            } finally {
+                sending = false;
+                $overlay.find('.app-feedback-x, .app-feedback-cancel-btn').prop('disabled', false);
+                $overlay.find('.app-feedback-send-btn').prop('disabled',
+                    settled || String($overlay.find('.app-feedback-message').val() || '').trim() === '');
+            }
+        };
+
+        $overlay.find('.app-feedback-send-btn').on('click', send);
+        // Enter alone belongs to the textarea (feedback may need paragraphs).
+        $overlay.find('.app-feedback-message').on('keydown', (e) => {
+            if ( e.key === 'Enter' && (e.metaKey || e.ctrlKey) ) {
+                e.preventDefault();
+                send();
+            }
+        });
+
+        // -- Pre-flight: is this app accepting feedback, and what is it
+        // called? The server is the authority — a title passed by the caller
+        // could impersonate another app.
+        (async () => {
+            try {
+                const res = await fetch(`${window.api_origin}/app-feedback/target?${new URLSearchParams(target_params)}`, {
+                    headers: { 'Authorization': `Bearer ${authToken}` },
+                });
+                if ( ! res.ok ) throw new Error(`target check responded ${res.status}`);
+                const target = await res.json();
+                if ( closed ) return;
+                if ( ! target.enabled ) {
+                    showUnavailable('app_feedback_not_available');
+                    return;
+                }
+                $overlay.find('.app-feedback-target-title').text(target.app?.title ?? '');
+                $overlay.find('.app-feedback-target-name').text(target.app?.name ?? '');
+                showPane('form');
+                $overlay.find('.app-feedback-message').get(0)?.focus({ preventScroll: true });
+            } catch ( e ) {
+                console.error('app-feedback: target check failed', e);
+                if ( ! closed ) showUnavailable('app_feedback_error');
+            }
+        })();
+    });
+}
+
+export default UIWindowAppFeedback;

src/gui/src/css/dashboard.css

@@ -1523,6 +1523,279 @@ input.myapps-group-name:focus {
     cursor: default;
 }
 
+/* App feedback modal (puter.ui.showFeedbackDialog) — a from-scratch,
+   theme-aware overlay in the spirit of the modals above, but used from more
+   than the dashboard (the desktop app-IPC path and the standalone popup too).
+   Self-contained color tokens (light default + dark override) so it themes
+   correctly wherever it's mounted, independent of the dashboard variables. */
+.app-feedback-overlay {
+    --afb-bg: #ffffff;
+    --afb-fg: #16202b;
+    --afb-muted: #64748b;
+    --afb-border: rgba(15, 23, 42, 0.12);
+    --afb-field-bg: #ffffff;
+    --afb-field-border: rgba(15, 23, 42, 0.18);
+    --afb-hover: rgba(15, 23, 42, 0.05);
+    --afb-scrim: rgba(0, 0, 0, 0.5);
+    --afb-error: #c62828;
+
+    position: fixed;
+    inset: 0;
+    /* Above app windows, the popup shell, and the drawer. */
+    z-index: 2147483000;
+    display: flex;
+    align-items: center;
+    justify-content: center;
+    padding: 20px;
+    box-sizing: border-box;
+    background: var(--afb-scrim);
+    opacity: 0;
+    transition: opacity 0.16s ease;
+    -webkit-font-smoothing: antialiased;
+}
+.app-feedback-overlay.app-feedback-open {
+    opacity: 1;
+}
+
+@media (prefers-color-scheme: dark) {
+    .app-feedback-overlay {
+        --afb-bg: #24262c;
+        --afb-fg: #e8ecf1;
+        --afb-muted: #9aa7b4;
+        --afb-border: rgba(255, 255, 255, 0.12);
+        --afb-field-bg: #1b1d22;
+        --afb-field-border: rgba(255, 255, 255, 0.16);
+        --afb-hover: rgba(255, 255, 255, 0.08);
+        --afb-scrim: rgba(0, 0, 0, 0.66);
+        --afb-error: #ff6b81;
+    }
+}
+
+.app-feedback-modal {
+    width: min(440px, 100%);
+    max-height: calc(100vh - 40px);
+    overflow-y: auto;
+    background: var(--afb-bg);
+    color: var(--afb-fg);
+    border: 1px solid var(--afb-border);
+    border-radius: 14px;
+    box-shadow: 0 18px 48px rgba(0, 0, 0, 0.32);
+    transform: translateY(8px) scale(0.98);
+    transition: transform 0.16s ease;
+    outline: none;
+}
+.app-feedback-open .app-feedback-modal {
+    transform: none;
+}
+
+.app-feedback-head {
+    display: flex;
+    align-items: center;
+    justify-content: space-between;
+    padding: 16px 16px 0 20px;
+}
+.app-feedback-title {
+    margin: 0;
+    font-size: 17px;
+    font-weight: 600;
+}
+.app-feedback-x {
+    display: flex;
+    align-items: center;
+    justify-content: center;
+    width: 30px;
+    height: 30px;
+    flex: none;
+    padding: 0;
+    border: none;
+    border-radius: 50%;
+    background: none;
+    color: var(--afb-muted);
+    cursor: pointer;
+    transition: background-color 0.12s ease, color 0.12s ease;
+}
+.app-feedback-x svg {
+    width: 16px;
+    height: 16px;
+}
+@media (hover: hover) {
+    .app-feedback-x:hover:not(:disabled) {
+        background: var(--afb-hover);
+        color: var(--afb-fg);
+    }
+}
+
+.app-feedback-body {
+    padding: 12px 20px 20px;
+}
+
+.app-feedback-loading {
+    text-align: center;
+    color: var(--afb-muted);
+    padding: 28px 10px;
+    font-size: 14px;
+}
+
+.app-feedback-target {
+    margin-bottom: 14px;
+}
+.app-feedback-target-title {
+    font-size: 15px;
+    font-weight: 600;
+    word-break: break-word;
+}
+.app-feedback-target-name {
+    font-size: 12px;
+    color: var(--afb-muted);
+    word-break: break-all;
+    margin-top: 2px;
+}
+
+.app-feedback-c2a {
+    margin: 0 0 10px;
+    font-size: 14px;
+    line-height: 1.45;
+}
+.app-feedback-unavailable-message {
+    margin: 8px 0 4px;
+    font-size: 14px;
+    line-height: 1.45;
+    text-align: center;
+    color: var(--afb-muted);
+}
+
+.app-feedback-message {
+    display: block;
+    width: 100%;
+    box-sizing: border-box;
+    min-height: 130px;
+    resize: vertical;
+    padding: 10px 12px;
+    font: inherit;
+    font-size: 14px;
+    line-height: 1.45;
+    color: var(--afb-fg);
+    background: var(--afb-field-bg);
+    border: 1px solid var(--afb-field-border);
+    border-radius: 8px;
+    transition: border-color 0.12s ease, box-shadow 0.12s ease;
+}
+.app-feedback-message:focus {
+    outline: none;
+    border-color: #088ef0;
+    box-shadow: 0 0 0 3px rgba(8, 142, 240, 0.18);
+}
+.app-feedback-message::placeholder {
+    color: var(--afb-muted);
+}
+
+.app-feedback-counter {
+    text-align: right;
+    font-size: 11px;
+    color: var(--afb-muted);
+    margin-top: 4px;
+}
+.app-feedback-note {
+    margin: 8px 0 0;
+    font-size: 12px;
+    line-height: 1.4;
+    color: var(--afb-muted);
+}
+.app-feedback-error {
+    margin: 10px 0 0;
+    font-size: 13px;
+    line-height: 1.4;
+    color: var(--afb-error);
+}
+
+.app-feedback-actions {
+    display: flex;
+    justify-content: flex-end;
+    gap: 10px;
+    margin-top: 18px;
+}
+.app-feedback-btn {
+    padding: 8px 18px;
+    font: inherit;
+    font-size: 14px;
+    font-weight: 500;
+    border-radius: 8px;
+    border: 1px solid var(--afb-field-border);
+    background: var(--afb-bg);
+    color: var(--afb-fg);
+    cursor: pointer;
+    transition: background-color 0.12s ease, opacity 0.12s ease, filter 0.12s ease;
+}
+@media (hover: hover) {
+    .app-feedback-btn:hover:not(:disabled) {
+        background: var(--afb-hover);
+    }
+}
+.app-feedback-btn-primary {
+    border-color: #088ef0;
+    background: linear-gradient(#34a5f8, #088ef0);
+    color: #fff;
+}
+@media (hover: hover) {
+    .app-feedback-btn-primary:hover {
+        filter: brightness(1.05);
+        background: linear-gradient(#34a5f8, #088ef0);
+    }
+}
+.app-feedback-btn-primary:disabled {
+    opacity: 0.5;
+    cursor: default;
+    filter: none;
+}
+/* Cancel/X are disabled while a submit is in flight. */
+.app-feedback-btn:disabled,
+.app-feedback-x:disabled {
+    opacity: 0.5;
+    cursor: default;
+}
+
+.app-feedback-success {
+    text-align: center;
+    padding: 18px 10px 8px;
+}
+.app-feedback-success-check {
+    width: 52px;
+    height: 52px;
+    margin: 0 auto 12px;
+    display: flex;
+    align-items: center;
+    justify-content: center;
+    border-radius: 50%;
+    background: rgba(34, 197, 94, 0.14);
+    color: #16a34a;
+}
+.app-feedback-success-check svg {
+    width: 28px;
+    height: 28px;
+}
+.app-feedback-success-text {
+    margin: 0;
+    font-size: 15px;
+    font-weight: 500;
+}
+
+/* Bottom-sheet on narrow screens. */
+@media (max-width: 500px) {
+    .app-feedback-overlay {
+        padding: 0;
+        align-items: flex-end;
+    }
+    .app-feedback-modal {
+        width: 100%;
+        max-height: 92vh;
+        border-radius: 14px 14px 0 0;
+        transform: translateY(16px);
+    }
+    .app-feedback-open .app-feedback-modal {
+        transform: none;
+    }
+}
+
 /* Add-an-app chooser (see showAddAppModal): the three ways to get an app, as
    rows in the same modal shell. min-width gives the two-line rows room without
    overflowing a narrow phone; the shell's own max-width caps the other end. */
@@ -5390,6 +5663,13 @@ body.dashboard-mode .window-dashboard-headless .window-body-app {
         opacity 0.2s ease;
 }
 
+/* An opted-in app carries a third control (feedback) before minimize; widen
+   the derived open surface by one button + its 2px gap so the trailing close
+   button isn't clipped. --open-w stays derived from the same parts. */
+.dashboard-app-drawer.has-feedback {
+    --open-w: calc(12px + var(--icon) + var(--i2t) + var(--title-w) + var(--t2b) + var(--btn) + 2px + var(--btn) + 2px + var(--btn) + 10px);
+}
+
 .dashboard-app-drawer.collapsed {
     width: var(--shut-w);
     height: calc(var(--shut-h) + var(--safe-top));
@@ -5574,6 +5854,7 @@ body.dashboard-mode .window-dashboard-headless .window-body-app {
     transition: background-color 0.12s ease;
 }
 
+.dashboard-app-drawer-feedback,
 .dashboard-app-drawer-minimize {
     margin-right: 2px;
 }

src/gui/src/css/style.css

@@ -5872,6 +5872,10 @@ html.dark-mode .usage-table-show-less:hover {
     height: initial !important;
 }
 
+.device-phone .window.window-app-feedback {
+    height: initial !important;
+}
+
 .device-phone .window.window-filedialog {
     transform: none;
     width: 100% !important;

src/gui/src/helpers/launch_app.js

@@ -558,6 +558,13 @@ const launch_app = async (options) => {
         // Add locale to URL
         iframe_url.searchParams.append('puter.locale', window.locale);
 
+        // Newer IPC dialogs this GUI can answer, comma-separated. The SDK
+        // consults this before posting a message an older GUI has no handler
+        // for: such a message is never replied to, and a reply timeout can't
+        // stand in for the check because legitimate replies only arrive when
+        // the user closes the dialog.
+        iframe_url.searchParams.append('puter.gui_features', 'feedback-dialog');
+
         // Add options.args to URL
         iframe_url.searchParams.append('puter.args', JSON.stringify(options.args ?? {}));
 
@@ -678,6 +685,9 @@ const launch_app = async (options) => {
             window_class: 'window-app',
             update_window_url: true,
             app_uuid: app_info.uuid ?? app_info.uid,
+            // Surfaced on the dashboard app-drawer as a "Send Feedback"
+            // control when the developer opted in (apps.feedbackEnabled).
+            feedback_enabled: app_info.feedback_enabled,
             top: top,
             left: left,
             height: window_height,

src/gui/src/i18n/translations/en.js

@@ -42,6 +42,15 @@ const en = {
         ai_app_unavailable: 'AI app is not available. Please try again later.',
         all_fields_required: 'All fields are required.',
         allow: 'Allow',
+        app_feedback_c2a: 'Your feedback will be sent directly to the developer of this app.',
+        app_feedback_error: 'Something went wrong. Please try again.',
+        app_feedback_not_available: 'This app is not accepting feedback right now.',
+        app_feedback_placeholder: 'What is working well? What could be better?',
+        app_feedback_privacy_note: 'Your username and email address will be shared with the developer so they can respond.',
+        app_feedback_privacy_note_no_email: 'Your username will be shared with the developer.',
+        app_feedback_rate_limited: "You've sent a lot of feedback recently. Please try again later.",
+        app_feedback_sent: 'Feedback sent. Thank you!',
+        app_feedback_title: 'Send Feedback',
         app_group_default_name: 'Folder',
         app_group_name_aria: 'Folder name',
         app_group_open: 'Open',

src/gui/src/initgui.js

@@ -23,6 +23,7 @@ import UIAlert from './UI/UIAlert.js';
 import UIComponentWindow from './UI/UIComponentWindow.js';
 import UIDesktop from './UI/UIDesktop.js';
 import UIWindow from './UI/UIWindow.js';
+import UIWindowAppFeedback from './UI/UIWindowAppFeedback.js';
 import UIWindowAuthMe from './UI/UIWindowAuthMe.js';
 import UIWindowChangeUsername from './UI/UIWindowChangeUsername.js';
 import UIWindowCopyToken from './UI/UIWindowCopyToken.js';
@@ -71,7 +72,7 @@ import { ThemeService } from './services/ThemeService.js';
 // silently resolve to the factory — use `window.privacy_aware_path` instead.
 import { privacy_aware_path as privacy_aware_path_factory } from './util/desktop.js';
 import { resolveAPIOrigin } from './util/apiOrigin.js';
-import { deliversTokenToOpener } from './util/popupAuth.js';
+import { deliversTokenToOpener, runsUserAppTokenExchange } from './util/popupAuth.js';
 import { verifyOidcPopupReturn } from './util/popupOidcReturn.js';
 
 const postAuthActions = async (action) => {
@@ -366,7 +367,7 @@ const postAuthActions = async (action) => {
                 });
             }
             return;
-        } else {
+        } else if ( runsUserAppTokenExchange(action) ) {
             const deliver_token_to_opener = deliversTokenToOpener(action);
             try {
                 let data = await window.getUserAppToken(new URL(window.openerOrigin).origin);
@@ -735,6 +736,62 @@ const postAuthActions = async (action) => {
             window.open('', '_self').close();
         }
     }
+
+    // -------------------------------------------------------------------------------------
+    // Action: Send Feedback — show the app-feedback dialog for the site that opened this
+    // popup and report whether feedback was sent back to the opener. Runs post-auth so
+    // signed-out users go through sign-in/signup first.
+    // -------------------------------------------------------------------------------------
+    if ( action === 'send-feedback' ) {
+        const msg_id = window.url_query_params.get('msg_id');
+        // Browser-attested only, same rule as request-permission above: the
+        // origin names the app the feedback is recorded against (the server
+        // resolves origin → app), so a link must not get to state it. The
+        // dialog itself refuses when the resolved app hasn't opted in.
+        const origin = window.openerOrigin;
+
+        // Whatever happens, the requester must get an answer and the popup
+        // must close — otherwise it wedges open with the caller's promise
+        // pending until the user closes it by hand.
+        let sent = false;
+        try {
+            if ( ! origin ) {
+                throw new Error('no opener origin; not prompting');
+            }
+            sent = await UIWindowAppFeedback({
+                origin,
+                source: 'web',
+            });
+        } catch (e) {
+            console.error('send-feedback action failed', e);
+        }
+
+        // `postMessage` throws a SyntaxError on a targetOrigin that isn't a
+        // parseable URL — an unparseable one would take out the answer *and*
+        // the close below.
+        let target_origin = '*';
+        try {
+            target_origin = origin ? new URL(origin).origin : '*';
+        } catch (e) {
+            console.error('send-feedback: unusable origin', origin);
+        }
+        const messageTarget = window.embedded_in_popup ? window.opener : window.parent;
+        try {
+            messageTarget?.postMessage({
+                msg: 'feedbackDialogClosed',
+                sent: sent === true,
+                original_msg_id: msg_id,
+            }, target_origin);
+        } catch (e) {
+            console.error('send-feedback: could not answer the requester', e);
+        }
+
+        // The popup exists only to host this dialog; close it once answered.
+        if ( window.embedded_in_popup ) {
+            window.close();
+            window.open('', '_self').close();
+        }
+    }
 };
 
 const launch_services = async function (options) {
@@ -2123,37 +2180,39 @@ window.initgui = async function (options) {
                             (async () => {
                                 let closing = false;
                                 try {
-                                    let msg_id =
-                                        window.url_query_params.get('msg_id');
-                                    let data = await window.getUserAppToken(
-                                        new URL(window.openerOrigin).origin,
-                                    );
-                                    // A network failure here returns null and
-                                    // an HTTP failure returns the parsed error
-                                    // body, neither of which carries a token;
-                                    // the reads below would fault or hand the
-                                    // opener an `undefined` token.
-                                    if (!data?.token) {
-                                        throw new Error(
-                                            'user-app token exchange returned no token',
-                                        );
-                                    }
-                                    // This is an implicit app and the app_uid is sent back from the server
-                                    // we cache it here so that we can use it later
-                                    window.host_app_uid = data.app_uid;
-                                    // send token to parent
-                                    if (deliversTokenToOpener(action)) {
-                                        window.opener?.postMessage(
-                                            {
-                                                msg: 'puter.token',
-                                                success: true,
-                                                msg_id: msg_id,
-                                                token: data.token,
-                                                username: window.user.username,
-                                                app_uid: data.app_uid,
-                                            },
-                                            window.openerOrigin,
+                                    if (runsUserAppTokenExchange(action)) {
+                                        let msg_id =
+                                            window.url_query_params.get('msg_id');
+                                        let data = await window.getUserAppToken(
+                                            new URL(window.openerOrigin).origin,
                                         );
+                                        // A network failure here returns null and
+                                        // an HTTP failure returns the parsed error
+                                        // body, neither of which carries a token;
+                                        // the reads below would fault or hand the
+                                        // opener an `undefined` token.
+                                        if (!data?.token) {
+                                            throw new Error(
+                                                'user-app token exchange returned no token',
+                                            );
+                                        }
+                                        // This is an implicit app and the app_uid is sent back from the server
+                                        // we cache it here so that we can use it later
+                                        window.host_app_uid = data.app_uid;
+                                        // send token to parent
+                                        if (deliversTokenToOpener(action)) {
+                                            window.opener?.postMessage(
+                                                {
+                                                    msg: 'puter.token',
+                                                    success: true,
+                                                    msg_id: msg_id,
+                                                    token: data.token,
+                                                    username: window.user.username,
+                                                    app_uid: data.app_uid,
+                                                },
+                                                window.openerOrigin,
+                                            );
+                                        }
                                     }
                                     // close popup
                                     if (!action || action === 'sign-in') {
@@ -2216,32 +2275,34 @@ window.initgui = async function (options) {
                         if (window.embedded_in_popup)
                             (async () => {
                                 try {
-                                    let msg_id =
-                                        window.url_query_params.get('msg_id');
-                                    let data = await window.getUserAppToken(
-                                        new URL(window.openerOrigin).origin,
-                                    );
-                                    if (!data?.token) {
-                                        throw new Error(
-                                            'user-app token exchange returned no token',
-                                        );
-                                    }
-                                    // This is an implicit app and the app_uid is sent back from the server
-                                    // we cache it here so that we can use it later
-                                    window.host_app_uid = data.app_uid;
-                                    // send token to parent
-                                    if (deliversTokenToOpener(action)) {
-                                        window.opener?.postMessage(
-                                            {
-                                                msg: 'puter.token',
-                                                success: true,
-                                                msg_id: msg_id,
-                                                token: data.token,
-                                                username: window.user.username,
-                                                app_uid: data.app_uid,
-                                            },
-                                            window.openerOrigin,
+                                    if (runsUserAppTokenExchange(action)) {
+                                        let msg_id =
+                                            window.url_query_params.get('msg_id');
+                                        let data = await window.getUserAppToken(
+                                            new URL(window.openerOrigin).origin,
                                         );
+                                        if (!data?.token) {
+                                            throw new Error(
+                                                'user-app token exchange returned no token',
+                                            );
+                                        }
+                                        // This is an implicit app and the app_uid is sent back from the server
+                                        // we cache it here so that we can use it later
+                                        window.host_app_uid = data.app_uid;
+                                        // send token to parent
+                                        if (deliversTokenToOpener(action)) {
+                                            window.opener?.postMessage(
+                                                {
+                                                    msg: 'puter.token',
+                                                    success: true,
+                                                    msg_id: msg_id,
+                                                    token: data.token,
+                                                    username: window.user.username,
+                                                    app_uid: data.app_uid,
+                                                },
+                                                window.openerOrigin,
+                                            );
+                                        }
                                     }
                                 } catch (err) {
                                     console.error(

src/gui/src/util/popupAuth.js

@@ -34,14 +34,15 @@
  */
 
 /** Popup actions that exist to answer a question, not to authenticate. */
-const NON_AUTH_POPUP_ACTIONS = new Set(['request-permission']);
+const NON_AUTH_POPUP_ACTIONS = new Set(['request-permission', 'send-feedback']);
 
 /**
  * Whether a popup running `action` may post `puter.token` to its opener.
  *
- * The token exchange itself still runs for the excluded actions — it bootstraps
+ * For `request-permission` the token exchange itself still runs — it bootstraps
  * the app row a permission grant needs and caches `host_app_uid` — only the
- * hand-off to the opener is suppressed.
+ * hand-off to the opener is suppressed. `send-feedback` skips the exchange
+ * entirely; see {@link runsUserAppTokenExchange}.
  *
  * @param {string|null|undefined} action - The popup's `action`, as parsed from
  *   the URL (`/action/<name>` or `?action=<name>`); undefined for a plain
@@ -51,6 +52,32 @@ const NON_AUTH_POPUP_ACTIONS = new Set(['request-permission']);
 export const deliversTokenToOpener = (action) =>
     !NON_AUTH_POPUP_ACTIONS.has(action);
 
+/**
+ * Popup actions that must not run the user-app token exchange at all.
+ *
+ * The exchange (`/auth/get-user-app-token`) is a write, not a read: it
+ * bootstraps an app row for the opener origin, grants
+ * `flag:app-is-authenticated` (what makes the site count as connected to the
+ * account), and creates the app's per-user AppData directory. Sign-in and
+ * file-picker popups need that, and `request-permission` needs the
+ * bootstrapped app row a grant is written against — but a send-feedback popup
+ * only ever *reads* app identity from its attested origin server-side, so
+ * merely opening (or cancelling) the feedback dialog must not record a
+ * user↔site relationship.
+ */
+const TOKEN_EXCHANGE_FREE_ACTIONS = new Set(['send-feedback']);
+
+/**
+ * Whether a popup running `action` runs the user-app token exchange.
+ *
+ * @param {string|null|undefined} action - The popup's `action`, as parsed from
+ *   the URL (`/action/<name>` or `?action=<name>`); undefined for a plain
+ *   sign-in popup.
+ * @returns {boolean} `true` if the exchange should run for this popup.
+ */
+export const runsUserAppTokenExchange = (action) =>
+    !TOKEN_EXCHANGE_FREE_ACTIONS.has(action);
+
 /*
  * On the `opener_origin` URL parameter, which this module used to gate.
  *

src/gui/src/util/popupAuth.test.js

@@ -22,6 +22,7 @@ import * as popupAuth from './popupAuth.js';
 import {
     deliversTokenToOpener,
     offersFederatedSignInInPopup,
+    runsUserAppTokenExchange,
 } from './popupAuth.js';
 
 describe('deliversTokenToOpener', () => {
@@ -32,6 +33,11 @@ describe('deliversTokenToOpener', () => {
         expect(deliversTokenToOpener('request-permission')).toBe(false);
     });
 
+    it('withholds the token from a feedback popup', () => {
+        // Sending feedback is not consent to sign the site in either.
+        expect(deliversTokenToOpener('send-feedback')).toBe(false);
+    });
+
     it('delivers the token for the sign-in flows that exist to authenticate', () => {
         // `undefined` is a plain sign-in popup, which carries no action.
         for ( const action of [undefined, 'sign-in'] ) {
@@ -68,6 +74,32 @@ describe('offersFederatedSignInInPopup', () => {
     });
 });
 
+describe('runsUserAppTokenExchange', () => {
+    it('skips the exchange entirely for a feedback popup', () => {
+        // The exchange is a write, not a read: it bootstraps an app row for
+        // the opener origin and records the user↔site relationship. The
+        // feedback flow resolves app identity read-only from the attested
+        // origin server-side, so opening (or cancelling) the dialog must not
+        // connect the site to the account.
+        expect(runsUserAppTokenExchange('send-feedback')).toBe(false);
+    });
+
+    it('runs it for sign-in, the pickers, and the permission prompt', () => {
+        // request-permission keeps the exchange: the app row it bootstraps is
+        // what a grant is written against.
+        for ( const action of [
+            undefined,
+            'sign-in',
+            'show-open-file-picker',
+            'show-directory-picker',
+            'show-save-file-picker',
+            'request-permission',
+        ] ) {
+            expect(runsUserAppTokenExchange(action)).toBe(true);
+        }
+    });
+});
+
 describe('the retired opener_origin gate', () => {
     it('is gone, because no action believes the raw parameter now', () => {
         // It used to allow `opener_origin` for every action but

src/puter-js/src/modules/UI.js

@@ -1917,6 +1917,172 @@ export class UIModule extends EventListener {
         });
     };
 
+    /**
+     * Opens a dialog the user can use to send feedback to this app's
+     * developer. The message is delivered by Puter (stored and emailed to the
+     * developer); it never passes through the app. Requires the developer to
+     * have opted in by setting `feedbackEnabled` on the app — otherwise the
+     * dialog tells the user feedback is unavailable.
+     *
+     * In the `app` environment the Puter desktop renders the dialog; in the
+     * `web` environment a puter.com popup hosts it (signing the user in first
+     * if needed). Every other environment resolves `false`.
+     *
+     * @returns {Promise<boolean>} `true` when the user submitted feedback,
+     *   `false` when the dialog was dismissed or feedback is unavailable.
+     *   Never rejects. On a cross-origin-isolated page COOP severs the
+     *   popup's link to the opener, so the promise resolves `false` while
+     *   the popup stays open and the user may still submit — `false` means
+     *   "not confirmed", not "not sent".
+     */
+    async showFeedbackDialog () {
+        if ( this.env === 'app' ) {
+            // The host GUI advertises the IPC dialogs it can answer via
+            // `puter.gui_features` on the app iframe's URL (see
+            // launch_app.js). A GUI that predates this feature has no
+            // handler for the message and would never reply, hanging this
+            // never-rejecting promise forever — and a reply timeout can't
+            // stand in for the check, because a legitimate reply only
+            // arrives when the user closes the dialog.
+            const features = new URLSearchParams(globalThis.location?.search ?? '')
+                .get('puter.gui_features')?.split(',') ?? [];
+            if ( ! features.includes('feedback-dialog') ) {
+                return false;
+            }
+            const result = await this.#postMessageAsync('showFeedbackDialog', {});
+            return result?.sent === true;
+        }
+
+        // The popup flow is for third-party websites only. In every other
+        // environment it either can't work (workers and node have no window
+        // to open a popup from) or makes no sense. Those callers resolve
+        // false rather than reject — dialogs are resolve-only.
+        if ( this.env !== 'web' ) {
+            return false;
+        }
+        if ( ! globalThis.open || ! globalThis.document ) {
+            return false;
+        }
+
+        // See requestPermission: canonical-to-canonical origin comparison. A
+        // configured origin that can't parse can't host the dialog at all.
+        let gui_origin;
+        try {
+            gui_origin = new URL(puter.defaultGUIOrigin).origin;
+        } catch (e) {
+            return false;
+        }
+
+        // How long to wait, after the popup is observed closed, for a result
+        // message that may still be in flight.
+        const CLOSE_GRACE_MS = 1000;
+
+        return new Promise((resolve) => {
+            // Unique per request and not reused across page loads — same
+            // stale-popup collision reasoning as requestPermission. The app's
+            // identity is deliberately NOT in this URL: the GUI derives it
+            // from the browser-attested opener origin, so a link can't open a
+            // feedback dialog in another app's name.
+            const msg_id = `${this.#messageID++}-${Math.random().toString(36).slice(2, 10)}`;
+            const url = `${gui_origin}/action/send-feedback?embedded_in_popup=true&msg_id=${encodeURIComponent(msg_id)}`;
+
+            // Guards against settling more than once across the message,
+            // popup-closed, and dialog-cancel code paths.
+            let settled = false;
+            let checkClosed = null;
+            let popupWindow = null;
+            let consentDialog = null;
+
+            const cleanup = () => {
+                if ( checkClosed ) {
+                    clearInterval(checkClosed);
+                    checkClosed = null;
+                }
+                window.removeEventListener('message', messageHandler);
+                consentDialog?.remove();
+                consentDialog = null;
+            };
+
+            const settle = (sent) => {
+                if ( settled ) return;
+                settled = true;
+                cleanup();
+                resolve(sent === true);
+            };
+
+            const messageHandler = (e) => {
+                // Only accept the result from the Puter GUI origin AND from
+                // the popup we opened; msg_id binds it to this request. The
+                // GUI echoes msg_id back as a string, which the loose `!=`
+                // compares correctly.
+                if ( e.origin !== gui_origin ) return;
+                if ( popupWindow && e.source !== popupWindow ) return;
+                if ( e.data?.original_msg_id != msg_id ) return;
+                if ( e.data?.msg !== 'feedbackDialogClosed' ) return;
+                settle(e.data.sent === true);
+            };
+            window.addEventListener('message', messageHandler);
+
+            const watchPopup = (popup) => {
+                if ( settled ) return;
+                if ( ! popup ) {
+                    settle(false);
+                    return;
+                }
+                // Pin the expected event.source before anything can return
+                // early.
+                popupWindow = popup;
+                // A severed opener relationship (COOP) means the popup can't
+                // post the result back and `popup.closed` tells us nothing.
+                // Unlike a permission grant, a feedback submission can't be
+                // read back from the server, so the outcome is unknowable
+                // here: report false now rather than hang. The popup stays
+                // open — the user can still send their feedback.
+                if ( window.crossOriginIsolated || popup.closed ) {
+                    settle(false);
+                    return;
+                }
+                checkClosed = setInterval(() => {
+                    if ( ! popup.closed ) return;
+                    clearInterval(checkClosed);
+                    checkClosed = null;
+                    // The GUI posts the result and then closes the popup, and
+                    // cross-process postMessage delivery is not ordered
+                    // relative to `closed` becoming true — give an in-flight
+                    // result its grace period before treating the close as a
+                    // dismissal.
+                    setTimeout(() => settle(false), CLOSE_GRACE_MS);
+                }, 100);
+            };
+
+            // Every path out of here resolves a boolean, so anything that
+            // throws while launching has to resolve false rather than reject.
+            try {
+                if ( hasUserActivation() ) {
+                    // Unique window name per request: window.open() reuses a
+                    // window with the same name, which would hijack a popup an
+                    // earlier, still-pending request is waiting on.
+                    watchPopup(openAuthPopup(url, `puter-feedback-${msg_id}`));
+                } else {
+                    // No user gesture: a popup opened now would be blocked.
+                    // Show a consent dialog first; the popup is then opened
+                    // from the user's click on it.
+                    const dialog = new PuterDialog(() => {}, () => {}, {
+                        popupURL: url,
+                        popupName: `puter-feedback-${msg_id}`,
+                        onLaunch: (popup) => watchPopup(popup),
+                        onCancel: () => settle(false),
+                    });
+                    consentDialog = dialog;
+                    document.body.appendChild(dialog);
+                    dialog.open();
+                }
+            } catch (e) {
+                settle(false);
+            }
+        });
+    };
+
     /**
      * Greys out a menubar item so it cannot be clicked.
      *

src/puter-js/src/modules/apps/lib/appObject.js

@@ -26,4 +26,5 @@ export const toAppObject = (raw) => ({
     background: raw.background,
     filetype_associations: raw.filetypeAssociations,
     metadata: raw.metadata,
+    feedback_enabled: raw.feedbackEnabled,
 });

src/puter-js/src/modules/apps/types.js

@@ -32,6 +32,9 @@
  * @property {boolean} [maximize_on_start] Whether the app should be maximized when it is started.
  * Default is `false`.
  * @property {boolean} [background] Whether the app should run in the background. Default is `false`.
+ * @property {boolean} [feedback_enabled] Whether users can send feedback to the app's developer through
+ * `puter.ui.showFeedbackDialog()`. Default is `false` for apps created through `puter.apps.create`; the
+ * Dev Center enables it at creation.
  * @property {string[]} [filetype_associations] The file types that the app can open. Each string is in
  * the format `".<extension>"` or `"mime/type"`, e.g. `[".txt", "image/png"]`. For a directory
  * association, the string should be `.directory`.
@@ -85,6 +88,8 @@
  * @property {boolean} [maximizeOnStart] Whether the app should be maximized when it is started.
  * Defaults to `false`.
  * @property {boolean} [background] Whether the app should run in the background. Defaults to `false`.
+ * @property {boolean} [feedbackEnabled] Whether users can send feedback to the app's developer through
+ * `puter.ui.showFeedbackDialog()`. Defaults to `false`.
  * @property {string[]} [filetypeAssociations] The filetypes that the app can open. File extensions and
  * MIME types are supported, e.g. `[".txt", ".md", "application/pdf"]`. Defaults to `[]`.
  * @property {Record<string, unknown>} [metadata] Custom metadata for the app as arbitrary key-value pairs.
@@ -105,6 +110,8 @@
  * @property {boolean} [maximizeOnStart] Whether the app should be maximized when it is started.
  * Defaults to `false`.
  * @property {boolean} [background] Whether the app should run in the background. Defaults to `false`.
+ * @property {boolean} [feedbackEnabled] Whether users can send feedback to the app's developer through
+ * `puter.ui.showFeedbackDialog()`. Omitted leaves the app's current value unchanged.
  * @property {string[]} [filetypeAssociations] The filetypes that the app can open. File extensions and
  * MIME types are supported, e.g. `[".txt", ".md", "application/pdf"]`. Defaults to `[]`.
  * @property {Record<string, unknown>} [metadata] Custom metadata for the app as arbitrary key-value pairs.

src/puter-js/tests/api/suites/apps.suite.ts

@@ -144,6 +144,28 @@ export default suite('apps', {
         t.assert.equal(updated.description, 'New description');
     },
 
+    'feedbackEnabled round-trips on create and survives an unrelated update':
+        async (t) => {
+            // Mirrors Dev Center: create with feedback on, then a Save-style
+            // update that omits feedbackEnabled must not clear it.
+            const created = await t.puter.apps.create({
+                name: 'apps-suite-feedback',
+                indexURL: 'https://example.com/feedback',
+                feedbackEnabled: true,
+            });
+            t.assert.equal(Boolean(created.feedback_enabled), true);
+
+            const updated = await t.puter.apps.update('apps-suite-feedback', {
+                title: 'Feedback App',
+            });
+            t.assert.equal(Boolean(updated.feedback_enabled), true);
+
+            const disabled = await t.puter.apps.update('apps-suite-feedback', {
+                feedbackEnabled: false,
+            });
+            t.assert.equal(Boolean(disabled.feedback_enabled), false);
+        },
+
     'get of an unknown app rejects': async (t) => {
         await t.assert.rejects(
             () => t.puter.apps.get('apps-suite-does-not-exist'),

src/puter-js/tests/e2e/fixtures/send-feedback.html

@@ -0,0 +1,63 @@
+<!DOCTYPE html>
+<html>
+<head>
+    <meta charset="utf-8">
+    <title>puter-js test fixture: showFeedbackDialog</title>
+    <style>
+        body { font-family: system-ui, sans-serif; padding: 16px; }
+        button { padding: 8px 12px; margin-right: 8px; font-size: 14px; }
+        #log { margin-top: 16px; padding: 8px; background: #f5f5f5; border: 1px solid #ddd; min-height: 60px; font-family: monospace; white-space: pre-wrap; }
+        .ready #status { color: green; }
+    </style>
+</head>
+<body>
+    <h1>puter-js showFeedbackDialog fixture</h1>
+    <p id="status">Loading puter.js…</p>
+
+    <button id="send-feedback" disabled>Send Feedback</button>
+
+    <div id="log" data-testid="log"></div>
+
+    <script>
+        // Point the SDK at the local Puter instance (env=web popup flow).
+        window.PUTER_ORIGIN = 'http://puter.localhost:4100';
+        // Must be the real api subdomain: the SDK sends credentialed CORS
+        // requests, and only the api host answers with
+        // Access-Control-Allow-Credentials — on the GUI host they all fail.
+        window.PUTER_API_ORIGIN = 'http://api.puter.localhost:4100';
+    </script>
+    <script src="/dist/puter.dev.js"></script>
+    <script>
+        const logEl = document.getElementById('log');
+        const statusEl = document.getElementById('status');
+
+        function log(entry) {
+            const line = document.createElement('div');
+            line.textContent = entry;
+            line.dataset.entry = entry;
+            logEl.appendChild(line);
+        }
+
+        function ready() {
+            document.body.classList.add('ready');
+            statusEl.textContent = `Ready (env=${puter.env})`;
+            document.getElementById('send-feedback').disabled = false;
+        }
+
+        function waitForPuter() {
+            if (window.puter && puter.ui) ready();
+            else setTimeout(waitForPuter, 50);
+        }
+        waitForPuter();
+
+        document.getElementById('send-feedback').addEventListener('click', async () => {
+            try {
+                const sent = await puter.ui.showFeedbackDialog();
+                log(`feedback:${sent}`);
+            } catch (e) {
+                log(`feedback:error:${e?.message ?? e}`);
+            }
+        });
+    </script>
+</body>
+</html>

src/puter-js/tests/e2e/specs/showFeedbackDialog.spec.js

@@ -0,0 +1,188 @@
+import { test, expect } from '@playwright/test';
+import { registerTestApp, deleteTestApp, gotoTestApp, waitForPuterReady, FIXTURE_URL } from '../helpers/testApp.js';
+
+const FEEDBACK_FIXTURE_URL = FIXTURE_URL.replace(
+    'menubar-contextmenu.html',
+    'send-feedback.html',
+);
+
+/** Flips the app's opt-in flag through the same path developers use. */
+async function setFeedbackEnabled (page, appName, enabled) {
+    await page.goto('/');
+    await waitForPuterReady(page);
+    const result = await page.evaluate(
+        async ({ name, value }) => {
+            try {
+                const app = await window.puter.apps.update(name, { feedbackEnabled: value });
+                return { ok: true, feedback_enabled: app.feedback_enabled };
+            } catch (e) {
+                return { ok: false, error: String(e?.message ?? e) };
+            }
+        },
+        { name: appName, value: enabled },
+    );
+    if ( ! result.ok ) {
+        throw new Error(`apps.update({ feedbackEnabled }) failed: ${result.error}`);
+    }
+    // The flag round-trips through the driver's client serialization, so a
+    // wrong value here means the opt-in never landed and every assertion
+    // downstream would test the unavailable pane instead.
+    if ( result.feedback_enabled !== enabled ) {
+        throw new Error(`feedback_enabled is ${result.feedback_enabled}, expected ${enabled}`);
+    }
+}
+
+test.describe('puter.ui.showFeedbackDialog (env=app)', () => {
+    test('submitting feedback resolves true', async ({ page }) => {
+        const appName = await registerTestApp(page, { fixtureURL: FEEDBACK_FIXTURE_URL });
+        try {
+            await setFeedbackEnabled(page, appName, true);
+            const appFrame = await gotoTestApp(page, appName);
+
+            await appFrame.locator('#send-feedback').click();
+            const dialog = page.locator('.app-feedback-overlay');
+            await expect(dialog).toBeVisible();
+
+            // The form pane only appears after the server-side target check
+            // confirms the app opted in; the app is named by its canonical
+            // server-known title and unique name (anti-impersonation).
+            const form = dialog.locator('.app-feedback-form');
+            await expect(form).toBeVisible({ timeout: 15_000 });
+            await expect(dialog.locator('.app-feedback-target-name')).toHaveText(appName);
+
+            // Nothing to send until something has been written.
+            const sendBtn = dialog.locator('.app-feedback-send-btn');
+            await expect(sendBtn).toBeDisabled();
+            await dialog.locator('.app-feedback-message').fill('The new editor is great!');
+            await expect(sendBtn).toBeEnabled();
+
+            await sendBtn.click();
+            await expect(dialog.locator('.app-feedback-success')).toBeVisible();
+            await expect(appFrame.locator('#log [data-entry="feedback:true"]')).toBeVisible();
+            // The dialog closes itself shortly after the success pane.
+            await expect(dialog).toBeHidden({ timeout: 10_000 });
+        } finally {
+            await deleteTestApp(page, appName);
+        }
+    });
+
+    test('cancel resolves false', async ({ page }) => {
+        const appName = await registerTestApp(page, { fixtureURL: FEEDBACK_FIXTURE_URL });
+        try {
+            await setFeedbackEnabled(page, appName, true);
+            const appFrame = await gotoTestApp(page, appName);
+
+            await appFrame.locator('#send-feedback').click();
+            const dialog = page.locator('.app-feedback-overlay');
+            await expect(dialog.locator('.app-feedback-form')).toBeVisible({ timeout: 15_000 });
+            await dialog.locator('.app-feedback-cancel-btn').click();
+
+            await expect(appFrame.locator('#log [data-entry="feedback:false"]')).toBeVisible();
+            await expect(dialog).toBeHidden();
+        } finally {
+            await deleteTestApp(page, appName);
+        }
+    });
+
+    test('an app that has not opted in gets the unavailable notice', async ({ page }) => {
+        const appName = await registerTestApp(page, { fixtureURL: FEEDBACK_FIXTURE_URL });
+        try {
+            const appFrame = await gotoTestApp(page, appName);
+
+            await appFrame.locator('#send-feedback').click();
+            const dialog = page.locator('.app-feedback-overlay');
+            await expect(dialog.locator('.app-feedback-unavailable')).toBeVisible({ timeout: 15_000 });
+            // No form to type into — feedback is strictly opt-in.
+            await expect(dialog.locator('.app-feedback-form')).toBeHidden();
+            await dialog.locator('.app-feedback-close-btn').click();
+
+            await expect(appFrame.locator('#log [data-entry="feedback:false"]')).toBeVisible();
+        } finally {
+            await deleteTestApp(page, appName);
+        }
+    });
+});
+
+test.describe('puter.ui.showFeedbackDialog (env=gui)', () => {
+    test('resolves false on the Puter desktop itself', async ({ page }) => {
+        await page.goto('/');
+        await waitForPuterReady(page);
+        const sent = await page.evaluate(() => window.puter.ui.showFeedbackDialog());
+        expect(sent).toBe(false);
+    });
+});
+
+test.describe('dashboard app-drawer feedback control', () => {
+    test('opted-in app shows a feedback control in the drawer that opens the dialog', async ({ page }) => {
+        const appName = await registerTestApp(page, { fixtureURL: FEEDBACK_FIXTURE_URL });
+        try {
+            await setFeedbackEnabled(page, appName, true);
+
+            // Open the app on the /app/<name> route — dashboard mode, where
+            // the app window wears the top-edge drawer instead of a titlebar.
+            await page.goto(`/app/${appName}`);
+            const drawer = page.locator('.window-app .dashboard-app-drawer');
+            await expect(drawer).toBeAttached({ timeout: 60_000 });
+
+            // The drawer opens on hover; the control lives inside it.
+            await drawer.hover();
+            const feedbackBtn = drawer.locator('.dashboard-app-drawer-feedback');
+            await expect(feedbackBtn).toBeVisible();
+            await feedbackBtn.click();
+
+            // It opens the same dialog, targeting this app.
+            const dialog = page.locator('.app-feedback-overlay');
+            await expect(dialog.locator('.app-feedback-form')).toBeVisible({ timeout: 15_000 });
+            await expect(dialog.locator('.app-feedback-target-name')).toHaveText(appName);
+        } finally {
+            await deleteTestApp(page, appName);
+        }
+    });
+
+    test('an app that has not opted in shows no feedback control', async ({ page }) => {
+        const appName = await registerTestApp(page, { fixtureURL: FEEDBACK_FIXTURE_URL });
+        try {
+            await page.goto(`/app/${appName}`);
+            const drawer = page.locator('.window-app .dashboard-app-drawer');
+            await expect(drawer).toBeAttached({ timeout: 60_000 });
+            await drawer.hover();
+            // The control is only rendered for opted-in apps.
+            await expect(drawer.locator('.dashboard-app-drawer-feedback')).toHaveCount(0);
+        } finally {
+            await deleteTestApp(page, appName);
+        }
+    });
+});
+
+test.describe('puter.ui.showFeedbackDialog (env=web popup)', () => {
+    test('popup hosts the dialog, reports false on close, and never hands the opener a token', async ({ page }) => {
+        // Prime the GUI session (storageState sign-in) so the popup is authed.
+        await page.goto('/');
+        await page.waitForFunction(() => !!window.puter?.authToken, null, { timeout: 60_000 });
+
+        // Load the fixture directly (env=web, third-party origin, signed out).
+        await page.goto(FEEDBACK_FIXTURE_URL);
+        await page.locator('body.ready').waitFor({ timeout: 60_000 });
+
+        const [popup] = await Promise.all([
+            page.waitForEvent('popup'),
+            page.locator('#send-feedback').click(),
+        ]);
+
+        // The popup renders the feedback dialog for whichever app the
+        // browser-attested opener origin resolves to. On a shared dev DB
+        // that app is not deterministic, so this asserts the dialog shell
+        // rather than a specific pane.
+        const dialog = popup.locator('.app-feedback-overlay');
+        await expect(dialog).toBeVisible({ timeout: 60_000 });
+
+        // Closing the popup without submitting reports a dismissal.
+        await popup.close();
+        await expect(page.locator('#log [data-entry="feedback:false"]')).toBeVisible({ timeout: 15_000 });
+
+        // send-feedback is a NON_AUTH popup action: hosting the dialog must
+        // not have signed the site in as a side effect.
+        const authToken = await page.evaluate(() => window.puter.authToken ?? null);
+        expect(authToken).toBeNull();
+    });
+});