Feedback widget

One script tag on any site you run. Visitor reports become dispatchable fleet work, and shipped fixes close the loop automatically.

1. Enable it on a project

Open the project's page in FleetCrown, scroll to Visitor feedback, and click Enable & install via agent (or from Control, use the fleet coverage strip). That mints a project token and dispatches an agent to embed the snippet. Prefer that one click over copy-paste unless you are wiring a site by hand.

<script src="https://fleetcrown.orangecat.ch/widget.js"
        data-fc-project="fcw_…" async></script>

The token is public by design and write-only — it can submit feedback for this one project and read nothing. Origins are allowlisted from your project's production URL; submissions from other origins are rejected.

2. Install it — two ways

  • Copy snippet — paste it into your site's base template or root layout, before </body>. Any framework, any stack.
  • Install via agent — for repo-linked projects, one click dispatches an agent that adds the snippet to your codebase, verifies the page loads cleanly, and ships it the way your repo ships changes. It will not add a second embed if one already exists. Remove via agent is the symmetric operation.

If your site already has its own floating button in the bottom-right corner, add data-fc-bottom="88" to stack the feedback button above it.

3. What visitors get

A small button on every page. Opening it, the visitor picks a scope — Element (they click the exact thing that's broken; the widget records its CSS selector and visible text), This page, or Whole site — writes what should be improved, optionally attaches an image (file picker or paste; the widget downscales it client-side so a phone photo never ships megabytes), and optionally leaves a name or email. The widget renders in a Shadow DOM, so your styles and the widget's can't interfere with each other.

Repeat reports don't pile up: the same complaint filed again bumps a counter on the existing inbox row (shown as ×N) instead of creating a duplicate — the volume signal survives, the noise doesn't.

They can also speak instead of typing — useful on a phone, where describing a bug by thumb is where most reports die. The transcript lands in the same box, editable, and the visitor still presses Send.

The mic needs your site's permission. If your site sends a Permissions-Policy header with microphone=() — an empty allowlist, which several security presets ship by default — browsers block the microphone for every origin including your own, and never show a permission prompt. The widget detects this and simply doesn't offer the button, rather than showing one that can only fail. To enable it, allow your own origin: Permissions-Policy: microphone=(self). Everything else in the widget works regardless.

4. Remote control — no deploys

The snippet is a pointer; all behavior is server-side. On every page load the widget asks FleetCrown whether to render, and that call doubles as a heartbeat:

  • Live status is observed truth — the setup card shows Live on your-site.com · last seen … only once the boot call has actually arrived from your site.
  • Pause / Resume — hides or shows the widget on your live site within ~30 seconds, without touching your code.
  • Rotate mints a new token (the old snippet stops working); Disable revokes it entirely.

5. From report to fix

Submissions land in the project's Visitor feedback inbox, and the Control page shows a fleet-wide strip of projects with new reports. Per row:

  • Dispatch fix — one report → one scoped agent run. Routes through FleetCrown's injectPrompt SSOT: local Fleet Runner when connected, otherwise the cloud builder. You do not pick a terminal.
  • Dispatch all as one (2+ new items) — one agent pass covering the whole pile. Prefer this when you want a single coherent fix run now.
  • Synthesize themes (3+ new items) — an agent clusters the pile into structured briefs filed back into the same inbox; you then Dispatch the brief. Use when volume is high and themes help before fixing.
  • AI review — an agent opens any page of your site in a headless browser (desktop + mobile) and files findings into the same inbox.
  • A daily digest clusters busy inboxes into themes and files each as a draft on Approvals — with the exact agent prompt included, so you review precisely what would run.

Nothing auto-executes. Visitor text is untrusted input; it reaches an agent only after your explicit click. The approval gate is a security boundary, not a formality.

6. The loop closes itself

Every dispatched report remembers its run. When the run finishes with a verified success, the report resolves automatically — and if the visitor left an email, they get a short note that their feedback shipped. Reporters who hear back report again; that is the point.

Security model

  • Token is write-only and scoped to one project; reading requires your session.
  • Origin allowlist enforced on submission; rate limits per IP and per token.
  • Pause / rotate / revoke take effect on the live site without customer deploys.
  • Human approval gates every agent dispatch that involves visitor text.

Deeper read: The Visitor Is Part of the Fleet Now — the full tour with screenshots.