# Apptakes — install and remove instructions (for a coding agent or a human)

Apptakes adds a small beta-testing widget to a web app: after a tester consents, it records
their activity and page replay, captures JavaScript errors and failed requests, and gives them
a floating button to leave a typed or spoken note. The developer reads everything in their
Apptakes account. Testers never see any Apptakes screens other than the consent dialog and the
floating button.

You are installing a single `<script>` tag. There is nothing to build, no package to add, and
no server code to write. Do not invent anything not listed here.

## 0. Preconditions (stop and ask the developer if any is missing)

- `APP_KEY` — the key shown in Apptakes → Setup → the app's row → "Script tag". It looks like
  `recipe-box-k3f9q`. Never guess or fabricate one.
- Which pages should carry the widget. Default: every page a beta tester can reach, EXCEPT
  admin, billing, checkout/payment, and account-settings pages.
- Whether the app has user roles. If it does, the widget must load only for users flagged as
  beta testers (or on a beta-only deployment), not for the general public.
- Mode: `full` (activity + replay + errors + notes) or `suggest` (feedback button only, no
  recording). Use what the developer chose in Setup; `full` is the default.

## 1. Add the tag

Put this once in the shared layout/template that wraps the pages chosen above, just before
`</body>` (or in `<head>` — it is `defer`red either way):

```html
<script src="https://apptakes.com/widget/beta.js" data-key="APP_KEY" defer></script>
```

For suggest mode add `data-mode="suggest"`:

```html
<script src="https://apptakes.com/widget/beta.js" data-key="APP_KEY" data-mode="suggest" defer></script>
```

If the app has roles, wrap the tag in the app's own "current user is a beta tester" condition
in the template language it already uses (Jinja, ERB, Blade, React conditional, etc.). Do not
add a new role system to do this.

If the site sends a `Content-Security-Policy` header (check `_headers`, `netlify.toml`,
`vercel.json`, nginx config, or a `<meta http-equiv>` tag), add `https://apptakes.com` to
`script-src` and `connect-src`. Without it the browser refuses the script with a console error
naming the policy and nothing appears. Change nothing else in the policy.

## 2. Never load it on

- admin or staff pages
- billing, checkout, payment, or subscription pages
- account-security pages (password change, 2FA)
- any page that renders another user's private data

List, in your report, exactly which pages you excluded and how.

## 3. Test login (if the developer set one in Apptakes Setup)

Do nothing in the code. Apptakes shows the tester the test login itself, after they identify.
Only remind the developer: the test account must be a tester-level account, never an admin or
personal login.

## 4. Verify (all four must pass before you report success)

1. Load a page that carries the tag with the browser console open: no error mentioning
   `apptakes`, `beta.js`, or `bw-`.
2. The consent dialog appears once ("… beta test", with "Powered by Apptakes"). Accept it with a
   name and email.
3. A small floating 🎙 button appears bottom-right. Right-click (or long-press) it: the menu
   shows "Type a note" and "Done testing — send my feedback".
4. `GET https://apptakes.com/.netlify/functions/bw-app?key=APP_KEY` returns HTTP 200 with the
   app's name. (A 404 means the key is wrong.)

Then have the developer open Apptakes → Sessions: the test session appears within a minute.

## 5. Report back to the developer

- files changed (paths)
- pages that now carry the widget, pages excluded, and the role condition used (if any)
- mode (`full` or `suggest`)
- the four verification results above, verbatim

## REMOVE (when asked to take Apptakes out)

1. Delete the `<script … apptakes.com/widget/beta.js …>` tag and any role condition you added
   solely for it.
2. Search the codebase for `apptakes.com`, `beta.js`, `data-key=`, and `bw-`; remove any leftover
   reference you added. Do not touch unrelated code.
3. Verify: load the pages that used to carry the tag; no request goes to `apptakes.com` and no
   floating 🎙 button appears.
4. Tell the developer that recorded sessions remain in their Apptakes account until they delete
   the app there (Setup → the app → Danger zone).
