@songsid/agend 2.3.0-beta.2 → 2.3.0-beta.20

package/dist/ui/settings-owner-effects.js

@@ -3,28 +3,28 @@ import { html, useEffect, useRef, useState } from "/assets/app-html.js";
 import { register, t } from "/assets/app-i18n.js";
 import { useStore } from "/assets/app-store.js";
 import { OWNER_EFFECT_PREF_KEYS } from "/assets/app-prefs.js";
-import { getAppEffects } from "./app-effects.js";
+import { getAppEffects, wakeEffects } from "./effects-waker.js";
 import { ownerEffectsStore, watchOwnerEffects, refreshOwnerEffects, saveOwnerEffects } from "/assets/owner-effect-prefs.js";
 register("ownerEffects", {
   en: {
-    title: "Your effect choices", operatorTitle: "Host-wide effect choices", person: "These choices follow this platform sign-in. Discord and Telegram accounts stay separate.",
-    operator: "Host-wide choices: everyone signed in as the host operator shares these slots.",
+    title: "Your effect choices", operatorTitle: "Host-wide effect choices", person: "Follows your sign-in; Discord and Telegram are separate.",
+    operator: "Shared by everyone signed in as the host.",
     sidebar: "Sidebar", header: "Header", page: "Page", box: "Box", cursor: "Cursor", none: "None", savedChoice: "Saved choice",
     unknown: "Choices are unavailable. Reload to try again.", changed: "This page can no longer access these choices. Reload and sign in again.",
     unavailable: "No longer available", clear: "Clear", reload: "Reload choices", saved: "Saved.", failed: "Couldn't save. Reload choices and try again.",
     savedRefresh: "Saved, but the choices couldn't be refreshed. Reload to check.", readOnly: "Sign in as an admin to change these choices.",
-    playback: "Playback requires Effects and preview consent. The cursor follows the same consent and falls back to stock cursors when unavailable.",
-    pause: "Pause", resume: "Resume", running: "Running", cursorFailed: "The cursor could not be applied here. Clear or reload the choice to try again.", starting: "Starting", queued: "Waiting for a slot", paused: "Paused", off: "Playback is off or unavailable here.", budget: "Paused to protect page responsiveness. Resume keeps the three-pauses safety limit.", resumeFailed: "This effect cannot resume: the page or its safety history is not ready. Reload the page or choose another effect.",
+    playback: "Effects don't require HTML-preview permission.",
+    pause: "Pause", resume: "Resume", running: "Running", cursorFailed: "The cursor could not be applied here. Clear or reload the choice to try again.", starting: "Starting", queued: "Waiting for a slot", paused: "Paused", off: "Playback is off or unavailable here.", budget: "Paused to keep the page responsive.", resumeFailed: "This effect cannot resume: the page or its safety history is not ready. Reload the page or choose another effect.",
   },
   "zh-TW": {
-    title: "你的效果選擇", operatorTitle: "主機共用效果選擇", person: "選擇會跟隨這個平台的登入身分；Discord 與 Telegram 帳號各自獨立。",
-    operator: "主機共用選擇：所有以主機操作者身分登入的人，都會共用這些欄位。",
+    title: "你的效果選擇", operatorTitle: "主機共用效果選擇", person: "跟隨你的登入身分；Discord 與 Telegram 各自獨立。",
+    operator: "所有以主機身分登入的人共用。",
     sidebar: "側邊欄", header: "頁首", page: "頁面", box: "區塊", cursor: "游標", none: "無", savedChoice: "已儲存的選擇",
     unknown: "目前無法取得選擇，請重新載入再試。", changed: "這個頁面已無法存取選擇，請重新載入並登入。",
     unavailable: "已無法使用", clear: "清除", reload: "重新載入選擇", saved: "已儲存。", failed: "無法儲存，請重新載入選擇再試。",
     savedRefresh: "已儲存，但無法更新畫面；請重新載入確認。", readOnly: "請以管理員身分登入才能修改選擇。",
-    playback: "開啟效果並允許預覽後才會播放；游標也遵循相同的同意設定；無法使用時會還原一般游標。",
-    pause: "暫停", resume: "恢復", running: "播放中", cursorFailed: "這裡無法套用游標。可清除或重新載入選擇後再試。", starting: "啟動中", queued: "等待空位", paused: "已暫停", off: "這裡已關閉播放，或無法播放效果。", budget: "為維持頁面順暢，已暫停效果。恢復仍保留三次暫停的安全上限。", resumeFailed: "頁面或安全紀錄尚未就緒，無法恢復此效果。請重新載入頁面，或選擇其他效果。",
+    playback: "效果不需要 HTML 預覽權限。",
+    pause: "暫停", resume: "恢復", running: "播放中", cursorFailed: "這裡無法套用游標。可清除或重新載入選擇後再試。", starting: "啟動中", queued: "等待空位", paused: "已暫停", off: "這裡已關閉播放，或無法播放效果。", budget: "為維持頁面順暢，已暫停。", resumeFailed: "頁面或安全紀錄尚未就緒，無法恢復此效果。請重新載入頁面，或選擇其他效果。",
   },
 });
 const text = key => t(`ownerEffects.${key}`);
@@ -38,9 +38,11 @@ export function OwnerEffects({ catalog, busy = false }) {
   const state = useStore(ownerEffectsStore), [message, setMessage] = useState(null), life = useRef({ alive: false, seq: 0 }), [runtime, setRuntime] = useState(null);
   useEffect(() => { life.current.alive = true; const stop = watchOwnerEffects(); return () => { life.current.alive = false; life.current.seq++; stop(); }; }, []);
   useEffect(() => {
-    let live = true; const entry = getAppEffects();
-    const pull = () => { if (!live) return; const gates = entry?.gates(); setRuntime({ entry, snapshot: entry?.api?.ownerSnapshot?.(), cursor: entry?.cursorSnapshot?.(), available: !!entry && !entry.dead && gates.enabled && gates.show && gates.previewReady && gates.optIn && !gates.safe && !gates.publicLink && !gates.reducedMotion && !gates.saveData }); };
-    const off = entry?.subscribe(pull), end = entry?.onEnd(pull); pull();
+    // #2193: managing personal effects needs the runtime's view of them: it is woken here (it may still be asleep).
+    let live = true, entry = getAppEffects(), off = null, end = null;
+    const pull = () => { if (!live) return; const gates = entry?.gates(); setRuntime({ entry, snapshot: entry?.api?.ownerSnapshot?.(), cursor: entry?.cursorSnapshot?.(), available: !!entry && !entry.dead && gates.enabled && gates.show && gates.transportReady && !gates.safe && !gates.publicLink && !gates.reducedMotion }); };
+    const bind = () => { off = entry?.subscribe(pull) ?? null; end = entry?.onEnd(pull) ?? null; pull(); };
+    if (entry) bind(); else { pull(); void wakeEffects().then(() => { if (!live) return; entry = getAppEffects(); bind(); }); }
     return () => { live = false; off?.(); end?.(); };
   }, []);
   const reload = () => { getAppEffects()?.api?.changedOwner?.(); return refreshOwnerEffects(); };
@@ -54,7 +56,7 @@ export function OwnerEffects({ catalog, busy = false }) {
     const seq = ++life.current.seq; setMessage(null);
     const result = await saveOwnerEffects({ [key]: id });
     if (!life.current.alive || seq !== life.current.seq) return;
-    if (result.ok || result.saved) getAppEffects()?.api?.changedOwner?.();
+    if (result.ok || result.saved) getAppEffects()?.api?.changedOwner?.();   // #2193: asleep, the saved slot wakes it (app-prefs)
     setMessage(text(result.ok ? "saved" : result.saved ? "savedRefresh" : "failed"));
   };
   return html`<section class="s-fx-owner" aria-label=${text(state.scope === "operator" ? "operatorTitle" : "title")}><h4>${text(state.scope === "operator" ? "operatorTitle" : "title")}</h4><p class="sub">${text(state.scope === "operator" ? "operator" : "person")}</p>

package/dist/ui/settings-strings.js

@@ -14,7 +14,8 @@ register("settings", {
     publicTtl: "Public link minutes (1–480)",
     publicProtocol: "Tunnel protocol",
     webEcho: "Web echo",
-    webEchoHint: "Copies web messages to the bound Telegram or Discord topic. ClassicBot rooms are excluded.",
+    webEchoHint: "Copies web messages to the bound Telegram or Discord topic. ClassicBot rooms follow it unless a room sets its own.",
+    webUsagePublic: "Usage report over the public link", webUsagePublicHint: "Fleet → Usage (up to 400 days of each agent's tokens, requests, messages and API-equivalent amounts) is offered over the temporary public link too. Off by default; guests never see it. Applies at once.",
     webLogTab: "Log tab: each agent's steps", webLogTabHint: "Shows each instance's prompts, replies, tool calls and results, and fleet events in its Log tab, read from its own transcript only while the tab is open. Secret values are masked. Also over the public link. Turning it on waits for a fleet admin's confirmation.",
     general: "General Settings",
     advanced: "Advanced",
@@ -88,7 +89,6 @@ register("settings", {
     wake: "Wake",
     accessMode: "Access mode",
     affected: "Affected instances",
-    webEchoGroupConfirm: "This looks like a group channel: enabling posts every web message to this instance where all channel members can read it. Enable web echo?",
     language: "Language (bot replies)",
     defaultBackend: "Default backend",
     defaultModel: "Default model",
@@ -131,6 +131,7 @@ register("settings", {
     applyPartial: "Some changes failed",
     applyClose: "Close",
     settingsButton: "Settings",
+    connRetryNow: "Retry now", connRetryQueued: "Connection retry requested.", connRetryFailed: "Could not retry this connection. Check its status and try again.",
     modalDone: "Stage change",
     wizardButton: "Setup wizard",
     wizardTitle: "Set up AgEnD",
@@ -204,6 +205,9 @@ register("settings", {
     changesApplied: "Changes applied. AgEnD is reconciling affected Agents.",
     reviewChanges: "Review changes",
     backendUnavailable: "{0} (removed — choose another backend)",
+    backendNotInstalled: "not installed", backendNotSignedIn: "not signed in (use /login)", backendTooOld: "needs {0} or newer", backendUnchecked: "not checked yet",
+    modelNotListed: "current — not in this CLI's list", modelOther: "Other…", modelOtherLabel: "Model name", modelOtherPlaceholder: "a model name this CLI accepts",
+    modelNone: "— none —", inheritValue: "inherit ({0})", modelCliDefault: "the CLI's own default",
     readyApply: "Ready to apply",
     copied: "Copied",
     expectedMapping: "expected a mapping",
@@ -222,7 +226,7 @@ register("settings", {
     staggerWarning: "Very low values can cause startup spikes",
     sec_device: "Preferences", syncedTitle: "Synced across your devices", syncedLead: "Changes here apply on every device where you are signed in.",
     profileTitle: "Your name",
-    profileLeadBound: "Agents see your web messages as the Discord or Telegram account your sign-in code was sent to: its id, and its name unless you choose another here. It follows you to every device you sign in on. It is for recognition only: it grants nothing.",
+    profileLeadBound: "Agents see your web messages as the Discord or Telegram account your sign-in code was sent to: its id, and its name unless you choose another here. It follows you to every device you sign in on. Agents do your ordinary requests as you; a release, anything destructive, spending, secrets or passing your authority on needs this browser authorized, or your confirm in Discord or Telegram.",
     profileLeadUnbound: "This browser was not signed in with a code sent to your Discord or Telegram account, so agents see your web messages as \"web-user\" (or the name you set here). Sign in with a code from /web to be recognised as your account.",
     profileName: "Name", profileHelp: "Agents see: {0} · id {1}", profileSave: "Save", profileClear: "Use web-user", profileUseAccount: "Use {0}",
     profileSaved: "Agents now see you as {0}", profileFailed: "Could not save the name",
@@ -290,17 +294,18 @@ register("settings", {
     sec_web: "Web",
     // #1629 r4 §3: Settings → Appearance (owner CSS).
     sec_appearance: "Web appearance",
-    colorTitle: "Identity colours", colorLead: "Each agent's colour in the sidebar: a person's pick, the agent's own, its bot's Discord role colour, or an automatic soft colour. Change one agent's from its ⋯ menu → Colour….",
-    colorPlaces: "Where colours show, unless an agent's own setting says otherwise", colorOff: "Turn off colours",
-    colorOffLead: "Hides every identity colour on this host. The colours people picked are kept, and come back when you turn colours on again.",
-    restoreTitle: "Restore defaults", restoreLead: "Puts this host's appearance settings back to their defaults. It asks first and says what it resets.",
-    restoreConfirm: "This resets, for this host: showing agents' themes and effects, the card size and each card's own size, your sidebar widget, where colours show, and whether colours are off. It also turns your custom CSS off (its versions are kept) and its switch on this device. The colours people picked for agents, installed mods, uploaded effects and the card limits stay as they are.",
+    groupLook: "Look", groupLayout: "Your layout", groupCss: "Styles you write", groupMods: "Add-ons", groupAdvanced: "Advanced", learnMore: "Learn more: {0}",
+    colorTitle: "Identity colours", colorLead: "One agent's colour: its ⋯ menu → Colour…",
+    colorPlaces: "Where colours show", colorSample: "Sample agent", colorOff: "Turn off colours",
+    colorOffLead: "Colours people picked are kept.",
+    restoreTitle: "Restore defaults", restoreLead: "Puts this host's look back to the defaults. Asks first.",
+    restoreConfirm: "Resets, for this host: showing agents' themes and effects, the card size and each card's own size, your sidebar widget, where colours show, and colours off. Also turns your custom CSS off (its versions are kept) and its switch on this device. Kept: the colours people picked for agents, installed mods, uploaded effects and the card limits.",
     restoreGo: "Restore defaults", restoreDone: "Appearance settings are back to their defaults.", restoreCssFailed: "The settings are back to their defaults, but your custom CSS could not be turned off: {0}",
     cardSizeTitle: "Identity cards",
-    cardSizeLead: "How large identity cards are drawn on all your devices. A card's own S / M / L sets that card apart.",
+    cardSizeLead: "A card's own S / M / L overrides this.",
     cardLimitsTitle: "Identity card upload limits",
-    cardLimitsLead: "The largest portrait and banner anyone may upload, and how many pictures each agent may keep. Empty = the default (shown greyed). A lower limit applies at once; a higher one waits for a fleet admin's confirmation. Pictures already stored stay.",
-    cardLimitsUnavailable: "Only a signed-in admin can see and change these here (or edit web.appearance in fleet.yaml).",
+    cardLimitsLead: "Empty = the default. Raising a limit needs an admin's OK.",
+    cardLimitsUnavailable: "Only a signed-in admin can change these.",
     cardLimit_portrait_max_width: "Portrait width (px)", cardLimit_portrait_max_height: "Portrait height (px)", cardLimit_portrait_max_kib: "Portrait size (KiB)",
     cardLimit_banner_max_width: "Banner width (px)", cardLimit_banner_max_height: "Banner height (px)", cardLimit_banner_max_kib: "Banner size (KiB)",
     cardLimit_instance_quota_files: "Pictures per agent", cardLimit_instance_quota_mib: "Picture space per agent (MiB)",
@@ -312,10 +317,12 @@ register("settings", {
     cardLimitsFailed: "Not saved: {0}",
     themesTitle: "Agents' themes",
     themesShow: "Show agents' themes, effects and widgets",
-    themesShowLead: "On all your devices. When it's off, every chat looks the same, and agents' pictures and ring colours are their bots' again.",
+    themesShowLead: "When off, every chat looks the same.",
+    themesFollowMotion: "Effects: follow the system's reduced-motion setting",
+    themesFollowMotionLead: "This device only: effects stay still while the system reduces motion.",
     themesSafeMode: "This page was opened with ?safe=1: agents' themes are not shown on it.",
     widgetTitle: "Your sidebar widget",
-    widgetLead: "A small panel under the instance list, on all your devices: the dashboard draws it from a spec and values you write here as JSON — no HTML, script or CSS. Its live values are your fleet's counts (fleet.working, fleet.needs_you, fleet.idle, fleet.stopped). Agents can't change it.",
+    widgetLead: "A small panel under your agent list, written as JSON.",
     widgetNotJson: "Not JSON.",
     widgetSave: "Save widget",
     widgetSaved: "Sidebar widget saved.",
@@ -323,7 +330,7 @@ register("settings", {
     widgetRemove: "Remove widget",
     widgetRemoved: "Sidebar widget removed.",
     modsTitle: "Mods",
-    modsLead: "A mod is one file (.agendmod.json) that carries a look: an agent's theme and pictures, its card text, widgets, effects, and custom CSS. Importing shows everything in it first; only what you tick is applied, all at once. Uninstalling removes the mod from this list; what it applied stays until you reset it.",
+    modsLead: "Only the parts you tick are applied.",
     modsLoadFailed: "Couldn't load the installed mods. Reload the page to try again.",
     modsNone: "No mods installed.",
     modChoose: "Import a mod file…",
@@ -334,6 +341,7 @@ register("settings", {
     modReplace: "Replace the installed version {0}",
     modPartTheme: "Theme (colours, font, pictures)",
     modPartIdentity: "Card text (tagline and bio)",
+    modPartAmbient: "Ambient effect (falling, rising, twinkling or click glyphs)",
     modPartWidget_chat_header: "Chat header widget",
     modPartWidget_details: "Details page widget",
     modPartWidget_sidebar: "Your sidebar widget",
@@ -360,7 +368,7 @@ register("settings", {
     modUninstallConfirm: "Uninstall {0}? Its effects leave your library unless something still uses them. What it applied stays.",
     modUninstalled: "Uninstalled {0}.",
     modExport: "Export a mod",
-    modExportLead: "Make a mod file from what is in force now: an agent's theme, card text and widgets, your sidebar widget, your custom CSS.",
+    modExportLead: "Save what's in force now as a mod file.",
     modExportInstance: "Agent",
     modExportName: "Name (a-z, 0-9, -)",
     modExportVersion: "Version",
@@ -372,7 +380,7 @@ register("settings", {
     modReview: "Review",
     modDismiss: "Dismiss",
     cssTitle: "Custom CSS (yours only)",
-    cssLead: "Your own stylesheet, applied to your screens only: every device where you are signed in, never anyone else's, and never on Settings. It can't load anything from the internet. Put pictures and fonts under Assets below and name them url(\"asset:<id>\").",
+    cssLead: "Applies to your screens only.",
     cssLoadFailed: "Couldn't load your custom CSS. Reload the page to try again.",
     cssPublicLink: "Custom CSS isn't available on a temporary public link.",
     cssInForce: "In force: {0}",
@@ -385,15 +393,14 @@ register("settings", {
     cssCurrent: "in force",
     cssRestore: "Use this",
     cssAssets: "Assets",
-    cssAssetsLead: "PNG, WebP, JPEG, GIF or WOFF2. {0} of {1} files, {2} in total (at most 1 MiB). Metadata such as GPS is removed.",
+    cssAssetsLead: "{0} of {1} files, {2} in total (at most 1 MiB in all).",
     cssAssetAdd: "Add a picture or font",
     cssAssetCopy: "Copy reference",
     cssCopied: "Copied {0}",
     cssAssetRemove: "Remove",
     cssDeviceTitle: "On this device",
     cssDeviceOff: "Turn off custom CSS on this device",
-    cssDeviceOffLead: "Only this browser. Your other devices keep it.",
-    cssSafe: "Is something hidden or broken? Add ?safe=1 to the end of any page's address and it loads without custom CSS.",
+    cssSafe: "Something hidden? Add ?safe=1 to the address.",
     cssError_at_rule: "Not saved: {0} isn't allowed.",
     cssError_url: "Not saved: the only url() allowed is url(\"asset:<id>\") for a file in Assets.",
     cssError_unknown_asset: "Not saved: there's no asset {0}. Add it under Assets first.",
@@ -426,6 +433,28 @@ register("settings", {
     webTerminalTtl: "Terminal session minutes (1–20)",
     webTerminalTtlRange: "Must be a whole number from 1 to 20",
     webReadOnlyTitle: "Set in fleet.yaml",
+    guestsTitle: "Guests", guestsReview: "Review guest changes",
+    guestsHint: "People who are not admins can sign in to the web as guests: they send /web where they already chat and get a code privately. A guest sees only the agents they can already use in chat, and their messages are recognition only.",
+    guestsEnabled: "Guest sign-in", guestsEnabledHint: "Off: no one can sign in as a guest, and every guest session ends. Turning it on waits for a fleet admin's confirmation.",
+    guestsChat: "Guests may chat", guestsChatHint: "Off: guests can read their agents' chats but not send, attach, click a reply's buttons or press Cancel.",
+    guestsOpenFor: "Agents for guests of {0} ({1})", guestsOpenHint: "This connection is open to everyone, so it has no list of people: its guests reach only the agents you tick here (none by default). Adding agents waits for a fleet admin's confirmation.",
+    guestsList: "Guest accounts", guestsNone: "No guest has signed in yet.", guestsLoadFailed: "The guest list could not be loaded.",
+    guestFacts: "Agents: {0} · Sessions: {1} · Remembered browsers: {2}", guestLastActive: "Last active {0}", guestNotSignedIn: "Not signed in now",
+    guestNotNarrowed: "Reaches every agent they can use in chat.", guestNarrowedTo: "Narrowed to: {0}", guestNothing: "nothing",
+    guestNarrow: "Narrow", guestNotReachable: "(no longer reachable)", guestReachesNothing: "This account reaches no agent from chat right now, so there is nothing to narrow.", guestNarrowLift: "Remove narrowing", guestNarrowHint: "Tick what this guest may still reach. Narrowing only takes away (it applies at once); widening or removing it waits for a fleet admin's confirmation.",
+    guestSignOut: "Sign out", guestSignOutTitle: "Sign out this guest?", guestSignOutConfirm: "{0}'s guest sessions end now, their sign-in code stops working and their browsers are forgotten. They can sign in again with /web while guest sign-in is on.",
+    guestSignedOut: "{0} is signed out.", guestSignedOutNotDurable: "{0} is signed out for now, but it could not be saved: a restart may bring their sessions back.", guestSignOutFailed: "That did not work — try again.",
+    vaTitle: "Web authority", vaReview: "Review web authority changes",
+    vaHint: "Whether a signed-in fleet admin's web messages carry their own account's authority, recorded in each message's delivery receipt. A session signed in with a code sent privately to that account, on the dashboard reached directly, is authorized once from Discord or Telegram; the public link and guests never are. Agents do an admin's ordinary web requests either way; a release, anything destructive, spending, secrets or passing authority on needs this.",
+    vaLoadFailed: "Web authority could not be loaded.",
+    vaEnabled: "Web messages carry authority", vaEnabledHint: "On by default: a session carries authority only once its account confirms it from Discord or Telegram. Off: no web message carries authority, and any already given reads as none at once; authority given before it was turned off never comes back.",
+    vaStuckOff: "Web authority is off for now: its state could not be saved on this computer (see the fleet log). It comes back on by itself once it can be.",
+    vaLoopbackOnly: "Only this computer can authorize", vaLoopbackOnlyHint: "On: only a browser on this computer qualifies, not one on your network or tailnet, and authority already given from elsewhere reads as none. Turning it off again doesn't bring that back.",
+    vaLanWarning: "The dashboard also answers to {0} (web.allowed_hosts). Anyone who reaches it there with a stolen sign-in could give authority in your name. Turn on \"Only this computer can authorize\" unless you trust everyone who can reach it.",
+    vaHours: "An authorization lasts (hours, {0}–{1})", vaHoursRange: "Must be a number from 1 to 48",
+    vaSessionsTitle: "Authorized sessions", vaSessionsNone: "No session is authorized now.", vaSessionUntil: "Authorized {0} · until {1}",
+    vaRevoke: "Revoke web authority", vaRevokeTitle: "Revoke all web authority?", vaRevokeConfirm: "Every authority given from the web so far reads as none from now on, and every session's authorization ends. Nobody is signed out: a session carries authority again once it is authorized again.",
+    vaRevoked: "Web authority given so far is revoked.", vaRevokedNotDurable: "Revoked for now, but it could not be saved: web authority stays off until it can be, and a restart before then undoes the revocation.", vaRevokeFailed: "That did not work — try again.",
     webReadOnlyLead: "Read-only here: these decide what the dashboard listens on and exposes. Edit fleet.yaml, then run agend reload (web.preview_port and web.preview_origin take a restart of AgEnD).",
     notSet: "not set (default)",
     defaultsTitle: "Defaults",
@@ -474,7 +503,19 @@ register("settings", {
     discardOnLeave: "Discard {0} pending changes?",
     applyBusyLocal: "An Apply is still running — wait for it to finish.",
     applyStepFailed: "Stopped at a change: {0}. The changes after it were not applied; they are staged again.",
-    stepWaiting: "Waiting for confirmation in chat",
+    applyError_unsupported_sensitive_effect: "it changes a setting the confirmation cannot show safely, so nothing was changed",
+    applyError_confirmation_diff_too_large: "it is too large to confirm at once; apply fewer changes at a time",
+    applyError_session_required: "your sign-in ended; sign in again and apply",
+    applyError_admin_required: "only a fleet admin can confirm it",
+    applyError_settings_changed: "the settings changed meanwhile; review and apply again",
+    applyError_request_no_longer_current: "the settings changed meanwhile; review and apply again",
+    applyError_too_many_pending_changes: "too many changes are waiting for confirmation; confirm or withdraw some first",
+    applyError_fleet_unavailable: "the fleet is not running",
+    applyError_invalid_settings_effect: "the result would not be a valid configuration",
+    applyError_settings_confirmation_unavailable: "its confirmation could not be set up; try again",
+    applyError_failed: "the server could not apply it",
+    applyErrorOther: "the server refused it ({0})",
+    stepWaiting: "Waiting for confirmation",
     stepSkipped: "Not applied",
     viaRestart: "(restart)",
     format: "Format",
@@ -491,7 +532,6 @@ register("settings", {
     discordUserPlaceholder: "your Discord user id",
     telegramUserPlaceholder: "your Telegram user id",
     bindingApplyButton: "Rebind",
-    webEchoEnable: "Turn on web echo",
     help1: "Agents: each agent's settings, Start/Stop, Pause/Wake, and New agent.",
     help2: "Connections: who may use each bot, its binding, its status emojis, a new token; and provider API keys.",
     help3: "ClassicBot: each room's backend, model and options.",
@@ -535,7 +575,8 @@ register("settings", {
     publicTtl: "公開連結分鐘數（1–480）",
     publicProtocol: "Tunnel 協定",
     webEcho: "Web 同步",
-    webEchoHint: "將網頁訊息複製到綁定的 Telegram 或 Discord 主題，不包含 ClassicBot 群組。",
+    webEchoHint: "將網頁訊息複製到綁定的 Telegram 或 Discord 主題。ClassicBot 聊天室也照這個設定，除非該聊天室另外設定。",
+    webUsagePublic: "透過公開連結提供用量報告", webUsagePublicHint: "Fleet → 用量（最多 400 天、每個 agent 的 token、請求、訊息與依牌價換算的 API 等值）也會透過臨時公開連結提供。預設關閉；訪客一律看不到。變更立即生效。",
     webLogTab: "紀錄分頁：每個 agent 的步驟", webLogTabHint: "在每個 instance 的「紀錄」分頁顯示提示、回覆、工具呼叫與結果，以及 fleet 事件；只在分頁開著時從它自己的對話紀錄讀取。機密值會遮蔽。公開連結也看得到。開啟需 fleet admin 確認。",
     general: "一般設定",
     advanced: "進階",
@@ -584,7 +625,6 @@ register("settings", {
     wake: "喚醒",
     accessMode: "存取模式",
     affected: "受影響 instances",
-    webEchoGroupConfirm: "這看起來是群組頻道：開啟後，這個 instance 的每則 web 訊息都會貼到所有頻道成員看得到的地方。確定要開啟 web echo？",
     language: "語言（bot 回覆）",
     defaultBackend: "預設後端",
     defaultModel: "預設模型",
@@ -627,6 +667,7 @@ register("settings", {
     applyPartial: "有部分變更失敗",
     applyClose: "關閉",
     settingsButton: "設定",
+    connRetryNow: "立即重試", connRetryQueued: "已要求重新連線。", connRetryFailed: "無法重試此連線，請檢查狀態後再試。",
     modalDone: "加入待套用",
     wizardButton: "設定精靈",
     wizardTitle: "設定 AgEnD",
@@ -700,6 +741,9 @@ register("settings", {
     changesApplied: "變更已套用，AgEnD 正在協調受影響的 Agent。",
     reviewChanges: "檢查變更",
     backendUnavailable: "{0}（已移除，請選擇其他 backend）",
+    backendNotInstalled: "未安裝", backendNotSignedIn: "未登入（請用 /login）", backendTooOld: "需要 {0} 以上版本", backendUnchecked: "尚未檢查",
+    modelNotListed: "目前使用中 — 不在這個 CLI 的清單裡", modelOther: "其他…", modelOtherLabel: "模型名稱", modelOtherPlaceholder: "這個 CLI 接受的模型名稱",
+    modelNone: "— 無 —", inheritValue: "沿用（{0}）", modelCliDefault: "CLI 自己的預設",
     readyApply: "可套用變更",
     copied: "已複製",
     expectedMapping: "預期為 mapping",
@@ -718,7 +762,7 @@ register("settings", {
     staggerWarning: "數值太低可能造成啟動尖峰",
     sec_device: "偏好設定", syncedTitle: "在你所有的裝置同步", syncedLead: "這裡的變更會套用到你登入的每一台裝置。",
     profileTitle: "你的名字",
-    profileLeadBound: "agent 會把你從網頁送出的訊息，認成收到登入驗證碼的那個 Discord 或 Telegram 帳號：用它的 id，名字也用它的，除非你在這裡另外取名。它會跟著你到每一台登入的裝置。這只用來辨認，不代表任何權限。",
+    profileLeadBound: "agent 會把你從網頁送出的訊息，認成收到登入驗證碼的那個 Discord 或 Telegram 帳號：用它的 id，名字也用它的，除非你在這裡另外取名。它會跟著你到每一台登入的裝置。一般的請求，agent 會當作是你本人提出的；發布、破壞性操作、花費、密鑰，或把你的授權交給別人，則要先授權這個瀏覽器，或在 Discord、Telegram 上確認。",
     profileLeadUnbound: "這個瀏覽器不是用私訊到你 Discord 或 Telegram 帳號的驗證碼登入的，所以 agent 會把你的網頁訊息看成「web-user」（或你在這裡設定的名字）。用 /web 的驗證碼登入，就能被認成你的帳號。",
     profileName: "名字", profileHelp: "agent 看到：{0} · id {1}", profileSave: "儲存", profileClear: "改回 web-user", profileUseAccount: "改用 {0}",
     profileSaved: "agent 現在會看到你是 {0}", profileFailed: "無法儲存名字",
@@ -785,17 +829,18 @@ register("settings", {
     webChat: "網頁聊天",
     sec_web: "網頁",
     sec_appearance: "網頁外觀",
-    colorTitle: "識別色", colorLead: "每個 agent 在側欄的顏色：有人挑選的、agent 自己的、它的 bot 在 Discord 身分組的顏色，或自動配的柔和色。要改某個 agent 的顏色，從它的 ⋯ 選單 → 顏色…。",
-    colorPlaces: "顏色顯示的位置（agent 自己另有設定時除外）", colorOff: "關閉顏色",
-    colorOffLead: "在這台主機隱藏所有識別色。有人挑過的顏色會保留，重新開啟顏色後就會回來。",
-    restoreTitle: "還原預設值", restoreLead: "把這台主機的外觀設定改回預設值。執行前會先詢問，並說明會重設哪些項目。",
-    restoreConfirm: "會重設這台主機的：是否顯示 agent 的主題與效果、卡片大小與各張卡片自己的大小、你的側欄小工具、顏色顯示的位置，以及是否關閉顏色；也會關閉你的自訂 CSS（版本會保留）以及這台裝置上的 CSS 開關。有人替 agent 挑的顏色、已安裝的 mod、上傳的效果與卡片上限都不會變。",
+    groupLook: "外觀", groupLayout: "你的版面", groupCss: "自己寫的樣式", groupMods: "擴充", groupAdvanced: "進階", learnMore: "了解更多：{0}",
+    colorTitle: "識別色", colorLead: "單一 agent 的顏色：⋯ 選單 → 顏色…",
+    colorPlaces: "顏色顯示的位置", colorSample: "範例 agent", colorOff: "關閉顏色",
+    colorOffLead: "已挑選的顏色會保留。",
+    restoreTitle: "還原預設值", restoreLead: "把這台主機的外觀改回預設值，會先詢問。",
+    restoreConfirm: "會重設這台主機的：是否顯示 agent 的主題與效果、卡片大小與各張卡片自己的大小、你的側欄小工具、顏色顯示的位置、是否關閉顏色；也會關閉你的自訂 CSS（版本會保留）與這台裝置上的 CSS 開關。不變：有人替 agent 挑的顏色、已安裝的 mod、上傳的效果與卡片上限。",
     restoreGo: "還原預設值", restoreDone: "外觀設定已改回預設值。", restoreCssFailed: "設定已改回預設值，但無法關閉你的自訂 CSS：{0}",
     cardSizeTitle: "身分卡",
-    cardSizeLead: "身分卡在你所有裝置上的顯示大小。卡片上自己的 小／中／大 可以單獨設定那張卡片。",
+    cardSizeLead: "卡片上的 小／中／大 可單獨設定。",
     cardLimitsTitle: "身分卡上傳限制",
-    cardLimitsLead: "任何人可上傳的肖像與橫幅上限，以及每個 agent 可保留的圖片數量。留空＝預設值（以灰字顯示）。調低立即生效；調高需 fleet admin 確認。已存的圖片不受影響。",
-    cardLimitsUnavailable: "只有已登入的管理者能在這裡查看與修改（或在 fleet.yaml 編輯 web.appearance）。",
+    cardLimitsLead: "留空＝預設值。調高上限需管理員確認。",
+    cardLimitsUnavailable: "只有已登入的管理者能修改。",
     cardLimit_portrait_max_width: "肖像寬度（px）", cardLimit_portrait_max_height: "肖像高度（px）", cardLimit_portrait_max_kib: "肖像大小（KiB）",
     cardLimit_banner_max_width: "橫幅寬度（px）", cardLimit_banner_max_height: "橫幅高度（px）", cardLimit_banner_max_kib: "橫幅大小（KiB）",
     cardLimit_instance_quota_files: "每個 agent 的圖片數", cardLimit_instance_quota_mib: "每個 agent 的圖片空間（MiB）",
@@ -807,10 +852,12 @@ register("settings", {
     cardLimitsFailed: "未儲存：{0}",
     themesTitle: "Agent 的主題",
     themesShow: "顯示 agent 的主題、效果與小工具",
-    themesShowLead: "套用到你所有的裝置。關閉時每個聊天看起來都一樣，agent 的圖片與外框顏色也會換回各自 bot 的。",
+    themesShowLead: "關閉時每個聊天看起來都一樣。",
+    themesFollowMotion: "效果：跟隨系統的「減少動態效果」設定",
+    themesFollowMotionLead: "只套用於這台裝置：系統減少動態效果時，效果保持靜止。",
     themesSafeMode: "這個頁面是用 ?safe=1 開啟的：不顯示 agent 的主題。",
     widgetTitle: "你的側邊欄小工具",
-    widgetLead: "實例清單下方的一個小面板，套用到你所有的裝置：儀表板依你在這裡用 JSON 寫的規格與數值繪製——沒有 HTML、腳本或 CSS。即時數值是你 fleet 的計數（fleet.working、fleet.needs_you、fleet.idle、fleet.stopped）。agent 無法變更它。",
+    widgetLead: "agent 清單下方的小面板，用 JSON 撰寫。",
     widgetNotJson: "不是 JSON。",
     widgetSave: "儲存小工具",
     widgetSaved: "已儲存側邊欄小工具。",
@@ -818,7 +865,7 @@ register("settings", {
     widgetRemove: "移除小工具",
     widgetRemoved: "已移除側邊欄小工具。",
     modsTitle: "Mod",
-    modsLead: "Mod 是一個檔案（.agendmod.json），帶著一套外觀：agent 的主題與圖片、身分卡文字、小工具、效果，以及自訂 CSS。匯入時會先完整列出內容，只有你勾選的部分會一次套用。解除安裝會把 mod 從這個清單移除；它已套用的外觀會保留，直到你重設。",
+    modsLead: "只套用你勾選的部分。",
     modsLoadFailed: "無法載入已安裝的 mod。請重新載入頁面再試一次。",
     modsNone: "尚未安裝任何 mod。",
     modChoose: "匯入 mod 檔案…",
@@ -829,6 +876,7 @@ register("settings", {
     modReplace: "取代已安裝的 {0} 版",
     modPartTheme: "主題（顏色、字型、圖片）",
     modPartIdentity: "身分卡文字（標語與簡介）",
+    modPartAmbient: "環境效果（飄落、上升、閃爍或點擊符號）",
     modPartWidget_chat_header: "聊天標頭小工具",
     modPartWidget_details: "詳細資料頁小工具",
     modPartWidget_sidebar: "你的側邊欄小工具",
@@ -855,7 +903,7 @@ register("settings", {
     modUninstallConfirm: "要解除安裝 {0} 嗎？它的效果會離開你的效果庫，除非還有東西在使用。它已套用的外觀會保留。",
     modUninstalled: "已解除安裝 {0}。",
     modExport: "匯出 mod",
-    modExportLead: "用目前生效的外觀做成 mod 檔案：某個 agent 的主題、身分卡文字與小工具、你的側邊欄小工具、你的自訂 CSS。",
+    modExportLead: "把目前生效的外觀存成 mod 檔。",
     modExportInstance: "Agent",
     modExportName: "名稱（a-z、0-9、-）",
     modExportVersion: "版本",
@@ -867,7 +915,7 @@ register("settings", {
     modReview: "檢視",
     modDismiss: "略過",
     cssTitle: "自訂 CSS（只套用在你自己）",
-    cssLead: "你自己的樣式表，只套用在你自己的畫面：你登入的每一台裝置都會套用，不會影響別人，也不會套用在設定頁。它無法從網路載入任何東西；圖片和字型請放在下方的「資源」，再用 url(\"asset:<id>\") 引用。",
+    cssLead: "只套用在你的畫面。",
     cssLoadFailed: "無法載入你的自訂 CSS。請重新整理頁面再試一次。",
     cssPublicLink: "臨時公開連結無法使用自訂 CSS。",
     cssInForce: "使用中：{0}",
@@ -880,15 +928,14 @@ register("settings", {
     cssCurrent: "使用中",
     cssRestore: "改用這版",
     cssAssets: "資源",
-    cssAssetsLead: "PNG、WebP、JPEG、GIF 或 WOFF2。目前 {0} / {1} 個檔案，共 {2}（上限 1 MiB）。會移除 GPS 等中繼資料。",
+    cssAssetsLead: "{0} / {1} 個檔案，合計 {2}（全部合計最多 1 MiB）。",
     cssAssetAdd: "加入圖片或字型",
     cssAssetCopy: "複製引用",
     cssCopied: "已複製 {0}",
     cssAssetRemove: "移除",
     cssDeviceTitle: "這台裝置",
     cssDeviceOff: "在這台裝置關閉自訂 CSS",
-    cssDeviceOffLead: "只影響這個瀏覽器，你的其他裝置照常套用。",
-    cssSafe: "畫面被藏起來或壞掉了嗎？在任何頁面網址的最後加上 ?safe=1，就會不套用自訂 CSS 地載入。",
+    cssSafe: "畫面被藏起來？在網址後加上 ?safe=1。",
     cssError_at_rule: "未儲存：不允許使用 {0}。",
     cssError_url: "未儲存：url() 只能用 url(\"asset:<id>\") 引用「資源」裡的檔案。",
     cssError_unknown_asset: "未儲存：找不到資源 {0}。請先在「資源」加入它。",
@@ -921,6 +968,28 @@ register("settings", {
     webTerminalTtl: "終端機 session 分鐘數（1–20）",
     webTerminalTtlRange: "必須是 1 到 20 之間的整數",
     webReadOnlyTitle: "在 fleet.yaml 設定",
+    guestsTitle: "訪客", guestsReview: "檢視訪客變更",
+    guestsHint: "不是管理者的人可以用訪客身分登入網頁：在他本來就能聊天的地方傳 /web，就會私下收到登入碼。訪客只會看到在聊天中本來就能用的 agent，他的訊息僅供辨識。",
+    guestsEnabled: "訪客登入", guestsEnabledHint: "關閉：沒有人能以訪客登入，所有訪客 session 都會結束。開啟需 fleet admin 確認。",
+    guestsChat: "訪客可以聊天", guestsChatHint: "關閉：訪客可以讀他的 agent 的聊天，但不能送訊息、附加檔案、按回覆的按鈕或按取消。",
+    guestsOpenFor: "{0}（{1}）訪客可用的 agent", guestsOpenHint: "這個連線對所有人開放，沒有人員名單：它的訪客只能用你在這裡勾選的 agent（預設沒有）。新增 agent 需 fleet admin 確認。",
+    guestsList: "訪客帳號", guestsNone: "還沒有訪客登入過。", guestsLoadFailed: "無法載入訪客清單。",
+    guestFacts: "agent：{0} · session：{1} · 記住的瀏覽器：{2}", guestLastActive: "最後使用 {0}", guestNotSignedIn: "目前未登入",
+    guestNotNarrowed: "可用他在聊天中能用的所有 agent。", guestNarrowedTo: "已縮小為：{0}", guestNothing: "無",
+    guestNarrow: "縮小範圍", guestNotReachable: "（已無法使用）", guestReachesNothing: "這個帳號目前在聊天中沒有能用的 agent，沒有可以縮小的範圍。", guestNarrowLift: "取消縮小", guestNarrowHint: "勾選這位訪客仍可使用的 agent。縮小只會拿走權限（立即生效）；放寬或取消縮小需 fleet admin 確認。",
+    guestSignOut: "登出", guestSignOutTitle: "登出這位訪客？", guestSignOutConfirm: "{0} 的訪客 session 會立即結束，登入碼失效，記住的瀏覽器也會被忘記。訪客登入開啟期間，他可以再傳 /web 登入。",
+    guestSignedOut: "已登出 {0}。", guestSignedOutNotDurable: "已暫時登出 {0}，但無法保存：重新啟動後他的 session 可能會恢復。", guestSignOutFailed: "沒有成功，請再試一次。",
+    vaTitle: "網頁授權", vaReview: "檢視網頁授權變更",
+    vaHint: "已登入的 fleet 管理者從網頁送出的訊息，是否帶有他本人帳號的授權，記錄在每則訊息的送達收據中。用私下傳給該帳號的登入碼、透過直接連線的 dashboard 登入的 session，要在 Discord 或 Telegram 上授權一次；公開連結與訪客一律不行。一般的網頁請求，agent 本來就會照做；發布、破壞性操作、花費、密鑰，或把授權交給別人，則需要它。",
+    vaLoadFailed: "無法載入網頁授權。",
+    vaEnabled: "網頁訊息帶有授權", vaEnabledHint: "預設開啟：session 要等它的帳號在 Discord 或 Telegram 上確認後才帶有授權。關閉：網頁訊息都不帶授權，已給出的授權立即視為無；關閉前給出的授權不會恢復。",
+    vaStuckOff: "網頁授權目前是關閉的：它的狀態無法存到這台電腦上（請看 fleet 紀錄）。可以存入後會自動恢復。",
+    vaLoopbackOnly: "只有這台電腦可以授權", vaLoopbackOnlyHint: "開啟：只有這台電腦上的瀏覽器符合，網路或 tailnet 上的不算，之前從其他地方給出的授權視為無。再關掉也不會讓那些授權恢復。",
+    vaLanWarning: "dashboard 也接受 {0} 的連線（web.allowed_hosts）。任何人只要從那裡連上、又拿到被盜的登入，就能以你的名義給出授權。除非你信任所有能連到那裡的人，否則請開啟「只有這台電腦可以授權」。",
+    vaHours: "一次授權的有效期（小時，{0}–{1}）", vaHoursRange: "必須是 1 到 48 之間的數字",
+    vaSessionsTitle: "已授權的 session", vaSessionsNone: "目前沒有已授權的 session。", vaSessionUntil: "{0} 授權 · 到 {1}",
+    vaRevoke: "撤銷網頁授權", vaRevokeTitle: "撤銷所有網頁授權？", vaRevokeConfirm: "到目前為止從網頁給出的授權，從現在起都視為無，所有 session 的授權也會結束。不會登出任何人：session 再授權一次後，送出的訊息會再帶有授權。",
+    vaRevoked: "已撤銷到目前為止的網頁授權。", vaRevokedNotDurable: "已暫時撤銷，但無法保存：在可以保存之前網頁授權會保持關閉，而在那之前重新啟動會讓這次撤銷失效。", vaRevokeFailed: "沒有成功，請再試一次。",
     webReadOnlyLead: "這裡僅供檢視：這些設定決定儀表板監聽和公開的內容。請編輯 fleet.yaml 後執行 agend reload（web.preview_port 與 web.preview_origin 需要重新啟動 AgEnD）。",
     notSet: "未設定（預設）",
     defaultsTitle: "預設值",
@@ -969,7 +1038,19 @@ register("settings", {
     discardOnLeave: "要捨棄 {0} 項尚未套用的變更嗎？",
     applyBusyLocal: "還有一次套用在進行中——請等它完成。",
     applyStepFailed: "在某項變更停下：{0}。之後的變更沒有套用，已重新暫存。",
-    stepWaiting: "等待在聊天中確認",
+    applyError_unsupported_sensitive_effect: "它改到的設定無法在確認中安全顯示，所以什麼都沒有改",
+    applyError_confirmation_diff_too_large: "一次要確認的內容太多；請分幾次套用",
+    applyError_session_required: "你的登入已經結束；請重新登入再套用",
+    applyError_admin_required: "只有 fleet 管理者能確認它",
+    applyError_settings_changed: "設定在這期間被改過了；請檢查後再套用一次",
+    applyError_request_no_longer_current: "設定在這期間被改過了；請檢查後再套用一次",
+    applyError_too_many_pending_changes: "等待確認的變更太多；請先確認或撤回一些",
+    applyError_fleet_unavailable: "fleet 沒有在執行",
+    applyError_invalid_settings_effect: "改完的結果不是有效的設定",
+    applyError_settings_confirmation_unavailable: "無法建立它的確認；請再試一次",
+    applyError_failed: "伺服器無法套用它",
+    applyErrorOther: "伺服器拒絕了它（{0}）",
+    stepWaiting: "等待確認",
     stepSkipped: "未套用",
     viaRestart: "（重新啟動）",
     format: "格式",
@@ -986,7 +1067,6 @@ register("settings", {
     discordUserPlaceholder: "你的 Discord 使用者 id",
     telegramUserPlaceholder: "你的 Telegram 使用者 id",
     bindingApplyButton: "改綁",
-    webEchoEnable: "開啟網頁轉發",
     help1: "Agent：每個 agent 的設定、啟動/停止、暫停/喚醒，以及新增 agent。",
     help2: "連線：誰可以使用各個 bot、它的綁定、狀態表情、新的 token；以及供應商 API key。",
     help3: "ClassicBot：每個房間的 backend、model 與選項。",

package/dist/ui/settings-web-authority.js

@@ -0,0 +1,91 @@
+// #1939 S2a: Settings → Web → Web authority — whether a signed-in admin's web messages carry their account's authority
+// in delivery receipts (docs/design/1939-verified-web-sessions.md §0, §0.1, §3, §10): the server switch (on by default),
+// "Only this computer can authorize", how long a session's authorization lasts, the sessions authorized now, and "Revoke
+// web authority". Changes go through Review changes → Apply like every Settings edit, and apply at once (§0.1: none of
+// them grants anything by itself — a session still needs its account's Confirm in Discord or Telegram).
+import { html, useEffect, useState } from "/assets/app-html.js";
+import { t } from "/assets/app-i18n.js";
+import { toast } from "/assets/ui-toast.js";
+import { confirmDialog } from "/assets/ui-confirm.js";
+import { api } from "./settings-confirm.js";
+import { Feedback } from "./settings-dialogs.js";
+import { resetWebAuthorization } from "/assets/web-authorize.js";
+import "./settings-strings.js";
+
+const tn = (k, ...v) => t(`settings.${k}`, ...v);
+
+/** What changed against what fleet.yaml says, as the PUT /api/settings/fleet/web body's `verified_authority` (null: nothing). */
+export function verifiedAuthorityBody(original, f) {
+  const out = {};
+  if (f.enabled !== original.enabled) out.enabled = f.enabled ? null : false;                   // §0.1: on is the default
+  if (f.loopbackOnly !== original.loopbackOnly) out.loopback_only = f.loopbackOnly ? true : null;
+  if (f.hours !== original.hours) out.max_session_hours = f.hours === null ? null : f.hours;
+  return Object.keys(out).length ? out : null;
+}
+
+export function WebAuthorityCard({ ctx, staged, disabled = false }) {
+  const [overview, setOverview] = useState(null), [failed, setFailed] = useState(false);
+  const [original, setOriginal] = useState(null), [f, setF] = useState(null), [msg, setMsg] = useState(null);
+  const load = async () => {
+    // What changes here (a revoke, the switch) changes this browser's own line: the chat reads it again when it shows.
+    resetWebAuthorization();
+    let r = null;
+    try { r = await api("/api/settings/web-authority"); } catch { r = null; }
+    // Anything but the overview's shape (an older server, an error page) is "could not be loaded", never a crash.
+    const o = r && r.ok ? r.body : null;
+    if (!o || typeof o !== "object" || !o.state || !o.hours || !Array.isArray(o.lanHosts) || !Array.isArray(o.authorized)) { setFailed(true); return; }
+    const c = o.configured || {};
+    const orig = { enabled: c.enabled !== false, loopbackOnly: c.loopback_only === true, hours: typeof c.max_session_hours === "number" ? c.max_session_hours : null };
+    setOverview(o); setFailed(false);
+    setOriginal((prev) => prev || orig);
+    setF((prev) => prev || { ...orig });
+  };
+  useEffect(() => { load(); }, []);
+  const card = (body) => html`<section class="card s-web-authority"><h3>${tn("vaTitle")}</h3><p class="note">${tn("vaHint")}</p>${body}</section>`;
+  if (failed) return card(html`<p class="note" role="status">${tn("vaLoadFailed")} <button type="button" class="btn btn-sm" onClick=${load}>${t("app.retry")}</button></p>`);
+  if (!overview || !f) return card(html`<p class="note">${t("app.loading")}</p>`);
+
+  const set = (patch) => setF((x) => ({ ...x, ...patch }));
+  const hoursText = f.hours === null ? "" : String(f.hours);
+  const hoursError = f.hours !== null && (!Number.isFinite(f.hours) || f.hours < overview.hours.min || f.hours > overview.hours.max) ? "vaHoursRange" : "";
+  const stuckOff = f.enabled && original.enabled && !overview.state.enabled;
+  const warnHosts = !f.loopbackOnly && overview.lanHosts.length > 0;
+  const when = (ms) => new Date(ms).toLocaleString();
+
+  const review = () => {
+    if (hoursError) return;
+    const body = verifiedAuthorityBody(original, f);
+    if (body) ctx.stage("verified_authority", { label: tn("vaTitle"), impact: "now", request: { method: "PUT", url: "/api/settings/fleet/web", body: { verified_authority: body } } });
+    else if (staged.has("verified_authority")) ctx.unstage("verified_authority");
+    setMsg(tn("readyApply"));
+  };
+  const revoke = async () => {
+    const yes = await confirmDialog({ title: tn("vaRevokeTitle"), message: tn("vaRevokeConfirm"), confirmLabel: tn("vaRevoke"), danger: true });
+    if (!yes) return;
+    let r = null;
+    try { r = await api("/api/settings/web-authority/revoke", { method: "POST", body: "{}" }); } catch { r = null; }
+    if (r && r.ok) { toast(tn(r.body && r.body.durable === false ? "vaRevokedNotDurable" : "vaRevoked")); load(); }
+    else toast(tn("vaRevokeFailed"), false);
+  };
+
+  return card(html`<fieldset class="s-va-fields" disabled=${disabled}>
+      ${stuckOff ? html`<p class="note s-va-warn" role="status" id="vaStuckOff">${tn("vaStuckOff")}</p>` : null}
+      <label class="check"><input id="vaEnabled" type="checkbox" checked=${f.enabled} onChange=${(e) => set({ enabled: e.target.checked })} /><span>${tn("vaEnabled")}</span></label>
+      <p class="note">${tn("vaEnabledHint")}</p>
+      <label class="check"><input id="vaLoopbackOnly" type="checkbox" checked=${f.loopbackOnly} onChange=${(e) => set({ loopbackOnly: e.target.checked })} /><span>${tn("vaLoopbackOnly")}</span></label>
+      <p class="note">${tn("vaLoopbackOnlyHint")}</p>
+      ${warnHosts ? html`<p class="note s-va-warn" role="status" id="vaLanWarning">${tn("vaLanWarning", overview.lanHosts.join(", "))}</p>` : null}
+      <div class="field"><label for="vaHours">${tn("vaHours", overview.hours.min, overview.hours.max)}</label>
+        <input id="vaHours" type="number" min=${overview.hours.min} max=${overview.hours.max} step="any" placeholder=${tn("defaultHours", overview.hours.default)}
+          class=${hoursError ? "invalid" : ""} value=${hoursText} onInput=${(e) => set({ hours: e.target.value.trim() === "" ? null : Number(e.target.value) })} />
+        <${Feedback} error=${hoursError} /></div>
+      <h4>${tn("vaSessionsTitle")}</h4>
+      ${overview.authorized.length
+        ? html`<ul class="s-va-sessions" id="vaSessions">${overview.authorized.map((a) => html`<li key=${a.handle} data-handle=${a.handle}>
+            <strong>${a.label}</strong> <span class="note">${a.account}</span><br /><span class="note">${tn("vaSessionUntil", when(a.authorizedAt), when(a.until))}</span></li>`)}</ul>`
+        : html`<p class="note" id="vaSessionsNone">${tn("vaSessionsNone")}</p>`}
+    </fieldset>
+    <div class="save-row"><button type="button" class="btn btn-primary" id="vaReview" disabled=${disabled || !!hoursError} onClick=${review}>${tn("vaReview")}</button>
+      <button type="button" class="btn btn-danger" id="vaRevoke" disabled=${disabled} onClick=${revoke}>${tn("vaRevoke")}</button>
+      ${msg ? html`<span class="note" role="status">${msg}</span>` : null}</div>`);
+}

package/dist/ui/shared/agend-auth.js

@@ -67,7 +67,7 @@
     bar.setAttribute("role", "alert");
     bar.setAttribute("data-trust", "session-ended");
     bar.className = "agend-session-ended";
-    bar.style.cssText = "position:fixed;top:0;left:0;right:0;z-index:2147483647;padding:10px 16px;background:#f85149;color:#fff;font:14px system-ui,sans-serif;text-align:center";
+    bar.style.cssText = "position:fixed;top:0;left:0;right:0;z-index:2147483647;padding:10px 16px;background:#f85149;color:#fff;font:14px system-ui,sans-serif,\"Apple Color Emoji\",\"Segoe UI Emoji\",\"Segoe UI Symbol\",\"Noto Color Emoji\",emoji;text-align:center";
     const zh = /^zh/i.test(navigator.language || "");
     bar.append(document.createTextNode(zh ? "登入已結束。" : "Your session has ended. "));
     const link = document.createElement("a");