@songsid/agend 2.3.0-beta.2 → 2.3.0-beta.21

package/dist/types.d.ts

@@ -172,6 +172,12 @@ export interface InstanceConfig {
      * Mirror Topic are unaffected. Unset inherits `defaults.cross_instance_visibility`, else "full".
      */
     cross_instance_visibility?: "full" | "summary" | "hidden";
+    /**
+     * #2303: how many task board cards handed to this instance it may have in progress at once (claiming another at the
+     * limit is refused). A whole number of at least 1; unset is 1. Cards it opened for itself never count. The fleet
+     * reads it at each claim; the daemon only keeps it current.
+     */
+    board_cards_at_once?: number;
     /**
      * Detect a human-channel turn that ended without a delivered reply and ask
      * the agent to send one bounded recovery reply. Only capable backends use
@@ -345,6 +351,12 @@ export interface WebConfig {
     echo_to_channel?: boolean;
     /** Show the AI subscription usage panel on /view and serve /api/ai-usage (default true). */
     usage_panel?: boolean;
+    /**
+     * #2122: serve the usage report (Fleet → Usage, GET /ui/usage-report) over the temporary public link too (default
+     * false). It is up to 400 days of per-agent, per-model, per-profile activity and amounts — more than the live quota
+     * rail or the cache report the link already shows. Guests never get it.
+     */
+    usage_report_on_public_link?: boolean;
     /**
      * #1937: the largest file the web chat takes, in MB (whole number, 1–500; default 50). Never more than
      * upload_max_total_mb; over the public link a file is at most 95 MB whatever this says (the quick tunnel's limit).
@@ -359,6 +371,15 @@ export interface WebConfig {
      * admin's change, confirmed like any access change (Settings → Web).
      */
     log_tab?: boolean;
+    /**
+     * #2293: the dashboard's global search (Ctrl+K) over chat messages, cross-instance messages and Task Board tasks — an
+     * index of its own (search.db, kept `retention_days`, default 90; search/search-index.ts). `enabled: false`: no index
+     * from the next fleet start (the file is left as it is), and searches are refused at once.
+     */
+    search?: {
+        enabled?: boolean;
+        retention_days?: number;
+    };
     /** Expose provider API-key verify/apply endpoints (default false until dark-shipped). */
     provider_secrets?: boolean;
     /**
@@ -378,7 +399,7 @@ export interface WebConfig {
     /**
      * #1620: how long a web session lasts. Only the LOCAL surface (the dashboard reached directly — loopback, a LAN, a
      * tailnet) is configurable; a public-link session's limits stay fixed. Hours, 1 ≤ idle_hours ≤ absolute_hours ≤ 720;
-     * defaults 12 (absolute, from sign-in) and 2 (idle, since the last use). Shortening applies to existing sessions.
+     * defaults 48 (absolute, from sign-in) and 48 (idle, since the last use; #1670). Shortening applies to existing sessions.
      */
     session?: {
         local?: {
@@ -417,6 +438,47 @@ export interface WebConfig {
      * (and warned about); a change applies to new uploads only.
      */
     appearance?: import("./web-appearance-limits.js").AppearanceLimitsConfig;
+    /**
+     * #1920: guest web sign-in — a non-admin signed in as their own Discord or Telegram account, seeing only the instances
+     * they already use in chat (derived on every request). Default off.
+     */
+    guests?: WebGuestsConfig;
+    /**
+     * #1939: when a signed-in web session's messages carry authority (docs/design/1939-verified-web-sessions.md §3).
+     * S1 records it in receipts only; no agent acts on it yet.
+     */
+    verified_authority?: WebVerifiedAuthorityConfig;
+}
+/** #1939: fleet.yaml `web.verified_authority` (docs/design/1939-verified-web-sessions.md §0, §3, §10). */
+export interface WebVerifiedAuthorityConfig {
+    /**
+     * The server switch (§10): web messages carry authority only while it is on (default true, §0.1). Turning it off makes
+     * every web authority read as none at once; turning it back on never brings back authority given before.
+     */
+    enabled?: boolean;
+    /** "Only this computer can authorize": only loopback requests qualify (default false: LAN and tailnet too). */
+    loopback_only?: boolean;
+    /** A session's authorization lasts this many hours after it was given, 1–48 (default 48). */
+    max_session_hours?: number;
+}
+/** #1920: fleet.yaml `web.guests`. */
+export interface WebGuestsConfig {
+    /** Guest sign-in at all (default false). Turning it off ends every guest session. */
+    enabled?: boolean;
+    /** Guests may chat (default true); false: read-only. */
+    chat?: boolean;
+    /**
+     * An `open` connection's guests reach nothing until an admin names instances here, per connection id (the user's
+     * decision: least privilege, since an open group has no list of people).
+     */
+    open_instances?: Record<string, string[]>;
+    /** An admin's narrowing, per `<connection id>:<user id>`: intersected with the derived scope, never widening it. */
+    narrow?: Record<string, string[]>;
+    /** A guest session's limits: absolute 1–24 h (default 12), idle 15–720 min (default 120). */
+    session?: {
+        absolute_hours?: number;
+        idle_minutes?: number;
+    };
 }
 /** `login:` section — remote /login behaviour. */
 export interface LoginConfig {

package/dist/ui/app-effects.js

@@ -1,14 +1,16 @@
 /** #1629: one session-only app effect owner. Importing this module starts nothing. */
 import { appStore } from "/assets/app-store.js";
+import { motionBlocked, onMotionChange } from "/assets/fx-motion.js";
 import { navStore } from "/assets/app-nav.js";
-import { onPrefsChanged, prefInForce } from "/assets/app-prefs.js";
-import { resolvedMode, themesStore } from "/assets/app-themes.js";
+import { onPrefsChanged } from "/assets/app-prefs.js";
+import { resolvedMode, themesStore, themesShown } from "/assets/app-themes.js";
 import { ownerCssLifecycle, safeMode } from "/assets/owner-css.js";
 import { constrainedDevice } from "/assets/effect-policy.js";
 import { createAppEffectRuntime } from "/assets/effect-app-runtime.js";
+import { effectBootstrapReady } from "/assets/effect-frame.js";
 import { createEffectCursor } from "/assets/effect-cursor.js";
 import { createOwnerEffectRegions } from "/assets/effect-owner-regions.js";
-import { chatEffectIdentity } from "/assets/effect-chat-runtime.js";
+import { chatEffectIdentity, effectPlaybackIdentity } from "/assets/effect-chat-runtime.js";
 import { createEffectTrialController } from "./effect-trial-controller.js";
 import { effectTrialMessage } from "./effect-trial-offer.js";
 import { claimPanel, panelVersion, panelStore, openTrialPanel, closePanel } from "./preview-panel.js";
@@ -19,8 +21,9 @@ export function getAppEffects(host = window) { const value = owners.get(host); r
 export function startAppEffects({ store, window: host = window, factories = {} } = {}) {
   const existing = owners.get(host);
   if (existing) { if (!existing.dead) existing.bindStore(store); return getAppEffects(host); }
-  if (!chatEffectIdentity(host) || typeof host.AgendAuth?.onSessionEnd !== "function" || typeof host.AgendAuth?.sessionEnded !== "function") return null;
-  const doc = host.document, releases = [], ended = new Set(), updates = new Set(), trialUpdates = new Set(); let replyOff = null, replyStore = null, regions = null, cursor = null, cursorStamp = null, trialControl = null, trialIntent = null, trialHint = false, trialSerial = 0, trialStamp = null, chatBinding = null;
+  const playbackIdentity = effectPlaybackIdentity(host), ownerIdentity = chatEffectIdentity(host);
+  if (!playbackIdentity || typeof host.AgendAuth?.onSessionEnd !== "function" || typeof host.AgendAuth?.sessionEnded !== "function") return null;
+  const doc = host.document, releases = [], ended = new Set(), updates = new Set(), trialUpdates = new Set(); let replyOff = null, replyStore = null, regions = null, cursor = null, cursorStamp = null, trialControl = null, trialIntent = null, trialHint = ownerIdentity ? null : false, trialSerial = 0, trialStamp = null, chatBinding = null;
   const safe = fn => { try { return fn(); } catch { return null; } };
   const hold = off => { if (entry.dead) safe(() => off?.()); else releases.push(off); };
   const entry = { dead: false, api: null,
@@ -38,11 +41,23 @@ export function startAppEffects({ store, window: host = window, factories = {} }
         if (entry.dead || replyStore !== value) safe(() => off?.()); else replyOff = off;
       }
     },
-    canTry(message) {
+    trialStatus(message) {
       const offer = safe(() => effectTrialMessage(message)), nav = navStore.get();
-      return !entry.dead && !!chatBinding && safe(() => chatBinding.current()) === true && trialHint && trialControl?.ok === true && !!offer && message.instance === nav.route?.instance && nav.route?.panel === "chat"
-        && trialControl.snapshot().phase === "idle" && !trialControl.snapshot().busy && trialAllowed();
+      const now = safe(() => host.Date.now());
+      if (!offer || !Number.isFinite(now) || now >= offer.expiresAt) return "expired";
+      if (trialHint === null && !entry.dead) return "checking";
+      if (entry.dead || !trialHint || trialControl?.ok !== true) return "localAdmin";
+      if (!chatBinding || safe(() => chatBinding.current()) !== true || message.instance !== nav.route?.instance || nav.route?.panel !== "chat") return "chatChanged";
+      const state = trialControl.snapshot();
+      if (state.phase !== "idle" || state.busy) return "busy";
+      return trialPlaybackStatus();
     },
+    trialFailure(message) {
+      const offer = safe(() => effectTrialMessage(message)), state = trialControl?.snapshot();
+      return offer && state?.phase === "idle" && state.offer === offer.offer && !["stopped", "replaced"].includes(state.reason) ? state.reason : null;
+    },
+    canTry(message) { return entry.trialStatus(message) === "ready"; },
+    stopTrial() { trialControl?.stop(); },
     startTrial(message) {
       if (!entry.canTry(message)) return Promise.resolve(false);
       const nav = navStore.get(); trialIntent = { name: message.instance, seq: nav.seq, claim: claimPanel(), handle: null, chat: chatBinding };
@@ -67,25 +82,69 @@ export function startAppEffects({ store, window: host = window, factories = {} }
     },
   };
   owners.set(host, entry); // Reentrant setup never constructs another owner.
-  let media, coarse, preview;
+  let media, coarse;
+  function ownerCssForPlayback() {
+    if (doc.body.dataset.tier !== "guest") return ownerCssLifecycle.get().state;
+    // Guests never install owner CSS. Prove its absence rather than borrowing the uninstalled
+    // lifecycle's initial unknown, and refuse unexpected styles instead of trusting a missing id.
+    try {
+      if (doc.body.dataset.ownerCss || doc.querySelectorAll("#owner-css").length) return "unknown";
+      // A CSP-refused or disabled STYLE has no paint. Recheck on every proof so enabling
+      // it never borrows an earlier absence verdict (WebKit capture inserts a refused no-op).
+      for (const style of doc.querySelectorAll("style")) if (style.sheet && style.sheet.disabled !== true) return "unknown";
+      const allowed = new Set(["/assets/tokens.css", "/assets/app.css"]);
+      for (const link of doc.querySelectorAll('link[rel~="stylesheet"]')) {
+        const url = new URL(link.getAttribute("href"), host.location.origin);
+        if (url.origin !== host.location.origin || !allowed.has(url.pathname) || url.search || url.hash) return "unknown";
+      }
+      return "off";
+    } catch { return "unknown"; }
+  }
+  function guestChatVersion(value) {
+    if (doc.body.dataset.tier !== "guest") return null;
+    const name = navStore.get().route?.instance, v = value.instances?.find(i => i.name === name)?.effect_chat_v;
+    return typeof v === "string" && /^[a-f0-9]{32}$/.test(v) ? v : null;
+  }
+  // #2188: whether a dialog, menu or popover is open — a whole-document query when none is (the usual case), asked
+  // several times per sync. Read once per task: the cached value is dropped at the next microtask, and whenever the
+  // document changes (the MutationObserver below drops it before it reads).
+  let modalCache = null;
+  function modalOpen() {
+    if (modalCache === null) {
+      modalCache = !!doc.querySelector("dialog[open],.menu-list,.pop,[role=alertdialog],.oc-keep,.shell.sb-open");
+      Promise.resolve().then(() => { modalCache = null; });
+    }
+    return modalCache;
+  }
   function context() {
-    let ready = false; try { ready = preview?.availability().ok === true; } catch { /* unavailable */ }
-    return { safe: safeMode(), publicLink: doc.body.dataset.publicLink === "1", reducedMotion: media?.matches !== false, saveData: host.navigator?.connection?.saveData === true,
-      hidden: doc.visibilityState !== "visible", enabled: typeof host.OffscreenCanvas === "function" && typeof host.Worker === "function" && typeof host.MutationObserver === "function" && typeof host.ResizeObserver === "function",
-      show: prefInForce("fx.show")?.value !== false, previewReady: ready,
-      optIn: prefInForce("preview.optIn")?.value === true && preview?.optedIn() === true && preview?.never() !== true,
+    return { safe: safeMode(), publicLink: doc.body.dataset.publicLink === "1", reducedMotion: motionBlocked(host), saveData: host.navigator?.connection?.saveData === true,
+      hidden: doc.visibilityState !== "visible", enabled: entry.api?.playbackAvailable !== false && typeof host.OffscreenCanvas === "function" && typeof host.Worker === "function" && typeof host.MutationObserver === "function" && typeof host.ResizeObserver === "function",
+      show: themesShown(), transportReady: effectBootstrapReady(host, host.location?.origin, doc.body.dataset.effectBoot),
       constrained: constrainedDevice({ memory: host.navigator?.deviceMemory, cores: host.navigator?.hardwareConcurrency, coarse: coarse?.matches === true, width: host.innerWidth }),
-      modal: !!doc.querySelector("dialog[open],.menu-list,.pop,[role=alertdialog],.oc-keep,.shell.sb-open"), openInstance: null };
+      modal: modalOpen(), openInstance: null };
   }
   function trialCurrent(name) {
     const intent = trialIntent, nav = navStore.get();
     return !entry.dead && host.document === doc && !!intent && !!intent.chat && chatBinding === intent.chat && intent.chat.current() === true && intent.name === name && nav.seq === intent.seq && nav.route?.panel === "chat" && nav.route.instance === name
       && (panelVersion() === intent.claim || intent.handle !== null && panelStore.get().open?.handle === intent.handle);
   }
+  // One priority order feeds both presentation and redraw identity: false→different-false must redraw.
+  function trialPlaybackStatus() {
+    const c = context();
+    if (c.safe) return "safe";
+    if (!c.show) return "effectsOff";
+    if (c.reducedMotion) return "reducedMotion";
+    if (!c.enabled) return "unsupported";
+    if (!c.transportReady) return "transport";
+    if (c.publicLink) return "localAdmin";
+    if (c.hidden || doc.hasFocus?.() !== true) return "inactive";
+    if (c.modal) return "dialog";
+    return "ready";
+  }
   function trialAllowed() {
     const c = context();
-    return !entry.dead && doc.visibilityState === "visible" && doc.hasFocus?.() === true && ownerCssLifecycle.get().state === "off"
-      && c.enabled && c.show && c.previewReady && c.optIn && !c.safe && !c.publicLink && !c.reducedMotion && !c.saveData && !c.hidden && !c.modal;
+    return !entry.dead && doc.visibilityState === "visible" && doc.hasFocus?.() === true
+      && c.enabled && c.show && c.transportReady && !c.safe && !c.publicLink && !c.reducedMotion && !c.hidden && !c.modal;
   }
   function mountTrial(handle) {
     const intent = trialIntent; if (!intent || !trialCurrent(handle.instance) || !handle.current() || !Number.isSafeInteger(++trialSerial)) throw Error("trial_unavailable");
@@ -97,7 +156,7 @@ export function startAppEffects({ store, window: host = window, factories = {} }
       if (panelStore.get().open?.handle === handle) closePanel();
     };
     try {
-      openTrialPanel({ key: binding.key, instance: handle.instance, binding, handle, ownerCss: () => ownerCssLifecycle.get().state,
+      openTrialPanel({ key: binding.key, instance: handle.instance, binding, handle,
         onStage(value) {
           stage = value;
           if (!handle.current()) { cleanup(); handle.stop(); return; }
@@ -111,7 +170,7 @@ export function startAppEffects({ store, window: host = window, factories = {} }
   }
   function notifyTrial() {
     if (entry.dead) return;
-    const nav = navStore.get(), next = JSON.stringify([trialHint, safe(() => chatBinding?.current()) === true, trialAllowed(), nav.route?.panel, nav.route?.instance, trialControl?.snapshot()]);
+    const nav = navStore.get(), next = JSON.stringify([trialHint, safe(() => chatBinding?.current()) === true, trialPlaybackStatus(), nav.route?.panel, nav.route?.instance, trialControl?.snapshot()]);
     if (next === trialStamp) return; trialStamp = next;
     for (const fn of [...trialUpdates]) safe(fn);
   }
@@ -120,47 +179,45 @@ export function startAppEffects({ store, window: host = window, factories = {} }
   function syncCursor() {
     if (entry.dead || !cursor) return;
     const c = context();
-    cursor.update(entry.api?.cursorSelection?.() ?? null, c.enabled && c.show && c.previewReady && c.optIn && !c.safe && !c.publicLink && !c.reducedMotion && !c.saveData && !c.hidden && !c.modal && !cursorDragging());
+    cursor.update(entry.api?.cursorSelection?.() ?? null, c.enabled && c.show && c.transportReady && !c.safe && !c.publicLink && !c.reducedMotion && !c.hidden && !c.modal && !cursorDragging());
   }
   try {
     if (appStore.get().connection === "ended") { entry.dispose(); return null; }
-    preview = host.AgendPreview;
     media = host.matchMedia?.("(prefers-reduced-motion: reduce)") ?? { matches: true };
     coarse = host.matchMedia?.("(pointer: coarse)") ?? { matches: false };
     entry.api = (factories.runtime ?? createAppEffectRuntime)({ window: host, current: () => !entry.dead && host.document === doc,
-      observe: () => ({ context: context(), ownerCss: ownerCssLifecycle.get().state, mode: resolvedMode() }), onDispose: () => entry.dispose(),
+      observe: () => ({ context: context(), ownerCss: ownerCssForPlayback(), mode: resolvedMode() }), onDispose: () => entry.dispose(),
       resolveOwnerTarget: (slot, manifest, proof) => !entry.dead ? regions?.resolve?.(slot, manifest.box, proof) ?? null : null,
       onChange: () => { syncCursor(); notify(); } });
     if (entry.dead || !entry.api.ok) { entry.dispose(); return null; }
-    trialControl = (factories.trialController ?? createEffectTrialController)({ window: host, current: trialCurrent, allowed: trialAllowed, onStart: mountTrial, onChange: notify });
+    if (ownerIdentity) trialControl = (factories.trialController ?? createEffectTrialController)({ window: host, current: trialCurrent, allowed: trialAllowed, onStart: mountTrial, onChange: notify });
     hold(() => trialControl?.dispose());
-    if (typeof host.AgendAuth.trialSession === "function") Promise.resolve().then(() => host.AgendAuth.trialSession()).then(value => {
+    if (ownerIdentity && typeof host.AgendAuth.trialSession === "function") Promise.resolve().then(() => host.AgendAuth.trialSession()).then(value => {
       if (entry.dead) return; trialHint = value?.localAdmin === true && value.epoch === chatEffectIdentity(host)?.epoch; notify();
-    }).catch(() => {});
+    }).catch(() => { if (!entry.dead) { trialHint = false; notify(); } });
     hold(panelStore.subscribe(() => { trialControl?.sync(); notifyTrial(); }));
-    const ownRegions = (factories.regions ?? createOwnerEffectRegions)({ window: host, current: () => !entry.dead && host.document === doc });
+    const ownRegions = ownerIdentity && (factories.regions ?? createOwnerEffectRegions)({ window: host, current: () => !entry.dead && host.document === doc });
     regions = ownRegions?.ok ? ownRegions : null; hold(() => ownRegions?.dispose?.());
     if (entry.dead) return null;
-    const ownCursor = safe(() => (factories.cursor ?? createEffectCursor)({ window: host, current: () => !entry.dead && host.document === doc,
+    const ownCursor = ownerIdentity && safe(() => (factories.cursor ?? createEffectCursor)({ window: host, current: () => !entry.dead && host.document === doc,
       readImage: (selection, signal) => entry.api?.cursorImageSettled?.(selection, signal) ?? Promise.resolve(null),
       onChange(value) { const next = JSON.stringify(value); if (next !== cursorStamp) { cursorStamp = next; notify(); } },
     }));
     cursor = ownCursor?.ok ? ownCursor : null; hold(() => ownCursor?.dispose?.());
     if (entry.dead) return null;
     const sync = () => { if (!entry.dead) { trialControl?.sync(); entry.api.sync(); syncCursor(); notifyTrial(); } };
-    let revision = appStore.get().themesRev, prefsRevision = appStore.get().prefsRev, navSeq = navStore.get().seq;
+    let revision = appStore.get().themesRev, prefsRevision = appStore.get().prefsRev, guestRevision = guestChatVersion(appStore.get()), navSeq = navStore.get().seq;
     hold(navStore.subscribe(value => { if (entry.dead || value.seq === navSeq) return; navSeq = value.seq; trialControl?.stop(); chatBinding = null; entry.api.detachChat(); syncCursor(); }));
     hold(appStore.subscribe(value => {
       if (entry.dead) return;
       if (value.connection === "ended") { entry.dispose(); return; }
-      const chatChanged = value.themesRev !== revision, ownerChanged = value.prefsRev !== prefsRevision;
-      revision = value.themesRev; prefsRevision = value.prefsRev;
+      const guestNext = guestChatVersion(value), chatChanged = value.themesRev !== revision || guestNext !== guestRevision, ownerChanged = value.prefsRev !== prefsRevision;
+      revision = value.themesRev; prefsRevision = value.prefsRev; guestRevision = guestNext;
       if (chatChanged) entry.api.changedChat();
       if (ownerChanged) entry.api.changedOwner();
       if (!chatChanged && !ownerChanged) sync();
     }));
-    hold(ownerCssLifecycle.subscribe(sync)); hold(themesStore.subscribe(sync)); hold(onPrefsChanged(sync));
-    if (typeof preview?.onChange === "function") hold(preview.onChange(sync));
+    hold(ownerCssLifecycle.subscribe(sync)); hold(themesStore.subscribe(sync)); hold(onPrefsChanged(sync)); hold(onMotionChange(sync));
     if (typeof host.AgendTheme?.onChange === "function") hold(host.AgendTheme.onChange(sync));
     for (const [target, type] of [[media, "change"], [coarse, "change"], [doc, "visibilitychange"], [host, "resize"], [host.navigator?.connection, "change"]]) {
       if (target?.addEventListener) { target.addEventListener(type, sync); hold(() => target.removeEventListener(type, sync)); }
@@ -175,6 +232,7 @@ export function startAppEffects({ store, window: host = window, factories = {} }
     };
     const barriers = typeof host.MutationObserver === "function" ? new host.MutationObserver(records => {
       if (entry.dead) return;
+      modalCache = null;      // the document changed: a dialog may have opened or closed (read it again)
       const value = context().modal, drag = cursorDragging(); if (value !== modal || drag !== dragging) { modal = value; dragging = drag; sync(); }
       if (Array.isArray(records) && records.some(r => r.target?.closest?.("#app") || r.target === doc.getElementById?.("app"))) surfaceChanged();
     }) : null;

package/dist/ui/backend-signin.js

@@ -0,0 +1,297 @@
+// #2233: signing a backend in from the dashboard — the dialog, the line every admin page shows while a sign-in runs,
+// and the list Settings → Agents shows. Behind the session gate (/ui/js/); a guest's page never loads it.
+//
+// What the page is told comes from GET /ui/backend-login, as this session may see it (web-backend-login.ts): the
+// session that started a sign-in gets its terminal link, access code and device code; every other admin page only that
+// one runs, on which device, and may cancel it. The stream's `backend_login` event carries nothing — it only says to
+// read again. Starting is two steps, as in chat: check (the server keeps what it found) and start (with its id).
+import { html, useEffect, useState } from "/assets/app-html.js";
+import { t, register } from "/assets/app-i18n.js";
+import { appStore, createStore, useStore } from "/assets/app-store.js";
+import { closeDialog, shellStore, showDialog } from "/assets/app-shell.js";
+import { Dialog } from "/assets/ui-dialog.js";
+import { toast } from "/assets/ui-toast.js";
+
+register("signin", {
+  en: {
+    title: "Sign in to {0}",
+    checking: "Checking whether {0} is signed in…",
+    confirmDevice: "AgEnD runs {0}'s own sign-in on this machine. You get a link and a one-time code here, to finish in your browser.",
+    confirmTerminal: "AgEnD runs {0}'s own sign-in on this machine and opens it as a terminal in your browser (only that sign-in, no shell). You get the link and a one-time access code here.",
+    stillSignedIn: "It is still signed in: signing in again replaces that login.",
+    logoutFirst: "It signs out first ({0}), then in.",
+    publicNote: "Not at this machine? A temporary public link opens the terminal from anywhere, for this sign-in only.",
+    go: "Sign in",
+    goPublic: "Use a temporary public link",
+    cancel: "Cancel",
+    close: "Close",
+    starting: "Starting…",
+    deviceStep: "Open this page and enter the code:",
+    linkStep: "Open this page to sign in; if it gives you a code, paste it into the sign-in terminal:",
+    terminalStep: "Open the sign-in terminal and enter this access code there. It works once, for {0} minutes.",
+    openTerminal: "Open the sign-in terminal",
+    accessCode: "Access code",
+    code: "Code",
+    copy: "Copy",
+    copied: "Copied",
+    publicLink: "Public link: anyone with the link and the code could use it — keep both to yourself.",
+    loopback: "This terminal listens on the machine's own address only. Open it on that machine, or set web_terminal.bind for your network.",
+    waitingHint: "Waiting for the sign-in to show its link…",
+    signedIn: "{0} is signed in.",
+    ended: "The sign-in ended.",
+    cancelSignIn: "Cancel sign-in",
+    cancelled: "Sign-in cancelled.",
+    running: "Signing in to {0} (started on {1}).",
+    open: "Open",
+    expired: "That took too long — start again.",
+    notHere: "Signing in is not available over the public link. Open the dashboard on the machine running AgEnD, or use /login in your chat.",
+    notAdmin: "Only a fleet admin signed in on this machine or its network can sign a backend in.",
+    notOffered: "A public link is not offered for this sign-in.",
+    failed: "That did not work.",
+    listTitle: "Sign-ins",
+    listHint: "Each backend's login on this machine, and each credential profile an agent uses.",
+    stUsable: "signed in",
+    stNotSignedIn: "not signed in",
+    stNotInstalled: "not installed",
+    stTooOld: "too old",
+    stUnknown: "not checked",
+    signIn: "Sign in",
+    signInAgain: "Sign in again",
+    onHost: "Sign in on the machine: {0}",
+    install: "Install on the machine: {0}",
+    update: "Update on the machine: {0}",
+    profile: "{0} · profile {1}",
+  },
+  "zh-TW": {
+    title: "登入 {0}",
+    checking: "正在確認 {0} 是否已登入…",
+    confirmDevice: "AgEnD 會在這台機器上執行 {0} 自己的登入。這裡會給你一個連結和一次性代碼，在瀏覽器完成登入。",
+    confirmTerminal: "AgEnD 會在這台機器上執行 {0} 自己的登入，並在瀏覽器以終端機開啟（只有這個登入，沒有 shell）。這裡會給你連結和一次性存取碼。",
+    stillSignedIn: "它目前仍是登入狀態：重新登入會取代原本的登入。",
+    logoutFirst: "會先登出（{0}），再登入。",
+    publicNote: "不在這台機器前？臨時公開連結可以從任何地方開啟終端機，只用於這次登入。",
+    go: "登入",
+    goPublic: "使用臨時公開連結",
+    cancel: "取消",
+    close: "關閉",
+    starting: "啟動中…",
+    deviceStep: "開啟這個頁面並輸入代碼：",
+    linkStep: "開啟這個頁面登入；如果它給你一組代碼，請貼到登入終端機：",
+    terminalStep: "開啟登入終端機，在那裡輸入這個存取碼。只能用一次，{0} 分鐘內有效。",
+    openTerminal: "開啟登入終端機",
+    accessCode: "存取碼",
+    code: "代碼",
+    copy: "複製",
+    copied: "已複製",
+    publicLink: "公開連結：拿到連結和代碼的人都能使用——兩者都只留給自己。",
+    loopback: "這個終端機只在本機位址上接聽。請在那台機器上開啟，或為你的網路設定 web_terminal.bind。",
+    waitingHint: "等待登入顯示連結…",
+    signedIn: "{0} 已登入。",
+    ended: "登入已結束。",
+    cancelSignIn: "取消登入",
+    cancelled: "已取消登入。",
+    running: "正在登入 {0}（從 {1} 啟動）。",
+    open: "開啟",
+    expired: "等太久了——請重新開始。",
+    notHere: "公開連結上不能登入。請在執行 AgEnD 的機器上開啟儀表板，或在聊天裡用 /login。",
+    notAdmin: "只有在這台機器或它的網路上登入的 fleet 管理員，才能讓後端登入。",
+    notOffered: "這次登入不提供公開連結。",
+    failed: "沒有成功。",
+    listTitle: "登入",
+    listHint: "這台機器上每個 backend 的登入，以及代理使用的每個憑證設定檔。",
+    stUsable: "已登入",
+    stNotSignedIn: "未登入",
+    stNotInstalled: "未安裝",
+    stTooOld: "版本太舊",
+    stUnknown: "未檢查",
+    signIn: "登入",
+    signInAgain: "重新登入",
+    onHost: "在機器上登入：{0}",
+    install: "在機器上安裝：{0}",
+    update: "在機器上更新：{0}",
+    profile: "{0} · 設定檔 {1}",
+  },
+});
+const tn = (k, ...v) => t(`signin.${k}`, ...v);
+const shownOf = (backend, profile) => (profile ? tn("profile", backend, profile) : backend);
+
+/** What this page knows: the current sign-in as this session may see it, and Settings' list. */
+export const signInStore = createStore({ loaded: false, login: null, targets: [] });
+
+let reading = null, again = false;
+/**
+ * Read GET /ui/backend-login (one read at a time). Asked again while one is on its way (an event that came after it was
+ * sent): one more read follows it, so the last change is never missed (#2262 review).
+ */
+export function refreshSignIn() {
+  if (reading) { again = true; return reading; }
+  reading = fetch("/ui/backend-login", { cache: "no-store" })
+    .then((r) => (r.ok ? r.json() : null))
+    .then((b) => { if (b) signInStore.set({ loaded: true, login: b.login || null, targets: Array.isArray(b.targets) ? b.targets : [] }); return b; })
+    .catch(() => null)
+    .finally(() => { reading = null; if (again) { again = false; void refreshSignIn(); } });
+  return reading;
+}
+
+let installed = false;
+/** Once per admin page: listen for `backend_login`, read once, and show the line while a sign-in runs. */
+export function installSignIn() {
+  if (installed || !signInOffered()) return;
+  installed = true;
+  const on = appStore.get().streamOn;
+  if (typeof on === "function") on("backend_login", () => { void refreshSignIn(); });
+  void refreshSignIn();
+  shellStore.set({ banner: SignInLine });
+}
+
+/** Open the dialog for one login (a backend's default one, or a credential profile). */
+export function openSignIn({ backend, profile }) {
+  showDialog(SignInDialog, { backend, ...(profile ? { profile } : {}) });
+}
+
+/** Open the dialog on the running sign-in (its starter's view, or the cancel-only one). */
+function openRunning(login) { showDialog(SignInDialog, { backend: login.backend, ...(login.profile ? { profile: login.profile } : {}), resume: true }); }
+
+async function post(path, body) {
+  try {
+    const res = await fetch(path, { method: "POST", headers: { "Content-Type": "application/json" }, body: JSON.stringify(body) });
+    let json = null; try { json = await res.json(); } catch { /* none */ }
+    return { ok: res.ok, status: res.status, body: json };
+  } catch { return { ok: false, status: 0, body: null }; }
+}
+
+const errorText = (code) => (code === "confirm_expired" ? tn("expired") : code === "tunnel_not_offered" ? tn("notOffered")
+  : code === "sign_in_not_over_public_link" ? tn("notHere") : code === "sign_in_needs_a_local_admin" ? tn("notAdmin") : tn("failed"));
+/** The public link's page (#2233: Sign in is refused there — never offered). */
+export const signInOffered = () => !(typeof document !== "undefined" && document.body && document.body.dataset.publicLink === "1");
+const loopbackHost = (h) => h === "localhost" || h === "::1" || h === "[::1]" || /^127\./.test(h);
+
+function CopyField({ label, value }) {
+  const [copied, setCopied] = useState(false);
+  const copy = async () => { try { await navigator.clipboard.writeText(value); setCopied(true); } catch { toast(value); } };
+  return html`<div class="signin-field"><span class="signin-label">${label}</span><code class="signin-value">${value}</code>
+    <button type="button" class="btn btn-sm" onClick=${copy}>${copied ? tn("copied") : tn("copy")}</button></div>`;
+}
+
+/** The starter's view of a running sign-in: the device link and code, or the terminal and its access code. */
+function Running({ login }) {
+  const { hint, terminal, accessCode } = login;
+  const away = terminal && terminal.loopback && typeof location !== "undefined" && !loopbackHost(location.hostname);
+  return html`<div class="signin-run">
+    ${hint ? html`<p>${hint.code ? tn("deviceStep") : tn("linkStep")}</p>
+      ${hint.linkable ? html`<p><a data-trust="navigation" class="btn btn-primary" href=${hint.url} target="_blank" rel="noopener noreferrer">${tn("open")}</a> <span class="signin-url">${hint.url}</span></p>`
+        : html`<${CopyField} label="URL" value=${hint.url} />`}
+      ${hint.code ? html`<${CopyField} label=${tn("code")} value=${hint.code} />` : null}` : null}
+    ${terminal ? html`<p>${tn("terminalStep", terminal.ttlMinutes)}</p>
+      <p><a data-trust="navigation" class="btn btn-primary" href=${terminal.url} target="_blank" rel="noopener noreferrer">${tn("openTerminal")}</a></p>
+      ${accessCode ? html`<${CopyField} label=${tn("accessCode")} value=${accessCode} />` : null}
+      ${terminal.public ? html`<p class="signin-note">${tn("publicLink")}</p>` : null}
+      ${away ? html`<p class="signin-note">${tn("loopback")}</p>` : null}` : null}
+    ${!hint && !terminal ? html`<p class="signin-note">${tn("waitingHint")}</p>` : null}
+  </div>`;
+}
+
+export function SignInDialog({ backend, profile, resume = false, onClose }) {
+  const s = useStore(signInStore);
+  const [step, setStep] = useState(resume ? { kind: "login" } : { kind: "checking" });
+  const [busy, setBusy] = useState(false);
+  const shown = shownOf(backend, profile);
+  const close = onClose || closeDialog;
+  useEffect(() => {
+    if (resume) return undefined;
+    let gone = false;
+    post("/ui/backend-login/check", { backend, ...(profile ? { profile } : {}) }).then((r) => {
+      if (gone) return;
+      if (r.body && r.body.confirm) setStep({ kind: "confirm", confirm: r.body.confirm });
+      else setStep({ kind: "message", text: (r.body && (r.body.message || (r.body.error && errorText(r.body.error)))) || tn("failed") });
+    });
+    return () => { gone = true; };
+  }, []);
+  const login = s.login;
+  const live = step.kind === "login" && login && login.phase === "running";
+  // While a running sign-in is on screen, read it every 2 s too (a page without the stream still sees it move).
+  useEffect(() => {
+    if (!live) return undefined;
+    const h = setInterval(() => { void refreshSignIn(); }, 2000);
+    return () => clearInterval(h);
+  }, [live]);
+  const start = async (tunnel) => {
+    setBusy(true); setStep({ kind: "starting" });
+    const r = await post("/ui/backend-login/start", { confirm: step.confirm.id, ...(tunnel ? { tunnel: true } : {}) });
+    setBusy(false);
+    if (r.body && r.body.login) { signInStore.set({ login: r.body.login }); setStep({ kind: "login" }); return; }
+    setStep({ kind: "message", text: (r.body && (r.body.message || (r.body.error && errorText(r.body.error)))) || tn("failed") });
+  };
+  const cancelRun = async () => {
+    setBusy(true);
+    const r = await post("/ui/backend-login/cancel", {});
+    setBusy(false);
+    toast((r.body && r.body.message) || tn("cancelled"));
+    void refreshSignIn();
+  };
+  let body, actions;
+  if (step.kind === "checking" || step.kind === "starting") {
+    body = html`<p role="status">${step.kind === "checking" ? tn("checking", shown) : tn("starting")}</p>`;
+    actions = html`<button type="button" class="btn" disabled=${busy} onClick=${close}>${tn("cancel")}</button>`;
+  } else if (step.kind === "confirm") {
+    const c = step.confirm;
+    body = html`<p>${c.deviceAuth ? tn("confirmDevice", shown) : tn("confirmTerminal", shown)}</p>
+      ${c.tokenPresent ? html`<p>${tn("stillSignedIn")}</p>` : null}
+      ${c.logoutFirst ? html`<p>${tn("logoutFirst", c.logoutFirst)}</p>` : null}
+      ${c.publicLink ? html`<p class="signin-note">${tn("publicNote")}</p>` : null}`;
+    actions = html`<button type="button" class="btn" onClick=${close}>${tn("cancel")}</button>
+      ${c.publicLink ? html`<button type="button" class="btn" onClick=${() => start(true)}>${tn("goPublic")}</button>` : null}
+      <button type="button" class="btn btn-primary" onClick=${() => start(false)}>${tn("go")}</button>`;
+  } else if (step.kind === "message") {
+    body = html`<p class="signin-message">${step.text}</p>`;
+    actions = html`<button type="button" class="btn btn-primary" onClick=${close}>${tn("close")}</button>`;
+  } else if (!login) {
+    body = html`<p class="signin-note">${tn("ended")}</p>`;
+    actions = html`<button type="button" class="btn btn-primary" onClick=${close}>${tn("close")}</button>`;
+  } else if (!login.mine) {
+    body = html`<p>${login.phase === "running" ? tn("running", shownOf(login.backend, login.profile), login.startedOn) : tn("ended")}</p>`;
+    actions = html`<button type="button" class="btn" onClick=${close}>${tn("close")}</button>
+      ${login.phase === "running" ? html`<button type="button" class="btn btn-danger" disabled=${busy} onClick=${cancelRun}>${tn("cancelSignIn")}</button>` : null}`;
+  } else {
+    const lines = Array.isArray(login.lines) ? login.lines : [];
+    body = html`${login.phase === "running" ? html`<${Running} login=${login} />`
+        : html`<p role="status" class=${login.ok ? "signin-ok" : "signin-message"}>${login.ok ? tn("signedIn", shownOf(login.backend, login.profile)) : tn("ended")}</p>`}
+      ${lines.length ? html`<ul class="signin-lines">${lines.map((l, i) => html`<li key=${i}>${l}</li>`)}</ul>` : null}`;
+    actions = html`<button type="button" class="btn" onClick=${close}>${tn("close")}</button>
+      ${login.phase === "running" ? html`<button type="button" class="btn btn-danger" disabled=${busy} onClick=${cancelRun}>${tn("cancelSignIn")}</button>` : null}`;
+  }
+  return html`<${Dialog} title=${tn("title", shown)} onClose=${close} busy=${busy} actions=${actions}>${body}</${Dialog}>`;
+}
+
+/** The line every admin page shows while a sign-in runs (the shell's banner slot). */
+export function SignInLine() {
+  const { login } = useStore(signInStore);
+  if (!login || login.phase !== "running") return null;
+  return html`<div data-trust="status" class="conn op-line signin-line" role="status">
+    <span>${tn("running", shownOf(login.backend, login.profile), login.startedOn)}</span>
+    <button type="button" class="btn btn-sm" onClick=${() => openRunning(login)}>${tn("open")}</button></div>`;
+}
+
+const STATE_KEY = { usable: "stUsable", not_signed_in: "stNotSignedIn", not_installed: "stNotInstalled", too_old: "stTooOld", unknown: "stUnknown" };
+
+/** Settings → Agents: each login on this machine, with Sign in where the dashboard can do it. */
+export function SignInList() {
+  const { targets, loaded, login } = useStore(signInStore);
+  useEffect(() => { void refreshSignIn(); }, []);
+  if (!loaded || !targets.length) return null;
+  const running = login && login.phase === "running";
+  return html`<section class="s-group signin-list" aria-label=${tn("listTitle")}>
+    <div class="list-head"><span>${tn("listTitle")}</span></div>
+    <p class="sub">${tn("listHint")}</p>
+    ${targets.map((x) => html`<div key=${`${x.backend}:${x.profile || ""}`} class="s-row">
+      <span class="s-name">${shownOf(x.backend, x.profile)}</span>
+      <span class="tag">${tn(STATE_KEY[x.state] || "stUnknown")}</span>
+      <span class="s-br" aria-hidden="true"></span>
+      ${x.install ? html`<span class="s-meta"><code>${tn("install", x.install)}</code></span>` : null}
+      ${x.update ? html`<span class="s-meta"><code>${tn("update", x.update)}</code></span>` : null}
+      ${x.hostCommand ? html`<span class="s-meta"><code>${tn("onHost", x.hostCommand)}</code></span>` : null}
+      <span class="s-actions">${x.signIn ? html`<button type="button" class=${x.state === "not_signed_in" ? "btn btn-sm btn-primary" : "btn btn-sm"} disabled=${!!running}
+        onClick=${() => openSignIn(x)}>${x.state === "usable" ? tn("signInAgain") : tn("signIn")}</button>` : null}</span>
+    </div>`)}
+  </section>`;
+}