@songsid/agend 2.3.0-beta.2 → 2.3.0-beta.21

package/dist/ui/shared/usage-dialog.js

@@ -4,6 +4,7 @@
 import { html, useEffect, useLayoutEffect, useMemo, useRef, useState } from "./app-html.js";
 import { t } from "./app-i18n.js";
 import { useLease } from "./app-ctx.js";
+import { guestPage } from "./app-store.js";
 import { readStream } from "./read-stream.js";
 import { Dialog } from "./ui-dialog.js";
 import { ErrorState, Skeleton } from "./ui-states.js";
@@ -38,6 +39,24 @@ function resetText(iso) {
   if (ms <= 0) return tn("usage.reset.soon");
   return usageText("", { key: "usage.reset.in", args: [usageDuration(ms)] });
 }
+/** "14:05" today, "10/19 14:05" another day, in this browser's time: when last known numbers were read, a window reset. */
+export function usageClock(iso, now = Date.now()) {
+  const at = new Date(iso || "");
+  if (Number.isNaN(at.getTime())) return "";
+  const hm = `${String(at.getHours()).padStart(2, "0")}:${String(at.getMinutes()).padStart(2, "0")}`;
+  return new Date(now).toDateString() === at.toDateString() ? hm : `${at.getMonth() + 1}/${at.getDate()} ${hm}`;
+}
+/**
+ * A row showing its last known numbers (the live read failed; #2236 follow-up): "已過期 · 快取於 14:05" and, for an expiry
+ * or another failure, what to do on a second line (its full text is the mark's tooltip too). A row from an older
+ * server (no `cachedAt`) says its hint, as before.
+ */
+export function staleNote(p) {
+  if (!p.stale) return null;
+  if (!p.cachedAt || !p.staleCause) return { mark: usageText(p.hint || "", p.hintI18n), detail: "" };
+  const detail = p.staleCause !== "transient" && (p.hint || p.hintI18n) ? usageText(p.hint || "", p.hintI18n) : "";
+  return { mark: usageText("", { key: `usage.stale.${p.staleCause}`, args: [usageClock(p.cachedAt)] }), detail };
+}
 function expiryText(iso) {
   if (!iso) return "";
   const at = new Date(iso), ms = at.getTime() - Date.now();
@@ -47,6 +66,8 @@ function expiryText(iso) {
 export function UsageMetric({ m }) {
   const bar = useRef(null);
   const label = usageText(m.label, m.labelI18n);
+  // Its window has reset since these numbers were read: no number and no bar — an old one is never shown as current.
+  if (m.resetPassed) return html`<div class="u-metric u-reset-since"><div class="u-row"><span class="u-label">${label}</span><span class="u-val">${usageText("", { key: "usage.metric.reset_since", args: [usageClock(m.resetsAt)] })}</span></div></div>`;
   const note = m.note ? usageText(m.note, m.noteI18n) : "";
   const pct = m.type === "percent" ? Math.min(100, Math.max(0, m.used ?? 0)) : 0;
   useLayoutEffect(() => { if (bar.current) bar.current.style.width = `${pct}%`; }, [pct]);   // CSSOM (#1300)
@@ -69,10 +90,13 @@ export function UsageMetric({ m }) {
 /**
  * #2014: a row's title. A credential profile's row (`profile`; its API `name` is "Claude (<profile>)") shows the
  * provider name on the title line beside the plan badge, and the profile on its own full-width muted line under it;
- * the full name is the tooltip, and the dialog shows the profile unclipped. Any other row: its name.
+ * the full name is the tooltip, and the dialog shows the profile unclipped. The default login's row beside profiles
+ * (`defaultLogin`; "Claude (default)", #2236) does the same with "default" in the page's language, never a clipped
+ * "Claude (d…". Any other row: its name.
  */
 export function providerTitle(p) {
   const name = String((p && p.name) || ""), profile = p && typeof p.profile === "string" && p.profile ? p.profile : "";
+  if (!profile && p && p.defaultLogin === true && name.endsWith(" (default)")) return { base: name.slice(0, -" (default)".length), profile: tn("usage.default_login") };
   const suffix = ` (${profile})`;
   return profile && name.endsWith(suffix) ? { base: name.slice(0, -suffix.length), profile } : { base: name, profile };
 }
@@ -144,14 +168,14 @@ export function UsageBody({ owner }) {
   else {
     const providers = ordered(data.providers);
     content = html`${!providers.length ? html`<p class="note">${tn("usage.empty_active")}</p>` : null}
-      ${providers.map((p, i) => html`<section key=${key(p)} class="u-provider">
+      ${providers.map((p, i) => html`<section key=${key(p)} class=${p.stale ? "u-provider is-stale" : "u-provider"}>
         <div class="u-head"><strong title=${p.name}>${providerTitle(p).base}</strong>${p.plan ? html`<span class="pill u-plan" title=${p.plan}><span aria-hidden="true">${planBadge(p.plan)}</span><span class="sr-only">${p.plan}</span></span>` : null}
           <span class="u-order">
             <button type="button" class="icon-btn" disabled=${i === 0} aria-label=${tn("usageMoveUp")} title=${tn("usageMoveUp")} onClick=${() => move(key(p), -1, data.providers)}><${Icon} name="up" size=${14} /></button>
             <button type="button" class="icon-btn" disabled=${i === providers.length - 1} aria-label=${tn("usageMoveDown")} title=${tn("usageMoveDown")} onClick=${() => move(key(p), 1, data.providers)}><${Icon} name="down" size=${14} /></button>
           </span></div>
         ${providerTitle(p).profile ? html`<div class="u-profile" title=${p.name}>${providerTitle(p).profile}</div>` : null}
-        ${p.stale ? html`<p class="note">${usageText(p.hint || "", p.hintI18n)}</p>` : null}
+        ${p.stale ? html`<p class="note u-stale" title=${staleNote(p).detail || null}>${staleNote(p).mark}</p>${staleNote(p).detail ? html`<p class="note u-stale-detail">${staleNote(p).detail}</p>` : null}` : null}
         ${p.status === "error" && !p.transient ? html`<p class="u-err">${usageText(p.error || tn("usage.error_fallback"), p.errorI18n)}</p>`
           : p.status === "error" && p.transient ? html`<p class="note">${usageText(p.error || tn("usage.error_fallback"), p.errorI18n)}</p>`
           : p.status === "no-credentials" ? html`<p class="note">${tn("usage.not_logged_in")}</p>${p.hint ? html`<p class="note">${usageText(p.hint, p.hintI18n)}</p>` : null}`
@@ -159,11 +183,18 @@ export function UsageBody({ owner }) {
             ${!p.stale && p.hint ? html`<p class="note">${usageText(p.hint, p.hintI18n)}</p>` : !(p.metrics || []).length ? html`<p class="note">${tn("usage.no_data")}</p>` : null}`}
       </section>`)}
       <div class="u-foot"><span class="note" title=${new Date(data.fetchedAt).toLocaleString()}>${updatedAgo(data.fetchedAt)}${data.refreshing ? html` · <span class="u-refreshing">${tn("usageRefreshing")}</span>` : null}</span>
+        ${byAgent() ? html`<a class="btn btn-ghost btn-sm u-by-agent" href="/ui/fleet/usage" title=${tn("usageByAgentTitle")}>${tn("usageByAgent")}</a>` : null}
         <button type="button" class="btn btn-sm" onClick=${() => load(true)}>${tn("usageRefresh")}</button></div>`;
   }
   return content;
 }
 
+/**
+ * #2122: the plans above are per login; each agent's own tokens and API-equivalent are Fleet → Usage — linked from the
+ * app (not View's anonymous reader, not a guest, who has no Fleet).
+ */
+const byAgent = () => !guestPage() && typeof location !== "undefined" && location.pathname.startsWith("/ui");
+
 /** `owner`: the navigation that opened it — its reads and the minute's timer live and end with it. */
 export function UsageDialog({ onClose, owner = "" }) {
   return html`<${Dialog} title=${tn("usage.title")} onClose=${onClose} wide=${true}><${UsageBody} owner=${`usage-dialog:${owner}`} /></${Dialog}>`;

package/dist/ui/shared/view-strings.js

@@ -40,6 +40,8 @@ register("view", {
   "usageMinutes": "{n} min",
   "usageHours": "{n} h",
   "usageRefresh": "Refresh",
+  "usageByAgent": "By agent →",
+  "usageByAgentTitle": "Each agent's tokens and API-equivalent (Fleet → Usage)",
   "usageHigh": "high",
   "usageNear": "near limit",
   "usageMoveUp": "Move up",
@@ -51,6 +53,16 @@ register("view", {
   "tooltipEffort": "Effort: {value}",
   "tooltipCost": "Cost: {value}",
   "tooltipUnavailable": "Unavailable",
+  "srcConfigured": " (configured)",
+  "srcFleetDefault": " (fleet default)",
+  "modelDefault": "default",
+  "modelDefaultWhy": "default ({reason})",
+  "modelCliDefault": "{model} (default)",
+  "modelWhyStart": "detected when it starts",
+  "modelWhyCli": "this CLI does not report a default",
+  "groupOther": "Other",
+  "groupTeam": "Team",
+  "groupTag": "Tag",
   "statusRunning": "Running",
   "statusPaused": "Paused",
   "statusStopped": "Stopped",
@@ -63,6 +75,7 @@ register("view", {
   "usage.title_plain": "AI subscription usage",
   "usage.empty_active": "No active backends with usage tracking",
   "usage.not_logged_in": "not logged in",
+  "usage.default_login": "default",
   "usage.error_fallback": "error",
   "usage.no_data": "no data",
   "usage.reset.in": "resets in {0}",
@@ -125,6 +138,10 @@ register("view", {
   "usage.error.rate_limited": "Rate limited by {0} — try again later.",
   "usage.error.rate_limited_transient": "{0}: can't fetch usage right now (rate limited). This does not affect your agents.",
   "usage.stale_rate_limited": "data from {0} min ago — can't refresh right now",
+  "usage.stale.expired": "expired · cached at {0}",
+  "usage.stale.transient": "not updated · cached at {0}",
+  "usage.stale.error": "couldn't read · cached at {0}",
+  "usage.metric.reset_since": "reset since {0}",
   "usage.error.http": "Usage request failed (HTTP {0}).",
   "usage.error.billing_http": "Billing request failed (HTTP {0}).",
   "usage.error.invalid_response": "Invalid response from usage endpoint.",
@@ -162,6 +179,9 @@ register("view", {
   "cardBio": "Bio (up to 280 characters, 3 line breaks)",
   "cardPortrait": "Portrait",
   "cardBanner": "Banner",
+  "cardBannerFocus": "Banner focus",
+  "cardBannerFocusNote": "What stays in view when the banner is cropped: the dashed area shows on every screen and card size; the yellow one is a phone's medium card.",
+  "cardFocusFollow": "Follow the agent's",
   "cardRemove": "Remove yours",
   "cardKeep": "Keep yours",
   "clearCard": "Clear card",
@@ -198,6 +218,22 @@ register("view", {
   "favDown": "Move {name} down",
   "favFull": "Favorites are full ({max})",
   "favFiltered": "Clear the filter to reorder favorites",
+  "favSorted": "Favorites are sorted by last reply — set them back to your order to move them",
+  "replyJustNow": "just now",
+  "replyMinutes": "{n} min ago",
+  "replyHours": "{n} h ago",
+  "replyYesterday": "yesterday",
+  "replyDays": "{n} d ago",
+  "replyTitle": "Last replied: {time}",
+  "sortTitle": "Sort the list",
+  "sortCustom": "Custom",
+  "sortCustomHint": "Your own order (drag rows); replies never move them",
+  "sortRecent": "Recent replies",
+  "sortRecentHint": "No groups: the last reply first",
+  "sortFavs": "Favorites, in Recent replies",
+  "sortFavsFixed": "Pinned on top, in your order",
+  "sortFavsRecent": "Sorted by last reply too",
+  "recentOthers": "Recent replies first",
   "pinnedCurrent": "Current",
   "pinnedLabel": "The instance you have open"
  },
@@ -237,6 +273,8 @@ register("view", {
   "usageMinutes": "{n} 分鐘",
   "usageHours": "{n} 小時",
   "usageRefresh": "重新整理",
+  "usageByAgent": "依 agent →",
+  "usageByAgentTitle": "每個 agent 的 token 與 API 等值（Fleet → 用量）",
   "usageHigh": "偏高",
   "usageNear": "接近上限",
   "usageMoveUp": "上移",
@@ -248,6 +286,16 @@ register("view", {
   "tooltipEffort": "推理強度：{value}",
   "tooltipCost": "費用：{value}",
   "tooltipUnavailable": "無資料",
+  "srcConfigured": "（設定值）",
+  "srcFleetDefault": "（fleet 預設）",
+  "modelDefault": "預設",
+  "modelDefaultWhy": "預設（{reason}）",
+  "modelCliDefault": "{model}（預設）",
+  "modelWhyStart": "啟動時偵測",
+  "modelWhyCli": "這個 CLI 不提供預設值",
+  "groupOther": "其他",
+  "groupTeam": "團隊",
+  "groupTag": "標籤",
   "statusRunning": "運行中",
   "statusPaused": "已暫停",
   "statusStopped": "已停止",
@@ -260,6 +308,7 @@ register("view", {
   "usage.title_plain": "AI 訂閱用量",
   "usage.empty_active": "沒有使用中且支援用量追蹤的 Backend",
   "usage.not_logged_in": "未登入",
+  "usage.default_login": "預設",
   "usage.error_fallback": "錯誤",
   "usage.no_data": "無資料",
   "usage.reset.in": "{0} 後重置",
@@ -322,6 +371,10 @@ register("view", {
   "usage.error.rate_limited": "{0} 暫時限制請求速率，請稍後再試。",
   "usage.error.rate_limited_transient": "暫時查不到 {0} 用量（{0} 限制查詢頻率），不影響你的 agent。",
   "usage.stale_rate_limited": "{0} 分鐘前的資料，暫時無法更新",
+  "usage.stale.expired": "已過期 · 快取於 {0}",
+  "usage.stale.transient": "暫時無法更新 · 快取於 {0}",
+  "usage.stale.error": "讀取失敗 · 快取於 {0}",
+  "usage.metric.reset_since": "已於 {0} 重置",
   "usage.error.http": "用量請求失敗（HTTP {0}）。",
   "usage.error.billing_http": "計費請求失敗（HTTP {0}）。",
   "usage.error.invalid_response": "用量端點回傳了無效資料。",
@@ -359,6 +412,9 @@ register("view", {
   "cardBio": "簡介（最多 280 個字、3 次換行）",
   "cardPortrait": "肖像",
   "cardBanner": "橫幅",
+  "cardBannerFocus": "橫幅焦點",
+  "cardBannerFocusNote": "橫幅被裁切時保留在畫面中的部分：虛線框在所有螢幕與卡片大小都看得到；黃色框是手機上中卡片的範圍。",
+  "cardFocusFollow": "跟隨 agent 的設定",
   "cardRemove": "移除你的",
   "cardKeep": "保留你的",
   "clearCard": "清除卡片",
@@ -395,6 +451,22 @@ register("view", {
   "favDown": "把 {name} 下移",
   "favFull": "最愛已滿（{max} 個）",
   "favFiltered": "清除篩選後才能調整最愛順序",
+  "favSorted": "最愛目前依最近回覆排序；改回「照你的順序」才能移動",
+  "replyJustNow": "剛剛",
+  "replyMinutes": "{n} 分鐘前",
+  "replyHours": "{n} 小時前",
+  "replyYesterday": "昨天",
+  "replyDays": "{n} 天前",
+  "replyTitle": "最後回覆：{time}",
+  "sortTitle": "排序方式",
+  "sortCustom": "自訂",
+  "sortCustomHint": "你拖曳排好的順序，有回覆也不會跳動",
+  "sortRecent": "最近回覆",
+  "sortRecentHint": "不分組，最後回覆的在上面",
+  "sortFavs": "最愛（最近回覆模式時）",
+  "sortFavsFixed": "固定在最上面，照你的順序",
+  "sortFavsRecent": "也依最近回覆排序",
+  "recentOthers": "最近回覆在上",
   "pinnedCurrent": "目前",
   "pinnedLabel": "你目前開著的 instance"
  }

package/dist/ui/shared/web-authorize.js

@@ -0,0 +1,198 @@
+// #1939 S2b (design §0.1): "Authorize this browser". The app shows this browser's state — verified (until when), a
+// Confirm card waiting in the account's Discord or Telegram DM (with its countdown), or why it can't be authorized here —
+// and asks for the card. The card itself is the gate: nothing here can authorize anything.
+import { html, useEffect, useRef, useState } from "./app-html.js";
+import { register, t } from "./app-i18n.js";
+import { guestPage } from "./app-store.js";
+
+register("webauth", {
+  en: {
+    verified: "Verified · speaks as you until {0}",
+    notVerified: "Not verified",
+    authorize: "Authorize this browser",
+    waiting: "Waiting for your Confirm in Discord or Telegram ({0})",
+    sent: "Sent — confirm it in your DM within 5 minutes.",
+    publicLink: "Not on the temporary public link: open the dashboard directly to authorize.",
+    reason_disabled: "Web authority is turned off.",
+    reason_loopback_only: "Only this computer can authorize, and this browser is not on it.",
+    reason_no_account: "This browser was not signed in as an account (agend web): sign in with /web to authorize.",
+    reason_not_admin: "Your account is not a fleet admin here.",
+    reason_not_admin_session: "Guests can't authorize.",
+    reason_token_rotated: "The dashboard's token changed: sign in again.",
+    reason_public_link: "Not on the temporary public link.",
+    reason_not_session: "Sign in to authorize.",
+    reason_other: "This browser can't be authorized here.",
+    refusal_pending: "A request is already waiting in your DM.",
+    refusal_rate_limited: "Three requests this hour — try again in {0} min.",
+    refusal_dm_unavailable: "Couldn't send you a DM. Open your DMs with the bot, then try again.",
+    refusal_other: "That didn't work: {0}",
+    settings: "Settings",
+    verifiedShort: "Verified",
+    authorizeShort: "Authorize",
+    authorizeWhy: "Not verified: authorize this browser to speak as you",
+    waitingShort: "Waiting for your Confirm ({0})",
+  },
+  "zh-TW": {
+    verified: "已驗證 · 以你的身分發言到 {0}",
+    notVerified: "未驗證",
+    authorize: "授權這個瀏覽器",
+    waiting: "等你在 Discord 或 Telegram 按下確認（{0}）",
+    sent: "已送出——請在 5 分鐘內到私訊確認。",
+    publicLink: "臨時公開連結上無法授權：請直接開啟儀表板再授權。",
+    reason_disabled: "網頁授權已關閉。",
+    reason_loopback_only: "只有這台電腦可以授權，而這個瀏覽器不在這台電腦上。",
+    reason_no_account: "這個瀏覽器不是用帳號登入的（agend web）：請用 /web 登入後再授權。",
+    reason_not_admin: "你的帳號在這裡不是 fleet 管理者。",
+    reason_not_admin_session: "訪客無法授權。",
+    reason_token_rotated: "儀表板的 token 已變更：請重新登入。",
+    reason_public_link: "臨時公開連結上無法授權。",
+    reason_not_session: "登入後才能授權。",
+    reason_other: "這個瀏覽器在這裡無法授權。",
+    refusal_pending: "已經有一個請求在你的私訊中等待。",
+    refusal_rate_limited: "這一小時已請求三次——請 {0} 分鐘後再試。",
+    refusal_dm_unavailable: "無法私訊給你。請開放與 bot 的私訊後再試一次。",
+    refusal_other: "沒有成功：{0}",
+    settings: "設定",
+    verifiedShort: "已驗證",
+    authorizeShort: "授權",
+    authorizeWhy: "未驗證：授權這個瀏覽器以你的身分發言",
+    waitingShort: "等待確認（{0}）",
+  },
+});
+const tn = (k, ...v) => t(`webauth.${k}`, ...v);
+const REASONS = ["disabled", "loopback_only", "no_account", "not_admin", "not_admin_session", "token_rotated", "public_link", "not_session"];
+// Until when: the time, with the day when it isn't today (an authorization lasts up to 48 h).
+const clock = (ms) => {
+  const d = new Date(ms), today = new Date().toDateString() === d.toDateString();
+  return today ? d.toLocaleTimeString([], { hour: "2-digit", minute: "2-digit" })
+    : d.toLocaleString([], { weekday: "short", month: "short", day: "numeric", hour: "2-digit", minute: "2-digit" });
+};
+const mmss = (ms) => { const s = Math.max(0, Math.ceil(ms / 1000)); return `${Math.floor(s / 60)}:${String(s % 60).padStart(2, "0")}`; };
+const publicLink = () => globalThis.document?.body?.dataset?.publicLink === "1";
+
+// One read per page load, shared by every line that shows it (the composer's, the session menu's): coming back to a chat
+// reads nothing (#1374). It is read again only after an ask, and while a card is pending.
+// An answer of any kind counts as this page's read (one that isn't a state hides the line); only a network failure lets a
+// later mount try again. Signed out (401: the session ended, e.g. Not me), the line goes.
+let shared = null, answered = false, inflight = null, signedOut = false;
+async function readStatus() {
+  inflight ??= (async () => {
+    try {
+      const r = await fetch("/ui/authorization", { credentials: "same-origin" });
+      answered = true;
+      if (r.status === 401) { signedOut = true; shared = null; }
+      const body = r.ok ? await r.json().catch(() => null) : null;
+      if (body && typeof body.state === "string") shared = body;
+    } catch { /* the line stays as it was; a later mount may try again */ }
+    finally { inflight = null; }
+    return shared;
+  })();
+  return inflight;
+}
+
+/** This browser's authorization, kept fresh while a card is pending (every 3 s, until it is decided or expires). */
+export function useWebAuthorization() {
+  const [st, setSt] = useState(shared), [notice, setNotice] = useState(null);
+  const [deadline, setDeadline] = useState(0), [now, setNow] = useState(() => Date.now());
+  const alive = useRef(true);
+  const load = async () => {
+    if (publicLink() || guestPage()) return;
+    const body = await readStatus();
+    if (!alive.current) return;
+    if (signedOut) { setSt(null); setNotice(null); return; }
+    if (!body) return;
+    setSt(body);
+    if (body.state !== "pending") setNotice((n) => (n === tn("sent") ? null : n));           // "Sent —" was about the card
+    if (body.state === "pending" && typeof body.expiresInMs === "number") setDeadline(Date.now() + body.expiresInMs);
+  };
+  useEffect(() => { alive.current = true; if (!answered) load(); return () => { alive.current = false; }; }, []);
+  useEffect(() => {
+    if (!st || st.state !== "pending") return undefined;
+    const tick = setInterval(() => setNow(Date.now()), 1000), poll = setInterval(load, 3000);
+    return () => { clearInterval(tick); clearInterval(poll); };
+  }, [st && st.state]);
+  // "Verified · until X" is read again at X (a page left open must not keep saying verified after it ends).
+  useEffect(() => {
+    if (!st || st.state !== "verified" || typeof st.until !== "number") return undefined;
+    const at = setTimeout(() => { resetWebAuthorization(); load(); }, Math.max(0, Math.min(st.until - Date.now() + 1000, 2 ** 31 - 1)));
+    return () => clearTimeout(at);
+  }, [st && st.state, st && st.until]);
+  const ask = async () => {
+    setNotice(null);
+    let r = null, body = null;
+    try { r = await fetch("/ui/authorization", { method: "POST", credentials: "same-origin", headers: { "content-type": "application/json" }, body: "{}" }); body = await r.json(); } catch { body = null; }
+    if (r && r.ok && body && body.ok) { setNotice(tn("sent")); setSt(shared = { state: "pending", expiresInMs: body.expiresInMs }); setDeadline(Date.now() + body.expiresInMs); return; }
+    const refusal = body && body.refusal;
+    if (refusal === "rate_limited") setNotice(tn("refusal_rate_limited", Math.max(1, Math.ceil((body.retryAfterMs || 0) / 60_000))));
+    else if (refusal === "pending" || refusal === "dm_unavailable") setNotice(tn(`refusal_${refusal}`));
+    else if (REASONS.includes(refusal)) setNotice(tn(`reason_${refusal}`));
+    else setNotice(tn("refusal_other", String(refusal || (r && r.status) || "?")));
+    load();
+  };
+  return { st, notice, ask, left: deadline - now };
+}
+
+/**
+ * Forget the page's one read, so the next line that mounts reads again: Settings → Web calls it when it shows (a revoke
+ * or a changed switch there changes what the line should say). Tests use it too: each case is its own page load.
+ */
+export function resetWebAuthorization() { shared = null; answered = false; inflight = null; signedOut = false; }
+
+/** The line under the composer: verified, waiting, or "Not verified" with the button (or why not, with the fix). */
+export function AuthorizeChip() {
+  const a = useWebAuthorization();
+  if (guestPage()) return null;
+  if (publicLink()) return html`<p class="webauth-chip note" data-state="public">${tn("publicLink")}</p>`;
+  if (!a.st) return null;
+  return html`<div class="webauth-chip" data-state=${a.st.state}>${body(a)}${a.notice ? html` <span class="note" role="status">${a.notice}</span>` : null}</div>`;
+}
+
+/**
+ * The composer's row (#2215, the user's request, 2026-10-19): the same states as AuthorizeChip, each kept to a few words so
+ * they share one row with the key hint. What a state would have said at length is in its tooltip and its accessible
+ * name: when "Verified" ends, why it can't be authorized, the countdown's ask. A tap on "✓ Verified" shows when it
+ * ends (touch has no hover) in a bubble above the row, until the next tap, a tap elsewhere or Escape. What pressing
+ * Authorize answered (sent, refused) is said in the row itself, in the hint's place (#2216 review: a bubble left over the
+ * composer covered Attach and what was being typed, with nothing to close it).
+ */
+export function ComposerAuth() {
+  const a = useWebAuthorization();
+  const [open, setOpen] = useState(false);
+  const tip = useRef("wa-tip-" + Math.random().toString(36).slice(2, 8));
+  useEffect(() => { setOpen(false); }, [a.st && a.st.state]);              // a new state closes the bubble
+  if (guestPage()) return null;
+  if (publicLink()) return html`<span class="webauth-row note" data-state="public" title=${tn("publicLink")}>${tn("publicLink")}</span>`;
+  if (!a.st) return null;
+  const st = a.st, id = tip.current;
+  const said = a.notice ? html`<span class="webauth-notice" role="status">${a.notice}</span>` : null;
+  if (st.state === "verified") {
+    const until = tn("verified", clock(st.until));
+    return html`<span class="webauth-row" data-state="verified">
+      <button type="button" class="webauth-ok" title=${until} aria-label=${`✓ ${until}`} aria-expanded=${open ? "true" : "false"}
+        aria-controls=${id} onClick=${() => setOpen((v) => !v)} onBlur=${() => setOpen(false)}
+        onKeyDown=${(e) => { if (e.key === "Escape" && open) { e.stopPropagation(); setOpen(false); } }}>✓ ${tn("verifiedShort")}</button><span
+        id=${id} class="webauth-tip" role="tooltip" hidden=${!open}>${until}</span>${said}</span>`;
+  }
+  if (st.state === "pending") {
+    const asks = tn("waiting", mmss(a.left));
+    return html`<span class="webauth-row" data-state="pending"><span class="note" title=${a.notice ? `${asks} — ${a.notice}` : asks}>${tn("waitingShort", mmss(a.left))}</span>${said}</span>`;
+  }
+  if (st.reason === "not_authorized" || st.reason === "authorization_expired") {
+    return html`<span class="webauth-row" data-state="none"><span class="note" aria-hidden="true">${tn("notVerified")} ·</span><button type="button" class="webauth-ask"
+      title=${tn("authorizeWhy")} aria-label=${tn("authorizeWhy")} onClick=${a.ask}>${tn("authorizeShort")}</button>${said}</span>`;
+  }
+  const why = REASONS.includes(st.reason) ? tn(`reason_${st.reason}`) : tn("reason_other");
+  return html`<span class="webauth-row" data-state="none"><span class="note" title=${why}>${tn("notVerified")}<span class="sr-only">: ${why}</span></span>${st.reason === "disabled" || st.reason === "loopback_only"
+    ? html` · <a href="/settings/web" title=${why}>${tn("settings")}</a>` : null}</span>`;
+}
+
+function body(a) {
+  const st = a.st;
+  if (st.state === "verified") return html`<span class="webauth-ok">✓ ${tn("verified", clock(st.until))}</span>`;
+  if (st.state === "pending") return html`<span class="note">${tn("waiting", mmss(a.left))}</span>`;
+  if (st.reason === "not_authorized" || st.reason === "authorization_expired")
+    return html`<span class="note">${tn("notVerified")} ·</span> <button type="button" class="btn btn-sm" onClick=${a.ask}>${tn("authorize")}</button>`;
+  const why = REASONS.includes(st.reason) ? tn(`reason_${st.reason}`) : tn("reason_other");
+  // The fix, where there is one the person can take here: the switch lives in Settings → Web.
+  return html`<span class="note">${tn("notVerified")}: ${why}</span>${st.reason === "disabled" || st.reason === "loopback_only" ? html` <a href="/settings/web">${tn("settings")}</a>` : null}`;
+}

package/dist/ui/web-terminal/terminal.css

@@ -1,4 +1,4 @@
-html, body { margin: 0; height: 100%; background: #111; color: #ddd; font: 14px system-ui, sans-serif; }
+html, body { margin: 0; height: 100%; background: #111; color: #ddd; font: 14px system-ui, sans-serif, "Apple Color Emoji", "Segoe UI Emoji", "Segoe UI Symbol", "Noto Color Emoji", emoji; }
 body { display: flex; flex-direction: column; }
 #bar { display: flex; align-items: center; gap: 12px; padding: 6px 10px; background: #1c1c1c; border-bottom: 1px solid #333; }
 #bar #title { font-weight: 600; }
@@ -6,18 +6,18 @@ body { display: flex; flex-direction: column; }
 #bar button { background: #402; color: #fbb; border: 1px solid #733; border-radius: 4px; padding: 3px 10px; cursor: pointer; }
 #gate { max-width: 560px; margin: 40px auto; padding: 0 16px; line-height: 1.5; }
 #gate form { display: flex; gap: 8px; margin-top: 12px; }
-#gate input { flex: 1; font: 16px ui-monospace, monospace; letter-spacing: 1px; padding: 8px; background: #000; color: #fff; border: 1px solid #555; border-radius: 4px; }
+#gate input { flex: 1; font: 16px ui-monospace, monospace, "Apple Color Emoji", "Segoe UI Emoji", "Segoe UI Symbol", "Noto Color Emoji", emoji; letter-spacing: 1px; padding: 8px; background: #000; color: #fff; border: 1px solid #555; border-radius: 4px; }
 #gate button { padding: 8px 16px; background: #246; color: #fff; border: 0; border-radius: 4px; cursor: pointer; }
 #gate-msg { color: #f88; min-height: 1.5em; }
 #term { flex: 1; min-height: 0; padding: 4px; overflow: hidden; }  /* never drawn over the rows below it (#1242) */
 #code-row { display: flex; flex-wrap: wrap; align-items: center; gap: 8px; padding: 8px 10px; background: #1c1c1c; border-top: 1px solid #333; }
 #code-row[hidden] { display: none; }
-#code-row input { flex: 1; min-width: 12em; font: 16px ui-monospace, monospace; padding: 8px; background: #000; color: #fff; border: 1px solid #555; border-radius: 4px; }
+#code-row input { flex: 1; min-width: 12em; font: 16px ui-monospace, monospace, "Apple Color Emoji", "Segoe UI Emoji", "Segoe UI Symbol", "Noto Color Emoji", emoji; padding: 8px; background: #000; color: #fff; border: 1px solid #555; border-radius: 4px; }
 #code-row button { padding: 8px 16px; background: #246; color: #fff; border: 0; border-radius: 4px; cursor: pointer; }
 #code-msg { color: #9ad; min-height: 1.2em; }
 #code-hint { flex-basis: 100%; margin: 0; color: #aaa; font-size: 13px; }
 #keys { display: flex; flex-wrap: wrap; gap: 6px; padding: 6px; background: #1c1c1c; border-top: 1px solid #333; }
-#keys button { background: #222; color: #ddd; border: 1px solid #444; border-radius: 4px; padding: 6px 10px; font: 14px ui-monospace, monospace; cursor: pointer; }
+#keys button { background: #222; color: #ddd; border: 1px solid #444; border-radius: 4px; padding: 6px 10px; font: 14px ui-monospace, monospace, "Apple Color Emoji", "Segoe UI Emoji", "Segoe UI Symbol", "Noto Color Emoji", emoji; cursor: pointer; }
 #done { padding: 10px; background: #1c1c1c; border-top: 1px solid #333; }
 #done.ok { color: #8d8; } #done.bad { color: #f88; }
 @media (min-width: 900px) { #keys { display: none; } }

package/dist/ui/web-terminal/terminal.html

@@ -17,7 +17,7 @@
 </header>
 <section id="gate">
   <p>This terminal is connected to <strong>one command only</strong> and closes when it exits or when the time limit lapses. There is no shell behind it.</p>
-  <p>Paste the <strong>access token</strong> you received in chat. It is separate from this link; the link alone grants nothing.</p>
+  <p>Paste the <strong>access token</strong> you were given: privately in chat, or in the dashboard's sign-in dialog. It is separate from this link; the link alone grants nothing.</p>
   <form id="gate-form" autocomplete="off">
     <input id="token" type="text" inputmode="text" autocapitalize="characters" spellcheck="false" placeholder="access token" maxlength="40" required>
     <button type="submit">Open</button>

package/dist/update-launch.d.ts

@@ -43,11 +43,20 @@ export declare function openUpdateLog(logPath: string, header: string): {
 } | null;
 export interface UpdateLaunchDeps {
     platform: string;
+    /** This process's uid: a system manager's scope is root's to ask for (#2274). */
+    uid?(): number;
     cgroup(): Promise<string>;
     version(): Promise<string | null>;
     nonce(): string;
 }
 export declare const defaultUpdateLaunchDeps: UpdateLaunchDeps;
+/**
+ * Which systemd manager runs the service the fleet is in: "user" (a unit below user@UID.service — com.agend.fleet),
+ * "system" (a unit of the system manager — the legacy /etc/systemd/system/agend.service, #2274), false (no service: a
+ * detached fleet), null (unknown: unreadable, or rows that disagree). Unknown is not proof that a detached child can
+ * escape a service's KillMode.
+ */
+export declare function serviceManagerOf(text: string): "user" | "system" | false | null;
 /** Unknown is not proof that a detached child can escape a service's KillMode. */
 export declare function inServiceCgroup(text: string): boolean | null;
 export type UpdateLaunch = {

package/dist/update-launch.js

@@ -69,14 +69,16 @@ function updateTarget(output) {
  */
 export function updateFixHint(output, opts = {}) {
     const target = updateTarget(output);
+    // #2264: one repair for an install left half-done — the installer, which puts back or removes what npm left aside.
+    const installer = `\`curl -fsSL https://songsid.github.io/AgEnD/install.sh | ${target === "<version>" ? "" : `AGEND_VERSION=${target} `}bash\``;
     if (opts.agendGone)
-        return `\`npm install -g @songsid/agend@${target}\``;
+        return installer;
     if (/^npm (?:ERR!|error) code ENOTEMPTY\b/im.test(output)) {
         const named = /^npm (?:ERR!|error) dest (.+)$/im.exec(output)?.[1] ?? /ENOTEMPTY[^\n]*rename '[^'\n]+' -> '([^'\n]+)'/.exec(output)?.[1];
         const ours = named && isAbsolute(named) && !/['"\s\\`$]/.test(named)
             && basename(dirname(named)) === "@songsid" && /^\.agend[A-Za-z0-9._-]*$/.test(basename(named));
         if (ours)
-            return t("update.failure.remove_staging", `\`rm -rf '${named}' && agend update\``);
+            return t("update.failure.remove_staging", installer);
         return null;
     }
     if (/systemd does not know /.test(output))
@@ -144,6 +146,7 @@ function readRunTail(logPath, offset) {
 }
 export const defaultUpdateLaunchDeps = {
     platform: process.platform,
+    uid: () => (typeof process.getuid === "function" ? process.getuid() : -1),
     cgroup: async () => {
         const started = performance.now();
         const result = await readFile("/proc/self/cgroup", { encoding: "utf8", signal: AbortSignal.timeout(2000) });
@@ -165,20 +168,38 @@ export const defaultUpdateLaunchDeps = {
     },
     nonce: () => randomBytes(16).toString("hex"),
 };
-/** Unknown is not proof that a detached child can escape a service's KillMode. */
-export function inServiceCgroup(text) {
+/**
+ * Which systemd manager runs the service the fleet is in: "user" (a unit below user@UID.service — com.agend.fleet),
+ * "system" (a unit of the system manager — the legacy /etc/systemd/system/agend.service, #2274), false (no service: a
+ * detached fleet), null (unknown: unreadable, or rows that disagree). Unknown is not proof that a detached child can
+ * escape a service's KillMode.
+ */
+export function serviceManagerOf(text) {
     if (!text || text.length > 64 * 1024 || text.includes("\0"))
         return null;
     const rows = text.trimEnd().split("\n");
-    let service = false;
+    const managers = new Set();
     for (const row of rows) {
         const parsed = /^(\d+):([^:]*):(\/[^\r\n]*)$/.exec(row);
         if (!parsed || parsed[3].split("/").some(part => part === "." || part === ".."))
             return null;
-        // user@UID.service is the user manager itself, not a fleet stop boundary.
-        service ||= parsed[3].split("/").some(part => part.endsWith(".service") && !/^user@\d+\.service$/.test(part));
+        // user@UID.service is the user manager itself, not a fleet stop boundary: the units below it are the user's.
+        let underUserManager = false;
+        for (const part of parsed[3].split("/")) {
+            if (/^user@\d+\.service$/.test(part))
+                underUserManager = true;
+            else if (part.endsWith(".service"))
+                managers.add(underUserManager ? "user" : "system");
+        }
     }
-    return service;
+    if (managers.size > 1)
+        return null;
+    return managers.size ? [...managers][0] : false;
+}
+/** Unknown is not proof that a detached child can escape a service's KillMode. */
+export function inServiceCgroup(text) {
+    const manager = serviceManagerOf(text);
+    return manager === null ? null : manager !== false;
 }
 /** Same UID, no privileged or remote manager, no credentials in argv. No unsafe detached fallback. */
 export async function resolveUpdateLaunch(agend, deps = defaultUpdateLaunchDeps) {
@@ -192,11 +213,16 @@ export async function resolveUpdateLaunch(agend, deps = defaultUpdateLaunchDeps)
     catch {
         return { ok: false, reason: "cannot read the fleet's service cgroup" };
     }
-    const service = inServiceCgroup(before);
-    if (service === null)
+    const manager = serviceManagerOf(before);
+    if (manager === null)
         return { ok: false, reason: "cannot identify the fleet's service cgroup" };
-    if (!service)
+    if (!manager)
         return { ok: true, ...plain };
+    // #2274: a fleet under the system manager (the legacy agend.service, root) has no user bus; its updater's scope is the
+    // system manager's — which only root may ask for.
+    if (manager === "system" && (deps.uid?.() ?? -1) !== 0) {
+        return { ok: false, reason: "the fleet runs as a system service, and only root can give its updater a scope of its own" };
+    }
     let version;
     try {
         version = await deps.version();
@@ -222,7 +248,7 @@ export async function resolveUpdateLaunch(agend, deps = defaultUpdateLaunchDeps)
     }
     const scope = `agend-updater-${nonce}.scope`;
     return { ok: true, command: "systemd-run", scope, args: [
-            "--user", "--scope", "--quiet", "--collect", "--no-ask-password", `--unit=${scope}`,
+            ...(manager === "user" ? ["--user"] : []), "--scope", "--quiet", "--collect", "--no-ask-password", `--unit=${scope}`,
             ...expansion, "--", plain.command, ...plain.args,
         ] };
 }