@songsid/agend 2.3.0-beta.4 → 2.3.0-beta.5

package/dist/ui/chat-strings.js

@@ -41,7 +41,8 @@ register("chat", {
     a11yWorking: "{0} started working", a11yIdle: "{0} finished", a11yReplied: "{0} replied", conversationWith: "Conversation with {0}",
     stopping: "Stopping {0}…", awaiting: "{0} is waiting for your input", approxNote: "Read from the terminal, so approximate", elapsedTitle: "Time since this page saw it start (approximate)",
     dropHere: "Drop files to attach them", asText: "As text", pasteAttached: "A long paste ({0} characters) was attached as a text file", pasteKeptAsText: "No room for another attachment: the long paste stays as text",
-    send: "Send", composerPlaceholder: "Message {0}…", composerHint: "Enter to send · Shift+Enter for a new line", composerMore: "/ for commands · Esc stops the reply", attachTitle: "Attach files (any type — or paste / drop them)",
+    send: "Send", composerPlaceholder: "Message {0}…", composerHint: "Enter to send · Shift+Enter for a new line", composerMore: "/ for commands · Esc stops the reply", guestMore: "Esc stops the reply",
+    guestNote: "You're a guest: the agent sees your messages as a guest's (recognition only).", guestNoCommands: "Guests can't run commands — send it without the leading /.", attachTitle: "Attach files (any type — or paste / drop them)",
     pvPreview: "Preview", pvStop: "Stop", pvDownload: "Download", pvMenu: "Preview options", pvHtml: "HTML",
     pvAllowButton: "Allow previews", pvAllow: "Allow HTML previews — they may be able to send data out", pvDisallow: "Stop allowing HTML previews",
     pvConfirm: "Allow HTML previews?\n\nThis applies on every device where you are signed in. A preview runs the agent's HTML in an isolated frame. It cannot use your login, but it may be able to send data out, and it can slow or freeze this tab. You still click Preview each time.",
@@ -157,7 +158,8 @@ register("chat", {
     a11yWorking: "{0} 開始工作", a11yIdle: "{0} 已完成", a11yReplied: "{0} 已回覆", conversationWith: "與 {0} 的對話",
     stopping: "正在中止 {0}…", awaiting: "{0} 正在等你回應", approxNote: "從終端畫面判讀，僅供參考", elapsedTitle: "從這個頁面看到它開始工作起算（約略）",
     dropHere: "放開即可附加檔案", asText: "改為文字", pasteAttached: "貼上的長文字（{0} 個字元）已改為文字檔附加", pasteKeptAsText: "附件已滿，貼上的長文字保留為一般文字",
-    send: "送出", composerPlaceholder: "傳訊息給 {0}…", composerHint: "Enter 送出 · Shift+Enter 換行", composerMore: "/ 叫出指令 · Esc 中止回覆", attachTitle: "附加檔案（任何類型，也可以貼上或拖曳）",
+    send: "送出", composerPlaceholder: "傳訊息給 {0}…", composerHint: "Enter 送出 · Shift+Enter 換行", composerMore: "/ 叫出指令 · Esc 中止回覆", guestMore: "Esc 中止回覆",
+    guestNote: "你是訪客：agent 會把你的訊息視為訪客的訊息（僅供辨識）。", guestNoCommands: "訪客不能執行指令，請去掉開頭的 / 再送出。", attachTitle: "附加檔案（任何類型，也可以貼上或拖曳）",
     pvPreview: "預覽", pvStop: "停止", pvDownload: "下載", pvMenu: "預覽選項", pvHtml: "HTML",
     pvAllowButton: "允許預覽", pvAllow: "允許預覽 HTML（預覽可能把資料傳出去）", pvDisallow: "不再允許預覽 HTML",
     pvConfirm: "要允許預覽 HTML 嗎？\n\n這會套用到你登入的每一台裝置。預覽會在隔離的框架裡執行 agent 的 HTML。它無法使用你的登入，但可能把資料傳出去，也可能讓這個分頁變慢或卡住。每次仍需要你按「預覽」。",

package/dist/ui/panel-chat.js

@@ -8,7 +8,7 @@
 // that apply to its state are offered (#1408 rough edges 4 and 7).
 import { html, useEffect, useLayoutEffect, useRef, useState } from "/assets/app-html.js";
 import { t } from "/assets/app-i18n.js";
-import { appStore, useStore } from "/assets/app-store.js";
+import { appStore, guestPage, useStore } from "/assets/app-store.js";
 import { useLease } from "/assets/app-ctx.js";
 import { modelText, namesOf, namesStore } from "/assets/instance-nav.js";
 import { PanelHeader, onPanelKey, setTitle, statusClass, statusLabel, openDrawer, requestNewInstance } from "/assets/app-shell.js";
@@ -116,7 +116,8 @@ export function boot({ stream, boot: bootData, deps = {} }) {
   }
   // #1604: the preview opt-in and Tour live in Settings → This device now (and on each preview card's menu).
   installTour();
-  startAppEffects({ store });
+  // #1920 phase 3: effects are an admin's to place (a guest's page reads none: each read would be refused).
+  if (!guestPage()) startAppEffects({ store });
   return store;
 }
 
@@ -278,13 +279,16 @@ function ChatView({ name, inst, lease, navKey, exec, awaiting }) {
     { key: "delete", label: t("chat.delete"), icon: "trash", danger: true, onSelect: () => setDialog("delete") },
   ];
   const cls = statusClass(inst, exec, awaiting);
+  // #1920 phase 3: a guest has this chat only — no Details, View or Log to switch to, no lifecycle, colour, theme,
+  // effects or delete (a guest's status frame carries no model or effort either, so those chips do not show).
+  const guest = guestPage();
   // #1269 quick actions: the model and effort it runs, each a way to /model or /effort (the same pick list).
   const pick = (command) => store.runCommand(name, command, "", { alive: () => lease.current() });
   const sub = html`<span class="status"><span class=${`dot ${cls}`} aria-hidden="true"></span>${statusLabel(inst, exec, awaiting)}</span>
     ${inst.model ? html`<button type="button" class="hd-chip" title=${t("chat.chipModel", modelText(inst))} aria-label=${t("chat.chipModel", modelText(inst))} onClick=${() => pick("model")}>${modelText(inst)}</button>` : null}
     ${inst.effort ? html`<button type="button" class="hd-chip" title=${t("chat.chipEffort", inst.effort)} aria-label=${t("chat.chipEffort", inst.effort)} onClick=${() => pick("effort")}>${inst.effort}</button>` : null}`;
   return html`<div class=${`panel p-chat${wrap ? " wrap-code" : ""}`} ref=${view}>
-    <${PanelHeader} title=${headerName(namesOf(inst || { name }, names.primary))} sub=${sub} nav=${html`<${InstanceSwitch} name=${name} current="chat" />`}><${ChatEffectPosters} name=${name} lease=${lease} element=${effectSurface} /><${ChatEffects} name=${name} lease=${lease} element=${effectSurface} store=${store} open=${dialog === "effects"} onClose=${() => setDialog(null)} /><${HeaderTools} navKey=${navKey} /><${Menu} items=${items} label=${t("app.more")} /></${PanelHeader}>
+    <${PanelHeader} title=${headerName(namesOf(inst || { name }, names.primary))} sub=${sub} nav=${guest ? null : html`<${InstanceSwitch} name=${name} current="chat" />`}><${ChatEffectPosters} name=${name} lease=${lease} element=${effectSurface} />${guest ? null : html`<${ChatEffects} name=${name} lease=${lease} element=${effectSurface} store=${store} open=${dialog === "effects"} onClose=${() => setDialog(null)} />`}<${HeaderTools} navKey=${navKey} />${guest ? null : html`<${Menu} items=${items} label=${t("app.more")} />`}</${PanelHeader}>
     <${ChatCard} key=${name} name=${name} card=${card} />
     <${AgentWidget} slot="chat_header" widget=${widgetFor(name, "chat_header")} binds=${instanceBinds(inst, exec, awaiting)} />
     <div class="chat-split" ref=${split}>
@@ -379,7 +383,8 @@ function Dock({ name, inst, lease, exec, awaiting, workingLabel }) {
       <button type="button" class="btn btn-primary btn-sm" onClick=${() => store.putBack(name)}>${t("chat.putBack")}</button>
       <button type="button" class="btn btn-sm" onClick=${() => store.discardFailed(name)}>${t("chat.discard")}</button></div>` : null}
     <${Composer} name=${name} lease=${lease} busy=${R().isBusy(exec)} />
-    <p class="hint" title=${t("chat.composerMore")}>${t("chat.composerHint")}</p>
+    <p class="hint" title=${t(guestPage() ? "chat.guestMore" : "chat.composerMore")}>${t("chat.composerHint")}</p>
+    ${guestPage() ? html`<p class="guest-note">${t("chat.guestNote")}</p>` : null}
   </div></div>`;
 }
 
@@ -456,8 +461,10 @@ function Composer({ name, lease, busy }) {
   const value = s.drafts[name] || "";
   const files = s.pendingFiles[name] || [];
   const content = !!value.trim() || files.length > 0;
-  // A file waiting: what goes is a message with its file, never a command (no palette, no command line).
-  const palette = files.length || closedFor === value ? null : paletteFor(value);
+  // A file waiting: what goes is a message with its file, never a command (no palette, no command line). A guest never
+  // runs one (#1920: the server refuses its slash text), so it has no palette either.
+  const guest = guestPage();
+  const palette = guest || files.length || closedFor === value ? null : paletteFor(value);
   const pick = palette && palette.length ? palette[Math.min(sel, palette.length - 1)] : null;
   // Grow with the text, up to a limit: set through the CSSOM, never a style attribute (#1300).
   useLayoutEffect(() => { const el = input.current; if (!el) return; el.style.height = "auto"; el.style.height = `${Math.min(el.scrollHeight, 240)}px`; }, [value]);
@@ -478,6 +485,8 @@ function Composer({ name, lease, busy }) {
       else complete(pick);
       return;
     }
+    // #1920: a guest's "/…" would be refused as a command — said here, the draft kept to edit.
+    if (guest && /^\s*\//.test(value)) { toast(t("chat.guestNoCommands"), false); return; }
     const cmd = files.length ? null : parseCommandLine(value);
     if (cmd && needsArgument(cmd.command) && !cmd.args) { setValue(`/${cmd.command} `); return; }
     if (cmd) { runLine(cmd); return; }

package/dist/ui/panel-fleet.js

@@ -522,6 +522,8 @@ function CreateTeam({ onClose, onDone, team = null }) {
 export function CreateInstanceDialog({ onClose }) {
   const lease = useLease("create-instance");
   const [backends, setBackends] = useState(null);
+  // The backend "fleet default" means (#2098 review P3-3): its models are the ones the model list offers then.
+  const [defaultBackend, setDefaultBackend] = useState("claude-code");
   const [f, setF] = useState({ dir: "", topic: "", desc: "", backend: "", model: "", branch: "", tags: "", prompt: "" });
   useEffect(() => {
     (async () => {
@@ -530,6 +532,7 @@ export function CreateInstanceDialog({ onClose }) {
         if (!lease.current()) return;
         const list = bd.backends || [];
         const first = list.find(b => b.installed && !b.deprecated) || list.find(b => b.installed);
+        if (typeof bd.defaultBackend === "string" && bd.defaultBackend) setDefaultBackend(bd.defaultBackend);
         setBackends(list);
         setF(x => ({ ...x, backend: first ? first.name : "" }));
       } catch {
@@ -560,7 +563,7 @@ export function CreateInstanceDialog({ onClose }) {
     ${field(t("fleet.description"), html`<input value=${f.desc} onInput=${set("desc")} placeholder=${t("fleet.descriptionHint")} />`)}
     ${field(t("fleet.backend"), backends ? html`<select value=${f.backend} onChange=${set("backend")}><option value="">${t("fleet.fleetDefault")}</option>
       ${backends.map(b => html`<option key=${b.name} value=${b.name} disabled=${backendBlocked(b)}>${b.name}${b.deprecated ? ` ${t("fleet.deprecated")}` : ""}${backendNote(b)}</option>`)}</select>` : html`<${Skeleton} lines=${1} />`)}
-    ${field(t("fleet.model"), html`<${ModelSelect} value=${f.model} onChange=${(v) => setF(x => ({ ...x, model: v }))} backend=${f.backend || null} inherit=${t("fleet.fleetDefault")} />`)}
+    ${field(t("fleet.model"), html`<${ModelSelect} value=${f.model} onChange=${(v) => setF(x => ({ ...x, model: v }))} backend=${f.backend || defaultBackend} inherit=${t("fleet.fleetDefault")} />`)}
     ${field(t("fleet.branch"), html`<input value=${f.branch} onInput=${set("branch")} placeholder=${t("fleet.branchHint")} />`)}
     ${field(t("fleet.tags"), html`<input value=${f.tags} onInput=${set("tags")} placeholder=${t("fleet.tagsHint")} />`)}
     ${field(t("fleet.systemPrompt"), html`<textarea rows="3" value=${f.prompt} onInput=${set("prompt")} placeholder=${t("fleet.systemPromptHint")}></textarea>`)}

package/dist/ui/panel-settings.js

@@ -43,6 +43,7 @@ import { setPreviewOptIn } from "./panel-chat.js";
 import { startTour } from "./chat-tour.js";
 import "./chat-strings.js";
 import { AppearanceSection } from "./settings-appearance.js";
+import { GuestsCard } from "./settings-guests.js";
 
 const tn = (k, ...v) => t(`settings.${k}`, ...v);
 const ICONS = { device: "user", appearance: "palette", agents: "bot", bots: "plug", classic: "room", general: "sliders", web: "globe", advanced: "code" };
@@ -866,6 +867,7 @@ function WebSection({ ctx, staged }) {
       </div>
     </section>
     </fieldset>
+    <${GuestsCard} ctx=${ctx} staged=${staged} disabled=${overPublicLink} />
     <section class="card s-web-readonly"><h3>${tn("webReadOnlyTitle")}</h3>
       <p class="note">${tn("webReadOnlyLead")}</p>
       <dl class="s-web-ro">${WEB_READ_ONLY.map((k) => html`<div key=${k}><dt><code>${k}</code></dt><dd>${shown(k)}</dd></div>`)}</dl>

package/dist/ui/settings-catalog.js

@@ -21,7 +21,10 @@ function cached(url) {
   cache.set(url, { at: now, value: null, pending });
   return pending;
 }
-/** For tests and after a write that changes the answer. */
+/**
+ * Drop every remembered answer. Only tests call it today: a page keeps an answer TTL_MS, so a sign-in or a newly
+ * cached catalog shows within that time, or at once on the next page load.
+ */
 export function forgetCatalogs() { cache.clear(); }
 
 function useAnswer(url) {

package/dist/ui/settings-guests.js

@@ -0,0 +1,117 @@
+// #1920 phase 3 (P3b-2): Settings → Web → Guests — guest sign-in for people who are not admins. The switches (guest
+// sign-in, guests may chat), the agents an open connection's guests may reach, and every guest account: who, on which
+// platform, what it reaches now, its sessions and devices, with Sign out (at once) and Narrow (staged with the rest).
+// Changes go through Review changes → Apply like every Settings edit: one that widens what guests reach waits for a
+// fleet admin's confirmation (the server's settings-change.ts), one that narrows it applies at once.
+import { html, useEffect, useMemo, useState } from "/assets/app-html.js";
+import { t } from "/assets/app-i18n.js";
+import { toast } from "/assets/ui-toast.js";
+import { confirmDialog } from "/assets/ui-confirm.js";
+import { api } from "./settings-confirm.js";
+import "./settings-strings.js";
+
+const tn = (k, ...v) => t(`settings.${k}`, ...v);
+const PLATFORMS = { discord: "Discord", telegram: "Telegram" };
+const own = (o, k) => !!o && Object.prototype.hasOwnProperty.call(o, k);
+const copyLists = (m) => { const out = {}; for (const [k, v] of Object.entries(m || {})) if (Array.isArray(v)) out[k] = [...v]; return out; };
+const sameList = (a, b) => (a || []).length === (b || []).length && (a || []).every((n) => (b || []).includes(n));
+const accountKey = (g) => `${g.adapterId}:${g.userId}`;
+
+/** What changed against the configuration, as the PUT /api/settings/fleet/web body's `guests` (null: nothing). */
+export function guestsBody(original, f) {
+  const out = {};
+  if (f.enabled !== original.enabled) out.enabled = f.enabled ? true : null;          // off is the default
+  if (f.chat !== original.chat) out.chat = f.chat ? null : false;                     // on is the default
+  for (const key of ["open_instances", "narrow"]) {
+    const was = original[key], now = f[key], diff = {};
+    for (const k of new Set([...Object.keys(was), ...Object.keys(now)])) {
+      const a = own(was, k) ? was[k] : undefined, b = own(now, k) ? now[k] : undefined;
+      if (a === undefined && b === undefined) continue;
+      if (a !== undefined && b !== undefined && sameList(a, b)) continue;
+      // open_instances: none named = the entry leaves. narrow: undefined = lifted; [] = narrowed to nothing.
+      diff[k] = b === undefined || (key === "open_instances" && !b.length) ? null : [...b];
+    }
+    if (Object.keys(diff).length) out[key] = diff;
+  }
+  return Object.keys(out).length ? out : null;
+}
+
+/** `away`: narrowed names it no longer reaches — listed (marked) only so they can be unticked; unticked, they leave. */
+function Names({ id, all, value, onChange, away = new Set() }) {
+  const chosen = new Set(value || []);
+  return html`<div class="guest-names" id=${id} role="group">${all.map((n) => html`<label key=${n} class=${`check guest-name${away.has(n) ? " guest-away" : ""}`}>
+    <input type="checkbox" checked=${chosen.has(n)} onChange=${(e) => { const s = new Set(chosen); if (e.target.checked) s.add(n); else s.delete(n); onChange(all.filter((x) => s.has(x))); }} />
+    <span>${n}${away.has(n) ? html` <span class="note">${tn("guestNotReachable")}</span>` : null}</span></label>`)}</div>`;
+}
+
+export function GuestsCard({ ctx, staged, disabled = false }) {
+  const g = (ctx.fleet.web && ctx.fleet.web.guests) || {};
+  const original = useMemo(() => ({ enabled: g.enabled === true, chat: g.chat !== false, open_instances: copyLists(g.open_instances), narrow: copyLists(g.narrow) }), []);
+  const [f, setF] = useState(() => ({ ...original, open_instances: copyLists(original.open_instances), narrow: copyLists(original.narrow) }));
+  const [overview, setOverview] = useState(null), [failed, setFailed] = useState(false), [narrowing, setNarrowing] = useState(null), [msg, setMsg] = useState(null);
+  const load = async () => {
+    let r = null;
+    try { r = await api("/api/settings/guests"); } catch { r = null; }
+    if (r && r.ok && r.body) { setOverview(r.body); setFailed(false); } else setFailed(true);
+  };
+  useEffect(() => { load(); }, []);
+  const set = (patch) => setF((x) => ({ ...x, ...patch }));
+  const setList = (key, k, list) => setF((x) => { const m = { ...x[key] }; if (list === undefined) delete m[k]; else m[k] = list; return { ...x, [key]: m }; });
+  const review = () => {
+    const body = guestsBody(original, f);
+    if (body) ctx.stage("guests", { label: tn("guestsTitle"), impact: "now", request: { method: "PUT", url: "/api/settings/fleet/web", body: { guests: body } } });
+    else if (staged.has("guests")) ctx.unstage("guests");
+    setMsg(tn("readyApply"));
+  };
+  const signOut = async (guest) => {
+    const yes = await confirmDialog({ title: tn("guestSignOutTitle"), message: tn("guestSignOutConfirm", guest.name), confirmLabel: tn("guestSignOut"), danger: true });
+    if (!yes) return;
+    let r = null;
+    try { r = await api("/api/settings/guests/revoke", { method: "POST", body: JSON.stringify({ adapterId: guest.adapterId, userId: guest.userId }) }); } catch { r = null; }
+    if (r && r.ok) { toast(tn(r.body && r.body.durable === false ? "guestSignedOutNotDurable" : "guestSignedOut", guest.name)); load(); }
+    else toast(tn("guestSignOutFailed"), false);
+  };
+  const instances = (overview && overview.instances) || [];
+  const open = ((overview && overview.connections) || []).filter((c) => c.mode === "open");
+  const guests = (overview && overview.guests) || [];
+  const when = (ms) => (typeof ms === "number" ? tn("guestLastActive", new Date(ms).toLocaleString()) : tn("guestNotSignedIn"));
+  return html`<section class="card s-guests"><h3>${tn("guestsTitle")}</h3>
+    <p class="note">${tn("guestsHint")}</p>
+    <fieldset class="s-guest-fields" disabled=${disabled}>
+      <label class="check"><input id="guestsEnabled" type="checkbox" checked=${f.enabled} onChange=${(e) => set({ enabled: e.target.checked })} /><span>${tn("guestsEnabled")}</span></label>
+      <p class="note">${tn("guestsEnabledHint")}</p>
+      <label class="check"><input id="guestsChat" type="checkbox" checked=${f.chat} onChange=${(e) => set({ chat: e.target.checked })} /><span>${tn("guestsChat")}</span></label>
+      <p class="note">${tn("guestsChatHint")}</p>
+      ${open.map((c) => html`<div key=${c.id} class="field guest-open"><span class="label">${tn("guestsOpenFor", c.id, PLATFORMS[c.type] || c.type)}</span>
+        <p class="note">${tn("guestsOpenHint")}</p>
+        <${Names} id=${`guestsOpen-${c.id}`} all=${instances} value=${own(f.open_instances, c.id) ? f.open_instances[c.id] : []} onChange=${(list) => setList("open_instances", c.id, list)} /></div>`)}
+      <h4>${tn("guestsList")}</h4>
+      ${failed ? html`<p class="note" role="status">${tn("guestsLoadFailed")} <button type="button" class="btn btn-sm" onClick=${load}>${t("app.retry")}</button></p>`
+        : !overview ? html`<p class="note">${t("app.loading")}</p>`
+        : !guests.length ? html`<p class="note" id="guestsNone">${tn("guestsNone")}</p>`
+        : html`<ul class="guest-list">${guests.map((guest) => {
+          const k = accountKey(guest), narrowed = own(f.narrow, k) ? f.narrow[k] : undefined;
+          return html`<li key=${k} class="guest-row" data-account=${k}>
+            <div class="guest-who"><strong>${guest.name}</strong> <span class="note">${PLATFORMS[guest.platform] || guest.platform} · ${guest.userId}</span></div>
+            <div class="note guest-facts">${tn("guestFacts", guest.scope.length, guest.sessions, guest.devices)} · ${when(guest.lastSeen)}</div>
+            <div class="note guest-narrow">${narrowed === undefined ? tn("guestNotNarrowed") : tn("guestNarrowedTo", narrowed.length ? narrowed.join(", ") : tn("guestNothing"))}</div>
+            <div class="guest-actions">
+              <button type="button" class="btn btn-sm" aria-expanded=${narrowing === k ? "true" : "false"} onClick=${() => setNarrowing(narrowing === k ? null : k)}>${tn("guestNarrow")}</button>
+              ${narrowed !== undefined ? html`<button type="button" class="btn btn-sm" onClick=${() => setList("narrow", k, undefined)}>${tn("guestNarrowLift")}</button>` : null}
+              ${guest.sessions || guest.devices ? html`<button type="button" class="btn btn-sm btn-danger" onClick=${() => signOut(guest)}>${tn("guestSignOut")}</button>` : null}
+            </div>
+            ${narrowing === k ? (() => {
+              // #2104 review: only what this account can reach (narrowing never widens); a narrowed name it no longer
+              // reaches is listed to be unticked, marked.
+              const reach = guest.reach || guest.scope, away = new Set((narrowed || []).filter((n) => !reach.includes(n)));
+              return html`<div class="guest-narrow-edit"><p class="note">${tn("guestNarrowHint")}</p>
+                ${reach.length || away.size ? html`<${Names} id=${`guestNarrow-${k}`} all=${[...reach, ...away]} away=${away} value=${narrowed === undefined ? guest.scope : narrowed} onChange=${(list) => setList("narrow", k, list)} />`
+                  : html`<p class="note">${tn("guestReachesNothing")}</p>`}</div>`;
+            })() : null}
+          </li>`;
+        })}</ul>`}
+    </fieldset>
+    <div class="save-row"><button type="button" class="btn btn-primary" id="guestsReview" disabled=${disabled} onClick=${review}>${tn("guestsReview")}</button>
+      ${msg ? html`<span class="note" role="status">${msg}</span>` : null}</div>
+  </section>`;
+}

package/dist/ui/settings-strings.js

@@ -428,6 +428,17 @@ register("settings", {
     webTerminalTtl: "Terminal session minutes (1–20)",
     webTerminalTtlRange: "Must be a whole number from 1 to 20",
     webReadOnlyTitle: "Set in fleet.yaml",
+    guestsTitle: "Guests", guestsReview: "Review guest changes",
+    guestsHint: "People who are not admins can sign in to the web as guests: they send /web where they already chat and get a code privately. A guest sees only the agents they can already use in chat, and their messages are recognition only.",
+    guestsEnabled: "Guest sign-in", guestsEnabledHint: "Off: no one can sign in as a guest, and every guest session ends. Turning it on waits for a fleet admin's confirmation.",
+    guestsChat: "Guests may chat", guestsChatHint: "Off: guests can read their agents' chats but not send, attach, click a reply's buttons or press Cancel.",
+    guestsOpenFor: "Agents for guests of {0} ({1})", guestsOpenHint: "This connection is open to everyone, so it has no list of people: its guests reach only the agents you tick here (none by default). Adding agents waits for a fleet admin's confirmation.",
+    guestsList: "Guest accounts", guestsNone: "No guest has signed in yet.", guestsLoadFailed: "The guest list could not be loaded.",
+    guestFacts: "Agents: {0} · Sessions: {1} · Remembered browsers: {2}", guestLastActive: "Last active {0}", guestNotSignedIn: "Not signed in now",
+    guestNotNarrowed: "Reaches every agent they can use in chat.", guestNarrowedTo: "Narrowed to: {0}", guestNothing: "nothing",
+    guestNarrow: "Narrow", guestNotReachable: "(no longer reachable)", guestReachesNothing: "This account reaches no agent from chat right now, so there is nothing to narrow.", guestNarrowLift: "Remove narrowing", guestNarrowHint: "Tick what this guest may still reach. Narrowing only takes away (it applies at once); widening or removing it waits for a fleet admin's confirmation.",
+    guestSignOut: "Sign out", guestSignOutTitle: "Sign out this guest?", guestSignOutConfirm: "{0}'s guest sessions end now, their sign-in code stops working and their browsers are forgotten. They can sign in again with /web while guest sign-in is on.",
+    guestSignedOut: "{0} is signed out.", guestSignedOutNotDurable: "{0} is signed out for now, but it could not be saved: a restart may bring their sessions back.", guestSignOutFailed: "That did not work — try again.",
     webReadOnlyLead: "Read-only here: these decide what the dashboard listens on and exposes. Edit fleet.yaml, then run agend reload (web.preview_port and web.preview_origin take a restart of AgEnD).",
     notSet: "not set (default)",
     defaultsTitle: "Defaults",
@@ -924,6 +935,17 @@ register("settings", {
     webTerminalTtl: "終端機 session 分鐘數（1–20）",
     webTerminalTtlRange: "必須是 1 到 20 之間的整數",
     webReadOnlyTitle: "在 fleet.yaml 設定",
+    guestsTitle: "訪客", guestsReview: "檢視訪客變更",
+    guestsHint: "不是管理者的人可以用訪客身分登入網頁：在他本來就能聊天的地方傳 /web，就會私下收到登入碼。訪客只會看到在聊天中本來就能用的 agent，他的訊息僅供辨識。",
+    guestsEnabled: "訪客登入", guestsEnabledHint: "關閉：沒有人能以訪客登入，所有訪客 session 都會結束。開啟需 fleet admin 確認。",
+    guestsChat: "訪客可以聊天", guestsChatHint: "關閉：訪客可以讀他的 agent 的聊天，但不能送訊息、附加檔案、按回覆的按鈕或按取消。",
+    guestsOpenFor: "{0}（{1}）訪客可用的 agent", guestsOpenHint: "這個連線對所有人開放，沒有人員名單：它的訪客只能用你在這裡勾選的 agent（預設沒有）。新增 agent 需 fleet admin 確認。",
+    guestsList: "訪客帳號", guestsNone: "還沒有訪客登入過。", guestsLoadFailed: "無法載入訪客清單。",
+    guestFacts: "agent：{0} · session：{1} · 記住的瀏覽器：{2}", guestLastActive: "最後使用 {0}", guestNotSignedIn: "目前未登入",
+    guestNotNarrowed: "可用他在聊天中能用的所有 agent。", guestNarrowedTo: "已縮小為：{0}", guestNothing: "無",
+    guestNarrow: "縮小範圍", guestNotReachable: "（已無法使用）", guestReachesNothing: "這個帳號目前在聊天中沒有能用的 agent，沒有可以縮小的範圍。", guestNarrowLift: "取消縮小", guestNarrowHint: "勾選這位訪客仍可使用的 agent。縮小只會拿走權限（立即生效）；放寬或取消縮小需 fleet admin 確認。",
+    guestSignOut: "登出", guestSignOutTitle: "登出這位訪客？", guestSignOutConfirm: "{0} 的訪客 session 會立即結束，登入碼失效，記住的瀏覽器也會被忘記。訪客登入開啟期間，他可以再傳 /web 登入。",
+    guestSignedOut: "已登出 {0}。", guestSignedOutNotDurable: "已暫時登出 {0}，但無法保存：重新啟動後他的 session 可能會恢復。", guestSignOutFailed: "沒有成功，請再試一次。",
     webReadOnlyLead: "這裡僅供檢視：這些設定決定儀表板監聽和公開的內容。請編輯 fleet.yaml 後執行 agend reload（web.preview_port 與 web.preview_origin 需要重新啟動 AgEnD）。",
     notSet: "未設定（預設）",
     defaultsTitle: "預設值",

package/dist/ui/shared/app-i18n.js

@@ -74,6 +74,7 @@ register("app", {
     hydrating: "Loading what is open now…", hydrateFailed: "Could not load what is open now (prompts, ticks).",
     skip: "Skip to the conversation", loadFailed: "This could not be loaded.", retry: "Try again", loading: "Loading…",
     noInstances: "No instances yet", noInstancesHint: "Create one to start chatting.",
+    guestChip: "Guest", guestAs: "Guest · {0}", guestAsOn: "Guest · {0} ({1})", guestHint: "You see only the agents you can already use in chat.",
     session: "Session", signIn: "Sign in", signedIn: "Signed in", signedOut: "Not signed in", thisDevice: "This device", devicePrefs: "Theme and language",
     lastActive: "active {0}", justNow: "just now", minAgo: "{0} min ago", hrAgo: "{0} h ago", signOut: "Sign out",
     signOutAll: "Sign out everywhere", devices: "Signed-in devices", expires: "Ends by {0} at the latest, or after {1} unused",
@@ -106,6 +107,7 @@ register("app", {
     hydrating: "正在載入目前的狀態…", hydrateFailed: "無法載入目前的狀態（提示、送達標記）。",
     skip: "跳到對話", loadFailed: "無法載入。", retry: "再試一次", loading: "載入中…",
     noInstances: "還沒有 instance", noInstancesHint: "建立一個就能開始聊天。",
+    guestChip: "訪客", guestAs: "訪客 · {0}", guestAsOn: "訪客 · {0}（{1}）", guestHint: "你只會看到在聊天中本來就能用的 agent。",
     session: "登入狀態", signIn: "登入", signedIn: "已登入", signedOut: "尚未登入", thisDevice: "這台裝置", devicePrefs: "主題與語言",
     lastActive: "{0}活動", justNow: "剛剛", minAgo: "{0} 分鐘前", hrAgo: "{0} 小時前", signOut: "登出",
     signOutAll: "全部登出", devices: "已登入的裝置", expires: "最晚 {0} 結束；閒置 {1} 也會結束",

package/dist/ui/shared/app-prefs.js

@@ -18,7 +18,7 @@
 // - The status frame's prefs_rev: another device changed something; the host's values are read again and applied. A
 //   revision counts as seen only once its read succeeded (a failed one is tried again, at most every few seconds).
 import { deviceLanguage, lang, setLang } from "./app-i18n.js";
-import { appStore } from "./app-store.js";
+import { appStore, guestPage } from "./app-store.js";
 
 const SYNCED_FLAG = "agend_prefs_synced";
 const RETRY_MS = 5000;
@@ -88,9 +88,9 @@ if (host) {
   }
 }
 
-/** This page may change the host's preferences: the signed-in app, not over the public link. */
+/** This page may change the host's preferences: the signed-in app, not over the public link, not a guest's (#1920). */
 export function prefsWritable() {
-  return !!initial && !(typeof document !== "undefined" && document.body && document.body.dataset.publicLink === "1");
+  return !!initial && !guestPage() && !(typeof document !== "undefined" && document.body && document.body.dataset.publicLink === "1");
 }
 /**
  * The value in force for a key, in memory — never only in this browser's storage (a full storage must not bring back

package/dist/ui/shared/app-shell.js

@@ -7,7 +7,7 @@ import { Toasts } from "./ui-toast.js";
 import { ConfirmHost } from "./ui-confirm.js";
 import { ColorDialogHost } from "./identity-color.js";
 import { t, lang, setLang, onLang } from "./app-i18n.js";
-import { appStore, createStore, useStore } from "./app-store.js";
+import { appStore, createStore, guestBadge, guestPage, useStore } from "./app-store.js";
 import { navStore } from "./app-nav.js";
 import { chatPath, viewPath, settingsPath, routeKey, NEEDS_PATH, detailsPath, fleetPath } from "./app-route.js";
 import { SessionMenu } from "./app-session.js";
@@ -291,6 +291,22 @@ function Sidebar({ route, onNewInstance, viewOnly }) {
       <${SidebarResize} />
     </aside>`;
   }
+  // #1920 phase 3: a guest's sidebar — its own agents to pick from, who it is signed in as, and its session; no fleet,
+  // Needs you, View, Settings, new agent or widget (each is an admin's, and the server refuses a guest them anyway).
+  if (guestPage()) {
+    return html`<aside id="sidebar" class="sidebar" aria-label=${t("app.menu")}>
+      <div class="side-head" data-trust="navigation">
+        <a class="brand" href="/ui" onClick=${closeDrawer}>${t("app.brand")}</a>
+        <button type="button" class="icon-btn side-collapse" onClick=${toggleSidebar} aria-label=${narrow() ? t("app.closeMenu") : t("app.collapse")} title=${narrow() ? t("app.closeMenu") : t("app.collapse")} aria-controls="sidebar"><${Icon} name="sidebar" /></button>
+      </div>
+      <${InstanceNav} route=${route} items=${app.instances} loaded=${app.ready !== false} exec=${app.exec} awaiting=${app.awaiting} onPick=${closeDrawer} />
+      <div class="side-foot" data-trust="navigation">
+        <${GuestChip} />
+        <${SessionMenu} />
+      </div>
+      <${SidebarResize} />
+    </aside>`;
+  }
   // #1675: the whole fleet, on its Org chart (#1389), from anywhere — top left, so at the top of a phone's drawer too. The
   // "Fleet" row under it goes to the open instance's Details (#1523 N2); this one is the Fleet panel, any of its tabs.
   const onFleet = !!route && route.panel === "fleet";
@@ -319,6 +335,17 @@ function Sidebar({ route, onNewInstance, viewOnly }) {
   </aside>`;
 }
 
+/** #1920 phase 3: "Guest · <name> (<platform>)" — who this guest's page is signed in as; what a guest sees, in its title. */
+const PLATFORM_NAMES = { discord: "Discord", telegram: "Telegram" };
+function GuestChip() {
+  const { name, platform } = guestBadge();
+  const where = PLATFORM_NAMES[platform] || platform;
+  const label = name ? (where ? t("app.guestAsOn", name, where) : t("app.guestAs", name)) : t("app.guestChip");
+  // Inside .side-foot (a marked, stock-trusted element): no trust marker of its own — effect-stock-trust's closed inventory
+  // refuses any element it does not know, which would hide a guest's static effect posters (#2101 review).
+  return html`<p class="guest-chip" title=${t("app.guestHint")}><${Icon} name="user" size=${14} /><span class="grow">${label}</span></p>`;
+}
+
 /** #1629 r4-4: the person's own sidebar widget (their synced preference), with the fleet's counts. */
 function SidebarWidget({ app }) {
   useStore(sidebarWidgetStore);
@@ -406,6 +433,8 @@ function BottomTabs({ route, viewOnly }) {
       ${tab(signInHref(), "user", t("app.signIn"), false)}
     </nav>`;
   }
+  // #1920: a guest has only its chats (the drawer lists them): no tabs to switch between.
+  if (guestPage()) return null;
   return html`<nav data-trust="navigation" class="tabs" aria-label=${t("app.menu")}>
     ${tab(chatHref, "chat", t("app.chat"), route && route.panel === "chat", anyAwaiting)}
     ${tab(NEEDS_PATH, "inbox", t("app.needsTab"), route && route.panel === "needs", (app.needs || []).length, t("app.needsCount", (app.needs || []).length))}
@@ -530,23 +559,24 @@ export function Shell({ panels, onNewInstance, viewOnly = false }) {
     vv.addEventListener("resize", onResize);
     return () => vv.removeEventListener("resize", onResize);
   }, []);
-  const cls = ["shell", shell.collapsed ? "sb-collapsed" : "", shell.drawer ? "sb-open" : "", shell.keyboard ? "kb-open" : ""].filter(Boolean).join(" ");
+  const guest = guestPage();             // #1920: a guest's page — no operations, usage, pending changes or owner CSS
+  const cls = ["shell", shell.collapsed ? "sb-collapsed" : "", shell.drawer ? "sb-open" : "", shell.keyboard ? "kb-open" : "", guest ? "guest" : ""].filter(Boolean).join(" ");
   return html`<div class=${cls}>
     <a data-trust="navigation" class="skip" href="#main">${t("app.skip")}</a>
     <${Sidebar} route=${nav.route} onNewInstance=${onNewInstance} viewOnly=${viewOnly} />
     <div class="scrim" onClick=${closeDrawer} aria-hidden="true"></div>
     <main id="main" class="main" tabindex="-1" inert=${shell.drawer && narrow() ? true : undefined}>
       <${ConnectionLine} />
-      ${viewOnly ? null : html`<${OperationLine} route=${nav.route} />`}
+      ${viewOnly || guest ? null : html`<${OperationLine} route=${nav.route} />`}
       <${Outlet} route=${nav.route} seq=${nav.seq} panels=${panels} />
     </main>
-    <${UsageRail} route=${nav.route} />
+    ${guest ? null : html`<${UsageRail} route=${nav.route} />`}
     <${BottomTabs} route=${nav.route} viewOnly=${viewOnly} />
     ${shell.dialog ? html`<${shell.dialog.Component} ...${shell.dialog.props} onClose=${closeDialog} />` : null}
-    ${viewOnly || (nav.route && nav.route.panel === "settings") ? null : html`<${PendingChanges} />`}
+    ${viewOnly || guest || (nav.route && nav.route.panel === "settings") ? null : html`<${PendingChanges} />`}
     <${ConfirmHost} />
     <${ColorDialogHost} />
-    ${viewOnly ? null : html`<${OwnerCssKeepBar} />`}
+    ${viewOnly || guest ? null : html`<${OwnerCssKeepBar} />`}
     <${Toasts} />
   </div>`;
 }

package/dist/ui/shared/app-store.js

@@ -26,6 +26,20 @@ export function createStore(initial) {
 export const appStore = createStore({ ready: false, instances: [], uptime: 0, exec: {}, awaiting: {}, connection: "connecting", needs: [], connections: null,
   hydration: "none", retryHydration: null });
 
+/**
+ * #1920 phase 3: this page is a guest's — the server says so on <body> (data-tier="guest"). A guest sees only its own
+ * agents' chats: no fleet, Needs you, View, Settings, filters, commands or new agent, and nothing it may not read is asked
+ * for (each would be refused). The server checks every request regardless; this only keeps the page to what works.
+ */
+export function guestPage() {
+  return typeof document !== "undefined" && !!document.body && document.body.dataset.tier === "guest";
+}
+/** Who a guest's page is signed in as: its web name and its platform (the server's, on <body>). */
+export function guestBadge() {
+  const d = typeof document !== "undefined" && document.body ? document.body.dataset : {};
+  return { name: d.guestName || "", platform: d.guestPlatform || "" };
+}
+
 /** Fold one status frame (stream or poll) into the store. */
 export function applyStatus(d) {
   if (!d || !Array.isArray(d.instances)) return;

package/dist/ui/shared/app.css

@@ -181,6 +181,13 @@ html:has(.shell), html:has(.shell) body { overflow: hidden; }
 .side-foot > .session { position: static; }
 .side-foot .side-row span:not(.dot):not(.meta) { overflow: hidden; text-overflow: ellipsis; white-space: nowrap; }
 .side-foot .session .meta { display: none; }
+/* #1920 phase 3: a guest's page says who it is signed in as, beside its session. */
+.guest-chip { flex: 1; min-width: 0; display: flex; align-items: center; gap: var(--s-1); margin: 0; padding: 6px var(--s-2); border-radius: var(--r-sm);
+  background: var(--surface-2); color: var(--text-2); font-size: var(--fs-sm); }
+.guest-chip .grow { overflow: hidden; text-overflow: ellipsis; white-space: nowrap; }
+/* Its own row: a name and a platform do not fit beside the session at sidebar widths. */
+.guest .side-foot { flex-wrap: wrap; }
+.guest .side-foot > .guest-chip { flex-basis: 100%; }
 .prefs-pop > summary { list-style: none; cursor: pointer; }
 .prefs-pop > summary::-webkit-details-marker { display: none; }
 .prefs.labelled { flex-direction: column; gap: var(--s-2); padding: 0; }
@@ -661,6 +668,17 @@ html.lb-open .scroller { overflow: hidden; }
 @media (max-width: 479px) { .btn-stop .stop-label { position: absolute; width: 1px; height: 1px; padding: 0; margin: -1px; overflow: hidden; clip: rect(0 0 0 0); white-space: nowrap; border: 0; } }
 .btn-stop { background: var(--bg); }
 .hint { font-size: var(--fs-xs); color: var(--text-3); text-align: center; }
+/* #1920 phase 3: Settings → Web → Guests. */
+.s-guests .guest-names { display: grid; grid-template-columns: repeat(auto-fill, minmax(180px, 1fr)); gap: 2px var(--s-3); max-height: 220px; overflow: auto;
+  padding: var(--s-1) var(--s-2); border: 1px solid var(--border); border-radius: var(--r-sm); }
+.s-guests .guest-name span { overflow: hidden; text-overflow: ellipsis; white-space: nowrap; }
+.s-guests .guest-list { list-style: none; margin: 0; padding: 0; display: flex; flex-direction: column; gap: var(--s-2); }
+.s-guests .guest-row { padding: var(--s-2) var(--s-3); border: 1px solid var(--border); border-radius: var(--r-sm); }
+.s-guests .guest-actions { display: flex; flex-wrap: wrap; gap: var(--s-1); margin-top: var(--s-1); }
+.s-guests .guest-narrow-edit { margin-top: var(--s-2); }
+.s-guests .guest-away { color: var(--text-3); }
+/* #1920: a guest's note under the composer — on a phone too, where the key hints are hidden. */
+.guest-note { margin: 2px 0 0; font-size: var(--fs-xs); color: var(--text-3); text-align: center; }
 .pending-files { display: flex; flex-wrap: wrap; gap: var(--s-2); padding: var(--s-2) var(--s-2) 0; }
 .file-chip { display: flex; align-items: center; gap: 6px; font-size: var(--fs-xs); padding: 4px var(--s-2); border-radius: var(--r-md); background: var(--bg); max-width: 320px; }
 .file-chip img { width: 28px; height: 28px; object-fit: cover; border-radius: 4px; }

package/dist/ui/shared/app.js

@@ -12,7 +12,7 @@ import { Shell, handleKey, showDialog, closeDrawer, openDrawer, shellStore, retr
 import { installSwipe } from "./app-swipe.js";
 import { startRouter, navStore, navigate } from "./app-nav.js";
 import { createStream } from "./app-stream.js";
-import { appStore, applyStatus, applyActivity } from "./app-store.js";
+import { appStore, applyStatus, applyActivity, guestPage } from "./app-store.js";
 import { chatPath } from "./app-route.js";
 import { startNeedsNotifier } from "./app-needs.js";
 import { toast } from "./ui-toast.js";
@@ -29,6 +29,9 @@ initUsageRail();
 // session-only panel, nothing under /ui/ is ever imported or read (#1408 §3).
 const mode = boot.mode === "view-only" ? "view-only" : "full";
 appStore.set({ viewOnly: mode === "view-only" });
+// #1920 phase 3: a guest's page has its chats and nothing else — no panel, notifier, theme list or owner CSS a guest
+// would be refused.
+const guest = guestPage();
 
 // A failed load can be retried (the panel's Retry): each retry asks for a fresh URL, since a browser may keep a failed
 // module import cached under the first one. boot() runs once, whichever attempt succeeds.
@@ -80,19 +83,22 @@ if (mode === "full") {
   // a boot import that failed before the Outlet first asked would be retried at once, depending on timing.)
   let chatLoads = 0;
   panels.set("chat", { load: () => (chatLoads++ === 0 ? chatBoot : loadChat()).then((m) => m.ChatPanel) });
-  panels.set("fleet", { load: () => loadFleet().then((m) => m.FleetPanel) });
-  panels.set("settings", { load: () => loadSettings().then((m) => m.SettingsPanel) });
-  panels.set("needs", { load: () => loadNeeds().then((m) => m.NeedsPanel) });
-  // #1523 N2: one instance's Details (/ui/fleet/agent/<name>).
-  panels.set("details", { load: () => loadDetails().then((m) => m.DetailsPanel) });
-  // #1218: one instance's Log (/ui/log/<name>).
-  panels.set("log", { load: () => loadLog().then((m) => m.LogPanel) });
-  // #1386 §6.3: desktop notifications for new "Needs you" items, in any panel, while this signed-in page is open.
-  startNeedsNotifier({ open: (instance) => navigate(chatPath(instance)) });
+  if (!guest) {
+    panels.set("fleet", { load: () => loadFleet().then((m) => m.FleetPanel) });
+    panels.set("settings", { load: () => loadSettings().then((m) => m.SettingsPanel) });
+    panels.set("needs", { load: () => loadNeeds().then((m) => m.NeedsPanel) });
+    // #1523 N2: one instance's Details (/ui/fleet/agent/<name>).
+    panels.set("details", { load: () => loadDetails().then((m) => m.DetailsPanel) });
+    // #1218: one instance's Log (/ui/log/<name>).
+    panels.set("log", { load: () => loadLog().then((m) => m.LogPanel) });
+    // #1386 §6.3: desktop notifications for new "Needs you" items, in any panel, while this signed-in page is open.
+    startNeedsNotifier({ open: (instance) => navigate(chatPath(instance)) });
+  }
   // #1665: this device's first upload of its own choices (once), then another device's changes at each status frame.
+  // A guest's page only reads them (prefsWritable is false there).
   bootPrefs();
-  // #1629: agents' themes, read when the status frame's themes_rev moves.
-  startThemes();
+  // #1629: agents' themes, read when the status frame's themes_rev moves (a guest's frames never carry it).
+  if (!guest) startThemes();
   onNewInstance = async () => {
     closeDrawer();                                 // on a phone the dialog opens from the drawer: the drawer goes first
     let m;
@@ -103,8 +109,9 @@ if (mode === "full") {
 } else appStore.set({ connection: "none" });
 
 startRouter(window);
-// #1629 r4 §3: the person's owner CSS (full app only; never on Settings, in safe mode or where this device turned it off).
-installOwnerCss();
+// #1629 r4 §3: the person's owner CSS (full app only; never on Settings, in safe mode or where this device turned it off;
+// never a guest's — owner CSS is an admin's).
+if (!guest) installOwnerCss();
 // /ui on its own opens the chat this browser had open last (an unknown name shows the panel's "not found").
 {
   const r = navStore.get().route;