@songsid/agend 2.3.1 → 2.3.2-beta.2

package/dist/ui/settings-registry.js

@@ -0,0 +1,142 @@
+// #2347 §6: the settings registry — one entry per setting, for Settings' search and the Ctrl K "Settings" group: where it
+// is (its section, and the element to bring into view), what it is called in both languages (a settings string key,
+// `labelKey`, or `label`), its config key, and the words people search with (synonyms, in both languages). A test
+// mounts every section and checks each field drawn has an entry, and each entry's element is drawn in its section.
+import { lang, tIn } from "/assets/app-i18n.js";
+import { sectionPath } from "/assets/app-route.js";
+import { navigate } from "/assets/app-nav.js";
+import "./settings-strings.js";
+import "./chat-strings.js";
+import { GUESTS_SETTINGS } from "./settings-guests.js";
+
+const L = (en, zh) => ({ en, "zh-TW": zh });
+/** [id, section, target, labelKey | label, config key, words en, words zh] */
+const ROWS = [
+  // You · Preferences
+  ["profile.name", "preferences", "#profile-name", "settings.profileTitle", null, ["name", "display name", "who agents see", "profile"], ["名字", "名稱", "顯示名稱", "個人資料"]],
+  ["prefs.theme", "preferences", "#pref-theme", "app.theme", null, ["theme", "dark", "light", "dark mode", "colour scheme"], ["主題", "深色", "淺色", "外觀"]],
+  ["prefs.lang", "preferences", "#pref-lang", "app.language", null, ["language", "dashboard language", "english", "chinese", "locale"], ["語言", "介面語言", "中文", "英文"]],
+  ["prefs.names", "preferences", "#pref-names", "app.names", null, ["names", "nickname", "real name", "instance name", "display"], ["名稱", "暱稱", "實名"]],
+  ["prefs.previews", "preferences", "#pref-previews", "chat.previews", null, ["html preview", "preview", "iframe"], ["預覽", "HTML 預覽"]],
+  ["prefs.tour", "preferences", "#tourBtn", "chat.tour", null, ["tour", "help", "walkthrough", "guide"], ["導覽", "說明", "教學"]],
+  ["device.motion", "preferences", "#fx-follow-reduced-motion", "settings.themesFollowMotion", null, ["reduced motion", "animation", "effects", "accessibility"], ["減少動態", "動畫", "特效", "無障礙"]],
+  ["device.css-off", "preferences", "#css-off-here", "settings.cssDeviceOff", null, ["custom css", "css off", "this device", "safe"], ["自訂 CSS", "關閉 CSS", "這個裝置"]],
+  // You · Look
+  ["look.themes", "look", "#fx-show-themes", "settings.themesShow", "fx.show", ["agent themes", "themes", "effects", "widgets"], ["主題", "agent 的主題", "特效", "小工具"]],
+  ["look.colours", "look", ".s-colors", "settings.colorTitle", "color.show", ["identity colour", "color", "colour", "turn off colours"], ["識別色", "顏色", "關閉顏色"]],
+  ["look.cards", "look", ".s-card-size", "settings.cardSizeTitle", "card.size", ["identity card", "card size", "portrait", "banner"], ["身分卡", "卡片大小"]],
+  ["look.widget", "look", ".s-widget", "settings.widgetTitle", "widget.sidebar", ["sidebar widget", "widget", "json"], ["側邊欄小工具", "小工具"]],
+  ["look.css", "look", ".s-owner-css", "settings.cssTitle", null, ["custom css", "stylesheet", "style", "css"], ["自訂 CSS", "樣式表", "樣式"]],
+  ["look.mods", "look", ".s-mods", "settings.modsTitle", null, ["mod", "mods", "import", "add-on", "agendmod"], ["mod", "匯入", "擴充"]],
+  ["look.effects", "look", ".s-effects", null, null, ["effects", "canvas", "ambient", "petals", "click stars"], ["特效", "效果", "花瓣", "氛圍"], L("Effects", "效果")],
+  ["look.restore", "look", ".s-restore", "settings.restoreTitle", null, ["restore defaults", "reset", "default"], ["還原預設值", "重設", "預設"]],
+  // Fleet · Agents
+  ["agents.new", "agents", "#newAgentBtn", "settings.newAgent", null, ["new agent", "create", "add agent", "instance"], ["新增 agent", "建立", "新 agent"]],
+  ["agents.provider-keys", "agents", ".s-provider-keys", "settings.providerKeys", "web.provider_secrets", ["api key", "provider", "openai", "anthropic", "token", "secret"], ["API 金鑰", "金鑰", "供應商", "token"]],
+  // Fleet · Agent defaults
+  ["defaults.locale", "agent-defaults", "#g-locale", "settings.language", "defaults.locale", ["language", "bot language", "reply language", "locale"], ["語言", "回覆語言", "bot 語言"]],
+  ["defaults.backend", "agent-defaults", "#g-be", "settings.defaultBackend", "defaults.backend", ["backend", "cli", "claude", "codex", "kiro"], ["後端", "CLI"]],
+  ["defaults.model", "agent-defaults", "#g-model", "settings.defaultModel", "defaults.model", ["model", "opus", "sonnet", "gpt"], ["模型"]],
+  ["defaults.auto-pause", "agent-defaults", "#g-auto", "settings.autoPause", "defaults.auto_pause_after", ["auto pause", "idle", "sleep", "minutes"], ["自動暫停", "閒置", "休眠"]],
+  ["defaults.tool-progress", "agent-defaults", "#g-tp", "settings.toolProgress", "defaults.tool_progress", ["tool progress", "verbose", "steps"], ["工具進度", "詳細"]],
+  ["defaults.visibility", "agent-defaults", "#g-vis", "settings.crossInstanceVisibility", "defaults.cross_instance_visibility", ["visibility", "bot to bot", "cross instance", "messages"], ["可見性", "bot 之間", "跨 instance"]],
+  ["defaults.reply-guard", "agent-defaults", "#g-reply", "settings.replyCompletionGuard", "defaults.reply_completion_guard", ["delivered reply", "reply guard", "require reply"], ["送達回覆", "回覆保護"]],
+  ["defaults.tool-set", "agent-defaults", "#g-ts", "settings.toolSet", "defaults.tool_set", ["tool set", "tools", "mcp"], ["工具組", "工具"]],
+  ["defaults.dashboard", "agent-defaults", "#g-dash", "settings.dashboardAccess", "defaults.dashboard", ["dashboard access", "dashboard features", "permissions", "appearance tools", "task board", "web settings"], ["Dashboard 權限", "權限", "外觀", "任務看板", "網頁設定"]],
+  ["defaults.log-level", "agent-defaults", "#g-ll", "settings.logLevel", "defaults.log_level", ["log level", "debug", "logging"], ["記錄層級", "除錯", "日誌"]],
+  ["defaults.agent-mode", "agent-defaults", "#g-am", "settings.agentMode", "defaults.agent_mode", ["agent mode", "mcp", "cli"], ["agent 模式"]],
+  ["defaults.hang-on", "agent-defaults", "#g-hang-on", "settings.hangEnabled", "defaults.hang_detector.enabled", ["hang detector", "stuck", "frozen"], ["卡住偵測", "卡住", "當機"]],
+  ["defaults.hang-timeout", "agent-defaults", "#g-hang", "settings.hangTimeout", "defaults.hang_detector.timeout_minutes", ["hang timeout", "stuck", "minutes"], ["卡住逾時", "逾時"]],
+  ["defaults.concurrency", "agent-defaults", "#g-conc", "settings.concurrency", "startup.concurrency", ["startup", "concurrency", "parallel", "spawn"], ["啟動", "並行"]],
+  ["defaults.project-roots", "agent-defaults", "#g-roots", "settings.projectRootsTitle", "project_roots", ["project roots", "folders", "directory", "where agents work", "working directory"], ["專案資料夾", "資料夾", "目錄", "工作目錄"]],
+  ["defaults.stagger", "agent-defaults", "#g-stag", "settings.staggerDelay", "startup.stagger_delay_ms", ["startup", "stagger", "delay"], ["啟動", "間隔", "延遲"]],
+  // Fleet · Chat & connections
+  ["chat.new-connection", "chat", "#newBotBtn", "settings.newBot", "channels", ["new connection", "bot", "telegram", "discord", "bot token", "token"], ["新增連線", "bot", "Telegram", "Discord", "bot token", "token"]],
+  ["chat.web-echo", "chat", "#webEchoToChannel", "settings.webEcho", "web.echo_to_channel", ["web echo", "mirror", "copy to chat", "echo"], ["網頁轉發", "轉發", "同步到聊天"]],
+  ["chat.classic-rooms", "chat", "#classicbot", "settings.classicChannels", null, ["classicbot", "rooms", "channels"], ["ClassicBot", "房間", "頻道"]],
+  ["chat.classic-backend", "chat", "#g-cbe", "settings.classicBackend", "classic_defaults.backend", ["classicbot backend", "backend"], ["ClassicBot 後端", "後端"]],
+  ["chat.classic-tool-progress", "chat", "#g-ctp", "settings.toolProgress", "classic_defaults.tool_progress", ["classicbot tool progress", "tool progress"], ["ClassicBot 工具進度", "工具進度"]],
+  ["chat.classic-reply-guard", "chat", "#g-creply", "settings.replyCompletionGuard", "classic_defaults.reply_completion_guard", ["classicbot delivered reply", "reply guard"], ["ClassicBot 送達回覆"]],
+  ["chat.classic-admins", "chat", "#g-admins", "settings.classicAdmins", "classic.admin_users", ["classicbot admins", "who can use classicbot", "admin"], ["ClassicBot 管理員", "誰可以使用 ClassicBot", "管理員"]],
+  ["chat.classic-guilds", "chat", "#g-guilds", "settings.allowedGuilds", "classic.allowed_guilds", ["discord server", "guild", "allowed servers"], ["Discord 伺服器", "伺服器"]],
+  // Fleet · Web dashboard
+  ["dash.log-tab", "web-dashboard", "#webLogTab", "settings.webLogTab", "web.log_tab", ["log tab", "steps", "log"], ["Log 分頁", "紀錄", "步驟"]],
+  ["dash.usage-public", "web-dashboard", "#webUsagePublic", "settings.webUsagePublic", "web.usage_report_on_public_link", ["usage", "public link", "cost", "tokens"], ["用量", "公開連結", "費用"]],
+  ["dash.app-icon", "web-dashboard", ".s-app-icon", "settings.appIconTitle", null, ["app icon", "favicon", "home screen", "icon"], ["App 圖示", "圖示", "主畫面"]],
+  ["dash.card-limits", "web-dashboard", ".s-card-limits", "settings.cardLimitsTitle", "web.appearance", ["upload limits", "portrait", "banner", "card limits"], ["上傳限制", "身分卡上傳限制"]],
+  ["dash.canvas-worker", "web-dashboard", ".s-experimental-effects", "experimentalEffects.title", "web.experimental.canvas_worker", ["canvas worker", "experimental", "effects"], ["Canvas Worker", "實驗功能", "特效"]],
+  // Fleet · Access & security
+  ["access.session-absolute", "access", "#webSessionAbsolute", "settings.sessionAbsolute", "web.session.local.absolute_hours", ["session", "sign in", "hours", "expire", "logout"], ["session", "登入", "時數", "到期"]],
+  ["access.session-idle", "access", "#webSessionIdle", "settings.sessionIdle", "web.session.local.idle_hours", ["session", "idle", "unused", "hours"], ["session", "閒置", "時數"]],
+  ["access.terminal", "access", "#webTerminalEnabled", "settings.webTerminalEnabled", "web_terminal.enabled", ["browser terminal", "terminal", "login", "shell"], ["瀏覽器終端機", "終端機", "登入"]],
+  ["access.terminal-ttl", "access", "#webTerminalTtl", "settings.webTerminalTtl", "web_terminal.ttl_minutes", ["terminal minutes", "terminal", "ttl"], ["終端機", "分鐘"]],
+  ["access.public-link", "access", "#publicWebLink", "settings.publicLink", "web.public_link.allow_public", ["public link", "share", "tunnel", "cloudflare", "trycloudflare"], ["公開連結", "分享", "tunnel"]],
+  ["access.hostname", "access", "#publicWebHostname", "settings.namedHostname", "web.public_link.hostname", ["fixed address", "domain", "hostname", "named tunnel", "https"], ["固定網址", "網域", "主機名稱", "具名 tunnel"]],
+  ["access.origin-port", "access", "#publicWebOriginPort", "settings.namedOriginPort", "web.public_link.origin_port", ["port", "origin port", "fixed address"], ["連接埠", "port", "固定網址"]],
+  ["access.public-ttl", "access", "#publicWebTtl", "settings.publicTtl", "web.public_link.ttl_minutes", ["public link minutes", "how long", "ttl", "no expiry", "expire"], ["公開連結", "分鐘", "多久", "不過期", "到期"]],
+  // Shown with a fixed hostname (a named tunnel), or while it is set.
+  ["access.public-auto-open", "access", "#publicAutoOpen", "settings.publicAutoOpen", "web.public_link.auto_open", ["reopen after restart", "auto open", "public link", "named link"], ["重新開啟", "自動開啟", "公開連結", "固定網域"]],
+  ["access.protocol", "access", "#publicWebProtocol", "settings.publicProtocol", "web.public_link.protocol", ["protocol", "http2", "quic", "https"], ["通訊協定", "協定"]],
+  ["access.cloudflare-token", "access", "#publicTunnelToken", "settings.namedToken", "web.public_link.tunnel_token_env", ["cloudflare token", "tunnel token", "token", "fixed address", "secret"], ["Cloudflare token", "tunnel token", "token", "固定網址", "金鑰"]],
+  ["access.authority", "access", "#vaEnabled", "settings.vaEnabled", "web.verified_authority.enabled", ["web authority", "verified", "authorize"], ["網頁授權", "驗證", "授權"]],
+  ["access.authority-loopback", "access", "#vaLoopbackOnly", "settings.vaLoopbackOnly", "web.verified_authority.loopback_only", ["only this computer", "loopback", "authorize"], ["只有這台電腦", "授權"]],
+  // #2453: shown with a fixed hostname (a named tunnel), or while it is on; its label names the hostname, so its own words here.
+  ["access.authority-named-link", "access", "#vaNamedLink", null, "web.verified_authority.named_link", ["named link", "my named link", "authorize", "fixed hostname"], ["固定網域", "授權", "named link"], L("Also over my named link", "也允許透過我的固定網域")],
+  ["access.authority-quick-link", "access", "#vaQuickLink", null, "web.verified_authority.quick_link", ["temporary public link", "quick link", "quick tunnel", "authorize", "trycloudflare"], ["臨時公開連結", "授權", "quick tunnel"], L("Also over the temporary public link", "也允許透過臨時公開連結")],
+  ["access.authority-hours", "access", "#vaHours", null, "web.verified_authority.max_session_hours", ["authorization hours", "how long", "authority"], ["授權時數", "多久"], L("How long a web authorization lasts", "網頁授權持續多久")],
+  ["access.authority-revoke", "access", "#vaRevoke", "settings.vaRevoke", null, ["revoke", "sign out", "authority"], ["撤銷", "登出", "授權"]],
+  // Fleet · Advanced
+  ["advanced.fleet-yaml", "advanced", ".s-dev", null, null, ["fleet.yaml", "yaml", "json", "raw", "edit config"], ["fleet.yaml", "YAML", "設定檔"], L("fleet.yaml (YAML / JSON)", "fleet.yaml（YAML / JSON）")],
+  ["advanced.read-only", "advanced", ".s-web-ro", "settings.webReadOnlyTitle", null, ["allowed hosts", "view access", "preview port", "read only", "web settings"], ["allowed hosts", "唯讀", "網頁設定"]],
+];
+
+export const SETTINGS_REGISTRY = Object.freeze([
+  ...ROWS.map(([id, section, target, labelKey, key, en, zh, label]) => Object.freeze({ id, section, target, labelKey, label: label || null, key, words: { en, "zh-TW": zh } })),
+  // dev-claude2's Guests section (#2348): its entries, brought to the same shape (the card itself is the target).
+  ...GUESTS_SETTINGS.map((g) => Object.freeze({ id: g.id, section: g.section, target: g.id === "guests.enabled" ? "#guestsEnabled" : g.id === "guests.chat" ? "#guestsChat" : "#guests",
+    labelKey: null, label: g.label, key: g.key || null, words: g.words })),
+]);
+
+/** An entry's name in a language. */
+export function settingLabel(entry, language = lang()) {
+  return entry.label ? entry.label[language] || entry.label.en : tIn(language, entry.labelKey);
+}
+
+const fold = (s) => String(s || "").toLowerCase().normalize("NFKC");
+/**
+ * Entries matching `query`: every word in it is found in the entry's name (either language), its config key, or its
+ * words (either language). Ranked: a name that starts with it, then one that contains it, then a config key, then a word.
+ */
+export function searchSettings(query) {
+  const terms = fold(query).split(/\s+/).filter(Boolean);
+  if (!terms.length) return [];
+  const scored = [];
+  for (const entry of SETTINGS_REGISTRY) {
+    const names = [settingLabel(entry, "en"), settingLabel(entry, "zh-TW")].map(fold);
+    const keys = fold(entry.key || "");
+    const words = [...(entry.words.en || []), ...(entry.words["zh-TW"] || [])].map(fold);
+    let score = 0, all = true;
+    for (const term of terms) {
+      const s = names.some((n) => n.startsWith(term)) ? 4 : names.some((n) => n.includes(term)) ? 3 : keys.includes(term) ? 2 : words.some((w) => w.includes(term)) ? 1 : 0;
+      if (!s) { all = false; break; }
+      score += s;
+    }
+    if (all) scored.push({ entry, score });
+  }
+  return scored.sort((a, b) => b.score - a.score).map((s) => s.entry);
+}
+
+// The setting a search result opened, brought into view once its section is drawn (the panel asks for it).
+let pending = null;
+/** Go to a setting: its section, then (once drawn) the setting itself, focused and flashed. */
+export function goToSetting(entry) {
+  pending = entry ? entry.target : null;
+  navigate(sectionPath(entry.section));
+}
+/** Go to a section and, once it is drawn, to one element in it (a field the bar says to fix). */
+export function goToTarget(section, target) {
+  pending = target || null;
+  navigate(sectionPath(section));
+}
+/** The element a search result asked for, once (null: none). */
+export function takePendingSetting() { const p = pending; pending = null; return p; }

package/dist/ui/settings-strings.js

@@ -60,6 +60,11 @@ register("settings", {
     autoPause: "Auto-pause after",
     minutes: "minutes",
     inheritDefault: "Inherit from defaults",
+    // #2347 §10: the value in effect, and where it comes from.
+    defaultMark: "default", inEffect: "In effect: {0}", inheritedValue: "Inherited: {0}",
+    changeInDefaults: "change in Agent defaults", changeInClassic: "change in ClassicBot defaults",
+    cappedBySession: "capped by the session length", hoursValue: "{0} h", minutesValue: "{0} min", valueOn: "on", valueOff: "off", valueNone: "none",
+    concurrencyAuto: "automatic, 2–10 by free memory and CPU cores", inEffectShort: "in effect: {0}", cappedByTotal: "capped by upload_max_total_mb",
     statusEmojis: "Status emojis",
     statusEmojisInstance: "This agent's status emojis (override the connection's)",
     statusEmojisChannel: "Status emojis for this connection's bots",
@@ -162,7 +167,7 @@ register("settings", {
     applyClose: "Close",
     settingsButton: "Settings",
     connRetryNow: "Retry now", connRetryQueued: "Connection retry requested.", connRetryFailed: "Could not retry this connection. Check its status and try again.",
-    modalDone: "Stage change",
+    modalDone: "Done",
     wizardButton: "Setup wizard",
     wizardTitle: "Set up AgEnD",
     wizardStep: "Step {0} of {1}",
@@ -209,6 +214,7 @@ register("settings", {
     deleteBot: "Delete this bot",
     noAllowedUsers: "no allowed users",
     searchAll: "Search agents, bots, channels…",
+    searchSettings: "Search settings — token, 語言, session…", searchNone: "No setting matches.", searchFoot: "↑↓ move · Enter go there · Esc close · also under Ctrl K → Settings",
     accessMovedHint: "Who may use the bot is set on the connection itself — open Settings on \"{0}\" under Connections.",
     applyRestartNeeded: "Saved — restart AgEnD to apply",
     applyNoChange: "no change needed",
@@ -226,13 +232,15 @@ register("settings", {
     signatureMismatch: "fleet.yaml and the running configuration disagree on: {0}. Restarting will not clear this — check daemon.log first.",
     applyStillWorking: "Still restarting ({0}s) — AgEnD is still working; this page keeps checking.",
     applyLostJob: "Lost track of this apply (the fleet may have restarted). Reload the page to see the current state.",
-    changesPending: "{0} change(s) not applied",
+    changesPending: "{0} unsaved change(s)",
+    fixToSave: "Fix {0} field(s) to save", fixToSaveIn: "Fix {0} field(s) in {1} to save",
     impactNow: "Immediately",
     impactAgent: "Restart this Agent",
     impactFleet: "Restart AgEnD",
-    queued: "Queued: {0}",
+    queued: "Not saved yet: {0} — Save below",
     applyFailed: "Apply failed",
     changesApplied: "Changes applied. AgEnD is reconciling affected Agents.",
+    youPrefs: "Your preferences", youSaved: "Saved.", youSaveFailed: "Some of your preferences were not saved — try again.", youDeviceChoice: "This device: {0}",
     reviewChanges: "Review changes",
     backendUnavailable: "{0} (removed — choose another backend)",
     backendNotInstalled: "not installed", backendNotSignedIn: "not signed in (use /login)", backendTooOld: "needs {0} or newer", backendUnchecked: "not checked yet",
@@ -254,7 +262,7 @@ register("settings", {
     concurrencyWarning: "May exceed CPU capacity on smaller hosts",
     staggerRange: "Must be between 0 and 30000",
     staggerWarning: "Very low values can cause startup spikes",
-    sec_device: "Preferences", syncedTitle: "Synced across your devices", syncedLead: "Changes here apply on every device where you are signed in.",
+    "sec_preferences": "Preferences", syncedTitle: "Synced across your devices", syncedLead: "Changes here apply on every device where you are signed in.",
     profileTitle: "Your name",
     profileLeadBound: "Agents see your web messages as the Discord or Telegram account your sign-in code was sent to: its id, and its name unless you choose another here. It follows you to every device you sign in on. Agents do your ordinary requests as you; a release, anything destructive, spending, secrets or passing your authority on needs this browser authorized, or your confirm in Discord or Telegram.",
     profileLeadUnbound: "This browser was not signed in with a code sent to your Discord or Telegram account, so agents see your web messages as \"web-user\" (or the name you set here). Sign in with a code from /web to be recognised as your account.",
@@ -263,10 +271,9 @@ register("settings", {
     syncedPublicLink: "On the public link these are read-only: a change here stays in this browser.",
     deviceTitle: "This device only", deviceLead: "The tour, text size, view fit, the sidebar shown or hidden, panel widths and desktop notifications stay on each device.",
     sec_agents: "Agents",
-    sec_bots: "Connections",
-    sec_classic: "ClassicBot",
-    sec_general: "General",
-    sec_advanced: "Developer",
+    "sec_agent-defaults": "Agent defaults", sec_chat: "Chat & connections", "sec_web-dashboard": "Web dashboard", sec_access: "Access & security",
+    sec_advanced: "Advanced", sec_look: "Look", grp_you: "You", grp_fleet: "Fleet",
+    classicDefaultsTitle: "ClassicBot defaults", publicLinkTitle: "Public link & fixed address", webDashboardTitle: "Dashboard features", webSettingsLabel: "Web settings",
     stRunning: "Running",
     stPaused: "Paused",
     stCrashed: "Crashed",
@@ -288,6 +295,8 @@ register("settings", {
     deleteAgentMenu: "Delete agent",
     deleteAgentLabel: "Delete {0}",
     updateAgent: "Update {0}",
+    projectRootsTitle: "Project folders", projectRootsHint: "New agents may only work inside these folders (empty: anywhere). Checked when an agent is created.",
+    projectRootsAnywhere: "any folder",
     updateDefaults: "Update agent defaults",
     updateClassicDefaults: "Update ClassicBot defaults and access",
     updateAccess: "Update {0} access",
@@ -321,10 +330,8 @@ register("settings", {
     keyRollbackFailed: "Rollback failed",
     accessTitle: "Access",
     webChat: "Web chat",
-    sec_web: "Web",
     // #1629 r4 §3: Settings → Appearance (owner CSS).
-    sec_appearance: "Web appearance",
-    groupLook: "Look", groupLayout: "Your layout", groupCss: "Styles you write", groupMods: "Add-ons", groupAdvanced: "Advanced", learnMore: "Learn more: {0}",
+    motionTitle: "Effects on this device", groupLook: "Look", groupLayout: "Your layout", groupCss: "Styles you write", groupMods: "Add-ons", groupAdvanced: "Advanced", learnMore: "Learn more: {0}",
     colorTitle: "Identity colours", colorLead: "One agent's colour: its ⋯ menu → Colour…",
     colorPlaces: "Where colours show", colorSample: "Sample agent", colorOff: "Turn off colours",
     colorOffLead: "Colours people picked are kept.",
@@ -394,7 +401,7 @@ register("settings", {
     modInstalled: "Installed {0}.",
     modFailed: "Not done: {0}",
     idLine: "ID: {0}",
-    modCanvasWorkerOff: "Not done: this mod has Canvas Worker effects, an experimental feature. Turn it on in Settings → Web appearance first.",
+    modCanvasWorkerOff: "Not done: this mod has Canvas Worker effects, an experimental feature. Turn it on in Settings → Web dashboard first.",
     modDownload: "Download",
     modUninstall: "Uninstall",
     modUninstallConfirm: "Uninstall {0}? Its effects leave your library unless something still uses them. What it applied stays.",
@@ -498,7 +505,6 @@ register("settings", {
     sessionIdle: "Sign out after unused for, hours (1–720)",
     sessionRange: "Must be a number of hours from 1 to 720",
     sessionIdleOver: "Must not exceed the session length",
-    defaultHours: "{0} (default)",
     webTerminalTitle: "Browser terminal",
     webTerminalHint: "The token-gated terminal /login opens to sign a CLI in. Off: /login refuses. Applies to the next /login.",
     webTerminalEnabled: "Allow the browser terminal",
@@ -516,14 +522,36 @@ register("settings", {
     guestNarrow: "Narrow", guestNotReachable: "(no longer reachable)", guestReachesNothing: "This account reaches no agent from chat right now, so there is nothing to narrow.", guestNarrowLift: "Remove narrowing", guestNarrowHint: "Tick what this guest may still reach. Narrowing only takes away (it applies at once); widening or removing it waits for a fleet admin's confirmation.",
     guestSignOut: "Sign out", guestSignOutTitle: "Sign out this guest?", guestSignOutConfirm: "{0}'s guest sessions end now, their sign-in code stops working and their browsers are forgotten. They can sign in again with /web while guest sign-in is on.",
     guestSignedOut: "{0} is signed out.", guestSignedOutNotDurable: "{0} is signed out for now, but it could not be saved: a restart may bring their sessions back.", guestSignOutFailed: "That did not work — try again.",
+    // #2348: explicit grants.
+    grantsHint: "Choose who may sign in as a guest and which agents each of them sees. A guest sees a granted agent's chat as its channel showed it — other people's messages there too, never web-only ones. Granting waits for a fleet admin's OK in General; taking away applies at once.",
+    grantsLegacy: "Guests now reach what their chat access gives them. Saving grants switches to explicit access: only the people below, only their ticked agents.",
+    grantsConvert: "Start from today's guests", grantsWithAccess: "People with access", grantsNoneYet: "No one has guest access yet.",
+    grantsAdd: "Add a person", grantsSearch: "Search people who have written to your agents", grantsNoPeople: "No one matches. A person must have written to an agent first.",
+    grantsChoose: "Choose", grantsChosen: "Chosen", grantsMaySee: "{0} may see:", grantsWroteHere: "wrote here", grantsWroteTo: "Wrote to: {0}",
+    grantsLastSeen: "last seen {0}", grantsRecent: "Recent changes", grantsRecentNone: "No change to anyone's access yet.", grantsAuditDirect: "applied at once", grantsAuditConfirmed: "confirmed in General", grantsAuditEnded: "{0} session(s) ended", grantsAuditCodeSent: "sign-in code sent", grantsAuditCodeNot: "sign-in code not sent ({0})", grantsAuditDmFailed: "the DM did not go through", grantsAuditWait: "asked again within a minute", grantsAuditAdminLimit: "the admin's limit of codes was reached",
+    grantsEditAgents: "Edit agents", grantsRemove: "Remove access", grantsUndoRemove: "Keep access",
+    grantsWillBeRemoved: "Access ends when you save.", grantsNew: "New — granted when you save", grantsNoAgents: "Tick at least one agent, or remove this person.",
+    grantsSend: "Send sign-in code", grantsSendAgain: "Send again in {0}", grantsSendSaveFirst: "Save first: a code goes only to saved access.",
+    grantsSent: "Code sent {0} · expires {1}", grantsSentPublic: "It works on the open public link too.", grantsSending: "Sending…",
+    grantsSignedIn: "Signed in · {0} device(s)", grantsNotSignedIn: "Not signed in",
+    grantsDmFailed: "Couldn't DM {0}: {1}", grantsDmFailedTg: "Couldn't DM {0}: they haven't started the bot. Send them this link: {1}",
+    grantsDmFailedDiscord: "Couldn't DM {0}: their Discord privacy settings block messages from this server.",
+    grantsWait: "One code a minute per person — try again shortly.", grantsAdminLimit: "You've sent many codes; try again in a few minutes.",
+    grantsCodeFailed: "The code was not sent: {0}",
+    codeGuestsOff: "guest sign-in is off", codeAdmin: "a fleet admin signs in as an admin", codeNothing: "nothing is granted to this person yet — save their access first",
+    codeStarting: "AgEnD is starting or this connection is not running", codePaused: "guest sign-in is paused for a few minutes (too many wrong codes)",
+    codeBusy: "too many guest codes are waiting to be used — try again in a few minutes", codeRevoked: "you are no longer authorized", grantsWaiting: "Waiting for a fleet admin's OK in General.", grantsSaveFailed: "Not saved: {0}",
+    grantsPublicLinkNote: "If they aren't on this network, open the public link first, then send the code.",
     vaTitle: "Web authority", vaReview: "Review web authority changes",
-    vaHint: "Whether a signed-in fleet admin's web messages carry their own account's authority, recorded in each message's delivery receipt. A session signed in with a code sent privately to that account, on the dashboard reached directly, is authorized once from Discord or Telegram; the public link and guests never are. Agents do an admin's ordinary web requests either way; a release, anything destructive, spending, secrets or passing authority on needs this.",
+    vaHint: "Whether a signed-in fleet admin's web messages carry their own account's authority, recorded in each message's delivery receipt. A session signed in with a code sent privately to that account, on the dashboard reached directly, is authorized once from Discord or Telegram. Guests never are; over a public link, only while its option below is on. Agents do an admin's ordinary web requests either way; a release, anything destructive, spending, secrets or passing authority on needs this.",
     vaLoadFailed: "Web authority could not be loaded.",
     vaEnabled: "Web messages carry authority", vaEnabledHint: "On by default: a session carries authority only once its account confirms it from Discord or Telegram. Off: no web message carries authority, and any already given reads as none at once; authority given before it was turned off never comes back.",
     vaStuckOff: "Web authority is off for now: its state could not be saved on this computer (see the fleet log). It comes back on by itself once it can be.",
     vaLoopbackOnly: "Only this computer can authorize", vaLoopbackOnlyHint: "On: only a browser on this computer qualifies, not one on your network or tailnet, and authority already given from elsewhere reads as none. Turning it off again doesn't bring that back.",
-    vaNamedLink: "Also over my named link ({0})", vaNamedLinkHint: "On: a browser signed in over your own named-tunnel hostname may be authorized too (the same Confirm in your DM). It is reached from the internet, and Cloudflare sees its traffic: turning this on is confirmed in a General or on this computer. Off applies at once, and every authorization given over it reads as none. A quick tunnel never qualifies.",
+    vaNamedLink: "Also over my named link ({0})", vaNamedLinkHint: "On: a browser signed in over your own named-tunnel hostname may be authorized too (the same Confirm in your DM). It is reached from the internet, and Cloudflare sees its traffic: turning this on is confirmed in a General or on this computer. Off applies at once, and every authorization given over it reads as none. The temporary public link has its own option below.",
     vaSessionNamed: "over your named link",
+    vaQuickLink: "Also over the temporary public link", vaQuickLinkHint: "On: a browser signed in over the temporary public link that /web opens may be authorized too (the same Confirm in your DM). That link is an address on the internet, served by Cloudflare's quick-tunnel service, which sees its traffic. Turning this on is confirmed in a General or on this computer, and ends every authorization given so far (each browser confirms again). Turning it off applies at once. An authorized browser's authority ends with the link.",
+    vaSessionQuick: "over the temporary public link",
     vaLanWarning: "The dashboard also answers to {0} (web.allowed_hosts). Anyone who reaches it there with a stolen sign-in could give authority in your name. Turn on \"Only this computer can authorize\" unless you trust everyone who can reach it.",
     vaHours: "An authorization lasts (hours, {0}–{1})", vaHoursRange: "Must be a number from 1 to 48",
     vaSessionsTitle: "Authorized sessions", vaSessionsNone: "No session is authorized now.", vaSessionUntil: "Authorized {0} · until {1}",
@@ -533,7 +561,6 @@ register("settings", {
     searchRetentionUnset: "not set (no age limit; 300,000-row cap)",
     searchRetentionZero: "0 (no age limit; 300,000-row cap)",
     webSearchHint: "Global search keeps entries with no age limit by default. The daily prune still caps the index at 300,000 rows (oldest first). Set web.search.retention_days in fleet.yaml (1–3650 days, or 0 for no age limit); it takes effect at the next fleet start.",
-    notSet: "not set (default)",
     defaultsTitle: "Defaults",
     classicBackend: "ClassicBot default backend",
     whoUsesClassic: "Who can use ClassicBot",
@@ -541,7 +568,6 @@ register("settings", {
     guildIdPlaceholder: "guild id",
     tagPlaceholder: "tag",
     removeItem: "Remove {0}",
-    inheritPlaceholder: "(inherit default)",
     zeroDisabled: "0 = off",
     optional: "optional",
     collabMode: "Collaboration mode",
@@ -574,10 +600,10 @@ register("settings", {
     rotateToken: "Rotate the {0} token",
     addBotLabel: "Add connection {0}",
     removeBotLabel: "Remove connection {0}",
-    pendingRegion: "Changes not applied yet",
+    pendingRegion: "Unsaved changes",
     discard: "Discard",
-    applyChanges: "Apply changes",
-    discardOnLeave: "Discard {0} pending changes?",
+    applyChanges: "Save",
+    discardOnLeave: "Discard {0} unsaved change(s)?",
     applyBusyLocal: "An Apply is still running — wait for it to finish.",
     applyStepFailed: "Stopped at a change: {0}. The changes after it were not applied; they are staged again.",
     applyError_unsupported_sensitive_effect: "it changes a setting the confirmation cannot show safely, so nothing was changed",
@@ -601,8 +627,12 @@ register("settings", {
     copy: "Copy",
     devDownload: "Download fleet.yaml",
     devEditor: "fleet.yaml editor",
-    devApply: "Apply & save",
-    devApplyHint: "Writes these settings and applies them, like Apply changes.",
+    devApply: "Apply",
+    devApplyHint: "Adds this edit to the Save bar below: Save writes it, with any other unsaved change.",
+    devStaged: "In the Save bar: {0} change(s) to fleet.yaml. Save writes them, Discard drops them; edit and Apply again to replace them.",
+    devFormsUnsaved: "Save or discard the unsaved changes to agents, agent defaults or connections first: this editor writes the same settings.",
+    yamlUnsaved: "An unsaved fleet.yaml edit (Advanced) writes these settings. Save or discard it to edit them here.",
+    yamlOpen: "Open the editor",
     noChanges: "Nothing to change.",
     wizardCommitting: "Writing the configuration…",
     wizardPlatform: "Platform",
@@ -698,6 +728,10 @@ register("settings", {
     autoPause: "閒置後自動暫停",
     minutes: "分鐘",
     inheritDefault: "沿用全域預設值",
+    defaultMark: "預設", inEffect: "目前生效：{0}", inheritedValue: "沿用：{0}",
+    changeInDefaults: "到 Agent 預設值變更", changeInClassic: "到 ClassicBot 預設值變更",
+    cappedBySession: "受 session 時長限制", hoursValue: "{0} 小時", minutesValue: "{0} 分鐘", valueOn: "開", valueOff: "關", valueNone: "無",
+    concurrencyAuto: "自動，依可用記憶體與 CPU 核心數取 2–10", inEffectShort: "實際：{0}", cappedByTotal: "受 upload_max_total_mb 限制",
     detection: "偵測",
     startup: "啟動",
     backendSection: "後端",
@@ -775,7 +809,7 @@ register("settings", {
     applyClose: "關閉",
     settingsButton: "設定",
     connRetryNow: "立即重試", connRetryQueued: "已要求重新連線。", connRetryFailed: "無法重試此連線，請檢查狀態後再試。",
-    modalDone: "加入待套用",
+    modalDone: "完成",
     wizardButton: "設定精靈",
     wizardTitle: "設定 AgEnD",
     wizardStep: "第 {0} 步，共 {1} 步",
@@ -822,6 +856,7 @@ register("settings", {
     deleteBot: "刪除這個機器人",
     noAllowedUsers: "沒有允許的使用者",
     searchAll: "搜尋 agent、機器人、頻道…",
+    searchSettings: "搜尋設定 —— token、語言、session…", searchNone: "沒有符合的設定。", searchFoot: "↑↓ 移動・Enter 前往・Esc 關閉・也可從 Ctrl K → 設定 找到",
     accessMovedHint: "誰可以使用 bot 是在連線本身設定 —— 請到「連線」開啟「{0}」的設定。",
     applyRestartNeeded: "已儲存 —— 需要重新啟動 AgEnD 才會生效",
     applyNoChange: "無需變更",
@@ -839,13 +874,15 @@ register("settings", {
     signatureMismatch: "fleet.yaml 與執行中的設定在這些項目上不一致：{0}。重新啟動無法解決，請先查看 daemon.log。",
     applyStillWorking: "仍在重啟中（{0} 秒）—— AgEnD 還在處理，此頁面會持續確認。",
     applyLostJob: "已追蹤不到這次套用（AgEnD 可能重啟過）。請重新整理頁面查看目前狀態。",
-    changesPending: "有 {0} 項變更尚未套用",
+    changesPending: "{0} 項變更未儲存",
+    fixToSave: "修正 {0} 個欄位後才能儲存", fixToSaveIn: "修正「{1}」的 {0} 個欄位後才能儲存",
     impactNow: "立即生效",
     impactAgent: "重新啟動此 Agent",
     impactFleet: "重新啟動 AgEnD",
-    queued: "已加入待套用：{0}",
+    queued: "尚未儲存：{0} —— 請按下方的儲存",
     applyFailed: "套用失敗",
     changesApplied: "變更已套用，AgEnD 正在協調受影響的 Agent。",
+    youPrefs: "你的偏好設定", youSaved: "已儲存。", youSaveFailed: "部分偏好設定沒有儲存，請再試一次。", youDeviceChoice: "這個裝置：{0}",
     reviewChanges: "檢查變更",
     backendUnavailable: "{0}（已移除，請選擇其他 backend）",
     backendNotInstalled: "未安裝", backendNotSignedIn: "未登入（請用 /login）", backendTooOld: "需要 {0} 以上版本", backendUnchecked: "尚未檢查",
@@ -867,7 +904,7 @@ register("settings", {
     concurrencyWarning: "在較小的主機上可能超出 CPU 負荷",
     staggerRange: "必須介於 0 到 30000",
     staggerWarning: "數值太低可能造成啟動尖峰",
-    sec_device: "偏好設定", syncedTitle: "在你所有的裝置同步", syncedLead: "這裡的變更會套用到你登入的每一台裝置。",
+    "sec_preferences": "偏好", syncedTitle: "在你所有的裝置同步", syncedLead: "這裡的變更會套用到你登入的每一台裝置。",
     profileTitle: "你的名字",
     profileLeadBound: "agent 會把你從網頁送出的訊息，認成收到登入驗證碼的那個 Discord 或 Telegram 帳號：用它的 id，名字也用它的，除非你在這裡另外取名。它會跟著你到每一台登入的裝置。一般的請求，agent 會當作是你本人提出的；發布、破壞性操作、花費、密鑰，或把你的授權交給別人，則要先授權這個瀏覽器，或在 Discord、Telegram 上確認。",
     profileLeadUnbound: "這個瀏覽器不是用私訊到你 Discord 或 Telegram 帳號的驗證碼登入的，所以 agent 會把你的網頁訊息看成「web-user」（或你在這裡設定的名字）。用 /web 的驗證碼登入，就能被認成你的帳號。",
@@ -876,10 +913,9 @@ register("settings", {
     syncedPublicLink: "公開連結只能讀取這些設定：在這裡變更只會留在這個瀏覽器。",
     deviceTitle: "只限這台裝置", deviceLead: "導覽、文字大小、視圖寬度、側欄顯示或隱藏、面板寬度與桌面通知，每台裝置各自保留。",
     sec_agents: "Agent",
-    sec_bots: "連線",
-    sec_classic: "ClassicBot",
-    sec_general: "一般",
-    sec_advanced: "開發者",
+    "sec_agent-defaults": "Agent 預設值", sec_chat: "聊天與連線", "sec_web-dashboard": "網頁儀表板", sec_access: "存取與安全",
+    sec_advanced: "進階", sec_look: "外觀", grp_you: "你自己", grp_fleet: "整個 Fleet",
+    classicDefaultsTitle: "ClassicBot 預設值", publicLinkTitle: "公開連結與固定網址", webDashboardTitle: "儀表板功能", webSettingsLabel: "網頁設定",
     stRunning: "執行中",
     stPaused: "已暫停",
     stCrashed: "已當掉",
@@ -901,6 +937,8 @@ register("settings", {
     deleteAgentMenu: "刪除 agent",
     deleteAgentLabel: "刪除 {0}",
     updateAgent: "更新 {0}",
+    projectRootsTitle: "專案資料夾", projectRootsHint: "新的 agent 只能在這些資料夾裡工作（留空：不限）。建立 agent 時檢查。",
+    projectRootsAnywhere: "不限",
     updateDefaults: "更新 agent 預設值",
     updateClassicDefaults: "更新 ClassicBot 預設值與存取",
     updateAccess: "更新 {0} 的存取",
@@ -934,9 +972,7 @@ register("settings", {
     keyRollbackFailed: "還原失敗",
     accessTitle: "存取",
     webChat: "網頁聊天",
-    sec_web: "網頁",
-    sec_appearance: "網頁外觀",
-    groupLook: "外觀", groupLayout: "你的版面", groupCss: "自己寫的樣式", groupMods: "擴充", groupAdvanced: "進階", learnMore: "了解更多：{0}",
+    motionTitle: "這個裝置上的特效", groupLook: "外觀", groupLayout: "你的版面", groupCss: "自己寫的樣式", groupMods: "擴充", groupAdvanced: "進階", learnMore: "了解更多：{0}",
     colorTitle: "識別色", colorLead: "單一 agent 的顏色：⋯ 選單 → 顏色…",
     colorPlaces: "顏色顯示的位置", colorSample: "範例 agent", colorOff: "關閉顏色",
     colorOffLead: "已挑選的顏色會保留。",
@@ -1006,7 +1042,7 @@ register("settings", {
     modInstalled: "已安裝 {0}。",
     modFailed: "未完成：{0}",
     idLine: "ID：{0}",
-    modCanvasWorkerOff: "未完成：這個 mod 含有 Canvas Worker 效果，這是實驗性功能。請先到「設定 → 網頁外觀」開啟。",
+    modCanvasWorkerOff: "未完成：這個 mod 含有 Canvas Worker 效果，這是實驗性功能。請先到「設定 → 網頁儀表板」開啟。",
     modDownload: "下載",
     modUninstall: "解除安裝",
     modUninstallConfirm: "要解除安裝 {0} 嗎？它的效果會離開你的效果庫，除非還有東西在使用。它已套用的外觀會保留。",
@@ -1110,7 +1146,6 @@ register("settings", {
     sessionIdle: "閒置多久後登出，小時（1–720）",
     sessionRange: "必須是 1 到 720 之間的小時數",
     sessionIdleOver: "不能超過 session 時長",
-    defaultHours: "{0}（預設）",
     webTerminalTitle: "瀏覽器終端機",
     webTerminalHint: "/login 用來登入 CLI 的 token 保護終端機。關閉時 /login 會拒絕。下一次 /login 起生效。",
     webTerminalEnabled: "允許瀏覽器終端機",
@@ -1128,14 +1163,35 @@ register("settings", {
     guestNarrow: "縮小範圍", guestNotReachable: "（已無法使用）", guestReachesNothing: "這個帳號目前在聊天中沒有能用的 agent，沒有可以縮小的範圍。", guestNarrowLift: "取消縮小", guestNarrowHint: "勾選這位訪客仍可使用的 agent。縮小只會拿走權限（立即生效）；放寬或取消縮小需 fleet admin 確認。",
     guestSignOut: "登出", guestSignOutTitle: "登出這位訪客？", guestSignOutConfirm: "{0} 的訪客 session 會立即結束，登入碼失效，記住的瀏覽器也會被忘記。訪客登入開啟期間，他可以再傳 /web 登入。",
     guestSignedOut: "已登出 {0}。", guestSignedOutNotDurable: "已暫時登出 {0}，但無法保存：重新啟動後他的 session 可能會恢復。", guestSignOutFailed: "沒有成功，請再試一次。",
+    grantsHint: "選擇誰可以用訪客身分登入，以及每個人可以看到哪些 agent。訪客看到的是頻道上原本顯示的對話（包含頻道裡其他人的訊息），看不到只在網頁上的訊息。新增授權需 fleet 管理員在 General 同意；收回立即生效。",
+    grantsLegacy: "目前訪客能看到的，取決於他們在聊天中的權限。儲存授權後改為明確授權：只有下列的人，只看得到勾選的 agent。",
+    grantsConvert: "以目前的訪客為起點", grantsWithAccess: "有存取權的人", grantsNoneYet: "還沒有人有訪客存取權。",
+    grantsAdd: "新增人員", grantsSearch: "搜尋曾傳訊息給你的 agent 的人", grantsNoPeople: "沒有符合的人。對方必須先傳過訊息給某個 agent。",
+    grantsChoose: "選擇", grantsChosen: "已選擇", grantsMaySee: "{0} 可以看到：", grantsWroteHere: "傳過訊息", grantsWroteTo: "傳過訊息給：{0}",
+    grantsLastSeen: "最後出現 {0}", grantsRecent: "最近的變更", grantsRecentNone: "還沒有人的存取權變更過。", grantsAuditDirect: "立即生效", grantsAuditConfirmed: "在 General 確認後生效", grantsAuditEnded: "結束了 {0} 個登入", grantsAuditCodeSent: "已寄出登入碼", grantsAuditCodeNot: "登入碼未寄出（{0}）", grantsAuditDmFailed: "私訊沒有送達", grantsAuditWait: "一分鐘內重複要求", grantsAuditAdminLimit: "已達管理員的登入碼上限",
+    grantsEditAgents: "編輯 agent", grantsRemove: "移除存取權", grantsUndoRemove: "保留存取權",
+    grantsWillBeRemoved: "儲存後存取權就會結束。", grantsNew: "新增 —— 儲存後授權", grantsNoAgents: "至少勾選一個 agent，或移除這個人。",
+    grantsSend: "傳送登入碼", grantsSendAgain: "{0} 後可再傳", grantsSendSaveFirst: "請先儲存：登入碼只會傳給已儲存的授權。",
+    grantsSent: "{0} 已傳送 · {1} 到期", grantsSentPublic: "也可以用在目前開啟的公開連結上。", grantsSending: "傳送中…",
+    grantsSignedIn: "已登入 · {0} 個裝置", grantsNotSignedIn: "未登入",
+    grantsDmFailed: "無法私訊 {0}：{1}", grantsDmFailedTg: "無法私訊 {0}：對方還沒有啟動 bot。請把這個連結傳給對方：{1}",
+    grantsDmFailedDiscord: "無法私訊 {0}：對方的 Discord 隱私設定擋住了這個伺服器的私訊。",
+    grantsWait: "每人每分鐘只能傳一次登入碼，請稍後再試。", grantsAdminLimit: "你已經傳了很多登入碼，請幾分鐘後再試。",
+    grantsCodeFailed: "沒有傳出登入碼：{0}",
+    codeGuestsOff: "訪客登入未開啟", codeAdmin: "fleet 管理員以管理員身分登入", codeNothing: "這個人還沒有任何授權——請先儲存對方的存取權限",
+    codeStarting: "AgEnD 正在啟動，或這個連線沒有在執行", codePaused: "訪客登入暫停幾分鐘（錯誤的登入碼太多）",
+    codeBusy: "目前有太多訪客登入碼還沒被使用，請過幾分鐘再試", codeRevoked: "你已不再被授權", grantsWaiting: "等待 fleet 管理員在 General 同意。", grantsSaveFailed: "沒有儲存：{0}",
+    grantsPublicLinkNote: "如果對方不在這個網路上，請先開啟公開連結，再傳送登入碼。",
     vaTitle: "網頁授權", vaReview: "檢視網頁授權變更",
-    vaHint: "已登入的 fleet 管理者從網頁送出的訊息，是否帶有他本人帳號的授權，記錄在每則訊息的送達收據中。用私下傳給該帳號的登入碼、透過直接連線的 dashboard 登入的 session，要在 Discord 或 Telegram 上授權一次；公開連結與訪客一律不行。一般的網頁請求，agent 本來就會照做；發布、破壞性操作、花費、密鑰，或把授權交給別人，則需要它。",
+    vaHint: "已登入的 fleet 管理者從網頁送出的訊息，是否帶有他本人帳號的授權，記錄在每則訊息的送達收據中。用私下傳給該帳號的登入碼、透過直接連線的 dashboard 登入的 session，要在 Discord 或 Telegram 上授權一次；訪客一律不行；公開連結只在下方對應的選項開啟時可以。一般的網頁請求，agent 本來就會照做；發布、破壞性操作、花費、密鑰，或把授權交給別人，則需要它。",
     vaLoadFailed: "無法載入網頁授權。",
     vaEnabled: "網頁訊息帶有授權", vaEnabledHint: "預設開啟：session 要等它的帳號在 Discord 或 Telegram 上確認後才帶有授權。關閉：網頁訊息都不帶授權，已給出的授權立即視為無；關閉前給出的授權不會恢復。",
     vaStuckOff: "網頁授權目前是關閉的：它的狀態無法存到這台電腦上（請看 fleet 紀錄）。可以存入後會自動恢復。",
     vaLoopbackOnly: "只有這台電腦可以授權", vaLoopbackOnlyHint: "開啟：只有這台電腦上的瀏覽器符合，網路或 tailnet 上的不算，之前從其他地方給出的授權視為無。再關掉也不會讓那些授權恢復。",
-    vaNamedLink: "也允許透過我的固定網域（{0}）", vaNamedLinkHint: "開啟：透過你自己的 named tunnel 固定網域登入的瀏覽器也能被授權（一樣要在私訊按「確認」）。它可從網際網路連到，Cloudflare 也看得到流量：開啟需在 General 或這台電腦上確認。關閉立即生效，透過它給出的授權都視為無。Quick tunnel 一律不行。",
+    vaNamedLink: "也允許透過我的固定網域（{0}）", vaNamedLinkHint: "開啟：透過你自己的 named tunnel 固定網域登入的瀏覽器也能被授權（一樣要在私訊按「確認」）。它可從網際網路連到，Cloudflare 也看得到流量：開啟需在 General 或這台電腦上確認。關閉立即生效，透過它給出的授權都視為無。臨時公開連結另有下方的選項。",
     vaSessionNamed: "透過你的固定網域",
+    vaQuickLink: "也允許透過臨時公開連結", vaQuickLinkHint: "開啟：透過 /web 開出的臨時公開連結登入的瀏覽器也能被授權（一樣要在私訊按「確認」）。這個連結是網際網路上的位址，由 Cloudflare 的 quick tunnel 服務轉送，Cloudflare 看得到流量。開啟需在 General 或這台電腦上確認，並會結束到目前為止給出的所有授權（每個瀏覽器都要重新確認）；關閉立即生效。已授權的瀏覽器在連結結束時一併失去授權。",
+    vaSessionQuick: "透過臨時公開連結",
     vaLanWarning: "dashboard 也接受 {0} 的連線（web.allowed_hosts）。任何人只要從那裡連上、又拿到被盜的登入，就能以你的名義給出授權。除非你信任所有能連到那裡的人，否則請開啟「只有這台電腦可以授權」。",
     vaHours: "一次授權的有效期（小時，{0}–{1}）", vaHoursRange: "必須是 1 到 48 之間的數字",
     vaSessionsTitle: "已授權的 session", vaSessionsNone: "目前沒有已授權的 session。", vaSessionUntil: "{0} 授權 · 到 {1}",
@@ -1145,7 +1201,6 @@ register("settings", {
     searchRetentionUnset: "未設定（不限天數；上限 30 萬筆）",
     searchRetentionZero: "0（不限天數；上限 30 萬筆）",
     webSearchHint: "全域搜尋預設不限天數。每日清理仍會把索引上限維持在 30 萬筆（先刪最舊的）。在 fleet.yaml 設定 web.search.retention_days（1–3650 天，或 0 代表不限天數），下次啟動 fleet 後生效。",
-    notSet: "未設定（預設）",
     defaultsTitle: "預設值",
     classicBackend: "ClassicBot 預設 backend",
     whoUsesClassic: "誰可以使用 ClassicBot",
@@ -1153,7 +1208,6 @@ register("settings", {
     guildIdPlaceholder: "伺服器 id",
     tagPlaceholder: "標籤",
     removeItem: "移除 {0}",
-    inheritPlaceholder: "（沿用預設）",
     zeroDisabled: "0 = 關閉",
     optional: "選填",
     collabMode: "協作模式",
@@ -1186,10 +1240,10 @@ register("settings", {
     rotateToken: "更換 {0} token",
     addBotLabel: "新增連線 {0}",
     removeBotLabel: "移除連線 {0}",
-    pendingRegion: "尚未套用的變更",
+    pendingRegion: "未儲存的變更",
     discard: "捨棄",
-    applyChanges: "套用變更",
-    discardOnLeave: "要捨棄 {0} 項尚未套用的變更嗎？",
+    applyChanges: "儲存",
+    discardOnLeave: "要捨棄 {0} 項未儲存的變更嗎？",
     applyBusyLocal: "還有一次套用在進行中——請等它完成。",
     applyStepFailed: "在某項變更停下：{0}。之後的變更沒有套用，已重新暫存。",
     applyError_unsupported_sensitive_effect: "它改到的設定無法在確認中安全顯示，所以什麼都沒有改",
@@ -1213,8 +1267,12 @@ register("settings", {
     copy: "複製",
     devDownload: "下載 fleet.yaml",
     devEditor: "fleet.yaml 編輯器",
-    devApply: "套用並儲存",
-    devApplyHint: "寫入這些設定並套用，和「套用變更」相同。",
+    devApply: "套用",
+    devApplyHint: "把這次編輯加入下方的儲存列：按「儲存」時和其他未儲存的變更一起寫入。",
+    devStaged: "已加入儲存列：fleet.yaml 的 {0} 項變更。按「儲存」寫入，按「捨棄」放棄；修改後再按「套用」會取代它們。",
+    devFormsUnsaved: "請先儲存或捨棄 Agent、Agent 預設值或連線中未儲存的變更：這個編輯器會寫入相同的設定。",
+    yamlUnsaved: "有一份未儲存的 fleet.yaml 編輯（進階）會寫入這些設定。請先儲存或捨棄它，才能在這裡修改。",
+    yamlOpen: "開啟編輯器",
     noChanges: "沒有需要變更的內容。",
     wizardCommitting: "正在寫入設定…",
     wizardPlatform: "平台",