@songsid/agend 2.3.3-beta.9 → 2.3.3

package/dist/tunnel/purpose-lane.js.map

@@ -1 +1 @@
-{"version":3,"file":"purpose-lane.js","sourceRoot":"","sources":["../../src/tunnel/purpose-lane.ts"],"names":[],"mappings":"AAYA,MAAM,QAAQ,GAAG,GAAqB,EAAE,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;AAClH,kGAAkG;AAClG,MAAM,OAAO,iBAAiB;IAEC,OAAO;IAD5B,KAAK,GAA2E,IAAI,CAAC;IAC7F,YAA6B,OAA8C;uBAA9C,OAAO;IAA0C,CAAC;IAC/E,OAAO,CAAC,OAA8B,EAAE,EAAU;QAChD,IAAI,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,KAAK,OAAO,IAAI,IAAI,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC;QAC9G,IAAI,OAAO,GAAG,IAAI,CAAC;QACnB,IAAI,QAAiD,CAAC;QACtD,IAAI,QAA+C,CAAC;QACpD,MAAM,OAAO,GAAG,GAAS,EAAE,GAAG,IAAI,OAAO,IAAI,IAAI,CAAC,KAAK,EAAE,WAAW,KAAK,WAAW;YAAE,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QAC3G,MAAM,WAAW,GAAsB;YACrC,KAAK,EAAE,CAAC,QAAQ,EAAE,OAAO,EAAE,EAAE;gBAC3B,IAAI,IAAI,CAAC,KAAK,EAAE,WAAW,KAAK,WAAW;oBAAE,OAAO,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC,CAAC;gBACzG,IAAI,QAAQ;oBAAE,OAAO,QAAQ,CAAC;gBAC9B,OAAO,GAAG,KAAK,CAAC;gBAChB,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE;oBAC7D,IAAI,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS;wBAAE,OAAO,GAAG,IAAI,CAAC;oBACpD,OAAO,MAAM,CAAC;gBAChB,CAAC,CAAC,CAAC;gBACH,OAAO,QAAQ,CAAC;YAClB,CAAC;YACD,IAAI,EAAE,CAAC,MAAM,EAAE,UAAU,EAAE,EAAE;gBAC3B,4GAA4G;gBAC5G,6CAA6C;gBAC7C,MAAM,KAAK,GAAG,UAAU,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;gBACjD,OAAO,QAAQ,KAAK,CAAC,KAAK,IAAI,EAAE;oBAC9B,MAAM,QAAQ,EAAE,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;oBAChC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;oBAC5D,MAAM,MAAM,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC;oBAChE,OAAO,GAAG,MAAM,CAAC,SAAS,CAAC;oBAC3B,OAAO,EAAE,CAAC;oBACV,OAAO,MAAM,CAAC;gBAChB,CAAC,CAAC,EAAE,CAAC;YACP,CAAC;YACD,aAAa,EAAE,OAAO;SACvB,CAAC;QACF,IAAI,CAAC,KAAK,GAAG,EAAE,OAAO,EAAE,EAAE,EAAE,WAAW,EAAE,CAAC;QAC1C,OAAO,WAAW,CAAC;IACrB,CAAC;CACF"}
+{"version":3,"file":"purpose-lane.js","sourceRoot":"","sources":["../../src/tunnel/purpose-lane.ts"],"names":[],"mappings":"AAYA,MAAM,QAAQ,GAAG,GAAqB,EAAE,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;AAClH,kGAAkG;AAClG,MAAM,OAAO,iBAAiB;IAEC,OAAO;IAD5B,KAAK,GAA2E,IAAI,CAAC;IAC7F,YAA6B,OAA8C;uBAA9C,OAAO;IAA0C,CAAC;IAC/E,+FAA+F;IAC/F,MAAM,KAAoB,OAAO,IAAI,CAAC,KAAK,EAAE,OAAO,IAAI,IAAI,CAAC,CAAC,CAAC;IAC/D,OAAO,CAAC,OAA6C,EAAE,EAAU;QAC/D,IAAI,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,KAAK,OAAO,IAAI,IAAI,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC;QAC9G,IAAI,OAAO,GAAG,IAAI,CAAC;QACnB,IAAI,QAAiD,CAAC;QACtD,IAAI,QAA+C,CAAC;QACpD,MAAM,OAAO,GAAG,GAAS,EAAE,GAAG,IAAI,OAAO,IAAI,IAAI,CAAC,KAAK,EAAE,WAAW,KAAK,WAAW;YAAE,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QAC3G,MAAM,WAAW,GAAsB;YACrC,KAAK,EAAE,CAAC,QAAQ,EAAE,OAAO,EAAE,EAAE;gBAC3B,IAAI,IAAI,CAAC,KAAK,EAAE,WAAW,KAAK,WAAW;oBAAE,OAAO,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC,CAAC;gBACzG,IAAI,QAAQ;oBAAE,OAAO,QAAQ,CAAC;gBAC9B,OAAO,GAAG,KAAK,CAAC;gBAChB,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE;oBAC7D,IAAI,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS;wBAAE,OAAO,GAAG,IAAI,CAAC;oBACpD,OAAO,MAAM,CAAC;gBAChB,CAAC,CAAC,CAAC;gBACH,OAAO,QAAQ,CAAC;YAClB,CAAC;YACD,IAAI,EAAE,CAAC,MAAM,EAAE,UAAU,EAAE,EAAE;gBAC3B,4GAA4G;gBAC5G,6CAA6C;gBAC7C,MAAM,KAAK,GAAG,UAAU,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;gBACjD,OAAO,QAAQ,KAAK,CAAC,KAAK,IAAI,EAAE;oBAC9B,MAAM,QAAQ,EAAE,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;oBAChC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;oBAC5D,MAAM,MAAM,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC;oBAChE,OAAO,GAAG,MAAM,CAAC,SAAS,CAAC;oBAC3B,OAAO,EAAE,CAAC;oBACV,OAAO,MAAM,CAAC;gBAChB,CAAC,CAAC,EAAE,CAAC;YACP,CAAC;YACD,aAAa,EAAE,OAAO;SACvB,CAAC;QACF,IAAI,CAAC,KAAK,GAAG,EAAE,OAAO,EAAE,EAAE,EAAE,WAAW,EAAE,CAAC;QAC1C,OAAO,WAAW,CAAC;IACrB,CAAC;CACF"}

package/dist/ui/panel-settings.js

@@ -50,6 +50,7 @@ import { GuestsCard } from "./settings-guests.js";
 import { OfficeSharesCard } from "./office-share-dialog.js";
 import { syncStage, useDraft } from "./settings-draft.js";
 import { WebAuthorityCard } from "./settings-web-authority.js";
+import { NamedLinkTest, setTypedTunnelToken } from "./settings-named-test.js";
 import { SignInList } from "./backend-signin.js";
 
 const tn = (k, ...v) => t(`settings.${k}`, ...v);
@@ -1353,6 +1354,7 @@ function WebSection({ ctx, staged, part = "all" }) {
         <div class=${fc("field", "originPort")}><label for="publicWebOriginPort">${tn("namedOriginPort")}</label><input id="publicWebOriginPort" type="number" min="1024" max="65535" value=${f.originPort} class=${errors.originPort ? "invalid" : ""} onInput=${(e) => set("originPort")(e.target.value)} /><${Feedback} error=${errors.originPort} /></div>
       </div>
       <p class="note">${tn("namedTunnelHint")} <a href="https://github.com/songsid/AgEnD/blob/main/docs/named-tunnel.md" target="_blank" rel="noopener noreferrer">${tn("namedTunnelSetup")}</a></p>
+      ${String(f.hostname || "").trim() ? html`<${NamedLinkTest} hostname=${f.hostname} port=${f.originPort} protocol=${f.protocol} />` : null}
       <div class="grid2">
         <div class=${fc("field", "ttl")}><label for="publicWebTtl">${tn(named ? "publicTtlNamed" : "publicTtl")}</label><input id="publicWebTtl" type="number" min=${named ? "0" : "1"} max=${named ? "10080" : "480"} step="1" class=${errors.ttl ? "invalid" : ""} value=${f.ttl} onInput=${(e) => set("ttl")(e.target.value)} /><${Feedback} error=${errors.ttl} /></div>
         <div class=${fc("field", "protocol")}><label for="publicWebProtocol">${tn("publicProtocol")}</label><${Select} id="publicWebProtocol" value=${f.protocol} onChange=${set("protocol")} options=${["http2", "quic", "auto"]} /></div>
@@ -1548,11 +1550,11 @@ function PublicTunnelToken() {
     const result = await api(base);
     if (lease.current() && result.ok) setPresent(result.body?.[0]?.token_present === true);
   };
-  useEffect(() => { refresh().catch(() => {}); }, []);
+  useEffect(() => { refresh().catch(() => {}); return () => setTypedTunnelToken(""); }, []);
   const go = async (clear) => {
     if (inFlight.current || !clear && !secret) return;
     const value = secret;
-    setSecret(""); inFlight.current = true; setBusy(true); setMessage("");
+    setSecret(""); setTypedTunnelToken(""); inFlight.current = true; setBusy(true); setMessage("");
     const key = newKey("tunnel-token");
     try {
       const prepared = await api(`${base}/verify`, { method: "POST", headers: { "Idempotency-Key": key }, body: JSON.stringify(clear ? { clear: true } : { secret: value }) });
@@ -1576,7 +1578,7 @@ function PublicTunnelToken() {
   return html`<section class="card"><h3>${tn("namedToken")}</h3>
     <p class="note">${tn("namedTokenHint")}</p>
     <span class="tag">${present ? tn("keyConfigured") : tn("keyNotConfigured")}</span>
-    <input id="publicTunnelToken" type="password" autocomplete="new-password" aria-label=${tn("namedToken")} value=${secret} onInput=${e => setSecret(e.target.value)} />
+    <input id="publicTunnelToken" type="password" autocomplete="new-password" aria-label=${tn("namedToken")} value=${secret} onInput=${e => { setSecret(e.target.value); setTypedTunnelToken(e.target.value); }} />
     <button type="button" class="btn btn-sm" disabled=${busy || !secret} onClick=${() => go(false)}>${tn("namedTokenSet")}</button>
     <button type="button" class="btn btn-sm" disabled=${busy || !present} onClick=${() => go(true)}>${tn("namedTokenClear")}</button>
     ${message ? html`<p class="note" role="status">${message}</p>` : null}

package/dist/ui/settings-named-test.js

@@ -0,0 +1,144 @@
+// #2906 (the user, 2026-11-01): Settings → Access → the fixed address's 「測試連線」 / "Test connection". It tests the
+// values as filled in (unsaved too: the typed connector token, else the saved one) and shows each step ✓ or ✗; every ✗
+// says what the person can do next. The server answers closed step codes only (settings-api.ts, named-link-test.ts):
+// the token never comes back. Words never name the person's workplace — "this machine's network", "network administrator".
+import { html, useRef, useState } from "/assets/app-html.js";
+import { register, t } from "/assets/app-i18n.js";
+import { useLease } from "/assets/app-ctx.js";
+import { api } from "./settings-confirm.js";
+
+register("settings", {
+  en: {
+    ntButton: "Test connection",
+    ntRunning: "Testing… (up to about a minute)",
+    ntHint: "Tests the values above as filled in, saved or not — with the token typed below, or the saved one.",
+    ntBusy: "A test is already running. Try again when it ends.",
+    ntFailed: "The test could not run. Try again.",
+    ntNotRun: "Not tested (an earlier step failed).",
+    ntTimeout: "The test took too long and was stopped. Test again; if it repeats, check this machine's network.",
+    ntCancelled: "Your sign-in ended, so nothing was started. Sign in again and test again.",
+    ntCleanup: "The test's connector could not be confirmed stopped. Run agend restart before testing or opening the link again.",
+    ntStep_values: "The domain, port and token",
+    ntStep_origin: "This machine answers on port {1}",
+    ntStep_tunnel: "The tunnel connects to Cloudflare",
+    ntStep_dns: "{0} can be looked up",
+    ntStep_reach: "{0} reaches this AgEnD",
+    nt_values_ok: "Filled in correctly.",
+    "nt_values_bad-hostname": "Enter a domain such as agend.example.com (no https://, path or port).",
+    "nt_values_bad-port": "Enter a port from 1024 to 65535.",
+    "nt_values_no-token": "No connector token: paste it below (Cloudflare → your tunnel → the long string that starts with eyJ).",
+    "nt_values_bad-token": "This is not a connector token: copy only the long string that starts with eyJ.",
+    nt_origin_ok: "Answered for this test.",
+    nt_origin_live: "Your link is open on these values: it is tested as it is.",
+    "nt_origin_dashboard-port": "{1} is the dashboard's own port. Choose another (19282 by default), and make the Cloudflare route's service http://127.0.0.1:<that port>.",
+    "nt_origin_port-in-use": "Port {1} is used by another program on this machine. Choose another port here, and make the Cloudflare route's service http://127.0.0.1:<that port>.",
+    "nt_origin_origin-failed": "AgEnD could not listen on port {1}. Try another port.",
+    "nt_origin_link-open-other": "Your link is open with other settings. Close it (/web → Close public link), then test again.",
+    "nt_origin_tunnel-busy": "Another tunnel is starting or running (a public link or a sign-in). Try again in a minute.",
+    nt_tunnel_ok: "Connected to Cloudflare.",
+    nt_tunnel_live: "Your open link is connected.",
+    nt_tunnel_auth: "Cloudflare refused the token: it is wrong or was rotated. Copy the current token from the tunnel's page in Cloudflare and paste it again.",
+    nt_tunnel_network: "This machine could not reach Cloudflare within 20 seconds. Set the protocol to http2 here, or ask the network administrator to allow outbound connections to Cloudflare (port 7844).",
+    nt_tunnel_stopped: "cloudflared stopped before it connected. Test again; if it repeats, check the token and the protocol.",
+    "nt_tunnel_no-binary": "cloudflared could not be prepared on this machine (its download or install failed). Check this machine's internet access and test again.",
+    nt_dns_ok: "Found.",
+    "nt_dns_dns-missing": "{0} does not exist yet. In Cloudflare, add a Published application route for {0} on this tunnel.",
+    "nt_dns_dns-failed": "This machine could not look up {0}: this machine's network may block DNS. Ask the network administrator.",
+    nt_reach_ok: "It works: {0} reached this AgEnD.",
+    "nt_reach_wrong-service": "Cloudflare answered but could not reach the service: make the route's service http://127.0.0.1:{1} (HTTP, not HTTPS).",
+    "nt_reach_other-page": "{0} answered with another page: its route points to another service or tunnel. Point it to this tunnel, with the service http://127.0.0.1:{1}.",
+    "nt_reach_route-missing": "{0} is not routed to this tunnel. In Cloudflare, add a Published application route for {0}.",
+    "nt_reach_self-unreachable": "The tunnel is connected, but this machine's network can't open {0} (some networks filter new domains). From another network, such as a phone on mobile data, it may still work. Ask the network administrator to allow {0}.",
+    "nt_reach_reach-failed": "{0} did not answer as expected. Test again in a minute; if it repeats, check the route in Cloudflare.",
+  },
+  "zh-TW": {
+    ntButton: "測試連線",
+    ntRunning: "測試中…（最多約 1 分鐘）",
+    ntHint: "用上面填的設定測試（不論是否已儲存），token 用下方輸入的，沒有就用已儲存的。",
+    ntBusy: "已經有一個測試在進行，請等它結束再試。",
+    ntFailed: "測試沒有執行成功，請再試一次。",
+    ntNotRun: "未測試（前面的步驟失敗）。",
+    ntTimeout: "測試太久，已經停止。請再測一次；如果一直這樣，請檢查這台主機所在的網路。",
+    ntCancelled: "你的登入已結束，所以沒有啟動任何東西。請重新登入後再測。",
+    ntCleanup: "無法確認測試用的連接器已經停止。請先執行 agend restart，再測試或開啟連結。",
+    ntStep_values: "網域、port 與 token",
+    ntStep_origin: "這台主機在 port {1} 回應",
+    ntStep_tunnel: "tunnel 連上 Cloudflare",
+    ntStep_dns: "查得到 {0}",
+    ntStep_reach: "{0} 連得到這台 AgEnD",
+    nt_values_ok: "填寫正確。",
+    "nt_values_bad-hostname": "請填網域，例如 agend.example.com（不含 https://、路徑或 port）。",
+    "nt_values_bad-port": "請填 1024–65535 之間的 port。",
+    "nt_values_no-token": "沒有 connector token：請貼在下方（Cloudflare → 你的 tunnel → 以 eyJ 開頭的長字串）。",
+    "nt_values_bad-token": "這不是 connector token：只複製以 eyJ 開頭的那串長字串。",
+    nt_origin_ok: "這次測試有回應。",
+    nt_origin_live: "你的連結正以這些設定開著：直接測試它。",
+    "nt_origin_dashboard-port": "{1} 是儀表板自己的 port。請換一個（預設 19282），並把 Cloudflare 路由的 service 設成 http://127.0.0.1:<那個 port>。",
+    "nt_origin_port-in-use": "這台主機上有其他程式在用 port {1}。請在這裡換一個 port，並把 Cloudflare 路由的 service 改成 http://127.0.0.1:<那個 port>。",
+    "nt_origin_origin-failed": "AgEnD 無法在 port {1} 監聽，請換一個 port。",
+    "nt_origin_link-open-other": "你的連結正以其他設定開著。請先關閉（/web → 關閉公開連結），再測試。",
+    "nt_origin_tunnel-busy": "另一條 tunnel 正在啟動或執行（公開連結或登入用）。請過一分鐘再試。",
+    nt_tunnel_ok: "已連上 Cloudflare。",
+    nt_tunnel_live: "開著的連結已連線。",
+    nt_tunnel_auth: "Cloudflare 拒絕這個 token：它是錯的或已被更換。請到 Cloudflare 的 tunnel 頁面複製目前的 token 再貼上。",
+    nt_tunnel_network: "這台主機在 20 秒內連不上 Cloudflare。請在這裡把通訊協定改成 http2，或請網路管理員允許對 Cloudflare 的對外連線（port 7844）。",
+    nt_tunnel_stopped: "cloudflared 在連上之前就停止了。請再測一次；如果一直這樣，請檢查 token 與通訊協定。",
+    "nt_tunnel_no-binary": "這台主機無法準備 cloudflared（下載或安裝失敗）。請確認這台主機能連上網路後再測。",
+    nt_dns_ok: "查得到。",
+    "nt_dns_dns-missing": "{0} 還不存在。請在 Cloudflare 為這條 tunnel 新增 {0} 的 Published application 路由。",
+    "nt_dns_dns-failed": "這台主機查不到 {0}：這台主機所在的網路可能擋了 DNS。請洽網路管理員。",
+    nt_reach_ok: "正常：{0} 連到了這台 AgEnD。",
+    "nt_reach_wrong-service": "Cloudflare 有回應，但連不到服務：請把路由的 service 設成 http://127.0.0.1:{1}（HTTP，不是 HTTPS）。",
+    "nt_reach_other-page": "{0} 回應了別的頁面：它的路由指向別的服務或 tunnel。請把它指向這條 tunnel，service 設成 http://127.0.0.1:{1}。",
+    "nt_reach_route-missing": "{0} 沒有路由到這條 tunnel。請在 Cloudflare 新增 {0} 的 Published application 路由。",
+    "nt_reach_self-unreachable": "tunnel 已連上，但這台主機所在的網路打不開 {0}（有些網路會擋新的網域）。從其他網路（例如手機行動網路）可能可以正常使用。請網路管理員允許 {0}。",
+    "nt_reach_reach-failed": "{0} 沒有如預期回應。請過一分鐘再測；如果一直這樣，請檢查 Cloudflare 上的路由。",
+  },
+});
+const tn = (k, ...v) => t(`settings.${k}`, ...v);
+const STEPS = ["values", "origin", "tunnel", "dns", "reach"];
+
+/**
+ * The connector token typed in the token card below (not yet saved): the test uses it when there is one. The card
+ * owns it: it sets it as typed and clears it when saved, cleared or unmounted (#2907 review: a hidden token from a
+ * card no longer on screen is never used).
+ */
+let typedToken = "";
+export function setTypedTunnelToken(value) { typedToken = typeof value === "string" ? value : ""; }
+
+/** The button and its result, for the fixed-address values the form holds now. */
+export function NamedLinkTest({ hostname, port, protocol }) {
+  const lease = useLease("named-link-test");
+  const [busy, setBusy] = useState(false);
+  const [result, setResult] = useState(null);
+  const [note, setNote] = useState("");
+  const running = useRef(false);
+  const run = async () => {
+    if (running.current) return;
+    running.current = true; setBusy(true); setNote(""); setResult(null);
+    try {
+      const r = await api("/api/settings/public-link/test", { method: "POST", body: JSON.stringify({
+        hostname: String(hostname ?? "").trim(), origin_port: String(port ?? "").trim() || "19282", protocol, ...(typedToken.trim() ? { token: typedToken } : {}),
+      }) });
+      if (!lease.current()) return;
+      if (r.status === 409) setNote(tn("ntBusy"));
+      else if (!r.ok || !Array.isArray(r.body?.steps)) setNote(tn("ntFailed"));
+      else setResult(r.body);
+    } catch { if (lease.current()) setNote(tn("ntFailed")); }
+    finally { running.current = false; if (lease.current()) setBusy(false); }
+  };
+  const host = result?.hostname || String(hostname ?? "").trim() || "—", shownPort = result?.port ?? (String(port ?? "").trim() || "19282");
+  return html`<div class="named-test">
+    <div class="save-row"><button type="button" class="btn btn-sm" id="namedLinkTest" disabled=${busy} onClick=${run}>${busy ? tn("ntRunning") : tn("ntButton")}</button></div>
+    <p class="note">${tn("ntHint")}</p>
+    ${note ? html`<p class="note" role="status">${note}</p>` : null}
+    ${result ? html`<ol class="named-test-steps" role="status" aria-live="polite">${STEPS.map((step) => {
+      const r = result.steps.find((s) => s.step === step);
+      const mark = !r ? "–" : r.ok ? "✓" : "✗";
+      const said = !r ? tn("ntNotRun") : r.code === "timeout" ? tn("ntTimeout") : r.code === "cancelled" ? tn("ntCancelled") : tn(`nt_${step}_${r.code}`, host, shownPort);
+      return html`<li key=${step} class=${!r ? "nt-skip" : r.ok ? "nt-ok" : "nt-fail"} data-step=${step} data-code=${r ? r.code : ""}>
+        <span class="nt-mark" aria-hidden="true">${mark}</span> <strong>${tn(`ntStep_${step}`, host, shownPort)}</strong> — ${said}</li>`;
+    })}</ol>` : null}
+    ${result?.cleanup ? html`<p class="feedback error" role="alert">${tn("ntCleanup")}</p>` : null}
+  </div>`;
+}

package/dist/ui/settings-strings.js

@@ -470,7 +470,7 @@ register("settings", {
     cssTitle: "Custom CSS (yours only)",
     cssLead: "Applies to your screens only.",
     cssLoadFailed: "Couldn't load your custom CSS. Reload the page to try again.",
-    cssPublicLink: "Custom CSS isn't available on a temporary public link.",
+    cssPublicLink: "Custom CSS isn't available over a public link.",
     cssInForce: "In force: {0}",
     cssOnTrial: "On trial: {0}. Choose Keep, or it reverts.",
     cssNone: "No custom CSS in force.",
@@ -507,9 +507,9 @@ register("settings", {
     cssError_owner_css_needs_a_signed_in_person: "Sign in in the browser to change custom CSS.",
     cssError_other: "Not saved ({0}).",
     webLead: "How the web dashboard behaves. A change that loosens access (longer sessions, the browser terminal back on or for longer, the public link) waits for a fleet admin to confirm it in chat (General topic) or on the host; one that tightens it applies at once.",
-    webPublicRefused: "Web settings can't be changed over a temporary public link. Open the dashboard at its own address to change them.",
+    webPublicRefused: "Web settings can't be changed over a public link. Open the dashboard at its own address to change them.",
     webSessionTitle: "Sign-in sessions",
-    webSessionHint: "For sign-ins at the dashboard's own address (this computer, the LAN, a tailnet). A temporary public link always keeps 4 h / 30 min. Shortening ends the sessions it now outlives; lengthening applies to new sign-ins and to an existing one's idle time on its next use. Empty = the default.",
+    webSessionHint: "For sign-ins at the dashboard's own address (this computer, the LAN, a tailnet). Over a public link (a temporary one or your permanent link), a session lasts at most 8 h, ends after 30 min idle and never outlives the link; an admin's also never lasts longer than these settings (a guest's follows the guest settings). Shortening ends the sessions it now outlives; lengthening applies to new sign-ins and to an existing one's idle time on its next use. Empty = the default.",
     sessionAbsolute: "Session length, hours (1–720)",
     sessionIdle: "Sign out after unused for, hours (1–720)",
     sessionRange: "Must be a number of hours from 1 to 720",
@@ -1124,7 +1124,7 @@ register("settings", {
     cssTitle: "自訂 CSS（只套用在你自己）",
     cssLead: "只套用在你的畫面。",
     cssLoadFailed: "無法載入你的自訂 CSS。請重新整理頁面再試一次。",
-    cssPublicLink: "臨時公開連結無法使用自訂 CSS。",
+    cssPublicLink: "透過公開連結無法使用自訂 CSS。",
     cssInForce: "使用中：{0}",
     cssOnTrial: "試用中：{0}。請按「保留」，否則會還原。",
     cssNone: "目前沒有使用自訂 CSS。",
@@ -1161,9 +1161,9 @@ register("settings", {
     cssError_owner_css_needs_a_signed_in_person: "請在瀏覽器登入後再變更自訂 CSS。",
     cssError_other: "未儲存（{0}）。",
     webLead: "網頁儀表板的行為。放寬存取的變更（延長 session、重新開啟或延長瀏覽器終端機、公開連結）需要 fleet admin 在聊天（General topic）或主機上確認；收緊的變更會立即套用。",
-    webPublicRefused: "無法透過臨時公開連結變更網頁設定。請從儀表板本身的網址開啟後再變更。",
+    webPublicRefused: "無法透過公開連結變更網頁設定。請從儀表板本身的網址開啟後再變更。",
     webSessionTitle: "登入 session",
-    webSessionHint: "適用於從儀表板本身網址登入的 session（本機、區域網路、tailnet）。臨時公開連結固定為 4 小時 / 30 分鐘。縮短會讓已超過新限制的 session 結束；延長會套用到新的登入，以及既有 session 下次使用時的閒置時間。留空 = 預設值。",
+    webSessionHint: "適用於從儀表板本身網址登入的 session（本機、區域網路、tailnet）。透過公開連結（臨時連結或你的固定網域）的 session 最長 8 小時、閒置 30 分鐘就結束，也不會超過連結本身；管理者的 session 也不會超過這裡的設定（訪客依訪客設定）。縮短會讓已超過新限制的 session 結束；延長會套用到新的登入，以及既有 session 下次使用時的閒置時間。留空 = 預設值。",
     sessionAbsolute: "Session 時長，小時（1–720）",
     sessionIdle: "閒置多久後登出，小時（1–720）",
     sessionRange: "必須是 1 到 720 之間的小時數",

package/dist/ui/shared/app.css

@@ -935,6 +935,13 @@ img.amb-p { object-fit: contain; }
 .webauth-tip[hidden] { display: none; }
 /* #1920 phase 3 / #2348: Settings → Access & security → Guests. The fixed template (#2330): flat rows split by a rule,
    no rounded box or fill; an edited row is .s-dirty (the shared straight bar + tint, square). A state is coloured text. */
+/* #2906: the fixed address's Test connection — one row per step, ✓ / ✗ / – and what to do next. */
+.named-test-steps { list-style: none; margin: var(--s-2) 0 0; padding: 0; display: grid; gap: var(--s-1); font-size: var(--fs-sm); }
+.named-test-steps li { overflow-wrap: anywhere; }
+.named-test-steps .nt-mark { display: inline-block; width: 1.2em; font-weight: var(--fw-semibold); }
+.named-test-steps .nt-ok .nt-mark { color: var(--ok); }
+.named-test-steps .nt-fail .nt-mark { color: var(--danger); }
+.named-test-steps .nt-skip { color: var(--text-3); }
 .s-guests .guest-names { display: grid; grid-template-columns: repeat(auto-fill, minmax(180px, 1fr)); gap: 2px var(--s-3); max-height: 220px; overflow: auto;
   padding: var(--s-1) 0; border-top: 1px solid var(--border); border-bottom: 1px solid var(--border); }
 .s-guests .guest-name span { overflow: hidden; text-overflow: ellipsis; white-space: nowrap; }

package/dist/ui/shared/web-authorize.js

@@ -18,7 +18,7 @@ register("webauth", {
     reason_not_admin: "Your account is not a fleet admin here.",
     reason_not_admin_session: "Guests can't authorize.",
     reason_token_rotated: "The dashboard's token changed: sign in again.",
-    reason_public_link: "Not on the temporary public link.",
+    reason_public_link: "This sign-in can't be authorized over this link.",
     reason_named_link_off: "Over your named link: turn on \"Also over my named link\" in Settings → Access & security on this computer.",
     reason_quick_link_off: "Over the temporary public link: turn on \"Also over the temporary public link\" in Settings → Access & security on this computer.",
     reason_not_session: "Sign in to authorize.",
@@ -46,7 +46,7 @@ register("webauth", {
     reason_not_admin: "你的帳號在這裡不是 fleet 管理者。",
     reason_not_admin_session: "訪客無法授權。",
     reason_token_rotated: "儀表板的 token 已變更：請重新登入。",
-    reason_public_link: "臨時公開連結上無法授權。",
+    reason_public_link: "這個登入無法透過這個連結授權。",
     reason_named_link_off: "透過固定網域：請在這台電腦的 設定 → 存取與安全 開啟「也允許透過我的固定網域」。",
     reason_quick_link_off: "透過臨時公開連結：請在這台電腦的 設定 → 存取與安全 開啟「也允許透過臨時公開連結」。",
     reason_not_session: "登入後才能授權。",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@songsid/agend",
-  "version": "2.3.3-beta.9",
+  "version": "2.3.3",
   "description": "Multi-agent fleet daemon — run coding CLIs (Claude, Muse, Codex, OpenCode) from Discord or Telegram",
   "type": "module",
   "bin": {