@songsid/agend 2.3.3 → 2.3.4-beta.1

package/dist/ui/settings-registry.js

@@ -65,6 +65,7 @@ const ROWS = [
   // Fleet · Web dashboard
   ["dash.log-tab", "web-dashboard", "#webLogTab", "settings.webLogTab", "web.log_tab", ["log tab", "steps", "log"], ["Log 分頁", "紀錄", "步驟"]],
   ["dash.usage-public", "web-dashboard", "#webUsagePublic", "settings.webUsagePublic", "web.usage_report_on_public_link", ["usage", "public link", "cost", "tokens"], ["用量", "公開連結", "費用"]],
+  ["dash.preview-cdn", "web-dashboard", "#webPreviewCdn", "settings.webPreviewCdn", "web.preview_cdn", ["cdn", "libraries", "html preview", "chart", "jsdelivr", "cdnjs"], ["CDN", "函式庫", "HTML 預覽", "圖表"]],
   ["dash.office-levels", "web-dashboard", "#webOfficeLevels", "settings.webOfficeLevels", "web.office_levels", ["office", "level", "badge", "profile card"], ["辦公室", "等級", "徽章", "名片"]],
   ["dash.app-icon", "web-dashboard", ".s-app-icon", "settings.appIconTitle", null, ["app icon", "favicon", "home screen", "icon"], ["App 圖示", "圖示", "主畫面"]],
   ["dash.card-limits", "web-dashboard", ".s-card-limits", "settings.cardLimitsTitle", "web.appearance", ["upload limits", "portrait", "banner", "card limits"], ["上傳限制", "身分卡上傳限制"]],

package/dist/ui/settings-strings.js

@@ -40,6 +40,8 @@ register("settings", {
     webEcho: "Web echo",
     webEchoHint: "Copies web messages to the bound Telegram or Discord topic. ClassicBot rooms follow it unless a room sets its own.",
     webOfficeLevels: "Office levels", webOfficeLevelsHint: "Each agent's level from its lifetime work, on its name tag in the Office and on its profile card. Off removes the badges and the card's level rows. The token counts behind a level follow the usage report's rules. Applies at once.",
+    webPreviewCdn: "HTML previews may load libraries from cdnjs / jsDelivr",
+    webPreviewCdnHint: "The page's scripts may load libraries from cdnjs (/ajax/libs/) and jsDelivr (/npm/); those requests leave this machine, so the CDN sees them, and a page could use them to send data out. Scripts, styles and fonts only — a preview still cannot fetch or post anything. Off by default; applies to the next preview started, on the public link too.",
     webUsagePublic: "Usage report over the public link", webUsagePublicHint: "Fleet → Usage (up to 400 days of each agent's tokens, requests, messages and API-equivalent amounts) is offered over the temporary public link too. Off by default; guests never see it. Applies at once.",
     webLogTab: "Log tab: each agent's steps", webLogTabHint: "Shows each instance's prompts, replies, tool calls and results, and fleet events in its Log tab, read from its own transcript only while the tab is open. Secret values are masked. Also over the public link. Turning it on waits for a fleet admin's confirmation.",
     general: "General Settings",
@@ -721,6 +723,8 @@ register("settings", {
     webEcho: "Web 同步",
     webEchoHint: "將網頁訊息複製到綁定的 Telegram 或 Discord 主題。ClassicBot 聊天室也照這個設定，除非該聊天室另外設定。",
     webOfficeLevels: "辦公室等級", webOfficeLevelsHint: "每個 agent 依終身工作量得到的等級，顯示在辦公室的名牌與名片上。關閉會移除徽章與名片上的等級列。等級背後的 token 數字依用量報告的規則顯示。變更立即生效。",
+    webPreviewCdn: "HTML 預覽可從 cdnjs / jsDelivr 載入函式庫",
+    webPreviewCdnHint: "頁面的指令碼可以從 cdnjs（/ajax/libs/）和 jsDelivr（/npm/）載入函式庫；這些請求會離開這台電腦，CDN 會看到它們，頁面也可能藉此把資料傳出去。只限指令碼、樣式與字型——預覽仍然無法擷取或送出任何資料。預設關閉；之後開始的預覽才會套用，公開連結也一樣。",
     webUsagePublic: "透過公開連結提供用量報告", webUsagePublicHint: "Fleet → 用量（最多 400 天、每個 agent 的 token、請求、訊息與依牌價換算的 API 等值）也會透過臨時公開連結提供。預設關閉；訪客一律看不到。變更立即生效。",
     webLogTab: "紀錄分頁：每個 agent 的步驟", webLogTabHint: "在每個 instance 的「紀錄」分頁顯示提示、回覆、工具呼叫與結果，以及 fleet 事件；只在分頁開著時從它自己的對話紀錄讀取。機密值會遮蔽。公開連結也看得到。開啟需 fleet admin 確認。",
     general: "一般設定",

package/dist/ui/shared/app-i18n.js

@@ -105,7 +105,7 @@ register("app", {
     restartRefused: "Restart refused: {0}",
     pendingSent: "Sent for confirmation — a fleet admin confirms it in chat.",
     pendingSelfSent: "Confirmed by your account (this browser is web-verified) — applying.",
-    needsNav: "Needs you", needsTab: "Needs you", needsCount: "{0} waiting",
+    needsNav: "Needs you", needsTab: "Needs you", needsCount: "{0} waiting", noticesNav: "Notices", noticesCount: "{0} unread",
     // #2293: global search — chats, cross-instance messages and tasks (not the sidebar's filter of agents).
     search: "Search", searchTitle: "Search chats, messages between agents and tasks ({0})",
     confirmTitle: "Please confirm", confirmOk: "Continue", cancel: "Cancel",
@@ -152,7 +152,7 @@ register("app", {
     restartRefused: "重新啟動被拒絕：{0}",
     pendingSent: "已送出確認——由 fleet 管理員在聊天中確認。",
     pendingSelfSent: "已由你的帳號確認（這個瀏覽器已通過網頁驗證）——套用中。",
-    needsNav: "等你處理", needsTab: "待處理", needsCount: "{0} 件待處理",
+    needsNav: "等你處理", needsTab: "待處理", needsCount: "{0} 件待處理", noticesNav: "通知", noticesCount: "{0} 則未讀",
     search: "搜尋", searchTitle: "搜尋聊天、agent 之間的訊息與任務（{0}）",
     confirmTitle: "請確認", confirmOk: "繼續", cancel: "取消",
     sidePanelLeave: "不儲存就離開「{0}」？你在那裡的修改會遺失。", sidePanelDiscard: "捨棄修改",

package/dist/ui/shared/app-route.js

@@ -30,6 +30,7 @@ export function parseRoute(pathname) {
   if (pathname === "/ui") return { panel: "chat", instance: null };
   if (pathname === "/ui/fleet") return { panel: "fleet", tab: "tasks" };
   if (pathname === "/ui/needs") return { panel: "needs" };
+  if (pathname === NOTICES_PATH) return { panel: "notices" };              // #2910 D2: a web-only fleet's Notices
   // #1523 N2: one instance's Details (`agent` is no Fleet tab; a tab is one segment).
   let m = /^\/ui\/fleet\/agent\/([^/]+)$/.exec(pathname);
   if (m) return named("details", m[1]);
@@ -82,6 +83,7 @@ export function rememberFleetTab(tab) {
   try { localStorage.setItem(LAST_FLEET_TAB_KEY, tab); } catch { /* this page only */ }
 }
 export const NEEDS_PATH = "/ui/needs";
+export const NOTICES_PATH = "/ui/notices";
 /** A section's address; an old name gives its new one (and the place in it: `chat#classicbot`). */
 export function settingsPath(name) {
   const section = (name && legacySection(name)) || name;
@@ -109,6 +111,7 @@ export function routePath(route) {
   if (route.panel === "fleet") return fleetPath(route.tab);
   if (route.panel === "settings") return settingsPath(route.section);
   if (route.panel === "needs") return NEEDS_PATH;
+  if (route.panel === "notices") return NOTICES_PATH;
   if (route.panel === "view") return viewPath(route.instance);
   if (route.panel === "details") return detailsPath(route.instance);
   if (route.panel === "log") return logPath(route.instance);
@@ -140,6 +143,7 @@ export function textLinkSegments(text, links) {
 export function routeKey(route) {
   if (!route) return "none";
   if (route.panel === "needs") return "needs:";
+  if (route.panel === "notices") return "notices:";
   return `${route.panel}:${route.panel === "fleet" ? route.tab : route.panel === "settings" ? route.section : route.instance ?? ""}`;
 }
 

package/dist/ui/shared/app-shell.js

@@ -10,7 +10,7 @@ import { t, lang, setLang, onLang } from "./app-i18n.js";
 import { appStore, createStore, guestBadge, guestPage, guestTrusted, useStore } from "./app-store.js";
 import { navStore } from "./app-nav.js";
 import { toast } from "./ui-toast.js";
-import { chatPath, viewPath, settingsPath, routeKey, NEEDS_PATH, fleetEntryPath } from "./app-route.js";
+import { chatPath, viewPath, settingsPath, routeKey, NEEDS_PATH, NOTICES_PATH, fleetEntryPath } from "./app-route.js";
 import { SessionMenu } from "./app-session.js";
 import { onPrefsChanged, savePref } from "./app-prefs.js";
 import { applyPageTheme, pageNow, resolvedMode, themesStore } from "./app-themes.js";
@@ -328,8 +328,8 @@ function Sidebar({ route, onNewInstance, viewOnly }) {
   const canCreate = useCanCreate();
   const on = (panel) => !!route && route.panel === panel;
   // A count badge is hidden at 0; its number is also in the link's accessible name.
-  const navLink = (panel, href, icon, label, count = 0) => html`<a class=${`side-row${on(panel) ? " active" : ""}`} href=${href}
-    aria-current=${on(panel) ? "page" : undefined} aria-label=${count ? `${label} (${t("app.needsCount", count)})` : undefined} onClick=${closeDrawer}>
+  const navLink = (panel, href, icon, label, count = 0, countText = "app.needsCount") => html`<a class=${`side-row${on(panel) ? " active" : ""}`} href=${href}
+    aria-current=${on(panel) ? "page" : undefined} aria-label=${count ? `${label} (${t(countText, count)})` : undefined} onClick=${closeDrawer}>
     <${Icon} name=${icon} /><span class="grow">${label}</span>${count ? html`<span class="nav-count" aria-hidden="true">${count}</span>` : null}</a>`;
   const needsCount = Array.isArray(app.needs) ? app.needs.length : 0;
   // View-only (an anonymous reader, #1408 §3): View and a way to sign in — nothing that needs a session is rendered.
@@ -379,6 +379,8 @@ function Sidebar({ route, onNewInstance, viewOnly }) {
     <nav data-trust="navigation" class="side-nav" aria-label=${t("app.menu")}>
       ${overview}
       ${navLink("needs", NEEDS_PATH, "inbox", t("app.needsNav"), needsCount)}
+      ${/* #2910 D2: a web-only fleet (no chat connection) has Notices — what General would have said. */
+        app.connections === 0 && app.notices && app.notices.enabled ? navLink("notices", NOTICES_PATH, "bell", t("app.noticesNav"), app.notices.unread | 0, "app.noticesCount") : null}
       ${searchOffered(canCreate) ? searchRow() : null}
       ${canCreate && onNewInstance ? html`<button type="button" class="side-row side-new" onClick=${onNewInstance}><${Icon} name="plus" /><span class="grow">${t("app.newAgent")}</span></button>` : null}
     </nav>

package/dist/ui/shared/app-store.js

@@ -63,7 +63,77 @@ export function applyStatus(d) {
     // #1685: host memory pressure slowing or holding new agents ("elevated" | "critical"), else null.
     hostMemory: d.host_memory === "elevated" || d.host_memory === "critical" ? d.host_memory : null,
     // #2015: while it lasts, the largest processes in the fleet and whose they are (at most 3; anything else dropped).
-    hostMemoryTop: hostMemoryTop(d.host_memory_top) });
+    hostMemoryTop: hostMemoryTop(d.host_memory_top),
+    // #2910 D2 (#2925 review): the newest Notice on a web-only fleet — a polling page reads the list again when it moves.
+    noticesNewest: Number.isSafeInteger(d.notices_newest) ? d.notices_newest : null });
+}
+
+/**
+ * #2910 D2 (#2925 review): a web-only fleet's Notices as the page keeps them. A list read (GET /ui/notices/list), a live
+ * one (SSE `notice`) and a read mark (POST /ui/notices/seen) can answer in any order, so each is merged, never
+ * replaced: the newest NOTICES_KEPT by id (a list read never drops one that arrived live after it was taken), and the
+ * read mark only moves forward. Unread is counted here from the two.
+ */
+export const NOTICES_KEPT = 500;
+function noticesState(enabled, byId, seen) {
+  const items = [...byId.values()].sort((a, b) => b.id - a.id).slice(0, NOTICES_KEPT);
+  return { enabled, items, seen, unread: items.filter((n) => n.id > seen).length };
+}
+const validNotice = (n) => !!n && Number.isSafeInteger(n.id) && n.id > 0 && typeof n.text === "string";
+export function mergeNoticeList(cur, d) {
+  const byId = new Map();
+  for (const n of Array.isArray(d && d.items) ? d.items : []) if (validNotice(n)) byId.set(n.id, n);
+  const listNewest = Math.max(0, ...byId.keys());
+  for (const n of cur && Array.isArray(cur.items) ? cur.items : []) if (n.id > listNewest && !byId.has(n.id)) byId.set(n.id, n);
+  return noticesState(!!(d && d.enabled === true), byId, Math.max(cur ? cur.seen | 0 : 0, d ? d.seen | 0 : 0));
+}
+export function addNotice(cur, n) {
+  if (!cur || !cur.enabled || !validNotice(n) || cur.items.some((x) => x.id === n.id)) return cur;
+  return noticesState(true, new Map([...cur.items, n].map((x) => [x.id, x])), cur.seen | 0);
+}
+/** The newest Notice the status frame names that the page does not have yet (a polling page hears no `notice`). 0: none. */
+export function noticesCatchUp(s) {
+  const have = s && s.notices && s.notices.items.length ? s.notices.items[0].id : 0;
+  return s && Number.isSafeInteger(s.noticesNewest) && s.noticesNewest > have ? s.noticesNewest : 0;
+}
+/** After a read that left the page still behind: try again this soon (a failed read waits longer). */
+export const NOTICES_RETRY_MS = { stale: 1000, failed: 5000 };
+/**
+ * #2910 D2 (#2925 review r2): the page's reads of GET /ui/notices/list. One at a time (a second ask joins the read in
+ * flight); once a read settles, the page asks again if it is still behind what the status frame names (an older read
+ * that was already in flight, or one that failed) — after NOTICES_RETRY_MS, and again until it catches up. Never a
+ * watermark set before a read succeeded.
+ */
+export function createNoticesSync({ store, fetchList, setTimer = (fn, ms) => setTimeout(fn, ms), now = () => Date.now() }) {
+  let inFlight = null, retryAt = 0, timer = null, on = false;
+  const behind = () => on && noticesCatchUp(store.get()) > 0;
+  const recheck = () => { if (!inFlight && behind() && now() >= retryAt) read(); };
+  const later = (ms) => {
+    retryAt = now() + ms;
+    if (timer === null) timer = setTimer(() => { timer = null; recheck(); }, ms);
+  };
+  function read() {
+    return (inFlight ??= Promise.resolve().then(fetchList).then((d) => {
+      if (!d || !Array.isArray(d.items)) throw new Error("no list");
+      store.set({ notices: mergeNoticeList(store.get().notices, d) });
+      return true;
+    }).catch(() => false).then((ok) => {
+      inFlight = null;
+      if (behind()) later(ok ? NOTICES_RETRY_MS.stale : NOTICES_RETRY_MS.failed);
+      else retryAt = 0;
+    }));
+  }
+  return {
+    /** The fleet is web-only: start (the first read), and follow the status frame from now on. */
+    start() { if (!on) { on = true; read(); } },
+    read,
+    recheck,
+    started: () => on,
+  };
+}
+export function applyNoticesSeen(cur, seen) {
+  if (!cur || !Number.isSafeInteger(seen) || seen <= (cur.seen | 0)) return cur;
+  return noticesState(cur.enabled, new Map(cur.items.map((x) => [x.id, x])), seen);
 }
 
 /** #2015: the status frame's host_memory_top, as the dashboard keeps it: well-formed entries only, at most 3. */

package/dist/ui/shared/app-stream.js

@@ -37,7 +37,7 @@
 // offices — the stored offices changed ({ rev }; SSE only: the Office view reads /ui/offices again).
 // office_skins — a skin pack was uploaded or deleted ({ rev }; SSE only: the Office view reads /ui/office-skins again).
 // office_acts — the agents' live acts in the Office view changed ({ acts }, #2578; a poll page reads /ui/office-acts).
-const EVENTS = ["status", "message", "agent_reply_live", "delivery", "deliveries", "prompt", "prompts", "prompt_resolved", "activity", "needs", "reply_buttons", "reactions", "steps_tick", "clock", "traffic", "delegation", "backend_login", "tasks", "offices", "office_skins", "office_acts", "office_pack_changes"];
+const EVENTS = ["status", "message", "agent_reply_live", "delivery", "deliveries", "prompt", "prompts", "prompt_resolved", "activity", "needs", "reply_buttons", "reactions", "steps_tick", "clock", "traffic", "delegation", "backend_login", "tasks", "offices", "office_skins", "office_acts", "office_pack_changes", "notice"];
 const MAX_HELD = 1000;                    // live events held during one catch-up read; more → read again afterwards
 const RETRY_DELAYS = [1000, 2000, 4000];  // after the first failed catch-up read; then it waits for Retry
 const POLL_LIMIT_MS = 10000;              // a poll that has not answered by then counts as failed

package/dist/ui/shared/app.css

@@ -807,6 +807,39 @@ img.amb-p { object-fit: contain; }
 .preview-frame.fill { flex: 1; height: 100%; min-height: 0; }
 .pv-code { flex: 1; min-height: 0; margin: 0; overflow: auto; font-family: var(--font-mono); font-size: var(--fs-xs); line-height: 1.5;
   background: var(--surface); border-radius: var(--r-sm); padding: var(--s-3); white-space: pre-wrap; overflow-wrap: anywhere; color: var(--text); }
+/* preview panel chrome (M-2216) — #2911: the version step and the Changes view. */
+.pv-ver { display: inline-flex; align-items: center; gap: var(--s-1); font-size: var(--fs-xs); color: var(--text-2); }
+.pv-ver-at { min-width: 6ch; text-align: center; font-variant-numeric: tabular-nums; }
+.pv-panel > .pv-ver-note { margin: 0 var(--s-3) var(--s-2); }
+.pv-diff-wrap { flex: 1; min-height: 0; display: flex; flex-direction: column; gap: var(--s-2); }
+.pv-diff-head { font-size: var(--fs-xs); color: var(--text-2); }
+.pv-diff { white-space: pre; overflow-wrap: normal; }
+.pv-diff > code > span { display: block; }
+.pv-diff .d-add { background: var(--ok-bg); color: var(--ok); }
+.pv-diff .d-del { background: var(--danger-bg); color: var(--danger); }
+.pv-diff .d-hunk { color: var(--text-3); }
+.pv-diff-note { margin: 0; }
+/* #2911 (2): the page at a phone's or a tablet's width, centred; a panel narrower than that scrolls sideways. */
+.pv-panel-body.w-phone, .pv-panel-body.w-tablet { overflow-x: auto; }
+/* The frame keeps its 2px warning border (.preview-frame): the holder is that much wider, so the page itself lays out
+   at exactly 390 / 768 CSS px (its innerWidth, its min-width media queries) — #2918 review. */
+.pv-panel-body.w-phone .pv-holder { flex: 1 0 auto; width: calc(390px + 2 * 2px); max-width: none; margin-inline: auto; }
+.pv-panel-body.w-tablet .pv-holder { flex: 1 0 auto; width: calc(768px + 2 * 2px); max-width: none; margin-inline: auto; }
+.pv-width { font: inherit; font-size: var(--fs-xs); padding: 2px var(--s-1); border: 1px solid var(--border); border-radius: var(--r-sm); background: var(--bg); color: var(--text); }
+/* Full screen: the API's (:fullscreen), or the panel over the whole window where the page may not use it. */
+/* Three classes, so it wins over the desktop split's ".chat-split > .pv-panel { position: relative; z-index: 1 }" — #2918 review. */
+.pv-panel.pv-fs.pv-fs-native, .pv-panel.pv-fs.pv-fs-immersive { width: auto; min-width: 0; max-width: none; }
+.chat-split > .pv-panel.pv-fs-immersive, .pv-panel.pv-fs.pv-fs-immersive { position: fixed; inset: 0; z-index: 60; }
+/* #2911 (6): the thread's pages. */
+.pv-pages { list-style: none; margin: 0; padding: 0; overflow: auto; display: flex; flex-direction: column; gap: var(--s-1); }
+.pv-page { width: 100%; display: flex; align-items: center; gap: var(--s-2); padding: var(--s-2) var(--s-3); border: 1px solid var(--border);
+  border-radius: var(--r-sm); background: var(--surface); color: var(--text); font: inherit; font-size: var(--fs-sm); text-align: left; cursor: pointer; }
+.pv-page.on { border-color: var(--accent); }
+.pv-page-name { flex: 1; min-width: 0; overflow: hidden; text-overflow: ellipsis; white-space: nowrap; }
+.pv-page-meta { flex: none; color: var(--text-3); font-size: var(--fs-xs); }
+.pv-pages-toggle { flex: none; }
+/* A narrow panel: two rows — versions and views; then the width, the run controls, the page's actions and Download. */
+@container (max-width: 560px) { .pv-panel-bar .grow { flex-basis: 100%; height: 0; } }
 .msg.flash { outline: 2px solid var(--accent); outline-offset: 4px; border-radius: var(--r-sm); transition: outline-color var(--t-med); }
 /* #2272: a message's reply action (top right, on hover or focus), the quote a reply shows, the message menu, a swipe. */
 .msg[data-key] { position: relative; }
@@ -837,6 +870,10 @@ img.amb-p { object-fit: contain; }
 @container (max-width: 560px) {
   .pv-panel-bar :not(.pv-panel-run) > .lbl { position: absolute; width: 1px; height: 1px; padding: 0; margin: -1px; overflow: hidden; clip: rect(0 0 0 0); white-space: nowrap; border: 0; }
 }
+/* preview feedback (M-2217, #2911): the errors chip — its count stays when a narrow bar hides the word. */
+.pv-fb-errors { color: var(--warn); border-color: var(--warn-line); background: var(--warn-bg); }
+.pv-fb-pick.on { color: var(--warn); border-color: var(--warn); }
+.pv-fb-errors .pv-fb-n { font-variant-numeric: tabular-nums; font-weight: var(--fw-semibold); }
 /* #1266: an agent reply's buttons — choices under the text; one answers for everyone. */
 .rb-row { display: flex; flex-wrap: wrap; align-items: center; gap: var(--s-2); margin-top: var(--s-2); }
 .rb-btn { max-width: 100%; white-space: normal; text-align: left; }
@@ -1595,6 +1632,11 @@ textarea.s-yaml { white-space: pre; overflow-x: auto; }
 .n-detail { color: var(--text-2); font-size: var(--fs-sm); overflow-wrap: anywhere; white-space: pre-wrap; }
 .n-actions { display: flex; gap: var(--s-2); flex-wrap: wrap; margin-top: var(--s-1); }
 .n-notify { display: flex; flex-direction: column; gap: var(--s-1); }
+/* #2910 D2: Notices (a web-only fleet's General) — the Needs you rows; a new one has an accent edge and a "New" tag. */
+.n-item.notice.unread { box-shadow: inset 3px 0 0 var(--accent); }
+.n-item.notice:not(.bad) .n-icon { color: var(--text-2); }
+.notice-new { font-size: var(--fs-xs); color: var(--accent); font-weight: var(--fw-semibold); }
+.notice-sub { margin: 0 var(--s-1) var(--s-3); }
 .confirm-text { white-space: pre-wrap; font-size: var(--fs-sm); color: var(--text-2); }
 
 /* ── Org chart (#1389): General → teams → instances. Connectors are borders and pseudo-elements; no inline style.
@@ -2242,7 +2284,7 @@ html.oo-immersive .p-fleet > .panel-body { z-index: 50; }
 @media (min-width: 900px) { .chat-split > .pv-divider, .chat-split > .pv-panel { position: relative; z-index: 1; } }
 /* #1629: full-app bounded stock surfaces. Panel roots stay neutral; effects never raise the whole app. */
 .p-fleet > .seg, .p-settings > .seg,
-.p-fleet > .panel-body, .p-needs > .panel-body, .p-settings > .panel-body,
+.p-fleet > .panel-body, .p-needs > .panel-body, .p-notices > .panel-body, .p-settings > .panel-body,
 .p-log > .panel-body, .p-details > .panel-body, .p-view > .panel-body,
 .p-log > .log-bar, .p-view > .v-term, .p-view > .v-id, .p-view > .v-watching { position: relative; z-index: 1; }
 /* Keep the existing Apply bar's sticky behavior, in its own bounded stock band. */

package/dist/ui/shared/app.js

@@ -13,7 +13,7 @@ import { installSwipe } from "./app-swipe.js";
 import { installTextUndo } from "./text-undo.js";
 import { startRouter, navStore, navigate } from "./app-nav.js";
 import { createStream } from "./app-stream.js";
-import { appStore, applyStatus, applyActivity, guestPage, guestTrusted } from "./app-store.js";
+import { appStore, applyStatus, applyActivity, guestPage, guestTrusted, addNotice, createNoticesSync } from "./app-store.js";
 import { chatPath } from "./app-route.js";
 import { startNeedsNotifier } from "./app-needs.js";
 import { toast } from "./ui-toast.js";
@@ -91,6 +91,27 @@ if (mode === "full") {
     const loadApply = retryable((a) => import(retryUrl("/ui/js/settings-apply.js", a)));
     appStore.set({ restartRunner: (jobId) => loadApply().then((m) => m.restartPendingChanges(jobId)) });
     panels.set("needs", { load: () => loadNeeds().then((m) => m.NeedsPanel) });
+    // #2910 D2: a web-only fleet's Notices (/ui/notices): read once the status says there is no chat connection (and
+    // again after a reconnect: a poll page hears no `notice`), then each new one from the stream.
+    const loadNotices = retryable((a) => import(retryUrl("/ui/js/panel-notices.js", a)));
+    panels.set("notices", { load: () => loadNotices().then((m) => m.NoticesPanel) });
+    // A list read and a live notice can cross: each is merged into what the page has (app-store.js mergeNoticeList); a
+    // read that leaves the page behind what the status frame names is asked again (createNoticesSync).
+    const notices = createNoticesSync({ store: appStore,
+      fetchList: () => fetch("/ui/notices/list", { credentials: "same-origin", cache: "no-store" }).then((r) => (r.ok ? r.json() : null)) });
+    const readNotices = () => notices.read();
+    appStore.set({ readNotices });
+    appStore.subscribe((s) => {
+      if (s.connections === 0) notices.start();
+      notices.recheck();                       // a polling page hears no `notice`: the status frame's newest id is its catch-up
+    });
+    stream.on("connection", (c) => { if ((c === "live" || c === "polling") && notices.started()) readNotices(); });
+    stream.on("notice", (d) => {
+      const cur = appStore.get().notices;
+      if (!cur || !cur.enabled) { readNotices(); return; }
+      const next = addNotice(cur, d && d.notice);
+      if (next !== cur) appStore.set({ notices: next });
+    });
     // #1523 N2: one instance's Details (/ui/fleet/agent/<name>).
     panels.set("details", { load: () => loadDetails().then((m) => m.DetailsPanel) });
     // #1218: one instance's Log (/ui/log/<name>).

package/dist/ui/shared/signin.js

@@ -23,6 +23,10 @@
       resend: "Send me a new code", resent: "A new code was sent to you privately in chat. Enter it above.",
       resend_wait: "A code was asked for a moment ago — wait a little and try again.",
       resend_refused: "A new code could not be sent. Ask for one with /web.",
+      // #2910 D5: a web-only fleet (no chat connection): there is no /web to send — the code comes from the AgEnD computer.
+      hint_web: "On the AgEnD computer, run agend web --code to get a sign-in code.",
+      refused_web: "The code is invalid or no longer works. Run agend web --code on the AgEnD computer for a new one.",
+      resend_refused_web: "A new code could not be sent. Run agend web --code on the AgEnD computer for one.",
     },
     "zh-TW": {
       checking: "正在確認登入狀態…", title: "登入 AgEnD", lead: "輸入登入碼。",
@@ -37,10 +41,17 @@
       resend: "傳一組新的登入碼給我", resent: "新的登入碼已私訊給你，請在上方輸入。",
       resend_wait: "剛剛才要過登入碼，請稍候再試。",
       resend_refused: "無法傳送新的登入碼。請用 /web 再要一個。",
+      hint_web: "在 AgEnD 電腦上執行 agend web --code 取得登入碼。",
+      refused_web: "登入碼無效或已失效。請在 AgEnD 電腦上執行 agend web --code 取得新碼。",
+      resend_refused_web: "無法傳送新的登入碼。請在 AgEnD 電腦上執行 agend web --code 取得。",
     },
   };
   const lang = /^zh/i.test(navigator.language || "") ? "zh-TW" : "en";
-  const t = (k) => T[lang][k] || T.en[k] || k;
+  // #2910 D5: the server marks a web-only fleet's page (<body data-web-only="1">): its own words where it has them.
+  const webOnly = !!document.body && document.body.getAttribute("data-web-only") === "1";
+  const t = (k) => (webOnly && (T[lang][`${k}_web`] || T.en[`${k}_web`])) || T[lang][k] || T.en[k] || k;
+  // …and no "No chat bot?" help: the hint above already is it.
+  if (webOnly) document.querySelectorAll("details.help").forEach((d) => { if (d.querySelector && d.querySelector('[data-i18n="nobot"]')) d.hidden = true; });
   document.documentElement.lang = lang === "zh-TW" ? "zh-Hant" : "en";
 
   // An old dashboard link carries `?token=`. It is not a credential any more (the server ignored it and

package/dist/ui/shared/ui-icons.js

@@ -60,6 +60,9 @@ const P = {
   panel: () => html`<rect x="3" y="4" width="18" height="16" rx="2"/><path d="M14 4v16"/>`,
   back: () => html`<path d="M19 12H5M12 19l-7-7 7-7"/>`,
   forward: () => html`<path d="M5 12h14M12 5l7 7-7 7"/>`,
+  prev: () => html`<path d="M15 18l-6-6 6-6"/>`,                            // #2911: the preview panel's version step
+  next: () => html`<path d="M9 18l6-6-6-6"/>`,
+  diff: () => html`<path d="M12 3v8M8 7h8M8 17h8M5 21h14"/>`,                   // #2911: the preview panel's Changes
   // #1629: Settings → Appearance.
   palette: () => html`<path d="M12 3a9 9 0 1 0 0 18c1.1 0 1.7-.8 1.7-1.7 0-.5-.2-.9-.5-1.2-.3-.3-.5-.7-.5-1.2 0-.9.8-1.7 1.7-1.7H16a5 5 0 0 0 5-5c0-4-4-7.2-9-7.2z"/><circle cx="7.5" cy="10.5" r="1"/><circle cx="10.5" cy="7" r="1"/><circle cx="15" cy="7.5" r="1"/>`,
   book: () => html`<path d="M4 19.5A2.5 2.5 0 0 1 6.5 17H20V3H6.5A2.5 2.5 0 0 0 4 5.5z"/><path d="M4 19.5A2.5 2.5 0 0 0 6.5 22H20v-5"/>`,

package/dist/ui/shared/web-authorize.js

@@ -15,6 +15,7 @@ register("webauth", {
     reason_disabled: "Web authority is turned off.",
     reason_loopback_only: "Only this computer can authorize, and this browser is not on it.",
     reason_no_account: "This browser was not signed in as an account (agend web): sign in with /web to authorize.",
+    reason_host_sign_in: "To speak as this computer's admin, sign in again on this computer with agend web --code.",
     reason_not_admin: "Your account is not a fleet admin here.",
     reason_not_admin_session: "Guests can't authorize.",
     reason_token_rotated: "The dashboard's token changed: sign in again.",
@@ -43,6 +44,7 @@ register("webauth", {
     reason_disabled: "網頁授權已關閉。",
     reason_loopback_only: "只有這台電腦可以授權，而這個瀏覽器不在這台電腦上。",
     reason_no_account: "這個瀏覽器不是用帳號登入的（agend web）：請用 /web 登入後再授權。",
+    reason_host_sign_in: "要以這台電腦的管理者身分發言，請在這台電腦上執行 agend web --code 重新登入。",
     reason_not_admin: "你的帳號在這裡不是 fleet 管理者。",
     reason_not_admin_session: "訪客無法授權。",
     reason_token_rotated: "儀表板的 token 已變更：請重新登入。",
@@ -66,7 +68,7 @@ register("webauth", {
 const tn = (k, ...v) => t(`webauth.${k}`, ...v);
 // The switch and "Only this computer" are changed in Settings on this computer — never over the public link (#2525 review).
 const fixable = (reason) => (reason === "disabled" || reason === "loopback_only") && globalThis.document?.body?.dataset?.publicLink !== "1";
-const REASONS = ["disabled", "loopback_only", "no_account", "not_admin", "not_admin_session", "token_rotated", "public_link", "named_link_off", "quick_link_off", "not_session"];
+const REASONS = ["disabled", "loopback_only", "no_account", "host_sign_in", "not_admin", "not_admin_session", "token_rotated", "public_link", "named_link_off", "quick_link_off", "not_session"];
 // Until when: the time, with the day when it isn't today (an authorization lasts up to 48 h).
 const clock = (ms) => {
   const d = new Date(ms), today = new Date().toDateString() === d.toDateString();

package/dist/web-api.d.ts

@@ -216,7 +216,23 @@ export interface WebApiContext {
             owner: string;
         }): Promise<import("./office-share-service.js").OfficeShareMade>;
         revoke(id: string): number;
+        /** #2911: page share links on the same tunnel (page-share.ts); absent: /ui/page-share is not offered. */
+        pagesEnabled?(): boolean;
+        pagesCdn?(): boolean;
+        listPages?(): import("./page-share.js").PageShare[];
+        createPage?(opts: {
+            html: string;
+            instance: string;
+            title: string;
+            owner: string;
+            from?: import("./page-share.js").PageShare["from"];
+            minutes?: number;
+            stillAllowed?(): boolean;
+        }): Promise<import("./office-share-service.js").PageShareMade>;
+        revokePage?(id: string): import("./page-share.js").PageShare[];
     };
+    /** #2911: a page share was made — said in that instance's channel (who, which page, for how long; never its URL). */
+    pageShareNotice?(who: string, share: import("./page-share.js").PageShare): void;
     /** #2636: a share was made or ended from the page — said in General (who, which office, until when). */
     officeShareNotice?(event: "created" | "revoked", who: string, share: import("./office-share.js").OfficeShare | null, count: number): void;
     /** #2692: the agents' skin-pack changes (approval mode, pending changes, log); absent: /ui/office-pack-changes is not offered. */
@@ -326,6 +342,16 @@ export interface WebApiContext {
         status: number;
         message: string;
     };
+    /** #2910 D2: a web-only fleet's Notices (web-notices.ts); null on a fleet whose General says them. */
+    webNoticesFeed?(): {
+        view(): {
+            items: unknown[];
+            seen: number;
+            unread: number;
+        };
+        markSeen(id: number): number;
+        unread(): number;
+    } | null;
     /** Answer one of them, exactly as a click on its platform button would. */
     /** `text`: #2675 — the typed answer, for the one action the page shows a text box for. */
     clickWebPrompt?(instance: string, nonce: string, action: string, text?: string): Promise<{