botmux 3.5.0 → 3.6.0

package/dist/dashboard/web/i18n.js

@@ -276,6 +276,9 @@ const zh = {
     'sessions.lockSelected': '锁定选中',
     'sessions.unlockSelected': '解锁选中',
     'sessions.lockFailed': '锁定状态更新失败',
+    'sessions.columnsReset': '重置',
+    'sessions.columnsMenu': '显示列',
+    'sessions.columns': '列',
     'sessions.bot': 'bot',
     'sessions.cli': 'CLI',
     'sessions.chat': '群聊',
@@ -331,15 +334,6 @@ const zh = {
     'sessions.dismiss': '关闭',
     'sessions.closeConfirm': '关闭这个会话？',
     'sessions.resumeFailed': '恢复失败',
-    'sessions.land': '落盘',
-    'sessions.landLoading': '加载沙盒 diff…',
-    'sessions.landUnavailable': '无法落盘',
-    'sessions.landEmpty': '沙盒副本没有改动。',
-    'sessions.landApply': '应用到磁盘',
-    'sessions.landDiscard': '丢弃',
-    'sessions.landApplied': '已落盘',
-    'sessions.landFailed': '落盘失败',
-    'sessions.landDiscarded': '已丢弃（沙盒副本未应用）。',
     'sessions.insight': '洞察',
     'sessions.insightLoading': '分析中…',
     'sessions.insightUnavailable': '无法分析',
@@ -785,6 +779,8 @@ const zh = {
     'connectors.noOnlineBots': '（没有在线机器人）',
     'connectors.storePayload': '记录请求参数',
     'connectors.storePayloadHint': '保存脱敏后的 JSON 请求体和请求头，默认保留 14 天；可随时在列表关闭。',
+    'connectors.suppressFinalOutput': '不发送最终结果通知',
+    'connectors.suppressFinalOutputHint': '触发后机器人处理完不再单独补发「完成/总结」那条消息；实时状态卡和处理过程中主动 botmux send 的内容仍会照常发出。适用于机器人已把结果发到话题、不想再收到一条兜底总结的场景。',
     'connectors.payloadLogged': '参数留存 {days} 天',
     'connectors.metadataOnly': '仅记录调用元数据',
     'connectors.btnDisablePayloadLog': '停止留存参数',
@@ -1224,6 +1220,12 @@ const zh = {
     'settings.loading': '正在加载设置…',
     'settings.loadFailed': '设置加载失败',
     'settings.readOnlyVisitor': '当前是只读访问，修改设置需要授权链接（运行 botmux dashboard 获取）',
+    'settings.moduleGeneral': '通用设置',
+    'settings.moduleGeneralHelp': '管理访问方式、飞书卡片、实验能力和任务行为。',
+    'settings.moduleMeeting': '会议 Agent',
+    'settings.moduleMeetingHelp': '集中配置会议监听、角色预设和官方角色模板。',
+    'settings.moduleSystem': '系统与维护',
+    'settings.moduleSystemHelp': '管理自动更新、重启与运行版本。',
     'settings.sectionAccess': '访问权限',
     'settings.publicReadOnly': '允许无 token 只读访问 dashboard',
     'settings.publicReadOnlyHelp': '允许无 token 查看明确列入白名单的只读数据；Workflow 详情、原始日志和所有写操作始终需要 token。',
@@ -1303,6 +1305,20 @@ const zh = {
     'settings.vcProfiles.migrationEnable': '升级并启用全能力默认纪要（保存后生效）',
     'settings.vcProfiles.noEligibleDefaultAgent': '暂时无法生成默认角色：请至少为一个支持可靠回执的角色执行 Bot 配置默认工作目录。',
     'settings.vcProfiles.legacyCatalog': '检测到旧版或未完成的会议 Agent 配置；保存角色预设后将切换到多角色模式。',
+    'settings.vcProfiles.templates.title': '角色模板库',
+    'settings.vcProfiles.templates.builtinBadge': '内置',
+    'settings.vcProfiles.templates.help': '从模板开始，再按你的场景修改 Agent、职责、过滤和输出方式。应用模板只会创建一份可编辑副本，不会与模板持续绑定。',
+    'settings.vcProfiles.templates.use': '使用此模板',
+    'settings.vcProfiles.list.title': '我的预设',
+    'settings.vcProfiles.list.help': '你维护的会议角色。点击卡片查看和编辑详情；勾选默认后，未操作飞书选择卡时会自动启用。',
+    'settings.vcProfiles.list.empty': '还没有角色预设。可以新建空白预设，或从下方官方模板开始。',
+    'settings.vcProfiles.setDefault': '设为默认',
+    'settings.vcProfiles.viewDetails': '查看详情',
+    'settings.vcProfiles.newBadge': '未保存',
+    'settings.vcProfiles.untitled': '未命名预设',
+    'settings.vcProfiles.noInstructions': '尚未填写职责说明',
+    'settings.vcProfiles.close': '关闭',
+    'settings.vcProfiles.done': '完成编辑',
     'settings.vcProfiles.needAuth': '会议角色预设需要授权访问后编辑。',
     'settings.vcProfiles.discardConfirm': '有未保存的修改，切换后将丢弃。确认切换？',
     'settings.vcProfiles.loading': '加载中…',
@@ -1327,6 +1343,11 @@ const zh = {
     'settings.vcProfiles.responseModeHelp': '静默：后台分析，不自动在监听群回帖；若权限模板允许，仍可申请会中发言，用户显式提问时也会回复。\n回复监听群：把分析结果自动发到会议监听话题；同一场会议最多一个角色自动回帖，避免刷屏。',
     'settings.vcProfiles.responseSilent': '静默（不自动回帖）',
     'settings.vcProfiles.responseListener': '回复监听群',
+    'settings.vcProfiles.fieldListenerPlacement': '群内呈现',
+    'settings.vcProfiles.listenerPlacementHelp': '仅控制自动输出在监听群中的承载形式，不改变静默/自动输出权限。跟随群聊模式保持历史行为；直接发群消息始终发送到群顶层；聚合到会议话题时，首条输出成为话题根，后续输出持续回复同一话题。',
+    'settings.vcProfiles.listenerPlacement.auto': '跟随群聊模式',
+    'settings.vcProfiles.listenerPlacement.chat': '直接发群消息',
+    'settings.vcProfiles.listenerPlacement.topic': '聚合到会议话题',
     'settings.vcProfiles.fieldPreset': '权限模板',
     'settings.vcProfiles.presetHelp': '只分析：只读会议信息。\n文本/语音发言：可申请对应的会中输出，仍需经 daemon 权限与审批闸门，不是直接发送；同一场会议每种输出只能有一个负责角色。\n自定义：仅沿用该 ID 已保存的底层 policy，不能在浏览器里构造新权限。',
     'settings.vcProfiles.preset.observe_only': '只分析',
@@ -1366,6 +1387,14 @@ const zh = {
     'settings.sectionWhiteboard': '本地白板',
     'settings.whiteboardEnable': '启用项目白板',
     'settings.whiteboardEnableHelp': '默认关闭。开启白板能力；不会立即创建白板，首次按群和项目使用时再初始化。',
+    'settings.sectionGroupCreation': '群聊创建',
+    'settings.groupNamePrefix': '/group 默认群名前缀',
+    'settings.groupNamePrefixHelp': '仅作用于飞书斜杠命令 /group 和别名 /g；其他建群入口不受影响。清空并保存即可关闭，跨进程最多约 2 秒生效。',
+    'settings.groupNamePrefixPlaceholder': '例如：AI讨论·',
+    'settings.groupNamePrefixPreview': '预览：{name}',
+    'settings.groupNamePrefixPreviewName': '示例群名',
+    'settings.groupNamePrefixDisabled': '当前未设置前缀；/group 将沿用原群名。',
+    'settings.groupNamePrefixSave': '保存前缀',
     'settings.saving': '保存中…',
     'settings.saved': '已保存',
     'settings.saveFailed': '保存失败',
@@ -1686,8 +1715,21 @@ const zh = {
     'botDefaults.sandboxToggle': '开启文件沙盒',
     'botDefaults.sandboxHelp': '开启后，该 bot 的每个会话都跑在沙盒里：agent 能在项目目录内正常读写干活，但碰不到项目外你磁盘上的真实文件、密钥、别的会话数据——对项目外的写入会被隔离/拦截。适合把机器人分享给半受信任的人（oncall）。Linux 用 bwrap、macOS 用 Seatbelt，两端保护效果一致；下个新会话生效。',
     'botDefaults.sandboxSaved': '已保存（下个新会话生效）',
-    'botDefaults.sandboxReadIsoOn': '读隔离：本 bot 的沙盒会话还会读不到其它 bot 的凭证（bots.json）、会话与聊天内容（macOS · Linux，claude/codex）。',
-    'botDefaults.sandboxReadIsoOff': '本 bot 的沙盒仅写保护；额外的「跨-bot 读隔离」需 claude-code / codex + macOS/Linux（且未配 wrapper 网关）。',
+    'botDefaults.sandboxReadIsoOn': '增强 CLI 数据隔离：该 bot 的 CLI 凭证、配置与会话数据会重定向到专属目录，与其它 bot 分开（claude-code / codex，且未配 wrapper 网关）。',
+    'botDefaults.sandboxReadIsoOff': '基础文件沙盒仍提供 deny-by-default 的读写隔离；当前 CLI 或 wrapper 配置不支持将 CLI 全局数据重定向到本 bot 专属目录。',
+    'botDefaults.sectionSandboxPaths': '沙盒目录白名单',
+    'botDefaults.sbxPathsHelp': 'deny-by-default：默认什么都看不到，只有下面显式放行的目录才可见。每个目录三态循环：继承父级 → 可写 → 只读 → 封禁。按最长前缀生效，可任意嵌套（可写目录里挖封禁洞、洞里再开可写窗）。改动下个新会话生效。',
+    'botDefaults.sbxPathsSaved': '已保存（下个新会话生效）',
+    'botDefaults.sbxPathsSave': '保存策略',
+    'botDefaults.sbxPathsTextMode': '切到文本模式（可复制分享）',
+    'botDefaults.sbxPathsTreeMode': '切回目录树',
+    'botDefaults.sbxRw': '可写',
+    'botDefaults.sbxRo': '只读',
+    'botDefaults.sbxDeny': '封禁',
+    'botDefaults.sbxNone': '不可见',
+    'botDefaults.sbxInherit': '继承',
+    'botDefaults.sbxNoSubdirs': '（无子目录）',
+    'botDefaults.sbxTestPlaceholder': '输入路径测试实际生效访问，如 ~/my-data/secrets/x',
     'botDefaults.readIsolationToggle': '开启读隔离（macOS）',
     'botDefaults.readIsolationHelp': '开启后，该 bot 的会话在 macOS 沙箱（Seatbelt）里运行：读不到其它 bot 的凭证（bots.json）、会话、聊天内容，但能收发自己的消息、读自己上传的文件/白板。是上面「文件沙盒」在 macOS 上的对应机制。下个新会话生效。',
     'botDefaults.readIsolationSaved': '已保存（下个新会话生效）',
@@ -1838,11 +1880,23 @@ const zh = {
     'botDefaults.maxLiveWorkersInvalid': '上限必须是正整数',
     'botDefaults.maxLiveWorkersStateDefault': '当前：默认常驻 30 个会话',
     'botDefaults.maxLiveWorkersStateOn': '当前：最多常驻 {count} 个会话',
+    'botDefaults.overloadAlert': '机器过载告警',
+    'botDefaults.overloadAlertHelp': '开启后，本 Bot 的 daemon 会每 30 秒检查整机负载/内存，越过过载线（默认 load15 > 核数×1.5 或内存≥92%）时给本 Bot 的管理员发一条飞书私信提醒，恢复后再发一条。机器过载会导致 botmux 会话冷启动超时假死，这个提醒能让你及时清理会话或调低常驻上限。负载是整机指标，指定一个 Bot 开启即可；多个 Bot 同时开也会自动去重、整机每次过载只发一次。默认关闭。',
     'botDefaults.sectionRuntimeEnv': '启动环境',
     'botDefaults.sectionStartupCommands': '启动命令',
     'botDefaults.startupCommandsHelp': '新会话启动后、首条消息前自动发送的 CLI 命令。支持逗号或换行分隔；每次新会话和恢复都会重放。仅原生 CLI 会话生效。',
     'botDefaults.startupCommandsPlaceholder': '每行一条，如 /effort ultracode',
     'botDefaults.startupCommandsSave': '保存启动命令',
+    'botDefaults.sectionSlashCommands': 'Slash 命令权限',
+    'botDefaults.sectionSlashCommandsHelp': '控制哪些 slash 命令透传给底层 CLI，以及哪些 daemon 命令对「能对话」的人放行。改动立即生效。',
+    'botDefaults.customPassthrough': '额外透传命令',
+    'botDefaults.customPassthroughHelp': '在内置白名单之外，额外放行透传给底层 CLI 的 slash 命令（daemon 不处理，原样转发）。逗号或空格分隔，如 /goal /export。会 daemon 命令冲突的条目被忽略。留空＝仅内置白名单。',
+    'botDefaults.customPassthroughPlaceholder': '如 /goal /export',
+    'botDefaults.customPassthroughSave': '保存透传命令',
+    'botDefaults.canTalkDaemon': 'canTalk 可用的 daemon 命令',
+    'botDefaults.canTalkDaemonHelp': '把列出的 daemon 命令权限从 canOperate（仅管理员）降到 canTalk（对话放行即可用，如 oncall 群成员、被授权人、私聊用户）。逗号或空格分隔，只认 daemon 命令（透传/拼错条目被忽略）。⚠️ /cd /restart /rename 等会改变状态，降级须谨慎；建议只放 /status /help 这类低危命令。留空＝全部仅管理员。',
+    'botDefaults.canTalkDaemonPlaceholder': '如 /status /help',
+    'botDefaults.canTalkDaemonSave': '保存降权名单',
     'botDefaults.sectionLaunchShell': '启动 Shell',
     'botDefaults.launchShellHelp': '指定启动 CLI 的 shell（如 zsh 或 /usr/bin/zsh），覆盖 daemon 的 $SHELL。用于绕过登录 shell rc 中的跳转问题；PATH 等仍需在所选 shell 配置中可用。下个新会话生效。',
     'botDefaults.launchShellPlaceholder': '如 zsh 或 /usr/bin/zsh；留空＝用 $SHELL',
@@ -2219,6 +2273,9 @@ const en = {
     'sessions.lockSelected': 'Lock selected',
     'sessions.unlockSelected': 'Unlock selected',
     'sessions.lockFailed': 'Failed to update lock state',
+    'sessions.columnsReset': 'Reset',
+    'sessions.columnsMenu': 'Show columns',
+    'sessions.columns': 'Columns',
     'sessions.bot': 'Bot',
     'sessions.cli': 'CLI',
     'sessions.chat': 'Chat',
@@ -2274,15 +2331,6 @@ const en = {
     'sessions.dismiss': 'Close',
     'sessions.closeConfirm': 'Close this session?',
     'sessions.resumeFailed': 'Resume failed',
-    'sessions.land': 'Land',
-    'sessions.landLoading': 'Loading sandbox diff…',
-    'sessions.landUnavailable': 'Cannot land',
-    'sessions.landEmpty': 'No changes in the sandbox clone.',
-    'sessions.landApply': 'Apply to disk',
-    'sessions.landDiscard': 'Discard',
-    'sessions.landApplied': 'Landed',
-    'sessions.landFailed': 'Land failed',
-    'sessions.landDiscarded': 'Discarded (sandbox clone not applied).',
     'sessions.insight': 'Insight',
     'sessions.insightLoading': 'Analyzing…',
     'sessions.insightUnavailable': 'Insight unavailable',
@@ -2728,6 +2776,8 @@ const en = {
     'connectors.noOnlineBots': '(No online bots)',
     'connectors.storePayload': 'Retain request parameters',
     'connectors.storePayloadHint': 'Stores redacted JSON bodies and headers for 14 days by default. You can turn this off from the list.',
+    'connectors.suppressFinalOutput': 'Suppress final result notice',
+    'connectors.suppressFinalOutputHint': 'After a trigger fires, the bot will not post the trailing "done/summary" message. The live status card and anything the bot actively sends via botmux send still appear. Use this when the bot already posts its result into the topic and you do not want an extra summary.',
     'connectors.payloadLogged': 'Parameters kept {days} days',
     'connectors.metadataOnly': 'Invocation metadata only',
     'connectors.btnDisablePayloadLog': 'Stop retaining parameters',
@@ -3167,6 +3217,12 @@ const en = {
     'settings.loading': 'Loading settings…',
     'settings.loadFailed': 'Failed to load settings',
     'settings.readOnlyVisitor': 'Read-only access — changing settings requires an authorized link (run botmux dashboard).',
+    'settings.moduleGeneral': 'General',
+    'settings.moduleGeneralHelp': 'Manage access, Feishu cards, experimental capabilities, and task behavior.',
+    'settings.moduleMeeting': 'Meeting Agent',
+    'settings.moduleMeetingHelp': 'Configure meeting listeners, role presets, and official role templates in one place.',
+    'settings.moduleSystem': 'System & Maintenance',
+    'settings.moduleSystemHelp': 'Manage automatic updates, restarts, and runtime versions.',
     'settings.sectionAccess': 'Access',
     'settings.publicReadOnly': 'Allow tokenless read-only dashboard access',
     'settings.publicReadOnlyHelp': 'Allows tokenless access only to explicitly allowlisted read-only data. Workflow details, raw logs, and all write actions always require a token.',
@@ -3246,6 +3302,20 @@ const en = {
     'settings.vcProfiles.migrationEnable': 'Upgrade and enable full-capability minutes (save to apply)',
     'settings.vcProfiles.noEligibleDefaultAgent': 'A default role cannot be generated yet. Configure a default working directory for at least one role execution Bot whose CLI supports reliable turn receipts.',
     'settings.vcProfiles.legacyCatalog': 'A legacy or partial meeting-Agent policy was found. Saving role presets switches it to multi-role mode.',
+    'settings.vcProfiles.templates.title': 'Role template library',
+    'settings.vcProfiles.templates.builtinBadge': 'Built in',
+    'settings.vcProfiles.templates.help': 'Start with a template, then customize its Agent, responsibilities, filters, and output. Applying a template creates an editable copy with no ongoing link to the source.',
+    'settings.vcProfiles.templates.use': 'Use template',
+    'settings.vcProfiles.list.title': 'My presets',
+    'settings.vcProfiles.list.help': 'Meeting roles you maintain. Open a card to view or edit it; mark it as default to enable it when the Feishu selection card is not used.',
+    'settings.vcProfiles.list.empty': 'No role presets yet. Create a blank preset or start from an official template below.',
+    'settings.vcProfiles.setDefault': 'Use by default',
+    'settings.vcProfiles.viewDetails': 'View details',
+    'settings.vcProfiles.newBadge': 'Unsaved',
+    'settings.vcProfiles.untitled': 'Untitled preset',
+    'settings.vcProfiles.noInstructions': 'No responsibility prompt yet',
+    'settings.vcProfiles.close': 'Close',
+    'settings.vcProfiles.done': 'Done editing',
     'settings.vcProfiles.needAuth': 'Meeting role presets require authorized access to edit.',
     'settings.vcProfiles.discardConfirm': 'You have unsaved changes; switching will discard them. Continue?',
     'settings.vcProfiles.loading': 'Loading…',
@@ -3270,6 +3340,11 @@ const en = {
     'settings.vcProfiles.responseModeHelp': 'Silent: analyzes in the background without auto-posting; if the permission template allows, it may still request in-meeting output, and it replies when explicitly asked.\nReply in listener chat: auto-posts results to the meeting thread; at most one role per meeting may auto-post.',
     'settings.vcProfiles.responseSilent': 'Silent (no automatic replies)',
     'settings.vcProfiles.responseListener': 'Reply in listener chat',
+    'settings.vcProfiles.fieldListenerPlacement': 'Chat placement',
+    'settings.vcProfiles.listenerPlacementHelp': 'Controls only how automatic output is placed in the listener chat; it does not change silent/automatic-output authority. Auto preserves historical routing, Chat always posts at the chat top level, and Topic uses the first output as a stable topic root for later replies.',
+    'settings.vcProfiles.listenerPlacement.auto': 'Follow chat mode',
+    'settings.vcProfiles.listenerPlacement.chat': 'Post to chat',
+    'settings.vcProfiles.listenerPlacement.topic': 'Keep in meeting topic',
     'settings.vcProfiles.fieldPreset': 'Permission template',
     'settings.vcProfiles.presetHelp': 'Analyze only: read-only meeting access.\nText/voice speaking: may request that in-meeting output — still gated by daemon permissions and approval, never sent directly; each output kind has a single owner per meeting.\nCustom: only reuses the saved policy of this ID; new permissions cannot be crafted from the browser.',
     'settings.vcProfiles.preset.observe_only': 'Analyze only',
@@ -3309,6 +3384,14 @@ const en = {
     'settings.sectionWhiteboard': 'Local Whiteboard',
     'settings.whiteboardEnable': 'Enable project whiteboards',
     'settings.whiteboardEnableHelp': 'Off by default. Enables whiteboard support. Nothing is created until a chat and project first need it.',
+    'settings.sectionGroupCreation': 'Group Creation',
+    'settings.groupNamePrefix': 'Default /group name prefix',
+    'settings.groupNamePrefixHelp': 'Applies only to the Feishu /group slash command and its /g alias. Other creation paths are unchanged. Clear and save to disable; cross-process updates take up to about 2 seconds.',
+    'settings.groupNamePrefixPlaceholder': 'For example: AI Discussion · ',
+    'settings.groupNamePrefixPreview': 'Preview: {name}',
+    'settings.groupNamePrefixPreviewName': 'Example group',
+    'settings.groupNamePrefixDisabled': 'No prefix is configured; /group keeps the requested name.',
+    'settings.groupNamePrefixSave': 'Save prefix',
     'settings.saving': 'Saving…',
     'settings.saved': 'Saved',
     'settings.saveFailed': 'Save failed',
@@ -3629,8 +3712,21 @@ const en = {
     'botDefaults.sandboxToggle': 'Enable file sandbox',
     'botDefaults.sandboxHelp': "When on, every session of this bot runs in a sandbox: the agent works normally inside the project dir, but cannot touch your real files, secrets, or other sessions outside it — writes outside the project are isolated/blocked. For sharing the bot with semi-trusted users (oncall). Linux uses bwrap, macOS uses Seatbelt; same protection on both. Applies to the next new session.",
     'botDefaults.sandboxSaved': 'Saved (applies to the next new session)',
-    'botDefaults.sandboxReadIsoOn': "Read isolation: this bot's sandboxed sessions also can't read other bots' credentials (bots.json), sessions, or chat content (macOS · Linux, claude/codex).",
-    'botDefaults.sandboxReadIsoOff': "This bot's sandbox is write-protection only; the extra cross-bot read isolation needs claude-code / codex on macOS/Linux (and no wrapper gateway).",
+    'botDefaults.sandboxReadIsoOn': "Enhanced CLI data isolation: this bot's CLI credentials, configuration, and session data are redirected to a private directory, separate from other bots (claude-code / codex, with no wrapper gateway).",
+    'botDefaults.sandboxReadIsoOff': "The base file sandbox still provides deny-by-default read/write isolation; this CLI or wrapper configuration cannot redirect the global CLI data directory into this bot's private directory.",
+    'botDefaults.sectionSandboxPaths': 'Sandbox directory whitelist',
+    'botDefaults.sbxPathsHelp': 'Deny-by-default: nothing is visible unless explicitly allowed below. Each directory cycles through three states: inherit from parent → read-write → read-only → deny. Longest-prefix wins, nestable to any depth (carve a deny hole inside a writable dir, then re-open a writable window inside that hole). Applies to the next new session.',
+    'botDefaults.sbxPathsSaved': 'Saved (applies to the next new session)',
+    'botDefaults.sbxPathsSave': 'Save policy',
+    'botDefaults.sbxPathsTextMode': 'Text mode (copy / share)',
+    'botDefaults.sbxPathsTreeMode': 'Back to tree',
+    'botDefaults.sbxRw': 'read-write',
+    'botDefaults.sbxRo': 'read-only',
+    'botDefaults.sbxDeny': 'deny',
+    'botDefaults.sbxNone': 'hidden',
+    'botDefaults.sbxInherit': 'inherit',
+    'botDefaults.sbxNoSubdirs': '(no subdirectories)',
+    'botDefaults.sbxTestPlaceholder': 'Test a path for its effective access, e.g. ~/my-data/secrets/x',
     'botDefaults.readIsolationToggle': 'Enable read isolation (macOS)',
     'botDefaults.readIsolationHelp': "When on, this bot's sessions run in a macOS sandbox (Seatbelt): reads of other bots' credentials (bots.json), sessions, and chat content are denied, while its own messages and uploaded files/whiteboards stay accessible. The macOS counterpart of the file sandbox above. Applies to the next new session.",
     'botDefaults.readIsolationSaved': 'Saved (applies to the next new session)',
@@ -3781,11 +3877,23 @@ const en = {
     'botDefaults.maxLiveWorkersInvalid': 'Limit must be a positive integer',
     'botDefaults.maxLiveWorkersStateDefault': 'Current: 30 resident sessions by default',
     'botDefaults.maxLiveWorkersStateOn': 'Current: up to {count} resident sessions',
+    'botDefaults.overloadAlert': 'Host overload alert',
+    'botDefaults.overloadAlertHelp': "When on, this bot's daemon checks host load/memory every 30s and DMs this bot's admin when the machine crosses into an overloaded state (default: load15 > cpu×1.5 or memory ≥92%), plus one more DM on recovery. An overloaded host makes botmux session cold-starts time out and false-die, so this heads-up lets you clear sessions or lower the resident cap in time. Load is machine-wide, so enabling one bot is enough; if several are on, alerts are de-duped so the machine only notifies once per overload episode. Off by default.",
     'botDefaults.sectionRuntimeEnv': 'Startup environment',
     'botDefaults.sectionStartupCommands': 'Startup commands',
     'botDefaults.startupCommandsHelp': 'CLI commands sent automatically after launch and before the first message. Use commas or new lines; replayed on every new or resumed session. Native CLI sessions only.',
     'botDefaults.startupCommandsPlaceholder': 'One per line, e.g. /effort ultracode',
     'botDefaults.startupCommandsSave': 'Save startup commands',
+    'botDefaults.sectionSlashCommands': 'Slash command permissions',
+    'botDefaults.sectionSlashCommandsHelp': 'Control which slash commands pass through to the underlying CLI, and which daemon commands are allowed for people who can talk. Changes take effect immediately.',
+    'botDefaults.customPassthrough': 'Extra passthrough commands',
+    'botDefaults.customPassthroughHelp': 'Beyond the built-in allowlist, additionally forward these slash commands to the underlying CLI (daemon does not handle them — relayed verbatim). Comma or space separated, e.g. /goal /export. Entries that collide with a daemon command are ignored. Empty = built-in allowlist only.',
+    'botDefaults.customPassthroughPlaceholder': 'e.g. /goal /export',
+    'botDefaults.customPassthroughSave': 'Save passthrough commands',
+    'botDefaults.canTalkDaemon': 'canTalk-allowed daemon commands',
+    'botDefaults.canTalkDaemonHelp': 'Lower the listed daemon commands from canOperate (admins only) to canTalk (anyone allowed to talk — oncall members, grantees, DM users). Comma or space separated; daemon commands only (passthrough/typo entries ignored). ⚠️ /cd /restart /rename etc. change state — lower with care; prefer low-risk commands like /status /help. Empty = all admins-only.',
+    'botDefaults.canTalkDaemonPlaceholder': 'e.g. /status /help',
+    'botDefaults.canTalkDaemonSave': 'Save canTalk list',
     'botDefaults.sectionLaunchShell': 'Launch shell',
     'botDefaults.launchShellHelp': 'Shell used to launch the CLI, such as zsh or /usr/bin/zsh, overriding the daemon $SHELL. Use it to avoid login-shell rc redirection issues; PATH must still be available in that shell. Applies next session.',
     'botDefaults.launchShellPlaceholder': 'e.g. zsh or /usr/bin/zsh; empty = $SHELL',