ysk-server-shared 1.0.0 → 1.1.9

package/locales/en/security.json

@@ -9,8 +9,12 @@
   "pillReady": "Ready",
   "pill2faOff": "2FA off",
   "stat2fa": "2FA",
-  "statApi": "API",
+  "statApi": "API keys",
+  "statApiSessions": "API sessions",
+  "revokeOtherTitle": "Sign out {{n}} other session(s)",
   "statSsh": "SSH",
+  "statSshValue": "{{keys}} keys · {{auth}} authorized",
+  "statSshHint": "Outbound identities / authorized login keys",
   "statPending": "Pending",
   "on": "On",
   "off": "Off",
@@ -19,7 +23,7 @@
   "tabApiKeys": "API keys",
   "tabSsh": "SSH",
   "tabApprovals": "Approvals",
-  "tabAllowlist": "Allowlist",
+  "tabAllowlist": "Agent tools",
   "apiTokenOnce": "API token (shown once):",
   "copiedToken": "Token copied",
   "totpTitle": "Two-factor (TOTP)",
@@ -57,6 +61,8 @@
   "reauthPassword": "Re-enter password",
   "reauthPasswordHint": "Start/reset 2FA requires password again (stolen session protection)",
   "reauthPasswordRequired": "Enter your login password first",
+  "needCurrentPassword": "Enter the current password first",
+  "passwordMin8": "New password must be at least 8 characters",
   "totpSecretGenerated": "Secret ready — scan the QR or copy the key, then enter the app’s 6-digit code",
   "reset2fa": "Reset 2FA",
   "start2fa": "Set up 2FA",
@@ -103,8 +109,9 @@
   "revokeAllDevices": "Revoke all devices",
   "revokedAllDevices": "All trusted devices revoked",
   "export2faBackup": "Export 2FA encrypted backup",
-  "fail2banSnippetMsg": "Fail2ban snippets: {{written}} — {{notes}}",
-  "generateFail2ban": "Generate Fail2ban snippets",
+  "fail2banSnippetMsg": "fail2ban snippets: {{written}} — {{notes}}",
+  "generatefail2ban": "Generate fail2ban snippets",
+  "generateFail2ban": "Generate fail2ban snippets",
   "adminPolicyTitle": "Admin 2FA policy",
   "adminPolicyDesc": "",
   "requireAdmin2fa": "Require admin 2FA",
@@ -124,8 +131,9 @@
   "apiKeysEmpty": "No API keys yet",
   "apiKeysEmptyHint": "Create from the toolbar; then call API with Bearer token",
   "approve": "Approve",
-  "allowlistTitle": "Allowlist ({{count}})",
-  "allowlistEmpty": "No allowlist tools",
+  "allowlistTitle": "Agent tools ({{count}})",
+  "allowlistEmpty": "No agent tools in the catalog",
+  "totpStatusLoadFailed": "Could not load 2FA status",
   "createApiKeyTitle": "Create API key",
   "createApiKeyDesc": "Full token is shown only once after create",
   "createKeyBtn": "Create key",
@@ -199,7 +207,9 @@
     "commentOptional": "Comment (optional)",
     "commentPlaceholder": "laptop / CI",
     "loginNeedProject": "Create a project first. Binding works best when the system user is ready.",
-    "loginNeedPub": "Select a project and paste a public key starting with ssh-",
+    "loginNeedPub": "Select a project or Linux user, and paste a public key starting with ssh-",
+    "loginNoProjects": "No projects. Authorize an existing Linux user (root / tester) below. Writing /root/.ssh needs YSK_EXECUTE=1.",
+    "loginLinuxHint": "Used when no project. Example: root or tester.",
     "loginAdded": "Added",
     "sshdTitle": "Project user SFTP (sshd)",
     "sshdDesc": "Let ysks_* / ysk_* project users SFTP with public keys",
@@ -323,6 +333,14 @@
     "ssh2faStep3": "Write home file",
     "ssh2faStep4": "Install PAM module and merge snippets (below)",
     "pkgLabel": "Package {{name}}",
+    "pkgStatus": "Package {{status}}",
+    "pamStatus": "PAM {{status}}",
+    "kbdStatus": "sshd keyboard-interactive {{status}}",
+    "light": {
+      "green": "ok",
+      "yellow": "check",
+      "red": "missing"
+    },
     "enrollForUser": "Enroll SSH 2FA for user",
     "ssh2faEmpty": "No Linux user has SSH 2FA yet",
     "ssh2faEmptyHint": "Prefer key login first;",
@@ -367,7 +385,13 @@
     "sharePanelTitle": "Share panel TOTP secret?",
     "sharePanelDesc": "High risk. Type SHARED to confirm.",
     "confirmString": "Confirmation string",
-    "enableShare": "Enable sharing"
+    "enableShare": "Enable sharing",
+    "invalidPub": "Paste a full OpenSSH public key line (ssh-ed25519 / ssh-rsa / ecdsa…).",
+    "dryRunOk": "Dry-run finished. Review the preview below.",
+    "strictDryRun": "Strict preview (dry-run)",
+    "errorNoDetail": "Test failed (no details)",
+    "strictBlocked": "Package or PAM is not ready; Strict apply is disabled.",
+    "privCloseWithoutAck": "Closed. The private key will not be shown again; generate a new one if you did not save it."
   },
   "sessionsActive": "Active sessions",
   "sessionsOther": "Other devices",
@@ -390,5 +414,42 @@
   "revokeOthersDesc": "This will end {{count}} other session(s). Your current browser stays signed in.",
   "sessionRevoked": "Session signed out",
   "mySecurityHint": "",
-  "policyTotpHint": "Site policy: each admin must enable their own 2FA (individual QR)"
+  "policyTotpHint": "Site policy: each admin must enable their own 2FA (individual QR)",
+  "requireUser2fa": "Require 2FA for all panel users",
+  "changePasswordTitle": "Change sign-in password",
+  "currentPassword": "Current password",
+  "newPassword": "New password",
+  "confirmNewPassword": "Confirm new password",
+  "passwordMismatch": "New passwords do not match.",
+  "changePassword": "Change password",
+  "passwordChanged": "Password updated.",
+  "strictNeedsEnrolled": "Enable 2FA on this admin account before turning on Strict.",
+  "policyTotpNeedSelf": "Enable 2FA on this account first; the confirm code cannot be filled otherwise.",
+  "policyNoTotpHint": "This account has no 2FA yet. Turn on 2FA above before requiring it for admins or all users — otherwise you can lock everyone out.",
+  "policyNeedSelf2fa": "Enable 2FA on this account first, then confirm with a TOTP code",
+  "revokeAllDevicesTitle": "Revoke every remembered device — you and other admins must verify 2FA again",
+  "sessionCli": "CLI",
+  "sessionApi": "API",
+  "fail2banSnippetTitle": "fail2ban snippet",
+  "fail2banSnippetEmpty": "No snippet was written.",
+  "trustedDevicesTitle": "Trusted devices",
+  "noTrustedDevices": "No trusted devices.",
+  "strictConfirmTitle": "Turn on Strict 2FA?",
+  "strictConfirmDesc": "Users without 2FA will be refused sign-in. Confirm you already have a working TOTP or passkey.",
+  "revokeDevicesTitle": "Revoke trusted devices?",
+  "revokeDevicesDesc": "Remembered browsers will need 2FA again.",
+  "approvalsHint": "Approvals appear when a high-risk tool needs a second operator. Grant Review approvals and Handle approvals on Users → Permissions.",
+  "allowlistReadonly": "Read-only catalog of agent tools. Capability grants are configured on Users → Permissions.",
+  "colTool": "Tool",
+  "colAllowed": "Allowed",
+  "colRisk": "Risk",
+  "colApproval": "Approval",
+  "risk": {
+    "low": "Low",
+    "medium": "Medium",
+    "high": "High",
+    "critical": "Critical"
+  },
+  "confirmDeleteApiKey": "Delete this API key?",
+  "confirmDeleteApiKeyDesc": "“{{name}}” will stop authenticating. This cannot be undone."
 }

package/locales/en/serviceExposure.json

@@ -7,11 +7,22 @@
   "modePrivate": "Local only",
   "modePublic": "Public",
   "modeRestricted": "Restricted",
+  "modeUndecided": "Not set",
+  "modePublicLive": "Public (live bind)",
+  "summaryPublicLive": "Listening on {{bind}} — reachable on all interfaces. Confirm access mode; this is not private.",
+  "modeLoading": "Loading",
   "summaryPrivate": "Not open on the public firewall.",
   "summaryPublic": "Open · {{ports}}",
+  "summaryUndecided": "Access mode not confirmed (catalog default: {{suggested}}).",
+  "summaryNotEnforced": "Firewall is off — the panel is not opening or blocking these ports.",
+  "roleSmtp": "SMTP submission",
+  "roleImap": "IMAP / POP3 mailbox",
   "summaryRestricted": "Restricted · {{count}} source(s)",
   "summaryFirewallOff": "Host firewall: {{detail}} — rules not enforced until UFW is active.",
+  "summaryFirewallOffOnly": "Host firewall is not enabled, so port rules are not enforced.",
   "outOfSync": "Out of sync",
+  "openButStopped": "Ports open — service not running",
+  "openNoTenants": "Public ports with no tenants",
   "firewallOff": "Firewall off",
   "ufwMissing": "UFW not installed",
   "ufwInactive": "inactive",
@@ -27,5 +38,6 @@
   "restrictedNeedSource": "Add at least one IP/CIDR or country code for restricted mode.",
   "privateStartTitle": "Expose {{service}} on the network?",
   "confirmAndStart": "Confirm and start",
-  "cloudSgNote": "Host firewall only — cloud security groups (AWS/GCP/Azure) are not changed."
+  "cloudSgNote": "Host firewall only — cloud security groups (AWS/GCP/Azure) are not changed.",
+  "serviceNotInstalled": "This service is not installed, so firewall rules do not apply."
 }

package/locales/en/services.json

@@ -1,13 +1,78 @@
 {
   "enabledBoot": "On boot",
+  "unitNotFound": "Not installed",
+  "bootNa": "Not applicable",
+  "unitNa": "Not applicable",
+  "permLabel": "Permission",
+  "permCanChange": "Can change the system (superuser)",
+  "permBlocked": "Cannot change the system",
+  "permHint": "System change {{exec}} · Superuser {{root}}",
+  "clusterLegend": "Planned = saved in the panel, not applied on the host.",
+  "active": {
+    "active": "Running",
+    "inactive": "Stopped",
+    "not-found": "Not installed",
+    "failed": "Failed",
+    "tool": "Tool",
+    "activating": "Starting"
+  },
+  "unitStatic": "static",
+  "unitIndirect": "indirect",
   "action": {
     "start": "Start",
     "stop": "Stop",
     "restart": "Restart",
-    "reload": "Reload"
+    "reload": "Reload",
+    "enable": "Enable on boot",
+    "disable": "Disable on boot"
   },
+  "enabledOk": "{{label}} enabled on boot",
+  "bootDisabledWarn": "{{label}} is running but will not start at boot. Enable it to persist across reboot.",
+  "bootDisabledShort": "Not on boot",
+  "sshdBootOffWarn": "sshd is not enabled on boot. After reboot this host will have no SSH rescue path.",
+  "mariadbNotInstalled": "MariaDB is not installed",
+  "mariadbNotInstalledMysqlOk": "Not installed: MariaDB (MySQL is installed)",
+  "lifecycleTitle": "{{label}} service control",
+  "startedOk": "{{label}} started",
+  "stoppedOk": "{{label}} stopped",
+  "needRunning": "{{label}} is not running",
+  "restartedOk": "{{label}} restarted",
+  "reloadedOk": "{{label}} reloaded",
+  "reloadTitle": "Reload {{label}} configuration without a full restart",
+  "stopNeedConfirm": "Needs confirmation",
+  "stopNeedConfirmPhrase": "Needs confirmation phrase",
+  "stopNeedConfirmImpact": "Stop {{label}}? Active connections to this service will drop.",
+  "stopConfirmTitle": "Stop {{label}}?",
+  "stopConfirmDesc": "{{label}} will stop listening. Start it again from this page when needed.",
+  "stopConfirmEdgeDesc": "Stopping {{label}} takes sites and reverse-proxy traffic offline until it is started again.",
+  "stopConfirmEdgeConsequence": "HTTP/HTTPS on this host will not be served while {{label}} is stopped.",
+  "stopConfirmSshdTitle": "Stop sshd?",
+  "stopConfirmSshdDesc": "Stopping sshd closes remote SSH. Confirm you still have a console or another login path.",
+  "stopConfirmSshdToken": "stop sshd",
+  "stopConfirmSshdConsequence": "New SSH sessions will fail until sshd is started from the host console.",
+  "stopConfirmPanelTitle": "Stop YSK Server?",
+  "stopConfirmPanelDesc": "The panel and API will go offline until the unit is started on the host.",
+  "stopConfirmPanelSshdOffDesc": "The panel and API will go offline. sshd is not enabled on boot, so SSH may not be a rescue path after reboot.",
+  "stopConfirmPanelSshdOffConsequence": "sshd is not enabled on boot. After reboot you may have no SSH rescue path.",
+  "ufwNoLifecycle": "UFW is not started or stopped from this matrix.",
+  "restartConfirmPanelTitle": "Restart YSK Server?",
+  "restartConfirmPanelDesc": "The panel and API will drop briefly while the unit restarts.",
+  "restartConfirmTitle": "Restart {{label}}?",
+  "restartConfirmDesc": "Restart {{label}} now. Active connections may drop.",
+  "startVerifyFailed": "{{label}} start did not stay healthy.",
+  "stopConfirmPanelToken": "stop ysk-server",
+  "stopConfirmPanelConsequence": "This browser session will disconnect. Start the unit from SSH or the host console.",
+  "stopConfirmFail2banTitle": "Stop fail2ban?",
+  "stopConfirmFail2banDesc": "Stopping fail2ban turns off automatic IP bans. Websites and SSH keep running.",
+  "stopConfirmFail2banConsequence": "New attackers are not banned until fail2ban is started again.",
   "actionDone": "{{action}} done",
   "runningOf": "{{running}}/{{total}} running",
+  "statusFilter": {
+    "all": "All states",
+    "running": "Running",
+    "failed": "Failed",
+    "missing": "Not installed"
+  },
   "canMutate": "Mutable",
   "locked": "Locked",
   "controlUnit": "Control-plane unit",
@@ -21,7 +86,7 @@
   "matrixTab": "Service matrix ({{count}})",
   "stackTab": "Software stack",
   "stackTitle": "Host software stack",
-  "stackHint": "Install or remove host components by plan; SQL server engines are exclusive.",
+  "stackHint": "Software plans install OS packages. The service matrix tab lists systemd units — the two counts are not the same set.",
   "protectionTab": "Protection probe",
   "knownServices": "Known services",
   "showing": "Showing {{shown}} / {{total}}",
@@ -31,6 +96,7 @@
   "bootPrefix": "Boot {{state}}",
   "controlPage": "Control page",
   "manageRuntime": "Install / update",
+  "installOrOpen": "Install / open",
   "protectionTitle": "Protection probe",
   "protectionSub": "Read-only; does not change firewall / fail2ban",
   "protectionDoneNote": "Protection probe finished",

package/locales/en/software.json

@@ -87,7 +87,8 @@
     "pick": "Pick version",
     "noTarget": "No update target",
     "needRuntimePage": "Install this version on the runtime page",
-    "noAptCandidate": "No apt candidate version"
+    "noAptCandidate": "No apt candidate version",
+    "sourceLabel": "Source"
   },
   "install": {
     "progress": "Installing: {{list}}…",

package/locales/en/softwareLifecycle.json

@@ -48,6 +48,8 @@
     "vnc": "VNC services will stop",
     "controlPlane": "Control plane runtime (protected)",
     "generic": "Related services may stop",
+    "containers": "Running containers will stop",
+    "validators": "Validator node stacks that use Docker Compose will stop",
     "purgeData": "Data paths will be deleted",
     "protectedSkipped": "Protected components are skipped",
     "runtimeStack": "All panel-managed versions of this runtime will be removed"
@@ -57,5 +59,13 @@
   "dockCancelling": "Cancelling · {{title}}",
   "dockCancelled": "Cancelled · {{title}}",
   "cancelHint": "Cancel requested. The client stopped listening; the host may finish the current apt/step. Re-probe status after a moment.",
-  "cancelledToast": "Operation cancelled (client stopped streaming)"
+  "cancelledToast": "Operation cancelled (client stopped streaming)",
+  "kindApply": "Apply",
+  "kindScan": "Scan",
+  "kindDeploy": "Deploy",
+  "kindRuntime": "Runtime",
+  "jobDone": "Finished · {{title}}",
+  "jobFailed": "Failed · {{title}}",
+  "uninstallUfwWarn": "Removing UFW leaves this host without its panel-managed port firewall.",
+  "uninstallFail2banWarn": "Removing fail2ban stops jails and releases current bans. Add your login IP to ignoreip first if you keep it."
 }

package/locales/en/ssl.json

@@ -16,6 +16,8 @@
   },
   "pillCount": "{{count}} cert(s)",
   "statCerts": "Certificates",
+  "panelCertHint": "Panel HTTPS uses {{path}} (expires {{exp}}). It is not listed as a site certificate.",
+  "openPanelTls": "Open panel HTTPS",
   "statWithFiles": "With files",
   "statBindings": "Bindings",
   "statFailed": "Failed",
@@ -71,6 +73,9 @@
   "filesYes": "Yes",
   "filesNo": "No",
   "colExpires": "Expires",
+  "renew": "Renew",
+  "renewFor": "Renew {{domain}}",
+  "deleteDomain": "Delete {{domain}}",
   "colStatus": "Status",
   "emptyTitle": "No certificates yet",
   "emptyDesc": "Use “Upload certificate” or “Request Let’s Encrypt” above",
@@ -93,11 +98,17 @@
   "leHttp01Hint": "Normal domains use http-01 (nginx plugin)",
   "deleteTitle": "Delete certificate?",
   "deleteDesc": "Removes cert files and registration for {{domain}}.",
+  "deleteNeedDomain": "Delete this certificate — type the domain name to confirm",
   "savedCert": "Saved certificate for {{domain}}",
   "uploadFailed": "Upload failed",
   "requestBlocked": "Cannot complete certificate request in the admin panel",
   "requestDone": "Certificate request completed",
   "requestFailed": "Certificate request did not succeed",
   "applyFailed": "Request failed",
-  "deletedCert": "Deleted {{domain}}"
+  "deletedCert": "Deleted {{domain}}",
+  "uninstallCertbotWarn": "Removing certbot stops automatic renewal of existing Let's Encrypt certificates.",
+  "uninstallCertbot": "Uninstall certbot (loses auto-renew)",
+  "domainRequired": "Please enter a domain.",
+  "domainInvalid": "Domain format is not valid.",
+  "domainKnownHint": "Pick a known project, DNS, or mail domain, or type a custom name."
 }

package/locales/en/stackWizard.json

@@ -1,6 +1,10 @@
 {
   "purgeConfirm": "Confirm purge? Registered data paths (databases/mail) will be deleted permanently.",
-  "installedCount": "Installed {{installed}} · Missing {{missing}}",
+  "installedCount": "Packages installed {{installed}} · missing {{missing}}",
+  "countHint": "These counts are OS packages in the software plan — not the service-matrix units on the other tab.",
+  "executeRoot": "System changes {{execute}} · administrator {{root}}",
+  "manifestPlan": "Plan {{plan}} ({{bundles}})",
+  "manifestHint": "Last chosen software plan and bundles",
   "needRootExecute": "Live install/remove needs administrator rights and system-change permission. You can still dry-run.",
   "modeInstall": "Install plan",
   "modeUninstall": "Uninstall",
@@ -15,5 +19,8 @@
   "dataPolicy": "Data policy",
   "keepData": "Keep data",
   "purgeData": "Purge data",
-  "uninstallNow": "Uninstall now"
+  "uninstallNow": "Uninstall now",
+  "uninstallNeedSelect": "Select at least one bundle. Empty selection no longer means remove all.",
+  "uninstallConfirmTitle": "Remove selected bundles?",
+  "uninstallConfirmDesc": "{{count}} bundle(s) will be removed. Type REMOVE to confirm."
 }

package/locales/en/support.json

@@ -24,5 +24,21 @@
   "cryptoNetwork": "Network",
   "cryptoAddress": "Address",
   "copy": "Copy",
-  "copied": "Copied"
+  "copied": "Copied",
+  "copyTitle": "Copy {{address}}",
+  "docsLink": "Documentation",
+  "diagTitle": "Diagnostic summary",
+  "diagBody": "Copy version, system-change, superuser, and host facts to paste into an email. This is not a full log bundle.",
+  "diagCopy": "Copy diagnostic summary",
+  "diagCopied": "Diagnostic summary copied",
+  "diagCopyTitle": "Copy version, system-change, and host facts",
+  "diagPreview": "Preview what will be copied",
+  "diagLoading": "Loading diagnostic…",
+  "diagLoadFailed": "Could not load diagnostic",
+  "copiedAddr": "Copied {{addr}}",
+  "diagStatus": "Status",
+  "diagMode": "Mode",
+  "diagProtection": "Protection",
+  "diagHostname": "Hostname",
+  "diagOs": "OS"
 }

package/locales/en/system.json

@@ -27,8 +27,11 @@
   "optional": "Optional",
   "prettyPh": "Friendly display name",
   "timezone": "Timezone",
-  "timezoneHint": "Choose an IANA timezone from the list (e.g. Asia/Hong_Kong)",
+  "timezoneHint": "IANA zone from timedatectl (e.g. Asia/Hong_Kong). This is the host clock — cron and vsftpd local time follow it. Stored timestamps stay UTC.",
+  "timezoneNow": "Host time now: {{time}} ({{tz}})",
+  "timezoneBrowserDiff": "This host uses {{host}}; your browser uses {{browser}}. Changing timezone here changes the host clock, not the browser.",
   "timezoneSelect": "Select timezone",
+  "notExported": "Not exported yet",
   "dns": "DNS",
   "updated": "Updated",
   "applyIdentity": "Apply identity",
@@ -39,9 +42,9 @@
   "panelSsl": "Panel SSL",
   "panelTls": {
     "title": "Panel HTTPS",
-    "sub": "Control plane (ysk-server) serves TLS on listenPort; WebAuthn/Passkeys need HTTPS",
+    "sub": "Control plane (ysk-server) serves TLS on the configured port; WebAuthn/Passkeys need HTTPS",
     "domain": "Panel domain",
-    "domainHint": "Used for certificate issue/bind, e.g. demo.ysk.hk",
+    "domainHint": "Used for certificate issue/bind, e.g. {{host}}",
     "email": "Let’s Encrypt email",
     "status": "Status",
     "enabled": "TLS enabled in config",
@@ -53,7 +56,9 @@
     "issueEnable": "Issue cert & enable HTTPS",
     "enableExisting": "Enable with existing cert",
     "disable": "Disable panel HTTPS",
+    "disableNeedConfirm": "Needs confirmation — type DISABLE-HTTPS",
     "needDomain": "Enter hostname / domain first",
+    "needFqdn": "Need a FQDN (example.com), not a bare hostname",
     "urlHint": "After restart open {{url}}",
     "certMissing": "TLS enabled but cert/key files missing",
     "restartToApply": "Restart ysk-server to apply HTTPS",
@@ -77,7 +82,16 @@
     "leOk": "Let’s Encrypt certificate obtained for {{domain}}",
     "leFailed": "Certificate request failed: {{detail}}",
     "leHint": "Ensure DNS A points here and port 80 is reachable (or nginx serves the domain)",
-    "openFirewall": "If public: allow panel port {{port}}/tcp (Firewall → open port → 9287 Panel)"
+    "openFirewall": "If public: allow panel port {{port}}/tcp (Firewall → open port → 9287 Panel)",
+    "disableConfirmTitle": "Disable panel HTTPS?",
+    "disableConfirmDesc": "The panel will serve HTTP. WebAuthn / Passkey will stop working until HTTPS is on again.",
+    "disablePasskeyWarn": "Registered passkeys need HTTPS — they will fail on HTTP.",
+    "listenPublic": "Panel is listening on a public address (0.0.0.0/::). Restrict with a firewall or bind to 127.0.0.1.",
+    "bootstrapCert": "This is the self-signed bootstrap certificate — browsers will warn. Issue a trusted certificate for the panel domain.",
+    "cliNoSocket": "CLI has no live HTTP socket; servingHttps is inferred from config and listen sockets (ss).",
+    "listenHost": "Listen address",
+    "currentHost": "This session",
+    "replaceCert": "Replace with a trusted certificate"
   },
   "timeNtp": "Time & NTP",
   "clockStatus": "System clock status",
@@ -119,6 +133,9 @@
   "powerTitle": "Power (danger zone)",
   "powerWarn": "Reboot/poweroff interrupts all services and the panel. The panel cannot power the host on — needs physical access or hypervisor.",
   "unlocked": "Unlocked",
+  "powerUnlock": "Unlock danger zone",
+  "powerLock": "Lock danger zone",
+  "noScheduledPower": "No reboot or poweroff is scheduled",
   "powerCaps": "Needs YSK_EXECUTE=1 and root. Now EXECUTE={{exec}}, root={{root}}.",
   "scheduledPower": "Scheduled poweroff/reboot detected",
   "cancelScheduleHint": ". Use “Cancel schedule” to withdraw.",
@@ -160,6 +177,7 @@
   "syncToSystem": "Sync to system",
   "syncSub": "Copy to /etc/nginx/conf.d and reload — needs root + EXECUTE",
   "syncReload": "Sync + reload",
+  "syncReloadNeedConfirm": "Needs confirmation — writes /etc/nginx/conf.d and reloads Nginx",
   "exportOnly": "Export only + list conf",
   "dryRun": "Dry-run",
   "dryRunNote": "Dry-run does not change the system.",
@@ -173,8 +191,8 @@
   "syncConfirmDesc": "Sync managed Nginx conf to /etc/nginx/conf",
   "uptime": "Uptime",
   "load1m": "Load 1m",
-  "executeLabel": "EXECUTE",
-  "rootLabel": "Root",
+  "executeLabel": "System change",
+  "rootLabel": "Superuser",
   "managedLabel": "Managed",
   "managedCount": "Managed",
   "exportsCount": "Exports",
@@ -182,5 +200,16 @@
   "exportPath": "Export path",
   "mode": "Mode",
   "managedConf": "Managed conf",
-  "dryRunFlag": "Dry-run"
+  "dryRunFlag": "Dry-run",
+  "timezoneSearch": "Filter timezones…",
+  "resyncNtp": "Re-sync NTP",
+  "storageSub": "Disk usage",
+  "nginxLeftover": "Leftover",
+  "nginxUnused": "Unused",
+  "nginxLeftoverHint": "Stale public-files or leftover conf. Still included in sync until you remove or replace it.",
+  "nginxUnusedHint": "Stock / catch-all conf (000-default). Still included in sync until you act.",
+  "nginxRemoveLeftover": "Remove leftover",
+  "nginxRemoveLeftoverTitle": "Remove leftover nginx conf?",
+  "nginxRemoveLeftoverDesc": "Deletes {{name}} from the panel inventory. The live /etc/nginx copy is removed only with YSK_EXECUTE + root. 000-default is not leftover and cannot be deleted here.",
+  "needExecuteRoot": "Needs YSK_EXECUTE + root"
 }

package/locales/en/systemd.json

@@ -70,6 +70,8 @@
   "policyNotEqualFull": "Write template ≠ service enabled ≠ listening",
   "controlPlaneUnit": "Control-plane unit",
   "kpiRuntime": "Runtime",
+  "rawStateHint": "Raw unit state in tooltip",
+  "bootHint": "Whether the unit starts at boot",
   "kpiBoot": "Boot enable",
   "kpiCaps": "Apply capability",
   "capsReady": "Can install to system",

package/locales/en/terminal.json

@@ -14,8 +14,12 @@
   "error": "Terminal error",
   "wsError": "WebSocket failed",
   "exitCode": "Exit code {{code}}",
-  "needRootExecute": "Requires root + YSK_EXECUTE=1 for system shells.",
+  "needRootExecute": "System shells need superuser and system-change permission.",
+  "groupSystem": "System",
+  "groupProject": "Project",
   "unavailable": "unavailable",
+  "copyAll": "Copy all",
+  "copyAllNeedConn": "Connect first — the buffer is empty while disconnected",
   "placeholder": "Pick an identity, then Connect",
   "aboutTitle": "About terminal",
   "aboutSub": "Interactive OS shell in the browser (local users). Not an arbitrary remote SSH client.",
@@ -29,5 +33,9 @@
   "stepUpHint": "Root login requires 2FA step-up when your account has TOTP enabled.",
   "stepUpTitle": "Confirm root shell",
   "stepUpDesc": "Enter your authenticator code or a recovery code.",
-  "totpLabel": "TOTP / recovery code"
+  "totpLabel": "TOTP / recovery code",
+  "sessionStillOpen": "A live shell is still connected while you read this page.",
+  "rootConfirmTitle": "Open a root shell?",
+  "rootConfirmDesc": "This session is an unrestricted root PTY on the host. Commands are audited.",
+  "rootConfirmBody": "Only continue if you intend to run privileged host commands."
 }