zigmini 0.9.0-beta.3 → 1.0.0-beta.1

package/web/memo.js

@@ -1,3 +1,8 @@
+import { registerStrings, t } from "./i18n.js";
+import strings from "./i18n/memo.js";
+
+registerStrings(strings);
+
 const STORAGE_KEY = "zgw.memo";
 const MAX_IMAGES = 2;
 const IMAGE_TYPES = new Set(["image/png", "image/jpeg", "image/gif", "image/webp"]);
@@ -35,13 +40,13 @@ export function setupMemo({ uploadImage, reportError }) {
 			link.rel = "noopener";
 			const image = document.createElement("img");
 			image.src = link.href;
-			image.alt = `보관한 이미지 ${index + 1}`;
+			image.alt = t("memo.savedImage", { index: index + 1 });
 			link.append(image);
 			const remove = document.createElement("button");
 			remove.type = "button";
 			remove.className = "text-btn";
-			remove.textContent = "삭제";
-			remove.setAttribute("aria-label", `보관한 이미지 ${index + 1} 삭제`);
+			remove.textContent = t("memo.delete");
+			remove.setAttribute("aria-label", t("memo.deleteImage", { index: index + 1 }));
 			remove.disabled = imageBusy;
 			remove.onclick = () => saveImages(images.filter((_, at) => at !== index));
 			item.append(link, remove);
@@ -83,20 +88,20 @@ export function setupMemo({ uploadImage, reportError }) {
 		pendingText = null;
 		void put({ text: value }, keepalive).catch((error) => {
 			pendingText ??= value;
-			fail("쪽지 저장 실패", error);
+			fail(t("memo.saveFailed"), error);
 		});
 	}
 	async function saveImages(next) {
 		if (imageBusy) return;
 		imageBusy = true;
-		status.textContent = "이미지 저장 중";
+		status.textContent = t("memo.savingImage");
 		renderImages();
 		try {
 			const saved = await put({ images: next });
 			images = saved.images;
 			status.textContent = "";
 		} catch (error) {
-			fail("이미지 저장 실패", error);
+			fail(t("memo.imageSaveFailed"), error);
 		} finally {
 			imageBusy = false;
 			renderImages();
@@ -106,15 +111,15 @@ export function setupMemo({ uploadImage, reportError }) {
 		const files = [...selected];
 		if (imageBusy || files.length === 0) return;
 		if (images.length + files.length > MAX_IMAGES) {
-			status.textContent = "이미지는 두 개까지 보관할 수 있습니다.";
+			status.textContent = t("memo.imageLimit");
 			return;
 		}
 		if (files.some((file) => !IMAGE_TYPES.has(file.type))) {
-			status.textContent = "PNG, JPEG, GIF, WebP 이미지를 선택해 주세요.";
+			status.textContent = t("memo.imageTypes");
 			return;
 		}
 		imageBusy = true;
-		status.textContent = "이미지 업로드 중";
+		status.textContent = t("memo.uploadingImage");
 		renderImages();
 		try {
 			const next = [...images];
@@ -123,7 +128,7 @@ export function setupMemo({ uploadImage, reportError }) {
 			images = saved.images;
 			status.textContent = "";
 		} catch (error) {
-			fail("이미지 보관 실패", error);
+			fail(t("memo.imageStoreFailed"), error);
 		} finally {
 			imageBusy = false;
 			renderImages();
@@ -139,7 +144,7 @@ export function setupMemo({ uploadImage, reportError }) {
 		rememberOpen(value);
 		if (value) {
 			text.focus();
-			void pull().catch((error) => fail("쪽지 불러오기 실패", error));
+			void pull().catch((error) => fail(t("memo.loadFailed"), error));
 		} else flush();
 	}
 
@@ -161,7 +166,7 @@ export function setupMemo({ uploadImage, reportError }) {
 		if (!value.width && legacy.width) Object.assign(patch, { width: legacy.width, height: legacy.height });
 		if (Object.keys(patch).length) { apply(patch); await put(patch); }
 		rememberOpen(Boolean(saved.open));
-	}).catch((error) => fail("쪽지 불러오기 실패", error));
+	}).catch((error) => fail(t("memo.loadFailed"), error));
 	toggle.onclick = () => open(box.hidden);
 	add.onclick = () => picker.click();
 	picker.onchange = () => { void addImages(picker.files); picker.value = ""; };
@@ -201,7 +206,7 @@ export function setupMemo({ uploadImage, reportError }) {
 			handle.removeEventListener("pointermove", move);
 			handle.removeEventListener("pointerup", end);
 			handle.removeEventListener("pointercancel", end);
-			void put({ width: box.offsetWidth, height: box.offsetHeight }).catch((error) => fail("쪽지 크기 저장 실패", error));
+			void put({ width: box.offsetWidth, height: box.offsetHeight }).catch((error) => fail(t("memo.resizeFailed"), error));
 		};
 		handle.addEventListener("pointermove", move);
 		handle.addEventListener("pointerup", end);

package/web/notifications.js

@@ -1,3 +1,8 @@
+import dict from "./i18n/notifications.js";
+import { registerStrings, t } from "./i18n.js";
+
+registerStrings(dict);
+
 export const NOTIFICATION_SETTINGS_PATH = "/api/settings/notifications";
 
 /** Parse gateway data without treating a failed or malformed response as a default. */
@@ -12,17 +17,17 @@ export function createNotificationSettings(fetcher, render) {
 	let mode = "inbox-only";
 	let ready = false;
 	let online = false;
-	let error = "";
+	let errorKey = "";
 	let epoch = 0;
 	let generation = 0;
 	let pending = 0;
 	let tail = Promise.resolve();
-	const view = () => ({ mode, ready, online, busy: pending > 0, error });
+	const view = () => ({ mode, ready, online, busy: pending > 0, error: errorKey ? t(errorKey) : "" });
 	const paint = () => render(view());
 	const confirm = (value) => {
 		mode = value;
 		ready = true;
-		error = "";
+		errorKey = "";
 		paint();
 	};
 
@@ -38,7 +43,7 @@ export function createNotificationSettings(fetcher, render) {
 			if (connection === epoch && request === generation) confirm(value);
 		} catch {
 			if (connection === epoch && request === generation) {
-				error = "알림 설정을 불러오지 못했습니다. 다시 연결하면 재시도합니다.";
+				errorKey = "notifications.error.read";
 				paint();
 			}
 		}
@@ -65,7 +70,7 @@ export function createNotificationSettings(fetcher, render) {
 				else await read(); // A newer event/read may describe another client's write.
 			} catch {
 				if (connection === epoch) {
-					error = "알림 설정을 저장하지 못했습니다. 확인된 설정을 유지합니다.";
+					errorKey = "notifications.error.save";
 					paint();
 				}
 			} finally {
@@ -86,7 +91,7 @@ export function createNotificationSettings(fetcher, render) {
 			generation += 1;
 			online = true;
 			ready = false;
-			error = "";
+			errorKey = "";
 			paint();
 			return read();
 		},
@@ -110,7 +115,7 @@ export function setupNotificationSettings({ choice, status }, fetcher = fetch) {
 	const controller = createNotificationSettings(fetcher, (view) => {
 		choice.value = view.mode;
 		choice.disabled = !view.online || !view.ready || view.busy;
-		status.textContent = view.error || (view.busy ? "저장 중…" : !view.online ? "게이트웨이 연결을 기다립니다." : !view.ready ? "알림 설정 확인 중…" : "");
+		status.textContent = view.error || (view.busy ? t("notifications.saving") : !view.online ? t("notifications.waiting") : !view.ready ? t("notifications.checking") : "");
 		status.classList.toggle("error", Boolean(view.error));
 	});
 	choice.onchange = () => controller.set(choice.value);

package/web/profile.js

@@ -1,18 +1,45 @@
-// The user's profile nickname: shown in the sidebar profile, on the user's chat messages and on the 작업 상태 user card.
+import dict from "./i18n/profile.js";
+import { onLanguageChange, registerStrings, t } from "./i18n.js";
+
+registerStrings(dict);
+
+// The user's profile nickname: shown in the sidebar profile, on the user's chat messages and on the work status user card.
 // Double-clicking the profile edits it; the name is kept in this browser's localStorage.
 // The agent's (gateway main) name sits beside it with the same editing; the gateway applies the same rules (src/profile.ts).
 
 export const NICKNAME_KEY = "zgw.profile.nickname";
-export const DEFAULT_NICKNAME = "나";
+/** A live binding: it follows the UI language, so importers always read the current default. */
+export let DEFAULT_NICKNAME = t("profile.nickname.default");
 export const NICKNAME_MAX = 20;
+export const AGENT_NAME_KEY = "zgw.profile.agentName";
+/** A live binding like DEFAULT_NICKNAME. */
+export let DEFAULT_AGENT_NAME = t("profile.agent.default");
+onLanguageChange(() => {
+	DEFAULT_NICKNAME = t("profile.nickname.default");
+	DEFAULT_AGENT_NAME = t("profile.agent.default");
+});
+
+/** True when [name] is a built-in default of either language (the same rule as src/profile.ts). */
+function isBuiltIn(name, key) {
+	return name === dict.en[key] || name === dict.ko[key];
+}
 
-export function normalizeNickname(value) {
+/** The user's own nickname: whitespace collapsed and trimmed, at most NICKNAME_MAX characters; "" for blank or a built-in default. */
+function ownNickname(value) {
+	const name = typeof value === "string" ? [...value.replace(/\s+/g, " ").trim()].slice(0, NICKNAME_MAX).join("") : "";
+	return isBuiltIn(name, "profile.nickname.default") ? "" : name;
+}
+
+function ownAgentName(value) {
 	const name = typeof value === "string" ? value.replace(/\s+/g, " ").trim() : "";
-	return name ? [...name].slice(0, NICKNAME_MAX).join("") : DEFAULT_NICKNAME;
+	return isBuiltIn(name, "profile.agent.default") ? "" : name;
+}
+
+/** The nickname to show: the user's own, else the current language's default. */
+export function normalizeNickname(value) {
+	return ownNickname(value) || DEFAULT_NICKNAME;
 }
 
-export const AGENT_NAME_KEY = "zgw.profile.agentName";
-export const DEFAULT_AGENT_NAME = "지그";
 export const AGENT_NAME_WIDTH = 20;
 
 /** Same ranges as src/profile.ts: Hangul, CJK, full-width forms and wide emoji count 2. */
@@ -29,9 +56,9 @@ export function displayWidth(text) {
 	return width;
 }
 
-/** Whitespace collapsed and trimmed; blank becomes the default. A name wider than AGENT_NAME_WIDTH is not shortened. */
+/** Whitespace collapsed and trimmed; blank or a built-in default becomes the current default. A name wider than AGENT_NAME_WIDTH is not shortened. */
 export function normalizeAgentName(value) {
-	return (typeof value === "string" ? value.replace(/\s+/g, " ").trim() : "") || DEFAULT_AGENT_NAME;
+	return ownAgentName(value) || DEFAULT_AGENT_NAME;
 }
 
 export function agentNameFits(value) {
@@ -39,14 +66,13 @@ export function agentNameFits(value) {
 }
 
 export function readAgentName(storage) {
-	const name = normalizeAgentName(storage.getItem(AGENT_NAME_KEY));
-	return agentNameFits(name) ? name : DEFAULT_AGENT_NAME;
+	const name = ownAgentName(storage.getItem(AGENT_NAME_KEY));
+	return name && agentNameFits(name) ? name : DEFAULT_AGENT_NAME;
 }
 
 export function writeAgentName(storage, value) {
-	const name = normalizeAgentName(value);
-	storage.setItem(AGENT_NAME_KEY, name);
-	return name;
+	storage.setItem(AGENT_NAME_KEY, ownAgentName(value));
+	return normalizeAgentName(value);
 }
 
 /**
@@ -94,9 +120,8 @@ export function readNickname(storage) {
 }
 
 export function writeNickname(storage, value) {
-	const name = normalizeNickname(value);
-	storage.setItem(NICKNAME_KEY, name);
-	return name;
+	storage.setItem(NICKNAME_KEY, ownNickname(value));
+	return normalizeNickname(value);
 }
 
 export function nicknameInitial(name) {
@@ -115,7 +140,7 @@ export function editNickname(nameEl, current, onSave, options = {}) {
 	input.className = "me-name-input";
 	input.value = current;
 	input.maxLength = NICKNAME_MAX * 2;
-	input.setAttribute("aria-label", options.label ?? "프로필 닉네임");
+	input.setAttribute("aria-label", options.label ?? t("profile.nickname.label"));
 	const mark = () => input.setAttribute("aria-invalid", String(!fits(input.value)));
 	input.addEventListener("input", mark);
 	mark();

package/web/reference.js

@@ -1,4 +1,9 @@
-// Message references (backlog 28): a right-click (or the row's 참조 button) on a stored message of the open conversation
+import { registerStrings, t } from "./i18n.js";
+import strings from "./i18n/reference.js";
+
+registerStrings(strings);
+
+// Message references (backlog 28): a right-click (or the row's reference button) on a stored message of the open conversation
 // adds it as a removable tag above the composer. A send carries the sources' stored event seqs
 // (`input.text.data.references`); the gateway stores canonical snapshots on the user message
 // (`message.user.data.references`), which history shows as quotes. Nothing is copied into the draft text.
@@ -7,13 +12,13 @@ export const MAX_REFERENCES = 4;
 // The gateway forwards the tagged sources' images with the new attachments and admits at most this many in one message.
 export const MAX_IMAGES = 4;
 // The assistant label is the agent's profile name (improvement 87): app.js passes `{ ...ROLE_LABELS, assistant: agentName }`.
-export const ROLE_LABELS = { user: "나", assistant: "zigmini" };
-export const NOTICES = {
-	duplicate: "이미 참조한 메시지입니다.",
-	full: `참조는 한 번에 ${MAX_REFERENCES}개까지 넣을 수 있습니다.`,
-	locked: "이미지를 올리는 동안에는 참조를 바꿀 수 없습니다.",
-	images: `이미지는 참조한 메시지의 이미지까지 합쳐 한 번에 ${MAX_IMAGES}장까지 보낼 수 있습니다. 참조나 첨부를 줄여 주세요.`,
-};
+export const ROLE_LABELS = { get user() { return t("reference.user"); }, assistant: "zigmini" };
+export const NOTICES = Object.defineProperties({}, {
+	duplicate: { enumerable: true, get: () => t("reference.duplicate") },
+	full: { enumerable: true, get: () => t("reference.full", { count: MAX_REFERENCES }) },
+	locked: { enumerable: true, get: () => t("reference.locked") },
+	images: { enumerable: true, get: () => t("reference.images", { count: MAX_IMAGES }) },
+});
 
 /**
  * The reference a stored chat event can be the source of, or null. Only an event with a stored seq counts: a user
@@ -42,12 +47,12 @@ function imageNames(list) {
 
 /** One line for a tag: the image count first, then the text with its whitespace collapsed (CSS clips the rest). */
 export function referenceLabel(ref) {
-	const image = ref.images.length > 0 ? `[이미지 ${ref.images.length}장]` : "";
+	const image = ref.images.length > 0 ? t("reference.imageCount", { count: ref.images.length }) : "";
 	return [image, ref.text.replace(/\s+/g, " ").trim()].filter(Boolean).join(" ");
 }
 
 export function referenceTitle(ref) {
-	const image = ref.images.length > 0 ? `[이미지 ${ref.images.length}장]` : "";
+	const image = ref.images.length > 0 ? t("reference.imageCount", { count: ref.images.length }) : "";
 	return [image, ref.text.trim()].filter(Boolean).join("\n");
 }
 
@@ -148,7 +153,7 @@ export function sentReferences(data) {
 // A source row's data comes from its event, never read back from what the row shows.
 const rowSources = new WeakMap();
 
-/** Marks [row] as a source and gives it the 참조 button: the keyboard route to the same tag as a right-click. */
+/** Marks [row] as a source and gives it the reference button: the keyboard route to the same tag as a right-click. */
 export function markReferenceable(row, source) {
 	rowSources.set(row, source);
 	row.dataset.refSeq = String(source.seq);
@@ -156,8 +161,8 @@ export function markReferenceable(row, source) {
 	const button = document.createElement("button");
 	button.type = "button";
 	button.className = "msg-ref-btn";
-	button.textContent = "참조";
-	button.title = "이 메시지를 입력창에 참조로 넣기";
+	button.textContent = t("reference.button");
+	button.title = t("reference.buttonTitle");
 	row.querySelector(".msg-head")?.append(button);
 }
 
@@ -184,8 +189,8 @@ function referenceChip(ref, locked, onRemove, labels) {
 	remove.type = "button";
 	remove.className = "ref-tag-remove";
 	remove.textContent = "×";
-	remove.title = "참조 빼기";
-	remove.setAttribute("aria-label", `참조 빼기: ${label}`);
+	remove.title = t("reference.remove");
+	remove.setAttribute("aria-label", t("reference.removeLabel", { label }));
 	remove.disabled = locked;
 	remove.onclick = () => onRemove(ref.seq, chip);
 	chip.addEventListener("keydown", (ev) => {

package/web/security-inbox.d.ts

@@ -1,8 +1,10 @@
 import type { HeldState, AllowedValue } from "../src/security-allow.ts";
 import type { HeldMessage } from "../src/security-check.ts";
+import type { SecurityBaselineTerm } from "../src/store.ts";
 
 export const HELD_PATH: "/api/security-check/held";
 export const ALLOWED_PATH: "/api/settings/security-check/allowed-values";
+export const BASELINE_PATH: "/api/settings/security-check/baseline";
 export type HeldDetail = HeldState & Partial<Pick<HeldMessage, "occurrences" | "draft">>;
 export interface Entry {
 	held: HeldDetail;
@@ -29,7 +31,22 @@ export function createSecurityInbox(fetcher: Fetcher, changed?: () => void): {
 	supported(value: boolean): void; connect(): Promise<void>; disconnect(): void; hide(id: string): boolean;
 };
 export function createAllowedValues(fetcher: Fetcher, changed?: () => void): {
-	state: { revision: number; values: AllowedValue[]; online: boolean; busy: boolean; loading: boolean; error: string; ready: boolean };
+	state: { revision: number; values: AllowedValue[]; online: boolean; busy: boolean; loading: boolean; error: string; notice: string; ready: boolean };
 	refresh(): Promise<void>; connect(): Promise<void>; disconnect(): void; updated(revision: number): void;
 	remove(id?: string | null): Promise<void>;
+	setScope(id: string, repo: boolean): Promise<boolean>;
+};
+export type AllowScope = NonNullable<AllowedValue["scopes"]>[number];
+export function repoAllowed(value: Pick<AllowedValue, "scopes">): boolean;
+export function scopesFor(repo: boolean): AllowScope[];
+export function repoScopeBlock(value: string, auto: BaselineState["auto"]): string;
+export interface BaselineState {
+	revision: number; terms: SecurityBaselineTerm[]; auto: { home: string; user: string } | null;
+	exportedAt: string | null; exportError: string | null;
+	online: boolean; busy: boolean; loading: boolean; error: string; notice: string; ready: boolean;
+}
+export function createSecurityBaseline(fetcher: Fetcher, changed?: () => void): {
+	state: BaselineState;
+	refresh(): Promise<void>; connect(): Promise<void>; disconnect(): void; updated(revision: number): void;
+	add(value: string): Promise<boolean>; remove(id: string): Promise<boolean>;
 };

package/web/security-inbox.js

@@ -1,6 +1,12 @@
+import { registerStrings, t } from "./i18n.js";
+import strings from "./i18n/security-inbox.js";
+
+registerStrings(strings);
+
 // Installation-local, memory-only client state. Never persist held details or drafts.
 export const HELD_PATH = "/api/security-check/held";
 export const ALLOWED_PATH = "/api/settings/security-check/allowed-values";
+export const BASELINE_PATH = "/api/settings/security-check/baseline";
 const TERMINAL = new Set(["sent", "cancelled", "failed", "unconfirmed"]);
 const STATUSES = new Set(["pending", "processing", ...TERMINAL]);
 
@@ -170,7 +176,7 @@ export function createSecurityInbox(fetcher, changed = () => {}) {
 }
 
 export function createAllowedValues(fetcher, changed = () => {}) {
-	const state = { revision: -1, values: [], online: false, busy: false, loading: false, error: "", ready: false };
+	const state = { revision: -1, values: [], online: false, busy: false, loading: false, error: "", notice: "", ready: false };
 	let generation = 0;
 	let read = 0;
 	let wanted = -1;
@@ -180,6 +186,7 @@ export function createAllowedValues(fetcher, changed = () => {}) {
 		const request = ++read;
 		state.loading = true;
 		state.error = "";
+		state.notice = "";
 		changed();
 		try {
 			const response = await fetcher(ALLOWED_PATH, { cache: "no-store", signal: AbortSignal.timeout(30_000) });
@@ -190,9 +197,9 @@ export function createAllowedValues(fetcher, changed = () => {}) {
 				state.revision = body.revision;
 				state.values = body.values;
 				state.ready = true;
-			} else state.error = "목록이 변경됐습니다. 다시 확인하세요.";
+			} else state.error = t("securityInbox.listChanged");
 		} catch {
-			if (epoch === generation && request === read) state.error = "허용 값을 확인하지 못했습니다. 다시 시도하세요.";
+			if (epoch === generation && request === read) state.error = t("securityInbox.allowedReadFailed");
 		} finally {
 			if (epoch === generation && request === read) {
 				state.loading = false;
@@ -228,10 +235,172 @@ export function createAllowedValues(fetcher, changed = () => {}) {
 				wanted = Math.max(wanted, body.revision);
 				await refresh();
 			} catch {
-				if (epoch === generation) state.error = "삭제 결과를 확인하지 못했습니다. 목록을 다시 확인하세요. 삭제를 자동 반복하지 않습니다.";
+				if (epoch === generation) state.error = t("securityInbox.deleteUnconfirmed");
 			} finally {
 				if (epoch === generation) { state.busy = false; changed(); }
 			}
 		},
+		/** One PATCH against the shown revision. Resolves true only when the server applied it; 409 and 404 re-read the newest list. */
+		setScope: async (id, repo) => {
+			// ready implies online: disconnect clears it, and a read applies it only inside its own generation.
+			if (!state.ready || state.busy || state.loading || state.error) return false;
+			state.busy = true;
+			state.notice = "";
+			const epoch = generation;
+			changed();
+			try {
+				const response = await fetcher(`${ALLOWED_PATH}/${encodeURIComponent(id)}`, {
+					method: "PATCH", headers: { "content-type": "application/json" },
+					body: JSON.stringify({ expectedRevision: state.revision, scopes: scopesFor(repo) }), signal: AbortSignal.timeout(30_000),
+				});
+				const body = await response.json();
+				if (epoch !== generation) return false;
+				if (response.status === 400) {
+					state.notice = t("securityInbox.scopeRejected", { error: body?.error ?? "scopes_invalid" });
+					return false;
+				}
+				const stale = response.status === 409 || response.status === 404;
+				if (!response.ok && !stale) throw new Error("scope_unconfirmed");
+				if (Number.isSafeInteger(body?.revision)) wanted = Math.max(wanted, body.revision);
+				await refresh();
+				if (stale && epoch === generation) state.notice = t("securityInbox.listRefreshed");
+				return response.ok;
+			} catch {
+				if (epoch === generation) state.error = t("securityInbox.scopeUnconfirmed");
+				return false;
+			} finally {
+				if (epoch === generation) { state.busy = false; changed(); }
+			}
+		},
+	};
+}
+
+/** Whether a remembered value also passes the repository scan; a row saved without scopes carries the transport default only. */
+export function repoAllowed(value) {
+	return Array.isArray(value.scopes) && value.scopes.includes("repo");
+}
+
+/** The scopes the toggle writes: on adds "repo" beside the transport default, off returns to the default alone. */
+export function scopesFor(repo) {
+	return repo ? ["transport", "repo"] : ["transport"];
+}
+
+/** The repository scan's term normalization (src/security/terms.ts normalizeTerm), so the screen judges like the export. */
+const normalizeTerm = (value) => value.normalize("NFC").toLowerCase();
+
+/**
+ * Why this value's repository toggle stays disabled, or "" when it may switch. The judgment is the export's
+ * (src/security-baseline.ts isAutomaticBaselineValue): the home path and the account name stay protected, and an
+ * unread automatic list fails closed.
+ */
+export function repoScopeBlock(value, auto) {
+	if (!auto) return t("securityInbox.autoUnavailable");
+	const normalized = normalizeTerm(value.trim());
+	if (normalized === normalizeTerm(auto.home) || normalized === normalizeTerm(auto.user)) {
+		return t("securityInbox.autoProtected");
+	}
+	return "";
+}
+
+/** The screen's words for a server rejection; the raw reason stays beside them. */
+const TERM_REJECTIONS = { empty: "securityInbox.rejectEmpty", too_short: "securityInbox.rejectShort", loopback: "securityInbox.rejectLoopback" };
+
+/**
+ * The repository baseline of this installation: its terms, the read-only automatic items and the exported file's state.
+ * Terms share the allowed values' revision, so a stale write gets 409 and re-reads instead of retrying on top of it.
+ */
+export function createSecurityBaseline(fetcher, changed = () => {}) {
+	const state = {
+		revision: -1, terms: [], auto: null, exportedAt: null, exportError: null,
+		online: false, busy: false, loading: false, error: "", notice: "", ready: false,
+	};
+	let generation = 0;
+	let read = 0;
+	let wanted = -1;
+	async function refresh() {
+		if (!state.online) return;
+		const epoch = generation;
+		const request = ++read;
+		state.loading = true;
+		state.error = "";
+		state.notice = "";
+		changed();
+		try {
+			const response = await fetcher(BASELINE_PATH, { cache: "no-store", signal: AbortSignal.timeout(30_000) });
+			const body = await response.json();
+			if (epoch !== generation || request !== read) return;
+			if (!response.ok || !Number.isSafeInteger(body.revision) || !Array.isArray(body.terms)) throw new Error("list_unavailable");
+			if (body.revision >= state.revision && body.revision >= wanted) {
+				state.revision = body.revision;
+				state.terms = body.terms;
+				state.auto = body.auto ?? null;
+				state.exportedAt = body.exportedAt ?? null;
+				state.exportError = body.exportError ?? null;
+				state.ready = true;
+			} else state.error = t("securityInbox.listChanged");
+		} catch {
+			if (epoch === generation && request === read) state.error = t("securityInbox.baselineReadFailed");
+		} finally {
+			if (epoch === generation && request === read) {
+				state.loading = false;
+				changed();
+			}
+		}
+	}
+	/** One write against the shown revision. Resolves true only when the server applied it; 409 and 404 re-read the newest list. */
+	async function write(path, method, payload, unconfirmed) {
+		// ready implies online: disconnect clears it, and a read applies it only inside its own generation.
+		if (!state.ready || state.busy || state.loading || state.error) return false;
+		state.busy = true;
+		state.notice = "";
+		const epoch = generation;
+		changed();
+		try {
+			const response = await fetcher(path, {
+				method, headers: { "content-type": "application/json" },
+				body: JSON.stringify({ ...payload, expectedRevision: state.revision }), signal: AbortSignal.timeout(30_000),
+			});
+			const body = await response.json();
+			if (epoch !== generation) return false;
+			if (response.status === 400) {
+				state.notice = body?.error === "term_duplicate" ? t("securityInbox.termDuplicate")
+					: t("securityInbox.termRejected", { reason: body?.reason ?? body?.error, detail: TERM_REJECTIONS[body?.reason] ? t(TERM_REJECTIONS[body.reason]) : t("securityInbox.rejectDefault") });
+				return false;
+			}
+			const stale = response.status === 409 || response.status === 404;
+			if (!response.ok && !stale) throw new Error("write_unconfirmed");
+			if (Number.isSafeInteger(body?.revision)) wanted = Math.max(wanted, body.revision);
+			await refresh();
+			if (stale && epoch === generation) state.notice = t("securityInbox.listRefreshed");
+			return response.ok;
+		} catch {
+			if (epoch === generation) state.error = unconfirmed;
+			return false;
+		} finally {
+			if (epoch === generation) { state.busy = false; changed(); }
+		}
+	}
+	return {
+		state, refresh,
+		connect: () => { generation++; state.online = true; return refresh(); },
+		disconnect: () => {
+			generation++; state.online = false; state.busy = false; state.loading = false; state.ready = false; changed();
+		},
+		updated: (revision) => {
+			if (revision <= Math.max(wanted, state.revision)) return;
+			wanted = revision;
+			void refresh();
+		},
+		add: async (value) => {
+			const term = typeof value === "string" ? value.trim() : "";
+			if (term === "") {
+				state.notice = t("securityInbox.enterTerm");
+				changed();
+				return false;
+			}
+			return write(BASELINE_PATH, "POST", { value: term }, t("securityInbox.addUnconfirmed"));
+		},
+		remove: (id) => write(`${BASELINE_PATH}/${encodeURIComponent(id)}`, "DELETE", {},
+			t("securityInbox.deleteUnconfirmed")),
 	};
 }

package/web/slash.js

@@ -1,19 +1,29 @@
+import { registerStrings, t } from "./i18n.js";
+import strings from "./i18n/slash.js";
+
+registerStrings(strings);
+
 export const WEB_COMMANDS = [
-	{ name: "tts on", description: "음성 답변 켜기", source: "web" },
-	{ name: "tts off", description: "음성 답변 끄기", source: "web" },
-	{ name: "wake on", description: "호출어(헤이 지그) 대기 켜기", source: "web" },
-	{ name: "wake off", description: "호출어(헤이 지그) 대기 끄기", source: "web" },
-	{ name: "clap on", description: "박수 감지 켜기", source: "web" },
-	{ name: "clap off", description: "박수 감지 끄기", source: "web" },
-	{ name: "voice on", description: "음성 기능 켜기(음성 서버 시작)", source: "web" },
-	{ name: "voice off", description: "음성 기능 끄기(음성 서버 정지)", source: "web" },
-	{ name: "옵션", description: "음성 기능·음성 답변·호출어·박수 감지 상태 보기", source: "web" },
-	{ name: "read", description: "마지막 답변 전체를 음성으로 읽기", source: "web" },
-	{ name: "기기", description: "등록된 기기 목록 (맥에서만)", source: "web" },
-	{ name: "기기 삭제", description: "번호로 등록된 기기 삭제, 예: /기기 삭제 2 (맥에서만)", source: "web" },
+	{ name: "tts on", get description() { return t("slash.ttsOn"); }, source: "web" },
+	{ name: "tts off", get description() { return t("slash.ttsOff"); }, source: "web" },
+	{ name: "wake on", get description() { return t("slash.wakeOn"); }, source: "web" },
+	{ name: "wake off", get description() { return t("slash.wakeOff"); }, source: "web" },
+	{ name: "clap on", get description() { return t("slash.clapOn"); }, source: "web" },
+	{ name: "clap off", get description() { return t("slash.clapOff"); }, source: "web" },
+	{ name: "voice on", get description() { return t("slash.voiceOn"); }, source: "web" },
+	{ name: "voice off", get description() { return t("slash.voiceOff"); }, source: "web" },
+	{ name: "옵션", get description() { return t("slash.options"); }, source: "web" },
+	{ name: "read", get description() { return t("slash.read"); }, source: "web" },
+	{ name: "기기", get description() { return t("slash.devices"); }, source: "web" },
+	{ name: "기기 삭제", get description() { return t("slash.deviceDelete"); }, source: "web" },
 ];
 
-export const SOURCE_LABELS = { skill: "스킬", extension: "명령", prompt: "템플릿", web: "웹 지그" };
+export const SOURCE_LABELS = {
+	get skill() { return t("slash.skill"); },
+	get extension() { return t("slash.command"); },
+	get prompt() { return t("slash.template"); },
+	get web() { return t("slash.webZig"); },
+};
 const SOURCE_ORDER = ["skill", "extension", "prompt", "web"];
 
 export function slashQuery(text) {