diff --git a/base/gdb/event.go b/base/gdb/event.go
index 35f7d6d4..6bc04cfe 100644
--- a/base/gdb/event.go
+++ b/base/gdb/event.go
@@ -22,6 +22,15 @@ func init() {
 		}, mdb.ZoneAction(mdb.SHORT, EVENT, mdb.FIELD, "time,id,cmd"))},
 	})
 }
+func EventAction(arg ...string) ice.Actions {
+	return ice.Actions{
+		ice.CTX_INIT: {Hand: func(m *ice.Message, args ...string) {
+			for _, v := range arg {
+				Watch(m, v)
+			}
+		}},
+	}
+}
 func Watch(m *ice.Message, key string, arg ...string) *ice.Message {
 	if len(arg) == 0 {
 		arg = append(arg, m.PrefixKey())
diff --git a/base/web/space.go b/base/web/space.go
index 5f006291..001bc237 100644
--- a/base/web/space.go
+++ b/base/web/space.go
@@ -3,7 +3,6 @@ package web
 import (
 	"math/rand"
 	"net"
-	"path"
 	"strings"
 	"time"
 
@@ -21,6 +20,7 @@ import (
 
 func _space_domain(m *ice.Message) (link string) {
 	if link = ice.Info.Domain; link == "" {
+		m.Optionv(ice.MSG_OPTS, ice.MSG_USERNAME)
 		link = m.Cmd(SPACE, ice.OPS, cli.PWD).Append(mdb.LINK)
 	}
 	if link == "" {
@@ -205,40 +205,24 @@ func _space_fork(m *ice.Message) {
 		text := kit.Select(s.RemoteAddr().String(), m.Option(ice.MSG_USERADDR))
 		name := strings.ToLower(m.Option(mdb.NAME, kit.ReplaceAll(kit.Select(text, m.Option(mdb.NAME)), ".", "_", ":", "_")))
 		kind := kit.Select(WORKER, m.Option(mdb.TYPE))
-		args := append([]string{mdb.TYPE, kind, mdb.NAME, name}, m.OptionSimple(SHARE, RIVER, ice.CMD)...)
+		args := append([]string{mdb.TYPE, kind, mdb.NAME, name}, m.OptionSimple(SHARE, RIVER, ice.MSG_USERUA)...)
 
 		m.Go(func() {
 			mdb.HashCreate(m, mdb.TEXT, kit.Select(text, m.Option(mdb.TEXT)), args, kit.Dict(mdb.TARGET, s))
+			defer mdb.HashRemove(m, mdb.NAME, name)
+
+			gdb.Event(m, SPACE_OPEN, args)
+			defer gdb.Event(m, SPACE_CLOSE, args)
 
 			switch kind {
-			case CHROME: // 交互节点
-				gdb.Event(m, SPACE_OPEN, args)
-				defer gdb.Event(m, SPACE_CLOSE, args)
-				defer mdb.HashRemove(m, mdb.NAME, name)
-				m.Go(func(msg *ice.Message) {
-					switch m.Option(ice.CMD) {
-					case cli.PWD:
-						link := kit.MergeURL2(_space_domain(m), path.Join("/chat/cmd/web.chat.grant", name))
-						msg.Sleep300ms(SPACE, name, cli.PWD, name, link, msg.Cmdx(cli.QRCODE, link))
-					case SSO:
-						link := _space_domain(m)
-						ls := strings.Split(kit.ParseURL(link).Path, ice.PS)
-						link = kit.MergeURL2(_space_domain(m), "/chat/sso", SPACE, kit.Select("", ls, 3), "back", m.Option("back"))
-						msg.Sleep300ms(SPACE, name, cli.PWD, name, link, msg.Cmdx(cli.QRCODE, link))
-					default:
-						msg.Sleep300ms(SPACE, name, cli.PWD, name)
-					}
-				})
-			case WORKER: // 工作节点
+			case CHROME:
+				m.Go(func(msg *ice.Message) { msg.Sleep300ms(SPACE, name, cli.PWD, name) })
+			case WORKER:
 				gdb.Event(m, DREAM_START, args)
 				defer gdb.Event(m, DREAM_STOP, args)
 				if m.Option("daemon") == "ops" {
 					defer m.Cmd(DREAM, DREAM_STOP, args)
 				}
-			default: // 服务节点
-				gdb.Event(m, SPACE_START, args)
-				defer gdb.Event(m, SPACE_STOP, args)
-				defer mdb.HashRemove(m, mdb.NAME, name)
 			}
 			_space_handle(m, false, m.Target().Server().(*Frame), s, name)
 		})
diff --git a/core/chat/grant.go b/core/chat/grant.go
index 2c6d12a2..800c3623 100644
--- a/core/chat/grant.go
+++ b/core/chat/grant.go
@@ -4,6 +4,9 @@ import (
 	ice "shylinux.com/x/icebergs"
 	"shylinux.com/x/icebergs/base/aaa"
 	"shylinux.com/x/icebergs/base/cli"
+	"shylinux.com/x/icebergs/base/gdb"
+	"shylinux.com/x/icebergs/base/mdb"
+	"shylinux.com/x/icebergs/base/tcp"
 	"shylinux.com/x/icebergs/base/web"
 )
 
@@ -13,6 +16,16 @@ func init() {
 	const CONFIRM = "confirm"
 	Index.MergeCommands(ice.Commands{
 		GRANT: {Name: "grant space auto", Help: "授权", Actions: ice.MergeActions(ice.Actions{
+			web.SPACE_OPEN: {Hand: func(m *ice.Message, arg ...string) {
+				if m.Option(mdb.TYPE) != aaa.LOGIN {
+					return
+				}
+				m.Go(func(msg *ice.Message) {
+					link := web.MergePodCmd(m, "", "", web.SPACE, m.Option(mdb.NAME))
+					link = tcp.ReplaceLocalhost(m, link)
+					msg.Sleep300ms(web.SPACE, m.Option(mdb.NAME), cli.PWD, m.Option(mdb.NAME), link, msg.Cmdx(cli.QRCODE, link))
+				})
+			}},
 			CONFIRM: {Help: "授权", Hand: func(m *ice.Message, arg ...string) {
 				if m.Warn(m.Option(ice.MSG_USERNAME) == "", ice.ErrNotLogin) {
 					return
@@ -20,13 +33,15 @@ func init() {
 				if m.Warn(m.Option(web.SPACE) == "", ice.ErrNotValid, web.SPACE) {
 					return
 				}
-				if m.Warn(m.CmdAppend(web.SPACE, m.Option(web.SPACE), ice.CMD) != cli.PWD, ice.ErrNotFound, m.Option(web.SPACE)) {
+				if msg := m.Cmd(web.SPACE, m.Option(web.SPACE)); m.Warn(msg.Append(mdb.TYPE) != aaa.LOGIN, ice.ErrNotFound, m.Option(web.SPACE)) {
 					return
+				} else {
+					m.Option(ice.MSG_USERUA, msg.Append(ice.MSG_USERUA))
 				}
 				m.Cmd(web.SPACE, m.Option(web.SPACE), ice.MSG_SESSID, aaa.SessCreate(m, m.Option(ice.MSG_USERNAME)))
 				m.ProcessLocation(web.MergeURL2(m, ice.PS))
 			}},
-		}, aaa.RoleAction(CONFIRM)), Hand: func(m *ice.Message, arg ...string) {
+		}, gdb.EventAction(web.SPACE_OPEN), aaa.RoleAction(CONFIRM)), Hand: func(m *ice.Message, arg ...string) {
 			m.Echo("请授权: %s 访问设备: %s", arg[0], ice.Info.HostName).Echo(ice.NL).EchoButton(CONFIRM)
 		}},
 	})
diff --git a/core/chat/header.go b/core/chat/header.go
index b70ec698..4fe6a35a 100644
--- a/core/chat/header.go
+++ b/core/chat/header.go
@@ -53,10 +53,8 @@ func _header_check(m *ice.Message, arg ...string) bool {
 	if m.Option(ice.MSG_USERNAME) != "" {
 		return true
 	}
-	if m.OptionFromConfig(web.SSO) == "" && m.Option(ice.DEV, m.CmdAppend(web.SPACE, ice.DEV, mdb.TEXT)) == "" {
-		if m.Option(ice.DEV, m.CmdAppend(web.SPACE, ice.SHY, mdb.TEXT)) == "" {
-			m.OptionFromConfig(web.LOGIN)
-		}
+	if m.OptionFromConfig(web.SSO) == "" && m.OptionFromConfig(web.LOGIN) == "" {
+		m.Option(web.SSO, GetSSO(m))
 	}
 	return false
 }
diff --git a/core/chat/sso.go b/core/chat/sso.go
index cd4458d6..e31f1af1 100644
--- a/core/chat/sso.go
+++ b/core/chat/sso.go
@@ -1,6 +1,8 @@
 package chat
 
 import (
+	"strings"
+
 	ice "shylinux.com/x/icebergs"
 	"shylinux.com/x/icebergs/base/aaa"
 	"shylinux.com/x/icebergs/base/cli"
@@ -14,13 +16,21 @@ const SSO = "sso"
 func init() {
 	Index.MergeCommands(ice.Commands{
 		web.P(SSO): {Name: "/sso", Help: "授权", Actions: aaa.WhiteAction(), Hand: func(m *ice.Message, arg ...string) {
-			if m.Option(ice.MSG_USERNAME) == "" || m.Warn(m.Option(cli.BACK) == "") {
+			if m.Warn(m.Option(ice.MSG_USERNAME) == "", ice.ErrNotLogin) || m.Warn(m.Option(cli.BACK) == "", ice.ErrNotValid) {
 				web.RenderIndex(m, ice.VOLCANOS)
 				return
 			}
-			sessid := aaa.UserRoot(m).Cmdx(web.SPACE, m.Option(web.SPACE), aaa.SESS, mdb.CREATE, aaa.USERNAME, m.Option(ice.MSG_USERNAME),
-				aaa.USERROLE, m.Option(ice.MSG_USERROLE), aaa.USERNICK, m.Option(ice.MSG_USERNICK))
-			m.RenderRedirect(kit.MergeURL(m.Option(cli.BACK), ice.MSG_SESSID, sessid))
+			m.RenderRedirect(kit.MergeURL(m.Option(cli.BACK), ice.MSG_SESSID, aaa.UserRoot(m).Cmdx(web.SPACE, m.Option(web.SPACE), aaa.SESS, mdb.CREATE,
+				aaa.USERNAME, m.Option(ice.MSG_USERNAME), aaa.USERROLE, m.Option(ice.MSG_USERROLE), aaa.USERNICK, m.Option(ice.MSG_USERNICK))))
 		}},
 	})
 }
+
+func GetSSO(m *ice.Message) string {
+	link := m.Cmdx(web.SPACE, web.DOMAIN)
+	if !strings.Contains(link, "/chat/pod/") {
+		return ""
+	}
+	ls := strings.Split(kit.ParseURL(link).Path, ice.PS)
+	return kit.MergeURL2(link, web.P(CHAT, SSO), web.SPACE, kit.Select("", ls, 3), cli.BACK, m.R.Header.Get(web.Referer))
+}