diff --git a/base/aaa/portal/asign.go b/base/aaa/portal/asign.go
index 3996fe2f..9ca9a39f 100644
--- a/base/aaa/portal/asign.go
+++ b/base/aaa/portal/asign.go
@@ -36,7 +36,7 @@ func (s asign) Inputs(m *ice.Message, arg ...string) {
 			m.Option(ice.TABLE_CHECKBOX, ice.TRUE)
 		})
 	} else if arg[0] == aaa.USERNAME {
-		m.Cmdy(aaa.USER).Cut(aaa.USERROLE, aaa.USERNAME, aaa.USERNICK)
+		m.Cmdy(aaa.USER).Cut(aaa.USERNAME, aaa.USERNICK, aaa.USERROLE)
 	} else {
 		s.Hash.Inputs(m, arg...)
 	}
diff --git a/base/web/dream.go b/base/web/dream.go
index 296d9255..79faa228 100644
--- a/base/web/dream.go
+++ b/base/web/dream.go
@@ -517,6 +517,7 @@ func init() {
 							if p := ProxyDomain(msg, value[mdb.NAME]); p != "" {
 								value[mdb.TEXT] = p
 								m.PushRecord(value, mdb.TIME, mdb.TYPE, mdb.NAME, mdb.ICONS, nfs.MODULE, nfs.VERSION, mdb.TEXT)
+								m.PushButton(PORTAL, DESKTOP)
 							}
 						}
 					})
diff --git a/base/web/matrix.js b/base/web/matrix.js
index 268766f2..d03ffc9d 100644
--- a/base/web/matrix.js
+++ b/base/web/matrix.js
@@ -3,7 +3,19 @@ Volcanos(chat.ONIMPORT, {
 		msg.Table(function(value) { var name = value.name, _domain = value.domain
 			list[name] = list[name]||{}, list[name][_domain] = value, domain.indexOf(_domain) == -1 && domain.push(_domain)
 			value.type == web.SERVER && server.push(value.domain)
-		})
+		}), can.db.list = list, can.db.domain = domain, can.db.server = server
+		
+		can.ui = can.page.Appends(can, can._output, [{view: [wiki.CONTENT, html.TABLE], list: [
+			{type: html.THEAD, list: [{type: html.TR, list: can.core.Item(list, function(name, value) {
+				return {type: html.TH, list: [value[""]? can.onimport.item(can, value[""], list): can.onimport.void(can, name, domain, list)]}
+			}) }]},
+			{type: html.TBODY, list: can.core.List(domain, function(domain) { if (!domain) { return }
+				return {type: html.TR, list: can.core.Item(list, function(name, value) { var item = value[domain]
+					return {type: html.TD, list: [item? can.onimport.item(can, item, list): can.onimport.void(can, name, domain, list)]}
+				})}
+			})},
+		] }]), can.onmotion.delay(can, function() { can.Status(mdb.COUNT, can.core.List(domain).length+"x"+can.core.Item(list).length) })
+		return
 		can.ui = can.page.Appends(can, can._output, [{view: [wiki.CONTENT, html.TABLE], list: [
 			{type: html.THEAD, list: [{type: html.TR, list: can.core.List(domain, function(domain) {
 				return {type: html.TH, list: [can.onimport.item(can, list[""][domain], list)]}
@@ -14,8 +26,6 @@ Volcanos(chat.ONIMPORT, {
 				})}
 			})},
 		] }]), can.onmotion.delay(can, function() { can.Status(mdb.COUNT, can.core.Item(list).length+"x"+can.core.List(domain).length) })
-		can.onmotion.orderShow(can, can.page.SelectOne(can, can._output, "table>tbody"), "tr")
-		can.db.list = list, can.db.domain = domain, can.db.server = server
 	},
 	void: function(can, name, domain, list) { var worker = list[name][""], server = list[""][domain]
 		return {view: html.ACTION, _init: function(target) {
diff --git a/base/web/share.go b/base/web/share.go
index 76ba5b72..92d72363 100644
--- a/base/web/share.go
+++ b/base/web/share.go
@@ -203,7 +203,7 @@ func ProxyUpload(m *ice.Message, pod string, p string) string {
 		share := m.Cmdx(SHARE, mdb.CREATE, mdb.TYPE, PROXY, mdb.NAME, p, mdb.TEXT, pod)
 		defer m.Cmd(SHARE, mdb.REMOVE, mdb.HASH, share)
 		url := tcp.PublishLocalhost(m, m.MergeLink(PP(SHARE, PROXY), SHARE, share))
-		m.Cmd(SPACE, pod, SPIDE, PROXY, URL, url, nfs.SIZE, size, CACHE, cache.Format(ice.MOD_TIME), UPLOAD, mdb.AT+p)
+		m.Cmd(SPACE, pod, SPIDE, PROXY, URL, url, nfs.SIZE, size, CACHE, cache.Format(ice.MOD_TIME), UPLOAD, mdb.AT+p, kit.Dict(ice.MSG_USERROLE, aaa.TECH))
 	}
 	return kit.Select(p, pp, file.ExistsFile(pp))
 }
diff --git a/base/web/space.go b/base/web/space.go
index b7b9eb18..52cc83c9 100644
--- a/base/web/space.go
+++ b/base/web/space.go
@@ -129,7 +129,8 @@ func _space_handle(m *ice.Message, safe bool, name string, c *websocket.Conn) {
 		}
 		msg := m.Spawn(b)
 		if safe && msg.Option(ice.MSG_UNSAFE) != ice.TRUE { // 下行权限
-			kit.If(kit.IsIn(msg.Option(ice.MSG_USERROLE), "", aaa.VOID), func() { msg.Option(ice.MSG_USERROLE, aaa.UserRole(msg, msg.Option(ice.MSG_USERNAME))) })
+			msg.Option(ice.MSG_USERROLE, kit.Select(msg.Option(ice.MSG_USERROLE), aaa.UserRole(msg, msg.Option(ice.MSG_USERNAME))))
+			// kit.If(kit.IsIn(msg.Option(ice.MSG_USERROLE), "", aaa.VOID), func() { msg.Option(ice.MSG_USERROLE, aaa.UserRole(msg, msg.Option(ice.MSG_USERNAME))) })
 		} else { // 上行权限
 			msg.Option(ice.MSG_UNSAFE, ice.TRUE)
 			kit.If(msg.Option(ice.MSG_USERROLE), func() { msg.Option(ice.MSG_USERROLE, aaa.VOID) })
@@ -321,7 +322,7 @@ func init() {
 				cli.NodeInfo(m, ice.Info.Pathname, WORKER, arg[0])
 				m.Cmd(SERVE, m.ActionKey(), arg)
 			}},
-			ice.MAIN: {Name: "main index", Hand: func(m *ice.Message, arg ...string) {
+			ice.MAIN: {Name: "main index", Role: aaa.VOID, Hand: func(m *ice.Message, arg ...string) {
 				if len(arg) > 0 {
 					ice.Info.NodeMain = m.Option(ctx.INDEX)
 					m.Cmd(SERVE, m.ActionKey(), arg)
diff --git a/base/web/store.go b/base/web/store.go
index 195b5537..11f00516 100644
--- a/base/web/store.go
+++ b/base/web/store.go
@@ -93,7 +93,6 @@ func init() {
 					}
 					m.Push(mdb.TEXT, value[nfs.REPOS]).Push(ORIGIN, origin)
 					if _, ok := list[value[mdb.NAME]]; ok || arg[0] == ice.OPS {
-						// m.PushButton(PORTAL, DESKTOP, ADMIN, OPEN)
 						m.PushButton(PORTAL, INSTALL)
 					} else if ice.Info.NodeType == WORKER || !aaa.IsTechOrRoot(m) {
 						m.PushButton(PORTAL)