diff --git a/base/aaa/role.go b/base/aaa/role.go
index 36fda11e..69f3def7 100644
--- a/base/aaa/role.go
+++ b/base/aaa/role.go
@@ -57,6 +57,11 @@ const (
 	BLACK = "black"
 	RIGHT = "right"
 )
+const (
+	AUTH    = "auth"
+	PUBLIC  = "public"
+	PRIVATE = "private"
+)
 const ROLE = "role"
 
 func init() {
diff --git a/base/web/admin.go b/base/web/admin.go
new file mode 100644
index 00000000..b880ba0d
--- /dev/null
+++ b/base/web/admin.go
@@ -0,0 +1,16 @@
+package web
+
+import (
+	ice "shylinux.com/x/icebergs"
+	kit "shylinux.com/x/toolkits"
+)
+
+func init() {
+	Index.MergeCommands(ice.Commands{
+		"admin": {Name: "admin", Help: "管理", Hand: func(m *ice.Message, arg ...string) {
+			args := []string{}
+			kit.For(arg[1:], func(v string) { args = append(args, ice.ARG, v) })
+			m.Cmdy(SPIDE, ice.OPS, SPIDE_RAW, "/chat/cmd/"+arg[0], args)
+		}},
+	})
+}
diff --git a/base/web/space.go b/base/web/space.go
index f2eb8d4c..8795d029 100644
--- a/base/web/space.go
+++ b/base/web/space.go
@@ -52,8 +52,7 @@ func _space_fork(m *ice.Message) {
 	text := kit.Select(addr, m.Option(mdb.TEXT))
 	if kit.IsIn(m.Option(mdb.TYPE), CHROME) && m.Option(mdb.NAME) != "chrome" || !(ice.Info.Localhost && tcp.IsLocalHost(m, m.R.RemoteAddr) ||
 		m.Option(TOKEN) != "" && m.Cmdv(TOKEN, m.Option(TOKEN), mdb.TIME) > m.Time()) {
-		name = kit.ReplaceAll(addr, "[", "_", "]", "_", nfs.DF, "_", nfs.PT, "_")
-		text = kit.Select(addr, m.Option(mdb.NAME), m.Option(mdb.TEXT))
+		name, text = kit.Hashs(name), kit.Select(addr, m.Option(mdb.NAME), m.Option(mdb.TEXT))
 	}
 	args := kit.Simple(mdb.TYPE, kit.Select(WORKER, m.Option(mdb.TYPE)), mdb.NAME, name, mdb.TEXT, text, m.OptionSimple(cli.DAEMON, ice.MSG_USERUA), m.OptionSimple(nfs.MODULE, nfs.VERSION))
 	if c, e := websocket.Upgrade(m.W, m.R); !m.Warn(e) {
diff --git a/core/chat/macos/desktop.js b/core/chat/macos/desktop.js
index 7a42e520..17937d52 100644
--- a/core/chat/macos/desktop.js
+++ b/core/chat/macos/desktop.js
@@ -77,7 +77,7 @@ Volcanos(chat.ONIMPORT, {
 			sub.onexport.marginBottom = function() { return 100 }
 			sub.onexport.actionHeight = function(sub) { return can.page.ClassList.has(can, sub._target, html.OUTPUT)? 0: html.ACTION_HEIGHT+20 },
 			can.onmotion.move(can, sub._target, {"z-index": 10, top: item.top, left: item.left}), sub.onmotion.resize(can, sub._target, function(height, width) { sub.onimport.size(sub, height, width) }, 25)
-			sub._target.onclick = function(event) { can.page.Select(can, sub._target.parentNode, html.FIELDSET, function(target) { can.page.style(can, target, "z-index", target == sub._target? "10": "9") }) }
+			sub._target.onclick = function(event) { can.ondetail.select(can, sub._target) }
 		}, can.ui.desktop)
 	},
 	session: function(can, list) { can.page.Select(can, can._output, html.DIV_DESKTOP, function(target) { can.page.Remove(can, target) })
diff --git a/misc/git/service.go b/misc/git/service.go
index 0ca42725..0f96b585 100644
--- a/misc/git/service.go
+++ b/misc/git/service.go
@@ -151,7 +151,7 @@ func init() {
 			}
 
 		case UPLOAD_PACK:
-			if mdb.Conf(m, Prefix(SERVICE), kit.Keym("auth")) == "private" {
+			if mdb.Conf(m, Prefix(SERVICE), kit.Keym(aaa.AUTH)) == aaa.PRIVATE {
 				if err := _service_login(m); m.Warn(err, ice.ErrNotLogin) {
 					web.RenderHeader(m.W, "WWW-Authenticate", `Basic realm="git server"`)
 					return
@@ -198,7 +198,8 @@ func init() {
 				mdb.HashSelect(m, arg...).Table(func(value ice.Maps) {
 					m.Push(nfs.SIZE, kit.Split(m.Cmdx(cli.SYSTEM, "du", "-sh", path.Join(ice.USR_LOCAL_REPOS, value[REPOS])))[0])
 					m.PushScript(kit.Format("git clone %s", tcp.PublishLocalhost(m, kit.Split(web.MergeURL2(m, "/x/"+value[REPOS]+".git"), mdb.QS)[0])))
-				}).Sort(REPOS).Cmdy("web.code.publish", ice.CONTEXTS, "dev")
+				}).Sort(REPOS).Cmdy("web.code.publish", ice.CONTEXTS, ice.DEV)
+				kit.If(mdb.Config(m, aaa.AUTH) == aaa.PRIVATE, func() { m.StatusTimeCount(aaa.AUTH, aaa.PRIVATE) })
 			} else if len(arg) == 1 {
 				_repos_branch(m, _repos_open(m, arg[0]))
 				m.EchoScript(tcp.PublishLocalhost(m, kit.Split(web.MergeURL2(m, "/x/"+arg[0]), mdb.QS)[0]))