diff --git a/base/aaa/user.go b/base/aaa/user.go
index baf59d8f..77f2477b 100644
--- a/base/aaa/user.go
+++ b/base/aaa/user.go
@@ -62,7 +62,7 @@ func init() {
 					m.Option(ice.TABLE_CHECKBOX, ice.TRUE)
 				}
 			}},
-			mdb.CREATE: {Name: "create userrole=void,tech username* usernick language userzone email", Hand: func(m *ice.Message, arg ...string) {
+			mdb.CREATE: {Name: "create userrole=void,tech username* usernick language userzone email avatar", Hand: func(m *ice.Message, arg ...string) {
 				_user_create(m, m.Option(USERNAME), m.OptionSimple(USERROLE, USERNICK, LANGUAGE, AVATAR, BACKGROUND, USERZONE, EMAIL)...)
 			}},
 			mdb.REMOVE: {Hand: func(m *ice.Message, arg ...string) { _user_remove(m, m.Option(USERNAME)) }},
diff --git a/base/web/dream.go b/base/web/dream.go
index 0b31078e..8f1377b4 100644
--- a/base/web/dream.go
+++ b/base/web/dream.go
@@ -293,8 +293,13 @@ func init() {
 					case tcp.NODENAME:
 						m.Cmdy(SPACE, m.Option(mdb.NAME), SPACE, ice.INFO).CutTo(mdb.NAME, tcp.NODENAME)
 					case aaa.USERNAME:
-						m.Push(arg[0], m.Option(tcp.NODENAME))
-						m.Push(arg[0], m.Option(ice.MSG_USERNAME))
+						if aaa.IsTechOrRoot(m) && m.Option(ctx.ACTION) == GRANT {
+							m.Cmdy(aaa.USER).Cut(aaa.USERNAME, aaa.USERNICK)
+							m.Option(ice.TABLE_CHECKBOX, ice.FALSE)
+						} else {
+							m.Push(arg[0], m.Option(ice.MSG_USERNAME))
+							m.Push(arg[0], m.Option(tcp.NODENAME))
+						}
 					default:
 						gdb.Event(m, DREAM_INPUTS, arg)
 					}
@@ -429,7 +434,10 @@ func init() {
 			"gettoken": {Help: "令牌", Style: "danger", Hand: func(m *ice.Message, arg ...string) {
 				m.Options(m.Cmd(SPIDE, m.Option(mdb.NAME)).AppendSimple()).Cmdy(SPIDE, mdb.DEV_REQUEST)
 			}},
-			GRANT: {Hand: func(m *ice.Message, arg ...string) {
+			GRANT: {Name: "grant username", Hand: func(m *ice.Message, arg ...string) {
+				if aaa.IsTechOrRoot(m) && m.Option(aaa.USERNAME) != "" {
+					m.Option(ice.MSG_USERNAME, m.Option(aaa.USERNAME))
+				}
 				m.Cmd(CHAT_GRANT, aaa.CONFIRM, kit.Dict(SPACE, m.Option(mdb.NAME)))
 			}},
 			OPEN: {Style: "notice", Role: aaa.VOID, Hand: func(m *ice.Message, arg ...string) {
@@ -450,7 +458,6 @@ func init() {
 					m.ProcessOpen(S(m.Option(mdb.NAME)))
 				}
 			}},
-			DREAM_OPEN: {Hand: func(m *ice.Message, arg ...string) {}},
 			DREAM_CLOSE: {Hand: func(m *ice.Message, arg ...string) {
 				kit.For(arg, func(k, v string) {
 					if k == cli.DAEMON && v == ice.OPS && m.Cmdv(SPACE, m.Option(mdb.NAME), mdb.STATUS) != cli.STOP {
diff --git a/base/web/space.go b/base/web/space.go
index 6fb7403c..be7a549e 100644
--- a/base/web/space.go
+++ b/base/web/space.go
@@ -106,7 +106,7 @@ func _space_fork(m *ice.Message) {
 				safe = true
 				m.Go(func() {
 					SpacePwd(m, name, kit.Path(""))
-					SpaceEvent(m, OPS_SERVER_OPEN, name, args...)
+					// SpaceEvent(m, OPS_DREAM_OPEN, name, args...)
 				})
 			case SERVER:
 				defer gdb.EventDeferEvent(m, SPACE_OPEN, args)(SPACE_CLOSE, args)
@@ -203,7 +203,7 @@ func _space_exec(m *ice.Message, name string, source, target []string, c *websoc
 		args := m.OptionSimple(mdb.ICONS, mdb.TIME, nfs.MODULE, nfs.VERSION, AGENT, cli.SYSTEM)
 		kit.If(name == ice.OPS, func() { args = append(args, m.OptionSimple(mdb.TEXT)...) })
 		mdb.HashModify(m, mdb.HASH, name, ParseUA(m), args)
-		SpaceEvent(m, OPS_ORIGIN_OPEN, name, kit.Simple(mdb.NAME, name, args)...)
+		// SpaceEvent(m, OPS_ORIGIN_OPEN, name, kit.Simple(mdb.NAME, name, args)...)
 	default:
 		if m.IsErr() {
 			return
@@ -290,6 +290,7 @@ const (
 	OPS_ORIGIN_OPEN = "ops.origin.open"
 	OPS_SERVER_OPEN = "ops.server.open"
 	OPS_DREAM_SPAWN = "ops.dream.spawn"
+	OPS_DREAM_OPEN  = "ops.dream.open"
 
 	SPACE_LOGIN       = "space.login"
 	SPACE_LOGIN_CLOSE = "space.login.close"
@@ -496,9 +497,11 @@ func init() {
 			m.SetAppend().Push(arg[0], SpideOrigin(m, ice.DEV))
 			m.Copy(m.Cmd(SPIDE, kit.Dict(ice.MSG_FIELDS, CLIENT_ORIGIN)).CutTo(CLIENT_ORIGIN, arg[0]).Sort(arg[0]))
 		case mdb.ICONS:
-			m.Options(nfs.DIR_REG, kit.ExtReg(nfs.PNG, nfs.JPG, nfs.JPEG), nfs.DIR_DEEP, ice.TRUE)
+			m.Options(nfs.DIR_DEEP, ice.TRUE, nfs.DIR_REG, kit.ExtReg(nfs.PNG, nfs.JPG, nfs.JPEG))
 			m.Cmdy(nfs.DIR, nfs.SRC, nfs.PATH)
-			m.Cmdy(nfs.DIR, ice.USR_LOCAL_IMAGE, nfs.PATH)
+			if aaa.IsTechOrRoot(m) {
+				m.Cmdy(nfs.DIR, ice.USR_LOCAL_IMAGE, nfs.PATH)
+			}
 			m.Cmdy(nfs.DIR, ice.USR_ICONS, nfs.PATH)
 			m.CutTo(nfs.PATH, arg[0])
 		case ctx.INDEX, ice.CMD:
diff --git a/core/code/go.go b/core/code/go.go
index f05bb95b..08deb225 100644
--- a/core/code/go.go
+++ b/core/code/go.go
@@ -74,7 +74,8 @@ func _go_show(m *ice.Message, arg ...string) {
 		// ctx.ProcessField(m, "web.code.xterm", kit.Simple())
 		ctx.ProcessField(m, "log.debug", kit.Simple("bench"))
 	} else if cmd := ctx.GetFileCmd(path.Join(arg[2], arg[1])); cmd != "" {
-		if p := path.Join(path.Dir(path.Join(arg[2], arg[1])), "portal.go"); path.Base(arg[1]) != "portal.go" && nfs.Exists(m, p) && arg[1] != "gonganxitong/user.go" {
+		if p := path.Join(path.Dir(path.Join(arg[2], arg[1])), "portal.go"); path.Base(arg[1]) != "portal.go" && nfs.Exists(m, p) &&
+			!kit.IsIn(arg[1], "gonganxitong/user.go", "gonganxitong/domain.go") {
 			if cmd := ctx.GetFileCmd(p); cmd != "" {
 				ctx.ProcessField(m, cmd, kit.Simple())
 				return