diff --git a/base/cli/runtime.go b/base/cli/runtime.go
index 6c7a9642..0bc0f250 100644
--- a/base/cli/runtime.go
+++ b/base/cli/runtime.go
@@ -44,6 +44,7 @@ func _runtime_init(m *ice.Message) {
 	ice.Info.HostName = m.Conf(RUNTIME, kit.Keys(BOOT, HOSTNAME))
 	ice.Info.PathName = m.Conf(RUNTIME, kit.Keys(BOOT, PATHNAME))
 	ice.Info.UserName = m.Conf(RUNTIME, kit.Keys(BOOT, USERNAME))
+	m.Cmd(aaa.USER, mdb.CREATE, ice.Info.UserName, "", aaa.ROOT)
 	aaa.UserRoot(ice.Pulse)
 
 	// 启动程序 boot
diff --git a/base/nfs/cat.go b/base/nfs/cat.go
index 30749dba..e6b7bce8 100644
--- a/base/nfs/cat.go
+++ b/base/nfs/cat.go
@@ -37,7 +37,7 @@ func _cat_hash(m *ice.Message, p string) string {
 	return ""
 }
 func _cat_list(m *ice.Message, name string) {
-	if !aaa.Right(m, name) {
+	if m.Option(CAT_CONTENT) == "" && !aaa.Right(m, name) {
 		return // 没有权限
 	}
 	f, e := _cat_find(m, name)
diff --git a/base/web/option.go b/base/web/option.go
index 75d680c6..83affac0 100644
--- a/base/web/option.go
+++ b/base/web/option.go
@@ -7,11 +7,13 @@ import (
 	"time"
 
 	ice "shylinux.com/x/icebergs"
+	"shylinux.com/x/icebergs/base/aaa"
 	"shylinux.com/x/icebergs/base/cli"
 	"shylinux.com/x/icebergs/base/ctx"
 	"shylinux.com/x/icebergs/base/gdb"
 	"shylinux.com/x/icebergs/base/mdb"
 	"shylinux.com/x/icebergs/base/nfs"
+	"shylinux.com/x/icebergs/base/tcp"
 	kit "shylinux.com/x/toolkits"
 	"shylinux.com/x/toolkits/file"
 )
@@ -136,6 +138,9 @@ func OptionUserWeb(m Message) *url.URL {
 	return kit.ParseURL(m.Option(ice.MSG_USERWEB))
 }
 func MergeURL2(m Message, url string, arg ...ice.Any) string {
+	if m.Option(ice.MSG_USERWEB) == "" {
+		return kit.MergeURL2(ice.HTTP+"://"+ice.Pulse.Cmd(tcp.HOST).Append(aaa.IP)+":"+ice.Pulse.Cmd(SERVE).Append(tcp.PORT), url, arg...)
+	}
 	return kit.MergeURL2(m.Option(ice.MSG_USERWEB), url, arg...)
 }
 func MergeLink(m Message, url string, arg ...ice.Any) string {
diff --git a/base/web/render.go b/base/web/render.go
index 05d59227..f85c7572 100644
--- a/base/web/render.go
+++ b/base/web/render.go
@@ -139,8 +139,8 @@ func RenderResult(m *ice.Message, arg ...ice.Any) {
 }
 
 func CookieName(url string) string {
+	return ice.MSG_SESSID + "_" + kit.ReplaceAll(kit.ParseURLMap(url)[tcp.PORT], ".", "_", ":", "_")
 	return ice.MSG_SESSID + "_" + kit.ReplaceAll(kit.ParseURLMap(url)[tcp.HOST], ".", "_", ":", "_")
-	return ice.MSG_SESSID + "_" + kit.ParseURLMap(url)[tcp.PORT]
 }
 
 func RenderIndex(m *ice.Message, repos string, file ...string) *ice.Message {
@@ -152,21 +152,18 @@ func RenderIndex(m *ice.Message, repos string, file ...string) *ice.Message {
 func RenderWebsite(m *ice.Message, pod string, dir string, arg ...string) *ice.Message {
 	return m.Echo(m.Cmdx(Space(m, pod), "web.chat.website", lex.PARSE, dir, arg)).RenderResult()
 }
-func RenderCmd(m *ice.Message, index string, args ...ice.Any) {
-	if index == "" {
-		return
-	}
-	list := index
-	if index != "" {
-		msg := m.Cmd(ctx.COMMAND, index)
-		list = kit.Format(kit.List(kit.Dict(msg.AppendSimple(mdb.NAME, mdb.HELP),
-			ctx.INDEX, index, ctx.ARGS, kit.Simple(args), ctx.DISPLAY, m.Option(ice.MSG_DISPLAY),
-			mdb.LIST, kit.UnMarshal(msg.Append(mdb.LIST)), mdb.META, kit.UnMarshal(msg.Append(mdb.META)),
-		)))
-	}
+func RenderCmd(m *ice.Message, cmd string, arg ...ice.Any) {
+	RenderPodCmd(m, "", cmd, arg...)
+}
+func RenderPodCmd(m *ice.Message, pod, cmd string, arg ...ice.Any) {
+	msg := m.Cmd(Space(m, pod), ctx.COMMAND, kit.Select("web.wiki.word", cmd))
+	list := kit.Format(kit.List(kit.Dict(msg.AppendSimple(mdb.NAME, mdb.HELP),
+		ctx.INDEX, cmd, ctx.ARGS, kit.Simple(arg), ctx.DISPLAY, m.Option(ice.MSG_DISPLAY),
+		mdb.LIST, kit.UnMarshal(msg.Append(mdb.LIST)), mdb.META, kit.UnMarshal(msg.Append(mdb.META)),
+	)))
 	m.Echo(kit.Format(_cmd_template, list)).RenderResult()
 }
-func RenderMain(m *ice.Message, pod, index string, args ...ice.Any) *ice.Message {
+func RenderMain(m *ice.Message, pod, index string, arg ...ice.Any) *ice.Message {
 	if script := m.Cmdx(Space(m, pod), nfs.CAT, kit.Select(ice.SRC_MAIN_JS, index)); script != "" {
 		return m.Echo(kit.Format(_main_template, script)).RenderResult()
 	}
diff --git a/base/web/serve.go b/base/web/serve.go
index e345311e..66085b59 100644
--- a/base/web/serve.go
+++ b/base/web/serve.go
@@ -300,7 +300,7 @@ func _serve_login(msg *ice.Message, key string, cmds []string, w http.ResponseWr
 		return cmds, !msg.IsErr() && msg.Result(0) != ice.FALSE
 	}
 
-	if aaa.Right(msg, key, cmds) {
+	if aaa.Right(msg.Spawn(), key, cmds) {
 		return cmds, true
 	}
 
diff --git a/base/web/share.go b/base/web/share.go
index 72b07280..83629e2a 100644
--- a/base/web/share.go
+++ b/base/web/share.go
@@ -16,8 +16,8 @@ import (
 	"shylinux.com/x/icebergs/base/ssh"
 	"shylinux.com/x/icebergs/base/tcp"
 	kit "shylinux.com/x/toolkits"
-	"shylinux.com/x/toolkits/logs"
 	"shylinux.com/x/toolkits/file"
+	"shylinux.com/x/toolkits/logs"
 )
 
 func _share_render(m *ice.Message, arg ...string) {
@@ -37,7 +37,7 @@ func _share_render(m *ice.Message, arg ...string) {
 }
 func _share_link(m *ice.Message, p string, arg ...ice.Any) string {
 	p = kit.Select("", SHARE_LOCAL, !strings.HasPrefix(p, ice.PS)) + p
-	return tcp.ReplaceLocalhost(m, MergeURL2(m, p, arg...))
+	return tcp.ReplaceLocalhost(m, MergeLink(m, p, arg...))
 }
 func _share_cache(m *ice.Message, arg ...string) {
 	if pod := m.Option(ice.POD); ctx.PodCmd(m, CACHE, arg[0]) {
@@ -207,4 +207,4 @@ func IsNotValidShare(m *ice.Message, value ice.Maps) bool {
 		return true
 	}
 	return false
-}
\ No newline at end of file
+}
diff --git a/base/web/space.go b/base/web/space.go
index 00644ff0..ecb7def5 100644
--- a/base/web/space.go
+++ b/base/web/space.go
@@ -3,6 +3,7 @@ package web
 import (
 	"math/rand"
 	"net"
+	"path"
 	"strings"
 	"time"
 
@@ -217,7 +218,7 @@ func _space_fork(m *ice.Message) {
 				m.Go(func(msg *ice.Message) {
 					switch m.Option(ice.CMD) {
 					case cli.PWD:
-						link := kit.MergeURL(_space_domain(m), aaa.GRANT, name)
+						link := kit.MergeURL2(_space_domain(m), path.Join("/chat/cmd/web.chat.grant", name))
 						msg.Sleep300ms(SPACE, name, cli.PWD, name, link, msg.Cmdx(cli.QRCODE, link))
 					case SSO:
 						link := _space_domain(m)
diff --git a/core/chat/action.go b/core/chat/action.go
index 964c9f9a..5e0acb0c 100644
--- a/core/chat/action.go
+++ b/core/chat/action.go
@@ -15,11 +15,11 @@ func _action_list(m *ice.Message, river, storm string) {
 }
 func _action_exec(m *ice.Message, river, storm, index string, arg ...string) {
 	m.Options(ice.MSG_RIVER, river, ice.MSG_STORM, storm)
-	if m.Warn(m.Cmd(STORM, index, func(value ice.Maps) {
+	if m.Warn(m.Cmd(STORM, index, arg, func(value ice.Maps) {
 		if index = value[ctx.INDEX]; value[web.SPACE] != "" {
 			m.Option(ice.POD, value[web.SPACE])
 		}
-	}).Length() == 0, ice.ErrNotFound, index) {
+	}).Length() == 0, ice.ErrNotRight, index, arg) {
 		return
 	}
 	if m.Option(ice.MSG_UPLOAD) != "" {
diff --git a/core/chat/grant.go b/core/chat/grant.go
index 25b3e98d..5a1c21d1 100644
--- a/core/chat/grant.go
+++ b/core/chat/grant.go
@@ -11,20 +11,14 @@ const GRANT = "grant"
 
 func init() {
 	Index.MergeCommands(ice.Commands{
-		GRANT: {Name: "grant space id auto insert", Help: "授权", Actions: ice.MergeActions(ice.Actions{
-			mdb.INPUTS: {Hand: func(m *ice.Message, arg ...string) {
-				switch arg[0] {
-				case web.SPACE:
-					m.Cmdy(web.SPACE).RenameAppend(mdb.NAME, web.SPACE).Cut("space,type")
-				case GRANT:
-					m.Cmdy(web.SPACE, m.Option(web.SPACE), web.SPACE).RenameAppend(mdb.NAME, GRANT).Cut("grant,type")
-				case aaa.USERROLE:
-					m.Push(arg[0], m.Option(ice.MSG_USERROLE))
-				case aaa.USERNAME:
-					m.Push(arg[0], m.Option(ice.MSG_USERNAME))
-				}
+		GRANT: {Name: "grant space id auto", Help: "授权", Actions: ice.MergeActions(ice.Actions{
+			"confirm": {Help: "通过", Hand: func(m *ice.Message, arg ...string) {
+				m.Cmd(web.SPACE, m.Option(web.SPACE), ice.MSG_SESSID, aaa.SessCreate(m, m.Option(ice.MSG_USERNAME)))
+				m.ProcessLocation(web.MergeURL2(m, ice.PS))
 			}},
-			mdb.INSERT: {Name: "insert space grant userrole username"},
-		}, mdb.ZoneAction(mdb.SHORT, web.SPACE, mdb.FIELD, "time,grant,userrole,username"))},
+		}, mdb.HashAction(mdb.SHORT, web.SPACE, mdb.FIELD, "time,space,userrole,username,usernick"), aaa.RoleAction("confirm")), Hand: func(m *ice.Message, arg ...string) {
+			m.Echo("请授权: %s 访问设备: %s", arg[0], ice.Info.HostName).Echo(ice.NL)
+			m.EchoButton("confirm")
+		}},
 	})
 }
diff --git a/core/chat/header.go b/core/chat/header.go
index 415c5375..b9cf99aa 100644
--- a/core/chat/header.go
+++ b/core/chat/header.go
@@ -10,17 +10,22 @@ import (
 	"shylinux.com/x/icebergs/base/mdb"
 	"shylinux.com/x/icebergs/base/tcp"
 	"shylinux.com/x/icebergs/base/web"
-	kit "shylinux.com/x/toolkits"
 )
 
 func _header_users(m *ice.Message, arg ...string) {
 	if m.Warn(m.Option(ice.MSG_USERNAME) == "", ice.ErrNotLogin) {
 		return
 	}
+	if m.Warn(m.Option(web.SHARE) != "", ice.ErrNotRight, "没有权限") {
+		return
+	}
 	m.Cmdy(aaa.USER, mdb.MODIFY, aaa.USERNAME, m.Option(ice.MSG_USERNAME), m.ActionKey(), m.Option(m.ActionKey(), arg[0]))
 }
 func _header_share(m *ice.Message, arg ...string) {
-	if m.Warn(m.Option(ice.MSG_USERNAME) == "", ice.ErrNotLogin) {
+	if m.Warn(m.Option(ice.MSG_USERNAME) == "", ice.ErrNotLogin, "没有登录") {
+		return
+	}
+	if m.Warn(m.Option(web.SHARE) != "", ice.ErrNotRight, "没有权限") {
 		return
 	}
 	for i := 0; i < len(arg)-1; i += 2 {
@@ -80,7 +85,7 @@ func init() {
 			aaa.AVATAR:     {Hand: _header_users},
 			web.SHARE:      {Hand: _header_share},
 			"webpack":      {Hand: ctx.CmdHandler("webpack", "build")},
-		}, ctx.ConfAction(aaa.LOGIN, kit.List("密码登录", "扫码授权")), aaa.BlackAction("webpack")), Hand: func(m *ice.Message, arg ...string) {
+		}, aaa.BlackAction("webpack")), Hand: func(m *ice.Message, arg ...string) {
 			if gdb.Event(m, HEADER_AGENT); !_header_check(m, arg...) {
 				return
 			}
diff --git a/core/chat/pod.go b/core/chat/pod.go
index 0dbc9480..d6568a34 100644
--- a/core/chat/pod.go
+++ b/core/chat/pod.go
@@ -23,14 +23,14 @@ func init() {
 				return
 			}
 			if len(arg) == 0 || kit.Select("", arg, 0) == "" {
-				web.RenderCmd(m, web.ROUTE)
+				web.RenderCmd(m, web.SPACE)
 			} else if len(arg) == 1 {
 				if m.Cmd(web.SPACE, arg[0]).Length() == 0 && !strings.Contains(arg[0], ice.PT) {
 					m.Cmd(web.DREAM, cli.START, mdb.NAME, arg[0])
 				}
 				web.RenderMain(aaa.UserRoot(m), arg[0], "")
 			} else if arg[1] == CMD {
-				m.Cmdy(web.SPACE, arg[0], m.Prefix(CMD), path.Join(arg[2:]...))
+				web.RenderPodCmd(m, arg[0], arg[2], arg[3:])
 			} else if arg[1] == WEBSITE {
 				web.RenderWebsite(m, arg[0], path.Join(arg[2:]...))
 			}
diff --git a/core/chat/river.go b/core/chat/river.go
index 57030b34..222fbf99 100644
--- a/core/chat/river.go
+++ b/core/chat/river.go
@@ -58,11 +58,9 @@ func init() {
 			}},
 		}, mdb.HashAction(mdb.FIELD, "time,hash,type,name,text,template"), aaa.WhiteAction()), Hand: func(m *ice.Message, arg ...string) {
 			if m.Warn(m.Option(ice.MSG_USERNAME) == "", ice.ErrNotLogin) {
-				m.RenderStatusUnauthorized()
 				return
 			}
 			if !aaa.Right(m, RIVER, arg) {
-				m.RenderStatusForbidden()
 				return
 			}
 			if len(arg) == 0 {
diff --git a/core/chat/sso.go b/core/chat/sso.go
index 06c6a41e..cd4458d6 100644
--- a/core/chat/sso.go
+++ b/core/chat/sso.go
@@ -14,13 +14,10 @@ const SSO = "sso"
 func init() {
 	Index.MergeCommands(ice.Commands{
 		web.P(SSO): {Name: "/sso", Help: "授权", Actions: aaa.WhiteAction(), Hand: func(m *ice.Message, arg ...string) {
-			if m.Option(ice.MSG_USERNAME) == "" {
+			if m.Option(ice.MSG_USERNAME) == "" || m.Warn(m.Option(cli.BACK) == "") {
 				web.RenderIndex(m, ice.VOLCANOS)
 				return
 			}
-			if m.Warn(m.Option(cli.BACK) == "") {
-				return
-			}
 			sessid := aaa.UserRoot(m).Cmdx(web.SPACE, m.Option(web.SPACE), aaa.SESS, mdb.CREATE, aaa.USERNAME, m.Option(ice.MSG_USERNAME),
 				aaa.USERROLE, m.Option(ice.MSG_USERROLE), aaa.USERNICK, m.Option(ice.MSG_USERNICK))
 			m.RenderRedirect(kit.MergeURL(m.Option(cli.BACK), ice.MSG_SESSID, sessid))
diff --git a/core/chat/storm.go b/core/chat/storm.go
index 87030d4f..e3ce92b4 100644
--- a/core/chat/storm.go
+++ b/core/chat/storm.go
@@ -39,7 +39,7 @@ func init() {
 				m.Cmdy(mdb.SELECT, RIVER, _river_key(m), mdb.HASH, ice.OptionFields("time,hash,name,text,count"))
 			} else if len(arg) == 0 || kit.Int(arg[0]) > 0 {
 				m.Cmdy(mdb.SELECT, RIVER, _storm_key(m), mdb.LIST, mdb.ID, arg, ice.OptionFields("time,id,space,index,args,style,display"))
-			} else if aaa.Right(m, arg[0]) {
+			} else if aaa.Right(m, arg) {
 				m.Push(ctx.INDEX, arg[0])
 			}
 		}},
diff --git a/core/code/vimer.go b/core/code/vimer.go
index cc35a60f..65925e8d 100644
--- a/core/code/vimer.go
+++ b/core/code/vimer.go
@@ -6,6 +6,7 @@ import (
 	"strings"
 
 	ice "shylinux.com/x/icebergs"
+	"shylinux.com/x/icebergs/base/aaa"
 	"shylinux.com/x/icebergs/base/cli"
 	"shylinux.com/x/icebergs/base/ctx"
 	"shylinux.com/x/icebergs/base/mdb"
@@ -50,7 +51,7 @@ const VIMER = "vimer"
 
 func init() {
 	Index.MergeCommands(ice.Commands{
-		VIMER: {Name: "vimer path=src/@key file=main.go line=1 list", Help: "编辑器", Actions: ice.Actions{
+		VIMER: {Name: "vimer path=src/@key file=main.go line=1 list", Help: "编辑器", Actions: ice.MergeActions(ice.Actions{
 			mdb.INPUTS: {Hand: func(m *ice.Message, arg ...string) {
 				switch m.Option(ctx.ACTION) {
 				case AUTOGEN, web.DREAM, XTERM:
@@ -169,7 +170,7 @@ func init() {
 			PUBLISH: {Name: "publish", Help: "发布", Hand: func(m *ice.Message, arg ...string) {
 				m.Cmdy(PUBLISH, ice.CONTEXTS)
 			}},
-		}, Hand: func(m *ice.Message, arg ...string) {
+		}, aaa.RoleAction(ctx.COMMAND)), Hand: func(m *ice.Message, arg ...string) {
 			if m.Cmdy(INNER, arg); arg[0] != ctx.ACTION {
 				m.Action(AUTOGEN, nfs.SCRIPT, web.WEBSITE, web.DREAM, nfs.SAVE, COMPILE)
 				m.Option("tabs", m.Config("show.tabs"))
diff --git a/core/team/plan.go b/core/team/plan.go
index d3de153f..33ff84b3 100644
--- a/core/team/plan.go
+++ b/core/team/plan.go
@@ -69,7 +69,7 @@ func init() {
 					m.Cmdy(arg)
 				}
 			}},
-		}, TASK, ctx.CmdAction()), Hand: func(m *ice.Message, arg ...string) {
+		}, TASK, ctx.CmdAction(), aaa.RoleAction(ctx.COMMAND)), Hand: func(m *ice.Message, arg ...string) {
 			begin_time, end_time := _plan_scope(m, kit.Slice(arg, 0, 2)...)
 			_plan_list(m, begin_time.Format(ice.MOD_TIME), end_time.Format(ice.MOD_TIME))
 			web.PushPodCmd(m, "", arg...)
diff --git a/core/wiki/word.go b/core/wiki/word.go
index 3057900d..32d0eac5 100644
--- a/core/wiki/word.go
+++ b/core/wiki/word.go
@@ -41,7 +41,7 @@ func init() {
 				})
 			}}, "play": {Name: "play", Help: "演示"},
 			ice.STORY: {Hand: func(m *ice.Message, arg ...string) { m.Cmdy(arg[0], ice.RUN, arg[2:]) }},
-		}, WikiAction("", nfs.SHY), ctx.CmdAction(), aaa.RoleAction()), Hand: func(m *ice.Message, arg ...string) {
+		}, WikiAction("", nfs.SHY), ctx.CmdAction(), aaa.RoleAction("story.field")), Hand: func(m *ice.Message, arg ...string) {
 			if m.Option(nfs.DIR_DEEP, ice.TRUE); len(arg) == 0 {
 				arg = append(arg, "src/")
 			}
diff --git a/logs.go b/logs.go
index 7ed22300..3b19ceb3 100644
--- a/logs.go
+++ b/logs.go
@@ -113,13 +113,14 @@ func (m *Message) Warn(err Any, arg ...Any) bool {
 	}
 	str, meta := m.join(arg...)
 	m.log(LOG_WARN, str, meta...)
-	m.error(arg...)
-	if len(arg) > 0 {
-		switch kit.Format(arg[0]) {
-		case ErrNotLogin:
-			m.RenderStatusUnauthorized()
-		case ErrNotRight:
-			m.RenderStatusForbidden()
+	if !m.IsErr() {
+		if m.error(arg...); len(arg) > 0 {
+			switch kit.Format(arg[0]) {
+			case ErrNotLogin:
+				m.RenderStatusUnauthorized(str)
+			case ErrNotRight:
+				m.RenderStatusForbidden(str)
+			}
 		}
 	}
 	return true
diff --git a/misc/git/status.go b/misc/git/status.go
index 52004616..cf87478b 100644
--- a/misc/git/status.go
+++ b/misc/git/status.go
@@ -200,7 +200,7 @@ const STATUS = "status"
 
 func init() {
 	Index.MergeCommands(ice.Commands{
-		STATUS: {Name: "status repos auto", Help: "状态机", Actions: ice.Actions{
+		STATUS: {Name: "status repos auto", Help: "状态机", Actions: ice.MergeActions(ice.Actions{
 			mdb.INPUTS: {Hand: func(m *ice.Message, arg ...string) {
 				switch arg[0] {
 				case mdb.NAME, REPOS:
@@ -317,7 +317,7 @@ func init() {
 			code.DEVPACK: {Name: "devpack", Help: "开发模式", Hand: func(m *ice.Message, arg ...string) {
 				m.Cmdy(code.VIMER, code.DEVPACK)
 			}},
-		}, Hand: func(m *ice.Message, arg ...string) {
+		}, aaa.RoleAction()), Hand: func(m *ice.Message, arg ...string) {
 			if _configs_get(m, "user.email") == "" {
 				m.Echo("please config user.email")
 				m.Action(CONFIGS)
diff --git a/render.go b/render.go
index 0bde13e1..853451b3 100644
--- a/render.go
+++ b/render.go
@@ -70,11 +70,11 @@ func (m *Message) RenderStatus(status int) *Message {
 func (m *Message) RenderStatusBadRequest() *Message {
 	return m.Render(RENDER_STATUS, http.StatusBadRequest)
 }
-func (m *Message) RenderStatusUnauthorized() *Message {
-	return m.Render(RENDER_STATUS, http.StatusUnauthorized)
+func (m *Message) RenderStatusUnauthorized(arg ...string) *Message {
+	return m.Render(RENDER_STATUS, http.StatusUnauthorized, arg)
 }
-func (m *Message) RenderStatusForbidden() *Message {
-	return m.Render(RENDER_STATUS, http.StatusForbidden)
+func (m *Message) RenderStatusForbidden(arg ...string) *Message {
+	return m.Render(RENDER_STATUS, http.StatusForbidden, arg)
 }
 func (m *Message) RenderStatusNotFound() *Message {
 	return m.Render(RENDER_STATUS, http.StatusNotFound)