diff --git a/const.js b/const.js
index a0d0db84..840ab14a 100644
--- a/const.js
+++ b/const.js
@@ -57,7 +57,7 @@ var mdb = {FOREACH: "*", RANDOMS: "%",
 	TYPE: "type", NAME: "name", TEXT: "text", ICON: "icon", ICONS: "icons",
 	KEY: "key", VALUE: "value", STATUS: "status", EXPIRE: "expire", EXTRA: "extra",
 	SHORT: "short", FIELD: "field", COUNT: "count", TOTAL: "total", INDEX: "index", LIMIT: "limit",
-	DATA: "data", VIEW: "view",
+	DATA: "data", VIEW: "view", ORDER: "order",
 	INPUTS: "inputs", CREATE: "create", REMOVE: "remove", UPDATE: "update",
 	INSERT: "insert", DELETE: "delete", MODIFY: "modify", SELECT: "select",
 	PRUNES: "prunes", EXPORT: "export", IMPORT: "import",
diff --git a/frame.js b/frame.js
index a16fb574..f42f45e9 100644
--- a/frame.js
+++ b/frame.js
@@ -347,7 +347,7 @@ Volcanos(chat.ONAPPEND, {_init: function(can, meta, list, cb, target, field) {
 		}, _init: function(target) { can.page.style(can, target, html.WIDTH, (select.offsetWidth||80)+10), can.onappend.style(can, html.HIDE, select) }}, {icon: mdb.SELECT}])
 	},
 	table: function(can, msg, cb, target, keys) { if (!msg || msg.Length() == 0) { return } var meta = can.base.Obj(msg.Option(mdb.META))
-		if (can.user.isMobile) { can.base.toLast(msg.append, mdb.TIME), can.base.toLast(msg.append, web.LINK) } can.base.toLast(msg.append, ctx.ACTION)
+		if (can.user.isMobile) { can.base.toLast(msg.append, mdb.TIME) } can.base.toLast(msg.append, web.LINK), can.base.toLast(msg.append, ctx.ACTION)
 		var table = can.page.AppendTable(can, msg, target||can._output, msg.append, cb||function(value, key, index, data, list) {
 			if (msg.append.length == 2 && msg.append[0] == mdb.KEY && msg.append[1] == mdb.VALUE) { if (key == mdb.VALUE) { key = data.key } data = {}, can.core.List(list, function(item) { data[item.key] = item.value }) }
 			function run(event, cmd, arg) { can.misc.Event(event, can, function(msg) { can.run(can.request(event, data, can.Option()), [ctx.ACTION, cmd].concat(arg)) }) }
@@ -491,7 +491,8 @@ Volcanos(chat.ONAPPEND, {_init: function(can, meta, list, cb, target, field) {
 	},
 	tabview: function(can, meta, list, target) { var ui = can.page.Append(can, target, [html.ACTION, html.OUTPUT])
 		can.core.List(can.base.getValid(list, can.core.Item(meta)), function(name, index) {
-			ui[name] = can.page.Append(can, ui.action, [{text: name, onclick: function(event) {
+			ui[name] = can.page.Append(can, ui.action, [{view: [html.TABS, html.DIV, name], onclick: function(event) {
+				can.onmotion.select(can, ui.action, html.DIV_TABS, event.target)
 				if (can.onmotion.cache(can, function() { return name }, ui.output)) { return } meta[name](ui.output)
 			}, _init: function(target) { index == 0 && can.onmotion.delay(can, function() { target.click() }) }}])._target
 		}); return ui._target = target, ui
diff --git a/index.css b/index.css
index ca45aaed..c2fa8c20 100644
--- a/index.css
+++ b/index.css
@@ -162,11 +162,19 @@ body>div.input textarea { height:120px; width:240px !important; }
 body>div.input div.action { width:100%; position:sticky; bottom:0; }
 body>div.input div.action>div.item { margin:5px; float:right; }
 body>div.input div.action>div.item>input[type=button] { width:110px; }
+body>div.input.login { box-shadow:unset; }
+body>div.input.login>div.action { display: flex; justify-content: center; border-bottom:var(--box-border); }
+body>div.input.login>div.action>div.tabs { padding:10px; }
 body>div.input.login>div.output { text-align:center; clear:both; }
-body>div.input.login>div.output div.sso { display:flex; justify-content:center; cursor:pointer; }
-body>div.input.login>div.output div.sso:hover { background-color:var(--hover-bg-color); }
-body>div.input.login>div.output div.sso>img { height:32px; }
-body>div.input.login>div.output div.sso>span { line-height:32px; }
+body>div.input.login>div.output>fieldset { box-shadow:none; }
+body>div.input.login>div.output>fieldset>div.output { background-color:transparent; }
+body>div.input.login>div.output { height:360px; width:420px; }
+body>div.input.login>div.display>span.item { font-style:italic; padding-left:5px; border-left:var(--notice-bg-color) solid 5px; }
+body>div.input.login>div.display div.sso { display:flex; justify-content:center; cursor:pointer; }
+body>div.input.login>div.display div.sso div.item { display:flex; align-items:center; padding:10px; }
+body>div.input.login>div.display div.sso div.item:hover { background-color:var(--hover-bg-color); }
+body>div.input.login>div.display div.sso div.item>img { height:32px; }
+body>div.input.login>div.display div.sso div.item>span { line-height:32px; padding:5px; }
 body>div.input.simple td:first-child { display:none; }
 body>div.upload div.action input[type=file] { width:320px; }
 body>div.upload div.output { border:var(--box-notice); }
@@ -415,7 +423,8 @@ div.carte div.item:hover { background-color:var(--hover-bg-color); }
 div.carte div.item.danger:hover { background-color:var(--danger-bg-color); color:var(--danger-fg-color); }
 div.carte div.item.notice:hover { background-color:var(--notice-bg-color); color:var(--notice-fg-color); }
 /* mobile */
-body.cmd.mobile { overflow:hidden; }
+body.mobile.cmd { overflow:hidden; }
+body.mobile.login>fieldset.panel.Action>div.output { background-color: var(--panel-output-bg-color); }
 body.mobile table.content { width:100%; }
 body.mobile form.option>div.item:not(.icon) { margin-right:var(--button-margin); }
 body.mobile:not(.cmd) form.option>div.item.button.icons>input { display:none; }
@@ -505,6 +514,7 @@ fieldset.qrcode>div.output div.code { padding:0; }
 fieldset.macos.desktop.cmd>div.output>fieldset.macos.dock { z-index:11; }
 fieldset.web.code.git.status>div.output table.content { width:100%; }
 fieldset.web.code.git>div.output>fieldset.web.code.inner>div.output { overflow:auto; }
+fieldset.web.chat.wx.scan>div.output>table.content tr.expired { color:var(--disable-fg-color); }
 
 fieldset.web.mall.region>div.output>table.content td:nth-child(3) { text-align:right; }
 fieldset.web.mall.region>div.output>table.content td:nth-child(3) { text-align:right; }
diff --git a/lib/page.js b/lib/page.js
index 1fe3e7d1..b692f047 100644
--- a/lib/page.js
+++ b/lib/page.js
@@ -205,7 +205,7 @@ Volcanos("page", {
 		}
 	},
 	Format: function(type) { var arg = arguments; switch (type) {
-		case html.A: return `<a href="${arg[1]}" target="_blank">${arg[2]||arg[1]}"</a>`
+		case html.A: return `<a href="${arg[1]}" target="_blank">${arg[2]||arg[1]}</a>`
 		case html.IMG: return arg[3]? `<img src="${arg[1]}" height="${arg[2]}" width=${arg[3]}>`: arg[2]? `<img src="${arg[1]}" height="${arg[2]}">`: `<img src="${arg[1]}">`
 		case html.SPAN: arg[2] && typeof arg[2] == code.OBJECT && arg[2].join && (arg[2] = arg[2].join(lex.SP))
 			return arg[2]?  `<span class="${arg[2]}">${arg[1]}</span>`: arg[1]
diff --git a/lib/user.js b/lib/user.js
index 232a1c91..1e1be077 100644
--- a/lib/user.js
+++ b/lib/user.js
@@ -254,23 +254,27 @@ Volcanos("user", {
 			can.user.input(event, can, [{name: mdb.NAME, value: name}], function(list) { can.user.download(can, url, list[0], nfs.PNG) })
 		}), resize: html.IMG,
 	}) },
-	login: function(can, cb, msg) { can.misc.CookieSessid(can, "")
-		function layout() { can.page.style(can, ui._target, {left: (window.innerWidth-ui._target.offsetWidth)/2, top: window.innerHeight/8}) }
-		var ui = can.onappend.tabview(can, {
-			"扫码授权": function(target) { var socket = can.misc.WSS(can, {type: aaa.LOGIN}, function(cmd, arg) {
-				if (cmd == cli.PWD) { var _cmd = " space login "+arg[0]; can.onmotion.delay(can, function() { layout() })
-					return can.page.Modify(can, target, arg[2]), can.page.Append(can, target, [
-						{text: "<br/>或命令授权: "}, {text: [_cmd, "", html.ITEM], title: "点击复制，并后台执行此命令，即可登录", style: {cursor: "copy"}, onclick: function() { can.user.copy(event, can, _cmd) }},
-					].concat(msg.Table(function(value) {
-						return {view: "sso", list: [{img: can.misc.Resource(can, value.icon)}, {text: value.name}], onclick: function() { can.user.jumps(value.url) }}
-					})))
-				} else if (cmd == ice.MSG_SESSID) { can.onmotion.delay(can, function() { socket.close() })
-					if (!can.misc.CookieSessid(can, arg[0])) { can.user.info.sessid = arg[0] }
-					return can.page.Remove(can, ui._target), can.base.isFunc(cb) && cb(), cb = null
-				}
-			}) },
-		}, ["扫码授权"], can.page.Append(can, document.body, [{view: "input login float"}])._target); can.onmotion.delay(can, function() { layout() })
-	},
+	login: function(can, cb, msg) { can.misc.CookieSessid(can, ""); var ui, socket = can.misc.WSS(can, {type: aaa.LOGIN}, function(cmd, arg) {
+		can.page.ClassList.add(can, document.body, aaa.LOGIN)
+		if (cmd == cli.PWD) { var list = {"扫码授权": function(target) { can.page.Modify(can, target, arg[2]) }}
+			msg.Table(function(value) { if (value.type == mdb.PLUGIN) { list[value.name] = function(target) {
+				can.onappend.plugin(can, {space: value.space, index: value.index, args: can.core.Split(value.args), style: html.OUTPUT, width: 420}, function(sub) {
+					var run = sub.run; sub.run = function(event, cmds, cb) { var msg = can.request(event, {space: arg[0]}); can.page.exportValue(can, msg), run(event, cmds, cb) }
+				}, ui.output)
+			} } })
+			ui = can.onappend.tabview(can, list, can.core.Item(list), can.page.Append(can, document.body, [{view: "input login float"}])._target)
+			can.page.style(can, ui._target, {left: (window.innerWidth-ui._target.offsetWidth)/2, top: can.user.isMobile? 48: window.innerHeight/8})
+			var _cmd = "space login "+arg[0]; ui.display = can.page.Append(can, ui._target, [html.DISPLAY])._target
+			can.page.Appends(can, ui.display, [{text: "<br/>或命令授权: "}, {text: [_cmd, "", html.ITEM], title: "点击复制，并后台执行此命令，即可登录", style: {cursor: "copy"}, onclick: function() { can.user.copy(event, can, _cmd) }}])
+			can.page.Append(can, ui.display, [{view: "sso", list: msg.Table(function(value) {
+				return value.type == "oauth" && {view: html.ITEM, title: "点击跳转，授权登录", list: [{img: can.misc.Resource(can, value.icons)}, {text: value.name}], onclick: function() { can.user.jumps(value.link) }}
+			}) }])
+		} else if (cmd == ice.MSG_SESSID) { can.onmotion.delay(can, function() { socket.close() })
+			if (!can.misc.CookieSessid(can, arg[0])) { can.user.info.sessid = arg[0] }
+			can.page.ClassList.del(can, document.body, aaa.LOGIN)
+			return can.page.Remove(can, ui._target), can.base.isFunc(cb) && cb(), cb = null
+		}
+	}) },
 	logout: function(can) { can.user.toastConfirm(can, aaa.LOGOUT, "", function() { can.runAction({}, aaa.LOGOUT, [], function(msg) {
 		can.misc.CookieSessid(can, ""), can.misc.Search(can, chat.SHARE)? can.misc.Search(can, chat.SHARE, ""): can.user.reload(true)
 	}) }) },
diff --git a/panel/header.js b/panel/header.js
index f88890c4..0b5316d7 100644
--- a/panel/header.js
+++ b/panel/header.js
@@ -65,7 +65,8 @@ Volcanos(chat.ONACTION, {_init: function(can) {
 		can.run(can.request({}, {_method: http.GET}), [], function(msg) { lang(msg)
 			can.onaction._menus[1] = [chat.THEME, ice.AUTO].concat(can.core.List(msg["theme.list"], function(item) { return can.base.trimSuffix(item, ".css") }))
 			can.onaction._menus[2] = [aaa.LANGUAGE, ice.AUTO].concat(can.core.List(msg["language.list"], function(item) { return can.base.trimSuffix(item, ".js") }))
-			can.require(can.core.List(msg["theme.list"], function(item) { return "src/template/web.chat.header/theme/"+item }), function() { can.page.requireModules(can, [msg.Option(mdb.ICONS)])
+			can.require(can.core.List(msg["theme.list"], function(item) { return "src/template/web.chat.header/theme/"+item }), function() {
+				can.page.requireModules(can, [msg.Option("icon.lib")])
 				if (can.base.beginWith(location.pathname, "/wiki/portal/", "/chat/cmd/web.wiki.portal/", "/chat/cmd/web.chat.oauth.client", "/chat/pod/20230511-golang-story/cmd/web.code.gitea.client")) { return show(msg) }
 				if (location.pathname == "/" && can.base.beginWith(msg.Option(ice.MAIN)||"", "/wiki/portal/", "/chat/cmd/web.wiki.portal/")) { return show(msg) }
 				if (!can.Conf(aaa.USERNICK, msg.Option(aaa.USERNICK)||msg.Option(ice.MSG_USERNICK)||msg.Option(ice.MSG_USERNAME))) {