diff --git a/frame.js b/frame.js
index f42f45e9..1eff12c3 100644
--- a/frame.js
+++ b/frame.js
@@ -142,7 +142,7 @@ Volcanos(chat.ONAPPEND, {_init: function(can, meta, list, cb, target, field) {
 				}) })
 			}), can.base.isFunc(cb) && cb(sub)
 			if (sub.isOutputStyle()) { return } if (can.user.isMobile && !can.user.isLandscape()) { return }
-			sub.isCmdMode() && !can.base.isIn(meta.index, web.CODE_VIMER, web.CODE_INNER, web.CHAT_MACOS_DESKTOP) && can.page.insertBefore(can, can.user.header(can), sub._output, sub._fields)
+			sub.isCmdMode() && !can.base.isIn(meta.index, web.CODE_VIMER, web.CODE_INNER, web.CHAT_MACOS_DESKTOP) && can.page.insertBefore(can, can.user.header(can), sub._output, sub._fields||sub._target)
 		}); return sub
 	},
 	_option: function(can, meta, option, skip) { var index = -1, args = can.base.Obj(meta.args||meta.arg, []), opts = can.base.Obj(meta.opts, {})
@@ -331,7 +331,7 @@ Volcanos(chat.ONAPPEND, {_init: function(can, meta, list, cb, target, field) {
 		}
 	},
 	select: function(can, select, item) { // can.user.trans(can, item.value||item.values[0])
-		var trans = {}; can.core.List(item.values, function(value) { trans[can.user.trans(can, value, null, html.INPUT)] = value })
+		var trans = {}; can.core.List(item.values, function(value) { trans[can.user.trans(can, value, null, html.VALUE)] = value })
 		return can.page.Append(can, select.parentNode, [{type: html.INPUT, data: {className: html.SELECT, type: html.BUTTON, name: item.name, value: can.user.trans(can, item.value||item.values[0], null, html.VALUE), title: can.user.trans(can, item.name, null, html.VALUE)}, onclick: function(event) { var target = event.target
 			var carte = can.user.carte(event, can, {}, can.core.List(item.values, function(item) {
 				return can.user.trans(can, item, null, html.VALUE)
diff --git a/index.css b/index.css
index c2fa8c20..66155e31 100644
--- a/index.css
+++ b/index.css
@@ -132,6 +132,7 @@ body>div.toast div.action>div.item { float:right; }
 body>div.carte { padding:0; }
 body>div.carte input[name=filter] { margin:5px; width:calc(100% - 10px); position:sticky; top:5px; }
 body>div.carte div.item { white-space:pre; padding:5px 10px; }
+body.mobile>div.carte div.item { padding:10px; }
 body>div.carte div.item span.icon.next { float:right; line-height:22px; height:22px; }
 body>div.carte.select.float>div.item { text-align:center; }
 body>div.input { padding:20px; }
@@ -162,14 +163,17 @@ body>div.input textarea { height:120px; width:240px !important; }
 body>div.input div.action { width:100%; position:sticky; bottom:0; }
 body>div.input div.action>div.item { margin:5px; float:right; }
 body>div.input div.action>div.item>input[type=button] { width:110px; }
+body.mobile.landscape>div.input.login { padding:0; }
+body.mobile.landscape>div.input.login div.output img { max-height:280px; }
 body>div.input.login { box-shadow:unset; }
 body>div.input.login>div.action { display: flex; justify-content: center; border-bottom:var(--box-border); }
 body>div.input.login>div.action>div.tabs { padding:10px; }
 body>div.input.login>div.output { text-align:center; clear:both; }
 body>div.input.login>div.output>fieldset { box-shadow:none; }
 body>div.input.login>div.output>fieldset>div.output { background-color:transparent; }
-body>div.input.login>div.output { height:360px; width:420px; }
-body>div.input.login>div.display>span.item { font-style:italic; padding-left:5px; border-left:var(--notice-bg-color) solid 5px; }
+body>div.input.login>div.output { height:380px; width:420px; overflow:hidden; }
+body.mobile.landscape>div.input.login>div.output { height:290px; }
+body>div.input.login>div.display>span.item { font-style:italic; word-break:break-all; padding-left:5px; border-left:var(--notice-bg-color) solid 5px; }
 body>div.input.login>div.display div.sso { display:flex; justify-content:center; cursor:pointer; }
 body>div.input.login>div.display div.sso div.item { display:flex; align-items:center; padding:10px; }
 body>div.input.login>div.display div.sso div.item:hover { background-color:var(--hover-bg-color); }
@@ -425,6 +429,12 @@ div.carte div.item.notice:hover { background-color:var(--notice-bg-color); color
 /* mobile */
 body.mobile.cmd { overflow:hidden; }
 body.mobile.login>fieldset.panel.Action>div.output { background-color: var(--panel-output-bg-color); }
+div.output>div.code>div.form { font-size:15px; padding:60px 10px; text-align:center; }
+div.output>div.code>div.form>input[type=button][name=confirm] { background-color:var(--notice-bg-color); color:var(--notice-fg-color); margin:10px 0; }
+div.output>div.code>div.form>input[type=button] { min-width:200px; }
+body.mobile div.output>div.code>div.form input[type=button] { width:100%; }
+
+/* body.login>fieldset.panel { display:none; } */
 body.mobile table.content { width:100%; }
 body.mobile form.option>div.item:not(.icon) { margin-right:var(--button-margin); }
 body.mobile:not(.cmd) form.option>div.item.button.icons>input { display:none; }
diff --git a/lib/misc.js b/lib/misc.js
index 5487f9f2..26d71553 100644
--- a/lib/misc.js
+++ b/lib/misc.js
@@ -81,6 +81,7 @@ Volcanos("misc", {
 			return msg.result && msg.result[0] == "warn: "
 		},
 		_caller: function(skip) { msg.Option("log.caller") || msg.Option("log.caller", can.misc.fileLine((skip||2)+3).link); return msg },
+		isDebug: function() { return msg.Option(log.DEBUG) == ice.TRUE },
 	}); return msg },
 	Event: function(event, can, cb) { for (var i = 3; i < arguments.length; i++) { can.request(event, arguments[i]) } cb(can.request(event)) },
 	Run: function(event, can, dataset, cmds, cb) { var msg = can.request(event), _can = msg._can; _can._fields && _can.sup && (_can = _can.sup)
diff --git a/lib/page.js b/lib/page.js
index b692f047..da41cc47 100644
--- a/lib/page.js
+++ b/lib/page.js
@@ -246,7 +246,10 @@ Volcanos("page", {
 	},
 	insertBefore: function(can, target, before, parent) { parent = parent||before.parentNode
 		if (can.base.isArray(target)) {
-			return can.core.List(target, function(item) { var target = can.page.Append(can, parent, [item])._target; return parent.insertBefore(target, before), target })[0]
+			return can.core.List(target, function(item) { if (!item) { return }
+				var target = can.page.Append(can, parent, [item])._target
+				return parent.insertBefore(target, before), target
+			})[0]
 		} return before && parent.insertBefore(target, before), target
 	},
 	styleHeight: function(can, target, value) { return can.page.style(can, target, html.HEIGHT, value), target.offsetHeight },
diff --git a/lib/user.js b/lib/user.js
index 1e1be077..b666bb4f 100644
--- a/lib/user.js
+++ b/lib/user.js
@@ -254,25 +254,27 @@ Volcanos("user", {
 			can.user.input(event, can, [{name: mdb.NAME, value: name}], function(list) { can.user.download(can, url, list[0], nfs.PNG) })
 		}), resize: html.IMG,
 	}) },
-	login: function(can, cb, msg) { can.misc.CookieSessid(can, ""); var ui, socket = can.misc.WSS(can, {type: aaa.LOGIN}, function(cmd, arg) {
-		can.page.ClassList.add(can, document.body, aaa.LOGIN)
-		if (cmd == cli.PWD) { var list = {"扫码授权": function(target) { can.page.Modify(can, target, arg[2]) }}
-			msg.Table(function(value) { if (value.type == mdb.PLUGIN) { list[value.name] = function(target) {
+	login: function(can, cb, msg) { can.misc.CookieSessid(can, ""); var socket = can.misc.WSS(can, {type: aaa.LOGIN}, function(cmd, arg) {
+		if (cmd == cli.PWD) { if (can.misc.CookieSessid(can)) { return }
+			can.page.ClassList.add(can, document.body, aaa.LOGIN)
+			var list = {}; msg.Table(function(value) { if (value.order == "") {} else if (value.type == mdb.PLUGIN) { list[value.name] = function(target) {
 				can.onappend.plugin(can, {space: value.space, index: value.index, args: can.core.Split(value.args), style: html.OUTPUT, width: 420}, function(sub) {
 					var run = sub.run; sub.run = function(event, cmds, cb) { var msg = can.request(event, {space: arg[0]}); can.page.exportValue(can, msg), run(event, cmds, cb) }
 				}, ui.output)
+			} } else if (value.type == cli.QRCODE) { list[value.name] = function(target) {
+				can.page.Modify(can, target, arg[2])
 			} } })
-			ui = can.onappend.tabview(can, list, can.core.Item(list), can.page.Append(can, document.body, [{view: "input login float"}])._target)
-			can.page.style(can, ui._target, {left: (window.innerWidth-ui._target.offsetWidth)/2, top: can.user.isMobile? 48: window.innerHeight/8})
+			var ui = can.onappend.tabview(can, list, can.core.Item(list), can.page.Append(can, document.body, [{view: "input login float"}])._target)
+			can.page.style(can, ui._target, {left: (window.innerWidth-ui._target.offsetWidth)/2, top: can.user.isMobile? can.user.isLandscape()? 0 :48 :window.innerHeight/8})
 			var _cmd = "space login "+arg[0]; ui.display = can.page.Append(can, ui._target, [html.DISPLAY])._target
 			can.page.Appends(can, ui.display, [{text: "<br/>或命令授权: "}, {text: [_cmd, "", html.ITEM], title: "点击复制，并后台执行此命令，即可登录", style: {cursor: "copy"}, onclick: function() { can.user.copy(event, can, _cmd) }}])
 			can.page.Append(can, ui.display, [{view: "sso", list: msg.Table(function(value) {
 				return value.type == "oauth" && {view: html.ITEM, title: "点击跳转，授权登录", list: [{img: can.misc.Resource(can, value.icons)}, {text: value.name}], onclick: function() { can.user.jumps(value.link) }}
 			}) }])
-		} else if (cmd == ice.MSG_SESSID) { can.onmotion.delay(can, function() { socket.close() })
+		} else if (cmd == ice.MSG_SESSID) { can.page.ClassList.del(can, document.body, aaa.LOGIN)
 			if (!can.misc.CookieSessid(can, arg[0])) { can.user.info.sessid = arg[0] }
-			can.page.ClassList.del(can, document.body, aaa.LOGIN)
-			return can.page.Remove(can, ui._target), can.base.isFunc(cb) && cb(), cb = null
+			can.onmotion.clearFloat(can), can.onmotion.delay(can, function() { socket.close() })
+			return can.base.isFunc(cb) && cb(), cb = null
 		}
 	}) },
 	logout: function(can) { can.user.toastConfirm(can, aaa.LOGOUT, "", function() { can.runAction({}, aaa.LOGOUT, [], function(msg) {
@@ -280,7 +282,6 @@ Volcanos("user", {
 	}) }) },
 	header: function(can) { if (!can._root) { return } var header = can._root.Header
 		var meta = {
-			// space: {view: [[html.ITEM, html.SPACE]], style: {"flex-grow": "1"}},
 			time: !can.user.isMobile && {view: [[html.ITEM, mdb.TIME]], _init: function(target) {
 				can.onappend.figure(can, {action: "date", _hold: true}, target, function(sub, value) {})
 				can.core.Timer({interval: 100}, function() { can.page.Modify(can, target, can.user.time(can, null, "%H:%M:%S %w")) })
diff --git a/panel/footer.css b/panel/footer.css
index 6e5693e5..950a2db7 100644
--- a/panel/footer.css
+++ b/panel/footer.css
@@ -13,8 +13,9 @@ fieldset.Footer>div.output div.menu>div.River { display:flex; justify-content:sp
 fieldset.Footer>div.output div.menu>div.River>div.item { display:flex; flex-direction:column; text-align:center; flex-grow:1; }
 fieldset.Footer>div.output div.menu>div.River>div.item>i { font-size:24px; margin-right:0; }
 fieldset.Footer>div.output div.menu>div.River>div.item>span { font-size:12px; }
-body.mobile fieldset.Footer>div.output { font-style:italic; height:60px; overflow:hidden; }
+body.mobile fieldset.Footer>div.output { font-style:italic; height:80px; overflow:hidden; }
 body.mobile fieldset.Footer>div.output div.cmd { display:none; }
+body.mobile fieldset.Footer>div.output div.toast { display:none; }
 
 .picker { box-shadow:4px 4px 20px 4px #626bd0; }
 div.view span.keyword { color:#5cadd4; }
diff --git a/panel/header.js b/panel/header.js
index 0b5316d7..6a0572da 100644
--- a/panel/header.js
+++ b/panel/header.js
@@ -9,7 +9,7 @@ Volcanos(chat.ONIMPORT, {_init: function(can, msg, target) {
 			can.core.CallFunc([can.onaction, item], [event, can, item])
 		}}]); return }
 		if (can.user.isMobile && item == mdb.TIME) { return }
-		can.page.Append(can, target, [{view: [[html.ITEM, chat.STATE, item], "", (can.Conf(item)||msg.Option(item)||"").split(ice.AT)[0].slice(0, 10)], onclick: function(event) {
+		can.page.Append(can, target, [{view: [[html.ITEM, chat.STATE, item], "", can.Conf(item)||msg.Option(item)||""], onclick: function(event) {
 			can.core.CallFunc([can.onaction, item], [event, can, item])
 		}, _init: function(target) { item == mdb.TIME && can.onimport._time(can, target) }}])
 	}) },
@@ -59,7 +59,7 @@ Volcanos(chat.ONACTION, {_init: function(can) {
 			can.user.info.usernick = can.Conf(aaa.USERNICK), can.user.info.userrole = msg.Option(ice.MSG_USERROLE), can.user.info.avatar = msg.Option(aaa.AVATAR), can.user.info.background = msg.Option(aaa.BACKGROUND)
 			can.user.info.email = msg.Option(aaa.EMAIL), can.user.info.repos = msg.Option(nfs.REPOS)
 			msg.Option(nfs.SCRIPT) && can.require(can.base.Obj(msg.Option(nfs.SCRIPT)), function(can) { can.onaction.source(can, msg) }) 
-			msg.Option(mdb.PLUGIN) && can.onappend.plugin(can, {index: msg.Option(mdb.PLUGIN)}, function() {}, document.body)
+			msg.Option(mdb.PLUGIN) && can.onappend.plugin(can, {index: msg.Option(mdb.PLUGIN)}, function(sub) { can.onmotion.hidden(can, sub._target) }, document.body)
 			lang(msg, function() { can.onmotion.clear(can), can.onimport._init(can, can.request(), can._output), can.onengine.signal(can, chat.ONLOGIN) })
 		}
 		can.run(can.request({}, {_method: http.GET}), [], function(msg) { lang(msg)
@@ -69,7 +69,7 @@ Volcanos(chat.ONACTION, {_init: function(can) {
 				can.page.requireModules(can, [msg.Option("icon.lib")])
 				if (can.base.beginWith(location.pathname, "/wiki/portal/", "/chat/cmd/web.wiki.portal/", "/chat/cmd/web.chat.oauth.client", "/chat/pod/20230511-golang-story/cmd/web.code.gitea.client")) { return show(msg) }
 				if (location.pathname == "/" && can.base.beginWith(msg.Option(ice.MAIN)||"", "/wiki/portal/", "/chat/cmd/web.wiki.portal/")) { return show(msg) }
-				if (!can.Conf(aaa.USERNICK, msg.Option(aaa.USERNICK)||msg.Option(ice.MSG_USERNICK)||msg.Option(ice.MSG_USERNAME))) {
+				if (!can.Conf(aaa.USERNICK, (msg.Option(aaa.USERNICK)||msg.Option(ice.MSG_USERNICK)||msg.Option(ice.MSG_USERNAME)).slice(0, 8))) {
 					return can.user.login(can, function() { can.onengine.signal(can, chat.ONMAIN, msg) }, msg)
 				} show(msg)
 			})
diff --git a/panel/river.js b/panel/river.js
index 95e62902..323c2c20 100644
--- a/panel/river.js
+++ b/panel/river.js
@@ -129,7 +129,11 @@ Volcanos(chat.ONENGINE, {_engine: function(event, can, msg, panel, cmds, cb) { v
 		}
 	})
 	if (cmds.length != 1 && cmds[1] != chat.STORM) { return false } var river = list[cmds[0]]; if (!river) { return false }
-	can.core.ItemOrder(river.storm, "order", function(key, value) { msg.Push({hash: key, name: can.user.isEnglish(can)? key: value.name, icon: value.icon||""}) })
+	can.core.ItemOrder(river.storm, "order", function(key, value) {
+		if (can.user.info.userrole == aaa.ROOT || can.base.isIn(value.type||"", "", aaa.VOID, can.user.info.userrole)) {
+			msg.Push({hash: key, name: can.user.isEnglish(can)? key: value.name, icon: value.icon||""})
+		}
+	})
 	can.base.isFunc(cb) && cb(msg); return true
 }})
 })()