{ "title": "Security & Approvals", "allowlist": "Tool Allowlist (read-only default; high-risk needs human approval)", "llmUntrusted": "LLM output is always untrusted and must never execute directly", "pending": "Pending approvals", "runSysInfo": "Run sys.info", "none": "No pending approvals", "pillPending": "{{count}} pending", "pillReady": "Ready", "pill2faOff": "2FA off", "stat2fa": "2FA", "statApi": "API keys", "statApiSessions": "API sessions", "revokeOtherTitle": "Sign out {{n}} other session(s)", "statSsh": "SSH", "statSshValue": "{{keys}} keys · {{auth}} authorized", "statSshHint": "Outbound identities / authorized login keys", "statPending": "Pending", "on": "On", "off": "Off", "output": "Output", "tabAccount": "My security", "tabApiKeys": "API keys", "tabSsh": "SSH", "tabApprovals": "Approvals", "tabAllowlist": "Agent tools", "apiTokenOnce": "API token (shown once):", "copiedToken": "Token copied", "totpTitle": "Two-factor (TOTP)", "totpStatus": "Status: ", "totpEnabled": "Enabled", "totpEnrolledUnconfirmed": "In progress — scan & confirm", "totpNotSet": "Not set", "totpLead": "Login requires a 6-digit app code.", "totpWhy1": "Stolen passwords alone cannot sign in without the app code", "totpWhy2": "Sensitive actions can re-prompt for TOTP (step-up)", "totpWhy3": "Works with Google Authenticator, Authy, NordPass, 1Password, and more", "totpAppsHint": "Suggested apps: Google Authenticator, Authy, Microsoft Authenticator, NordPass, 1Password", "totpStepsLabel": "Setup steps", "totpStepReauth": "Verify password", "totpStepScan": "Scan QR / enter key", "totpStepConfirm": "Confirm 6-digit code", "totpStepBackup": "Save recovery codes", "totpScanTitle": "Scan QR code", "totpScanHint": "Open your authenticator app → Add account → Scan this QR.", "totpManualTitle": "Or enter the key manually", "totpManualHint": "If you cannot scan, choose manual entry in the app and paste this Base32 secret.", "totpShowOtpauth": "Show otpauth:// URL (advanced)", "totpQrAlt": "TOTP setup QR code", "totpQrFailed": "Could not render QR — use the secret key below", "totpSecretCopied": "Secret copied", "hideSecret": "Hide secret", "showSecret": "Show secret", "totpEnabledDesc": "Enabled.", "totpRecoveryRemaining": "{{n}} recovery codes left", "totpResetSummary": "Reset or turn off 2FA…", "totpResetHint": "Reset issues a new QR/secret (old app entries stop working)", "totpDisableCodeHint": "App 6-digit code or recovery code", "disable2fa": "Turn off 2FA", "totpDisabledOk": "Two-factor auth turned off", "reauthPassword": "Re-enter password", "reauthPasswordHint": "Start/reset 2FA requires password again (stolen session protection)", "reauthPasswordRequired": "Enter your login password first", "needCurrentPassword": "Enter the current password first", "passwordMin8": "New password must be at least 8 characters", "totpSecretGenerated": "Secret ready — scan the QR or copy the key, then enter the app’s 6-digit code", "reset2fa": "Reset 2FA", "start2fa": "Set up 2FA", "secretLabel": "Secret: ", "confirmCode": "6-digit code from app", "confirmCodeHint": "After scanning, enter the 6 digits currently shown in your authenticator.", "confirmCodeInvalid": "Enter a 6-digit verification code", "totpEnabledSaveCodes": "2FA enabled — save the recovery codes below now (shown once)", "confirmEnable": "Confirm & enable", "recoveryCodesHint": "Recovery codes are shown once only", "copiedRecoveryCodes": "Recovery codes copied", "downloadRecovery": "Download .txt", "recoveryDownloaded": "Recovery codes file downloaded", "copyAll": "Copy all", "savedClose": "I've saved them — done", "sessionsTitle": "Sessions", "sessionsDesc": "", "revokeOtherSessions": "Sign out other devices", "revokedOtherSessions": "Signed out {{count}} other session(s)", "noSessions": "No active sessions", "currentSession": "This device", "revoke": "Sign out", "passkeyTitle": "Passkey / WebAuthn", "passkeyDesc": "", "passkeyRegistered": "Passkey registered", "webauthnFailed": "WebAuthn failed", "webauthnUnsupported": "This page has no WebAuthn API. In Brave/Chrome/Firefox avoid restricted modes; use a password manager if needed, and open the panel on a domain over HTTPS.", "webauthnInsecureContext": "This page is not a secure context ({{origin}}). Browsers require HTTPS or localhost for Passkeys — unrelated to Brave/NordPass. Open https://your-domain instead.", "webauthnIpHost": "You opened the panel via IP ({{origin}}). WebAuthn forbids IP as RP ID, so Brave/NordPass will fail. Bind a domain + HTTPS (e.g. https://panel.example.com) and retry.", "webauthnEnvOk": "Passkey ready ({{origin}})", "webauthnEnvCurrent": "Current page: {{origin}}", "webauthnCancelled": "Cancelled or timed out. Try again.", "webauthnUnavailableHint": "Passkey needs HTTPS + domain.", "registerPasskey": "Register passkey", "noPasskey": "No passkey", "passkeyVerifyOk": "Passkey verified (step-up done)", "verifyFailed": "Verification failed", "verifyWithPasskey": "Verify with passkey (step-up)", "passkeyHint": "For high-risk step-up; needs HTTPS + domain.", "devicesTitle": "Devices / backup", "devicesDesc": "", "viewTrustedDevices": "View trusted devices", "trustedDevicesCount": "Trusted devices: {{count}}", "revokeAllDevices": "Revoke all devices", "revokedAllDevices": "All trusted devices revoked", "export2faBackup": "Export 2FA encrypted backup", "fail2banSnippetMsg": "fail2ban snippets: {{written}} — {{notes}}", "generatefail2ban": "Generate fail2ban snippets", "generateFail2ban": "Generate fail2ban snippets", "adminPolicyTitle": "Admin 2FA policy", "adminPolicyDesc": "", "requireAdmin2fa": "Require admin 2FA", "strictAdmin2fa": "Strict: block login without 2FA", "confirmTotpPolicy": "Confirm TOTP (when changing policy)", "confirmTotpPolicyHint": "Enabling policy needs step-up", "totp6digitPlaceholder": "6-digit code", "policyUpdated": "Security policy updated", "savePolicy": "Save policy", "recentProbe": "Recent probe", "apiKeysTitle": "API access keys", "apiKeysDesc": "", "createKey": "+ Create key", "colName": "Name", "colPrefix": "Prefix", "colCreated": "Created", "apiKeysEmpty": "No API keys yet", "apiKeysEmptyHint": "Create from the toolbar; then call API with Bearer token", "approve": "Approve", "allowlistTitle": "Agent tools ({{count}})", "allowlistEmpty": "No agent tools in the catalog", "totpStatusLoadFailed": "Could not load 2FA status", "createApiKeyTitle": "Create API key", "createApiKeyDesc": "Full token is shown only once after create", "createKeyBtn": "Create key", "apiKeyNameHint": "Easy to recognize, e.g. CI / backup script", "apiKeyScope": "Scope", "apiKeyScopeHint": "read = read-only (no full mutate)", "scopeFull": "full (full API)", "scopeRead": "read (read-only)", "apiKey2faHint": "If 2FA is on, creating a key requires a verification code (step-up).", "apiKeyCreated": "API key created", "export2faBackupTitle": "Export 2FA backup", "createApiKeyStepUp": "Create API key · step-up", "enterTotpCode": "Enter current TOTP code", "export": "Export", "backupCopied": "Encrypted backup copied to clipboard (store offline)", "digit6Placeholder": "6-digit code", "ssh": { "workspaceTitle": "SSH workspace", "workspaceDesc": "Pick a job first", "subOutbound": "Outbound IDs", "subOutboundHint": "Private keys for panel/project outbound", "subLogin": "Login auth", "subLoginHint": "Who can SFTP/SSH in", "sub2fa": "Login 2FA", "sub2faHint": "SSH TOTP (≠ panel 2FA)", "subSshd": "System sshd", "subSshdHint": "Project user SFTP settings", "jobOutboundTitle": "Connect outbound", "jobOutboundDesc": "Create outbound identity keys · panel peer / project git", "jobLoginTitle": "Allow inbound login", "jobLoginDesc": "Register public keys to project home · authorized_keys", "job2faTitle": "SSH login needs 2FA", "job2faDesc": "Linux user TOTP (separate from panel 2FA)", "jobSshdTitle": "Enable system SFTP", "jobSshdDesc": "Install sshd Match snippets (project users)", "purposePanel": "Panel to other hosts", "purposeUser": "Project user outbound", "purposeUnbound": "Purpose not set", "purposePanelHint": "Cluster peer, backup scp, remote probes", "purposeUserHint": "Project Linux user git / scp / scripts", "purposeDefaultHint": "Bind later", "statusStored": "Stored", "statusInstalled": "On disk", "statusVerified": "Verified", "statusMissing": "Missing on disk", "statusRetired": "Retired", "statusError": "Error", "actionInstall": "Write to disk", "actionTest": "Test connection", "actionCopyPub": "Copy public key", "pipelineStored": "Stored", "pipelineInstalled": "On disk", "pipelineVerified": "Verified", "progressAria": "Progress", "loginTitle": "Login authorization (public keys)", "loginDesc": "Who can come in", "loginAdd": "Add login public key", "loginEmpty": "No login public keys yet", "loginEmptyHint": "Paste a laptop or CI public key, bind to a project user for SFTP/SSH (needs sshd snippet)", "loginAddFirst": "Add first login public key", "boundProject": "Project", "unboundProject": "No project", "loginRemoved": "Public key removed", "remove": "Remove", "loginModalTitle": "Authorize a public key", "loginModalDesc": "After selecting a project, the key is written to that Linux user home/", "addAuth": "Add authorization", "selectOption": "— Select —", "publicKey": "Public key", "publicKeyHint": "Paste full line, e.g. ssh-ed25519 AAAA… comment", "commentOptional": "Comment (optional)", "commentPlaceholder": "laptop / CI", "loginNeedProject": "Create a project first. Binding works best when the system user is ready.", "loginNeedPub": "Select a project or Linux user, and paste a public key starting with ssh-", "loginNoProjects": "No projects. Authorize an existing Linux user (root / tester) below. Writing /root/.ssh needs YSK_EXECUTE=1.", "loginLinuxHint": "Used when no project. Example: root or tester.", "loginAdded": "Added", "sshdTitle": "Project user SFTP (sshd)", "sshdDesc": "Let ysks_* / ysk_* project users SFTP with public keys", "sshdStep1": "Add public keys under Login auth for projects", "sshdStep2": "Preview and install system Match snippets here", "sshdStep3": "Install needs system execute rights; will try to reload sshd", "sshdPreview": "Config preview", "loadingSnippet": "(Loading…)", "reloadedCopied": "Reloaded; snippet copied to clipboard", "reloadAndCopy": "Reload and copy", "installedOk": "Installed", "installToSystem": "Install to system", "sshdManualHint": "If execute is blocked, run the control plane with privileges, or place the snippet under", "outboundTitle": "Outbound identity keys", "outboundDesc": "Private keys encrypted in control plane", "outboundAdd": "Add outbound identity", "filterActive": "Active", "filterPanel": "Panel", "filterUser": "Project user", "filterRetired": "Retired", "filterAll": "All", "searchIdentity": "Search name or fingerprint…", "searchIdentityAria": "Search identities", "identityCount": "{{count}} identities", "identityList": "Identities", "outboundEmpty": "No outbound identities yet", "outboundEmptyFilter": "No matching items", "outboundEmptyHint": "Create a key in ~30s: pick purpose → name → done. Use for peer / backup / git.", "outboundEmptyFilterHint": "Try changing filters or clear search", "outboundAddFirst": "Add first outbound identity", "userPrefix": "User {{user}}", "createFailed": "Create failed", "identityCreatedOnce": "Identity created (private key shown once)", "writtenToDisk": "Written to disk", "cannotWriteNeedExecute": "Cannot write to system: enable execute (YSK_EXECUTE)", "notDone": "Not completed", "installFailed": "Install failed", "testPassed": "Connection OK", "testFailed": "Connection failed", "testError": "Test failed", "copiedPubPaste": "Public key copied — paste into peer authorized_keys or Git deploy key", "deletedNamed": "Deleted \"{{name}}\"", "rotated": "Rotated: old key retired, new key created", "detailStatus": "Status", "detailPurpose": "Purpose", "detailLinuxUser": "Linux user", "detailDiskPath": "Disk path", "detailLastTest": "Last test", "suggestFlow": "Suggested: store → write disk → put public key on peer → test connection", "suggestFlowPrefix": "Suggested: store → write disk → put ", "suggestFlowSuffix": " on peer → test connection", "publicKeyStrong": "public key", "copiedPub": "Public key copied", "allowLocalLogin": "Allow local login with this key", "localLoginOk": "Public key added to local login authorization", "testingConnection": "Testing connection…", "rotateKey": "Rotate key", "wizStepPurpose": "What is this key for?", "wizStepProject": "Which project?", "wizStepPanelConfirm": "Confirm panel outbound", "wizStepName": "Name and options", "wizStepPurposeDesc": "Pick purpose so list and install path align", "wizStepProjectDesc": "Key binds to that project's Linux user and home", "wizStepPanelDesc": "Private key stays in control-plane secrets for scp/ssh to other hosts", "wizStepNameDesc": "Name for recognition; advanced options can wait", "prevStep": "Back", "nextStep": "Next", "createIdentity": "Create identity", "purposePanelTitle": "Panel to other hosts", "purposePanelSub": "Cluster peer, remote backup, probes", "purposePanelRec": "Recommended for most admin ops", "purposeUserTitle": "Project user outbound", "purposeUserSub": "git pull, project script scp", "purposeUserPath": "Writes project home/.ssh", "selectProject": "— Select project —", "noProjectsHint": "No projects yet — create a project and system user first", "afterCreatePub": "After create, put the ", "afterCreatePubMid": " on the target host's ", "afterCreatePubEnd": ", then use Test connection.", "privKeyStayLocal": "Private key stays on this control plane; never in lists or logs.", "displayName": "Display name", "displayNameHint": "e.g. peer-prod, myapp-git", "algorithm": "Algorithm", "algoSuggested": "Recommended", "algoLegacy": "Legacy systems", "installImmediately": "Write to disk immediately after create", "installImmediatelyHint": "(needs system execute; otherwise you will be told it cannot apply)", "savePrivTitle": "Save private key now", "savePrivDesc": "After close, full private key will not be shown again", "copiedPriv": "Private key copied", "copyPriv": "Copy private key", "nextInstallDisk": "Next: write to disk", "savedCloseBtn": "Saved — close", "privKeyOnce": "Private key (this time only)", "privSavedConfirm": "I stored the private key safely (password manager / offline backup)", "testConnTitle": "Test connection", "testConnDesc": "Try ssh … true with this identity. Success only means this target is reachable.", "startTest": "Start test", "testTarget": "Target", "testTargetHint": "Format user@host or user@host:port", "deleteIdentityTitle": "Delete identity?", "rotateKeyTitle": "Rotate key?", "deleteIdentityDesc": "Delete \"{{name}}\" and try to remove the private key file on disk", "rotateKeyDesc": "\"{{name}}\" will be retired and a new key created. Update peer authorized_keys.", "rotate": "Rotate", "enrollStatusSecret": "Secret generated", "enrollStatusConfirmed": "App confirmed", "enrollStatusWritten": "Written to home", "enrollStatusRetired": "Retired", "needProjectOrUser": "Select a project or enter a Linux username", "enrollFailed": "Enrollment failed", "totpGenerated": "SSH-only TOTP generated (separate from panel 2FA unless you sync)", "confirmed": "Confirmed", "codeWrong": "Wrong code", "gaWritten": "Wrote .google_authenticator", "needExecute": "Needs system execute enabled", "ssh2faTitle": "SSH login second factor", "ssh2faDesc": "Protects ssh login for Linux users", "ssh2faStep1": "Enroll TOTP for a Linux user (scan QR)", "ssh2faStep2": "Confirm App 6-digit code", "ssh2faStep3": "Write home file", "ssh2faStep4": "Install PAM module and merge snippets (below)", "pkgLabel": "Package {{name}}", "pkgStatus": "Package {{status}}", "pamStatus": "PAM {{status}}", "kbdStatus": "sshd keyboard-interactive {{status}}", "light": { "green": "ok", "yellow": "check", "red": "missing" }, "enrollForUser": "Enroll SSH 2FA for user", "ssh2faEmpty": "No Linux user has SSH 2FA yet", "ssh2faEmptyHint": "Prefer key login first;", "startEnroll": "Start enrollment", "fromPanelBadge": "Same as panel", "enterCode": "Enter code", "rewriteHome": "Rewrite home file", "writeHome": "Write home", "retiredOk": "Retired", "retire": "Retire", "pamTitle": "System: PAM / sshd (manual or apply when permitted)", "pamDesc": "nullok avoids locking users without files. File written ≠ TOTP required.", "pamSnippet": "PAM snippet (merge into /etc/pam.d/sshd)", "sshdHint": "sshd hints", "rescueUsers": "Rescue users (comma-separated, never in strict Match)", "strictPreview": "Strict Match preview (publickey+TOTP, password off)", "copiedPam": "PAM snippet copied", "copyPam": "Copy PAM", "applyStrict": "Apply Strict to system", "pamPkgHint": "Package: ", "pamRescueHint": ". Keep at least one rescue admin without a 2FA file (default root).", "enrollModalTitle": "Enroll SSH 2FA", "enrollModalDesc": "Default: independent secret (not shared with panel)", "generateShowSecret": "Generate and show secret", "projectSuggested": "Project (recommended)", "orManualUser": "— or enter user manually —", "linuxUser": "Linux user", "advancedSharePanel": "Advanced: use current panel operator TOTP secret (type SHARED to confirm)", "setupAuthTitle": "Set up authenticator", "setupAuthDesc": "Scan or enter secret, then confirm with App 6-digit code", "later": "Later", "confirmCodeBtn": "Confirm code", "secretBase32": "Secret (base32)", "copiedSecret": "Secret copied", "copySecret": "Copy secret", "scanThenCode": "If already scanned, enter the current 6-digit code.", "verifyCode": "Verification code", "applyStrictStepUp": "Apply Strict · step-up", "enterPanelTotp": "Enter current panel TOTP code", "applyBtn": "Apply", "appliedOk": "Applied", "sharePanelTitle": "Share panel TOTP secret?", "sharePanelDesc": "High risk. Type SHARED to confirm.", "confirmString": "Confirmation string", "enableShare": "Enable sharing", "invalidPub": "Paste a full OpenSSH public key line (ssh-ed25519 / ssh-rsa / ecdsa…).", "dryRunOk": "Dry-run finished. Review the preview below.", "strictDryRun": "Strict preview (dry-run)", "errorNoDetail": "Test failed (no details)", "strictBlocked": "Package or PAM is not ready; Strict apply is disabled.", "privCloseWithoutAck": "Closed. The private key will not be shown again; generate a new one if you did not save it." }, "sessionsActive": "Active sessions", "sessionsOther": "Other devices", "sessionsHint": "", "noSessionsHint": "When you sign in again, this device will appear here.", "sessionOtherBadge": "Other", "sessionThisDevice": "You’re here", "sessionDeviceOn": "{{browser}} on {{os}}", "sessionIpUnknown": "IP unknown", "sessionLastActive": "Last active {{when}}", "sessionStarted": "Signed in {{when}}", "sessionIdShort": "ID {{id}}…", "sessionJustNow": "just now", "sessionMinAgo": "{{n}} min ago", "sessionHourAgo": "{{n}} h ago", "sessionDayAgo": "{{n}} d ago", "revokeSessionTitle": "Sign out this device?", "revokeSessionDesc": "End session for {{device}} ({{ip}}). That device will need to sign in again.", "revokeOthersTitle": "Sign out all other devices?", "revokeOthersDesc": "This will end {{count}} other session(s). Your current browser stays signed in.", "sessionRevoked": "Session signed out", "mySecurityHint": "", "policyTotpHint": "Site policy: each admin must enable their own 2FA (individual QR)", "requireUser2fa": "Require 2FA for all panel users", "changePasswordTitle": "Change sign-in password", "currentPassword": "Current password", "newPassword": "New password", "confirmNewPassword": "Confirm new password", "passwordMismatch": "New passwords do not match.", "changePassword": "Change password", "passwordChanged": "Password updated.", "strictNeedsEnrolled": "Enable 2FA on this admin account before turning on Strict.", "policyTotpNeedSelf": "Enable 2FA on this account first; the confirm code cannot be filled otherwise.", "policyNoTotpHint": "This account has no 2FA yet. Turn on 2FA above before requiring it for admins or all users — otherwise you can lock everyone out.", "policyNeedSelf2fa": "Enable 2FA on this account first, then confirm with a TOTP code", "revokeAllDevicesTitle": "Revoke every remembered device — you and other admins must verify 2FA again", "sessionCli": "CLI", "sessionApi": "API", "fail2banSnippetTitle": "fail2ban snippet", "fail2banSnippetEmpty": "No snippet was written.", "trustedDevicesTitle": "Trusted devices", "noTrustedDevices": "No trusted devices.", "strictConfirmTitle": "Turn on Strict 2FA?", "strictConfirmDesc": "Users without 2FA will be refused sign-in. Confirm you already have a working TOTP or passkey.", "revokeDevicesTitle": "Revoke trusted devices?", "revokeDevicesDesc": "Remembered browsers will need 2FA again.", "approvalsHint": "Approvals appear when a high-risk tool needs a second operator. Grant Review approvals and Handle approvals on Users → Permissions.", "allowlistReadonly": "Read-only catalog of agent tools. Capability grants are configured on Users → Permissions.", "colTool": "Tool", "colAllowed": "Allowed", "colRisk": "Risk", "colApproval": "Approval", "risk": { "low": "Low", "medium": "Medium", "high": "High", "critical": "Critical" }, "confirmDeleteApiKey": "Delete this API key?", "confirmDeleteApiKeyDesc": "“{{name}}” will stop authenticating. This cannot be undone." }