{
  "title": "安全与审批",
  "allowlist": "工具 Allowlist（默认只读，高风险需人工批准）",
  "llmUntrusted": "LLM 输出一律视为不可信，不可直接执行",
  "pending": "待审批",
  "runSysInfo": "执行 sys.info",
  "none": "当前没有待审批项",
  "pillPending": "{{count}} 待批",
  "pillReady": "就绪",
  "pill2faOff": "2FA 未启用",
  "stat2fa": "2FA",
  "statApi": "API",
  "statApiSessions": "API 会话",
  "revokeOtherTitle": "退出 {{n}} 个其他会话",
  "statSsh": "SSH",
  "statSshValue": "金钥 {{keys}} · 已授权 {{auth}}",
  "statSshHint": "出站身份／已授权登入金钥",
  "statPending": "待批",
  "on": "开",
  "off": "关",
  "output": "输出",
  "tabAccount": "我的安全",
  "tabApiKeys": "API 密钥",
  "tabSsh": "SSH",
  "tabApprovals": "审批",
  "tabAllowlist": "工具权限",
  "apiTokenOnce": "API token（只显示一次）：",
  "copiedToken": "已复制 token",
  "totpTitle": "双重验证 (TOTP)",
  "totpStatus": "状态：",
  "totpEnabled": "已启用",
  "totpEnrolledUnconfirmed": "进行中 — 请扫码并确认",
  "totpNotSet": "未设置",
  "totpLead": "登录时需 App 6 位动态码。",
  "totpWhy1": "即使密码泄露，没有手机／App 动态码也无法登录",
  "totpWhy2": "高危操作可再要求一次 TOTP 确认（step-up）",
  "totpWhy3": "支持 Google Authenticator、Authy、NordPass、1Password 等",
  "totpAppsHint": "建议 App：Google Authenticator、Authy、Microsoft Authenticator、NordPass、1Password。",
  "totpStepsLabel": "设置步骤",
  "totpStepReauth": "验证密码",
  "totpStepScan": "扫 QR／输入密钥",
  "totpStepConfirm": "确认 6 位码",
  "totpStepBackup": "保存恢复码",
  "totpScanTitle": "扫描 QR Code",
  "totpScanHint": "打开验证器 App → 添加账户 → 扫描此 QR。",
  "totpManualTitle": "或手动输入密钥",
  "totpManualHint": "无法扫码时，在 App 选择「手动输入」并粘贴以下 Base32 密钥。",
  "totpShowOtpauth": "显示 otpauth:// 链接（高级）",
  "totpQrAlt": "TOTP 设置 QR Code",
  "totpQrFailed": "无法生成 QR，请用下方密钥手动添加",
  "totpSecretCopied": "已复制密钥",
  "hideSecret": "隐藏密钥",
  "showSecret": "显示密钥",
  "totpEnabledDesc": "已启用。",
  "totpRecoveryRemaining": "恢复码剩余 {{n}}",
  "totpResetSummary": "重设或关闭 2FA…",
  "totpResetHint": "重设会生成新 QR／密钥（旧 App 条目失效）。关闭需输入当前 App 码或恢复码。",
  "totpDisableCodeHint": "App 6 位码或恢复码",
  "disable2fa": "关闭 2FA",
  "totpDisabledOk": "已关闭双重验证",
  "reauthPassword": "重新验证密码",
  "reauthPasswordHint": "开始／重置 2FA 需要再输入密码（防 session 被盗）",
  "reauthPasswordRequired": "请先输入登录密码",
  "needCurrentPassword": "请先输入目前密码",
  "passwordMin8": "新密码至少 8 个字元",
  "totpSecretGenerated": "已生成密钥 — 请扫 QR 或复制密钥，再输入 App 6 位码确认",
  "reset2fa": "重新设置 2FA",
  "start2fa": "开始设置 2FA",
  "secretLabel": "密钥：",
  "confirmCode": "App 显示的 6 位码",
  "confirmCodeHint": "扫码后，输入验证器 App 当前显示的 6 位数字以确认绑定。",
  "confirmCodeInvalid": "请输入 6 位数字验证码",
  "totpEnabledSaveCodes": "2FA 已启用 — 请立即保存下方恢复码（只显示一次）",
  "confirmEnable": "确认启用",
  "recoveryCodesHint": "恢复码只显示一次！请离线保存。每个码只能用一次；手机丢失时可用恢复码登录。",
  "copiedRecoveryCodes": "已复制恢复码",
  "downloadRecovery": "下载 .txt",
  "recoveryDownloaded": "已下载恢复码文件",
  "copyAll": "复制全部",
  "savedClose": "我已保存，完成",
  "sessionsTitle": "工作会话",
  "sessionsDesc": "",
  "revokeOtherSessions": "登出其他设备",
  "revokedOtherSessions": "已登出 {{count}} 个其他会话",
  "noSessions": "没有使用中的会话",
  "currentSession": "本机",
  "revoke": "登出",
  "passkeyTitle": "密钥/WebAuthn",
  "passkeyDesc": "",
  "passkeyRegistered": "Passkey 已登记",
  "webauthnFailed": "WebAuthn 失败",
  "webauthnUnsupported": "浏览器未暴露 WebAuthn API。Brave／Chrome／Firefox 请确认非特殊模式；仍可用 NordPass 等 manager，并用「域名 + HTTPS」打开面板。",
  "webauthnInsecureContext": "当前页面不是安全连接（{{origin}}）。浏览器规格要求 HTTPS 或 localhost 才可用 Passkey——与是否 Brave／NordPass 无关。请改用 https://你的域名 再开。",
  "webauthnIpHost": "当前用 IP 打开面板（{{origin}}）。WebAuthn 规格不接受 IP 作为 RP ID，Brave／NordPass 都会失败。请绑定域名 + HTTPS（例如 https://panel.example.com）再试。",
  "webauthnEnvOk": "Passkey 可用（{{origin}}）",
  "webauthnEnvCurrent": "当前页面：{{origin}}",
  "webauthnCancelled": "已取消或超时。请再试一次。",
  "webauthnUnavailableHint": "Passkey 需 HTTPS + 域名。",
  "registerPasskey": "登记 Passkey",
  "noPasskey": "无 passkey",
  "passkeyVerifyOk": "Passkey 验证成功（已 step-up）",
  "verifyFailed": "验证失败",
  "verifyWithPasskey": "用 Passkey 验证 (step-up)",
  "passkeyHint": "高危 step-up 用；需 HTTPS + 域名。",
  "devicesTitle": "设备／备份",
  "devicesDesc": "",
  "viewTrustedDevices": "查看信任设备",
  "trustedDevicesCount": "信任设备：{{count}} 个",
  "revokeAllDevices": "撤销全部设备",
  "revokedAllDevices": "已撤销全部信任设备",
  "export2faBackup": "导出 2FA 加密备份",
  "fail2banSnippetMsg": "fail2ban 片段：{{written}} — {{notes}}",
  "generatefail2ban": "生成 fail2ban 片段",
  "generateFail2ban": "产生 fail2ban 片段",
  "adminPolicyTitle": "管理员 2FA 政策",
  "adminPolicyDesc": "",
  "requireAdmin2fa": "要求管理员启用 2FA",
  "strictAdmin2fa": "Strict：未开 2FA 拒绝登录",
  "confirmTotpPolicy": "确认 TOTP（改策略时）",
  "confirmTotpPolicyHint": "开启策略需 step-up",
  "totp6digitPlaceholder": "6 位码",
  "policyUpdated": "安全策略已更新",
  "savePolicy": "保存策略",
  "recentProbe": "最近探测",
  "apiKeysTitle": "API 访问密钥",
  "apiKeysDesc": "",
  "createKey": "+ 创建密钥",
  "colName": "名称",
  "colPrefix": "前缀",
  "colCreated": "创建",
  "apiKeysEmpty": "尚未有 API 密钥",
  "apiKeysEmptyHint": "用列表右上角创建；创建后可用 Bearer token 调用 API",
  "approve": "批准",
  "allowlistTitle": "工具权限（{{count}}）",
  "allowlistEmpty": "尚无工具目录项目",
  "totpStatusLoadFailed": "无法载入双重验证状态",
  "createApiKeyTitle": "创建 API 密钥",
  "createApiKeyDesc": "创建后完整 token 只显示一次",
  "createKeyBtn": "创建密钥",
  "apiKeyNameHint": "方便辨识，例如 CI／备份脚本",
  "apiKeyScope": "范围",
  "apiKeyScopeHint": "read = 只读（no full mutate）",
  "scopeFull": "full（完整 API）",
  "scopeRead": "read（只读）",
  "apiKey2faHint": "若已开 2FA，创建密钥会要求再输入验证码（step-up）。",
  "apiKeyCreated": "API 密钥已创建",
  "export2faBackupTitle": "导出 2FA 备份",
  "createApiKeyStepUp": "创建 API 密钥 · step-up",
  "enterTotpCode": "请输入当前 TOTP 验证码",
  "export": "导出",
  "backupCopied": "加密备份已复制到剪贴板（离线保存）",
  "digit6Placeholder": "6 位数字",
  "ssh": {
    "workspaceTitle": "SSH 工作台",
    "workspaceDesc": "先选你要完成的事。登录公钥 ≠ 出站私钥，两边分开管理更安全。",
    "subOutbound": "出站身份",
    "subOutboundHint": "面板／项目出去用的私钥",
    "subLogin": "登录授权",
    "subLoginHint": "谁可以 SFTP／SSH 进来",
    "sub2fa": "登录 2FA",
    "sub2faHint": "SSH TOTP（≠ panel 2FA）",
    "subSshd": "系统 sshd",
    "subSshdHint": "项目用户 SFTP 设置",
    "jobOutboundTitle": "我要连出去",
    "jobOutboundDesc": "创建出站身份密钥 · 面板 peer／项目 git",
    "jobLoginTitle": "我要让人登录",
    "jobLoginDesc": "登记公钥到项目 home · authorized_keys",
    "job2faTitle": "SSH 登录要 2FA",
    "job2faDesc": "Linux 用户 TOTP（与 panel 2FA 分开）",
    "jobSshdTitle": "系统要能 SFTP",
    "jobSshdDesc": "安装 sshd Match 片段（项目用户）",
    "purposePanel": "面板连其他机",
    "purposeUser": "项目用户出站",
    "purposeUnbound": "尚未指定用途",
    "purposePanelHint": "Cluster peer、备份 scp、远程探测",
    "purposeUserHint": "项目 Linux 用户 git / scp / 脚本",
    "purposeDefaultHint": "稍后再绑定",
    "statusStored": "已入库",
    "statusInstalled": "已写入磁盘",
    "statusVerified": "连接通过",
    "statusMissing": "磁盘文件丢失",
    "statusRetired": "已退役",
    "statusError": "异常",
    "actionInstall": "写入磁盘",
    "actionTest": "测试连接",
    "actionCopyPub": "复制公钥",
    "pipelineStored": "已入库",
    "pipelineInstalled": "已写磁盘",
    "pipelineVerified": "连接通过",
    "progressAria": "进度",
    "loginTitle": "登录授权（公钥）",
    "loginDesc": "决定「谁可以进来」。只存公钥，写入项目 home 的 authorized_keys。与出站私钥无关。",
    "loginAdd": "新增登录公钥",
    "loginEmpty": "还没有允许登录的公钥",
    "loginEmptyHint": "把笔记本或 CI 的公钥贴上来，绑到项目用户后即可 SFTP／SSH（需 sshd 片段）。",
    "loginAddFirst": "新增第一把登录公钥",
    "boundProject": "项目",
    "unboundProject": "未绑项目",
    "loginRemoved": "已移除公钥",
    "remove": "移除",
    "loginModalTitle": "允许一把公钥登录",
    "loginModalDesc": "选择项目后，公钥会写入该 Linux 用户 home/.ssh/authorized_keys",
    "addAuth": "加入授权",
    "selectOption": "— 选择 —",
    "publicKey": "公钥",
    "publicKeyHint": "整行粘贴，例如 ssh-ed25519 AAAA… comment",
    "commentOptional": "备注（可选）",
    "commentPlaceholder": "笔记本 / CI",
    "loginNeedProject": "请先创建项目。系统用户就绪后再绑公钥效果最佳。",
    "loginNeedPub": "请选择项目并粘贴以 ssh- 开头的公钥",
    "loginNoProjects": "没有项目。在下面授权现有的 Linux 用户（root / tester）。写入/root/.ssh需要YSK_EXECUTE=1。",
    "loginLinuxHint": "没有项目时使用。示例：root 或 tester。",
    "loginAdded": "已加入",
    "sshdTitle": "项目用户 SFTP（sshd）",
    "sshdDesc": "让 ysks_* / ysk_* 项目用户可用公钥 SFTP。未安装时，登录授权可能无效。",
    "sshdStep1": "在「登录授权」为项目加入公钥",
    "sshdStep2": "在此预览并安装系统 Match 片段",
    "sshdStep3": "安装需要系统执行权限；会尝试 reload sshd",
    "sshdPreview": "设置预览",
    "loadingSnippet": "（加载中…）",
    "reloadedCopied": "已重新加载；片段已复制到剪贴板",
    "reloadAndCopy": "重新加载并复制",
    "installedOk": "已安装",
    "installToSystem": "安装到系统",
    "sshdManualHint": "若提示无法执行，请以具备权限的方式运行控制面，或手动将片段放入",
    "outboundTitle": "出站身份密钥",
    "outboundDesc": "私钥加密保存在控制面。列表永不显示私钥。写入磁盘 ≠ 对方已授权你登录。",
    "outboundAdd": "新增出站身份",
    "filterActive": "使用中",
    "filterPanel": "面板",
    "filterUser": "项目用户",
    "filterRetired": "已退役",
    "filterAll": "全部",
    "searchIdentity": "搜索名称或 fingerprint…",
    "searchIdentityAria": "搜索身份",
    "identityCount": "{{count}} 个身份",
    "identityList": "身份列表",
    "outboundEmpty": "还没有出站身份",
    "outboundEmptyFilter": "没有符合条件的项目",
    "outboundEmptyHint": "30 秒创建一把密钥：选用途 → 命名 → 完成。之后可用于 peer / 备份 / git。",
    "outboundEmptyFilterHint": "试着改筛选或清空搜索",
    "outboundAddFirst": "新增第一个出站身份",
    "userPrefix": "用户 {{user}}",
    "createFailed": "创建失败",
    "identityCreatedOnce": "身份已创建（私钥只显示一次）",
    "writtenToDisk": "已写入磁盘",
    "cannotWriteNeedExecute": "无法写入系统：需开启执行权限（YSK_EXECUTE）",
    "notDone": "未完成",
    "installFailed": "安装失败",
    "testPassed": "连接通过",
    "testFailed": "连接失败",
    "testError": "测试失败",
    "copiedPubPaste": "已复制公钥 — 贴到对方 authorized_keys 或 Git 部署密钥",
    "deletedNamed": "已删除「{{name}}」",
    "rotated": "已轮替：旧密钥退役，新密钥已创建",
    "detailStatus": "状态",
    "detailPurpose": "用途",
    "detailLinuxUser": "Linux 用户",
    "detailDiskPath": "磁盘路径",
    "detailLastTest": "最近测试",
    "suggestFlow": "建议流程：入库 → 写入磁盘 → 把公钥放到对方 → 测试连接",
    "suggestFlowPrefix": "建议流程：入库 → 写入磁盘 → 把",
    "suggestFlowSuffix": "放到对方 → 测试连接",
    "publicKeyStrong": "公钥",
    "copiedPub": "已复制公钥",
    "allowLocalLogin": "允许本机用此钥登录",
    "localLoginOk": "已把公钥加入本机登录授权",
    "testingConnection": "测试连接…",
    "rotateKey": "轮替密钥",
    "wizStepPurpose": "这把密钥用来做什么？",
    "wizStepProject": "绑定哪个项目？",
    "wizStepPanelConfirm": "确认面板出站",
    "wizStepName": "命名与选项",
    "wizStepPurposeDesc": "选对用途，之后列表与安装路径会自动对齐",
    "wizStepProjectDesc": "密钥会绑定该项目的 Linux 用户与 home",
    "wizStepPanelDesc": "私钥只放在控制面 secrets，用于 scp／ssh 到其他主机",
    "wizStepNameDesc": "名称方便你辨识；高级选项可稍后再改",
    "prevStep": "上一步",
    "nextStep": "下一步",
    "createIdentity": "创建身份",
    "purposePanelTitle": "面板连其他机",
    "purposePanelSub": "Cluster peer、远程备份、探测",
    "purposePanelRec": "推荐大多数管理操作",
    "purposeUserTitle": "项目用户出站",
    "purposeUserSub": "git pull、项目脚本 scp",
    "purposeUserPath": "写入项目 home/.ssh",
    "selectProject": "— 选择项目 —",
    "noProjectsHint": "尚未有项目 — 请先创建项目与系统用户",
    "afterCreatePub": "创建后请把",
    "afterCreatePubMid": "放到目标机的",
    "afterCreatePubEnd": "，再用「测试连接」确认。",
    "privKeyStayLocal": "私钥只留在本机控制面；不会出现在列表或日志。",
    "displayName": "显示名称",
    "displayNameHint": "例如 peer-prod、myapp-git",
    "algorithm": "算法",
    "algoSuggested": "建议",
    "algoLegacy": "旧系统",
    "installImmediately": "创建后立即写入磁盘",
    "installImmediatelyHint": "（需系统执行权限；否则会提示无法套用）",
    "savePrivTitle": "请立即保存私钥",
    "savePrivDesc": "关闭后面板不会再显示私钥全文。公钥可随时复制。",
    "copiedPriv": "已复制私钥",
    "copyPriv": "复制私钥",
    "nextInstallDisk": "下一步：写入磁盘",
    "savedCloseBtn": "我已保存，关闭",
    "privKeyOnce": "Private key（仅此一次）",
    "privSavedConfirm": "我已把私钥存到安全位置（密码管理器／离线备份）",
    "testConnTitle": "测试连接",
    "testConnDesc": "用此身份尝试 ssh … true。成功只代表这个目标可登录。",
    "startTest": "开始测试",
    "testTarget": "目标",
    "testTargetHint": "格式 user@host 或 user@host:port",
    "deleteIdentityTitle": "删除身份？",
    "rotateKeyTitle": "轮替密钥？",
    "deleteIdentityDesc": "将删除「{{name}}」并尝试清除磁盘上的私钥文件。此操作无法复原。",
    "rotateKeyDesc": "「{{name}}」会标记为已退役，并生成一把新密钥。请更新对方 authorized_keys。",
    "rotate": "轮替",
    "enrollStatusSecret": "已生成密钥",
    "enrollStatusConfirmed": "已确认 App",
    "enrollStatusWritten": "已写入 home",
    "enrollStatusRetired": "已退役",
    "needProjectOrUser": "请选项目或填 Linux 用户名",
    "enrollFailed": "登记失败",
    "totpGenerated": "已生成 SSH 专用 TOTP（与 panel 2FA 分开，除非勾选同步）",
    "confirmed": "已确认",
    "codeWrong": "码错误",
    "gaWritten": "已写入 .google_authenticator",
    "needExecute": "需开启系统执行权限",
    "ssh2faTitle": "SSH 登录第二因素",
    "ssh2faDesc": "保护 ssh 登录 Linux 用户。与「我的安全」的 panel 2FA 分开；默认独立 secret。",
    "ssh2faStep1": "为 Linux 用户登记 TOTP（扫码）",
    "ssh2faStep2": "确认 App 6 位码",
    "ssh2faStep3": "写入 home",
    "ssh2faStep4": "系统安装 PAM 模块并合并片段（下方）",
    "pkgLabel": "软件包 {{name}}",
    "pkgStatus": "套件 {{status}}",
    "pamStatus": "帕姆{{status}}",
    "kbdStatus": "sshd 键盘交互 {{status}}",
    "light": {
      "green": "正常",
      "yellow": "需检查",
      "red": "未就绪"
    },
    "enrollForUser": "为用户登记 SSH 2FA",
    "ssh2faEmpty": "尚未为任何 Linux 用户开启 SSH 2FA",
    "ssh2faEmptyHint": "建议先用密钥登录；2FA 作第二道门。项目 SFTP-only 用户通常不需要 keyboard-interactive。",
    "startEnroll": "开始登记",
    "fromPanelBadge": "与 panel 同源",
    "enterCode": "输入验证码",
    "rewriteHome": "重写 home 文件",
    "writeHome": "写入 home",
    "retiredOk": "已退役",
    "retire": "退役",
    "pamTitle": "系统：PAM / sshd（手动或有权限时套用）",
    "pamDesc": "nullok 避免未写文件用户被锁死。写文件 ≠ 已要求 TOTP。",
    "pamSnippet": "PAM 片段（建议并入 /etc/pam.d/sshd）",
    "sshdHint": "sshd 提示",
    "rescueUsers": "救援用户（逗号分隔，永不进 strict Match）",
    "strictPreview": "Strict Match 预览（publickey+TOTP、关 password）",
    "copiedPam": "已复制 PAM 片段",
    "copyPam": "复制 PAM",
    "applyStrict": "套用 Strict 到系统",
    "pamPkgHint": "软件包：",
    "pamRescueHint": "。保留至少一名未写 2FA 文件的救援管理员（默认 root）。",
    "enrollModalTitle": "登记 SSH 2FA",
    "enrollModalDesc": "默认生成独立 secret（不共用 panel）。高级才可同步 panel TOTP。",
    "generateShowSecret": "生成并显示密钥",
    "projectSuggested": "项目（建议）",
    "orManualUser": "— 或手动填用户 —",
    "linuxUser": "Linux 用户",
    "advancedSharePanel": "高级：使用当前 panel 操作员的 TOTP secret（需输入 SHARED 确认）",
    "setupAuthTitle": "设置 Authenticator",
    "setupAuthDesc": "扫码或输入密钥后，用 App 的 6 位码确认。确认后才写 home 文件。",
    "later": "稍后",
    "confirmCodeBtn": "确认验证码",
    "secretBase32": "密钥（base32）",
    "copiedSecret": "已复制 secret",
    "copySecret": "复制 secret",
    "scanThenCode": "若已扫码，直接输入当前 6 位码即可。",
    "verifyCode": "验证码",
    "applyStrictStepUp": "套用 Strict · step-up",
    "enterPanelTotp": "输入当前 panel TOTP 验证码",
    "applyBtn": "套用",
    "appliedOk": "已套用",
    "sharePanelTitle": "共用 panel TOTP secret？",
    "sharePanelDesc": "风险高。请输入 SHARED 确认。",
    "confirmString": "确认字符串",
    "enableShare": "启用共用",
    "invalidPub": "请贴上完整 OpenSSH 公钥行（ssh-ed25519／ssh-rsa／ecdsa…）。",
    "dryRunOk": "预览试行完成。请查看下方预览。",
    "strictDryRun": "严格模式预览",
    "errorNoDetail": "测试失败（无详情）",
    "strictBlocked": "套件或 PAM 未就绪，已停用套用 Strict。",
    "privCloseWithoutAck": "已关闭。私钥不会再显示；若尚未保存，请立即重新生成。"
  },
  "sessionsActive": "使用中",
  "sessionsOther": "其他设备",
  "sessionsHint": "",
  "noSessionsHint": "再次登录后，此设备会显示于此。",
  "sessionOtherBadge": "其他",
  "sessionThisDevice": "你在这里",
  "sessionDeviceOn": "{{browser}} · {{os}}",
  "sessionIpUnknown": "IP 未知",
  "sessionLastActive": "最近活动 {{when}}",
  "sessionStarted": "登录于 {{when}}",
  "sessionIdShort": "ID {{id}}...",
  "sessionJustNow": "刚刚",
  "sessionMinAgo": "{{n}} 分钟前",
  "sessionHourAgo": "{{n}} 小时前",
  "sessionDayAgo": "{{n}} 日前",
  "revokeSessionTitle": "登出此设备？",
  "revokeSessionDesc": "结束 {{device}}（{{ip}}）的会话，该设备需重新登录。",
  "revokeOthersTitle": "登出所有其他设备？",
  "revokeOthersDesc": "将结束 {{count}} 个其他会话。当前浏览器保持登录。",
  "sessionRevoked": "已登出该会话",
  "mySecurityHint": "",
  "policyTotpHint": "全站政策：要求 admin 角色各自启用 2FA（每人自己扫码），不是共用同一组验证码。",
  "requireUser2fa": "要求所有面板用户启用 2FA",
  "changePasswordTitle": "变更登录密码",
  "currentPassword": "目前密码",
  "newPassword": "新密码",
  "confirmNewPassword": "确认新密码",
  "passwordMismatch": "两次新密码不一致。",
  "changePassword": "变更密码",
  "passwordChanged": "已更新密码。",
  "strictNeedsEnrolled": "至少一名管理员已开 2FA，才可开启 Strict。",
  "policyTotpNeedSelf": "请先在本帐号启用 2FA，否则确认码无法填写。",
  "policyNoTotpHint": "This account has no 2FA yet — saving policy does not need a TOTP. Set up 2FA above if you want to require it for others.",
  "policyNeedSelf2fa": "首先在此帐户上启用 2FA，然后使用 TOTP 代码进行确认",
  "revokeAllDevicesTitle": "撤销每个记住的设备 - 您和其他管理员必须再次验证 2FA",
  "sessionCli": "CLI",
  "sessionApi": "API",
  "fail2banSnippetTitle": "fail2ban 片段",
  "fail2banSnippetEmpty": "没有写入片段。",
  "trustedDevicesTitle": "信任装置",
  "noTrustedDevices": "尚未有信任装置。",
  "strictConfirmTitle": "开启 Strict 2FA？",
  "strictConfirmDesc": "未开 2FA 的用户会被拒绝登录。请确认你已有可用的 TOTP 或通行密钥。",
  "revokeDevicesTitle": "撤销信任装置？",
  "revokeDevicesDesc": "已记住的浏览器要再做 2FA。",
  "approvalsHint": "高风险工具需要第二人批准时会出现在此。权限在「用户 → 权限」设定。",
  "allowlistReadonly": "代理工具目录（只读）。能力授权在「用户 → 权限」设定。",
  "colTool": "工具",
  "colAllowed": "允许",
  "colRisk": "风险",
  "colApproval": "审批",
  "risk": {
    "low": "低",
    "medium": "中",
    "high": "高",
    "critical": "严重"
  },
  "confirmDeleteApiKey": "删除此 API 密钥？",
  "confirmDeleteApiKeyDesc": "删除后「{{name}}」无法再验证。此操作无法复原。"
}