From feb712e2de0ed215fcbcecd623573936c333ecc5 Mon Sep 17 00:00:00 2001
From: KingKDot <why_are_you_looking_at_this@stoppeeping.com>
Date: Mon, 13 Jul 2026 21:54:21 -0500
Subject: [PATCH] fix turbo on dashboard + optimize a few more things.

---
 Overlord-Server/public/assets/build.js        |  7 +-
 Overlord-Server/public/assets/data.js         |  1 +
 Overlord-Server/public/assets/file-share.js   | 66 ++++---------------
 Overlord-Server/public/assets/main.js         |  1 +
 .../public/assets/stimulus/application.js     | 10 +++
 .../controllers/clipboard-controller.js       | 33 ++++++++++
 .../controllers/confirm-controller.js         | 12 ++++
 .../controllers/countdown-controller.js       | 53 +++++++++++++++
 .../stimulus/controllers/reveal-controller.js | 17 +++++
 .../controllers/sessions-controller.js        |  7 --
 .../stimulus/controllers/toggle-controller.js | 11 ++++
 .../public/assets/turbo-navigation.js         |  1 +
 Overlord-Server/public/assets/ui.js           | 23 ++++---
 Overlord-Server/public/file-share.html        | 24 +++++--
 Overlord-Server/public/settings.html          |  7 +-
 .../src/server/ui/sessions-view.ts            |  4 +-
 16 files changed, 194 insertions(+), 83 deletions(-)
 create mode 100644 Overlord-Server/public/assets/stimulus/controllers/clipboard-controller.js
 create mode 100644 Overlord-Server/public/assets/stimulus/controllers/confirm-controller.js
 create mode 100644 Overlord-Server/public/assets/stimulus/controllers/countdown-controller.js
 create mode 100644 Overlord-Server/public/assets/stimulus/controllers/reveal-controller.js
 create mode 100644 Overlord-Server/public/assets/stimulus/controllers/toggle-controller.js

diff --git a/Overlord-Server/public/assets/build.js b/Overlord-Server/public/assets/build.js
index a8d35e8..f14a6c8 100644
--- a/Overlord-Server/public/assets/build.js
+++ b/Overlord-Server/public/assets/build.js
@@ -2,7 +2,6 @@ import { createBuildProfileManager } from "./build-profile-manager.js";
 import {
   createBuildHistoryManager,
   formatFileSize,
-  updateExpirationTimer,
 } from "./build-history-manager.js";
 
 const form = document.getElementById("build-form");
@@ -2259,7 +2258,8 @@ function showBuildFiles(files, buildId, expiresAt) {
   const timer = document.createElement("span");
   timer.id = "expiration-timer";
   timer.className = "text-yellow-400 font-medium";
-  timer.dataset.expires = String(expiresAt);
+  timer.dataset.controller = "countdown";
+  timer.dataset.countdownExpiresAtValue = String(expiresAt);
   timer.textContent = "Calculating...";
   right.appendChild(clockIcon);
   right.appendChild(expiresLabel);
@@ -2270,9 +2270,6 @@ function showBuildFiles(files, buildId, expiresAt) {
   buildInfoDiv.appendChild(infoRow);
   buildFilesDiv.appendChild(buildInfoDiv);
 
-  updateExpirationTimer(timer, expiresAt);
-  setInterval(() => updateExpirationTimer(timer, expiresAt), 60000);
-
   files.forEach((file) => {
     const fileDiv = document.createElement("div");
     fileDiv.className =
diff --git a/Overlord-Server/public/assets/data.js b/Overlord-Server/public/assets/data.js
index 4983ef2..4dbd944 100644
--- a/Overlord-Server/public/assets/data.js
+++ b/Overlord-Server/public/assets/data.js
@@ -108,6 +108,7 @@ function moveClientCardImmediately(msg) {
 
 export function registerRenderer(fn) {
   render = fn;
+  state.lastDigest = "";
 }
 
 function clientQueryParams(page = state.page) {
diff --git a/Overlord-Server/public/assets/file-share.js b/Overlord-Server/public/assets/file-share.js
index ca43d5f..041a9b4 100644
--- a/Overlord-Server/public/assets/file-share.js
+++ b/Overlord-Server/public/assets/file-share.js
@@ -23,12 +23,6 @@ uploadInfinite?.addEventListener("change", () => {
 });
 if (uploadMaxDownloads) uploadMaxDownloads.disabled = true;
 
-const passwordInfoBtn = document.getElementById("password-info-btn");
-const passwordInfoPanel = document.getElementById("password-info-panel");
-passwordInfoBtn?.addEventListener("click", () => {
-  passwordInfoPanel?.classList.toggle("hidden");
-});
-
 async function loadCurrentUser() {
   try {
     const res = await fetch("/api/auth/me");
@@ -113,12 +107,14 @@ async function loadFiles() {
           <td class="px-6 py-4">
             <div class="flex items-center justify-end gap-2">
               <button class="action-btn px-2.5 py-1.5 text-sm bg-slate-800 hover:bg-slate-700 text-slate-200 rounded border border-slate-700 transition-colors"
-                data-action="copy-link" data-file-id="${f.id}" title="Copy download link">
+                data-controller="clipboard" data-action="clipboard#copy"
+                data-clipboard-text-value="${getDownloadUrl(f.id)}"
+                data-clipboard-success-message-value="Download link copied to clipboard!" title="Copy download link">
                 <i class="fa-solid fa-link"></i>
               </button>
               ${canManage ? `
                 <button class="action-btn px-2.5 py-1.5 text-sm bg-slate-800 hover:bg-slate-700 text-slate-200 rounded border border-slate-700 transition-colors"
-                  data-action="edit" data-file-id="${f.id}" 
+                  data-file-action="edit" data-file-id="${f.id}"
                   data-has-password="${f.hasPassword ? 1 : 0}"
                   data-max-downloads="${f.maxDownloads !== null ? f.maxDownloads : ''}"
                   data-expires-at="${f.expiresAt || ''}"
@@ -127,7 +123,9 @@ async function loadFiles() {
                   <i class="fa-solid fa-pen-to-square"></i>
                 </button>
                 <button class="action-btn px-2.5 py-1.5 text-sm bg-red-900/40 hover:bg-red-800/60 text-red-200 rounded border border-red-700/60 transition-colors"
-                  data-action="delete" data-file-id="${f.id}" data-filename="${escapeHtml(f.filename)}" title="Delete file">
+                  data-controller="confirm" data-action="confirm#confirm"
+                  data-confirm-message-value="Delete this file? This cannot be undone."
+                  data-file-action="delete" data-file-id="${f.id}" title="Delete file">
                   <i class="fa-solid fa-trash"></i>
                 </button>
               ` : ""}
@@ -137,57 +135,21 @@ async function loadFiles() {
       })
       .join("");
 
-    attachActionListeners();
   } catch (err) {
     console.error("Load files error:", err);
     fileList.innerHTML = `<tr><td colspan="7" class="px-6 py-12 text-center text-red-400">Failed to load files</td></tr>`;
   }
 }
 
-function attachActionListeners() {
-  fileList.addEventListener("click", (e) => {
-    const btn = e.target.closest(".action-btn");
-    if (!btn) return;
+fileList?.addEventListener("click", (e) => {
+  const btn = e.target.closest("[data-file-action]");
+  if (!btn) return;
 
-    const action = btn.dataset.action;
-    const fileId = btn.dataset.fileId;
-
-    switch (action) {
-      case "copy-link":
-        copyDownloadLink(fileId);
-        break;
-      case "edit":
-        openEditModal(btn);
-        break;
-      case "delete":
-        deleteFile(fileId, btn.dataset.filename);
-        break;
-    }
-  });
-}
-
-function copyDownloadLink(fileId) {
-  const url = getDownloadUrl(fileId);
-  navigator.clipboard.writeText(url).then(() => {
-    if (window.showToast) {
-      window.showToast("Download link copied to clipboard!", "success");
-    }
-  }).catch(() => {
-    const input = document.createElement("input");
-    input.value = url;
-    document.body.appendChild(input);
-    input.select();
-    document.execCommand("copy");
-    document.body.removeChild(input);
-    if (window.showToast) {
-      window.showToast("Download link copied!", "success");
-    }
-  });
-}
-
-async function deleteFile(fileId, filename) {
-  if (!confirm(`Delete "${filename}"? This cannot be undone.`)) return;
+  if (btn.dataset.fileAction === "edit") openEditModal(btn);
+  if (btn.dataset.fileAction === "delete") deleteFile(btn.dataset.fileId);
+});
 
+async function deleteFile(fileId) {
   try {
     const res = await fetch(`/api/file-share/${fileId}`, { method: "DELETE" });
     if (res.ok) {
diff --git a/Overlord-Server/public/assets/main.js b/Overlord-Server/public/assets/main.js
index 67ad20a..96505b7 100644
--- a/Overlord-Server/public/assets/main.js
+++ b/Overlord-Server/public/assets/main.js
@@ -1141,6 +1141,7 @@ function initializeRenderer() {
     }
   });
   initDashboardStats();
+  renderCachedClients({ reorder: true, force: true });
   setupDashboardThumbnailLoader();
   refreshGroupFilter();
   loadWithOptions();
diff --git a/Overlord-Server/public/assets/stimulus/application.js b/Overlord-Server/public/assets/stimulus/application.js
index 182fbde..80109a0 100644
--- a/Overlord-Server/public/assets/stimulus/application.js
+++ b/Overlord-Server/public/assets/stimulus/application.js
@@ -1,9 +1,19 @@
 import { Application } from "/vendor/hotwired/stimulus.js";
 import SessionsController from "./controllers/sessions-controller.js";
+import ClipboardController from "./controllers/clipboard-controller.js";
+import ConfirmController from "./controllers/confirm-controller.js";
+import CountdownController from "./controllers/countdown-controller.js";
+import RevealController from "./controllers/reveal-controller.js";
+import ToggleController from "./controllers/toggle-controller.js";
 
 const application = Application.start();
 application.debug = false;
 application.register("sessions", SessionsController);
+application.register("clipboard", ClipboardController);
+application.register("confirm", ConfirmController);
+application.register("countdown", CountdownController);
+application.register("reveal", RevealController);
+application.register("toggle", ToggleController);
 
 window.OverlordStimulus = application;
 
diff --git a/Overlord-Server/public/assets/stimulus/controllers/clipboard-controller.js b/Overlord-Server/public/assets/stimulus/controllers/clipboard-controller.js
new file mode 100644
index 0000000..1262b6b
--- /dev/null
+++ b/Overlord-Server/public/assets/stimulus/controllers/clipboard-controller.js
@@ -0,0 +1,33 @@
+import { Controller } from "/vendor/hotwired/stimulus.js";
+
+export default class extends Controller {
+  static values = {
+    text: String,
+    successMessage: { type: String, default: "Copied to clipboard" },
+  };
+
+  async copy(event) {
+    event.preventDefault();
+    if (!this.hasTextValue) return;
+
+    try {
+      await navigator.clipboard.writeText(this.textValue);
+    } catch {
+      const input = document.createElement("textarea");
+      input.value = this.textValue;
+      input.setAttribute("readonly", "");
+      input.style.position = "fixed";
+      input.style.opacity = "0";
+      document.body.appendChild(input);
+      input.select();
+      document.execCommand("copy");
+      input.remove();
+    }
+
+    window.showToast?.(this.successMessageValue, "success");
+    this.element.dispatchEvent(new CustomEvent("clipboard:copied", {
+      bubbles: true,
+      detail: { text: this.textValue },
+    }));
+  }
+}
diff --git a/Overlord-Server/public/assets/stimulus/controllers/confirm-controller.js b/Overlord-Server/public/assets/stimulus/controllers/confirm-controller.js
new file mode 100644
index 0000000..cab4a6a
--- /dev/null
+++ b/Overlord-Server/public/assets/stimulus/controllers/confirm-controller.js
@@ -0,0 +1,12 @@
+import { Controller } from "/vendor/hotwired/stimulus.js";
+
+export default class extends Controller {
+  static values = { message: String };
+
+  confirm(event) {
+    if (!this.hasMessageValue || window.confirm(this.messageValue)) return;
+
+    event.preventDefault();
+    event.stopImmediatePropagation();
+  }
+}
diff --git a/Overlord-Server/public/assets/stimulus/controllers/countdown-controller.js b/Overlord-Server/public/assets/stimulus/controllers/countdown-controller.js
new file mode 100644
index 0000000..a9630c6
--- /dev/null
+++ b/Overlord-Server/public/assets/stimulus/controllers/countdown-controller.js
@@ -0,0 +1,53 @@
+import { Controller } from "/vendor/hotwired/stimulus.js";
+
+export default class extends Controller {
+  static values = {
+    expiresAt: Number,
+    interval: { type: Number, default: 60_000 },
+  };
+
+  connect() {
+    this.update();
+    if (this.expiresAtValue > Date.now()) {
+      this.clock = window.setInterval(() => this.update(), this.intervalValue);
+    }
+  }
+
+  disconnect() {
+    window.clearInterval(this.clock);
+  }
+
+  update() {
+    const remaining = this.expiresAtValue - Date.now();
+    if (remaining <= 0) {
+      this.element.textContent = "Expired";
+      this.setTone("text-red-400");
+      window.clearInterval(this.clock);
+      return;
+    }
+
+    const days = Math.floor(remaining / 86_400_000);
+    const hours = Math.floor((remaining % 86_400_000) / 3_600_000);
+    const minutes = Math.floor((remaining % 3_600_000) / 60_000);
+    this.element.textContent = days > 0
+      ? `${days}d ${hours}h`
+      : hours > 0
+        ? `${hours}h ${minutes}m`
+        : `${minutes}m`;
+    this.setTone(days >= 3
+      ? "text-green-400"
+      : days >= 1
+        ? "text-yellow-400"
+        : "text-orange-400");
+  }
+
+  setTone(tone) {
+    this.element.classList.remove(
+      "text-red-400",
+      "text-green-400",
+      "text-yellow-400",
+      "text-orange-400",
+    );
+    this.element.classList.add(tone, "font-medium");
+  }
+}
diff --git a/Overlord-Server/public/assets/stimulus/controllers/reveal-controller.js b/Overlord-Server/public/assets/stimulus/controllers/reveal-controller.js
new file mode 100644
index 0000000..76f30bb
--- /dev/null
+++ b/Overlord-Server/public/assets/stimulus/controllers/reveal-controller.js
@@ -0,0 +1,17 @@
+import { Controller } from "/vendor/hotwired/stimulus.js";
+
+export default class extends Controller {
+  static targets = ["input", "icon"];
+
+  toggle(event) {
+    event.preventDefault();
+    const revealing = this.inputTarget.type === "password";
+    this.inputTarget.type = revealing ? "text" : "password";
+    event.currentTarget.setAttribute("aria-pressed", String(revealing));
+    event.currentTarget.setAttribute("aria-label", revealing ? "Hide value" : "Show value");
+    if (this.hasIconTarget) {
+      this.iconTarget.classList.toggle("fa-eye", !revealing);
+      this.iconTarget.classList.toggle("fa-eye-slash", revealing);
+    }
+  }
+}
diff --git a/Overlord-Server/public/assets/stimulus/controllers/sessions-controller.js b/Overlord-Server/public/assets/stimulus/controllers/sessions-controller.js
index 2eb1823..d1d411a 100644
--- a/Overlord-Server/public/assets/stimulus/controllers/sessions-controller.js
+++ b/Overlord-Server/public/assets/stimulus/controllers/sessions-controller.js
@@ -12,13 +12,6 @@ export default class extends Controller {
     window.clearInterval(this.clock);
   }
 
-  confirm(event) {
-    const message = event.currentTarget.dataset.confirmMessage;
-    if (message && !window.confirm(message)) {
-      event.preventDefault();
-    }
-  }
-
   updateTimes() {
     const now = Math.floor(Date.now() / 1000);
     for (const element of this.timeTargets) {
diff --git a/Overlord-Server/public/assets/stimulus/controllers/toggle-controller.js b/Overlord-Server/public/assets/stimulus/controllers/toggle-controller.js
new file mode 100644
index 0000000..094520f
--- /dev/null
+++ b/Overlord-Server/public/assets/stimulus/controllers/toggle-controller.js
@@ -0,0 +1,11 @@
+import { Controller } from "/vendor/hotwired/stimulus.js";
+
+export default class extends Controller {
+  static targets = ["content"];
+
+  toggle(event) {
+    event.preventDefault();
+    const hidden = this.contentTarget.classList.toggle("hidden");
+    event.currentTarget.setAttribute("aria-expanded", String(!hidden));
+  }
+}
diff --git a/Overlord-Server/public/assets/turbo-navigation.js b/Overlord-Server/public/assets/turbo-navigation.js
index 5656b98..b1f56f8 100644
--- a/Overlord-Server/public/assets/turbo-navigation.js
+++ b/Overlord-Server/public/assets/turbo-navigation.js
@@ -22,6 +22,7 @@ const persistentIds = [
   "chat-bubble",
   "chat-panel",
   "cert-trust-banner",
+  "command-menu",
 ];
 
 function normalizeUrl(value, base = window.location.href) {
diff --git a/Overlord-Server/public/assets/ui.js b/Overlord-Server/public/assets/ui.js
index f572618..cba2a31 100644
--- a/Overlord-Server/public/assets/ui.js
+++ b/Overlord-Server/public/assets/ui.js
@@ -1,3 +1,5 @@
+import { runWithoutPageTracking } from "./turbo-navigation.js";
+
 // ── Context menu data ─────────────────────────────────────────────────────────
 const MENU_GROUPS = [
   {
@@ -254,7 +256,6 @@ menuStyle.textContent = `
   #ctx-main { border-radius: 8px 8px 0 0; }
 }
 `;
-document.head.appendChild(menuStyle);
 
 // ── Build DOM ─────────────────────────────────────────────────────────────────
 function buildItemHTML(item) {
@@ -282,9 +283,11 @@ const subPanelsHTML =
 
 const menu = document.createElement("div");
 menu.id = "command-menu";
+menu.setAttribute("data-turbo-permanent", "");
 menu.setAttribute("role", "menu");
 menu.setAttribute("aria-hidden", "true");
 menu.innerHTML = `<div id="ctx-main">${mainRowsHTML}</div><div id="ctx-sub">${subPanelsHTML}</div>`;
+menu.prepend(menuStyle);
 document.body.appendChild(menu);
 
 const ctxMain = menu.querySelector("#ctx-main");
@@ -363,32 +366,34 @@ function refitMobileMenu() {
 }
 
 ctxMain.querySelectorAll(".ctx-row").forEach(rowEl => {
-  rowEl.addEventListener("mouseenter", () => {
+  runWithoutPageTracking(() => rowEl.addEventListener("mouseenter", () => {
     if (isMobileMenu()) return;
     if (rowEl.disabled || rowEl.getAttribute("aria-disabled") === "true") return;
     const groupId = rowEl.dataset.groupToggle;
     if (groupId) showSubmenu(groupId, rowEl);
-  });
+  }));
 });
 
 // Debounced hide — prevents the 5px gap between panels from closing the submenu
 function scheduleHide() { if (!isMobileMenu()) _hideTimer = setTimeout(hideSubmenu, 150); }
 function cancelHide()   { clearTimeout(_hideTimer); _hideTimer = null; }
 
-ctxMain.addEventListener("mouseleave", scheduleHide);
-ctxMain.addEventListener("mouseenter", cancelHide);
-ctxSub.addEventListener("mouseenter",  cancelHide);
-ctxSub.addEventListener("mouseleave",  scheduleHide);
+runWithoutPageTracking(() => {
+  ctxMain.addEventListener("mouseleave", scheduleHide);
+  ctxMain.addEventListener("mouseenter", cancelHide);
+  ctxSub.addEventListener("mouseenter", cancelHide);
+  ctxSub.addEventListener("mouseleave", scheduleHide);
+});
 
 // Touch / mobile: tap to toggle group
 ctxMain.querySelectorAll(".ctx-row").forEach(rowEl => {
-  rowEl.addEventListener("click", (e) => {
+  runWithoutPageTracking(() => rowEl.addEventListener("click", (e) => {
     const groupId = rowEl.dataset.groupToggle;
     if (!groupId) return;
     if (rowEl.disabled || rowEl.getAttribute("aria-disabled") === "true") return;
     e.stopPropagation();
     if (activeGroupId === groupId) { hideSubmenu(); } else { showSubmenu(groupId, rowEl); }
-  });
+  }));
 });
 
 const modal = document.createElement("div");
diff --git a/Overlord-Server/public/file-share.html b/Overlord-Server/public/file-share.html
index f1800b3..428edb5 100644
--- a/Overlord-Server/public/file-share.html
+++ b/Overlord-Server/public/file-share.html
@@ -40,18 +40,23 @@
                 class="block w-full text-sm text-slate-300 file:mr-4 file:py-2 file:px-4 file:rounded-lg file:border-0 file:text-sm file:font-medium file:bg-slate-800 file:text-slate-200 hover:file:bg-slate-700 cursor-pointer" />
             </div>
             <div class="grid grid-cols-1 md:grid-cols-3 gap-4">
-              <div>
+              <div data-controller="toggle">
                 <div class="flex items-center gap-1.5 mb-1">
                   <label class="block text-sm font-medium text-slate-300">Password (optional)</label>
-                  <button type="button" id="password-info-btn"
+                  <button type="button" id="password-info-btn" data-action="toggle#toggle" aria-expanded="false" aria-controls="password-info-panel"
                     class="inline-flex items-center justify-center w-5 h-5 rounded-full bg-slate-700 hover:bg-slate-600 text-slate-400 hover:text-slate-200 text-xs transition-colors"
                     title="How to download with a password">
                     <i class="fa-solid fa-question"></i>
                   </button>
                 </div>
-                <input type="password" id="upload-password" placeholder="Leave empty for no password"
-                  class="w-full px-3 py-2 bg-slate-800 border border-slate-700 rounded-lg text-slate-200 text-sm focus:outline-none focus:ring-2 focus:ring-rose-500/50" />
-                <div id="password-info-panel" class="hidden mt-2 p-3 bg-slate-800/80 border border-slate-700 rounded-lg text-xs text-slate-400">
+                <div class="relative" data-controller="reveal">
+                  <input type="password" id="upload-password" placeholder="Leave empty for no password" data-reveal-target="input"
+                    class="w-full pr-10 px-3 py-2 bg-slate-800 border border-slate-700 rounded-lg text-slate-200 text-sm focus:outline-none focus:ring-2 focus:ring-rose-500/50" />
+                  <button type="button" data-action="reveal#toggle" aria-label="Show value" aria-pressed="false" class="absolute inset-y-0 right-0 px-3 text-slate-400 hover:text-slate-200">
+                    <i class="fa-solid fa-eye" data-reveal-target="icon"></i>
+                  </button>
+                </div>
+                <div id="password-info-panel" data-toggle-target="content" class="hidden mt-2 p-3 bg-slate-800/80 border border-slate-700 rounded-lg text-xs text-slate-400">
                   <p class="mb-1.5 text-slate-300 font-medium">Downloading password-protected files:</p>
                   <p class="mb-1">Use the <code class="px-1 py-0.5 bg-slate-900 rounded text-rose-300">X-Download-Password</code> header:</p>
                   <pre class="mt-1 mb-2 p-2 bg-slate-900 rounded text-emerald-300 overflow-x-auto select-all">curl -H "X-Download-Password: yourpass" https://host/api/file-share/&lt;id&gt;/download -o file.ext</pre>
@@ -127,8 +132,13 @@
         <div class="space-y-4">
           <div>
             <label class="block text-sm font-medium text-slate-300 mb-1">Password</label>
-            <input type="password" id="edit-password" placeholder="Leave empty to remove password"
-              class="w-full px-3 py-2 bg-slate-800 border border-slate-700 rounded-lg text-slate-200 text-sm focus:outline-none focus:ring-2 focus:ring-rose-500/50" />
+            <div class="relative" data-controller="reveal">
+              <input type="password" id="edit-password" placeholder="Leave empty to remove password" data-reveal-target="input"
+                class="w-full pr-10 px-3 py-2 bg-slate-800 border border-slate-700 rounded-lg text-slate-200 text-sm focus:outline-none focus:ring-2 focus:ring-rose-500/50" />
+              <button type="button" data-action="reveal#toggle" aria-label="Show value" aria-pressed="false" class="absolute inset-y-0 right-0 px-3 text-slate-400 hover:text-slate-200">
+                <i class="fa-solid fa-eye" data-reveal-target="icon"></i>
+              </button>
+            </div>
             <p class="text-xs text-slate-500 mt-1">Enter new password or leave blank to remove</p>
           </div>
           <div>
diff --git a/Overlord-Server/public/settings.html b/Overlord-Server/public/settings.html
index 06fa262..3183642 100644
--- a/Overlord-Server/public/settings.html
+++ b/Overlord-Server/public/settings.html
@@ -878,7 +878,12 @@
             </label>
             <label class="block">
               <span class="text-sm text-slate-300">Client secret <span class="text-rose-400" aria-hidden="true">*</span><span class="sr-only">required unless client auth method is none</span></span>
-              <input id="oidc-client-secret" type="password" autocomplete="new-password" placeholder="Leave blank to keep existing secret" class="mt-1 w-full px-3 py-2 rounded-lg bg-slate-900 border border-slate-700 focus:outline-none focus:ring-2 focus:ring-teal-500" />
+              <div class="relative" data-controller="reveal">
+                <input id="oidc-client-secret" type="password" autocomplete="new-password" placeholder="Leave blank to keep existing secret" data-reveal-target="input" class="mt-1 w-full pr-10 px-3 py-2 rounded-lg bg-slate-900 border border-slate-700 focus:outline-none focus:ring-2 focus:ring-teal-500" />
+                <button type="button" data-action="reveal#toggle" aria-label="Show value" aria-pressed="false" class="absolute inset-y-0 right-0 mt-1 px-3 text-slate-400 hover:text-slate-200">
+                  <i class="fa-solid fa-eye" data-reveal-target="icon"></i>
+                </button>
+              </div>
               <p id="oidc-secret-hint" class="text-xs text-slate-500 mt-1">No client secret is currently saved.</p>
             </label>
           </div>
diff --git a/Overlord-Server/src/server/ui/sessions-view.ts b/Overlord-Server/src/server/ui/sessions-view.ts
index 4f92f37..cda3c5c 100644
--- a/Overlord-Server/src/server/ui/sessions-view.ts
+++ b/Overlord-Server/src/server/ui/sessions-view.ts
@@ -46,7 +46,7 @@ function renderSessionRow(
     <td class="px-3 py-2 text-slate-400 text-xs"><time data-sessions-target="time" data-format="relative" data-timestamp="${session.lastActivity}" datetime="${new Date(session.lastActivity * 1000).toISOString()}">—</time></td>
     <td class="px-3 py-2 text-xs">${status}${currentBadge}</td>
     <td class="px-3 py-2 text-right">
-      ${canRevoke ? `<form method="post" action="/ui/settings/sessions/${encodeURIComponent(session.id)}/revoke" data-turbo="true" data-action="submit->sessions#confirm" data-confirm-message="${escapeHtml(confirmation)}" class="inline">
+      ${canRevoke ? `<form method="post" action="/ui/settings/sessions/${encodeURIComponent(session.id)}/revoke" data-turbo="true" data-controller="confirm" data-action="submit->confirm#confirm" data-confirm-message-value="${escapeHtml(confirmation)}" class="inline">
         <button type="submit" class="px-2.5 py-1.5 rounded bg-red-700/80 hover:bg-red-600 text-white text-xs disabled:opacity-50">
           <i class="fa-solid fa-right-from-bracket mr-1"></i>Revoke
         </button>
@@ -80,7 +80,7 @@ export function renderSessionsFrame(
         <a href="/ui/settings/sessions" class="inline-flex items-center gap-2 px-3 py-2 rounded-lg bg-slate-800 hover:bg-slate-700 border border-slate-700 text-sm transition-colors">
           <i class="fa-solid fa-rotate"></i>Refresh
         </a>
-        <form method="post" action="/ui/settings/sessions/inactive" data-turbo="true" data-action="submit->sessions#confirm" data-confirm-message="Remove all expired and revoked sessions?">
+        <form method="post" action="/ui/settings/sessions/inactive" data-turbo="true" data-controller="confirm" data-action="submit->confirm#confirm" data-confirm-message-value="Remove all expired and revoked sessions?">
           <button type="submit" class="inline-flex items-center gap-2 px-3 py-2 rounded-lg bg-red-900/40 hover:bg-red-800/60 text-red-100 border border-red-700/60 text-sm transition-colors disabled:opacity-50">
             <i class="fa-solid fa-broom"></i>Remove Inactive
           </button>