diff --git a/README.md b/README.md
index f2fbf97..c3ea2bb 100644
--- a/README.md
+++ b/README.md
@@ -57,7 +57,12 @@ docker compose up -d
 
 ### 局域网访问
 
-如果要从另一台机器访问，例如 `http://10.0.0.138:5580`，需要同时让
+不建议把 `5580` / `5581` 直接暴露到不受信网络。`JOBS_API_ALLOWED_ORIGINS`
+只限制浏览器 CORS；不带 `Origin` 的脚本或命令行客户端仍然可以直接调用
+jobs-api。需要多人或跨网段访问时，优先用带认证和 TLS 的反向代理保护两个
+端口。
+
+如果只是在受信局域网临时访问，例如 `http://10.0.0.138:5580`，需要同时让
 `rclone` 和 `jobs-api` 两个端口监听这个地址，并把页面 Origin 加进
 jobs-api 白名单：
 
diff --git a/webgui/web/assets/js/app.js b/webgui/web/assets/js/app.js
index affbbf2..3904055 100644
--- a/webgui/web/assets/js/app.js
+++ b/webgui/web/assets/js/app.js
@@ -2,15 +2,15 @@
 // the top-nav active state in sync, and re-renders chrome strings when
 // the locale changes.
 
-import { onRoute } from "./state.js?v=job-stats-1";
-import { t, currentLocale, setLocale, onLocale } from "./i18n.js?v=job-stats-1";
-import { renderRemotes } from "./views/remotes.js?v=job-stats-1";
-import { renderBrowse } from "./views/browser.js?v=job-stats-1";
-import { renderJobs, renderNewJob, stopJobPolling } from "./views/jobs.js?v=job-stats-1";
+import { escapeHtml, onRoute } from "./state.js?v=review-fixes-1";
+import { t, currentLocale, setLocale, onLocale } from "./i18n.js?v=review-fixes-1";
+import { renderRemotes } from "./views/remotes.js?v=review-fixes-1";
+import { renderBrowse } from "./views/browser.js?v=review-fixes-1";
+import { renderJobs, renderNewJob, stopJobPolling } from "./views/jobs.js?v=review-fixes-1";
 import {
   renderConfigureNew,
   renderConfigureEdit,
-} from "./views/configure.js?v=job-stats-1";
+} from "./views/configure.js?v=review-fixes-1";
 
 const views = {
   remotes: renderRemotes,
@@ -94,12 +94,3 @@ onLocale(() => {
 // Initial chrome paint + switcher wiring.
 applyChromeStrings();
 wireLangSwitcher();
-
-function escapeHtml(s) {
-  return String(s)
-    .replace(/&/g, "&")
-    .replace(/</g, "&lt;")
-    .replace(/>/g, "&gt;")
-    .replace(/"/g, "&quot;")
-    .replace(/'/g, "&#39;");
-}
diff --git a/webgui/web/assets/js/i18n.js b/webgui/web/assets/js/i18n.js
index 62a24f5..a8f9a7b 100644
--- a/webgui/web/assets/js/i18n.js
+++ b/webgui/web/assets/js/i18n.js
@@ -190,7 +190,7 @@ const STRINGS = {
     "jobs.schedule_label_monthly": (day, time) => `Day ${day} of every month at ${time}`,
     "jobs.schedule_label_monthly_last": (time) => `Last day of every month at ${time}`,
     "jobs.local_option": "Local filesystem",
-    "jobs.local_path_help": "For Local filesystem, enter a path visible inside the rclone process, such as /data/source in this Docker setup. For remotes, enter a path inside the selected remote.",
+    "jobs.local_path_help": "For Local filesystem, enter a path visible inside the rclone process, such as /root/source in this Docker setup. For remotes, enter a path inside the selected remote.",
     "jobs.source_remote": "Source location",
     "jobs.source_path": "Source path",
     "jobs.dest_remote": "Destination location",
@@ -209,7 +209,7 @@ const STRINGS = {
     "jobs.empty_title": "No jobs yet",
     "jobs.empty_once_title": "No one-time jobs yet",
     "jobs.empty_recurring_title": "No recurring jobs yet",
-    "jobs.empty_body": "Use New Job to start a copy, sync, or move.",
+    "jobs.empty_body": (link) => `Use ${link} to start a copy, sync, or move.`,
     "jobs.started": (a, id) => `Started ${a} job #${id}`,
     "jobs.started_once": (a, id) => `Started one-time ${a} job #${id}`,
     "jobs.recurring_saved": (id) => `Saved recurring job #${id}`,
@@ -420,7 +420,7 @@ const STRINGS = {
     "jobs.schedule_label_monthly": (day, time) => `每月 ${day} 号 ${time}`,
     "jobs.schedule_label_monthly_last": (time) => `每月最后一天 ${time}`,
     "jobs.local_option": "本地文件系统",
-    "jobs.local_path_help": "选择本地文件系统时填写 rclone 进程内可见的路径；当前 Docker 编排里通常是 /data/source。选择远程存储时填写该远程内的路径。",
+    "jobs.local_path_help": "选择本地文件系统时填写 rclone 进程内可见的路径；当前 Docker 编排里通常是 /root/source。选择远程存储时填写该远程内的路径。",
     "jobs.source_remote": "源位置",
     "jobs.source_path": "源路径",
     "jobs.dest_remote": "目标位置",
@@ -439,7 +439,7 @@ const STRINGS = {
     "jobs.empty_title": "尚无任务",
     "jobs.empty_once_title": "尚无单次任务",
     "jobs.empty_recurring_title": "尚无循环任务",
-    "jobs.empty_body": "用「新建任务」开始一个 copy、sync 或 move。",
+    "jobs.empty_body": (link) => `用${link}开始一个 copy、sync 或 move。`,
     "jobs.started": (a, id) => `已启动 ${a} 任务 #${id}`,
     "jobs.started_once": (a, id) => `已启动单次 ${a} 任务 #${id}`,
     "jobs.recurring_saved": (id) => `已保存循环任务 #${id}`,
diff --git a/webgui/web/assets/js/state.js b/webgui/web/assets/js/state.js
index c4c70e1..38eea5c 100644
--- a/webgui/web/assets/js/state.js
+++ b/webgui/web/assets/js/state.js
@@ -156,3 +156,12 @@ export function formatTime(iso) {
     return iso;
   }
 }
+
+export function escapeHtml(s) {
+  return String(s)
+    .replace(/&/g, "&amp;")
+    .replace(/</g, "&lt;")
+    .replace(/>/g, "&gt;")
+    .replace(/"/g, "&quot;")
+    .replace(/'/g, "&#39;");
+}
diff --git a/webgui/web/assets/js/views/browser.js b/webgui/web/assets/js/views/browser.js
index 3e8006e..b48a28e 100644
--- a/webgui/web/assets/js/views/browser.js
+++ b/webgui/web/assets/js/views/browser.js
@@ -1,8 +1,8 @@
 // views/browser.js — file/folder listing with breadcrumbs, mkdir, upload, delete, rename.
 
-import { post, uploadFile, downloadURL } from "../rc.js?v=job-stats-1";
-import { toast, formatBytes, formatTime } from "../state.js?v=job-stats-1";
-import { t } from "../i18n.js?v=job-stats-1";
+import { post, uploadFile, downloadURL } from "../rc.js?v=review-fixes-1";
+import { escapeHtml, toast, formatBytes, formatTime } from "../state.js?v=review-fixes-1";
+import { t } from "../i18n.js?v=review-fixes-1";
 
 export async function renderBrowse({ remote, path }) {
   const app = document.getElementById("app");
@@ -37,18 +37,7 @@ export async function renderBrowse({ remote, path }) {
   const card = document.getElementById("browser-card");
   const fileInput = document.getElementById("upload-input");
 
-  try {
-    const res = await post("operations/list", {
-      fs,
-      remote: path || "",
-      opt: { noModTime: false, noMimeType: true, showHash: false },
-    });
-    const items = (res && res.list) || [];
-    renderTable(card, fs, path, items);
-  } catch (e) {
-    card.innerHTML = `<div class="empty"><h3>${t("error.couldnt_list")}</h3><p>${escapeHtml(e.message)}</p></div>`;
-    toast(`${t("browser.browse_failed")}: ${e.message}`, "error");
-  }
+  await refreshListing(card, fs, path);
 
   app.querySelector('[data-action="mkdir"]').addEventListener("click", () => {
     openModal(
@@ -61,6 +50,7 @@ export async function renderBrowse({ remote, path }) {
         const target = path ? `${path}/${name}` : name;
         await post("operations/mkdir", { fs, remote: target });
         toast(t("browser.mkdir_created", name), "success");
+        await refreshListing(card, fs, path);
       },
     ).catch((e) => toast(`${t("browser.mkdir_failed")}: ${e.message}`, "error"));
   });
@@ -76,13 +66,30 @@ export async function renderBrowse({ remote, path }) {
     try {
       await uploadFile(fs, path || "", files);
       toast(t("browser.uploaded", files.length), "success");
-      location.reload();
+      await refreshListing(card, fs, path);
     } catch (e) {
       toast(`${t("browser.upload_failed")}: ${e.message}`, "error");
     }
   });
 }
 
+async function refreshListing(card, fs, path) {
+  if (!card) return;
+  card.innerHTML = `<p class="empty">${t("loading.title")}…</p>`;
+  try {
+    const res = await post("operations/list", {
+      fs,
+      remote: path || "",
+      opt: { noModTime: false, noMimeType: true, showHash: false },
+    });
+    const items = (res && res.list) || [];
+    renderTable(card, fs, path, items);
+  } catch (e) {
+    card.innerHTML = `<div class="empty"><h3>${t("error.couldnt_list")}</h3><p>${escapeHtml(e.message)}</p></div>`;
+    toast(`${t("browser.browse_failed")}: ${e.message}`, "error");
+  }
+}
+
 function renderBreadcrumbs(el, remote, path) {
   const segments = (path || "").split("/").filter(Boolean);
   let html = `<a href="#/remotes">${t("nav.remotes")}</a><span class="sep">/</span>`;
@@ -198,7 +205,7 @@ async function onDelete(fs, path, itemPath) {
   try {
     await post("operations/deletefile", { fs, remote: itemPath });
     toast(t("browser.deleted", itemPath), "success");
-    location.reload();
+    await refreshListing(document.getElementById("browser-card"), fs, path);
   } catch (e) {
     toast(`${t("browser.delete_file_failed")}: ${e.message}`, "error");
   }
@@ -224,7 +231,7 @@ async function onRename(fs, path, itemPath) {
         toast(t("browser.renamed", name), "success");
       },
     );
-    location.reload();
+    await refreshListing(document.getElementById("browser-card"), fs, path);
   } catch (e) {
     toast(`${t("browser.rename_failed")}: ${e.message}`, "error");
   }
@@ -289,12 +296,3 @@ export function openModal(title, fields, onSubmit) {
     if (first) first.focus();
   });
 }
-
-function escapeHtml(s) {
-  return String(s)
-    .replace(/&/g, "&amp;")
-    .replace(/</g, "&lt;")
-    .replace(/>/g, "&gt;")
-    .replace(/"/g, "&quot;")
-    .replace(/'/g, "&#39;");
-}
diff --git a/webgui/web/assets/js/views/configure.js b/webgui/web/assets/js/views/configure.js
index aebd47e..572feab 100644
--- a/webgui/web/assets/js/views/configure.js
+++ b/webgui/web/assets/js/views/configure.js
@@ -9,9 +9,9 @@
 // OAuth backends (option named "token" with IsPassword) get a banner
 // and disabled submit — user must run `rclone config` in a terminal.
 
-import { post } from "../rc.js?v=job-stats-1";
-import { getState, setState, toast } from "../state.js?v=job-stats-1";
-import { t } from "../i18n.js?v=job-stats-1";
+import { post } from "../rc.js?v=review-fixes-1";
+import { escapeHtml, getState, setState, toast } from "../state.js?v=review-fixes-1";
+import { t } from "../i18n.js?v=review-fixes-1";
 
 // --- Route entrypoints ---
 
@@ -426,15 +426,6 @@ async function ensureProviders() {
   return providers;
 }
 
-function escapeHtml(s) {
-  return String(s)
-    .replace(/&/g, "&amp;")
-    .replace(/</g, "&lt;")
-    .replace(/>/g, "&gt;")
-    .replace(/"/g, "&quot;")
-    .replace(/'/g, "&#39;");
-}
-
 function escapeAttr(s) {
   return escapeHtml(s);
 }
diff --git a/webgui/web/assets/js/views/jobs.js b/webgui/web/assets/js/views/jobs.js
index 75bc8c3..afd6c28 100644
--- a/webgui/web/assets/js/views/jobs.js
+++ b/webgui/web/assets/js/views/jobs.js
@@ -1,13 +1,14 @@
 // views/jobs.js — submit sync/copy/move jobs and manage recurring transfers.
 
-import { post } from "../rc.js?v=job-stats-1";
+import { post } from "../rc.js?v=review-fixes-1";
 import {
   toast,
   formatBytes,
   formatSpeed,
   formatDuration,
-} from "../state.js?v=job-stats-1";
-import { t } from "../i18n.js?v=job-stats-1";
+  escapeHtml,
+} from "../state.js?v=review-fixes-1";
+import { t } from "../i18n.js?v=review-fixes-1";
 import {
   createOneTimeJob,
   createRecurringJob,
@@ -20,7 +21,7 @@ import {
   runRecurringJobNow,
   stopOneTimeJob,
   stopRecurringJob,
-} from "../jobs_api.js?v=job-stats-1";
+} from "../jobs_api.js?v=review-fixes-1";
 
 let pollTimer = null;
 const LOCAL_FS_VALUE = "__local__";
@@ -502,7 +503,7 @@ async function refreshJobs() {
     card.innerHTML = `
       <div class="empty">
         <h3>${currentJobsView === "once" ? t("jobs.empty_once_title") : t("jobs.empty_recurring_title")}</h3>
-        <p>${t("jobs.empty_body").replace("New Job", `<a href="#/jobs/new">${t("jobs.new_btn")}</a>`)}</p>
+        <p>${emptyJobsBody()}</p>
       </div>
     `;
     return false;
@@ -524,6 +525,11 @@ async function refreshJobs() {
   return jobs.some((job) => job.running);
 }
 
+function emptyJobsBody() {
+  const link = `<a href="#/jobs/new">${escapeHtml(t("jobs.new_btn"))}</a>`;
+  return t("jobs.empty_body", link);
+}
+
 function renderJobTable(statuses) {
   statuses.sort((a, b) => {
     const bTime = Date.parse(b.updatedAt || b.createdAt || b.startedAt || 0) || 0;
@@ -890,15 +896,6 @@ function oneTimeIdFromKey(key) {
   return Number(String(key).replace(/^once:/, ""));
 }
 
-function escapeHtml(s) {
-  return String(s)
-    .replace(/&/g, "&amp;")
-    .replace(/</g, "&lt;")
-    .replace(/>/g, "&gt;")
-    .replace(/"/g, "&quot;")
-    .replace(/'/g, "&#39;");
-}
-
 function escapeAttr(s) {
   return escapeHtml(s);
 }
diff --git a/webgui/web/assets/js/views/remotes.js b/webgui/web/assets/js/views/remotes.js
index c35b23f..5473aa1 100644
--- a/webgui/web/assets/js/views/remotes.js
+++ b/webgui/web/assets/js/views/remotes.js
@@ -1,8 +1,8 @@
 // views/remotes.js — connector-tile grid of configured remotes with CRUD.
 
-import { post } from "../rc.js?v=job-stats-1";
-import { getState, setState, toast } from "../state.js?v=job-stats-1";
-import { t } from "../i18n.js?v=job-stats-1";
+import { post } from "../rc.js?v=review-fixes-1";
+import { escapeHtml, getState, setState, toast } from "../state.js?v=review-fixes-1";
+import { t } from "../i18n.js?v=review-fixes-1";
 
 export async function renderRemotes() {
   const app = document.getElementById("app");
@@ -94,12 +94,3 @@ export async function renderRemotes() {
     toast(`${t("remotes.load_failed")}: ${e.message}`, "error");
   }
 }
-
-function escapeHtml(s) {
-  return String(s)
-    .replace(/&/g, "&amp;")
-    .replace(/</g, "&lt;")
-    .replace(/>/g, "&gt;")
-    .replace(/"/g, "&quot;")
-    .replace(/'/g, "&#39;");
-}
diff --git a/webgui/web/index.html b/webgui/web/index.html
index da5827e..61954eb 100644
--- a/webgui/web/index.html
+++ b/webgui/web/index.html
@@ -7,7 +7,7 @@
   <link rel="icon" type="image/svg+xml" href="/assets/favicon.svg">
   <link rel="stylesheet" href="/assets/styles/tokens.css">
   <link rel="stylesheet" href="/assets/styles/base.css">
-  <link rel="stylesheet" href="/assets/styles/components.css?v=job-stats-1">
+  <link rel="stylesheet" href="/assets/styles/components.css?v=review-fixes-1">
 </head>
 <body>
   <header class="top-nav">
@@ -80,6 +80,6 @@
   <div id="toast-stack" class="toast-stack"></div>
   <div id="modal-root"></div>
 
-  <script type="module" src="/assets/js/app.js?v=job-stats-1"></script>
+  <script type="module" src="/assets/js/app.js?v=review-fixes-1"></script>
 </body>
 </html>