diff --git a/content/panel.js b/content/panel.js
index af22059..9bb1dab 100644
--- a/content/panel.js
+++ b/content/panel.js
@@ -39,7 +39,7 @@
  var set = mk('div', 'dshmem-settings'); el.settings = set;
  var lbl = mk('div', 'dshmem-label', 'Token (save, then reload page)');
  el.token = mk('input', 'dshmem-input');
- el.token.type = 'password'; el.token.autocomplete = 'new-password'; el.token.setAttribute('autocomplete', 'new-password');
+ el.token.type = 'password'; el.token.autocomplete = 'one-time-code'; el.token.setAttribute('autocomplete', 'one-time-code');
  el.token.placeholder = 'dshmem-bridge-token';
  var row2 = mk('div', 'dshmem-row');
  el.save = mk('button', 'dshmem-btn primary', 'Save');
@@ -64,7 +64,7 @@
  });
  el.settingsToggle.addEventListener('click', function () { var s = el.settings; if (s) { s.style.display = s.style.display === 'none' ? '' : 'none' } }); el.transportToggle.addEventListener('click', function () { state.transport = state.transport === 'msg' ? 'xhr' : 'msg'; el.transportToggle.textContent = state.transport === 'msg' ? 'DSH MSG' : 'DSH XHR'; try { chrome.storage.local.set({ 'dshmem-transport': state.transport }) } catch (e) { } }); el.reset.addEventListener('click', function () { el.start.disabled = false; state.resetCbs.forEach(function (cb) { try { cb(); } catch (e) {} }); });
  el.stop.addEventListener('click', function () { el.start.disabled = false; state.stopCbs.forEach(function (cb) { try { cb(); } catch (e) {} }); }); el.start.addEventListener('click', function () { el.start.disabled = true; state.startCbs.forEach(function (cb) { try { cb(); } catch (e) {} }); });
- el.accLimit.addEventListener('change', function () { var n = parseInt(el.accLimit.value, 10); if (!n || n < 1000) n = 900000; state.accLimit = n; try { chrome.storage.local.set({ 'dshmem-acc-limit': n }) } catch (e) { } API.setMetrics(state.lastMetrics); }); el.accLimit.addEventListener('change', function () { var n = parseInt(el.accLimit.value, 10); if (!n || n < 1000) n = 900000; state.accLimit = n; try { chrome.storage.local.set({ 'dshmem-acc-limit': n }) } catch (e) { } API.setMetrics(state.lastMetrics); }); el.save.addEventListener('click', function () { var v = el.token.value || ''; state.saveCbs.forEach(function (cb) { try { cb(v); } catch (e) {} }); });
+ el.accLimit.addEventListener('change', function () { var n = parseInt(el.accLimit.value, 10); if (!n || n < 1000) n = 900000; state.accLimit = n; try { chrome.storage.local.set({ 'dshmem-acc-limit': n }) } catch (e) { } API.setMetrics(state.lastMetrics); }); el.accLimit.addEventListener('change', function () { var n = parseInt(el.accLimit.value, 10); if (!n || n < 1000) n = 900000; state.accLimit = n; try { chrome.storage.local.set({ 'dshmem-acc-limit': n }) } catch (e) { } API.setMetrics(state.lastMetrics); }); el.save.addEventListener('click', function () { var v = el.token.value || ''; if (!v) { API.log('token not changed (empty)'); return; } state.saveCbs.forEach(function (cb) { try { cb(v); } catch (e) {} }); });
  el.health.addEventListener('click', function () {
  try { globalThis.DSH_BRIDGE.health().then(function (r) {
  if (r && r.ok) { API.setConnected(true); API.log('health ok, bridge up'); }