Say the wiki switch covers API keys and widgets, not public links

Public-link visitors edit only wikis they can edit themselves and approve
each edit. The docs also note that with authentication off every caller
is the owner's local user, so the switch has no effect there.

docs/content/Deploying/Access-Control.mdx

@@ -143,7 +143,7 @@ Sharing rules:
 - Each share carries an access level: **`viewer`** (read-only) or **`editor`** (read and modify).
 - `editor` is not the same as owner — an editor can change a resource but cannot delete it or re-share it.
 - Shared tools run server-side with the **owner's** credentials; a grantee never sees the owner's secrets.
-- A wiki's editors can edit its pages, but only its owner decides whether API, widget and public-link users can edit it through an agent (see [Wiki sources](/Sources/Wiki-sources#edits-from-the-api-widget-and-public-links)).
+- A wiki's editors can edit its pages, but only its owner decides whether API and widget users can edit it through an agent (see [Wiki sources](/Sources/Wiki-sources#edits-from-the-api-widget-and-public-links)).
 
 ### Resources an editor adds to someone else's agent
 

docs/content/Guides/Connectors.mdx

@@ -55,7 +55,7 @@ The same list covers people who open the agent from its public link without bein
 
 Schedules that an API or widget chat set up before this version still run as the owner's own, without this list, until they fire or expire. Schedules set from a public link follow the list from their next run.
 
-Wikis have their own switch rather than an entry in this list: API, widget and public-link users can read a wiki the agent uses but edit it only when the wiki's owner turns on **Let API, widget and public-link users edit this wiki** in its **Wiki settings** (see [Wiki sources](/Sources/Wiki-sources#edits-from-the-api-widget-and-public-links)).
+Wikis have their own switch rather than an entry in this list: API and widget users can read a wiki the agent uses but edit it only when the wiki's owner turns on **Let API and widget users edit this wiki** in its **Wiki settings**. Public-link visitors edit only wikis they can edit themselves, and approve each edit (see [Wiki sources](/Sources/Wiki-sources#edits-from-the-api-widget-and-public-links)).
 
 A webhook is the owner's own automation (its URL is a secret), so its runs are not limited by this list. Nobody can approve during a webhook run, so it still skips every action that needs approval.
 

docs/content/Sources/Wiki-sources.mdx

@@ -92,12 +92,18 @@ Human edits are stamped with `human` provenance and trigger the same re-embed as
 
 ## Edits from the API, widget and public links
 
-An agent called with its API key (the website widget, the API) runs as its owner, and people who open an agent from its public link are strangers to the owner. By default, neither can change a wiki: they can still read it through the agent, but the agent isn't offered the create, edit, delete or rename actions in those chats, and the Wiki tool refuses them if it's asked anyway.
+An agent called with its API key (the website widget, the API) runs as its owner, so it could change any wiki the owner can edit. By default it can't: API and widget users can still read the wiki through the agent, but the agent isn't offered the create, edit, delete or rename actions in those chats, and the Wiki tool refuses them if it's asked anyway.
 
-The wiki's owner can allow such edits. On the **Sources** page, open the wiki's menu, choose **Wiki settings**, and turn on **Let API, widget and public-link users edit this wiki**. The change applies from the next message, including in chats that are already open. Only the owner sees it; team editors can't change it. You and the wiki's editors can always edit it in DocsGPT, and so can agents you or they use there.
+The wiki's owner can allow such edits. On the **Sources** page, open the wiki's menu, choose **Wiki settings**, and turn on **Let API and widget users edit this wiki**. The change applies from the next message, including in chats that are already open. Only the owner sees it; team editors can't change it. You and the wiki's editors can always edit it in DocsGPT, and so can agents you or they use there.
+
+The switch doesn't cover public links. People who open an agent from its public link run it as themselves, so they can only edit wikis they could edit anyway (their own, or ones shared with them as an editor). Because the agent's prompt and sources belong to someone else, each of their wiki edits waits for their approval in the chat before it runs.
 
 Scheduled and webhook runs don't get the Wiki tool, so they read a wiki through search but never edit it.
 
+<Callout type="warning" emoji="⚠️">
+With authentication off (`AUTH_TYPE=None`, the default), every request, including one from the widget or the API, runs as the same `local` user who owns the agents. The switch then can't tell outside callers from you and has no effect, so turn authentication on if others can reach the widget or the API.
+</Callout>
+
 From the API, only a signed-in session can change the setting; a personal access token can read it but not change it:
 
 ```text

frontend/src/locale/de.json

@@ -184,8 +184,8 @@
           "action": "Wiki-Einstellungen",
           "title": "Wiki-Einstellungen",
           "outsideEdits": {
-            "label": "API-, Widget- und Public-Link-Nutzern erlauben, dieses Wiki zu bearbeiten",
-            "description": "Wenn das aus ist, können Personen, die einen Agenten über seinen API-Schlüssel, sein Widget oder seinen öffentlichen Link nutzen, dieses Wiki lesen, aber nicht ändern. Du und die Bearbeiter des Wikis können es immer bearbeiten."
+            "label": "API- und Widget-Nutzern erlauben, dieses Wiki zu bearbeiten",
+            "description": "Wenn das aus ist, können Personen, die einen Agenten über seinen API-Schlüssel oder sein Widget nutzen, dieses Wiki lesen, aber nicht ändern. Besucher über einen öffentlichen Link können nur Wikis bearbeiten, die sie selbst bearbeiten dürfen, und werden vor jeder Änderung gefragt. Du und die Bearbeiter des Wikis können es immer bearbeiten."
           },
           "loadError": "Die Wiki-Einstellungen konnten nicht geladen werden.",
           "saveError": "Die Änderung konnte nicht gespeichert werden. Bitte versuche es erneut."

frontend/src/locale/en.json

@@ -189,8 +189,8 @@
           "action": "Wiki settings",
           "title": "Wiki settings",
           "outsideEdits": {
-            "label": "Let API, widget and public-link users edit this wiki",
-            "description": "When this is off, people who use an agent through its API key, widget or public link can read this wiki but not change it. You and the wiki's editors can always edit it."
+            "label": "Let API and widget users edit this wiki",
+            "description": "When this is off, people who use an agent through its API key or widget can read this wiki but not change it. Public-link visitors can only edit wikis they can edit themselves, and are asked before each edit. You and the wiki's editors can always edit it."
           },
           "loadError": "Could not load the wiki settings.",
           "saveError": "Could not save the change. Please try again."

frontend/src/locale/es.json

@@ -184,8 +184,8 @@
           "action": "Configuración del wiki",
           "title": "Configuración del wiki",
           "outsideEdits": {
-            "label": "Permitir que los usuarios de la API, del widget y del enlace público editen este wiki",
-            "description": "Si está desactivado, quienes usan un agente mediante su clave de API, su widget o su enlace público pueden leer este wiki, pero no cambiarlo. Tú y los editores del wiki siempre pueden editarlo."
+            "label": "Permitir que los usuarios de la API y del widget editen este wiki",
+            "description": "Si está desactivado, quienes usan un agente mediante su clave de API o su widget pueden leer este wiki, pero no cambiarlo. Los visitantes de un enlace público solo pueden editar los wikis que ellos mismos pueden editar, y se les pregunta antes de cada cambio. Tú y los editores del wiki siempre pueden editarlo."
           },
           "loadError": "No se pudo cargar la configuración del wiki.",
           "saveError": "No se pudo guardar el cambio. Inténtalo de nuevo."

frontend/src/locale/jp.json

@@ -183,8 +183,8 @@
           "action": "Wiki設定",
           "title": "Wiki設定",
           "outsideEdits": {
-            "label": "API、ウィジェット、公開リンクの利用者にこのWikiの編集を許可",
-            "description": "オフの場合、APIキー、ウィジェット、公開リンクからエージェントを利用する人はこのWikiを読めますが、変更はできません。あなたとWikiの編集者はいつでも編集できます。"
+            "label": "APIとウィジェットの利用者にこのWikiの編集を許可",
+            "description": "オフの場合、APIキーやウィジェットからエージェントを利用する人はこのWikiを読めますが、変更はできません。公開リンクの訪問者は自分で編集できるWikiだけを編集でき、変更のたびに確認されます。あなたとWikiの編集者はいつでも編集できます。"
           },
           "loadError": "Wiki設定を読み込めませんでした。",
           "saveError": "変更を保存できませんでした。もう一度お試しください。"

frontend/src/locale/ru.json

@@ -190,8 +190,8 @@
           "action": "Настройки вики",
           "title": "Настройки вики",
           "outsideEdits": {
-            "label": "Разрешить пользователям API, виджета и публичной ссылки редактировать эту вики",
-            "description": "Если выключено, те, кто пользуется агентом через его API-ключ, виджет или публичную ссылку, могут читать эту вики, но не изменять её. Вы и редакторы вики всегда могут её редактировать."
+            "label": "Разрешить пользователям API и виджета редактировать эту вики",
+            "description": "Если выключено, те, кто пользуется агентом через его API-ключ или виджет, могут читать эту вики, но не изменять её. Посетители по публичной ссылке могут редактировать только те вики, которые могут редактировать сами, и перед каждым изменением у них спрашивают подтверждение. Вы и редакторы вики всегда могут её редактировать."
           },
           "loadError": "Не удалось загрузить настройки вики.",
           "saveError": "Не удалось сохранить изменение. Попробуйте ещё раз."

frontend/src/locale/zh-TW.json

@@ -183,8 +183,8 @@
           "action": "Wiki 設定",
           "title": "Wiki 設定",
           "outsideEdits": {
-            "label": "允許 API、小工具和公開連結使用者編輯此 Wiki",
-            "description": "關閉時，透過代理的 API 金鑰、小工具或公開連結使用它的人可以閱讀此 Wiki，但無法變更。你和此 Wiki 的編輯者隨時都能編輯它。"
+            "label": "允許 API 和小工具使用者編輯此 Wiki",
+            "description": "關閉時，透過代理的 API 金鑰或小工具使用它的人可以閱讀此 Wiki，但無法變更。公開連結的訪客只能編輯他們自己有權編輯的 Wiki，且每次變更前都會被詢問。你和此 Wiki 的編輯者隨時都能編輯它。"
           },
           "loadError": "無法載入 Wiki 設定。",
           "saveError": "無法儲存變更。請再試一次。"

frontend/src/locale/zh.json

@@ -183,8 +183,8 @@
           "action": "Wiki 设置",
           "title": "Wiki 设置",
           "outsideEdits": {
-            "label": "允许 API、小组件和公开链接用户编辑此 Wiki",
-            "description": "关闭时，通过智能体的 API 密钥、小组件或公开链接使用它的人可以阅读此 Wiki，但不能更改。你和此 Wiki 的编辑者始终可以编辑它。"
+            "label": "允许 API 和小组件用户编辑此 Wiki",
+            "description": "关闭时，通过智能体的 API 密钥或小组件使用它的人可以阅读此 Wiki，但不能更改。公开链接的访问者只能编辑他们自己有权编辑的 Wiki，并且每次更改前都会被询问。你和此 Wiki 的编辑者始终可以编辑它。"
           },
           "loadError": "无法加载 Wiki 设置。",
           "saveError": "无法保存更改。请重试。"

frontend/src/settings/WikiSettingsModal.tsx

@@ -26,7 +26,7 @@ interface WikiSettingsModalProps {
 
 /**
  * A wiki's owner settings. Today one switch: whether people using an agent
- * through its API key, widget or public link may edit the wiki. It saves at
+ * through its API key or widget may edit the wiki. It saves at
  * once and flips back when the server refuses.
  */
 export default function WikiSettingsModal({