dsh-mobile 0.1.0-alpha.2 → 0.1.0-alpha.20

package/README.en.md

@@ -0,0 +1,123 @@
+<p align="center">
+  <img src="https://raw.githubusercontent.com/saya-ch/dsh-mobile/main/assets/brand/repository-hero.png" alt="Use DeepSeek Harness from a phone" width="100%">
+</p>
+
+<h1 align="center">DSH Mobile</h1>
+
+<p align="center">Secure, live LAN access to DeepSeek Harness from a phone.</p>
+
+<p align="center">
+  <a href="https://www.npmjs.com/package/dsh-mobile"><img src="https://img.shields.io/npm/v/dsh-mobile?tag=alpha&amp;label=npm&amp;color=CB3837" alt="npm version"></a>
+  <a href="https://github.com/saya-ch/dsh-mobile/actions/workflows/ci.yml"><img src="https://github.com/saya-ch/dsh-mobile/actions/workflows/ci.yml/badge.svg" alt="CI"></a>
+  <a href="https://github.com/saya-ch/dsh-mobile/releases"><img src="https://img.shields.io/badge/Android-10%2B-3DDC84?logo=android&amp;logoColor=white" alt="Android 10+"></a>
+  <a href="LICENSE"><img src="https://img.shields.io/badge/license-Apache--2.0-0F172A" alt="Apache-2.0"></a>
+</p>
+
+<p align="center"><a href="README.md">简体中文</a></p>
+
+> Alpha software. Android is the only native app. This is a community plugin, not an official DeepSeek product.
+
+<p align="center"><a href="https://github.com/saya-ch/dsh-mobile/releases"><strong>Download the Android app</strong></a></p>
+
+DSH Mobile provides a dedicated phone layout that composes the native DeepSeek Harness conversation, Workspace, settings, and plugin components. An authenticated HTTPS LAN gateway keeps desktop, Android, and mobile browsers on the same Workspaces, sessions, messages, tools, settings, and event streams.
+
+## Quick start
+
+With an installed `dsh` command:
+
+```powershell
+dsh plugin --profile web add dsh-mobile@alpha
+dsh plugin --profile web exec dsh-mobile setup
+dsh --profile web
+```
+
+From a DeepSeek Harness source checkout:
+
+```powershell
+corepack enable; pnpm install
+pnpm dsh plugin --profile web add dsh-mobile@alpha
+pnpm dsh plugin --profile web exec dsh-mobile setup
+pnpm dsh --profile web
+```
+
+`setup` automatically selects and remembers the current LAN. Wi-Fi, hotspot, and IP changes normally recover automatically; use `--address 192.168.x.x` only when automatic selection fails.
+
+Open **Mobile Access** in the lower-left DeepSeek Harness sidebar, enable it, and select **Create and copy key**. In the Android app, tap **Scan**, select the computer, and enter the key. The paired device remains trusted until it is revoked, expires, or its app data is cleared.
+
+## Compatibility
+
+| DSH Mobile | Verified DeepSeek Harness releases |
+| --- | --- |
+| `0.1.0-alpha.20` | `0.1.0-rc.5`, `0.1.0-rc.6` |
+
+At startup, the plugin verifies the DSH Host version and the frontend dependencies required by the mobile layout. An unverified release fails with a clear error instead of serving a broken page. CI also tracks the DSH main branch layout slots and mobile semantic markers. If a DSH upgrade reports an incompatibility, update DSH Mobile first.
+
+## Connection options
+
+| Client | Best for | Notes |
+| --- | --- | --- |
+| Android app | Everyday use | Automatic discovery, no browser chrome, private certificate pinning |
+| Mobile browser | Temporary or cross-platform access | Open the HTTPS origin shown by Mobile Access |
+
+Discovery uses mDNS/NSD, UDP announcements and queries, plus HTTPS probing. It publishes only the device name, address, port, protocol version, and stable `instanceId`. Keys and device tokens are never discoverable. IP changes do not require another Android pairing.
+
+For a browser's first connection, open pairing on the computer, generate a key, then visit `/mobile-access/pair` on the shown HTTPS origin and enter the 43-character pairing code after the key's final dot. The browser stores a revocable device credential after pairing.
+
+## Mobile UI
+
+Phones use a dedicated layout shell, so the main layout no longer depends on the desktop three-column DOM. Native feature components retain a small mobile adaptation layer. You can freely redesign the page structure and extend its interactions through **Customize from DeepSeek Harness**. By default, the session sidebar becomes a drawer, details open as an overlay, settings use a single-column layout, and the native composer is adapted for touch. Adding a Workspace browses computer folders inside the phone page. Images can come from the phone or the computer.
+
+The Android app is a thin Kotlin WebView shell and contains no frontend copy.
+
+For compatibility diagnosis, append `?frontend=stock` to the browser URL to temporarily use the previous desktop-page adaptation.
+
+## Customize from DeepSeek Harness
+
+Customization is intentionally open-ended: use your own ideas to arrange the mobile layout, interactions, and features instead of staying within the default style.
+
+Ask DeepSeek Harness to edit:
+
+```text
+$DSH_HOME/mobile-access/mobile.css
+$DSH_HOME/mobile-access/mobile.js
+```
+
+Changes are applied to open Android and browser pages in about one second. Customization is not limited to colors: `mobile.js` can add navigation, shortcuts, dashboards, camera, voice, scanning, and complete interactions with same-origin DeepSeek Harness APIs.
+
+## How it works
+
+```mermaid
+flowchart LR
+  Phone["Android / mobile browser"] -->|"HTTPS + device session"| Gateway["DSH Mobile gateway"]
+  Gateway -->|"loopback proxy"| DSH["Stock DSH Web and Host"]
+```
+
+The Host face owns discovery, pairing, HTTPS, and the proxy. The Client face replaces only the phone layout entry while reusing native feature plugins. Neither the DeepSeek Harness source nor its desktop page on port 3080 is modified.
+
+## Security
+
+Use the plugin only on a trusted LAN or trusted VPN. Never expose it directly to the public Internet. A paired device is a fully trusted DeepSeek Harness operator. Revoke lost devices from the computer. See [SECURITY.md](SECURITY.md).
+
+## Uninstall
+
+```powershell
+dsh plugin --profile web remove dsh-mobile
+```
+
+To remove local plugin data first:
+
+```powershell
+dsh plugin --profile web exec dsh-mobile purge --yes
+dsh plugin --profile web remove dsh-mobile
+```
+
+Source users replace `dsh` with `pnpm dsh`.
+
+## Development
+
+```powershell
+npm ci
+npm run verify
+```
+
+See the [Android guide](apps/mobile/README.md). Licensed under [Apache-2.0](LICENSE).

package/README.md

@@ -1,201 +1,171 @@
 <p align="center">
-  <img src="https://unpkg.com/dsh-mobile@0.1.0-alpha.2/assets/brand/repository-hero.png" alt="A lively whale girl using a phone beside a desktop running DSH" width="100%">
+  <img src="https://raw.githubusercontent.com/saya-ch/dsh-mobile/main/assets/brand/repository-hero.png" alt="使用手机连接 DeepSeek Harness" width="100%">
 </p>
 
 <h1 align="center">DSH Mobile</h1>
 
-<p align="center">Private, authenticated LAN access to the stock DeepSeek Harness Web UI.</p>
+<p align="center">在手机上安全、实时地使用电脑中的 DeepSeek Harness。</p>
 
 <p align="center">
-  <a href="https://www.npmjs.com/package/dsh-mobile"><img src="https://img.shields.io/npm/v/dsh-mobile?label=npm&amp;color=CB3837" alt="npm version"></a>
-  <a href="https://www.npmjs.com/package/dsh-mobile"><img src="https://img.shields.io/npm/dm/dsh-mobile?color=2563EB" alt="npm downloads"></a>
-  <img src="https://img.shields.io/badge/build-verified-059669" alt="Verified build">
-  <a href="apps/mobile/README.md"><img src="https://img.shields.io/badge/platform-Android-3DDC84?logo=android&amp;logoColor=white" alt="Android"></a>
-  <a href="#a-native-dsh-plugin"><img src="https://img.shields.io/badge/DSH-stock%20compatible-2563EB" alt="Compatible with stock DSH"></a>
-  <a href="LICENSE"><img src="https://img.shields.io/badge/license-Apache--2.0-0F172A" alt="Apache-2.0 license"></a>
+  <a href="https://www.npmjs.com/package/dsh-mobile"><img src="https://img.shields.io/npm/v/dsh-mobile?tag=alpha&label=npm&color=CB3837" alt="npm 版本"></a>
+  <a href="https://github.com/saya-ch/dsh-mobile/actions/workflows/ci.yml"><img src="https://github.com/saya-ch/dsh-mobile/actions/workflows/ci.yml/badge.svg" alt="CI"></a>
+  <a href="https://github.com/saya-ch/dsh-mobile/releases"><img src="https://img.shields.io/badge/Android-10%2B-3DDC84?logo=android&logoColor=white" alt="Android 10+"></a>
+  <a href="LICENSE"><img src="https://img.shields.io/badge/license-Apache--2.0-0F172A" alt="Apache-2.0"></a>
 </p>
 
 <p align="center">
-  <a href="README.zh.md">简体中文</a> ·
-  <a href="#quick-start">Quick start</a> ·
-  <a href="#customize-the-mobile-web-ui">Customize the UI</a> ·
-  <a href="#uninstall">Uninstall</a>
+  <a href="#快速开始">快速开始</a> ·
+  <a href="#连接方式">连接方式</a> ·
+  <a href="#自定义移动布局与功能">自定义</a> ·
+  <a href="README.en.md">English</a>
 </p>
 
-> Public npm alpha. The source repository remains private during the current testing phase. Android is the only supported native app. This is a community project, not an official DeepSeek product.
+> Alpha 版本，当前原生 App 仅支持 Android。本项目为 DeepSeek Harness 社区插件。
 
-DSH Mobile reuses DSH's own Web application, sessions, and plugin slots. It adds an authenticated HTTPS gateway, device pairing, session revocation, and a small responsive Client face. Use the Android shell without browser chrome, or open the same LAN address directly in any mobile browser.
+<p align="center"><a href="https://github.com/saya-ch/dsh-mobile/releases"><strong>下载 Android App</strong></a></p>
 
-The mobile client is self-editable: ask DSH in an ordinary conversation to change `mobile.css` for presentation or `mobile.js` for behavior, keep the phone open, and watch the Android app or mobile browser apply the result automatically within about one second.
+DSH Mobile 提供专属移动端布局入口，并直接组合 DeepSeek Harness 原生的对话、工作区、设置和插件组件。它通过受保护的局域网 HTTPS 网关，让 Android App 或手机浏览器访问电脑端同一份工作区、会话、消息和运行状态。
 
-## Features
+## 能做什么
 
-| Capability | Android app | Mobile browser |
-| --- | :---: | :---: |
-| Live DSH Web UI | Yes | Yes |
-| Authenticated HTTPS LAN access | Yes | Yes |
-| One-time device pairing | Yes | Yes |
-| Extend mobile UI and Web functions through a DSH conversation with live preview | Yes | Yes |
-| File selection and downloads | Yes | Browser-dependent |
-| iOS native app | Not yet | Safari can use the Web UI |
+- 实时控制电脑上的 DeepSeek Harness，会话和消息与桌面端同步。
+- 复用原生对话、Markdown、工具卡、模型、设置、批准和已安装 UI 插件。
+- 手机侧边栏、单列设置、移动输入栏和工具详情层。
+- 从手机或电脑选择图片；添加工作区时在手机上浏览电脑目录。
+- 自动发现局域网中的 DSH，IP 变化后按稳定设备标识更新地址。
+- 直接在 DeepSeek Harness 对话中修改移动布局和功能，手机约一秒内实时刷新。
 
-Host-native actions such as opening desktop files remain subject to stock DSH and operating-system restrictions. Treat every paired device as a fully trusted operator of the computer, not as a guest account.
+## 快速开始
 
-## Quick start
-
-Use the first block when `dsh` is available globally:
+已经安装 `dsh` 命令：
 
 ```powershell
-dsh plugin --profile web add dsh-mobile
+dsh plugin --profile web add dsh-mobile@alpha
 dsh plugin --profile web exec dsh-mobile setup
 dsh --profile web
 ```
 
-If you cloned the DSH source, run the second block from its repository root:
+直接使用 DeepSeek Harness 源码：
 
 ```powershell
-corepack enable
-pnpm install
-pnpm dsh plugin --profile web add dsh-mobile
+corepack enable; pnpm install
+pnpm dsh plugin --profile web add dsh-mobile@alpha
 pnpm dsh plugin --profile web exec dsh-mobile setup
 pnpm dsh --profile web
 ```
 
-Both paths install the public npm package into stock DSH without patching its source. Setup selects the LAN address, creates the local TLS certificate, and stores plugin data under `$DSH_HOME/mobile-access/`; run `dsh-mobile setup --help` through the same `plugin exec` command for manual network options.
-
-1. Copy the generated `dsh-mobile-ca.cer` to Android and install it as a user CA certificate.
-2. Open the Mobile card in the lower-left corner of the desktop DSH UI.
-3. Start access and create a pairing link. The link is copied to the clipboard.
-4. Paste the link into the Android app, or open it directly in a mobile browser.
+`setup` 会自动选择并记住当前局域网。切换 Wi-Fi、热点或 IP 后通常会自动恢复；仅在自动选择失败时使用 `--address 192.168.x.x`。
 
-Pairing links expire after two minutes and work once. The app and each browser have separate cookie stores, so pair them separately.
+启动后：
 
-## Everyday control
+1. 在 DeepSeek Harness 左下角打开“移动访问”，确认功能已开启。
+2. 点击“生成并复制密钥”。
+3. Android App 点击“扫描”，选择电脑并输入密钥。
+4. 配对完成后会建立持久设备信任，以后打开 App 无需重复输入。
 
-The Mobile card remains in DSH's lower-left corner. Stopping mobile access closes only the external HTTPS listener and active mobile sessions; the local DSH Web UI keeps running. Starting it again does not reinstall the plugin.
+插件不会修改 DeepSeek Harness 源码。设置、证书、设备和自定义文件保存在 `$DSH_HOME/mobile-access/`。
 
-The two access modes are equivalent:
+## 兼容性
 
-- Android app: a thin system WebView shell without browser address and tab bars.
-- Mobile browser: open the setup origin directly; no app installation is required.
+| DSH Mobile | 已验证的 DeepSeek Harness |
+| --- | --- |
+| `0.1.0-alpha.20` | `0.1.0-rc.5`、`0.1.0-rc.6` |
 
-## Customize the mobile Web UI
+插件会在启动时检查 DSH Host 版本和移动布局所需的前端依赖；遇到未经验证的版本会直接给出错误，不会带着不兼容页面继续启动。CI 也会持续检查 DSH 主分支的布局插槽和移动端语义标记。升级 DSH 后如遇兼容提示，请先升级 DSH Mobile。
 
-This is a same-origin Web extension surface, not a fixed theme editor. DSH can edit two files on the computer:
+## 连接方式
 
-- `mobile.css` controls layout, visual hierarchy, safe areas, typography, and responsive behavior.
-- `mobile.js` mounts mobile-only DOM and behavior, can use browser capabilities, and can call the same-origin DSH Web API as the paired page.
 
-That is enough to build a one-handed command dock, a gesture command palette, a session dashboard, terminal shortcut keys, a floating context panel, voice input, a camera or QR workflow, or a completely different mobile navigation model. Camera, microphone, notifications, and similar capabilities still require browser or Android permission.
+| 方式        | 适合场景         | 说明                                     |
+| ------------- | ------------------ | ------------------------------------------ |
+| Android App | 日常使用         | 自动发现、无浏览器栏、App 内私有证书固定 |
+| 手机浏览器  | 临时或跨平台访问 | 打开“移动访问”卡片显示的 HTTPS 地址    |
 
-The easiest workflow stays entirely inside DSH. In a conversation with filesystem write access, try a broad request:
+Android 同时使用 mDNS/NSD、UDP 公告、主动 UDP 查询和 HTTPS 探测发现 DeepSeek Harness。发现只广播设备名、地址、端口、协议版本和稳定 `instanceId`，不会广播密钥或令牌。
 
-```text
-Turn DSH Mobile into a one-handed field console by editing
-$DSH_HOME/mobile-access/mobile.css and mobile.js.
-
-Add a bottom command dock, swipe shortcuts for switching conversations,
-a push-to-talk button when the browser supports speech input, and a collapsible
-session monitor. Keep every feature mobile-only. Register JavaScript through
-window.dshMobile.register(), return a cleanup function, and do not modify DSH source.
-```
+App 配对后保存可撤销的设备凭据和私有证书信任；Wi-Fi、热点或 DHCP 导致 IP 变化时不需要重新配对。手机浏览器不能使用 App 的私有信任，因此需要浏览器本身信任该 HTTPS 证书。
 
-Keep the phone page open while DSH edits. The Android app and mobile browser check both authenticated files once per second and apply saved changes automatically—no DSH restart, new pairing, or manual page refresh. Invalid JavaScript does not replace the last successfully mounted extension.
+新浏览器首次访问时，在电脑端开启配对并生成密钥，然后打开 HTTPS 地址中的 `/mobile-access/pair`，输入密钥最后一个点号后的 43 位配对码。配对完成后，浏览器会保存可撤销的设备凭据。
 
-Setup creates:
-
-```text
-$DSH_HOME/mobile-access/mobile.css
-$DSH_HOME/mobile-access/mobile.js
-```
+## 移动端界面
 
-The files load only through the authenticated mobile gateway. They do not modify the DSH installation and survive DSH upgrades. Continue the same conversation with requests such as “turn the dock into a radial menu,” “add a full-screen monitoring view,” or “use the camera to prepare an attachment,” and inspect each revision directly on the phone.
+手机端使用插件自带的独立布局外壳，主布局不再依赖桌面三栏 DOM；原生功能组件保留少量移动端适配。你也可以通过“自定义移动布局与功能”继续调整页面结构并扩展交互：
 
-`mobile.js` uses a small lifecycle entry point:
+- 左上角打开工作区与会话抽屉。
+- 对话、轨迹、工具详情和 Session log 保持原有能力。
+- 设置页使用顶部分类和单列内容。
+- 输入栏保留命令、权限、模型、上下文、图片和发送控件。
+- “添加工作区”在手机上展示电脑目录，不会在电脑上弹系统选择器。
 
-```js
-window.dshMobile.register(({ root, document, request }) => {
-  const workspace = document.createElement('section')
-  workspace.ariaLabel = 'My mobile workspace'
-  root.append(workspace)
+Android App 只是 Kotlin WebView 薄壳，不内置另一份网页。手机浏览器访问的也是同一页面。
 
-  // Build any mobile Web UI and behavior inside workspace. Use request()
-  // for same-origin DSH API calls with the paired Session and CSRF protection.
+需要排查兼容性时，可在浏览器地址后追加 `?frontend=stock`，临时回到旧的桌面页面适配模式。
 
-  return () => workspace.remove()
-})
-```
+## 自定义移动布局与功能
 
-The supplied `root` isolates mobile-only DOM, while `request()` rejects cross-origin targets and carries the paired session plus the gateway's CSRF header. An extension may still use ordinary secure-context browser APIs directly when the device grants permission.
+自定义程度很高：你可以发挥创意，自由布置移动端的布局、交互和功能，而不必局限于默认样式。
 
-Basic theme controls:
+直接在 DeepSeek Harness 对话中提出修改即可。默认文件：
 
-```css
-:root {
-  --dsh-mobile-accent: #2563eb;
-  --dsh-mobile-font-scale: 1.05;
-  --dsh-mobile-radius: 16px;
-}
+```text
+$DSH_HOME/mobile-access/mobile.css
+$DSH_HOME/mobile-access/mobile.js
 ```
 
-Narrow-screen adjustments:
+例如对 DeepSeek Harness 说：
 
-```css
-@media (max-width: 720px) {
-  textarea { min-height: 88px; }
-  button, [role='button'] { min-height: 48px; }
-}
+```text
+请编辑 $DSH_HOME/mobile-access/mobile.css 和 mobile.js，
+把移动端改成适合单手操作的开发控制台：增加底部快捷指令、
+会话状态面板和长按语音入口。只影响窄屏，不修改 DSH 源码。
 ```
 
-Prefer stable Web APIs and DSH extension points over generated class names. Delete `mobile.css` to restore the visual defaults and replace `mobile.js` with an empty registered mount to remove custom behavior; the open phone page updates automatically.
-
-## A native DSH plugin
+保存后，已打开的 App 和浏览器通常会在一秒内应用变化。自定义能力不限于配色：`mobile.js` 可以添加导航、快捷操作、状态面板、相机、语音、扫码，以及调用同源 DSH API 的完整交互。
 
-One standard bundle contributes two faces: the Host face owns the gateway and loopback control route; the Client face owns the responsive layer and desktop control card. The package injects only stock `webServer`, installs with `dsh plugin add`, and uninstalls with `dsh plugin remove`.
+## 工作原理
 
 ```mermaid
 flowchart LR
-  Phone["Android app or mobile browser"] -->|"HTTPS and paired session"| Gateway["DSH Mobile plugin"]
-  Gateway -->|"loopback-only proxy"| DSH["Stock DSH Web UI"]
+  Phone["Android App / 手机浏览器"] -->|"HTTPS + 设备会话"| Gateway["DSH Mobile 网关"]
+  Gateway -->|"回环代理"| DSH["原生 DSH Web 与 Host"]
+  DSH -->|"同一工作区、会话和事件流"| Phone
 ```
 
-## Security model
+插件包含两部分：Host face 提供发现、配对、HTTPS 和回环代理；Client face 替换移动端的布局入口，并复用原生功能插件。DeepSeek Harness 的源码和 3080 桌面页面都不会被修改，安装和卸载仍完全通过插件机制完成。
 
-- The gateway accepts only the selected private LAN CIDR, exact Host, and same-origin browser requests.
-- The Android app never bypasses TLS validation. The certificate must cover the LAN address in use.
-- Pairing creates an HttpOnly session; devices and active sessions can be revoked from the computer.
-- Control and device-management routes are loopback-only.
-- Authentication happens before any request reaches the stock DSH loopback server. DSH itself is never rebound to `0.0.0.0`.
-- `mobile.js` runs as application code inside the paired DSH page. Only let trusted DSH conversations edit it, and review generated integrations before keeping them.
+## 安全
 
-Do not expose this gateway through public Wi-Fi, port forwarding, a public IP, or an untrusted VPN. See [SECURITY.md](SECURITY.md).
+- 仅在可信家庭、办公局域网或可信 VPN 中使用，不要转发到公网。
+- 配对设备拥有控制电脑端 DeepSeek Harness 的能力，应视为完全可信设备。
+- 移动网关开启时才监听局域网；关闭后 DeepSeek Harness 仍正常在电脑本机运行。
+- 丢失手机后应在电脑端撤销设备。
 
-## Uninstall
+完整说明见 [SECURITY.md](SECURITY.md)。
 
-Normal removal preserves certificates, paired devices, and custom CSS:
+## 卸载
+
+保留设备和自定义数据：
 
 ```powershell
 dsh plugin --profile web remove dsh-mobile
 ```
 
-To remove all local data, purge before removing the package:
+同时清除插件数据：
 
 ```powershell
 dsh plugin --profile web exec dsh-mobile purge --yes
 dsh plugin --profile web remove dsh-mobile
 ```
 
-## Android app
-
-The supported native shell lives in [`apps/mobile/android`](apps/mobile/android). It does not bundle a copy of the DSH frontend; it renders the same authenticated HTTPS page used by mobile browsers. See the [Android guide](apps/mobile/README.md).
+源码模式把上述 `dsh` 换成 `pnpm dsh`。
 
-## Development
+## 开发
 
 ```powershell
 npm ci
 npm run verify
 ```
 
-Release validation starts from the actual `npm pack` tarball and exercises install, setup, boot, pairing, and uninstall against an isolated stock DSH Web profile.
+Android 构建见 [App 文档](apps/mobile/README.zh-CN.md)。
 
-Apache-2.0 licensed. See [LICENSE](LICENSE).
+Apache-2.0，详见 [LICENSE](LICENSE)。

package/SECURITY.md

@@ -15,8 +15,10 @@ The maintainer will acknowledge a complete report within seven days. Publication
 ## Deployment requirements
 
 - Keep the ordinary DSH Web listener on loopback.
-- Expose only the plugin-owned HTTPS listener to the LAN.
-- Use a certificate trusted by every client platform; never instruct a WebView to ignore TLS errors.
+- Expose only the plugin-owned HTTPS listener to the LAN.
+- DNS-SD/mDNS, periodic UDP announcements, active UDP query replies, and HTTPS discovery return only the device name, public HTTPS origin, port, protocol version, and stable non-secret installation identifier. Discovery never returns the CA, a pairing key, a device token, Cookies, credentials, or private configuration.
+- Only after a user selects a device and enters the fingerprint-bound pairing key may Android fetch the public CA from that exact HTTPS origin. The bootstrap GET sends no key or credential. The app retains the CA in its encrypted credential record and never adds it to Android's system trust settings. Native requests use a private trust store; WebView accepts only the otherwise-untrusted leaf signed by that CA, for the exact origin and validity period. Every other TLS error is cancelled.
+- Browser clients require a certificate trusted by that browser platform. Android uses the pairing-key-bound app-private CA. Its WebView exception is restricted to `SSL_UNTRUSTED` for an exact-origin, currently valid leaf signed by that CA; hostname, validity, signature, and every other TLS error remain fail-closed.
 - Keep pairing closed except during a short local onboarding action.
 - Revoke a lost device immediately and rotate the device registry if credential theft is suspected.
 - Do not expose the gateway directly to the public Internet.
@@ -25,6 +27,6 @@ The maintainer will acknowledge a complete report within seven days. Publication
 
 ## Known alpha limitation
 
-The current DSH HTML boot process contains inline JavaScript and applies some styles dynamically. To keep the stock Web UI runnable, the gateway's Content Security Policy currently includes `script-src 'self' 'unsafe-inline'` and `style-src 'self' 'unsafe-inline'`. The remaining directives still restrict origins, connections, frames, objects, workers, images, and form targets, but this policy does not eliminate script-injection risk. Removing these allowances requires upstream DSH support for nonces, stable hashes, or external boot resources.
+The current DSH HTML boot process contains inline JavaScript, revives Schemastery callbacks with `new Function`, and applies some styles dynamically. To keep the stock Web UI runnable, the gateway's Content Security Policy currently includes `script-src 'self' 'unsafe-inline' 'unsafe-eval'` and `style-src 'self' 'unsafe-inline'`. The remaining directives still restrict origins, connections, frames, objects, workers, images, and form targets, but this policy does not eliminate script-injection risk. Removing these allowances requires upstream DSH support for nonces, stable hashes, external boot resources, and a non-evaluating schema representation.
 
 This repository never accepts private keys, npm tokens, pairing values, device credentials, Cookies, or captured settings in issues, logs, fixtures, or example configuration.

package/cordis.patch.yml

@@ -1,6 +1,16 @@
 # Community bundle for the stock DSH Web profile. Installation contributes a
 # Host gateway and a browser Client face; it does not patch DSH source files.
+- id: directory-picker
+  name: '@deepseek-ai/dsh-host-directory-picker-auto'
+  disabled: true
+
 - insert:
+    - id: directory-picker-mobile-host
+      name: '@deepseek-ai/dsh-host-directory-picker-browse'
+
+    - id: directory-picker-mobile-surface
+      name: '@deepseek-ai/dsh-client-ui-directory-picker-browse'
+
     - id: mobile-access
       name: dsh-mobile
       inject: [webServer]