dsh-mobile 0.1.0-alpha.32 → 0.1.0-alpha.33

package/README.en.md

@@ -19,15 +19,19 @@
 
 <p align="center"><a href="https://github.com/saya-ch/dsh-mobile/releases"><strong>Download the Android app</strong></a></p>
 
-DSH Mobile is a DeepSeek Harness plugin that lets a mobile browser or the Android app connect over a protected LAN and keep using the same sessions, Workspaces, messages, and tools. It is a mobile entry point only; the DeepSeek Harness source is not modified.
+DSH Mobile is a DeepSeek Harness plugin that lets a mobile browser or the Android app connect over a protected LAN and keep using the same sessions, Workspaces, messages, and tools. It is a mobile entry point only; the DeepSeek Harness source is not modified and no public-Internet tunneling is needed.
+
+It also lets you customize the phone from a DSH conversation: `/mobile <what you want>`.
 
 ## What it does
 
-- Continue DSH work from a phone: sessions, tools, settings, and live state stay in sync.
-- Edit the mobile layout, interactions, and features directly through a DeepSeek Harness conversation; open phone pages usually refresh within a few seconds — customize your mobile client by talking to DSH, not by writing code.
-- A dedicated touch layout: session drawer, tool details, settings, and composer are reorganized for touch.
-- Auto-discovery on the LAN; Wi-Fi, hotspot, or IP changes normally recover without re-pairing.
-- Pair by scanning a QR code, pasting a pairing link, or entering a key — no 43-character key to type.
+- **Continue DSH work from a phone**: the same sessions, Workspaces, messages, and tools, in real time.
+- **Customize the phone UI by talking to DSH**: change the mobile layout, interactions, and features from a conversation; open pages refresh within seconds.
+- **A dedicated touch layout**: session drawer, tool details, settings, and composer reorganized for phones.
+- **Auto-discovery, no re-pairing**: Wi-Fi, hotspot, or IP changes normally recover automatically.
+- **Three pairing options**: scan a QR code, paste a pairing link, or enter a key.
+
+A paired device is fully trusted and can operate the DSH on the computer. Use this only on a trusted home or office LAN, or a trusted VPN.
 
 ## Quick start
 
@@ -48,86 +52,34 @@ pnpm dsh plugin --profile web exec dsh-mobile setup
 pnpm dsh --profile web
 ```
 
-`setup` automatically selects and remembers the current LAN. Wi-Fi, hotspot, and IP changes normally recover automatically; use `--address 192.168.x.x` only when automatic selection fails.
-
-After starting DSH, open **Mobile Access** in the lower-left sidebar, enable it, then:
+After starting DSH, open **Mobile Access** in the lower-left sidebar, then:
 
 1. Select **Create and copy key** or **Copy pairing link**; the panel shows a pairing QR code.
 2. In the Android app, tap **Scan QR code** and point the camera at the screen — or tap **Scan**, select the computer, and paste the key or pairing link.
 3. Pairing establishes persistent device trust; later launches do not ask again.
 
-A paired device is fully trusted and can operate the DSH on the computer. Use this only on a trusted home or office LAN, or a trusted VPN.
-
-The plugin does not modify the DeepSeek Harness source. Settings, certificates, devices, and customization files live under `$DSH_HOME/mobile-access/`.
-
-## App or mobile browser
-
-| Client | Best for | Notes |
-| --- | --- | --- |
-| Android app | Everyday use | Auto-discovery; private certificate pinning inside the app, no manual browser trust step |
-| Mobile browser | Temporary or cross-platform | Open the HTTPS origin shown by Mobile Access; trust the certificate manually on first visit |
-
-Discovery uses mDNS/NSD, UDP announcements and queries, plus HTTPS probing. It publishes only the device name, address, port, protocol version, and stable `instanceId` — never keys or device tokens. IP changes do not require another pairing.
-
-For a browser's first connection, open pairing on the computer, then select **Copy pairing link** and open that link on the phone — the pairing code is prefilled. Alternatively, visit `/mobile-access/pair` on the shown HTTPS origin and enter the 43-character pairing code after the key's final dot. The browser stores a revocable device credential after pairing.
-
-## Mobile UI
-
-Phones use a dedicated layout shell that no longer depends on the desktop three-column DOM, while native components keep a small touch-adaptation layer:
-
-- A workspace-and-session drawer opens from the top-left.
-- Conversations, traces, tool details, and Session logs keep their full capabilities.
-- Settings use top-level tabs and a single column.
-- The composer keeps command, permission, model, context, image, and send controls.
-- **Add Workspace** browses computer folders inside the phone page instead of opening a system picker on the computer.
-
-The Android app is a thin Kotlin WebView shell and contains no frontend copy; mobile browsers load the same page. For compatibility diagnosis, append `?frontend=stock` to the browser URL to temporarily use the previous desktop-page adaptation.
+`setup` automatically selects and remembers the current LAN; Wi-Fi, hotspot, and IP changes normally recover without re-pairing. Use `--address 192.168.x.x` only when automatic selection fails. Settings, certificates, devices, and customization files live under `$DSH_HOME/mobile-access/`.
 
-## Customize from DeepSeek Harness
+## Extend and customize
 
-Default files:
+Type `/mobile <what you want>` in a DSH conversation, and DSH edits the phone client's files for you; changes apply within a few seconds. For example:
 
 ```text
-$DSH_HOME/mobile-access/mobile.css
-$DSH_HOME/mobile-access/mobile.js
+/mobile turn the phone UI into an old CRT terminal, with messages scrolling like terminal output
 ```
 
-Ask DeepSeek Harness to edit them, for example:
+Two kinds of changes are supported: the phone UI itself (theme, layout, buttons), and computer capabilities the phone can use (browsing computer files, running programs on the computer). `/mobile` hands the request to the DSH agent, which edits files under the local DSH configuration directory (`$DSH_HOME/mobile-access/`); the phone client applies them automatically. UI changes live in `mobile.css`/`mobile.js`. Computer capabilities come from extensions under `extensions/`, whose `host.mjs` runs with the local user's privileges on the computer. DeepSeek Harness source is not modified.
 
-```text
-Edit $DSH_HOME/mobile-access/mobile.css and mobile.js to turn the mobile
-client into a one-handed development console: add a bottom shortcut bar,
-a session status panel, and a press-and-hold voice entry. Narrow screens only;
-do not modify the DSH source.
-```
-
-Changes are applied to open Android and browser pages within a few seconds. `mobile.css` and `mobile.js` own the phone UI, interactions, and orchestration of existing APIs; they cannot create computer files, run commands, or access computer hardware by themselves. Browsers fall back to available Web APIs, while the Android app exposes a narrow native bridge for file picking, camera capture, sharing, clipboard, notifications, and speech.
-
-### Add computer-side capabilities
-
-For a new capability on the computer, create an extension under `$DSH_HOME/mobile-access/extensions/<id>/`:
+> When using computer-side capabilities, use only content you trust.
 
-```text
-extension.json   # metadata
-host.mjs         # trusted local Node.js code
-mobile.js        # optional phone-side script
-mobile.css       # optional phone-side styles
-assets/          # optional static files
-```
-
-Generate a complete starter extension with:
-
-```powershell
-dsh plugin --profile web exec dsh-mobile extension create media-tools --name "Media tools"
-```
-
-`host.mjs` can register schema-validated actions, ordinary HTTP/streaming/SSE routes, and teardown effects; `mobile.js` calls them through `api.host.invoke()` or `api.host.fetch()`. Extension source files can be changed only on the computer by the user or DSH; the phone has no endpoint that writes them. Closing Mobile Access, revoking a device, refreshing an extension, or stopping the gateway aborts its active requests.
-
-A published DSH plugin can also call `ctx.mobileAccess.registerExtension(definition)` from a Cordis effect. It shares the same authentication, routes, and client SDK as local directory extensions without modifying DSH core.
+## App or mobile browser
 
-Extension IDs are unique. Host code, scripts, and CSS switch as one generation; if a new generation fails, the previous one remains active. An empty `extensions/` directory is inert. Paired devices have every registered extension permission, so install and edit only trusted `host.mjs` code.
+| Client | Best for | Notes |
+| --- | --- | --- |
+| Android app | Everyday use | Auto-discovery; private certificate pinning inside the app, no manual browser trust step |
+| Mobile browser | Temporary or cross-platform | Open the HTTPS origin shown by Mobile Access; trust the certificate manually on first visit |
 
-Normal DSH community plugins continue to load through standard `dsh.client` and Slot contributions: conversation nodes, tool cards, settings sections, sidebar items, header actions, composer docks, and overlays remain available in the same session. Plugins that depend on hover, fixed desktop widths, system file pickers, or private DOM selectors need additional mobile adaptation.
+The Android app is a thin Kotlin WebView shell and contains no frontend copy; mobile browsers load the same page. For compatibility diagnosis, append `?frontend=stock` to the browser URL to temporarily use the previous desktop-page adaptation.
 
 ## How it works
 
@@ -137,7 +89,7 @@ flowchart LR
   Gateway -->|"loopback proxy"| DSH["Stock DSH Web and Host"]
 ```
 
-The three layers are: the Host face for discovery, pairing, HTTPS, loopback proxying, and extension registration; the Client face for the dedicated mobile root, multi-extension SDK, and hot updates; and the Android app for an exact-origin native bridge. Neither the DeepSeek Harness source nor its desktop page on port 3080 is modified.
+Three layers: the Host face for discovery, pairing, HTTPS, loopback proxying, and extension registration; the Client face for the dedicated mobile layout and extension SDK; and the Android app for a narrow native bridge. Neither the DeepSeek Harness source nor its desktop page on port 3080 is modified.
 
 ## Security
 
@@ -151,9 +103,9 @@ See [SECURITY.md](SECURITY.md).
 
 | DSH Mobile | Verified DeepSeek Harness releases |
 | --- | --- |
-| `0.1.0-alpha.32` | `0.1.0-rc.5`, `0.1.0-rc.6`, `0.1.0-rc.7` |
+| `0.1.0-alpha.33` | `0.1.0-rc.5`, `0.1.0-rc.6`, `0.1.0-rc.7` |
 
-At startup, the plugin verifies the DSH Host version and the frontend dependencies required by the mobile layout. An unverified release fails with a clear error instead of serving a broken page. CI also tracks the DSH main branch layout slots and mobile semantic markers. If a DSH upgrade reports an incompatibility, update DSH Mobile first.
+At startup, the plugin verifies the DSH Host version and the frontend dependencies required by the mobile layout; an unverified release fails with a clear error instead of serving a broken page. CI also tracks the DSH main branch layout contract. If a DSH upgrade reports an incompatibility, update DSH Mobile first.
 
 ## Uninstall
 

package/README.md

@@ -14,9 +14,9 @@
 </p>
 
 <p align="center">
+  <a href="#能做什么">能做什么</a> ·
   <a href="#快速开始">快速开始</a> ·
-  <a href="#app-与手机浏览器">App 与浏览器</a> ·
-  <a href="#在-dsh-对话中自定义">自定义</a> ·
+  <a href="#扩展与自定义">扩展与自定义</a> ·
   <a href="README.en.md">English</a>
 </p>
 
@@ -26,13 +26,17 @@
 
 DSH Mobile 是一个 DeepSeek Harness 插件，让手机浏览器或 Android App 在受保护的局域网内连接电脑，继续使用同一份会话、工作区、消息和工具。它只作为移动入口接入，不修改 DeepSeek Harness 源码。
 
+它还能在 DSH 对话里用 `/mobile <需求>` 定制手机端。
+
 ## 能做什么
 
-- 在手机上继续电脑端的 DSH 工作：会话、工具、设置和运行状态实时同步。
-- 在 DSH 对话中直接修改手机端布局、交互和功能，打开的手机页面通常会在几秒内刷新——用对话定制自己的移动端。
-- 专属移动布局：会话抽屉、工具详情、设置和输入栏都按触屏重新组织。
-- 自动发现局域网内的 DSH；切换 Wi-Fi、热点或 IP 后通常自动恢复，无需重新配对。
-- 扫码、配对链接或密钥均可配对。
+- **在手机上继续电脑端的工作**：同一份会话、工作区、消息和工具，实时同步。
+- **用对话定制手机端**：直接在 DSH 对话里改手机页面的布局、交互和功能，几秒内刷新。
+- **专属触屏布局**：会话抽屉、工具详情、设置和输入栏都按手机重新组织。
+- **自动发现、无需重新配对**：切换 Wi-Fi、热点或 IP 后通常自动恢复。
+- **三种配对方式**：扫码、配对链接、密钥。
+
+配对设备被视为完全信任，可以操作电脑上的 DSH；建议只在可信的家庭、办公局域网或可信 VPN 中使用。
 
 ## 快速开始
 
@@ -53,86 +57,33 @@ pnpm dsh plugin --profile web exec dsh-mobile setup
 pnpm dsh --profile web
 ```
 
-`setup` 会自动选择并记住当前局域网。切换 Wi-Fi、热点或 IP 后通常会自动恢复；仅在自动选择失败时使用 `--address 192.168.x.x`。
-
-启动后，在 DeepSeek Harness 左下角打开“移动访问”并确认已开启，然后：
+启动后，在 DeepSeek Harness 左下角打开“移动访问”，然后：
 
 1. 点击“生成并复制密钥”或“复制配对链接”，面板会显示配对二维码。
-2. Android App 点击“扫码配对”，把手机对准电脑屏幕上的二维码即可完成配对；也可以点击“扫描”选择电脑后粘贴密钥或配对链接。
+2. Android App 点击“扫码配对”，把手机对准电脑屏幕上的二维码即可；也可以点击“扫描”选择电脑后粘贴密钥或配对链接。
 3. 配对完成后会建立持久设备信任，以后打开 App 无需重复输入。
 
-配对设备被视为完全信任，可以操作电脑上的 DSH；建议只在可信的家庭、办公局域网或可信 VPN 中使用。
-
-插件不会修改 DeepSeek Harness 源码。设置、证书、设备和自定义文件保存在 `$DSH_HOME/mobile-access/`。
-
-## App 与手机浏览器
-
-
-| 方式        | 适合场景         | 说明                                                                    |
-| ------------- | ------------------ | ------------------------------------------------------------------------- |
-| Android App | 日常使用         | 自动发现；App 内保存私有证书信任，无需在浏览器手动信任证书              |
-| 手机浏览器  | 临时或跨平台访问 | 打开“移动访问”卡片显示的 HTTPS 地址；首次连接需在浏览器手动信任该证书 |
-
-Android 使用 mDNS/NSD、UDP 公告与主动查询、HTTPS 探测等方式发现 DeepSeek Harness。发现广播设备名、地址、端口、协议版本和稳定 `instanceId`，不会广播密钥或令牌。IP 变化后不需要重新配对。
-
-手机浏览器首次连接：在电脑端开启配对后，点击“复制配对链接”并把链接发到手机浏览器打开，配对码会自动填入；也可以打开 HTTPS 地址中的 `/mobile-access/pair`，手动输入密钥最后一段的 43 位配对码。配对完成后，浏览器会保存可撤销的设备凭据。
-
-## 移动端界面
-
-手机端使用独立的移动布局外壳，不再依赖桌面三栏 DOM；原生的对话、工具、设置等组件保留触屏适配：
-
-- 左上角打开工作区与会话抽屉。
-- 对话、轨迹、工具详情和 Session log 保持原有能力。
-- 设置页使用顶部分类和单列内容。
-- 输入栏保留命令、权限、模型、上下文、图片和发送控件。
-- “添加工作区”在手机上展示电脑目录，不会在电脑上弹系统选择器。
-
-Android App 只是 Kotlin WebView 薄壳，不内置另一份网页；手机浏览器访问的也是同一页面。需要排查兼容性时，可在浏览器地址后追加 `?frontend=stock`，临时回到旧的桌面页面适配模式。
+`setup` 会自动选择并记住当前局域网，切换 Wi-Fi、热点或 IP 后通常自动恢复；仅在自动选择失败时使用 `--address 192.168.x.x`。设置、证书、设备和自定义文件保存在 `$DSH_HOME/mobile-access/`。
 
-## 在 DSH 对话中自定义
+## 扩展与自定义
 
-默认文件：
+在 DSH 对话里输入 `/mobile <需求>`，DSH 会直接修改手机端的文件，几秒内生效。例如：
 
 ```text
-$DSH_HOME/mobile-access/mobile.css
-$DSH_HOME/mobile-access/mobile.js
+/mobile 把手机端做成老式终端的样子，让消息像终端输出一样逐行滚动
 ```
 
-直接在 DeepSeek Harness 对话中提出修改即可，例如：
+`/mobile` 把需求交给 DSH 对话中的 agent，由它直接修改本机 `$DSH_HOME/mobile-access/` 下的文件，保存后手机端自动生效。改动分两类：界面和交互在 `mobile.css`/`mobile.js`；需要电脑能力时用 `extensions/` 下的扩展，其 `host.mjs` 以本机用户权限在电脑上运行。不修改 DeepSeek Harness 源码。
 
-```text
-请编辑 $DSH_HOME/mobile-access/mobile.css 和 mobile.js，
-把移动端改成适合单手操作的开发控制台：增加底部快捷指令、
-会话状态面板和长按语音入口。只影响窄屏，不修改 DSH 源码。
-```
-
-保存后，已打开的 App 和浏览器通常会在几秒内应用变化。`mobile.css` 和 `mobile.js` 负责手机页面的样式、交互和已有 API 编排；它们不能单独创建电脑文件、运行命令或访问电脑硬件。浏览器按 Web API 能力降级，Android App 通过受限的原生 Bridge 提供文件选择、拍照、分享、剪贴板、通知和语音等能力。
-
-### 扩展电脑端能力
-
-需要手机调用新的电脑能力时，在 `$DSH_HOME/mobile-access/extensions/<id>/` 创建扩展：
-
-```text
-extension.json   # 元数据
-host.mjs         # 电脑端 Node.js 代码（可信本地代码）
-mobile.js        # 手机端脚本，可选
-mobile.css       # 手机端样式，可选
-assets/          # 静态资源，可选
-```
-
-可用命令生成模板：
-
-```powershell
-dsh plugin --profile web exec dsh-mobile extension create media-tools --name "媒体工具"
-```
-
-`host.mjs` 可以注册经过 Schema 校验的 Action、普通 HTTP/流式/SSE Route 和清理 Effect；`mobile.js` 通过 `api.host.invoke()` 或 `api.host.fetch()` 调用它们。扩展文件只能在电脑端由用户或 DSH 修改，手机没有写入这些文件的接口。Mobile Access 关闭、设备撤销、扩展刷新或网关关闭时，扩展请求会被中止。
+## App 与手机浏览器
 
-发布型 DSH 插件也可以在 Cordis effect 中调用 `ctx.mobileAccess.registerExtension(definition)`，与本地目录扩展共用认证、路由和客户端 SDK，不需要修改 DSH 核心。
 
-每个扩展的 `id` 必须唯一，Host、脚本和 CSS 会作为同一版本热切换；新版本加载失败时保留上一版本。空的 `extensions/` 目录不产生副作用。配对设备拥有所有已注册扩展的权限，因此只应安装和编辑自己信任的 `host.mjs`。
+| 方式        | 适合场景         | 说明                                                                    |
+| ------------- | ------------------ | ------------------------------------------------------------------------- |
+| Android App | 日常使用         | 自动发现；App 内保存私有证书信任，无需在浏览器手动信任证书              |
+| 手机浏览器  | 临时或跨平台访问 | 打开“移动访问”卡片显示的 HTTPS 地址；首次连接需在浏览器手动信任该证书 |
 
-普通 DSH 社区插件仍按标准 `dsh.client` 和 Slot 贡献加载：对话节点、工具卡、设置区、侧栏项、Header Action、Composer Dock 和 Overlay 会随同一会话同步。只有依赖鼠标悬停、固定桌面宽度、系统文件选择器或私有 DOM 的插件需要额外移动适配。
+Android App 只是 Kotlin WebView 薄壳，不内置另一份网页；手机浏览器访问的是同一页面。需要排查兼容性时，可在浏览器地址后追加 `?frontend=stock`，临时回到旧的桌面页面适配模式。
 
 ## 工作原理
 
@@ -143,7 +94,7 @@ flowchart LR
   DSH -->|"同一工作区、会话和事件流"| Phone
 ```
 
-插件包含三层：Host face 提供发现、配对、HTTPS、回环代理和扩展注册表；Client face 提供独立的移动根布局、多扩展 SDK 和热更新；Android App 提供精确 Origin 限定的原生 Bridge。DeepSeek Harness 的源码和 3080 桌面页面都不会被修改，安装和卸载完全通过插件机制完成。
+插件包含三层：Host face 负责发现、配对、HTTPS、回环代理和扩展注册表；Client face 提供独立的移动布局与扩展 SDK；Android App 提供受限的原生 Bridge。DeepSeek Harness 的源码和 3080 桌面页面都不会被修改，安装和卸载完全通过插件机制完成。
 
 ## 安全
 
@@ -158,14 +109,12 @@ flowchart LR
 
 | DSH Mobile       | 已验证的 DeepSeek Harness                |
 | ------------------ | ------------------------------------------ |
-| `0.1.0-alpha.32` | `0.1.0-rc.5`、`0.1.0-rc.6`、`0.1.0-rc.7` |
+| `0.1.0-alpha.33` | `0.1.0-rc.5`、`0.1.0-rc.6`、`0.1.0-rc.7` |
 
-插件会在启动时检查 DSH Host 版本和移动布局所需的前端依赖；遇到未经验证的版本会直接给出错误，不会带着不兼容页面继续启动。CI 也会持续检查 DSH 主分支的布局插槽和移动端语义标记。升级 DSH 后如遇兼容提示，请先升级 DSH Mobile。
+插件启动时会检查 DSH Host 版本和移动布局所需的前端依赖，遇到未经验证的版本会直接报错而不是带病启动；CI 也会持续跟踪 DSH 主分支的布局契约。升级 DSH 后如遇兼容提示，请先升级 DSH Mobile。
 
 ## 卸载
 
-保留设备和自定义数据：
-
 ```powershell
 dsh plugin --profile web remove dsh-mobile
 ```

package/lib/index.d.mts

@@ -590,7 +590,7 @@ declare const WS_PATHS: Set<string>;
 //#region src/plugin.d.ts
 /** Stable Cordis plugin name. */
 declare const name = "dsh-mobile";
-/** The stock WebServer is the only DSH Host service this plugin requires. */
+/** The stock WebServer serves the control card; commands exposes /mobile to the DSH agent. */
 declare const inject: string[];
 /** Mount the resident control route and its optional authenticated LAN gateway. */
 declare function apply(ctx: Context, config: PluginConfig): Promise<void>;

package/lib/index.mjs

@@ -14,6 +14,7 @@ import { pipeline } from "node:stream/promises";
 import Bonjour from "bonjour-service";
 import * as QRCode from "qrcode";
 import { Service } from "@deepseek-ai/cordis";
+import { boundContextSummary, createUserMessage } from "@deepseek-ai/dsh-llm/message";
 import { execFile } from "node:child_process";
 import { promisify } from "node:util";
 import { generate } from "selfsigned";
@@ -3248,6 +3249,39 @@ var MemoryDeviceStore = class {
 		return structuredClone(this.snapshot);
 	}
 };
+//#endregion
+//#region src/mobile-guide.ts
+/**
+* Instructions handed to the DSH agent when the user runs `/mobile <task>`.
+* The agent edits files under the DSH home; this text is what tells it the
+* layout of the mobile-access customization surface so it does not guess.
+*/
+const MOBILE_CUSTOMIZATION_GUIDE = `你在为用户定制 DSH Mobile 的手机端。DSH Mobile 是一个把电脑上的 DeepSeek Harness 带到手机浏览器的插件，手机端界面和能力都来自本机文件。
+
+所有改动只允许在 $DSH_HOME/mobile-access/ 目录内进行，绝不修改 DeepSeek Harness 的源码或其他目录。$DSH_HOME 是 DeepSeek Harness 的配置目录（通常为 ~/.dsh），先确认它的实际路径再操作。
+
+手机端的能力分两层，按用户需求选择改动目标：
+
+1. 界面与交互 —— 只改外观和交互，不需要碰电脑的文件或程序：
+   - $DSH_HOME/mobile-access/mobile.css：手机端样式
+   - $DSH_HOME/mobile-access/mobile.js：手机端脚本，用 window.dshMobile.register(({ root }) => { ... }) 把内容挂载到 root，返回清理函数
+   - 保存后手机端几秒内自动应用，无需重启
+
+2. 电脑端能力 —— 手机需要读电脑文件、执行命令或访问硬件时，创建扩展：
+   - 目录：$DSH_HOME/mobile-access/extensions/<id>/，id 用小写字母数字和连字符（如 media-remote）
+   - extension.json：{"schemaVersion":1,"id":"<id>","name":"显示名","version":"0.1.0","description":"说明"}
+   - host.mjs：电脑端 Node.js 代码（可信本地代码，可读写文件、执行命令）。导出默认函数 (api) => { ... }，用 api.action('名称', { input, run }) 注册动作、api.route({ method, path, handle }) 注册路由、api.effect(fn) 注册清理
+   - mobile.js：手机端脚本，用 window.dshMobile.define({ apiVersion:1, id:'<id>', activate(api) { ... } })，activate 返回清理函数
+   - mobile.css：手机端样式（可选）
+   - assets/：手机端静态资源（可选）
+   - mobile.js 里用 api.host.invoke('动作名', 输入) 调 host.mjs 的 action，api.host.fetch('/路由路径') 调 route
+   - 也可以先用命令生成模板：dsh plugin --profile web exec dsh-mobile extension create <id> --name "<名称>"，再在模板上改
+
+安全约束：
+- host.mjs 拥有电脑用户的完整权限，绝不能放入不可信代码，也不要让手机端无条件执行任意命令
+- 所有改动只限 $DSH_HOME/mobile-access/，不要动 DeepSeek Harness 源码
+
+请执行用户需求：外观或交互类改 mobile.css / mobile.js；需要电脑能力的创建或修改扩展。完成后简要说明改了什么、手机端会有什么变化。`;
 promisify(execFile);
 const VIRTUAL_INTERFACE_MARKERS = [
 	"bridge",
@@ -3453,8 +3487,8 @@ async function materializeManagedSetup(setup, table) {
 //#region src/plugin.ts
 /** Stable Cordis plugin name. */
 const name = "dsh-mobile";
-/** The stock WebServer is the only DSH Host service this plugin requires. */
-const inject = ["webServer"];
+/** The stock WebServer serves the control card; commands exposes /mobile to the DSH agent. */
+const inject = ["webServer", "commands"];
 function installedDshVersion() {
 	const manifest = createRequire(import.meta.url)("@deepseek-ai/dsh-host-webserver/package.json");
 	if (manifest === null || typeof manifest !== "object") return void 0;
@@ -3634,19 +3668,49 @@ async function apply(ctx, config) {
 	};
 	await ctx.effect(async () => {
 		const unregister = ctx.webServer.register(adminRoute);
+		const disposeMobileCommand = ctx.commands.register({
+			name: "mobile",
+			description: "按需求修改 DSH Mobile 的手机端界面或添加电脑端能力",
+			input: { hint: "<要做什么>" },
+			handler: ({ agent, rawInput }) => {
+				const task = rawInput.trim();
+				if (task === "") return {
+					kind: "error",
+					text: "请带上需求，例如：/mobile 把手机端改成深色主题"
+				};
+				agent.steer(createUserMessage({
+					content: [{
+						type: "text",
+						text: `${MOBILE_CUSTOMIZATION_GUIDE}\n\n用户需求：${task}`
+					}],
+					source: {
+						kind: "plugin",
+						plugin: "dsh-mobile",
+						form: "notice",
+						summary: boundContextSummary(`/mobile ${task}`)
+					}
+				}));
+				return {
+					kind: "success",
+					text: "已把需求交给 DSH 处理，改动会在手机端几秒内生效。"
+				};
+			}
+		});
 		try {
 			await controller.initialize();
 		} catch (error) {
 			unregister();
+			disposeMobileCommand();
 			unregisterBuiltin();
 			throw error;
 		}
 		return async () => {
 			unregister();
+			disposeMobileCommand();
 			await controller.close();
 			unregisterBuiltin();
 		};
-	}, "dsh-mobile: local control and authenticated LAN gateway");
+	}, "dsh-mobile: local control, authenticated LAN gateway, and /mobile command");
 }
 //#endregion
 export { AUTH_PREFIX, AccessController, AccessError, BoundedRateLimiter, CSRF_COOKIE, CSRF_HEADER, Config, DEVICE_COOKIE, EXTENSION_LIMITS, JsonDeviceStore, JsonMobileAccessControlStore, LOCAL_ADMIN_PREFIX, MemoryDeviceStore, MobileAccessGateway, MobileAccessGatewayController, MobileAccessService, MobileExtensionError, RequestTrustPolicy, SESSION_COOKIE, SUPPORTED_DSH_VERSIONS, WS_PATHS, addressAllowed, apply, assertExtensionId, assertSupportedDshVersion, createMobileAccessService, inject, isLoopbackAddress, name, parseAuthority, parseCidr, parseControlFile, parseDeviceSnapshot, parseExtensionManifest, parseGatewayConfig, parseMobileAccessControlState, resolveAuthority, rewriteMobileIndex };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-mobile",
-  "version": "0.1.0-alpha.32",
+  "version": "0.1.0-alpha.33",
   "private": false,
   "description": "DeepSeek Harness 移动端适配与安全局域网访问插件，支持 Android App 和手机浏览器。",
   "type": "module",
@@ -89,16 +89,24 @@
   "license": "Apache-2.0",
   "peerDependencies": {
     "@deepseek-ai/cordis": "^4.0.1",
+    "@deepseek-ai/dsh-commands": "0.1.0-rc.6 || 0.1.0-rc.7",
     "@deepseek-ai/dsh-host-webserver": "0.1.0-rc.5 || 0.1.0-rc.6 || 0.1.0-rc.7",
+    "@deepseek-ai/dsh-llm": "0.1.0-rc.6 || 0.1.0-rc.7",
     "react": "^18.2.0"
   },
   "peerDependenciesMeta": {
     "@deepseek-ai/cordis": {
       "optional": true
     },
+    "@deepseek-ai/dsh-commands": {
+      "optional": true
+    },
     "@deepseek-ai/dsh-host-webserver": {
       "optional": true
     },
+    "@deepseek-ai/dsh-llm": {
+      "optional": true
+    },
     "react": {
       "optional": true
     }
@@ -111,7 +119,9 @@
   },
   "devDependencies": {
     "@deepseek-ai/cordis": "^4.0.1",
+    "@deepseek-ai/dsh-commands": "^0.1.0-rc.7",
     "@deepseek-ai/dsh-host-webserver": "^0.1.0-rc.7",
+    "@deepseek-ai/dsh-llm": "^0.1.0-rc.7",
     "@types/js-yaml": "^4.0.9",
     "@types/node": "^24.3.0",
     "@types/qrcode": "^1.5.5",