dsh-mobile 0.1.3 → 0.1.4

package/CHANGELOG.md

@@ -0,0 +1,17 @@
+# Changelog
+
+Notable changes to DSH Mobile are recorded here. GitHub Releases remain the source for downloadable packages and complete generated commit notes.
+
+## 0.1.4 - 2026-08-23
+
+- Keep the plugin compatible with DeepSeek Harness 0.1.1.
+- Continue mobile layout, safe-area, composer, settings, and interaction improvements.
+- Restore bounded native response reads on Android 10 through 12.
+- Publish Android releases as reproducible, signed release builds instead of temporary debug builds.
+- Preserve the existing mobile protocol so older app builds can continue using the updated plugin; switching from the previous temporary Android signature requires one uninstall and re-pair.
+- Refresh CI actions, Android lint coverage, build tooling, and maintenance documentation.
+
+## 0.1.3 - 2026-08-23
+
+- Added DeepSeek Harness 0.1.1 compatibility.
+- Improved mobile layout and interaction behavior.

package/README.en.md

@@ -7,18 +7,20 @@
 <p align="center">Secure, live LAN access to DeepSeek Harness from a phone.</p>
 
 <p align="center">
-  <a href="https://www.npmjs.com/package/dsh-mobile"><img src="https://img.shields.io/npm/v/dsh-mobile?tag=alpha&amp;label=npm&amp;color=CB3837" alt="npm version"></a>
+  <a href="https://www.npmjs.com/package/dsh-mobile"><img src="https://img.shields.io/npm/v/dsh-mobile?label=npm&amp;color=CB3837" alt="npm version"></a>
   <a href="https://github.com/saya-ch/dsh-mobile/actions/workflows/ci.yml"><img src="https://github.com/saya-ch/dsh-mobile/actions/workflows/ci.yml/badge.svg" alt="CI"></a>
   <a href="https://github.com/saya-ch/dsh-mobile/releases"><img src="https://img.shields.io/badge/Android-10%2B-3DDC84?logo=android&amp;logoColor=white" alt="Android 10+"></a>
   <a href="LICENSE"><img src="https://img.shields.io/badge/license-Apache--2.0-0F172A" alt="Apache-2.0"></a>
   <a href="https://github.com/awesome-dsh-plugin/awesome-dsh-plugin"><img src="https://awesome-dsh-plugin.com/badge.svg" alt="Awesome DSH Plugin"></a>
 </p>
 
-<p align="center"><a href="README.md">简体中文</a></p>
+<p align="center"><a href="README.md">简体中文</a> · <a href="CHANGELOG.md">Changelog</a></p>
 
 > The native app currently supports Android only; the iOS client remains a local experiment and is not included in builds or releases. This is a DeepSeek Harness community plugin.
 >
-> This release adds compatibility with DeepSeek Harness 0.1.1 and improves mobile interaction and layout.
+> Current release: DSH Mobile 0.1.4 supports DeepSeek Harness 0.1.1 and continues to refine mobile interaction and layout.
+>
+> The Android app uses a stable release signing key starting with 0.1.4. Users upgrading from 0.1.3 or earlier must uninstall the old app, install the new build, and pair once more; later releases can be installed in place. The plugin can be upgraded independently, and older app builds can continue connecting to the 0.1.4 plugin.
 
 <p align="center"><a href="https://github.com/saya-ch/dsh-mobile/releases"><strong>Download the Android app</strong></a></p>
 
@@ -136,7 +138,7 @@ See [SECURITY.md](SECURITY.md).
 
 | DSH Mobile | Verified DeepSeek Harness releases |
 | --- | --- |
-| `0.1.0–0.1.2` | `0.1.0-rc.5`, `0.1.0-rc.6`, `0.1.0-rc.7`, `0.1.1-rc.2` |
+| `0.1.0–0.1.4` | `0.1.0-rc.5`, `0.1.0-rc.6`, `0.1.0-rc.7`, `0.1.1-rc.2` |
 
 At startup, the plugin verifies the DSH Host version and the frontend dependencies required by the mobile layout; an unverified release fails with a clear error instead of serving a broken page. CI also tracks the DSH main branch layout contract. If a DSH upgrade reports an incompatibility, update DSH Mobile first.
 

package/README.md

@@ -7,7 +7,7 @@
 <p align="center">在手机上安全、实时地使用电脑中的 DeepSeek Harness。</p>
 
 <p align="center">
-  <a href="https://www.npmjs.com/package/dsh-mobile"><img src="https://img.shields.io/npm/v/dsh-mobile?tag=alpha&label=npm&color=CB3837" alt="npm 版本"></a>
+  <a href="https://www.npmjs.com/package/dsh-mobile"><img src="https://img.shields.io/npm/v/dsh-mobile?label=npm&color=CB3837" alt="npm 版本"></a>
   <a href="https://github.com/saya-ch/dsh-mobile/actions/workflows/ci.yml"><img src="https://github.com/saya-ch/dsh-mobile/actions/workflows/ci.yml/badge.svg" alt="CI"></a>
   <a href="https://github.com/saya-ch/dsh-mobile/releases"><img src="https://img.shields.io/badge/Android-10%2B-3DDC84?logo=android&logoColor=white" alt="Android 10+"></a>
   <a href="LICENSE"><img src="https://img.shields.io/badge/license-Apache--2.0-0F172A" alt="Apache-2.0"></a>
@@ -18,12 +18,15 @@
   <a href="#能做什么">能做什么</a> ·
   <a href="#快速开始">快速开始</a> ·
   <a href="#扩展与自定义">扩展与自定义</a> ·
+  <a href="CHANGELOG.md">更新记录</a> ·
   <a href="README.en.md">English</a>
 </p>
 
 > 当前原生 App 仅支持 Android；iOS 客户端尚处于本地实验阶段，暂不纳入构建与发布。本项目是 DeepSeek Harness 社区插件。
 >
-> 本次更新：适配 DeepSeek Harness 0.1.1，优化移动端交互与布局体验。
+> 当前版本：DSH Mobile 0.1.4，适配 DeepSeek Harness 0.1.1，并持续优化移动端交互与布局体验。
+>
+> Android App 自 0.1.4 起使用稳定发布签名。已安装 0.1.3 或更早版本的用户需要卸载旧 App、安装新版并重新配对一次；此后版本可直接覆盖升级。插件可独立更新，旧版 App 仍可继续连接 0.1.4 插件。
 
 <p align="center"><a href="https://github.com/saya-ch/dsh-mobile/releases"><strong>下载 Android App</strong></a></p>
 
@@ -142,7 +145,7 @@ flowchart LR
 
 | DSH Mobile       | 已验证的 DeepSeek Harness                |
 | ------------------ | ------------------------------------------ |
-| `0.1.0–0.1.2` | `0.1.0-rc.5`、`0.1.0-rc.6`、`0.1.0-rc.7`、`0.1.1-rc.2` |
+| `0.1.0–0.1.4` | `0.1.0-rc.5`、`0.1.0-rc.6`、`0.1.0-rc.7`、`0.1.1-rc.2` |
 
 插件启动时会检查 DSH Host 版本和移动布局所需的前端依赖，遇到未经验证的版本会直接报错而不是带病启动；CI 也会持续跟踪 DSH 主分支的布局契约。升级 DSH 后如遇兼容提示，请先升级 DSH Mobile。
 

package/SECURITY.md

@@ -4,7 +4,7 @@
 
 ## Supported versions
 
-Only the newest prerelease receives security fixes while the project is in alpha. The README compatibility table identifies the exact DSH release tested with each plugin version.
+Security fixes target the newest stable release. Prereleases receive fixes only when the corresponding GitHub Release says they are supported. The README compatibility table identifies the exact DSH release tested with each plugin version.
 
 ## Reporting a vulnerability
 
@@ -27,7 +27,7 @@ The maintainer will acknowledge a complete report within seven days. Publication
 - Treat every extension `host.mjs` as a local program with the desktop user's Node.js privileges. It is never sandboxed and is not editable through the mobile gateway; only place code there that you trust.
 - Extension Actions and Routes receive filtered request data, a device identifier, and an abort signal. They cannot set proxy security headers or access the gateway's cookies, device tokens, CSRF tokens, or internal request headers.
 
-## Known alpha limitation
+## Known limitation
 
 The current DSH HTML boot process contains inline JavaScript, revives Schemastery callbacks with `new Function`, and applies some styles dynamically. To keep the stock Web UI runnable, the gateway's Content Security Policy currently includes `script-src 'self' 'unsafe-inline' 'unsafe-eval'` and `style-src 'self' 'unsafe-inline'`. The remaining directives still restrict origins, connections, frames, objects, workers, images, and form targets, but this policy does not eliminate script-injection risk. Removing these allowances requires upstream DSH support for nonces, stable hashes, external boot resources, and a non-evaluating schema representation.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-mobile",
-  "version": "0.1.3",
+  "version": "0.1.4",
   "private": false,
   "description": "DeepSeek Harness 移动端适配与安全局域网访问插件，支持 Android App 和手机浏览器。",
   "type": "module",
@@ -30,6 +30,7 @@
     "cordis.patch.yml",
     "README.md",
     "README.en.md",
+    "CHANGELOG.md",
     "assets/brand/*.png",
     "LICENSE",
     "SECURITY.md"
@@ -130,7 +131,7 @@
     "react": "^18.2.0",
     "tsdown": "^0.22.14",
     "typescript": "^6.0.3",
-    "vitest": "^4.1.10"
+    "vitest": "^4.1.11"
   },
   "directories": {
     "lib": "lib",