dsh-mobile 0.1.4 → 0.2.0

package/CHANGELOG.md

@@ -2,6 +2,14 @@
 
 Notable changes to DSH Mobile are recorded here. GitHub Releases remain the source for downloadable packages and complete generated commit notes.
 
+## 0.2.0 - 2026-08-24
+
+- Add independent LAN and remote access flows with separate paired-device stores.
+- Add optional Tailscale Funnel and managed cpolar remote providers.
+- Restore saved Android connections automatically and improve mobile loading over limited links.
+- Page older session history on demand and compress eligible gateway responses.
+- Build the pinned Funnel host from source and publish checksums, an SBOM, and third-party notices.
+
 ## 0.1.4 - 2026-08-23
 
 - Keep the plugin compatible with DeepSeek Harness 0.1.1.

package/README.en.md

@@ -16,15 +16,15 @@
 
 <p align="center"><a href="README.md">简体中文</a> · <a href="CHANGELOG.md">Changelog</a></p>
 
-> The native app currently supports Android only; the iOS client remains a local experiment and is not included in builds or releases. This is a DeepSeek Harness community plugin.
+> DSH Mobile 0.2.0 is a DeepSeek Harness community plugin for the DeepSeek Harness 0.1.1 series (verified with 0.1.1-rc.2); the native app supports Android only.
 >
-> Current release: DSH Mobile 0.1.4 supports DeepSeek Harness 0.1.1 and continues to refine mobile interaction and layout.
+> **0.2.0 update**: adds optional remote access and improves mobile loading performance.
 >
-> The Android app uses a stable release signing key starting with 0.1.4. Users upgrading from 0.1.3 or earlier must uninstall the old app, install the new build, and pair once more; later releases can be installed in place. The plugin can be upgraded independently, and older app builds can continue connecting to the 0.1.4 plugin.
+> Upgrading the app from 0.1.3 or earlier requires one uninstall and re-pair; older app builds can still use the 0.2.0 LAN path.
 
-<p align="center"><a href="https://github.com/saya-ch/dsh-mobile/releases"><strong>Download the Android app</strong></a></p>
+<p align="center"><a href="https://github.com/saya-ch/dsh-mobile/releases/download/v0.2.0/dsh-mobile-android-v0.2.0.apk"><strong>Download Android app 0.2.0</strong></a> · <a href="https://github.com/saya-ch/dsh-mobile/releases/tag/v0.2.0">Release notes and checksums</a></p>
 
-DSH Mobile is a DeepSeek Harness plugin that lets a mobile browser or the Android app connect over a protected LAN and keep using the same sessions, Workspaces, messages, and tools. It is a mobile entry point only; the DeepSeek Harness source is not modified and no public-Internet tunneling is needed.
+DSH Mobile is a DeepSeek Harness plugin that lets a mobile browser or the Android app connect over a protected LAN or an optional Tailscale Funnel or cpolar remote path. Local and remote access keep the same sessions, Workspaces, messages, and tools while using separate switches and paired-device stores without modifying DeepSeek Harness source.
 
 Mobile access runs on its own HTTPS origin with pinned certificates; only paired devices pass validation.
 
@@ -67,18 +67,49 @@ dsh plugin --profile web add dshmarket
 
 Restart DSH, then search for **dsh-mobile** under **Settings → Plugin Market** and install it with one click.
 
-After starting DSH, open **Mobile Access** in the lower-left sidebar, then:
+`setup` automatically selects and remembers the current LAN; Wi-Fi, hotspot, and IP changes normally recover without re-pairing. Use `--address 192.168.x.x` only when automatic selection fails. Settings, certificates, devices, and customization files live under `$DSH_HOME/mobile-access/`.
+
+After installation, start DSH and use the connection guide below to choose LAN or remote access.
+
+## Connection guide
+
+LAN and remote access are independent connections. Prefer LAN while the phone is near the computer for the lowest latency, and enable remote access only when leaving that network. Each path keeps its own switch, paired devices, and sign-in state.
 
-1. Select **Create and copy key** or **Copy pairing link**; the panel shows a pairing QR code.
+### Local network
+
+Use this when the phone and computer share Wi-Fi, Ethernet, or a phone hotspot. It is the default and simplest path.
 
 <p align="center">
-  <img src="https://raw.githubusercontent.com/saya-ch/dsh-mobile/main/assets/screenshots/desktop-qr.png" width="70%" alt="Mobile Access panel with the pairing QR code">
+  <img src="https://raw.githubusercontent.com/saya-ch/dsh-mobile/main/assets/screenshots/lan-access.png" width="82%" alt="DSH Mobile LAN access, pairing QR code, and device management">
 </p>
 
-2. In the Android app, tap **Scan QR code** and point the camera at the screen — or tap **Scan**, select the computer, and paste the key or pairing link.
-3. Pairing establishes persistent device trust; later launches do not ask again.
+1. Connect the phone and computer to the same local network, then open **Mobile Access → Local network** in the lower-left corner of DeepSeek Harness.
+2. If needed, select **Enable local access**, then select **Create and copy key**. The panel displays a pairing QR code.
+3. In the Android app, open **Local network**, scan for computers, select the device, then scan the QR code or paste the pairing key.
+4. Pairing creates persistent device trust. Later app launches discover and connect automatically; Wi-Fi, hotspot, and DHCP address changes normally do not require pairing again.
 
-`setup` automatically selects and remembers the current LAN; Wi-Fi, hotspot, and IP changes normally recover without re-pairing. Use `--address 192.168.x.x` only when automatic selection fails. Settings, certificates, devices, and customization files live under `$DSH_HOME/mobile-access/`.
+The app is optional: select **Copy pairing link** and open it in a mobile browser. The browser must manually trust the plugin certificate on the first visit.
+
+### Remote access
+
+Use this after the phone leaves the computer's network. Remote access is disabled by default, and the phone needs neither the Tailscale nor cpolar app.
+
+Remote providers may impose bandwidth and connection limits: the [cpolar Free plan](https://svip.cpolar.com/pricing) currently lists 1 Mbps, while [Tailscale Funnel](https://tailscale.com/docs/features/tailscale-funnel#requirements-and-limitations) has non-configurable bandwidth limits. DSH Mobile reduces transfer and waiting with 10-message pages, load-on-scroll history, gzip, and a persistent WebSocket, but it cannot raise provider quotas.
+
+<p align="center">
+  <img src="https://raw.githubusercontent.com/saya-ch/dsh-mobile/main/assets/screenshots/remote-access.png" width="82%" alt="DSH Mobile remote access and provider selection">
+</p>
+
+1. Open **Mobile Access → Remote** in the lower-left corner of DeepSeek Harness and choose a provider:
+   - **Tailscale Funnel**: select **Enable remote access**, complete the one-time Tailscale sign-in on the official page, follow the panel prompt to allow Funnel, then return to DSH and wait until the connection is ready.
+   - **cpolar**: select **Install official component**, sign in to the cpolar dashboard and obtain an Authtoken, paste it, then select **Save and connect**. The component is downloaded into the plugin's private directory only after confirmation.
+2. When the panel reports that remote access is ready, select **Create remote pairing QR code**.
+3. In the Android app, open **Remote access** and scan the QR code to create its separate pairing.
+4. The app keeps device trust and reconnects automatically. Disable remote access when it is not needed; LAN access remains unchanged.
+
+Tailscale Funnel has broad reach but may be unreliable from mainland China. cpolar is better suited to mainland networks. The plugin validates the pinned component download, stores its configuration and program entirely under `$DSH_HOME/mobile-access/`, and can remove them completely from the panel.
+
+The public remote origin still requires DSH device pairing. Managed remote components currently support Windows x64.
 
 ## Extend and customize
 
@@ -96,7 +127,7 @@ It can also drive computer capabilities the phone can use, like reading the mach
 
 Two kinds of changes are supported: the phone UI itself (theme, layout, buttons), and computer capabilities the phone can use (browsing computer files, running programs on the computer). `/mobile` hands the request to the DSH agent, which edits files under the local DSH configuration directory (`$DSH_HOME/mobile-access/`); the phone client applies them automatically. UI changes live in `mobile.css`/`mobile.js`. Computer capabilities come from extensions under `extensions/`, whose `host.mjs` runs with the local user's privileges on the computer. DeepSeek Harness source is not modified.
 
-> When using computer-side capabilities, use only content you trust.
+> `host.mjs` has the same privileges as a local program. Create and run only computer-side extensions that you understand and trust.
 
 The examples above, applied:
 
@@ -111,7 +142,7 @@ The examples above, applied:
 
 | Client | Best for | Notes |
 | --- | --- | --- |
-| Android app | Everyday use | Auto-discovery; private certificate pinning inside the app, no manual browser trust step |
+| Android app | Everyday use | Separate Local and Remote entries; LAN discovery and a system-trusted remote HTTPS path |
 | Mobile browser | Temporary or cross-platform | Open the HTTPS origin shown by Mobile Access; trust the certificate manually on first visit |
 
 The Android app is a thin Kotlin WebView shell and contains no frontend copy; mobile browsers load the same page. For compatibility diagnosis, append `?frontend=stock` to the browser URL to temporarily use the previous desktop-page adaptation.
@@ -120,7 +151,10 @@ The Android app is a thin Kotlin WebView shell and contains no frontend copy; mo
 
 ```mermaid
 flowchart LR
-  Phone["Android / mobile browser"] -->|"HTTPS + device session"| Gateway["DSH Mobile gateway"]
+  Phone["Android / mobile browser"] -->|"LAN HTTPS"| Lan["LAN gateway"]
+  Phone -->|"remote HTTPS"| Remote["separate remote gateway"]
+  Lan --> Gateway["DSH Mobile Gateway Core"]
+  Remote --> Gateway
   Gateway -->|"loopback proxy"| DSH["Stock DSH Web and Host"]
 ```
 
@@ -128,7 +162,9 @@ Three layers: the Host face for discovery, pairing, HTTPS, loopback proxying, an
 
 ## Security
 
-- Use the plugin only on a trusted LAN or trusted VPN; never expose it to the public Internet.
+- Use the LAN listener only on a trusted home, office, or hotspot network; do not add your own port forwarding.
+- A remote origin is publicly reachable, but unpaired requests cannot enter DSH; turn the remote switch off when it is not needed.
+- cpolar downloads a pinned official build only after confirmation and verifies its size and SHA-256. It installs no system service, PATH entry, or startup task, and plugin cleanup removes its managed files.
 - A paired device is a fully trusted DeepSeek Harness operator and can run tools on the computer; revoke lost devices from the computer.
 - The LAN gateway listens only while Mobile Access is enabled; with it off, DSH keeps running normally on the computer.
 
@@ -138,7 +174,8 @@ See [SECURITY.md](SECURITY.md).
 
 | DSH Mobile | Verified DeepSeek Harness releases |
 | --- | --- |
-| `0.1.0–0.1.4` | `0.1.0-rc.5`, `0.1.0-rc.6`, `0.1.0-rc.7`, `0.1.1-rc.2` |
+| `0.2.0` | `0.1.0-rc.5`, `0.1.0-rc.6`, `0.1.0-rc.7`, `0.1.1-rc.2` |
+| `0.1.4` | `0.1.0-rc.5`, `0.1.0-rc.6`, `0.1.0-rc.7`, `0.1.1-rc.2` |
 
 At startup, the plugin verifies the DSH Host version and the frontend dependencies required by the mobile layout; an unverified release fails with a clear error instead of serving a broken page. CI also tracks the DSH main branch layout contract. If a DSH upgrade reports an incompatibility, update DSH Mobile first.
 

package/README.md

@@ -17,20 +17,21 @@
 <p align="center">
   <a href="#能做什么">能做什么</a> ·
   <a href="#快速开始">快速开始</a> ·
+  <a href="#连接教程">连接教程</a> ·
   <a href="#扩展与自定义">扩展与自定义</a> ·
   <a href="CHANGELOG.md">更新记录</a> ·
   <a href="README.en.md">English</a>
 </p>
 
-> 当前原生 App 仅支持 Android；iOS 客户端尚处于本地实验阶段，暂不纳入构建与发布。本项目是 DeepSeek Harness 社区插件。
+> DSH Mobile 0.2.0 是 DeepSeek Harness 社区插件，适配 DeepSeek Harness 0.1.1 系列（已验证 0.1.1-rc.2）；原生 App 仅支持 Android。
 >
-> 当前版本：DSH Mobile 0.1.4，适配 DeepSeek Harness 0.1.1，并持续优化移动端交互与布局体验。
+> **0.2.0 更新**：新增可选远程访问，并优化移动端加载体验。
 >
-> Android App 自 0.1.4 起使用稳定发布签名。已安装 0.1.3 或更早版本的用户需要卸载旧 App、安装新版并重新配对一次；此后版本可直接覆盖升级。插件可独立更新，旧版 App 仍可继续连接 0.1.4 插件。
+> 从 0.1.3 或更早 App 升级时需卸载旧版并重新配对一次；旧版 App 仍可使用 0.2.0 的局域网功能。
 
-<p align="center"><a href="https://github.com/saya-ch/dsh-mobile/releases"><strong>下载 Android App</strong></a></p>
+<p align="center"><a href="https://github.com/saya-ch/dsh-mobile/releases/download/v0.2.0/dsh-mobile-android-v0.2.0.apk"><strong>下载 Android App 0.2.0</strong></a> · <a href="https://github.com/saya-ch/dsh-mobile/releases/tag/v0.2.0">版本说明与校验文件</a></p>
 
-DSH Mobile 是一个 DeepSeek Harness 插件，让手机浏览器或 Android App 在受保护的局域网内连接电脑，继续使用同一份会话、工作区、消息和工具。它只作为移动入口接入，不修改 DeepSeek Harness 源码。
+DSH Mobile 是一个 DeepSeek Harness 插件，让手机浏览器或 Android App 通过局域网，或可选的 Tailscale Funnel、cpolar 远程通道连接电脑，继续使用同一份会话、工作区、消息和工具。局域网与远程访问分别启停、分别管理设备，且都不修改 DeepSeek Harness 源码。
 
 移动访问使用独立的 HTTPS 与证书固定，只有配对过的设备能通过校验接入。
 
@@ -73,18 +74,49 @@ dsh plugin --profile web add dshmarket
 
 重启 DSH 后，在 **设置 → 插件市场** 里搜索 dsh-mobile，一键安装即可。
 
-启动后，在 DeepSeek Harness 左下角打开“移动访问”，然后：
+`setup` 会自动选择并记住当前局域网，切换 Wi-Fi、热点或 IP 后通常自动恢复；仅在自动选择失败时使用 `--address 192.168.x.x`。设置、证书、设备和自定义文件保存在 `$DSH_HOME/mobile-access/`。
+
+安装并启动 DSH 后，按照下一节选择局域网或远程连接。
+
+## 连接教程
+
+局域网和远程访问是两套相互独立的连接：在电脑附近优先使用局域网，延迟最低；离开当前网络时再启用远程访问。两边分别管理开关、设备和登录状态，互不影响。
 
-1. 点击“生成并复制密钥”或“复制配对链接”，面板会显示配对二维码。
+### 局域网访问
+
+适合同一 Wi-Fi、以太网或手机热点，是默认且最简单的连接方式。
 
 <p align="center">
-  <img src="https://raw.githubusercontent.com/saya-ch/dsh-mobile/main/assets/screenshots/desktop-qr.png" width="70%" alt="桌面端移动访问面板与配对二维码">
+  <img src="https://raw.githubusercontent.com/saya-ch/dsh-mobile/main/assets/screenshots/lan-access.png" width="82%" alt="DSH Mobile 局域网访问、配对二维码与设备管理">
 </p>
 
-2. Android App 点击“扫码配对”，把手机对准电脑屏幕上的二维码即可；也可以点击“扫描”选择电脑后粘贴密钥或配对链接。
-3. 配对完成后会建立持久设备信任，以后打开 App 无需重复输入。
+1. 让手机和电脑连接同一个局域网，在 DeepSeek Harness 左下角打开 **移动访问 → 局域网**。
+2. 如果尚未开启，点击 **开启局域网访问**；随后点击 **生成并复制密钥**，面板会显示配对二维码。
+3. 在 Android App 中进入 **局域网访问**，扫描发现电脑并点击设备，再扫描二维码或粘贴配对密钥。
+4. 配对完成后会建立持久设备信任。以后打开 App 会自动发现并连接，切换 Wi-Fi、热点或 DHCP 地址通常不需要重新配对。
 
-`setup` 会自动选择并记住当前局域网，切换 Wi-Fi、热点或 IP 后通常自动恢复；仅在自动选择失败时使用 `--address 192.168.x.x`。设置、证书、设备和自定义文件保存在 `$DSH_HOME/mobile-access/`。
+不安装 App 也可以访问：点击 **复制配对链接**，在手机浏览器中打开；首次访问需要按浏览器提示手动信任插件证书。
+
+### 远程访问
+
+适合手机离开电脑所在网络后使用。远程访问默认关闭，手机不需要另外安装 Tailscale 或 cpolar。
+
+远程服务可能受带宽和连接限额影响：[cpolar 免费方案](https://svip.cpolar.com/pricing) 当前为 1 Mbps，[Tailscale Funnel](https://tailscale.com/docs/features/tailscale-funnel#requirements-and-limitations) 也存在不可配置的带宽限制。DSH Mobile 通过 10 条分页、顶部按需加载、gzip 和 WebSocket 长连接减少流量与等待，但无法突破服务商限额。
+
+<p align="center">
+  <img src="https://raw.githubusercontent.com/saya-ch/dsh-mobile/main/assets/screenshots/remote-access.png" width="82%" alt="DSH Mobile 远程访问与通道选择">
+</p>
+
+1. 在 DeepSeek Harness 左下角打开 **移动访问 → 远程**，选择一种连接方式：
+   - **Tailscale Funnel**：点击 **启用远程访问**，在打开的官方页面完成一次 Tailscale 登录；按面板提示继续允许 Funnel，然后返回 DSH 等待连接就绪。
+   - **cpolar**：点击 **安装官方组件**，登录 cpolar 控制台取得 Authtoken，粘贴后点击 **保存并连接**。组件只会在确认后下载到插件私有目录。
+2. 状态变为“远程访问已就绪”后，点击 **生成远程配对二维码**。
+3. 在 Android App 中进入 **远程访问**，扫描二维码完成独立配对。
+4. 此后 App 会保存设备信任并自动重连；不使用时可以关闭远程访问，局域网连接不会受影响。
+
+Tailscale Funnel 覆盖范围广，但在中国大陆网络下可能不稳定。cpolar 更适合国内网络；插件会校验下载组件的固定版本，配置与程序均保存在 `$DSH_HOME/mobile-access/`，可随时在面板中彻底清除。
+
+远程公开地址仍受 DSH 设备配对保护。当前托管的远程组件支持 Windows x64。
 
 ## 扩展与自定义
 
@@ -102,6 +134,8 @@ dsh plugin --profile web add dshmarket
 
 `/mobile` 把需求交给 DSH 对话中的 agent，由它直接修改本机 `$DSH_HOME/mobile-access/` 下的文件，保存后手机端自动生效。改动分两类：界面和交互在 `mobile.css`/`mobile.js`；需要电脑能力时用 `extensions/` 下的扩展，其 `host.mjs` 以本机用户权限在电脑上运行。不修改 DeepSeek Harness 源码。
 
+> `host.mjs` 与本机程序拥有相同权限；仅创建和运行你理解并信任的电脑端扩展。
+
 示例的实际效果：
 
 <p align="center">
@@ -114,10 +148,10 @@ dsh plugin --profile web add dshmarket
 ## App 与手机浏览器
 
 
-| 方式        | 适合场景         | 说明                                                                    |
-| ------------- | ------------------ | ------------------------------------------------------------------------- |
-| Android App | 日常使用         | 自动发现；App 内保存私有证书信任，无需在浏览器手动信任证书              |
-| 手机浏览器  | 临时或跨平台访问 | 打开“移动访问”卡片显示的 HTTPS 地址；首次连接需在浏览器手动信任该证书 |
+| 方式        | 适合场景         | 说明                                                                        |
+| ------------- | ------------------ | ----------------------------------------------------------------------------- |
+| Android App | 日常使用         | 首屏分开显示局域网与远程入口；局域网自动发现，远程使用系统信任的 HTTPS 通道 |
+| 手机浏览器  | 临时或跨平台访问 | 打开“移动访问”卡片显示的 HTTPS 地址；首次连接需在浏览器手动信任该证书     |
 
 Android App 只是 Kotlin WebView 薄壳，不内置另一份网页；手机浏览器访问的是同一页面。需要排查兼容性时，可在浏览器地址后追加 `?frontend=stock`，临时回到旧的桌面页面适配模式。
 
@@ -125,7 +159,10 @@ Android App 只是 Kotlin WebView 薄壳，不内置另一份网页；手机浏
 
 ```mermaid
 flowchart LR
-  Phone["Android App / 手机浏览器"] -->|"HTTPS + 设备会话"| Gateway["DSH Mobile 网关"]
+  Phone["Android App / 手机浏览器"] -->|"局域网 HTTPS"| Lan["局域网网关"]
+  Phone -->|"远程 HTTPS"| Remote["独立远程网关"]
+  Lan --> Gateway["DSH Mobile Gateway Core"]
+  Remote --> Gateway
   Gateway -->|"回环代理"| DSH["原生 DSH Web 与 Host"]
   DSH -->|"同一工作区、会话和事件流"| Phone
 ```
@@ -134,7 +171,9 @@ flowchart LR
 
 ## 安全
 
-- 仅在可信家庭、办公局域网或可信 VPN 中使用，不要转发到公网。
+- 局域网监听只用于可信家庭、办公网络或可信热点；不要自行做端口转发。
+- 远程地址可从公网到达，但未配对请求无法进入 DSH；不使用时应关闭远程开关。
+- cpolar 仅在用户确认后下载固定官方版本并校验大小和 SHA-256；不会安装系统服务、写入 PATH 或设置开机启动，插件清理会删除其托管文件。
 - 配对设备拥有控制电脑端 DeepSeek Harness 的能力，应视为完全可信设备；丢失手机后应在电脑端撤销设备。
 - 移动网关开启时才监听局域网；关闭后 DeepSeek Harness 仍正常在电脑本机运行。
 
@@ -143,9 +182,10 @@ flowchart LR
 ## 兼容性
 
 
-| DSH Mobile       | 已验证的 DeepSeek Harness                |
-| ------------------ | ------------------------------------------ |
-| `0.1.0–0.1.4` | `0.1.0-rc.5`、`0.1.0-rc.6`、`0.1.0-rc.7`、`0.1.1-rc.2` |
+| DSH Mobile | 已验证的 DeepSeek Harness                              |
+| ------------ | -------------------------------------------------------- |
+| `0.2.0`    | `0.1.0-rc.5`、`0.1.0-rc.6`、`0.1.0-rc.7`、`0.1.1-rc.2` |
+| `0.1.4`    | `0.1.0-rc.5`、`0.1.0-rc.6`、`0.1.0-rc.7`、`0.1.1-rc.2` |
 
 插件启动时会检查 DSH Host 版本和移动布局所需的前端依赖，遇到未经验证的版本会直接报错而不是带病启动；CI 也会持续跟踪 DSH 主分支的布局契约。升级 DSH 后如遇兼容提示，请先升级 DSH Mobile。
 

package/SECURITY.md

@@ -21,7 +21,10 @@ The maintainer will acknowledge a complete report within seven days. Publication
 - Browser clients require a certificate trusted by that browser platform. Android uses the pairing-key-bound app-private CA. Its WebView exception is restricted to `SSL_UNTRUSTED` for an exact-origin, currently valid leaf signed by that CA; hostname, validity, signature, and every other TLS error remain fail-closed.
 - Keep pairing closed except during a short local onboarding action.
 - Revoke a lost device immediately and rotate the device registry if credential theft is suspected.
-- Do not expose the gateway directly to the public Internet.
+- Do not expose the LAN gateway through router port forwarding. Optional remote access uses a separate loopback gateway behind the selected Tailscale Funnel or cpolar service. The provider terminates public TLS, while DSH pairing, device authentication, CSRF checks, and session revocation remain enforced by the plugin gateway.
+- The Funnel node stores its Tailscale login state under `$DSH_HOME/mobile-access/remote/tailscale/`. The plugin does not request or store a Tailscale password, Auth Key, or OAuth secret.
+- cpolar is downloaded only after confirmation from a pinned official artifact whose size and SHA-256 are verified. Its Authtoken is stored in a private, self-update-disabled configuration under `$DSH_HOME/mobile-access/`, never returned by the admin API or written to logs. Cleanup removes the managed executable, configuration, logs, and independent remote device registry.
+- Disabling remote access stops the selected provider process without affecting LAN access. Resetting remote access also removes provider state and the independent remote device registry.
 - Treat every paired device as a fully trusted operator. Stock DSH methods reached through the authenticated loopback proxy may read configuration or run tools with the desktop user's authority.
 - Treat `mobile.js` as application code with the paired page's same-origin authority. Restrict write access to trusted host-side DSH sessions and review generated API calls or browser-permission use.
 - Treat every extension `host.mjs` as a local program with the desktop user's Node.js privileges. It is never sandboxed and is not editable through the mobile gateway; only place code there that you trust.

package/THIRD_PARTY_NOTICES.md

@@ -0,0 +1,5 @@
+# Third-party notices
+
+DSH Mobile includes a small Windows helper built from the source in `native/funnel-host`. The helper uses [Tailscale tsnet](https://pkg.go.dev/tailscale.com/tsnet) `v1.102.3`, distributed under the BSD 3-Clause license. Its exact transitive Go module versions are recorded in `native/funnel-host/go.mod` and `native/funnel-host/go.sum`; each dependency remains subject to its own license.
+
+The optional cpolar component is not included in the npm package or Android App. When a user explicitly chooses cpolar installation, DSH Mobile downloads the pinned official archive shown in the UI, verifies its size and SHA-256 digest, and stores it only under the user's DSH Mobile data directory. cpolar remains subject to its [terms of service](https://www.cpolar.com/tos).

package/lib/cli.js

@@ -8,6 +8,47 @@ import { X509Certificate, createPrivateKey, createPublicKey } from "node:crypto"
 import { generate } from "selfsigned";
 import "@deepseek-ai/cordis";
 import "@deepseek-ai/schemastery";
+//#region src/private-file.ts
+const execFile$3 = promisify(execFile);
+let userSidTask;
+async function currentWindowsUserSid() {
+	userSidTask ??= execFile$3("whoami.exe", [
+		"/user",
+		"/fo",
+		"csv",
+		"/nh"
+	], {
+		encoding: "utf8",
+		windowsHide: true
+	}).then(({ stdout }) => {
+		const match = /,"(S-\d(?:-\d+)+)"\s*$/u.exec(stdout.trim());
+		if (match?.[1] === void 0) throw new Error("unable to resolve the current Windows user SID");
+		return match[1];
+	});
+	return userSidTask;
+}
+/** Restrict a sensitive regular file to the current user and Windows administrators. */
+async function restrictPrivateFile(file, mode = 384) {
+	await chmod(file, mode);
+	if (process.platform !== "win32") return;
+	const userSid = await currentWindowsUserSid();
+	await execFile$3("icacls.exe", [
+		file,
+		"/inheritance:r",
+		"/grant:r",
+		`*${userSid}:(F)`,
+		"*S-1-5-18:(F)",
+		"*S-1-5-32-544:(F)",
+		"/remove:g",
+		"*S-1-1-0",
+		"*S-1-5-11",
+		"*S-1-5-32-545"
+	], {
+		encoding: "utf8",
+		windowsHide: true
+	});
+}
+//#endregion
 //#region src/managed-setup.ts
 const execFile$2 = promisify(execFile);
 const VIRTUAL_INTERFACE_MARKERS = [
@@ -156,8 +197,8 @@ async function atomicWrite(file, contents) {
 	});
 	const temporary = join(directory, `.${basename(file)}.${process.pid}.tmp`);
 	await writeFile(temporary, contents, { mode: 384 });
-	await chmod(temporary, 384);
 	await rename(temporary, file);
+	await restrictPrivateFile(file);
 }
 /** Create a long-lived CA or migrate the legacy self-signed server certificate as that CA. */
 async function ensureManagedCa(setup, legacy) {
@@ -207,10 +248,12 @@ async function ensureManagedCa(setup, legacy) {
 		await Promise.all([atomicWrite(setup.caCertFile, certPem), atomicWrite(setup.caKeyFile, keyPem)]);
 	}
 	if (certPem === void 0 || keyPem === void 0) throw new Error("managed TLS CA creation did not produce key material");
+	await Promise.all([restrictPrivateFile(setup.caCertFile), restrictPrivateFile(setup.caKeyFile)]);
 	return assertMatchingCa(certPem, keyPem);
 }
 /** Sign and atomically install a server leaf for the interface's current address. */
 async function refreshManagedServerCertificate(setup, address) {
+	await Promise.all([restrictPrivateFile(setup.tls.caCertFile), restrictPrivateFile(setup.tls.caKeyFile)]);
 	const [caCert, caKey] = await Promise.all([readFile(setup.tls.caCertFile, "utf8"), readFile(setup.tls.caKeyFile, "utf8")]);
 	assertMatchingCa(caCert, caKey);
 	const now = /* @__PURE__ */ new Date();
@@ -395,11 +438,11 @@ async function setup(args) {
 	await refreshManagedServerCertificate(managedSetup, network.address);
 	await writeFile(androidCertificate, ca.raw, { mode: 384 });
 	await Promise.all([
-		chmod(caCertFile, 384),
-		chmod(caKeyFile, 384),
-		chmod(certFile, 384),
-		chmod(keyFile, 384),
-		chmod(androidCertificate, 384)
+		restrictPrivateFile(caCertFile),
+		restrictPrivateFile(caKeyFile),
+		restrictPrivateFile(certFile),
+		restrictPrivateFile(keyFile),
+		restrictPrivateFile(androidCertificate)
 	]);
 	if (options.configureFirewall) await configureWindowsFirewall(options.port);
 	const customCss = join(directory, "mobile.css");
@@ -442,6 +485,7 @@ async function setup(args) {
 		...managedSetup,
 		tls: Object.fromEntries(Object.entries(managedSetup.tls).map(([key, value]) => [key, typeof value === "string" ? value.replaceAll("\\", "/") : value]))
 	}, null, 2)}\n`, { mode: 384 }), writeFile(join(directory, "control.json"), "{\"version\":1,\"enabled\":true}\n", { mode: 384 })]);
+	await Promise.all([restrictPrivateFile(join(directory, "setup.json")), restrictPrivateFile(join(directory, "control.json"))]);
 	console.log(`DSH Mobile follows ${network.name} and is currently configured for ${origin}`);
 	console.log(`Install this CA certificate on Android once: ${androidCertificate}`);
 	console.log(`Ask DSH to customize the mobile Web UI and features in: ${customCss} and ${customScript}`);