dsh-mobile 0.3.16 → 0.4.0

package/CHANGELOG.md

@@ -2,6 +2,24 @@
 
 Notable changes to DSH Mobile are recorded here. GitHub Releases remain the source for downloadable packages and complete generated commit notes.
 
+## Unreleased
+
+Future changes will be recorded here.
+
+## 0.4.0 - 2026-09-14
+
+- Add multi-device management to the Android app: migrate existing LAN and remote credentials, show each paired computer with its Origin and HTTPS reachability state, connect the most recently used valid device on direct startup, and provide list, rename, re-pair, delete, and launch-behavior controls.
+- Complete plugin-side localization for Chinese, English, and Italian, including diagnostic report copy, browser pairing pages, and reauthentication guidance selected from `Accept-Language`; Android resources remain key-complete across all three supported locales.
+- Use a bounded session-free native probe for list reachability checks, with a renewal fallback for older plugins so status refreshes cannot evict an active DSH session.
+- Preserve a local row after computer-side revocation, stop automatic retries for revoked credentials, and expose a short-lived undo action for local deletion without restoring a computer-side authorization.
+- Follow the DSH conversation's actual nested scroll container when showing or hiding the Android toolbar, keeping task-notification settings reachable on current DSH Web layouts.
+- Let cpolar choose its default route instead of forcing `cn`; explicit region settings remain available for advanced deployments.
+- Add Android task-completion and pending-input reminders through authenticated Host events and the exact-origin native bridge; notification permission is enabled explicitly from the foreground app menu, lock-screen text stays generic, and each completed turn keeps a separate reminder (thanks @qzyqmzn for PR #75).
+- Show and re-copy remote pairing links without invalidating the QR code's active one-time pairing window (thanks @qzyqmzn for PR #75).
+- Detect plugin-market installations that have not completed LAN setup, prevent the loopback-only `127.0.0.1` fallback from being presented as phone access, and provide a localized in-panel network picker that creates private TLS material and LAN-only Windows firewall rules after explicit confirmation. The configured gateway starts after one DSH restart (thanks @cangming99 for #72).
+- Keep native DSH file selection in the composer Add group, add only camera capture there, and reuse the native menu-row styling for the mobile action.
+- Add a native-app-only Switch computer action to the WebView's DSH General settings page, keeping the Android device-list settings and DSH content toolbar focused on their own controls.
+- Hide the Android shell toolbar above the WebView so DSH occupies the full safe viewport; the system status-bar color continues to follow the page background.
 
 ## 0.3.16 - 2026-09-12
 

package/README.en.md

@@ -19,14 +19,14 @@
 
 > DSH Mobile is a DeepSeek Harness community plugin; the native app supports Android only.
 >
-> **0.3.16 update**: supports community task-board pane anchors, improves wide-screen rightbar docking and phone question cards, and fixes custom DSH Web ports still targeting the saved default upstream. [Details](CHANGELOG.md).
+> **0.4.0 update**: adds multi-device management, computer-side revocation status sync, and session-free reachability checks; improves plugin-market LAN onboarding, task-state notifications, the immersive WebView layout, and three-language pairing pages. [Details](CHANGELOG.md).
 >
-> **Upgrade reminder**: update the plugin to **0.3.16** and restart DSH. Existing pairings and app 0.3.15 remain compatible; the 0.3.16 APK changes only Android version metadata, so the app update is optional. [Compatibility notes](#compatibility).
+> **Upgrade reminder**: 0.4.0 requires the plugin and Android app to be updated together for the multi-device list. Older apps continue to use their existing single-device pairing. [Compatibility notes](#compatibility).
 
 <p align="center">
-  <a href="https://github.com/saya-ch/dsh-mobile/releases/download/v0.3.16/dsh-mobile-android-v0.3.16.apk"><img src="assets/brand/app-icon-rounded.svg" alt="DSH Mobile Android app icon" width="72" height="72"></a><br>
-  <a href="https://github.com/saya-ch/dsh-mobile/releases/download/v0.3.16/dsh-mobile-android-v0.3.16.apk"><strong>Download Android app 0.3.16</strong></a><br>
-  <sub><a href="https://github.com/saya-ch/dsh-mobile/releases/tag/v0.3.16">Release notes and checksums</a></sub>
+  <a href="https://github.com/saya-ch/dsh-mobile/releases/download/v0.4.0/dsh-mobile-android-v0.4.0.apk"><img src="assets/brand/app-icon-rounded.svg" alt="DSH Mobile Android app icon" width="72" height="72"></a><br>
+  <a href="https://github.com/saya-ch/dsh-mobile/releases/download/v0.4.0/dsh-mobile-android-v0.4.0.apk"><strong>Download Android app 0.4.0</strong></a><br>
+  <sub><a href="https://github.com/saya-ch/dsh-mobile/releases/tag/v0.4.0">Release notes and checksums</a></sub>
 </p>
 
 DSH Mobile is a DeepSeek Harness plugin that lets a mobile browser or the Android app connect over a protected LAN or an optional Tailscale Funnel, cpolar, or self-hosted FRP remote path. Local and remote access keep the same sessions, Workspaces, messages, and tools while using separate switches and paired-device stores without modifying DeepSeek Harness source.
@@ -40,7 +40,7 @@ It also lets you customize the phone from a DSH conversation: `/mobile <what you
 - **Continue DSH work from a phone**: the same sessions, Workspaces, messages, and tools, in real time.
 - **Customize the phone UI by talking to DSH**: change the mobile layout, interactions, and features from a conversation; open pages refresh within seconds.
 - **A dedicated touch layout**: session drawer, tool details, settings, question cards, and composer reorganized for phones. Native app screens follow the Android system locale in Simplified Chinese, English, or Italian. Plugin-owned Web UI follows DSH's selected locale; Italian resources are ready for a future DSH Italian locale.
-- **Image attachments**: use the top row of the composer plus menu to select an image or take a photo; PNG, JPEG, WebP, and GIF files up to 8 MiB are supported, plus full-resolution JPEG capture.
+- **Image attachments**: file selection uses DSH's native **Add** group; DSH Mobile only adds **Take photo** to that group, and captured images follow DSH's native attachment flow.
 - **Auto-discovery, no re-pairing**: Wi-Fi, hotspot, or IP changes normally recover automatically.
 - **One-click connection diagnostics**: check versions, gateway, network interface, firewall, and the remote path; stable reason codes are localized in the UI, and the copied report excludes credentials and complete addresses.
 - **One-click approval for third-party plugin WebSockets**: the diagnostics view groups blocked plugin connections by directory (with attempt counts); allowing a path unblocks that exact path while everything unapproved stays blocked, and a red badge marks the sidebar entry until reviewed (#47). If a plugin keeps failing to connect (for example a terminal reporting 1006), first look at the diagnostics view for blocked connections and approve them in one click — manual configuration is usually unnecessary.
@@ -74,7 +74,7 @@ Or via the plugin market (optional):
 dsh plugin --profile web add dshmarket
 ```
 
-Restart DSH, then search for **dsh-mobile** under **Settings → Plugin Market** and install it with one click.
+Restart DSH, then search for **dsh-mobile** under **Settings → Plugin Market** and install it. On first opening Mobile access, the Local network page lists this computer's current networks; confirm one to create private certificates and LAN configuration, then restart DSH once as prompted. No terminal `setup` command is required for this path.
 
 `setup` automatically selects and remembers the current LAN; Wi-Fi, hotspot, and IP changes normally recover without re-pairing. Use `--address 192.168.x.x` only when automatic selection fails. Settings, certificates, devices, and customization files live under `$DSH_HOME/mobile-access/`.
 
@@ -103,6 +103,8 @@ Port note: `dsh web --port` changes the DSH Web upstream port (3080 by default),
 
 The app is optional: select **Copy pairing link** and open it in a mobile browser. The browser must manually trust the plugin certificate on the first visit.
 
+Browser pairing and reauthentication pages use the browser's `Accept-Language` to show Simplified Chinese, English, or Italian. Android screens follow the system language, while the DSH plugin control panel follows the language selected by DSH.
+
 ### Remote access
 
 Use this after the phone leaves the computer's network. Remote access is disabled by default, and the phone needs no separate Tailscale, cpolar, or FRP app.
@@ -160,6 +162,54 @@ The examples above, applied:
   <img src="https://raw.githubusercontent.com/saya-ch/dsh-mobile/main/assets/screenshots/cyberpunk-monitor-1.png" width="22%" style="margin-left:8px" alt="Mobile UI customized into a cyberpunk computer monitor">
 </p>
 
+### Device management
+
+The Android app keeps LAN, cpolar, Tailscale Funnel, and self-hosted FRP pairings in one **Paired computers** list. The first upgrade migrates the legacy LAN and remote credentials without requiring another pairing; when an address changes, the app merges the row by the DSH installation's stable `instanceId` and keeps its custom name. Device tokens and LAN CAs remain encrypted by Android Keystore and never appear in the list or QR code.
+
+Each row shows its custom name, transport, Origin, live reachability, and last connection time. A green dot means **Reachable**; a gray dot means **Checking**, **Temporarily unreachable**, **Pairing expired**, or **Removed on computer**. The check validates the DSH Gateway over HTTPS instead of using ICMP, so a temporary network outage is not mistaken for computer-side revocation.
+
+- **Startup behavior → Open DSH directly** (default): one device connects directly; with multiple devices, the app tries the last-used device first, then the still-valid device with the most recent connection. A bounded connection budget returns to the list instead of spinning forever.
+- **Startup behavior → Show device list**: choose a computer on every launch, which is useful when switching between several machines. The option is in the list's top-right settings button and is saved immediately.
+- Tap a row to connect. The overflow button and long press open the same action sheet for rename, check now, pair again, or delete the local record. Deletion has a second confirmation and a short undo window; undo restores only the local row and never restores a computer-side revocation.
+- Open DSH **Settings → General** in the WebView and select **Switch computer** to return to the paired-device list; this action appears only in the Android app. If the computer revokes a device, the app keeps its row as **Removed on computer**, stops automatic reconnection, and offers **Pair again** or **Delete device**.
+
+<table>
+  <tr>
+    <td align="center" valign="top" width="50%">
+      <img src="https://raw.githubusercontent.com/saya-ch/dsh-mobile/main/assets/screenshots/device-management.jpg" width="44%" alt="Paired computer list in the Android app"><br>
+      <sub>Device management: paired computers, transport, and reachability</sub>
+    </td>
+    <td align="center" valign="top" width="50%">
+      <img src="https://raw.githubusercontent.com/saya-ch/dsh-mobile/main/assets/screenshots/startup-behavior.jpg" width="44%" alt="Startup behavior settings in the Android app"><br>
+      <sub>Startup behavior: open DSH directly or show the device list</sub>
+    </td>
+  </tr>
+</table>
+
+### Third-party plugin compatibility
+
+The mobile adaptation keeps DSH's existing Workspace, task-management, terminal, and file-panel entry points instead of isolating third-party plugin content in a separate page. The wide-layout screenshot below shows the Android app in a wide viewport. The app adapts to the available width: phones use drawers and overlays, while wide screens use side-by-side panels; both layouts expose the same features and connection methods. DSH still loads third-party plugins itself—the mobile layer only adapts layout and access, without modifying DeepSeek Harness source.
+
+Compatibility and WebSocket rules:
+
+- This release is contract-checked against DSH `0.1.5-rc.2` (renderer-v2) and retains the `0.1.5-rc.1` LAN verification. The DSH page must expose the standard session, `main`/`panelInfo`, and `rightbar` slots; the community plugin must register its panel or sidebar content through DSH's standard entry points.
+- The gateway allows first-party DSH WebSocket paths by default, including `/sidebar/ws/terminal`. Other paths used by community sidebar plugins are blocked by default and appear in Diagnostics; the `/sidebar/ws/agent-opens` and `/sidebar/ws/agent-terminals` paths in the image are examples that must be reviewed for the actual plugin.
+- In **Connection diagnostics → Third-party WebSocket paths**, select **Allow** only for an exact path you have verified. Query strings and fuzzy prefixes are rejected; **Allow all** is not recommended. Approved paths can be removed at any time, and the same policy applies to LAN and remote connections.
+- Approval only lets that path pass through the authenticated, same-origin DSH Mobile gateway. It does not open arbitrary TCP/UDP ports or bypass device pairing. If a community plugin still fails, check the path recorded by Diagnostics and approve one path at a time.
+
+<table>
+  <tr>
+    <td align="center" valign="top" width="50%">
+      <img src="https://raw.githubusercontent.com/saya-ch/dsh-mobile/main/assets/screenshots/third-party-plugin-adaptation.png" width="96%" alt="Android app wide layout with a community sidebar plugin adapted"><br>
+      <sub>Community sidebar plugin compatibility in the Android app</sub>
+    </td>
+    <td align="center" valign="top" width="50%">
+      <img src="https://raw.githubusercontent.com/saya-ch/dsh-mobile/main/assets/screenshots/websocket-diagnostics.png" width="96%" alt="Third-party WebSocket path diagnostics in the Android app"><br>
+      <sub>Connection diagnostics: review and allow third-party WebSocket paths</sub>
+    </td>
+  </tr>
+</table>
+
 ## App or mobile browser
 
 | Client | Best for | Notes |
@@ -203,7 +253,7 @@ The table below lists, for each plugin version, the DeepSeek Harness version it
 
 | DSH Mobile plugin | Verified DeepSeek Harness version |
 | --- | --- |
-| `0.3.15`, `0.3.16` | `0.1.5-rc.2` (contract check); `0.1.5-rc.1` (@idoall LAN verification) |
+| `0.3.15`, `0.3.16`, `0.4.0` | `0.1.5-rc.2` (contract check); `0.1.5-rc.1` (@idoall LAN verification) |
 | `0.3.14` | `0.1.3-alpha.2` |
 | `0.3.9`-`0.3.12` | `0.1.3-alpha.1` |
 | `0.3.6`-`0.3.8` | `0.1.2-rc.1` |
@@ -211,7 +261,7 @@ The table below lists, for each plugin version, the DeepSeek Harness version it
 | `0.3.0`-`0.3.3` | `0.1.2-alpha.1` |
 | `0.1.4`, `0.2.x` | `0.1.1-rc.2` |
 
-Existing 0.3.3–0.3.16 apps do not need re-pairing. cpolar users should use app 0.3.15 or later because earlier apps may time out before a slow first load over the free route finishes; earlier apps also use a different status-bar strategy. App 0.1.3 or earlier requires reinstalling and pairing again.
+Existing 0.3.3–0.4.0 apps do not need re-pairing. cpolar users should use app 0.3.15 or later because earlier apps may time out before a slow first load over the free route finishes; earlier apps also use a different status-bar strategy. The 0.4.0 app adds the multi-device list, startup behavior, and computer-side revocation status; older apps continue to connect to their saved single device. App 0.1.3 or earlier requires reinstalling and pairing again.
 
 ## Uninstall
 

package/README.md

@@ -26,14 +26,14 @@
 
 > DSH Mobile 是 DeepSeek Harness 社区插件，原生 App 仅支持 Android。
 >
-> **0.3.16 更新**：兼容社区任务看板的移动布局锚点，优化宽屏右栏与手机提问卡片，并修复自定义 DSH Web 端口仍连接旧默认端口的问题。[详细记录](CHANGELOG.md)。
+> **0.4.0 更新**：加入多设备管理、电脑端撤销状态同步、无 Session 可达性检查；完善插件市场局域网引导、任务状态通知、原生 WebView 沉浸布局和三语配对页。[详细记录](CHANGELOG.md)。
 >
-> **升级提醒**：建议将插件升级至 **0.3.16** 并重启 DSH；现有配对与 0.3.15 App 保持兼容，本次 Android App 仅同步版本号，可按需更新。[兼容说明](#兼容性)。
+> **升级提醒**：0.4.0 需要同步更新插件与 Android App 才能使用多设备列表；旧 App 仍可使用原有单设备配对。[兼容说明](#兼容性)。
 
 <p align="center">
-  <a href="https://github.com/saya-ch/dsh-mobile/releases/download/v0.3.16/dsh-mobile-android-v0.3.16.apk"><img src="assets/brand/app-icon-rounded.svg" alt="DSH Mobile 安卓应用图标" width="72" height="72"></a><br>
-  <a href="https://github.com/saya-ch/dsh-mobile/releases/download/v0.3.16/dsh-mobile-android-v0.3.16.apk"><strong>下载 Android App 0.3.16</strong></a><br>
-  <sub><a href="https://github.com/saya-ch/dsh-mobile/releases/tag/v0.3.16">版本说明与校验文件</a></sub>
+  <a href="https://github.com/saya-ch/dsh-mobile/releases/download/v0.4.0/dsh-mobile-android-v0.4.0.apk"><img src="assets/brand/app-icon-rounded.svg" alt="DSH Mobile 安卓应用图标" width="72" height="72"></a><br>
+  <a href="https://github.com/saya-ch/dsh-mobile/releases/download/v0.4.0/dsh-mobile-android-v0.4.0.apk"><strong>下载 Android App 0.4.0</strong></a><br>
+  <sub><a href="https://github.com/saya-ch/dsh-mobile/releases/tag/v0.4.0">版本说明与校验文件</a></sub>
 </p>
 
 DSH Mobile 是一个 DeepSeek Harness 插件，让手机浏览器或 Android App 通过局域网，或可选的 Tailscale Funnel、cpolar、自建 FRP 远程通道连接电脑，继续使用同一份会话、工作区、消息和工具。局域网与远程访问分别启停、分别管理设备，且都不修改 DeepSeek Harness 源码。
@@ -47,7 +47,7 @@ DSH Mobile 是一个 DeepSeek Harness 插件，让手机浏览器或 Android App
 - **在手机上继续电脑端的工作**：同一份会话、工作区、消息和工具，实时同步。
 - **用对话定制手机端**：直接在 DSH 对话里改手机页面的布局、交互和功能，几秒内刷新。
 - **专属触屏布局**：会话抽屉、工具详情、设置、提问卡片和输入栏都按手机重新组织。App 原生页面跟随系统显示简体中文、英文或意大利文；插件界面跟随 DSH 的语言设置，意大利语资源已为 DSH 后续支持预留。
-- **图片附件**：在已打开会话的输入栏加号菜单顶部选择图片或拍照；支持 PNG、JPEG、WebP、GIF（不超过 8 MiB）和完整分辨率 JPEG。
+- **图片附件**：文件选择使用 DSH 原生“添加”组；DSH Mobile 只在该组补充“拍照”，拍摄结果按 DSH 原生附件流程发送。
 - **自动发现、无需重新配对**：切换 Wi-Fi、热点或 IP 后通常自动恢复。
 - **一键连接诊断**：检查版本、网关、网卡、防火墙和远程通道；稳定的原因码在界面中本地化，并生成不含凭据与完整地址的脱敏报告。
 - **第三方插件 WebSocket 一键放行**：诊断页按目录分组记录被拦截的插件连接（含次数），点允许即放行确切路径，未批准的一律拦截；有新拦截时侧栏红点提醒（#47）。若某插件的连接一直失败（如终端报 1006），先到诊断页看看有没有被拦的连接，一键放行即可，通常无需手动配置。
@@ -81,7 +81,7 @@ pnpm dsh --profile web
 dsh plugin --profile web add dshmarket
 ```
 
-重启 DSH 后，在 **设置 → 插件市场** 里搜索 dsh-mobile，一键安装即可。
+重启 DSH 后，在 **设置 → 插件市场** 里搜索 dsh-mobile 并安装。首次打开“移动访问”时，局域网页会列出电脑当前网络；确认网卡后由插件生成私有证书并配置局域网，按提示重启一次 DSH 即可使用，无需再打开终端运行 `setup`。
 
 `setup` 会自动选择并记住当前局域网，切换 Wi-Fi、热点或 IP 后通常自动恢复；仅在自动选择失败时使用 `--address 192.168.x.x`。设置、证书、设备和自定义文件保存在 `$DSH_HOME/mobile-access/`。
 
@@ -110,6 +110,8 @@ dsh plugin --profile web add dshmarket
 
 不安装 App 也可以访问：点击 **复制配对链接**，在手机浏览器中打开；首次访问需要按浏览器提示手动信任插件证书。
 
+手机浏览器中的配对和重新连接页面会按浏览器的 `Accept-Language` 显示简体中文、英文或意大利文；Android App 则跟随系统语言。DSH 内的插件控制面板继续跟随 DSH 当前语言。
+
 ### 远程访问
 
 适合手机离开电脑所在网络后使用。远程访问默认关闭，手机不需要另外安装 Tailscale、cpolar 或 FRP。
@@ -167,6 +169,54 @@ Tailscale Funnel 覆盖范围广，但在中国大陆网络下可能不稳定。
   <img src="https://raw.githubusercontent.com/saya-ch/dsh-mobile/main/assets/screenshots/cyberpunk-monitor-1.png" width="22%" style="margin-left:8px" alt="/mobile 定制为赛博朋克监控面板">
 </p>
 
+### 设备管理
+
+Android App 将局域网、cpolar、Tailscale Funnel 和自建 FRP 统一整理到“已配对设备”列表。首次升级会自动迁移旧版局域网与远程凭据，不要求重新配对；地址变化时按 DSH 安装的稳定 `instanceId` 合并原记录，保留自定义名称。设备 Token 和局域网 CA 继续由 Android Keystore 加密保存，不会显示在列表或二维码中。
+
+每条记录显示自定义名称、连接方式、Origin、实时可达状态和最近连接时间。绿色状态点表示“可达”，灰色状态点表示“检测中”“暂不可达”“配对已过期”或“电脑端已移除”；可达性检查直接验证 DSH Gateway，不依赖 ICMP，也不会把暂时断网误判成电脑端撤销。
+
+- **启动时打开 → 直接进入 DSH**（默认）：单设备直接连接；多设备优先连接上次使用的设备，其次按最近连接时间选择仍有效的设备。连接超过有限重试预算后自动回到列表，不会无限转圈。
+- **启动时打开 → 显示设备列表**：每次启动先选择电脑，适合经常在多台设备之间切换。该选项位于列表右上角的设置按钮中，修改后立即保存。
+- 点按设备行可连接；右侧“…”和长按提供相同的操作面板，可编辑名称、立即检测、重新配对或删除本地记录。删除前会二次确认，并提供短暂撤销；撤销只恢复本机记录，不恢复电脑端已经撤销的授权。
+- 在 WebView 页面打开 DSH **设置 → 通用**，选择 **切换电脑** 可回到已配对设备列表；该动作仅在 Android App 中显示。电脑端撤销设备后，App 保留该条目并显示“电脑端已移除”，停止自动重连，同时提供 **重新配对** 和 **删除本地记录**。
+
+<table>
+  <tr>
+    <td align="center" valign="top" width="50%">
+      <img src="https://raw.githubusercontent.com/saya-ch/dsh-mobile/main/assets/screenshots/device-management.jpg" width="44%" alt="Android App 已配对设备列表"><br>
+      <sub>设备管理列表：查看已配对电脑、连接方式和可达状态</sub>
+    </td>
+    <td align="center" valign="top" width="50%">
+      <img src="https://raw.githubusercontent.com/saya-ch/dsh-mobile/main/assets/screenshots/startup-behavior.jpg" width="44%" alt="Android App 启动行为设置"><br>
+      <sub>启动行为设置：选择直接进入 DSH 或显示设备列表</sub>
+    </td>
+  </tr>
+</table>
+
+### 第三方插件适配
+
+移动适配保持 DSH 原有的工作区、任务管理、终端和文件面板入口，不会把第三方插件内容隔离成另一套页面。下面的宽屏截图展示 Android App 在宽屏下的布局。App 会根据屏幕宽度自适应：手机使用抽屉和浮层，宽屏使用并排面板；两种布局共享相同的功能和连接方式。第三方插件仍由 DSH 自己加载，移动层负责适配布局与连接，不修改 DeepSeek Harness 源码。
+
+兼容条件与 WebSocket 放行规则：
+
+- 本版本已按 DSH `0.1.5-rc.2` 的 renderer-v2 合同检查，并保留对 `0.1.5-rc.1` 局域网路径的验证。DSH 页面需要提供标准的会话、`main`/`panelInfo` 和 `rightbar` 插槽；插件自身需要通过 DSH 的标准面板或侧边栏入口注册内容。
+- 网关默认只允许 DSH 内置的第一方 WebSocket 路径。社区侧边栏插件使用的其他路径默认拦截，通常会在诊断页显示为待处理项目；截图中的`/sidebar/ws/agent-terminals` 就属于这类需要按实际插件确认的路径。
+- 在 **连接诊断 → 第三方 WebSocket 路径** 中，只对确认过的精确路径点击 **允许**。系统不接受带查询字符串或模糊前缀的路径；不建议使用“全部允许”。已允许的路径可以随时移除，局域网和远程连接使用同一套规则。
+- 放行只代表该路径可以通过已认证、同源的 DSH Mobile 网关，不会开放任意 TCP/UDP 端口，也不会绕过设备配对。若社区插件仍然连接失败，先看诊断页的实际拦截路径，再按一条路径放行。
+
+<table>
+  <tr>
+    <td align="center" valign="top" width="50%">
+      <img src="https://raw.githubusercontent.com/saya-ch/dsh-mobile/main/assets/screenshots/third-party-plugin-adaptation.png" width="96%" alt="Android App 宽屏布局与社区侧边栏插件适配"><br>
+      <sub>Android App 下社区侧边栏插件的兼容</sub>
+    </td>
+    <td align="center" valign="top" width="50%">
+      <img src="https://raw.githubusercontent.com/saya-ch/dsh-mobile/main/assets/screenshots/websocket-diagnostics.png" width="96%" alt="Android App 第三方 WebSocket 路径诊断"><br>
+      <sub>连接诊断：检查第三方 WebSocket 路径并按需放行</sub>
+    </td>
+  </tr>
+</table>
+
 ## App 与手机浏览器
 
 
@@ -210,17 +260,18 @@ flowchart LR
 
 下表列出各插件版本验证支持到的 DeepSeek Harness 版本（早于该版本的 0.1.x 均兼容）。0.3.6 起插件不再按版本号拒绝启动，未列出的更新版本由 CI 契约检查兜底。历史记录见 [CHANGELOG.md](CHANGELOG.md)。
 
-| DSH Mobile 插件 | 验证支持的 DeepSeek Harness 版本 |
-| --- | --- |
-| `0.3.15`、`0.3.16` | `0.1.5-rc.2`（契约检查）；`0.1.5-rc.1`（@idoall 局域网实测） |
-| `0.3.14` | `0.1.3-alpha.2` |
-| `0.3.9`-`0.3.12` | `0.1.3-alpha.1` |
-| `0.3.6`-`0.3.8` | `0.1.2-rc.1` |
-| `0.3.4`、`0.3.5` | `0.1.2-alpha.2` |
-| `0.3.0`-`0.3.3` | `0.1.2-alpha.1` |
-| `0.1.4`、`0.2.x` | `0.1.1-rc.2` |
-
-现有 0.3.3–0.3.16 App 无需重新配对；cpolar 用户应使用 0.3.15 或更新 App，较早版本可能在免费线路的慢速首次加载完成前超时；更早的 App 还使用不同的状态栏策略。App 0.1.3 及更早版本需卸载重装并重新配对。
+
+| DSH Mobile 插件                         | 验证支持的 DeepSeek Harness 版本                             |
+| ----------------------------------------- | -------------------------------------------------------------- |
+| `0.3.15`、`0.3.16`、`0.4.0` | `0.1.5-rc.2`（契约检查）；`0.1.5-rc.1`（@idoall 局域网实测） |
+| `0.3.14`                                | `0.1.3-alpha.2`                                              |
+| `0.3.9`-`0.3.12`                        | `0.1.3-alpha.1`                                              |
+| `0.3.6`-`0.3.8`                         | `0.1.2-rc.1`                                                 |
+| `0.3.4`、`0.3.5`                        | `0.1.2-alpha.2`                                              |
+| `0.3.0`-`0.3.3`                         | `0.1.2-alpha.1`                                              |
+| `0.1.4`、`0.2.x`                        | `0.1.1-rc.2`                                                 |
+
+现有 0.3.3–0.4.0 App 无需重新配对；cpolar 用户应使用 0.3.15 或更新 App，较早版本可能在免费线路的慢速首次加载完成前超时；更早的 App 还使用不同的状态栏策略。App 0.4.0 才支持多设备列表、启动行为设置和电脑端撤销状态同步；旧版 App 仍可连接已保存的单台设备。App 0.1.3 及更早版本需卸载重装并重新配对。
 
 ## 卸载
 

package/lib/cli.js

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
-import { execFile } from "node:child_process";
 import { chmod, mkdir, readFile, rename, rm, writeFile } from "node:fs/promises";
 import { homedir, networkInterfaces } from "node:os";
-import { basename, dirname, join, resolve } from "node:path";
+import { basename, dirname, isAbsolute, join, resolve } from "node:path";
 import { X509Certificate, createPrivateKey, createPublicKey } from "node:crypto";
+import { execFile } from "node:child_process";
 import { generate } from "selfsigned";
 import "@deepseek-ai/cordis";
 import "@deepseek-ai/schemastery";
@@ -324,6 +324,88 @@ async function refreshManagedServerCertificate(setup, address) {
 	});
 	await Promise.all([atomicWrite(setup.tls.certFile, server.cert), atomicWrite(setup.tls.keyFile, server.private)]);
 }
+//#endregion
+//#region src/lan-setup.ts
+const FIREWALL_TCP_RULE = "DSH Mobile HTTPS";
+const FIREWALL_UDP_RULE = "DSH Mobile Discovery";
+async function runElevatedPowerShell(script) {
+	await execFileText("powershell.exe", [
+		"-NoProfile",
+		"-NonInteractive",
+		"-Command",
+		[
+			"$ErrorActionPreference = 'Stop'; $process = Start-Process -FilePath 'powershell.exe' -Verb RunAs -WindowStyle Hidden -Wait -PassThru",
+			`  -ArgumentList @('-NoProfile','-NonInteractive','-EncodedCommand','${Buffer.from(script, "utf16le").toString("base64")}')`,
+			"; exit $process.ExitCode"
+		].join(" ")
+	], { windowsHide: true });
+}
+/** Install the two Windows inbound rules used by the managed LAN listener. */
+async function configureWindowsFirewall(port) {
+	if (process.platform !== "win32") return;
+	await runElevatedPowerShell([
+		"$ErrorActionPreference = 'Stop'",
+		`Get-NetFirewallRule -DisplayName '${FIREWALL_TCP_RULE}' -ErrorAction SilentlyContinue | Remove-NetFirewallRule`,
+		`Get-NetFirewallRule -DisplayName '${FIREWALL_UDP_RULE}' -ErrorAction SilentlyContinue | Remove-NetFirewallRule`,
+		`New-NetFirewallRule -DisplayName '${FIREWALL_TCP_RULE}' -Direction Inbound -Action Allow -Protocol TCP -LocalPort ${String(port)} -RemoteAddress LocalSubnet -Profile Any | Out-Null`,
+		`New-NetFirewallRule -DisplayName '${FIREWALL_UDP_RULE}' -Direction Inbound -Action Allow -Protocol UDP -LocalPort ${String(port)} -RemoteAddress LocalSubnet -Profile Any | Out-Null`
+	].join("; "));
+}
+/** Remove only the two Windows firewall rules owned by DSH Mobile. */
+async function removeWindowsFirewall() {
+	if (process.platform !== "win32") return;
+	await runElevatedPowerShell([
+		"$ErrorActionPreference = 'Stop'",
+		`Get-NetFirewallRule -DisplayName '${FIREWALL_TCP_RULE}' -ErrorAction SilentlyContinue | Remove-NetFirewallRule`,
+		`Get-NetFirewallRule -DisplayName '${FIREWALL_UDP_RULE}' -ErrorAction SilentlyContinue | Remove-NetFirewallRule`
+	].join("; "));
+}
+/** Generate private TLS material and persist a managed setup selected by the user. */
+async function prepareManagedLanSetup(options) {
+	if (!isAbsolute(options.setupFile) || !isAbsolute(options.controlFile)) throw new Error("managed LAN setup paths must be absolute");
+	if (!Number.isSafeInteger(options.listenPort) || options.listenPort < 1024 || options.listenPort > 65535) throw new Error("managed LAN listenPort must be from 1024 through 65535");
+	if (!Number.isSafeInteger(options.dshPort) || options.dshPort < 1024 || options.dshPort > 65535) throw new Error("managed LAN dshPort must be from 1024 through 65535");
+	const directory = dirname(options.setupFile);
+	const tlsDirectory = join(directory, "tls");
+	await mkdir(tlsDirectory, {
+		recursive: true,
+		mode: 448
+	});
+	const managedTls = {
+		mode: "managed",
+		caCertFile: join(tlsDirectory, "ca.pem"),
+		caKeyFile: join(tlsDirectory, "ca-key.pem"),
+		certFile: join(tlsDirectory, "server-cert.pem"),
+		keyFile: join(tlsDirectory, "server-key.pem")
+	};
+	const ca = await ensureManagedCa(managedTls, {
+		certFile: join(tlsDirectory, "cert.pem"),
+		keyFile: join(tlsDirectory, "key.pem")
+	});
+	const setup = {
+		version: 2,
+		networkInterface: options.network.name,
+		listenPort: options.listenPort,
+		upstreamOrigin: `http://127.0.0.1:${String(options.dshPort)}`,
+		tls: managedTls
+	};
+	await refreshManagedServerCertificate(setup, options.network.address);
+	const androidCertificate = join(tlsDirectory, "dsh-mobile-ca.cer");
+	await writeFile(androidCertificate, ca.raw, { mode: 384 });
+	await Promise.all([...Object.values(managedTls).filter((value) => value !== "managed").map((file) => restrictPrivateFile(file)), restrictPrivateFile(androidCertificate)]);
+	if (options.configureFirewall) await configureWindowsFirewall(options.listenPort);
+	await Promise.all([writeFile(options.setupFile, `${JSON.stringify({
+		...setup,
+		tls: Object.fromEntries(Object.entries(setup.tls).map(([key, value]) => [key, typeof value === "string" ? value.replaceAll("\\", "/") : value]))
+	}, null, 2)}\n`, { mode: 384 }), writeFile(options.controlFile, "{\"version\":1,\"enabled\":true}\n", { mode: 384 })]);
+	await Promise.all([restrictPrivateFile(options.setupFile), restrictPrivateFile(options.controlFile)]);
+	return Object.freeze({
+		setup: Object.freeze(setup),
+		network: Object.freeze({ ...options.network }),
+		origin: `https://${options.network.address}:${String(options.listenPort)}`,
+		androidCertificate
+	});
+}
 Object.freeze({
 	manifest: 65536,
 	script: 1048576,
@@ -351,8 +433,6 @@ function assertExtensionId(value) {
 }
 //#endregion
 //#region src/cli.ts
-const FIREWALL_TCP_RULE = "DSH Mobile HTTPS";
-const FIREWALL_UDP_RULE = "DSH Mobile Discovery";
 function parseOptions(args) {
 	let address;
 	let port = 3443;
@@ -394,84 +474,16 @@ function parseOptions(args) {
 function dshHome() {
 	return resolve(process.env.DSH_HOME ?? join(homedir(), ".dsh"));
 }
-async function runElevatedPowerShell(script) {
-	await execFileText("powershell.exe", [
-		"-NoProfile",
-		"-NonInteractive",
-		"-Command",
-		[
-			"$ErrorActionPreference = 'Stop'; $process = Start-Process -FilePath 'powershell.exe' -Verb RunAs -WindowStyle Hidden -Wait -PassThru",
-			`  -ArgumentList @('-NoProfile','-NonInteractive','-EncodedCommand','${Buffer.from(script, "utf16le").toString("base64")}')`,
-			"; exit $process.ExitCode"
-		].join(" ")
-	], { windowsHide: true });
-}
-async function configureWindowsFirewall(port) {
-	if (process.platform !== "win32") return;
-	const script = [
-		"$ErrorActionPreference = 'Stop'",
-		`Get-NetFirewallRule -DisplayName '${FIREWALL_TCP_RULE}' -ErrorAction SilentlyContinue | Remove-NetFirewallRule`,
-		`Get-NetFirewallRule -DisplayName '${FIREWALL_UDP_RULE}' -ErrorAction SilentlyContinue | Remove-NetFirewallRule`,
-		`New-NetFirewallRule -DisplayName '${FIREWALL_TCP_RULE}' -Direction Inbound -Action Allow -Protocol TCP -LocalPort ${String(port)} -RemoteAddress LocalSubnet -Profile Any | Out-Null`,
-		`New-NetFirewallRule -DisplayName '${FIREWALL_UDP_RULE}' -Direction Inbound -Action Allow -Protocol UDP -LocalPort ${String(port)} -RemoteAddress LocalSubnet -Profile Any | Out-Null`
-	].join("; ");
-	console.log("Windows will request administrator approval for two LAN-only firewall rules.");
-	await runElevatedPowerShell(script);
-}
-async function removeWindowsFirewall() {
-	if (process.platform !== "win32") return;
-	await runElevatedPowerShell([
-		"$ErrorActionPreference = 'Stop'",
-		`Get-NetFirewallRule -DisplayName '${FIREWALL_TCP_RULE}' -ErrorAction SilentlyContinue | Remove-NetFirewallRule`,
-		`Get-NetFirewallRule -DisplayName '${FIREWALL_UDP_RULE}' -ErrorAction SilentlyContinue | Remove-NetFirewallRule`
-	].join("; "));
-}
 async function setup(args) {
 	const options = parseOptions(args);
 	const preferredInterfaces = options.address === void 0 ? await preferredLanInterfaceNames() : [];
 	const network = selectLanNetwork(options.address, void 0, void 0, preferredInterfaces);
 	const home = dshHome();
 	const directory = join(home, "mobile-access");
-	const tls = join(directory, "tls");
-	await mkdir(tls, {
+	await mkdir(directory, {
 		recursive: true,
 		mode: 448
 	});
-	const legacyCertFile = join(tls, "cert.pem");
-	const legacyKeyFile = join(tls, "key.pem");
-	const certFile = join(tls, "server-cert.pem");
-	const keyFile = join(tls, "server-key.pem");
-	const caCertFile = join(tls, "ca.pem");
-	const caKeyFile = join(tls, "ca-key.pem");
-	const androidCertificate = join(tls, "dsh-mobile-ca.cer");
-	const managedTls = {
-		mode: "managed",
-		caCertFile,
-		caKeyFile,
-		certFile,
-		keyFile
-	};
-	const ca = await ensureManagedCa(managedTls, {
-		certFile: legacyCertFile,
-		keyFile: legacyKeyFile
-	});
-	const managedSetup = {
-		version: 2,
-		networkInterface: network.name,
-		listenPort: options.port,
-		upstreamOrigin: `http://127.0.0.1:${String(options.dshPort)}`,
-		tls: managedTls
-	};
-	await refreshManagedServerCertificate(managedSetup, network.address);
-	await writeFile(androidCertificate, ca.raw, { mode: 384 });
-	await Promise.all([
-		restrictPrivateFile(caCertFile),
-		restrictPrivateFile(caKeyFile),
-		restrictPrivateFile(certFile),
-		restrictPrivateFile(keyFile),
-		restrictPrivateFile(androidCertificate)
-	]);
-	if (options.configureFirewall) await configureWindowsFirewall(options.port);
 	const customCss = join(directory, "mobile.css");
 	try {
 		await readFile(customCss);
@@ -507,14 +519,17 @@ async function setup(args) {
 		mode: 448
 	});
 	await createExtensionScaffold(extensions, "custom", "自定义移动扩展", false);
-	const origin = `https://${network.address}:${String(options.port)}`;
-	await Promise.all([writeFile(join(directory, "setup.json"), `${JSON.stringify({
-		...managedSetup,
-		tls: Object.fromEntries(Object.entries(managedSetup.tls).map(([key, value]) => [key, typeof value === "string" ? value.replaceAll("\\", "/") : value]))
-	}, null, 2)}\n`, { mode: 384 }), writeFile(join(directory, "control.json"), "{\"version\":1,\"enabled\":true}\n", { mode: 384 })]);
-	await Promise.all([restrictPrivateFile(join(directory, "setup.json")), restrictPrivateFile(join(directory, "control.json"))]);
-	console.log(`DSH Mobile follows ${network.name} and is currently configured for ${origin}`);
-	console.log(`Install this CA certificate on Android once: ${androidCertificate}`);
+	if (options.configureFirewall && process.platform === "win32") console.log("Windows will request administrator approval for two LAN-only firewall rules.");
+	const result = await prepareManagedLanSetup({
+		setupFile: join(directory, "setup.json"),
+		controlFile: join(directory, "control.json"),
+		network,
+		listenPort: options.port,
+		dshPort: options.dshPort,
+		configureFirewall: options.configureFirewall
+	});
+	console.log(`DSH Mobile follows ${network.name} and is currently configured for ${result.origin}`);
+	console.log(`Install this CA certificate on Android once: ${result.androidCertificate}`);
 	console.log(`Ask DSH to customize the mobile Web UI and features in: ${customCss} and ${customScript}`);
 	console.log(`Additional extensions live in: ${extensions}`);
 	console.log("Start DSH with: dsh --profile web");