dsh-mobile 0.6.10 → 0.6.12

package/apps/mobile/README.md

@@ -2,149 +2,130 @@
 
 [简体中文](README.zh-CN.md) · [Back to the project](../../README.en.md)
 
-DeepSeek Harness is the display name of this lightweight, community-maintained Android WebView shell. It does not bundle a second DSH frontend. The app and mobile browsers load the same authenticated HTTPS origin, so both receive the same DSH features plus live-editable `mobile.css` presentation and `mobile.js` functionality.
+DeepSeek Harness is the display name of this community-maintained Android WebView app. It opens the plugin's authenticated HTTPS page rather than bundling another DSH frontend. The app and mobile browsers receive the same DSH features and computer-side mobile customizations.
 
-Android is the only supported native target. The iOS client remains an unpublished local experiment and is outside the build, release, and support scope.
+The current stable app is **0.6.5** (build 81). The npm plugin and Android App have independent versions: a plugin update does not automatically require another APK. See the [0.6.5 changes](#065-update).
 
-The current stable app is **0.6.4** (build 80). The app and npm plugin update independently; plugin web UI or connection fixes do not require reinstalling the APK. Install a new signed release APK for native updates or when the app reports that its version is too old. Older official APKs with the same signer retain pairing during in-place upgrades; a differently signed Debug build cannot overwrite the official app.
+Android 10 or later is supported. The local iOS experiment is not a published or supported client.
 
-## 0.6.4 update
+## Install and pair
 
-Build 80 uses the system Photo Picker on Android 13+ when the webpage requests a single supported image MIME filter. Multiple selection follows the system limit; unavailable pickers, older systems, capture requests and filters that cannot be represented exactly use the document picker instead. Document requests start directly and retain MIME and multiple settings. The App does not promise a particular manufacturer's gallery. Standard callbacks are bound to the current WebView, exact Origin and document; obsolete Activity results cannot complete a newer request. These native changes require App 0.6.4 or later and are released independently from the npm plugin.
+1. Install and enable the plugin using the [project quick start](../../README.en.md#quick-start). Complete LAN setup from the command line or the computer's **Mobile Access** panel.
+2. Install the signed Android APK from [GitHub Releases](https://github.com/saya-ch/dsh-mobile/releases/tag/android-v0.6.5). Upgrade an official installation in place using the same release signer to retain its pairings. A differently signed Debug APK cannot replace it; do not uninstall or clear data just to bypass that mismatch.
+3. On the computer, generate a pairing key/link under **Mobile Access → Local network**, or configure a remote provider and generate its remote pairing QR code. In the app, choose the matching connection mode and scan or paste the link.
+4. Name the computer. The app stores each LAN or remote pairing as its own record. The phone does not need a cpolar, Cloudflare or Tailscale app.
 
-WebViews with navigation-listener support cancel a pending standard file request before replacing the document and do not open another selector while a document navigation is in progress. Older providers use the available navigation callbacks; if file selection stops opening after changing pages, update WebView or return to the paired-computer list and reopen the page. Clearing App data is unnecessary.
+For LAN, the app also offers a scan and manual `https://IP:port` entry. Discovery cannot bypass firewall rules, campus-network isolation or missing routes; use a reachable address or a remote channel when necessary. Browser pairing has its own [connection instructions](../../README.en.md).
 
-## 0.6.3 update
+## Devices and settings
 
-Build 79 adds per-computer recovery guidance, readable expired-CA records, duplicate-pairing protection and deduplicated status checks that leave capacity for an explicit connection. TLS still refuses expired certificates. It also improves dark-mode primary buttons and explicitly excludes encrypted pairings and WebView sessions from cloud backup and device transfer. The earlier automatic-recovery ownership corrections are included. This signed App is published independently from plugin 0.6.4.
+The **Paired computers** list shows names, connection types, addresses, reachability and recent connections. Tap a row to connect; long-press or use **More** to rename, check, reorder or delete its local record. New records append to the list; **Move up / Move to top** changes presentation, not the startup choice. **Add computer** accepts a fresh pairing link; pairing the same installation in the same mode retains its custom name.
 
-## 0.6.2 update
-
-Build 78 keeps web content clear of system navigation, display cutouts and the keyboard, and adds **Settings → General → Page zoom** (80–125%, reset to 100%). Zoom is saved in this App, independently from the per-address mobile font settings, and does not reload the current conversation. Its settings entry requires plugin 0.6.3 or later; older Apps and browsers do not show an inactive control.
-
-WebViews reporting Chromium below 100 receive a nonblocking update reminder once per detected build. You may continue, but an obsolete WebView can still lack APIs required by DSH. Use the official WebView/Chrome update route available on your device; an unknown engine version is not treated as obsolete.
-
-This release also protects paired records and legacy migration when encrypted data is temporarily unreadable: it does not treat failed reads as an empty list or replace existing credentials. Storage errors are reported without automatically clearing pairings.
-
-## 0.6.1 update
-
-The app is rebuilt with matching release metadata. Native functionality, package identity and pairing/renewal protocol are unchanged from 0.6.0, using the established release signer. This release improves the computer-side remote settings and Caddy build/test tooling; it does not enable official managed Caddy installation. See the [release notes](../../CHANGELOG.md#061---2026-10-08).
-
-## 0.6.0 updates
-
-- Fixed list order with new pairings appended. Move up / Move to top affect presentation only; startup still prefers the last-used computer.
-- The list's **Settings → App icon** offers the mascot and six whale-mark colors without changing package identity or paired data.
-- Proportionally cropped scanner preview, camera-supported continuous focus, pinch/double-tap zoom and 48dp zoom controls.
-- Hold the top-left drawer toggle inside the app to return to the list. **Settings → General → Switch computer** remains available.
-
-These native features require app 0.6.0 or later. See the [release notes](../../CHANGELOG.md#060---2026-10-07) for plugin module management, mobile font size and compatibility improvements.
-
-## Use the app
-
-1. Install and enable the plugin using the [project quick start](../../README.en.md#quick-start). For a command-line LAN installation, run the setup command shown there; plugin-market users can complete LAN setup in **Mobile Access** instead.
-2. Install the signed Android APK from [GitHub Releases](https://github.com/saya-ch/dsh-mobile/releases).
-3. With no paired computers, choose **Local network** or **Remote access**. For LAN, create a pairing key or link under **Mobile Access → Local network**. For remote access, configure a provider and generate its pairing QR code. Scan the corresponding QR code or paste its link in the app.
-4. Name the computer after pairing. The app stores each LAN or remote pairing as a device record: LAN pins its private CA; ordinary remote paths use platform-trusted public HTTPS certificates; the self-signed FRP entry pins a remote CA. No provider app is needed on the phone.
-
-The **Paired computers** list shows each computer's name, connection type, address, reachability and last connection. Tap a row to connect; long-press or use its **More** button to connect, rename, check or delete the local record. Revoked, expired or address-changed rows offer **Re-pair** instead of Connect. To use a new pairing link for another row, choose **Add computer** and the appropriate connection mode; re-pairing the same installation in the same mode keeps its name. The list's settings offer **Open DSH directly** (the default, using the last-used eligible computer even when several are paired) and **Show device list**. In the app's DSH page, **Settings → General → Switch computer** returns to the list. Existing LAN and remote credentials migrate without re-pairing. Temporary unreachability is not treated as revocation.
+| Location | Setting or action |
+| --- | --- |
+| Device list → Settings → Startup behavior | **Open DSH directly** (default) selects the last-used eligible pairing, even when several computers are saved. **Show device list** asks you to choose at each launch. |
+| Device list → Settings → App icon | Choose the mascot or one of six whale-mark colors without changing package identity or paired data. |
+| DSH page → Settings → General → Switch computer | Return to the paired-computer list. Holding the top-left drawer toggle provides another entry. These actions belong inside the app's webpage, not the device-list settings. |
+| <a id="062-update"></a>DSH page → Settings → General → Page zoom | App 0.6.2+ with plugin 0.6.3+: 80–125%, reset to 100%. Saved app-wide without reloading the conversation. |
+| DSH page → Settings → General → Mobile font size | Default 16px, range 12–32px; saved for the current address. Supported themes also expose code size and body/code font choices. Editable inputs retain a 16px minimum; terminal fonts remain DSH-owned. |
+| DSH page → Settings → General → Mobile page modules → Manage | Choose optional frontend modules for this paired device. This neither uninstalls computer plugins nor revokes their authorization; [module rules](../../docs/CLIENT_MODULES.en.md) describe dependencies and applying changes. |
+| DSH page → Settings → General → Task notifications | Request Android notification access or open the app's system notification settings. See [notification limits](#notifications-and-extensions). |
 
-Startup options are under the list's **Settings → Startup behavior**. Deleting a local device does not revoke its authorization on the computer; use the computer's Mobile Access device controls for revocation.
+Page zoom changes the whole page and is separate from per-address text preferences. App-only actions are shown only when the native bridge supports them. Native screens follow the Android system language in Simplified Chinese, English or Italian; webpage copy follows DSH's selected locale. DSH does not currently expose Italian.
 
-### Connection recovery and certificates
+Deleting a local record removes its saved token and pinned CA, not the computer's authorization or every short-lived WebView cookie. Use **Mobile Access** on the computer to revoke access immediately. A full Android clear-app-data reset removes all pairings and web data and is not a normal reconnection step.
 
-The managed self-hosted FRP path uses a public-CA HTTPS domain or IPv4 origin and requires Android app 0.3.3 or later. The existing-frps path, introduced in 0.4.6, can use the same public-CA pairing or a public-IPv4 self-signed entry that requires app 0.4.6 or later. See the [attachment guide](../../docs/ATTACH_EXISTING_FRPS.en.md); older supported apps continue to work with LAN, cpolar, and Tailscale Funnel.
+## 0.6.5 update
 
-See the [self-hosted FRP guide](../../docs/SELF_HOSTED_FRP.en.md) for manual and automatic VPS deployment, host-key verification, cleanup, and troubleshooting.
+Android 0.6.5/build 81 adds an immediate **Cancel connection** action during startup, saved-computer connection, LAN scanning and pairing. Cancellation returns to the device list or editable form without deleting existing pairings. **Stop reconnecting** retains a usable DSH page; a blank or failed document returns to the list.
 
-After the first pairing, the app encrypts its device records, including revocable long-lived tokens and any pinned CA, with Android Keystore. On a later launch it sends a stored token only to its exact saved Origin to renew a short Web session before opening DSH. If the computer receives another LAN address, the app scans the default port, matches the stable DSH installation identifier, and updates the saved origin automatically. A rotating remote address such as a free cpolar URL cannot be discovered through its expired predecessor; scan the computer's current remote QR code to validate the new Origin with a one-time pairing token. The app never sends the stored device token to that new Origin, and discovery never exposes device or Session credentials.
+The initial wait uses the whale-girl background, a centered loading indicator and a cancellation button, without a separate modal dialog. A trusted page's first visible commit reveals its own loading progress immediately. A small, nonblocking Cancel button remains until usable page controls appear; the app does not wait for every image or require a particular layout class.
 
-Before pairing, the app reads separate version metadata to distinguish an outdated app, an outdated plugin, and an unsupported protocol. A legacy plugin without that endpoint continues through the original flow. When direct launch is selected, the app attempts the saved connection within a bounded recovery budget and returns to the device list if it cannot reconnect. Automatic retries run only for transient network or provider failures. Native app screens automatically follow the Android system locale in Simplified Chinese, English, or Italian without a separate language switch. Plugin-owned UI inside the WebView follows DSH's selected locale. DSH does not currently expose Italian, but the dictionaries are ready to activate without another plugin change when it does.
+One overall budget covers each connection, including queued work, native authentication, retries and initial page loading: **30 seconds for LAN, 60 seconds for remote access**. Retries do not restart it. Manual failures settle visibly, a cached unreachable status still permits retry, and failure never silently selects another computer.
 
-If the initial trusted-connection screen remains open for 12 seconds, **View device list** appears without needing a server response. Retry is also available when the screen is bound to a saved computer. From the list, retry a connection, delete just its local record or use **Add computer** with a fresh pairing link; clearing all App data is unnecessary. App 0.6.3 also prevents previous recovery tasks from replacing a manually opened connection or pairing form.
+Cancellation withdraws queued retries and late navigation results and requests native network disconnection. It cannot roll back a pairing already accepted on the computer; generate a new QR code if its one-time code was consumed. These native controls require App 0.6.5 or later; updating npm alone does not install them.
 
-When automatic recovery renews a Session, the app keeps the existing DSH page if its interface is still mounted. A page that did not finish starting or whose renderer stopped must be reopened; unsaved in-page state cannot be recovered in that case.
+## Connections, recovery and trust
 
-The app keeps the live WebView when rotating, resizing the window or changing keyboard availability, preserving the page's scroll position, references and unsent images. It requests new layout and Insets without reloading. Android still recreates the Activity for language, font-scale or system-theme changes; process termination and renderer failure can also discard unpersisted page state. This follows the [Android WebView state-management guidance](https://developer.android.com/develop/adaptive-apps/cookbook/webview-state).
+Device records, long-lived revocable tokens and pinned CAs are encrypted with Android Keystore. Existing LAN/remote slots migrate without re-pairing. Temporarily unreadable encrypted data is reported, not treated as an empty list or overwritten. An expired CA record remains available for deletion or re-pairing, while TLS continues to reject the expired certificate.
 
-Once the app receives a computer-side revocation notification, later probes cannot replace **Removed on computer** with an expiry or network status. Re-pairing obtains a new credential before the row becomes usable again. A device revoked while offline may still show **Pairing expired**, because the computer deletes its token record and returns the same generic failure as for an unknown token.
+The app renews a short Web session only at the exact saved Origin. After a LAN address change, it can discover the same installation on the default port and renew under the existing pin. A rotated remote Origin cannot be discovered through its expired predecessor: scan the computer's current remote QR code to verify the new address. The old device token is never sent to that unverified address.
 
-LAN discovery listens to DNS-SD/mDNS and periodic UDP announcements at the same time, sends an active UDP query on port `3443`, and retains bounded HTTPS scans of visible private Wi-Fi and phone-hotspot `/24` networks as a compatibility fallback. Every discovery path carries metadata only and results are merged by stable installation identifier, so a changed address updates the existing device. After choosing **Local network**, the setup screen offers **Scan QR code** (point the camera at the computer's QR code), Scan, a result list, and a manual address field (enter `https://IP:port` when discovery fails, e.g. across subnets, on a non-default port, or behind a firewall); select one DSH before entering its key. For a browser's first connection, open the **Copy pairing link** link on the phone (the pairing code is prefilled), or visit `/mobile-access/pair` on the shown HTTPS origin and enter the 43-character pairing code after the generated key's final dot.
+Discovery carries metadata only. DNS-SD/mDNS, UDP announcements and active port-3443 queries are supplemented by bounded HTTPS probes of visible private Wi-Fi/hotspot `/24` subnets. For other ports or routed subnets, enter the address manually. Discovery success is not pairing authorization.
 
-The private CA is not discovery data. After explicit LAN or self-signed FRP pairing, Android retrieves the gateway CA from the chosen HTTPS Origin without sending a device credential, checks its validity and SHA-256 fingerprint against the pairing key, and stores it with the encrypted device credential. Native requests and WebView then trust only a valid leaf signed by that pinned CA for the exact Origin; other TLS errors are cancelled. For a public-CA remote entry, the gateway serves no private CA and Android uses platform trust instead. A leaf renewed under the same CA needs no re-pairing; an expired, replaced, or mismatched CA must never be silently accepted and requires a new pairing. No private CA is installed in Android's system trust settings.
+LAN and self-signed FRP pairings fetch the CA without device credentials, verify its validity and fingerprint against the pairing key, and pin it privately for the exact Origin. Other TLS errors are rejected; no CA is installed in Android's system trust store. A leaf renewed under the same CA does not require re-pairing, but a changed or expired CA does.
 
-## Why use the app
+Ordinary remote entries use publicly trusted HTTPS. The [managed FRP](../../docs/SELF_HOSTED_FRP.en.md) public-CA path supports App 0.3.3+; [existing-frps self-signed ingress](../../docs/ATTACH_EXISTING_FRPS.en.md) requires App 0.4.6+. Normal browsers do not automatically trust that private CA. Certificate lifetimes do not guarantee unattended availability.
 
-- No browser address or tab bars.
-- System Back dismisses supported page layers before same-origin WebView history and exits the app at the root. Model submenus return to their parent before closing.
-- File selection, same-origin downloads and sharing use narrow native implementations; no extra native toolbar appears above the WebView.
-- The app remains a shell around the same Web UI and protocol used by browsers.
+Temporary network failures are not revocation. An online computer-side revocation marks the row **Removed on computer** and prevents later probes from restoring it. A device revoked while offline may instead receive the generic **Pairing expired** result; re-pair with a fresh code. The app does not reveal whether an unknown token belonged to a removed device.
 
-A mobile browser remains an alternative for LAN and publicly trusted remote entries. The self-signed FRP entry requires the 0.4.6 Android app: ordinary browsers do not trust its private CA automatically.
+Automatic recovery tries to retain an already mounted DSH document after renewal. Renderer loss or a failed boot may require reopening, so unsaved state cannot always be recovered. Supported rotation, window and keyboard changes retain the WebView; system theme/font/language changes, process termination and renderer failure may recreate it.
 
-On WebView 151 or later, the app gives its own HTTP cache a 64 MiB minimum quota so large versioned DSH scripts can be reused across page loads. Older WebViews keep their default quota; the app never lowers a larger existing quota.
+## Files, camera and input
 
-To remove one computer, delete its row from the device list. A full reset uses Android system app information → clear app data (labels vary by system). It deletes all pairings, cookies, cache and Web storage and requires pairing again; do not use it as the first response to an ordinary reconnection failure.
+### Standard attachments
 
-Deleting a row removes the App's saved device token and pinned certificate, not computer-side authorization. WebView's short-lived site cookies are separate; revoke the device on the computer when access must end immediately. A full App reset clears all sites, so do not use it to remove only one computer.
+App 0.6.4+ uses the system Photo Picker on Android 13+ for supported image filters. It preserves the webpage's MIME and multiple-selection settings within system limits. Other filters, capture requests, older Android or an unavailable picker use Documents. No storage permission is added and no manufacturer's gallery is guaranteed.
 
-## Security properties
+Standard file callbacks belong to the current WebView, Origin and document. With navigation-listener support, pending requests are withdrawn before document replacement and new selection waits for navigation to finish. Older WebViews use available callbacks; if selection stops opening after changing pages, update WebView or return to the device list and reopen the computer, without clearing data.
 
-| Control | Android behavior |
-| --- | --- |
-| Transport | HTTPS origins only; cleartext traffic is disabled. |
-| TLS | LAN pins its pairing-key CA privately. The self-signed FRP entry requires a remote CA pin in app 0.4.6 or later. Both accept only an otherwise-untrusted, valid leaf for the exact Origin. Public-CA remote entries use platform trust; every other TLS error is cancelled. |
-| Origin | Only scheme, normalized host, and port persist. Ordinary paths, queries, and fragments do not. |
-| Navigation | Same-origin main frames stay inside; user-initiated external HTTPS links open in the system browser. |
-| Permissions | Standard file input uses the system Photo Picker or document picker according to Android version and the webpage's request, without storage permission. Camera permission is requested for QR scanning or photo capture; microphone permission is requested for DSH voice input. |
-| Downloads | Foreground GET from the exact origin only; authentication control paths are never downloads. |
-| Data | Android Keystore encrypts device records, including tokens, origins and pinned CAs; Web storage stays in the app sandbox. Deleting a device removes its record only; system clear-app-data removes all pairings and Web data. |
-| Backup | App backup is disabled; TLS private keys and signing keys must remain outside the repository. |
+DSH keeps its file action in **Add**; Mobile adds **Take photo** when the active attachment owner accepts images. Camera capture explicitly requests permission and returns a full-resolution JPEG. For troubleshooting, select one small JPEG/PNG and inspect the unsent draft preview. Files awaiting submission need not already exist as computer-side image objects; no model request is necessary to check selection.
 
-The network security configuration does not trust user-installed CAs. For LAN, the plugin signs a new leaf for the selected interface address while the app retains the stable CA pin. For the self-signed FRP entry, the computer-side CA lasts five years and its public-IPv4 leaf lasts 397 days; the leaf can rotate under the same CA, but CA expiry or replacement requires a new fingerprint check and re-pairing. These are certificate lifetimes, not an unattended-availability guarantee.
+### Keyboard and page space
 
-## Mobile extension bridge
+System Back first dismisses supported webpage layers, then handles same-origin WebView history, and exits at the root. Model submenus return to their parent before closing. No extra native toolbar is shown above the WebView.
 
-The authenticated page can call the Android bridge through `dshMobile` extensions. It uses an `androidx.webkit` WebMessage listener, checks the exact configured top-level origin and `isMainFrame` on every message, and never uses `addJavascriptInterface`. Inbound messages are capped at 1 MiB, clipboard text at 256 KiB, binary results at 8 MiB, and replies at 12 MiB. The bridge does not expose cookies, device tokens, pairing keys, CA private keys, or arbitrary Android APIs.
+The native soft-keyboard adapter uses plain Enter for a line break only with a visible inset-backed keyboard, no reported hardware keyboard, and a focused active-session composer. The plugin's separate touch-browser rule also uses Enter for draft line breaks, including external keyboards on touch-primary browsers. Menus, composition and modified shortcuts remain DSH-owned; non-touch desktop behavior is unchanged. Use Send for multiline messages or Shift+Enter where DSH's normal keyboard policy applies.
 
-Available actions include `files.pick`, `camera.capture`, `share`, `clipboard.read`, `clipboard.write`, `notification.notify`, `notification.settings` and `mobile.switch-computer`. DSH keeps its file-attachment action in Add; Mobile adds camera capture there when the current attachment owner accepts images. The separate `files.pick` returns one file, follows the caller's MIME types and returns at most 8 MiB through the bridge; that is not a limit on DSH's file selector. Camera capture requests permission when used, writes a full-resolution JPEG through `FileProvider` and returns a browser `File`.
+System bars, cutouts and keyboard occupancy are reserved once. WebView 151+ receives a minimum 64 MiB HTTP-cache quota for reusable versioned DSH resources; older engines retain their default quota. A Chromium-below-100 reminder is advisory, not a promise that every DSH API is supported on that engine.
 
-For ordinary DSH attachments, App 0.6.4 selects the system Photo Picker or document picker as described above, preserves the webpage's MIME and multiple-selection settings, and returns all selected items within the system picker limits. Available galleries and document providers depend on the device. This standard WebView path is independent of the extension `files.pick` action and its Bridge size limit. File-selection acceptance remains specific to the checked device, WebView provider and APK.
+A successful App connection does not establish that its engine can execute the page. The DSH 0.2.1-rc.2 frontend contains syntax Chromium 92 cannot parse. If system WebView cannot be updated, use a browser confirmed to work without clearing pairings. See the [old-engine notes](../../README.en.md#app-or-mobile-browser) for the plugin's startup feedback and support limits.
 
-Task reminders use Host completion events and explicit pending-input cards while the page remains alive. Enable notifications or open system settings from DSH **Settings → General** inside the app. Lock-screen text is generic and tapping opens the app. Plugin 0.6.4 distinguishes full session and turn IDs, including long and non-ASCII IDs; earlier versions can replace notifications when their tags collide. Completion reminders require SSE and have no offline event replay; Cloudflare Quick Tunnels do not support the stream. See [channel limits](../../docs/CLOUDFLARE_TUNNEL.en.md#quick-tunnel-feature-limits).
+### Voice
 
-Bridge file/camera actions are serialized with a five-minute deadline. Cancellation, WebView destruction, timeout and stale-session results are cleaned up or rejected. Standard WebView file inputs are a separate path. Since plugin 0.6.6, browser media selection waits for change, explicit cancellation, abort or the deadline rather than treating restored focus as cancellation. Unsupported browser capabilities return `unsupported`.
+DSH records audio through `getUserMedia` and sends it to the configured computer-side speech provider, not browser SpeechRecognition or the extension bridge. Android asks for microphone permission and accepts audio-only capture from the paired HTTPS Origin. Provider components, models and network access must work; granting recording permission does not verify transcription. Same-origin frontend plugins share that page permission.
 
-For image attachment diagnosis, compare the native DSH file button and camera action using a small JPEG or PNG and check the unsent draft preview. DSH keeps images in the browser draft before submission, so no new computer-side image object does not establish picker failure. Checking the selected file count/type and the draft preview is sufficient without sending a model request; generic files can use a different storage path. File selection, webpage intake and later submission are separate stages.
+## Notifications and extensions
 
-From App 0.4.7, its native keyboard adapter uses plain Enter for a new draft line when an inset-backed on-screen keyboard is visible, Android reports no hardware keyboard, and an active session composer is focused. The Send button still submits a multiline draft. Floating keyboards, unknown state and older Apps do not use this native rule; the plugin's touch-browser rule below can still apply. Physical keyboards can use Shift+Enter for a line break.
+Task reminders use Host completion events and pending-input cards while the page remains alive. Lock-screen text is generic and tapping returns to the app. They are not an offline push service: completion reminders require SSE, with no event replay after disconnection. Cloudflare Quick Tunnels do not support this stream; see [channel limits](../../docs/CLOUDFLARE_TUNNEL.en.md#quick-tunnel-feature-limits).
 
-From 0.6.0, the main composer in touch-primary browsers uses Enter to add a line to a nonempty draft and does nothing for an empty draft. DSH retains menus, composition and modified shortcuts. An external keyboard on a touch-primary browser uses that same rule; a non-touch desktop is unchanged. General settings offers a mobile font size of 12–32px, default 16px, saved for the current address only; editable inputs retain a 16px minimum.
+The authenticated page may use the `dshMobile` bridge for `files.pick`, `camera.capture`, `share`, clipboard read/write, task notifications/settings, computer switching and page scaling. The separate extension `files.pick` returns one file, follows its requested MIME types and limits bridge-returned file bytes to 8 MiB. This is not the standard DSH attachment selector's limit.
 
-Plugin 0.6.3 adds **More font settings**. From plugin 0.6.5, code-size and body/code-family controls appear only when the current DSH theme consumes their public Markdown font variables; unsupported controls are hidden and saved preferences retained. These webpage preferences belong to the current address, not computer-wide settings, and need no new APK. Terminal fonts remain controlled by DSH. **Page zoom** is a separate native control described in the 0.6.2 update above.
+Bridge file/camera operations are serialized with a five-minute deadline. Cancellation, document/session changes or WebView teardown reject stale results and clean up owned resources. Browser media selection waits for an actual result, explicit cancellation, abort or deadline; returning focus is not itself cancellation. Unsupported capabilities return `unsupported`.
 
-DSH records through `getUserMedia` and sends audio to the configured computer-side DSH speech provider for transcription, not browser-native SpeechRecognition or the extension bridge. The app requests microphone permission on first use and grants audio-only capture for the paired HTTPS Origin. Computer components, model and network must be available; permission does not guarantee transcription. Same-origin client plugins share the page's permissions, so grant recording only when you trust them.
+Computer-side `host.mjs` extensions are trusted Node.js code, separate from this native bridge; the bridge cannot edit or upload their source. Computer-managed frontend assets and extension activation are documented in the [project guide](../../README.en.md), and optional Worker execution in the [Worker guide](../../docs/EXTENSION_WORKERS.en.md).
 
-Computer-side extensions are separate: their `host.mjs` runs as trusted local Node.js code on the DSH host, while `mobile.js` calls its scoped actions and routes. The app bridge cannot edit or upload extension source files.
+## Security properties
 
-The client validates the extension manifest and revisioned resource URLs. File changes trigger an authenticated server-sent event so the phone can refresh immediately; 45-second visible and 5-minute hidden polling remains a recovery fallback. Every UI activation is pinned to its Host, script, stylesheet, and asset generation. Failed Host staging keeps the current version; failed client activation closes that extension and retries instead of mixing generations.
+| Control | Android behavior |
+| --- | --- |
+| Transport | HTTPS only; Manifest cleartext traffic is disabled. |
+| Trust | Exact-Origin platform trust or a privately pinned pairing CA. User-installed system CAs are not broadly trusted. |
+| Navigation | Same-origin main frames remain inside; explicit external HTTPS links open in the system browser. |
+| Permissions | Camera for explicit scanning/capture, microphone for DSH recording, notifications through a foreground permission/settings action; standard file selection needs no storage permission. |
+| Bridge | WebMessage listener validates exact top-level Origin and main frame; no `addJavascriptInterface` or arbitrary Android API. |
+| Limits | Inbound message 1 MiB, clipboard 256 KiB, binary bridge result 8 MiB, reply 12 MiB. |
+| Credentials | Bridge replies do not automatically include stored pairing credentials; there is no direct bridge API for reading the credential store or private keys. Clipboard contents and selected files may contain sensitive data: use only trusted extensions. |
+| Downloads | Foreground GET from the exact Origin only; authentication-control paths are excluded. |
+| Storage | Keystore-encrypted pairings and sandboxed web data; cloud backup and device transfer are disabled. Signing/TLS private keys must stay outside the repository. |
 
 ## Build
 
-Requirements: Android Studio or Android SDK 36 and JDK 17. The repository includes the Gradle 9.7.1 Wrapper.
+Use Android Studio or Android SDK 36 and JDK 17. The repository includes the Gradle 9.7.1 Wrapper.
 
 ```powershell
 Set-Location apps/mobile/android
 ./gradlew.bat :app:lintDebug :app:testDebugUnitTest :app:assembleDebug -x :app:lintAnalyzeDebugUnitTest -x :app:lintAnalyzeDebugAndroidTest
 ```
 
-The debug APK is written to `app/build/outputs/apk/debug/app-debug.apk`. GitHub Releases build a signed release APK with a stable signing key stored only in repository secrets; signing keys and passwords never enter the source tree or build artifacts. The current signed release is [Android 0.6.4](https://github.com/saya-ch/dsh-mobile/releases/tag/android-v0.6.4), with SHA-256 `b28f2e832a8596df2fa1bfbad7dc36eef59d519c9e4875dd2be1ea4713804adf`.
-
-## Acceptance
+The Debug APK is `app/build/outputs/apk/debug/app-debug.apk`. Official releases use the established signing key stored only in repository Secrets. A local unsigned Release build or a Debug install is not official-signer evidence.
 
-Shared URL-policy tests cover origin normalization, pairing entry, same-origin navigation and download paths. Local acceptance of the clean App 0.6.4 / build 80 Debug APK used PJW110 with Android 16 and Google WebView 153.0.8010.36. With the same retained WebView, the real DSH stock input reopened Documents after document replacement, rejected the old selection, and received the exact controlled PNG bytes with a decoded draft preview. A held main-document response also confirmed that selection was refused during navigation and reopened after HTTP 204 retained the old document. No model prompt was submitted. These USB-isolated Debug checks do not establish physical acceptance of the official-signer APK, public tunnels, HyperOS, older providers or other devices.
+The verified stable release is [Android 0.6.5](https://github.com/saya-ch/dsh-mobile/releases/tag/android-v0.6.5), SHA-256 `41bd476c5ccf90020ecf624844a29886d55060a79533b599e9aa5bf0a1d71844`. Earlier release history belongs in [CHANGELOG](../../CHANGELOG.md).
 
-Earlier PJW110 checks with Android 16 and WebView 151 covered model-menu Back, rotation with draft/reference/image retention, known revocation through checks and restart, and re-pairing the same device. Those checks also used an isolated HTTPS instance over USB. A real VPS plus phone end-to-end test of the self-signed FRP entry has not been recorded; cutouts, font scaling, TLS failures, downloads and additional device/provider combinations still require their own acceptance.
+## Acceptance and known limits
 
-A 0.5.6 development build used to prepare 0.6.0 additionally verified in-place Debug upgrade with paired data retained, all seven Launcher choices, two isolated computers, explicit order surviving later connections, scanner buttons/double-tap zoom and camera release on this device. Physical pinch, real QR recognition, older-Android fallback and process-death restoration are not represented as completed device checks.
+- Connection-control development builds used Debug metadata 0.6.4/build 80 on PJW110, Android 16 and Google WebView 153.0.8010.36. Against an isolated DSH 0.2.0-rc.2/plugin 0.6.10 instance over USB and pinned HTTPS, checks covered pairing/startup/saved-connection cancellation, Back, failed manual connections and return from a failed page after stopping native recovery. Held module responses also verified early webpage display, touch-through outside compact cancellation, cancellation and later completion. Pairings were retained and owned QA records removed.
+- Debug builds of App 0.6.4 retained one WebView across document replacement/reload, rejected an old selection, and received controlled PNG bytes with a decoded DSH draft preview. A held navigation and HTTP 204 also checked selector availability. Earlier checks covered model-menu Back, rotation with draft/reference/image retention, known revocation, re-pairing, icon choices and list ordering. None required a model prompt.
+- These observations do not establish final 0.6.5/build 81 official-signer device acceptance, every public provider, remote 60-second timing, full native recovery with a still-live draft, HyperOS/older WebViews or every screen/gesture configuration. Self-signed FRP still lacks a recorded real-VPS-plus-phone end-to-end check. Permission grants alone do not establish voice transcription, and process-death restoration is not guaranteed.
 
 Apache-2.0 licensed. See [LICENSE](../../LICENSE).

package/apps/mobile/README.zh-CN.md

@@ -0,0 +1,131 @@
+# DeepSeek Harness Android App
+
+[English](README.md) · [返回项目首页](../../README.md)
+
+DeepSeek Harness 是这个社区维护的 Android WebView App 的显示名称。它直接打开插件提供的已认证 HTTPS 页面，不打包另一套 DSH 前端；App 与手机浏览器获得相同的 DSH 功能，以及电脑端配置的移动页面定制。
+
+当前正式 App 为 **0.6.5**；构建号为 81。npm 插件与 Android App 独立编号、独立更新；插件升级不代表需要重新安装 APK。此次改进见 [0.6.5 更新](#065-更新)。
+
+支持 Android 10 及以上系统。iOS 本地实验不属于已发布或受支持的客户端。
+
+## 安装与配对
+
+1. 按[项目快速开始](../../README.md#快速开始)安装并启用插件。局域网配置可通过命令行或电脑端的 **移动访问** 面板完成。
+2. 从 [GitHub Releases](https://github.com/saya-ch/dsh-mobile/releases/tag/android-v0.6.5) 安装已签名 APK。正式版沿用相同发布签名，可原位升级并保留配对；不同签名的 Debug 包不能直接覆盖正式版，不要为绕过签名不匹配而卸载或清除数据。
+3. 在电脑 **移动访问 → 局域网访问** 中生成密钥／配对链接，或配置远程通道并生成远程配对二维码。在 App 选择对应方式，扫码或粘贴链接。
+4. 为电脑命名。每条局域网或远程配对单独保存；手机无需安装 cpolar、Cloudflare 或 Tailscale App。
+
+局域网还提供扫描和手动 `https://IP:端口` 输入。自动发现不能绕过防火墙、校园网隔离或缺失的网络路由；需要使用可达地址或远程通道。手机浏览器另见[项目连接说明](../../README.md)。
+
+## 设备与设置
+
+**已配对设备**列表显示名称、连接类型、地址、可达状态和最近连接时间。点按可连接；长按或点击“更多”可重命名、检测、排序或删除本机记录。新配对追加到末尾，**上移／置顶**只调整显示顺序，不改变启动选择。**添加电脑**可输入新配对链接；以相同方式重新配对同一安装实例会保留自定义名称。
+
+| 位置 | 设置或操作 |
+| --- | --- |
+| 设备列表 → 右上角设置 → 启动行为 | **直接进入 DSH**（默认）优先连接最近使用且配对仍有效的电脑，即使保存了多台设备；**显示设备列表**则每次启动先选择。 |
+| 设备列表 → 右上角设置 → 应用图标 | 可选鲸鱼娘和六种鲸鱼标志配色，不改变包名或配对数据。 |
+| DSH 页面 → 设置 → 通用设置 → 切换电脑 | 返回已配对设备列表；长按左上角抽屉按钮也可进入。这是 App 内网页的操作，不在设备列表设置里重复提供。 |
+| <a id="062-更新"></a>DSH 页面 → 设置 → 通用设置 → 页面缩放 | App 0.6.2+ 与插件 0.6.3+：80–125%，可恢复 100%；保存在当前 App 中，不刷新会话。 |
+| DSH 页面 → 设置 → 通用设置 → 移动端字号 | 默认 16px、范围 12–32px，按当前地址保存；受支持主题还提供代码字号及正文／代码字体选项。编辑输入框至少 16px，终端字体由 DSH 管理。 |
+| DSH 页面 → 设置 → 通用设置 → 移动页面模块 → 管理 | 选择当前配对设备加载的可选前端模块，不卸载电脑插件，也不撤销其权限；依赖和生效方式见[模块规则](../../docs/CLIENT_MODULES.md)。 |
+| DSH 页面 → 设置 → 通用设置 → 任务通知 | 申请 Android 通知权限或打开系统应用通知设置，限制见[通知与扩展](#通知与扩展)。 |
+
+页面缩放影响整个网页，与按地址保存的文字偏好不同。App 专属操作只在原生 Bridge 支持时显示。原生页面跟随 Android 系统语言，支持简体中文、英文和意大利文；网页跟随 DSH 选择的语言，当前 DSH 尚未提供意大利语。
+
+删除本机记录会移除保存的设备令牌和固定 CA，不等于撤销电脑授权或清除所有 WebView 短期 Cookie。需要立即终止访问时，请在电脑的 **移动访问** 中撤销设备。Android“清除应用数据”会删除全部配对和网页数据，不是普通重连的处理步骤。
+
+## 0.6.5 更新
+
+Android 0.6.5／构建 81 在启动连接、已配对电脑连接、局域网扫描和配对过程中均提供立即可用的 **取消连接**。取消后回到设备列表或可编辑表单，不删除原有配对；**停止重连**保留仍可用的 DSH 页面，空白或失效文档则返回列表。
+
+首次等待沿用鲸鱼娘背景、居中动画和取消按钮，不叠加独立弹窗。可信网页首次显示后立即露出网页自身的加载进度；页面尚未可操作时只保留小型、非阻挡的取消按钮，出现可用控件后再移除。不等待所有图片完成，也不依赖特定布局类名。
+
+每次连接共用一个总预算，涵盖排队、原生认证、重试和首次页面加载：**局域网 30 秒、远程 60 秒**，重试不重新计时。手动连接失败会明确结束等待；“暂不可达”的历史状态仍可主动重试，也不会因失败静默切换到其他电脑。
+
+取消会撤销排队重试和迟到的导航结果，并请求断开原生网络操作；无法回滚电脑端已经接受的配对，一次性二维码若已被消耗，请重新生成。这些原生控制需要 App 0.6.5 及以上版本，仅升级 npm 不会安装它们。
+
+## 连接恢复与信任
+
+设备记录、可撤销的长期令牌和固定 CA 使用 Android Keystore 加密保存，旧版局域网／远程槽可迁移，无需重新配对。暂时无法解密时会报告错误，不当成空列表或用新凭据覆盖。CA 已过期的记录仍能删除或重新配对，但 TLS 继续拒绝过期证书。
+
+App 只向已保存的精确 Origin 续期短期 Web 会话。局域网地址变化后，可在默认端口发现同一安装实例，并在原有固定证书校验下续期。远程 Origin 失效后无法从旧地址发现新地址，应扫描电脑端当前远程二维码验证；旧设备令牌不会发送给该未验证地址。
+
+发现过程只携带元数据：同时使用 DNS-SD/mDNS、UDP 公告、端口 `3443` 主动查询，以及可见私有 Wi-Fi／热点 `/24` 网段的有限 HTTPS 探测。其他端口或可路由子网可手动输入地址；发现成功不代表已获配对授权。
+
+局域网和自签 FRP 配对会在不发送设备凭据的情况下读取 CA，校验有效期及与配对密钥一致的指纹，然后按精确 Origin 在 App 内固定。其他 TLS 错误一律拒绝，不向系统安装 CA。同一 CA 下续签叶证书无需重配；CA 更换或过期则必须重新核对并配对。
+
+常规远程入口使用系统信任的 HTTPS 证书。[托管自建 FRP](../../docs/SELF_HOSTED_FRP.md) 的公开 CA 路径支持 App 0.3.3+；[既有 frps 的自签入口](../../docs/ATTACH_EXISTING_FRPS.md)需要 App 0.4.6+，普通浏览器不会自动信任其私有 CA。证书有效期不等于无需维护即可持续可用。
+
+临时断网不等于设备被撤销。收到在线撤销通知后，条目显示 **电脑端已移除**，后续探测不会恢复它；离线时被撤销的设备也可能只收到通用的 **配对已过期**，请使用新码重新配对。App 不会向未知令牌暴露设备是否曾被移除。
+
+自动恢复在续期后尽量保留仍运行的 DSH 文档。渲染进程失效或启动失败时可能需要重新打开，未保存状态不保证恢复。受支持的旋转、窗口和键盘变化保留 WebView；系统主题／字体／语言变化、进程终止及渲染失败可能导致重建。
+
+## 文件、相机与输入
+
+### 标准附件
+
+App 0.6.4+ 在 Android 13+ 对支持的图片过滤优先使用系统 Photo Picker，保留网页的 MIME 和多选要求，并遵守系统数量限制。其他过滤、拍摄请求、较旧 Android 或选择器不可用时使用 Documents；无需存储权限，也不保证出现某个厂商的相册。
+
+标准文件回调绑定当前 WebView、Origin 和文档。支持导航监听时，文档替换前撤销旧请求，导航结束后才能再次选择。较旧 WebView 使用可用回调；如换页后选择器不再打开，可更新 WebView，或回设备列表重新打开电脑，无需清除数据。
+
+DSH 的文件入口仍在 **添加** 组；当前附件 owner 支持图片时，Mobile 加入 **拍照**，明确申请相机权限后返回完整分辨率 JPEG。排查时可选一张小 JPEG／PNG，检查未发送草稿的预览；尚未提交的文件不必已经成为电脑端图片对象，无需发送模型请求来验证选择结果。
+
+### 键盘与页面空间
+
+系统返回键先关闭支持的网页层级，再处理同源 WebView 历史，根页面退出；模型子菜单先退回上一级再关闭。WebView 上方不显示额外原生工具栏。
+
+原生软键盘适配只在屏幕键盘占据窗口、未报告实体键盘且活动会话输入框聚焦时，把普通 Enter 用作换行。插件另有触屏浏览器规则，也将 Enter 用于草稿换行，触屏设备的外置键盘同样可能使用该规则。菜单、输入法组合和组合键仍交给 DSH，非触屏桌面行为不变；多行消息请点发送，DSH 常规键盘策略下也可用 Shift+Enter 换行。
+
+系统栏、屏幕缺口和键盘空间只预留一次。WebView 151+ 为 App 的可复用版本化 DSH 资源提供至少 64 MiB HTTP 缓存配额；旧内核保持默认配额。Chromium 低于 100 的提醒不阻断使用，也不承诺旧内核支持全部 DSH 接口。
+
+App 连接成功不代表网页脚本能够运行。DSH 0.2.1-rc.2 的前端含有 Chromium 92 无法解析的语法；系统内核无法更新时可使用已验证可用的浏览器，不必清除配对。插件的启动反馈与支持范围见[旧内核说明](../../README.md#app-与手机浏览器)。
+
+### 语音
+
+DSH 通过 `getUserMedia` 录音并交给电脑已配置的语音提供方，不使用浏览器 SpeechRecognition 或扩展 Bridge。Android 申请麦克风权限，仅接受配对 HTTPS Origin 的纯音频请求；电脑组件、模型和网络仍需可用，录音授权不代表转写成功。同源前端插件共享该页面权限。
+
+## 通知与扩展
+
+任务提醒依赖页面仍存活时收到的 Host 完成事件和待确认卡片。锁屏只显示通用文案，点击返回 App；它不是离线推送服务，完成事件需要 SSE，断连后不会补发。Cloudflare 快速隧道不支持该事件流，详见[通道限制](../../docs/CLOUDFLARE_TUNNEL.md#快速隧道的功能限制)。
+
+认证页面可通过 `dshMobile` Bridge 调用 `files.pick`、`camera.capture`、分享、剪贴板读写、任务通知／设置、切换电脑及页面缩放。扩展单独调用的 `files.pick` 返回一个文件，遵循声明的 MIME 类型，通过 Bridge 返回的文件最多 8 MiB；这不是 DSH 标准附件选择器的大小限制。
+
+Bridge 文件／相机操作串行执行，最长等待五分钟。取消、文档／会话变化或 WebView 销毁会拒绝旧结果并清理资源。浏览器媒体选择等待实际结果、明确取消、中止或超时，恢复焦点不直接视为取消；不支持的能力返回 `unsupported`。
+
+电脑端 `host.mjs` 扩展是另一层受信任 Node.js 代码，原生 Bridge 不能编辑或上传其源码。电脑管理的前端资源及扩展激活见[项目指南](../../README.md)，可选 Worker 执行见 [Worker 指南](../../docs/EXTENSION_WORKERS.md)。
+
+## 安全边界
+
+| 控制项 | Android 行为 |
+| --- | --- |
+| 传输 | 仅 HTTPS，Manifest 禁止明文流量。 |
+| 信任 | 按精确 Origin 使用系统信任或私有配对 CA，不广泛信任用户另装的系统 CA。 |
+| 导航 | 同源主页面保留，明确点击的外部 HTTPS 链接交给系统浏览器。 |
+| 权限 | 明确扫码／拍照时申请相机权限，DSH 录音时申请麦克风权限，通过前台操作申请或设置通知；标准选文件无需存储权限。 |
+| Bridge | WebMessage listener 校验精确顶层 Origin 和主框架，不使用 `addJavascriptInterface`，不暴露任意 Android API。 |
+| 限额 | 入站消息 1 MiB、剪贴板 256 KiB、二进制 Bridge 结果 8 MiB、回复 12 MiB。 |
+| 凭据 | Bridge 回复不自动附带已保存的配对凭据，也不提供直接读取凭据存储或私钥的接口；剪贴板和所选文件仍可能包含敏感内容，请仅使用可信扩展。 |
+| 下载 | 仅当前精确 Origin 的前台 GET，排除认证控制路径。 |
+| 存储 | 配对使用 Keystore 加密，网页数据位于沙箱；关闭云备份和设备迁移，签名／TLS 私钥不得进入仓库。 |
+
+## 构建
+
+使用 Android Studio 或 Android SDK 36 与 JDK 17；仓库包含 Gradle 9.7.1 Wrapper。
+
+```powershell
+Set-Location apps/mobile/android
+./gradlew.bat :app:lintDebug :app:testDebugUnitTest :app:assembleDebug -x :app:lintAnalyzeDebugUnitTest -x :app:lintAnalyzeDebugAndroidTest
+```
+
+Debug APK 位于 `app/build/outputs/apk/debug/app-debug.apk`。正式发布沿用只保存在仓库 Secrets 中的签名密钥，本地未签名 Release 构建或 Debug 安装不能替代正式签名核验。
+
+已核验的正式版本为 [Android 0.6.5](https://github.com/saya-ch/dsh-mobile/releases/tag/android-v0.6.5)，SHA-256：`41bd476c5ccf90020ecf624844a29886d55060a79533b599e9aa5bf0a1d71844`。旧版本历史集中在 [CHANGELOG](../../CHANGELOG.md)。
+
+## 验收与已知限制
+
+- 连接控制的开发包使用 Debug 元数据 0.6.4／构建 80，在 PJW110、Android 16、Google WebView 153.0.8010.36 上，通过 USB 和固定 CA 的 HTTPS 连接隔离的 DSH 0.2.0-rc.2／插件 0.6.10。检查了配对／启动／已保存连接取消、系统返回、手动失败收尾，以及停止原生恢复后从失效页面返回；暂停模块响应时也验证了提前露出网页、非按钮区域触摸透传、取消和放行后完成。原配对保留，临时 QA 记录已清理。
+- App 0.6.4 的 Debug 构建在同一 WebView 中覆盖文档替换／刷新、拒绝旧选择、接收受控 PNG 字节并形成已解码草稿预览；还检查了暂停导航及 HTTP 204 后选择器的可用性。更早的检查覆盖模型菜单返回、旋转保留草稿／引用／图片、已知撤销、重新配对、图标选择与列表顺序，均未发送模型请求。
+- 这些观察不代表最终 0.6.5／构建 81 正式签名 APK 已完成真机验收，也不覆盖所有公网提供方、远程 60 秒期限、保留活动草稿的完整原生恢复、HyperOS／旧 WebView 或所有屏幕／手势组合。自签 FRP 尚无真实 VPS 加手机的端到端验收记录；权限授予不代表语音转写成功，进程终止后的状态恢复也不作保证。
+
+Apache-2.0 licensed. See [LICENSE](../../LICENSE).

package/apps/mobile/release.json

@@ -1,5 +1,5 @@
 {
-  "version": "0.6.4",
-  "versionCode": 80,
-  "releaseTag": "android-v0.6.4"
+  "version": "0.6.5",
+  "versionCode": 81,
+  "releaseTag": "android-v0.6.5"
 }

package/docs/ATTACH_EXISTING_FRPS.en.md

@@ -40,7 +40,7 @@ The computer-side gateway terminates TLS with a five-year CA and 397-day public-
 | `frp_attach_mode_requires_vhost_port` | Public-CA mode needs the existing frps instance's real `vhostHTTPPort`; a guessed value can make the plaintext exposure probe check the wrong port. |
 | `frp_vhost_publicly_reachable` | The public-CA entry's plaintext vhost is reachable from outside. Restrict it without exposing another listener; a separate frps instance may be safer than changing global `proxyBindAddr`. |
 | `frp_attach_cert_unknown` | The self-signed certificate is absent or unreadable. Inspect the panel's certificate status and the private `remote/ingress/` files; do not bypass fingerprint validation. |
-| `frp_ingress_ca_expired` | The pinned CA expired. Reconfigure the self-signed entry and pair the phone again after checking the new fingerprint. Android 0.6.3 candidate keeps expired records readable and removable; in published App 0.6.2 an expired CA can make the device database unreadable. Retain App data pending this correction rather than clearing all pairings for one computer. |
+| `frp_ingress_ca_expired` | The pinned CA expired. Reconfigure the self-signed entry and pair the phone again after checking the new fingerprint. Android App 0.6.3 and later keep the device record readable and removable, while TLS still rejects the expired certificate. If App 0.6.2 or earlier cannot read its device list, preserve App data and use the [App guide](../apps/mobile/README.md) to install a same-signer release of 0.6.3 or later rather than clearing all pairings for one computer. |
 | Browser reports an untrusted certificate | Expected for self-signed ingress. Use app 0.4.6 or later and explicit pairing, or public-CA mode for a browser. |
 | `frp_proxy_name_in_use` | frps keeps proxy names unique across **all** its clients, and this installation's own name (`dsh-mobile-<first 12 characters of the installation identity>`) is already registered — usually another DSH computer, or this computer's previous session before the frps heartbeat expires it. Disable self-hosted FRP there, or remove that proxy on the frps. frpc keeps running without publishing the entry port, so check proxy registration rather than relying on process liveness. |
 | `frp_remote_port_in_use` | Another proxy on the same frps already owns the chosen entry port. Ports are first-come, first-served per server, so give this computer a different `publicPort` and allow it in the firewall. |

package/docs/ATTACH_EXISTING_FRPS.md

@@ -92,7 +92,7 @@ curl -k -sS -o /dev/null -w '%{http_code}\n' https://YOUR_PUBLIC_IPV4:33080/mobi
 | `frp_attach_mode_requires_vhost_port` | 选了公开 CA 证书档却没填你 frps 的真实 `vhostHTTPPort`。填上真实值即可（插件不会替你假定 7080） |
 | `frp_vhost_publicly_reachable` | 公开 CA 档的明文 vhost 端口从公网可达。限制其监听或改用独立 frps 实例；若同一实例还要提供自签档公网 TCP 入口，不要盲目把全局 `proxyBindAddr` 改为回环或公网地址。 |
 | `frp_attach_cert_unknown` | 自签入口证书缺失或不可读；检查面板证书状态与私有目录的 `remote/ingress/`，不要绕过指纹验证。 |
-| `frp_ingress_ca_expired` | 自签 CA 已过期，插件不会静默替换受信任 CA；重新生成 CA 后，手机须核对新指纹并重新配对。Android 0.6.3 候选保留过期记录可读、可删除；当前正式 App 0.6.2 的过期 CA 可能使整个设备库不可读，遇到时请保留 App 数据并等待该修正，不要为一台电脑清除全部配对。 |
+| `frp_ingress_ca_expired` | 自签 CA 已过期，插件不会静默替换受信任 CA；重新生成 CA 后，手机须核对新指纹并重新配对。Android App 0.6.3 及更新版本仍可读取、删除该设备记录，但 TLS 继续拒绝过期证书。若使用 0.6.2 或更早版本且设备库因此不可读，请保留 App 数据，并按 [App 手册](../apps/mobile/README.zh-CN.md)安装 0.6.3 或更新的同签名正式版，不要为一台电脑清除全部配对。 |
 | 手机浏览器提示证书不受信任 | 自签档的正常现象；请在 App 内配对使用 |
 | 自检显示「公网入口不可达」 | 端口未放行、frpc 未启动，或 frps 未把该 `remotePort` 转发出来 |
 | `frp_proxy_name_in_use` | frps 的代理名在**整台服务器**上唯一。本机安装名（`dsh-mobile-<安装标识前 12 位>`）已被占用：多半是另一台 DSH 电脑，或本机上一次连接尚未等到 frps 心跳超时。到那台机器上关闭自建 FRP，或在 frps 上移除该代理。frpc 此时仍在运行、只是入口端口没被发布，应检查代理是否注册成功，不能仅凭进程存在判断就绪。 |

package/docs/CADDY_MANAGED.en.md

@@ -6,9 +6,9 @@
 
 ## Requirements
 
-Managed Caddy manages an HTTPS proxy and certificates; it is not a NAT traversal service. You need a domain with Tencent Cloud DNSPod DNS, a reachable public inbound port, and router forwarding to the DSH computer. DNS-01 cannot bypass CGNAT, campus isolation, or an unavailable inbound route. Use Cloudflare Tunnel, cpolar, or FRP on an existing VPS for those networks.
+Managed Caddy manages an HTTPS proxy and certificates; it is not a NAT traversal service. You need a domain whose DNS-01 challenge records the Tencent Cloud DNSPod credentials can update, plus a public HTTPS inbound port that reaches the DSH computer. If the computer sits behind a router you control, forward the public port to its local Caddy port; on a cloud host, check its security group and host firewall instead. DNS-01 proves domain control but cannot bypass CGNAT, campus isolation, or an unavailable inbound route. Use Cloudflare Tunnel, cpolar, or FRP on an existing VPS for those networks.
 
-The panel currently configures DNS-01 only for Tencent Cloud DNSPod. Cloudflare DNS users can keep using Cloudflared without migrating DNS for this feature; do not enter a Cloudflared connector token in the Tencent Cloud credential fields.
+The panel currently supports only the `tencentcloud` DNS module and Tencent Cloud DNSPod credentials; another DNS provider's key cannot be used in this mode. Cloudflare DNS users can keep using Cloudflared without migrating DNS for this feature; do not enter a Cloudflared connector token in the Tencent Cloud credential fields.
 
 ```text
 Android App / browser → public HTTPS hostname (Caddy terminates TLS)
@@ -27,7 +27,7 @@ Configure the public HTTPS origin, DNS-01 credentials and local HTTPS port separ
 1. On the computer, open **Mobile Access → Remote → Self-hosted connection → Own reverse proxy** and choose **Managed Caddy**.
 2. Choose **Install managed Caddy** and confirm the download. The plugin downloads the fixed [DSH Mobile component distribution](https://github.com/saya-ch/dsh-mobile/releases/tag/caddy-component-2.11.7-tencentcloud-0.4.3-r1), checking its exact length, SHA-256, core and DNS module versions. Unavailable or invalid assets are not executed.
 3. Enter the public HTTPS origin, such as `https://dsh.example.com`, select Tencent Cloud DNSPod, supply a `SecretId` and `SecretKey` with the required zone permissions, and set the local HTTPS port, such as `8443`. Point the domain at the public ingress and, where needed, forward public TCP 443 to port 8443 on the computer.
-4. Choose **Save and start Caddy**. Installed is not ready: the panel reports readiness only after validating public HTTPS and confirming that the entry belongs to the current DSH instance.
+4. Choose **Save and start Caddy**. Installed is not ready: the panel reports readiness only after a computer-side public HTTPS probe validates the certificate and confirms that the entry belongs to the current DSH instance. That probe still does not prove phone-network reachability.
 5. Generate a remote pairing QR code and scan it from **Remote access** in the Android app, or open the pairing link in a mobile browser. Use the phone's cellular connection to check actual page loading, session synchronization and WebSockets; a computer-side health check alone does not establish phone access.
 
 Initial DNS-01 issuance waits for DNS propagation and certificate issuance. Keep the computer online and avoid repeated restarts that can trigger issuer limits. Managed mode creates no system service, PATH entry, startup item, or system trust-store certificate. Caddy's admin API and configuration autosave are disabled.
@@ -42,7 +42,7 @@ Stopping access or changing provider waits for Caddy and Gateway termination, re
 
 Run these build and validation tools from a source checkout of this repository. The npm plugin package does not include these maintenance scripts; ordinary users do not need to compile Caddy.
 
-The [builder](<../scripts/build-caddy-component.mjs>) fixes Go 1.26.9, xcaddy v0.4.7, Caddy v2.11.7, Tencent Cloud DNS v0.4.3 and golang.org/x/net v0.60.0. The [input lock](<../scripts/caddy-component-lock.json>) freezes source revisions and compiled dependency versions/checksums. Each build uses fresh private compiler AND module caches, normal Go checksum verification, source-origin checks and retained-module verification. Unknown dependencies, replacements, wrong native settings or compiler versions fail closed before executing the generated Caddy.
+The [builder](<https://github.com/saya-ch/dsh-mobile/blob/main/scripts/build-caddy-component.mjs>) fixes Go 1.26.9, xcaddy v0.4.7, Caddy v2.11.7, Tencent Cloud DNS v0.4.3 and golang.org/x/net v0.60.0. The [input lock](<https://github.com/saya-ch/dsh-mobile/blob/main/scripts/caddy-component-lock.json>) freezes source revisions and compiled dependency versions/checksums. Each build uses fresh private compiler AND module caches, normal Go checksum verification, source-origin checks and retained-module verification. Unknown dependencies, replacements, wrong native settings or compiler versions fail closed before executing the generated Caddy.
 
 Use the exact Go compiler (optionally through `GO_BINARY`); output directories must be new and absolute:
 
@@ -52,7 +52,7 @@ node scripts/build-caddy-component.mjs --output-dir /absolute/new/second
 node scripts/compare-caddy-builds.mjs --first /absolute/new/first --second /absolute/new/second --target linux-x64
 ```
 
-Windows uses native absolute paths and `--target win32-x64`. Reproducibility means identical executable bytes/size/SHA-256, not identical OS images or every rendered metadata/license file. The [workflow](<../.github/workflows/caddy-component.yml>) natively builds twice on Windows/Linux x64, validates complete evidence and tests the actually installed binary with an independent manifest. Tests cover real default inspection/promotion, no-redownload restart, corrupt-download rollback, TLS/pairing/API/WSS, durable device credentials and stopped-process owned cleanup while neighboring/pairing data survives. Other targets remain unreviewed.
+Windows uses native absolute paths and `--target win32-x64`. Reproducibility means identical executable bytes/size/SHA-256, not identical OS images or every rendered metadata/license file. The [workflow](<https://github.com/saya-ch/dsh-mobile/blob/main/.github/workflows/caddy-component.yml>) natively builds twice on Windows/Linux x64, validates complete evidence and tests the actually installed binary with an independent manifest. Tests cover real default inspection/promotion, no-redownload restart, corrupt-download rollback, TLS/pairing/API/WSS, durable device credentials and stopped-process owned cleanup while neighboring/pairing data survives. Other targets remain unreviewed.
 
 PR and normal dispatch runs are read-only review-artifact builds. Only an explicit manual opt-in on an existing `caddy-component-2.11.7-tencentcloud-0.4.3-review.N` tag in the authorized `abworks-dev/dsh-mobile` fork can publish a **TEST prerelease**, after both native jobs pass:
 
@@ -60,9 +60,9 @@ PR and normal dispatch runs are read-only review-artifact builds. Only an explic
 gh workflow run caddy-component.yml --repo abworks-dev/dsh-mobile --ref caddy-component-2.11.7-tencentcloud-0.4.3-review.1 -f publish_review_prerelease=true
 ```
 
-Component tags never start with `v`, avoiding the plugin release trigger. The separate write-permission job refuses occupied releases, creates a non-latest draft prerelease without asset clobbering, verifies an authenticated download of every draft asset against prepared bytes, then publishes. Assets include platform-distinct raw executables, manifests, build/module/version/license records, double-build proof, source-commit/run identity and SHA256SUMS. The [verifier](<../scripts/verify-caddy-release.mjs>) checks **every published asset** through GitHub metadata and the actual installer's HTTPS/validated-redirect downloader before emitting a review-only catalog. A failed post-publication check leaves the labelled prerelease public, fails the job and emits no catalog; it does not silently delete or roll back a release. Artifact retention is 14 days; release assets are separate.
+Component tags never start with `v`, avoiding the plugin release trigger. The separate write-permission job refuses occupied releases, creates a non-latest draft prerelease without asset clobbering, verifies an authenticated download of every draft asset against prepared bytes, then publishes. Assets include platform-distinct raw executables, manifests, build/module/version/license records, double-build proof, source-commit/run identity and SHA256SUMS. The [verifier](<https://github.com/saya-ch/dsh-mobile/blob/main/scripts/verify-caddy-release.mjs>) checks **every published asset** through GitHub metadata and the actual installer's HTTPS/validated-redirect downloader before emitting a review-only catalog. A failed post-publication check leaves the labelled prerelease public, fails the job and emits no catalog; it does not silently delete or roll back a release. Artifact retention is 14 days; release assets are separate.
 
-The public custom-download endpoint returned v2.11.7 when v2.11.6 was requested; dynamic latest downloads are not a trust source. Versioned GitHub URLs can still be replaced by repository owners: exact reviewed byte/hash pins, not URL spelling or a remotely supplied checksum alone, define the content boundary. A fork catalog is only a review candidate; it never automatically populates the [production table](<../src/caddy-component.ts>).
+The public custom-download endpoint returned v2.11.7 when v2.11.6 was requested; dynamic latest downloads are not a trust source. Versioned GitHub URLs can still be replaced by repository owners: exact reviewed byte/hash pins, not URL spelling or a remotely supplied checksum alone, define the content boundary. A fork catalog is only a review candidate; it never automatically populates the [production table](<https://github.com/saya-ch/dsh-mobile/blob/main/src/caddy-component.ts>).
 
 ### Official distribution and installation enablement