dsh-mobile 0.6.14 → 0.6.15

package/CHANGELOG.md

@@ -2,6 +2,22 @@
 
 Notable changes are recorded here. GitHub Releases provide the downloadable packages and generated commit notes.
 
+## 0.6.15 - 2026-10-21
+
+- Keep the dedicated Mobile page's plugin-update notifications connected during idle periods, without gzip buffering. Live module updates retain the mobile layout and the page's selected modules instead of replacing them with the desktop layout. Upgrade and reload the dedicated page to use the corrected stream; stock and older pages keep their existing behavior.
+- Retain authentication, expiry, revocation and cancellation checks for module notifications. A page view does not migrate to a new authentication Session: after native renewal, an old view can return `409 mobile_document_view_invalid` until the page is loaded again. This does not clear pairings or automatically refresh the current conversation. See [connection troubleshooting](docs/SLOW_CONNECTIONS.en.md#keep-event-streams-distinct).
+- Allow same-origin audio/video fetched into Blob URLs on the proxied DSH page. External media remains blocked, Gateway-owned pages retain their policy, and Android's media user-gesture requirement stays enabled.
+- Fix computer-side JSON management actions when Firefox privacy settings omit Origin. Keep local connection and Host checks, cross-origin rejection and official Desktop authentication. Thanks @axlrose for [#246](https://github.com/saya-ch/dsh-mobile/issues/246).
+- Add limited, credential-free diagnostics for the Gateway's authentication exchange with local DSH, separate from phone-side authorization failures.
+- Update development bundler dependencies to address Windows editor-launch security advisories; runtime authentication and model routing are unchanged.
+- Thanks @Void-LifeStream for the startup and reload report in [#243](https://github.com/saya-ch/dsh-mobile/issues/243). This release improves module updates and diagnostics; the complete reported symptom sequence remains unconfirmed.
+
+## Android 0.6.6 - 2026-10-21
+
+- Prevent repeated automatic recovery while renewal or Cookie installation is already pending, and serialize background restore work for the same credential until the previous worker exits.
+- Keep cancellation and the overall connection deadline effective for queued work and late results, without clearing existing pairing data.
+- Publish independently as App 0.6.6 (build 82). The pairing protocol and package identity remain unchanged; these native fixes require an App update and are not installed by updating the npm plugin.
+
 ## 0.6.14 - 2026-10-21
 
 - Defer touch-triggered history loading until the gesture settles, cancel pending loading when the reader leaves the top zone, and scope movement/settle events to the conversation scrollport. Withdraw an older refused loading intent when a new gesture begins. Retain @chintoleung's three original commits from [#239](https://github.com/saya-ch/dsh-mobile/pull/239) alongside maintainer regression fixes.

package/CONTRIBUTORS.md

@@ -4,6 +4,16 @@ GitHub 的 [Contributors 图表](https://github.com/saya-ch/dsh-mobile/graphs/co
 
 GitHub's Contributors graph counts commits on the default branch; issue reports and PR proposals cannot be manually added to it. This page credits community members by how they contributed, through 2026-10-21. The repository maintainer and automated dependency updates remain visible in GitHub's history.
 
+## 0.6.15 反馈 / Reports for 0.6.15
+
+感谢 [@axlrose](https://github.com/axlrose) 在 [#246](https://github.com/saya-ch/dsh-mobile/issues/246) 提供 Firefox 管理请求被拒的复现线索，促成 0.6.15 对缺少来源头场景的兼容与跨站拒绝测试。
+
+Thanks [@axlrose](https://github.com/axlrose) for the Firefox management-request rejection report in [#246](https://github.com/saya-ch/dsh-mobile/issues/246), informing compatibility for omitted source headers and cross-origin rejection tests in 0.6.15.
+
+感谢 [@Void-LifeStream](https://github.com/Void-LifeStream) 在 [#243](https://github.com/saya-ch/dsh-mobile/issues/243) 反馈启动、重载和会话显示问题，推动本轮模块通知、Android 自动恢复与诊断检查。插件 0.6.15 和 App 0.6.6 分别包含相关改进，不代表该报告中的全部现象已复现或解决。
+
+Thanks [@Void-LifeStream](https://github.com/Void-LifeStream) for reporting startup, reload and session-display problems in [#243](https://github.com/saya-ch/dsh-mobile/issues/243), prompting the module-notification, Android recovery and diagnostic investigation. Related improvements belong to plugin 0.6.15 and App 0.6.6 independently; not every reported symptom has been reproduced or resolved.
+
 ## 0.6.14 代码贡献与反馈 / Code contributions and reports for 0.6.14
 
 [@chintoleung](https://github.com/chintoleung) 的 [#239](https://github.com/saya-ch/dsh-mobile/pull/239) 将触摸历史自动加载延后至手势落定，并增加真实分页回归。0.6.14 保留原作者的三个提交，并追加维护者对滚动事件归属、新手势意图和混合输入的修正。感谢 [@gugubb5](https://github.com/gugubb5) 在 [#237](https://github.com/saya-ch/dsh-mobile/issues/237) 反馈侧栏入口共存问题，以及 [@faruzanCN](https://github.com/faruzanCN) 在 [#238](https://github.com/saya-ch/dsh-mobile/issues/238) 提出 IPv6 反代需求。

package/README.en.md

@@ -26,20 +26,20 @@
   <a href="#compatibility">Compatibility</a> ·
   <a href="docs/README.md">Documentation</a> ·
   <a href="#contributors">Contributors</a> ·
-  <a href="https://github.com/saya-ch/dsh-mobile/releases/tag/v0.6.14">Release notes</a> ·
+  <a href="https://github.com/saya-ch/dsh-mobile/releases/tag/v0.6.15">Release notes</a> ·
   <a href="README.md">简体中文</a>
 </p>
 
 > DSH Mobile is a DeepSeek Harness community plugin; the native app supports Android only.
 >
-> **Current stable release: 0.6.14**. Improve history-loading gestures and shared sidebar-footer entries, and support IPv6 loopback/ULA backends for an existing HTTPS reverse proxy. Android App **0.6.5** is unchanged and needs no matching update. [Release notes and downloads](https://github.com/saya-ch/dsh-mobile/releases/tag/v0.6.14) · [Full changelog](CHANGELOG.md).
+> **Current stable release: 0.6.15**. Improve mobile-page plugin-update notifications, support same-origin Blob media and management actions under Firefox privacy settings, and add connection diagnostics. Independently released Android App **0.6.6** improves automatic recovery and cancellation. [Plugin release notes and downloads](https://github.com/saya-ch/dsh-mobile/releases/tag/v0.6.15) · [Full changelog](CHANGELOG.md).
 >
 > **Version policy**: since plugin **0.6.2**, the Android app and plugin use independent version numbers and releases. Their numbers do not need to match, and a plugin update does not imply an app update. [Compatibility notes](#compatibility).
 
 <p align="center">
-  <a href="https://github.com/saya-ch/dsh-mobile/releases/download/android-v0.6.5/dsh-mobile-android-v0.6.5.apk"><img src="https://raw.githubusercontent.com/saya-ch/dsh-mobile/main/assets/brand/app-icon-rounded.svg" alt="DSH Mobile Android app icon" width="72" height="72"></a><br>
-  <a href="https://github.com/saya-ch/dsh-mobile/releases/download/android-v0.6.5/dsh-mobile-android-v0.6.5.apk"><strong>Download Android app 0.6.5</strong></a><br>
-  <sub><a href="https://github.com/saya-ch/dsh-mobile/releases/tag/android-v0.6.5">Release notes and checksums</a></sub>
+  <a href="https://github.com/saya-ch/dsh-mobile/releases/download/android-v0.6.6/dsh-mobile-android-v0.6.6.apk"><img src="https://raw.githubusercontent.com/saya-ch/dsh-mobile/main/assets/brand/app-icon-rounded.svg" alt="DSH Mobile Android app icon" width="72" height="72"></a><br>
+  <a href="https://github.com/saya-ch/dsh-mobile/releases/download/android-v0.6.6/dsh-mobile-android-v0.6.6.apk"><strong>Download Android app 0.6.6</strong></a><br>
+  <sub><a href="https://github.com/saya-ch/dsh-mobile/releases/tag/android-v0.6.6">Release notes and checksums</a></sub>
 </p>
 
 DSH Mobile is a DeepSeek Harness plugin that lets a mobile browser or the Android app connect over a protected LAN or an optional Tailscale Funnel, cpolar, cloudflared, self-hosted FRP, or own reverse-proxy remote path. Both routes reach the same sessions, Workspaces, messages, and tools. The computer manages their switches and pairing authorizations separately; the Android app lists paired computers together. The plugin does not modify DeepSeek Harness source.

package/README.md

@@ -26,20 +26,20 @@
   <a href="#兼容性">兼容性</a> ·
   <a href="docs/README.md">文档</a> ·
   <a href="#贡献者">贡献者</a> ·
-  <a href="https://github.com/saya-ch/dsh-mobile/releases/tag/v0.6.14">更新记录</a> ·
+  <a href="https://github.com/saya-ch/dsh-mobile/releases/tag/v0.6.15">更新记录</a> ·
   <a href="README.en.md">English</a>
 </p>
 
 > DSH Mobile 是 DeepSeek Harness 社区插件，原生 App 仅支持 Android。
 >
-> **当前正式版本：0.6.14**。改善历史消息加载手势与侧栏入口共存，支持自有反向代理的 IPv6 回环／ULA 后端。Android App **0.6.5** 保持不变，无需同步升级。[更新与下载](https://github.com/saya-ch/dsh-mobile/releases/tag/v0.6.14) · [完整更新记录](CHANGELOG.md)。
+> **当前正式版本：0.6.15**。改善移动页面的插件更新通知，兼容同源 Blob 音视频与 Firefox 隐私设置下的管理操作，并补充连接诊断。Android App **0.6.6** 独立发布，改善自动重连与取消。[插件更新与下载](https://github.com/saya-ch/dsh-mobile/releases/tag/v0.6.15) · [完整更新记录](CHANGELOG.md)。
 >
 > **版本说明**：自插件 **0.6.2** 起，Android App 与插件独立编号、独立发布，版本号无需一致；插件升级不代表 App 需要同步升级。[兼容说明](#兼容性)。
 
 <p align="center">
-  <a href="https://github.com/saya-ch/dsh-mobile/releases/download/android-v0.6.5/dsh-mobile-android-v0.6.5.apk"><img src="https://raw.githubusercontent.com/saya-ch/dsh-mobile/main/assets/brand/app-icon-rounded.svg" alt="DSH Mobile 安卓应用图标" width="72" height="72"></a><br>
-  <a href="https://github.com/saya-ch/dsh-mobile/releases/download/android-v0.6.5/dsh-mobile-android-v0.6.5.apk"><strong>下载 Android App 0.6.5</strong></a><br>
-  <sub><a href="https://github.com/saya-ch/dsh-mobile/releases/tag/android-v0.6.5">版本说明与校验文件</a></sub>
+  <a href="https://github.com/saya-ch/dsh-mobile/releases/download/android-v0.6.6/dsh-mobile-android-v0.6.6.apk"><img src="https://raw.githubusercontent.com/saya-ch/dsh-mobile/main/assets/brand/app-icon-rounded.svg" alt="DSH Mobile 安卓应用图标" width="72" height="72"></a><br>
+  <a href="https://github.com/saya-ch/dsh-mobile/releases/download/android-v0.6.6/dsh-mobile-android-v0.6.6.apk"><strong>下载 Android App 0.6.6</strong></a><br>
+  <sub><a href="https://github.com/saya-ch/dsh-mobile/releases/tag/android-v0.6.6">版本说明与校验文件</a></sub>
 </p>
 
 DSH Mobile 是一个 DeepSeek Harness 插件，让手机浏览器或 Android App 通过局域网，或可选的 Tailscale Funnel、cpolar、cloudflared、自建 FRP 或自有反向代理远程通道连接电脑，继续使用同一份会话、工作区、消息和工具。电脑端分别启停局域网与远程访问、分别管理配对授权；Android App 统一显示已配对电脑。插件不修改 DeepSeek Harness 源码。

package/SECURITY.md

@@ -18,7 +18,9 @@ The maintainer will acknowledge a complete report within seven days. Publication
 
 - Keep the ordinary DSH Web listener on loopback.
 - Expose only the plugin-owned HTTPS listener to the LAN.
-- The desktop admin API may accept an RFC1918 or IPv4 link-local Host only when the TCP peer is loopback, for a trusted local reverse proxy or headless host. Do not publicly forward `/api/mobile-access`; Host and loopback checks are not a replacement for proxy access control. Mutating admin requests require a same-origin `Origin` header, except official DSH Desktop requests: its forwarder strips `Origin` and `Sec-Fetch-Site` and supplies a signed Host browser-session Cookie, so the plugin client sends an exact non-simple marker that survives forwarding. The plugin requires both that marker and Connection's successful browser-session verification before accepting an Origin-less write.
+- The desktop admin API may accept an RFC1918 or IPv4 link-local Host only when the TCP peer is loopback, for a trusted local reverse proxy or headless host. Do not publicly forward `/api/mobile-access`; Host and loopback checks are not a replacement for proxy access control.
+- Mutating Web admin requests normally require a same-origin `Origin`. When a browser omits it, the plugin accepts only a JSON POST with its exact non-simple Web marker and absent or `same-origin` Fetch Metadata. Explicit foreign Origins/sites remain rejected. This marker is not a credential: its CSRF protection relies on browser CORS enforcement and the management prefix refusing OPTIONS without CORS permission. A trusted reverse proxy must not answer allowed CORS preflights or inject CORS authorization for `/api/mobile-access`.
+- Official DSH Desktop uses a separate path: its forwarder strips `Origin` and `Sec-Fetch-Site` and supplies a signed Host browser-session Cookie. The plugin requires both its separate Desktop marker and Connection's successful browser-session verification before accepting an Origin-less Desktop write. The Web marker cannot replace that authentication.
 ### Discovery, pairing and TLS
 
 - DNS-SD/mDNS, periodic UDP announcements, active UDP query replies, and HTTPS discovery return only the device name, public HTTPS origin, port, protocol version, and stable non-secret installation identifier. Discovery never returns the CA, a pairing key, a device token, Cookies, credentials, or private configuration.
@@ -70,6 +72,7 @@ The maintainer will acknowledge a complete report within seven days. Publication
 ### Framed content and browser policy
 
 - Proxied GUI responses allow HTTP iframe sources for compatibility with community surfaces. HTTP content is unauthenticated and unencrypted; Android still blocks mixed HTTP content inside HTTPS pages, and browsers may block it too. Prefer HTTPS and do not treat a gateway framing allowance as a transport-security guarantee.
+- Proxied GUI responses allow same-origin and Blob audio/video through `media-src 'self' blob:`; Gateway-owned login and pairing pages do not gain Blob media permission. External media and connections remain restricted. This permits a trusted page plugin to play a same-origin file fetched into an object URL; it does not bypass browser codec support or autoplay rules. Android retains its media user-gesture requirement. Media plugins should provide a visible poster and a user-initiated playback fallback rather than assume autoplay always succeeds.
 
 ## Known limitation
 

package/THIRD_PARTY_NOTICES.md

@@ -16,7 +16,7 @@ The optional [cloudflared](https://github.com/cloudflare/cloudflared) client is
 
 The optional managed Caddy component is not included in the npm package or Android App. Since plugin 0.6.9, users on Windows/Linux x64 can explicitly confirm an on-demand download of the fixed [DSH Mobile component distribution](https://github.com/saya-ch/dsh-mobile/releases/tag/caddy-component-2.11.7-tencentcloud-0.4.3-r1); its source, exact size and SHA-256 are pinned in the plugin. This distribution builds [Caddy v2.11.7](https://github.com/caddyserver/caddy/blob/v2.11.7/LICENSE), under Apache License 2.0, with [caddy-dns/tencentcloud v0.4.3](https://github.com/caddy-dns/tencentcloud/blob/v0.4.3/LICENSE), under the MIT License. The component release supplies each platform's exact embedded dependency manifest, Go build metadata and complete third-party license/notice texts as separate assets. It is a DSH Mobile build, not an upstream Caddy release or a dynamically generated download. Existing user-managed proxies are separate from this optional component.
 
-The npm package declares direct runtime dependencies on [Schemastery](https://github.com/shigma/schemastery) `^3.18.1`, [@noble/hashes](https://github.com/paulmillr/noble-hashes) `1.8.0`, [bonjour-service](https://github.com/onlxltd/bonjour-service) `1.4.4`, [qrcode](https://github.com/soldair/node-qrcode) `^1.5.4`, [selfsigned](https://github.com/jfromaniello/selfsigned) `^5.5.0`, and [ws](https://github.com/websockets/ws) `8.22.0`. These packages are distributed under the MIT License; the release checkout's exact transitive versions appear in the attached CycloneDX npm SBOM.
+The npm package declares direct runtime dependencies on [Schemastery](https://github.com/shigma/schemastery) `^3.18.1`, [@noble/hashes](https://github.com/paulmillr/noble-hashes) `1.8.0`, [bonjour-service](https://github.com/onlxltd/bonjour-service) `1.4.4`, [eventsource-parser](https://github.com/rexxars/eventsource-parser) `3.1.0`, [qrcode](https://github.com/soldair/node-qrcode) `^1.5.4`, [selfsigned](https://github.com/jfromaniello/selfsigned) `^5.5.0`, and [ws](https://github.com/websockets/ws) `8.22.0`. These packages are distributed under the MIT License; the release checkout's exact transitive versions appear in the attached CycloneDX npm SBOM.
 
 The Android App runtime contains [Kotlin standard library](https://github.com/JetBrains/kotlin) `2.1.0`, [kotlinx.coroutines](https://github.com/Kotlin/kotlinx.coroutines) `1.6.4`, [JetBrains annotations](https://github.com/JetBrains/java-annotations) `13.0`, [AndroidX Core](https://developer.android.com/jetpack/androidx/releases/core) `1.15.0`, [AndroidX WebKit](https://developer.android.com/jetpack/androidx/releases/webkit) `1.17.1`, their AndroidX transitive components, [Guava listenablefuture](https://github.com/google/guava) `1.0`, and [ZXing Core](https://github.com/zxing/zxing) `3.5.4`. These runtime libraries are distributed under the Apache License 2.0; the exact resolved tree is attached to each release as `dsh-mobile-android-v<version>-dependencies.txt`.
 
@@ -48,9 +48,37 @@ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
 THE SOFTWARE.
 ```
 
+## Event-stream parsing
+
+The Gateway uses eventsource-parser for Server-Sent Events framing. Its MIT license is included below:
+
+```text
+MIT License
+
+Copyright (c) 2026 Espen Hovlandsdal <espen@hovlandsdal.com>
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+```
+
 ## core-js browser compatibility bundle
 
-The standalone `lib/mobile-compat.js` bundles selected Iterator and `Promise.withResolvers` modules from [core-js](https://github.com/zloirock/core-js) `^3.50.0` (exact version recorded in `package-lock.json`). It is built into the npm package; browsers do not download a polyfill from a CDN. core-js is distributed under the following MIT License:
+The standalone `lib/mobile-compat.js` bundles selected compatibility modules, including Iterator, `Promise.withResolvers`, collection methods and structured cloning, from [core-js](https://github.com/zloirock/core-js) `^3.50.0` (exact version recorded in `package-lock.json`). It is built into the npm package; browsers do not download a polyfill from a CDN. core-js is distributed under the following MIT License:
 
 ```text
 Copyright (c) 2013–2025 Denis Pushkarev (zloirock.ru)

package/apps/mobile/README.md

@@ -4,14 +4,14 @@
 
 DeepSeek Harness is the display name of this community-maintained Android WebView app. It opens the plugin's authenticated HTTPS page rather than bundling another DSH frontend. The app and mobile browsers receive the same DSH features and computer-side mobile customizations.
 
-The current stable app is **0.6.5** (build 81). The npm plugin and Android App have independent versions: a plugin update does not automatically require another APK. See the [0.6.5 changes](#065-update).
+The current stable app is **0.6.6** (build 82). The npm plugin and Android App have independent versions: a plugin update does not automatically require another APK. See the [0.6.6 changes](#066-update).
 
 Android 10 or later is supported. The local iOS experiment is not a published or supported client.
 
 ## Install and pair
 
 1. Install and enable the plugin using the [project quick start](../../README.en.md#quick-start). Complete LAN setup from the command line or the computer's **Mobile Access** panel.
-2. Install the signed Android APK from [GitHub Releases](https://github.com/saya-ch/dsh-mobile/releases/tag/android-v0.6.5). Upgrade an official installation in place using the same release signer to retain its pairings. A differently signed Debug APK cannot replace it; do not uninstall or clear data just to bypass that mismatch.
+2. Install the signed Android APK from [GitHub Releases](https://github.com/saya-ch/dsh-mobile/releases/tag/android-v0.6.6). Upgrade an official installation in place using the same release signer to retain its pairings. A differently signed Debug APK cannot replace it; do not uninstall or clear data just to bypass that mismatch.
 3. On the computer, generate a pairing key/link under **Mobile Access → Local network**, or configure a remote provider and generate its remote pairing QR code. In the app, choose the matching connection mode and scan or paste the link.
 4. Name the computer. The app stores each LAN or remote pairing as its own record. The phone does not need a cpolar, Cloudflare or Tailscale app.
 
@@ -35,6 +35,12 @@ Page zoom changes the whole page and is separate from per-address text preferenc
 
 Deleting a local record removes its saved token and pinned CA, not the computer's authorization or every short-lived WebView cookie. Use **Mobile Access** on the computer to revoke access immediately. A full Android clear-app-data reset removes all pairings and web data and is not a normal reconnection step.
 
+## 0.6.6 update
+
+Android 0.6.6/build 82 prevents repeated automatic recovery while renewal or Cookie installation is already pending. Background restore work for the same credential waits for the previous worker to exit instead of overlapping it.
+
+Cancellation and the connection deadline withdraw queued work and late results so an older recovery cannot replace a newer action. Existing pairings, package identity and the pairing protocol are unchanged; no data reset or re-pairing is required for this update. Network availability and recovery of an unsaved webpage still depend on the connection and WebView state.
+
 ## 0.6.5 update
 
 Android 0.6.5/build 81 adds an immediate **Cancel connection** action during startup, saved-computer connection, LAN scanning and pairing. Cancellation returns to the device list or editable form without deleting existing pairings. **Stop reconnecting** retains a usable DSH page; a blank or failed document returns to the list.
@@ -120,12 +126,12 @@ Set-Location apps/mobile/android
 
 The Debug APK is `app/build/outputs/apk/debug/app-debug.apk`. Official releases use the established signing key stored only in repository Secrets. A local unsigned Release build or a Debug install is not official-signer evidence.
 
-The verified stable release is [Android 0.6.5](https://github.com/saya-ch/dsh-mobile/releases/tag/android-v0.6.5), SHA-256 `41bd476c5ccf90020ecf624844a29886d55060a79533b599e9aa5bf0a1d71844`. Earlier release history belongs in [CHANGELOG](../../CHANGELOG.md).
+The verified stable release is [Android 0.6.6](https://github.com/saya-ch/dsh-mobile/releases/tag/android-v0.6.6), build 82, SHA-256 `a63fb40da261d290d4435d713258b508be3e4f0592d223a325dca1a5b32f3c95`. The downloaded APK retains the established release signer and package `io.github.sayach.dshmobile`. Earlier release history belongs in [CHANGELOG](../../CHANGELOG.md).
 
 ## Acceptance and known limits
 
 - Connection-control development builds used Debug metadata 0.6.4/build 80 on PJW110, Android 16 and Google WebView 153.0.8010.36. Against an isolated DSH 0.2.0-rc.2/plugin 0.6.10 instance over USB and pinned HTTPS, checks covered pairing/startup/saved-connection cancellation, Back, failed manual connections and return from a failed page after stopping native recovery. Held module responses also verified early webpage display, touch-through outside compact cancellation, cancellation and later completion. Pairings were retained and owned QA records removed.
 - Debug builds of App 0.6.4 retained one WebView across document replacement/reload, rejected an old selection, and received controlled PNG bytes with a decoded DSH draft preview. A held navigation and HTTP 204 also checked selector availability. Earlier checks covered model-menu Back, rotation with draft/reference/image retention, known revocation, re-pairing, icon choices and list ordering. None required a model prompt.
-- These observations do not establish final 0.6.5/build 81 official-signer device acceptance, every public provider, remote 60-second timing, full native recovery with a still-live draft, HyperOS/older WebViews or every screen/gesture configuration. Self-signed FRP still lacks a recorded real-VPS-plus-phone end-to-end check. Permission grants alone do not establish voice transcription, and process-death restoration is not guaranteed.
+- These observations do not establish final official-signer APK device acceptance, every public provider, remote 60-second timing, full native recovery with a still-live draft, HyperOS/older WebViews or every screen/gesture configuration. Self-signed FRP still lacks a recorded real-VPS-plus-phone end-to-end check. Permission grants alone do not establish voice transcription, and process-death restoration is not guaranteed.
 
 Apache-2.0 licensed. See [LICENSE](../../LICENSE).

package/apps/mobile/README.zh-CN.md

@@ -4,14 +4,14 @@
 
 DeepSeek Harness 是这个社区维护的 Android WebView App 的显示名称。它直接打开插件提供的已认证 HTTPS 页面，不打包另一套 DSH 前端；App 与手机浏览器获得相同的 DSH 功能，以及电脑端配置的移动页面定制。
 
-当前正式 App 为 **0.6.5**；构建号为 81。npm 插件与 Android App 独立编号、独立更新；插件升级不代表需要重新安装 APK。此次改进见 [0.6.5 更新](#065-更新)。
+当前正式 App 为 **0.6.6**；构建号为 82。npm 插件与 Android App 独立编号、独立更新；插件升级不代表需要重新安装 APK。此次改进见 [0.6.6 更新](#066-更新)。
 
 支持 Android 10 及以上系统。iOS 本地实验不属于已发布或受支持的客户端。
 
 ## 安装与配对
 
 1. 按[项目快速开始](../../README.md#快速开始)安装并启用插件。局域网配置可通过命令行或电脑端的 **移动访问** 面板完成。
-2. 从 [GitHub Releases](https://github.com/saya-ch/dsh-mobile/releases/tag/android-v0.6.5) 安装已签名 APK。正式版沿用相同发布签名，可原位升级并保留配对；不同签名的 Debug 包不能直接覆盖正式版，不要为绕过签名不匹配而卸载或清除数据。
+2. 从 [GitHub Releases](https://github.com/saya-ch/dsh-mobile/releases/tag/android-v0.6.6) 安装已签名 APK。正式版沿用相同发布签名，可原位升级并保留配对；不同签名的 Debug 包不能直接覆盖正式版，不要为绕过签名不匹配而卸载或清除数据。
 3. 在电脑 **移动访问 → 局域网访问** 中生成密钥／配对链接，或配置远程通道并生成远程配对二维码。在 App 选择对应方式，扫码或粘贴链接。
 4. 为电脑命名。每条局域网或远程配对单独保存；手机无需安装 cpolar、Cloudflare 或 Tailscale App。
 
@@ -35,6 +35,12 @@ DeepSeek Harness 是这个社区维护的 Android WebView App 的显示名称。
 
 删除本机记录会移除保存的设备令牌和固定 CA，不等于撤销电脑授权或清除所有 WebView 短期 Cookie。需要立即终止访问时，请在电脑的 **移动访问** 中撤销设备。Android“清除应用数据”会删除全部配对和网页数据，不是普通重连的处理步骤。
 
+## 0.6.6 更新
+
+Android 0.6.6／构建 82 避免续期或安装 Cookie 尚未完成时重复触发自动恢复。同一凭据的后台恢复会等待上一项任务真正退出，不再重叠执行。
+
+取消和连接总期限会撤销排队任务及迟到结果，避免旧恢复覆盖新的操作。已有配对、包名和配对协议保持不变，升级无需清除数据或重新配对；网络是否可达、未保存网页能否恢复，仍取决于连接与 WebView 状态。
+
 ## 0.6.5 更新
 
 Android 0.6.5／构建 81 在启动连接、已配对电脑连接、局域网扫描和配对过程中均提供立即可用的 **取消连接**。取消后回到设备列表或可编辑表单，不删除原有配对；**停止重连**保留仍可用的 DSH 页面，空白或失效文档则返回列表。
@@ -120,12 +126,12 @@ Set-Location apps/mobile/android
 
 Debug APK 位于 `app/build/outputs/apk/debug/app-debug.apk`。正式发布沿用只保存在仓库 Secrets 中的签名密钥，本地未签名 Release 构建或 Debug 安装不能替代正式签名核验。
 
-已核验的正式版本为 [Android 0.6.5](https://github.com/saya-ch/dsh-mobile/releases/tag/android-v0.6.5)，SHA-256：`41bd476c5ccf90020ecf624844a29886d55060a79533b599e9aa5bf0a1d71844`。旧版本历史集中在 [CHANGELOG](../../CHANGELOG.md)。
+已核验的正式版本为 [Android 0.6.6](https://github.com/saya-ch/dsh-mobile/releases/tag/android-v0.6.6)，构建 82，SHA-256：`a63fb40da261d290d4435d713258b508be3e4f0592d223a325dca1a5b32f3c95`。下载的 APK 沿用正式发布签名及包名 `io.github.sayach.dshmobile`。旧版本历史集中在 [CHANGELOG](../../CHANGELOG.md)。
 
 ## 验收与已知限制
 
 - 连接控制的开发包使用 Debug 元数据 0.6.4／构建 80，在 PJW110、Android 16、Google WebView 153.0.8010.36 上，通过 USB 和固定 CA 的 HTTPS 连接隔离的 DSH 0.2.0-rc.2／插件 0.6.10。检查了配对／启动／已保存连接取消、系统返回、手动失败收尾，以及停止原生恢复后从失效页面返回；暂停模块响应时也验证了提前露出网页、非按钮区域触摸透传、取消和放行后完成。原配对保留，临时 QA 记录已清理。
 - App 0.6.4 的 Debug 构建在同一 WebView 中覆盖文档替换／刷新、拒绝旧选择、接收受控 PNG 字节并形成已解码草稿预览；还检查了暂停导航及 HTTP 204 后选择器的可用性。更早的检查覆盖模型菜单返回、旋转保留草稿／引用／图片、已知撤销、重新配对、图标选择与列表顺序，均未发送模型请求。
-- 这些观察不代表最终 0.6.5／构建 81 正式签名 APK 已完成真机验收，也不覆盖所有公网提供方、远程 60 秒期限、保留活动草稿的完整原生恢复、HyperOS／旧 WebView 或所有屏幕／手势组合。自签 FRP 尚无真实 VPS 加手机的端到端验收记录；权限授予不代表语音转写成功，进程终止后的状态恢复也不作保证。
+- 这些观察不代表最终正式签名 APK 已完成真机验收，也不覆盖所有公网提供方、远程 60 秒期限、保留活动草稿的完整原生恢复、HyperOS／旧 WebView 或所有屏幕／手势组合。自签 FRP 尚无真实 VPS 加手机的端到端验收记录；权限授予不代表语音转写成功，进程终止后的状态恢复也不作保证。
 
 Apache-2.0 licensed. See [LICENSE](../../LICENSE).

package/apps/mobile/release.json

@@ -1,5 +1,5 @@
 {
-  "version": "0.6.5",
-  "versionCode": 81,
-  "releaseTag": "android-v0.6.5"
+  "version": "0.6.6",
+  "versionCode": 82,
+  "releaseTag": "android-v0.6.6"
 }

package/docs/SLOW_CONNECTIONS.en.md

@@ -20,6 +20,12 @@ Both [#126](https://github.com/saya-ch/dsh-mobile/issues/126) and [#146](https:/
 
 Plugin 0.6.11 and later write limited `auth failure` HTTP diagnostics to the plugin log (`$DSH_HOME/mobile-access/logs/dsh-mobile.log`): authorization versus CSRF rejection, status, method, a safe route or route category, related Cookie/header presence and counts, normalized Origin and recognized fetch-site values. It omits tokens, Cookie values, query strings and arbitrary original paths. Each Gateway rate-limits its two categories separately: the first event is immediate and same-category rejections aggregate within a 30-second window; `suppressed` counts previously suppressed records of that category, not all requests or only the current path. This helps investigate missing credentials and CSRF failures; it does not automatically repair a 401/403. The absence of a record does not establish successful authentication: earlier Host/Origin rejections, WebSocket upgrades and native pairing/renewal are outside these two recording points. Review logs before sharing them.
 
+### Internal authentication exchange diagnostics (plugin 0.6.15+)
+
+`upstream auth` records the Gateway's internal Cookie exchange with local DSH separately from a phone request's `auth failure`. Each entry contains only the Gateway-local exchange `sequence`, `stage`, fixed `outcome`, `durationMs` and the upstream HTTP `status` after response headers arrive; this is not the phone-facing status. `accepted` means the strict 303, Cookie and expiry checks passed. Other outcomes distinguish an invalid target, unexpected status, invalid Cookie, timeout or transport failure. Logs omit the internal launch URL, Tokens, Cookie names and values, response bodies and raw errors.
+
+Success and failure each have one fixed sampling slot: the first result is immediate, then at most one per 30 seconds, with `suppressed` counting earlier omitted exchanges of that category. Concurrent requests sharing an exchange produce one record; cached Cookie use produces none. Sequences correlate only within one Gateway instance and are not device identifiers. Absence of a record establishes neither authentication nor successful frontend startup, and these logs cannot determine whether Session data was damaged.
+
 ## HTTP 400, 408 and 431 (plugin 0.6.13+)
 
 Plugin 0.6.13 and later distinguish request receive timeouts as `408 request_timeout` and oversized headers as `431 headers_too_large`; other malformed HTTP requests remain `400 bad_request`. Older versions may return 400 with the same short JSON for all of them, so a status and a 24-byte body do not identify the cause.
@@ -32,6 +38,10 @@ The `http failure` diagnostics distinguish three per-Gateway categories: `parser
 
 In DSH 0.2.0-rc.2, `/plugins/events` is the SSE stream for plugin-module graph and build updates, not conversation-message delivery. Its `200` response, small body or repeated reconnects alone cannot establish successful delivery, failure or a missing processing animation. Inspect the `/api/remote.mux` WebSocket and the actual HTTP request for that operation as well.
 
+Plugin 0.6.15 and later repair the idle cutoff and gzip buffering for new dedicated Mobile pages supporting the authenticated transport. The page identifies its current authorized view when requesting module events; only a bodyless `GET /plugins/events` with an actual `200 text/event-stream` response uses `upstreamApiTimeoutMs` for later frames. Event graphs use the same layout, dependency and module-selection projection as the initial Mobile page, rather than replacing the running Mobile layout with the raw desktop graph. Newly saved module choices still apply on the next page load. Connection/header deadlines, authentication, revocation, cancellation and concurrency limits remain. An expired view stops notifications rather than falling back to the raw graph or automatically refreshing the Session. Old pages and `frontend=stock` do not enable this projection; reload the dedicated page after upgrading to use it. This repair does not establish the cause of every startup or reload symptom in [#243](https://github.com/saya-ch/dsh-mobile/issues/243).
+
+A page view does not migrate to a new authentication Session. Native renewal may retain the WebView and draft without restoring the old module-event stream. A new Session using the old view receives `409 mobile_document_view_invalid`; loading the dedicated page again obtains a new view. This does not require removing a pairing or automatically refresh the current Session.
+
 An ordinary message bubble and cleared draft can precede `POST /api/session/prompt`: they are an optimistic local echo, not Host acceptance. If no corresponding request appears, retain redacted request timing, status codes and DSH logs to distinguish a request never started by the browser, proxy rejection and Host acceptance. The plugin does not automatically replay messages, approvals or other writes; check the Session before retrying an operation with an unknown outcome.
 
 ## Slow transfers can exceed the default deadlines
@@ -106,7 +116,7 @@ Resources without upstream validators do not automatically acquire a reliable on
 
 Commands such as `/compact` sent from the phone traverse the Mobile gateway's HTTP API. Automatic compaction inside DSH does not traverse that gateway request. Older gateways used the default 30-second `upstreamTimeoutMs` for every proxied request, so manual compaction could return `502 upstream_unavailable` while the model was still producing the summary. [#171](https://github.com/saya-ch/dsh-mobile/issues/171) records this case.
 
-The gateway now separates transport waits from authenticated API response waits. `upstreamTimeoutMs` still defaults to 30000 milliseconds (1000–300000) for uploads, static assets, boot resources, and WebSocket handshakes; incoming request headers retain their existing 10-second deadline. Only `/api` and `/api/…` HTTP requests that pass device authentication, Host/Origin checks, and any required CSRF check switch to `upstreamApiTimeoutMs` after the request body is sent to DSH. The new field defaults to `0`, disabling the API response idle timeout. To set a limit, use an integer from `1` through `2147483647` milliseconds; the upper limit is Node's timer representation limit. This is not a total execution deadline: arriving response data resets the idle timer.
+The gateway separates transport waits from authenticated API response waits. `upstreamTimeoutMs` still defaults to 30000 milliseconds (1000–300000) for uploads, static assets, boot resources, and WebSocket handshakes; incoming request headers retain their existing 10-second deadline. `/api` and `/api/…` HTTP requests that pass device authentication, Host/Origin checks, and any required CSRF check switch to `upstreamApiTimeoutMs` after the request body is sent to DSH. The field defaults to `0`, disabling these response idle timeouts. To set a limit, use an integer from `1` through `2147483647` milliseconds; the upper limit is Node's timer representation limit. Plugin 0.6.15 and later also apply it to dedicated module-event streams after valid response headers, under the event-stream conditions above. This is not a total execution deadline: arriving response data resets the idle timer.
 
 Add the property below to the existing `mobile-access` entry's `config` and keep all other settings. This is a configuration fragment, not a complete profile patch. `0` is the default; this example sets a 10-minute API response idle timeout:
 

package/docs/SLOW_CONNECTIONS.md

@@ -20,6 +20,12 @@
 
 插件 0.6.11 起会在插件日志（`$DSH_HOME/mobile-access/logs/dsh-mobile.log`）记录有限的 `auth failure` HTTP 诊断：区分授权与 CSRF 拒绝，包含状态、方法、安全路径或路径类别、相关 Cookie／请求头是否存在及计数、规范化 Origin 和受支持的 fetch-site 值，不记录令牌、Cookie 值、查询参数或任意原始路径。每个网关的两类诊断分别限频，首条立即记录，30 秒窗口内同类拒绝聚合；`suppressed` 表示此前被抑制的同类记录数量，不是全部请求数，也不限定于当前路径。它帮助排查凭据未携带或 CSRF 校验失败，不会自动修复 401／403。没有日志也不代表认证成功：更早的 Host／Origin 拒绝、WebSocket 升级和原生配对／续期不在这两处记录范围内。分享前仍应检查日志。
 
+### 内部认证交换诊断（插件 0.6.15 起）
+
+`upstream auth` 单独记录网关向本机 DSH 交换内部认证 Cookie 的结果，不是手机请求的 `auth failure`。每条只包含该网关内的交换序号 `sequence`、阶段 `stage`、固定结果 `outcome`、耗时 `durationMs`，以及收到响应头后才有的上游 HTTP `status`；这个状态不是手机最终收到的状态。`accepted` 表示严格通过 303、Cookie 和有效期检查；其他结果区分目标配置无效、状态不符、Cookie 无效、超时或传输失败。不记录内部启动地址、Token、Cookie 名称或值、响应正文及原始错误。
+
+成功与失败分别最多每 30 秒记录一条，首条立即记录，`suppressed` 计入此前同类被抑制的交换。并发请求共用一次交换时只记录一次，使用缓存 Cookie 时不新增记录；序号仅在同一个网关实例内关联，不是设备标识。没有记录不能证明该次请求认证或页面启动成功，也不能用这类日志判断会话数据是否损坏。
+
 ## HTTP 400、408 与 431 的区别（插件 0.6.13 起）
 
 插件 0.6.13 起把请求接收超时区分为 `408 request_timeout`，请求头过大区分为 `431 headers_too_large`；其他非法 HTTP 请求仍为 `400 bad_request`。旧版可能把这几类情况都返回成 400 和相同的短 JSON，因此状态码与“24 字节”不足以定位原因。
@@ -32,6 +38,10 @@
 
 在 DSH 0.2.0-rc.2 中，`/plugins/events` 是插件模块图和构建更新的 SSE，不是对话消息投递通道。它返回 `200`、传输很少字节或反复重连，不能单独证明消息发送成功、失败或处理中动画丢失；同时检查 `/api/remote.mux` WebSocket 与那次操作实际发出的 HTTP 请求。
 
+插件 0.6.15 起为支持认证传输的新专用移动页面修复该通知流的静默超时和 gzip 缓冲：页面以绑定当前授权的标识请求模块事件，网关只在无请求体的 `GET /plugins/events` 收到 `200 text/event-stream` 后按 `upstreamApiTimeoutMs` 等待后续帧。通知中的模块图使用与初始移动页面相同的布局、依赖与模块选择投影，不能用桌面原始模块图替换正在运行的移动布局；保存的新选择仍在下一次加载页面时应用。建连和首响应期限、鉴权、撤销、取消及并发限制不变，标识失效时终止通知，不退回原始模块图或自动刷新会话。旧页面与 `frontend=stock` 不启用这套投影；升级后重新加载专用页面才能使用新通知流。这项修复不代表 [#243](https://github.com/saya-ch/dsh-mobile/issues/243) 的所有启动和重载现象已定位。
+
+页面标识不会迁移到新的认证 Session：原生续期即使保留了当前 WebView 和草稿，也不代表旧模块通知流已恢复。新 Session 使用旧标识会收到 `409 mobile_document_view_invalid`；重新加载专用页面会取得新标识。这个限制不要求删除配对，也不会主动刷新当前会话。
+
 普通消息的气泡和清空草稿可能先于 `POST /api/session/prompt`，属于本地乐观回显，不是 Host 受理确认。若找不到对应请求，请保留脱敏后的请求时序、状态码及 DSH 日志，区分浏览器未发起、代理拒绝与 Host 已受理。插件不会自动重放消息、审批或其他写请求；结果不明时先确认会话，避免重复副作用。
 
 ## 慢速传输可能超过默认等待时间
@@ -106,7 +116,7 @@ websocketCompression:
 
 手机发出的 `/compact` 等命令要通过移动网关的 HTTP API；DSH 内部触发的自动压缩不经过这次网关请求。旧版网关对所有上游代理请求都使用默认 30 秒的 `upstreamTimeoutMs`，因此模型仍在生成摘要时，手动压缩可能先收到 `502 upstream_unavailable`。[#171](https://github.com/saya-ch/dsh-mobile/issues/171) 记录了这一情况。
 
-当前网关区分传输等待和已鉴权 API 的响应等待。`upstreamTimeoutMs` 仍默认 30000 毫秒（1000–300000），用于上传、静态资源、启动资源和 WebSocket 握手的等待；请求头另有既有的 10 秒接收期限。只有完成设备鉴权、Host/Origin 与必要 CSRF 检查的 `/api` 和 `/api/…` HTTP 请求，在请求体发往 DSH 后切换到 `upstreamApiTimeoutMs`。新字段默认 `0`，表示不对 API 响应施加空闲超时；需要限制时，可配置为 `1–2147483647` 的整数毫秒，范围上限来自 Node 定时器的表示范围。这不是整个操作的总执行期限：持续到达的响应数据会重置空闲计时。
+当前网关区分传输等待和已鉴权 API 的响应等待。`upstreamTimeoutMs` 仍默认 30000 毫秒（1000–300000），用于上传、静态资源、启动资源和 WebSocket 握手的等待；请求头另有既有的 10 秒接收期限。完成设备鉴权、Host/Origin 与必要 CSRF 检查的 `/api` 和 `/api/…` HTTP 请求，在请求体发往 DSH 后切换到 `upstreamApiTimeoutMs`。该字段默认 `0`，表示不对这些响应施加空闲超时；需要限制时，可配置为 `1–2147483647` 的整数毫秒，范围上限来自 Node 定时器的表示范围。插件 0.6.15 起，专用模块事件流在收到有效响应头后也使用此字段，适用条件见上面的通知流说明。这不是整个操作的总执行期限：持续到达的响应数据会重置空闲计时。
 
 以下属性放进现有 `mobile-access` 条目的 `config`，并保留其他配置；这是配置片段，不是完整的 profile 补丁。`0` 是默认值，示例为 API 响应设置 10 分钟的空闲等待期限：
 

package/lib/client.js

@@ -6001,12 +6001,17 @@ window.__ModuleLoader__.load({
 		/** Browser-safe desktop-admin Host checks. Do not import Node APIs here. */
 		const DESKTOP_ADMIN_HEADER = "x-dsh-mobile-desktop-admin";
 		const DESKTOP_ADMIN_MARKER = "dsh-app://app";
-		/** Add the forwarded Desktop marker only to this plugin's mutating admin requests. */
+		/** Non-simple source marker for this plugin's same-origin JSON management actions. */
+		const WEB_ADMIN_HEADER = "x-dsh-mobile-web-admin";
+		const WEB_ADMIN_MARKER = "same-origin-json";
+		/** Attach separate Desktop/Web source markers only to matching mutating admin requests. */
 		function localAdminRequestHeaders(init, location) {
 			const headers = new Headers(init?.headers);
 			if (!headers.has("content-type")) headers.set("content-type", "application/json");
 			headers.delete(DESKTOP_ADMIN_HEADER);
+			headers.delete(WEB_ADMIN_HEADER);
 			if (init?.method?.toUpperCase() === "POST" && location.protocol === "dsh-app:" && location.hostname === "app") headers.set(DESKTOP_ADMIN_HEADER, DESKTOP_ADMIN_MARKER);
+			else if (init?.method?.toUpperCase() === "POST" && (location.protocol === "http:" || location.protocol === "https:") && isLocalAdminHostname(location.hostname) && headers.get("content-type")?.split(";", 1)[0]?.trim().toLowerCase() === "application/json") headers.set(WEB_ADMIN_HEADER, WEB_ADMIN_MARKER);
 			return headers;
 		}
 		function unwrapBrackets(hostname) {