dsh-mobile 0.6.14 → 0.6.16

package/CHANGELOG.md

@@ -2,6 +2,38 @@
 
 Notable changes are recorded here. GitHub Releases provide the downloadable packages and generated commit notes.
 
+## 0.6.16 - 2026-10-22
+
+- Support App 0.6.7's optional same-computer LAN/remote switching with authenticated installation grouping and limited same-Session plain-text draft transfer through public DSH APIs. Independently paired endpoints keep separate credentials and CA pins; conflicts and unsupported editor state are not silently migrated. Stop disposed draft observers from subscribing again. Thanks @abworks-dev for [#252](https://github.com/saya-ch/dsh-mobile/pull/252).
+- Let browser pairing and reconnect pages remember the last supported language displayed by DSH on that gateway hostname. With no usable preference, retain browser-language negotiation. Native Android screens still follow the system language. Thanks @chintoleung for [#253](https://github.com/saya-ch/dsh-mobile/pull/253).
+- Add **Gallery** beside **Take photo** and DSH's existing **File** action in the dedicated mobile attachment menu. Gallery opens the standard image-only picker, preserves cancellation and ignores results belonging to an old composer or document. Android App 0.6.4+ already supports this picker path; this plugin shortcut does not itself require a new APK. Thanks @abworks-dev for [#249](https://github.com/saya-ch/dsh-mobile/pull/249).
+- Nudge DSH's public connection service when a disconnected page returns to the foreground. App 0.6.7 can also renew authentication once per continuous outage through its advertised native capability, without automatically replaying requests or refreshing the page. Older Apps retain browser-side reconnection. Thanks @ayiejosh for [#241](https://github.com/saya-ch/dsh-mobile/pull/241); original contributor commits are retained alongside maintainer corrections, without upstream bundle rewriting or broader immutable caching.
+- Show field-specific FRP configuration errors in Chinese, English and Italian, focus the first invalid field and clear corrected errors. Keep the existing HTTPS, public-address and port checks rather than guessing a scheme or changing the server configuration. Thanks @chenyxuan for [#250](https://github.com/saya-ch/dsh-mobile/issues/250).
+
+## Android 0.6.7 - 2026-10-22
+
+- Add **Manual**, **Detect and ask**, and **Automatic switch and notify** under device-list Settings → Automatic same-computer connection. Manual remains the default. LAN and remote entries must be independently paired with the same computer; enabling this option does not authorize another computer or share endpoint credentials. Thanks @abworks-dev for [#252](https://github.com/saya-ch/dsh-mobile/pull/252).
+- With plugin 0.6.16, automatic switching can retain the current Session's eligible plain-text draft while authenticating and staging the target. Keep the source on failed or cancelled migration, and retain native settings, zoom and renewal after adoption without another reload. Attachments, references, queued or in-flight operations, scroll and open panels are not full-page state migration; unsupported source state requires confirmation.
+- Add page-requested native authentication renewal with existing cancellation and connection deadlines. Serialize Session Cookie writes by host across Activity replacement, await actual platform callbacks and reject stale results. An already displayed document keeps its compact **Stop reconnecting** action and keyboard state; Back still exits at the root. Thanks @ayiejosh for the renewal contribution in [#241](https://github.com/saya-ch/dsh-mobile/pull/241).
+- Refresh pairing instructions in English, Chinese and Italian with the current Mobile Access entry and provider-neutral remote guidance.
+- Give Debug builds the separate package `io.github.sayach.dshmobile.debug` and a `-debug` version suffix. They coexist with the official App but do not inherit its data or older unsuffixed Debug data. Official App identity and signing remain unchanged; this release is App 0.6.7/build 83.
+
+## 0.6.15 - 2026-10-21
+
+- Keep the dedicated Mobile page's plugin-update notifications connected during idle periods, without gzip buffering. Live module updates retain the mobile layout and the page's selected modules instead of replacing them with the desktop layout. Upgrade and reload the dedicated page to use the corrected stream; stock and older pages keep their existing behavior.
+- Retain authentication, expiry, revocation and cancellation checks for module notifications. A page view does not migrate to a new authentication Session: after native renewal, an old view can return `409 mobile_document_view_invalid` until the page is loaded again. This does not clear pairings or automatically refresh the current conversation. See [connection troubleshooting](docs/SLOW_CONNECTIONS.en.md#keep-event-streams-distinct).
+- Allow same-origin audio/video fetched into Blob URLs on the proxied DSH page. External media remains blocked, Gateway-owned pages retain their policy, and Android's media user-gesture requirement stays enabled.
+- Fix computer-side JSON management actions when Firefox privacy settings omit Origin. Keep local connection and Host checks, cross-origin rejection and official Desktop authentication. Thanks @axlrose for [#246](https://github.com/saya-ch/dsh-mobile/issues/246).
+- Add limited, credential-free diagnostics for the Gateway's authentication exchange with local DSH, separate from phone-side authorization failures.
+- Update development bundler dependencies to address Windows editor-launch security advisories; runtime authentication and model routing are unchanged.
+- Thanks @Void-LifeStream for the startup and reload report in [#243](https://github.com/saya-ch/dsh-mobile/issues/243). This release improves module updates and diagnostics; the complete reported symptom sequence remains unconfirmed.
+
+## Android 0.6.6 - 2026-10-21
+
+- Prevent repeated automatic recovery while renewal or Cookie installation is already pending, and serialize background restore work for the same credential until the previous worker exits.
+- Keep cancellation and the overall connection deadline effective for queued work and late results, without clearing existing pairing data.
+- Publish independently as App 0.6.6 (build 82). The pairing protocol and package identity remain unchanged; these native fixes require an App update and are not installed by updating the npm plugin.
+
 ## 0.6.14 - 2026-10-21
 
 - Defer touch-triggered history loading until the gesture settles, cancel pending loading when the reader leaves the top zone, and scope movement/settle events to the conversation scrollport. Withdraw an older refused loading intent when a new gesture begins. Retain @chintoleung's three original commits from [#239](https://github.com/saya-ch/dsh-mobile/pull/239) alongside maintainer regression fixes.

package/CONTRIBUTORS.md

@@ -1,8 +1,28 @@
 # 贡献者 / Contributors
 
-GitHub 的 [Contributors 图表](https://github.com/saya-ch/dsh-mobile/graphs/contributors) 按进入默认分支的提交自动统计，无法手动加入仅提交 issue 或 PR 提案的成员。本页按截至 2026-10-21 的实际参与方式感谢社区成员；仓库维护者与自动依赖更新仍可在 GitHub 历史记录中查看。
+GitHub 的 [Contributors 图表](https://github.com/saya-ch/dsh-mobile/graphs/contributors) 按进入默认分支的提交自动统计，无法手动加入仅提交 issue 或 PR 提案的成员。本页按截至 2026-10-22 的实际参与方式感谢社区成员；仓库维护者与自动依赖更新仍可在 GitHub 历史记录中查看。
 
-GitHub's Contributors graph counts commits on the default branch; issue reports and PR proposals cannot be manually added to it. This page credits community members by how they contributed, through 2026-10-21. The repository maintainer and automated dependency updates remain visible in GitHub's history.
+GitHub's Contributors graph counts commits on the default branch; issue reports and PR proposals cannot be manually added to it. This page credits community members by how they contributed, through 2026-10-22. The repository maintainer and automated dependency updates remain visible in GitHub's history.
+
+## 待发布贡献与反馈 / Unreleased contributions and reports
+
+[@abworks-dev](https://github.com/abworks-dev) 的 [#252](https://github.com/saya-ch/dsh-mobile/pull/252) 提供经认证的同电脑通道切换与有限纯文本草稿迁移；[@chintoleung](https://github.com/chintoleung) 的 [#253](https://github.com/saya-ch/dsh-mobile/pull/253) 让浏览器配对／重连页记住 DSH 语言偏好。原作者提交保留，维护者另补桥接生命周期和回归测试修正。这批功能仍为待发布候选，不代表正式 App 已具备。
+
+[@abworks-dev](https://github.com/abworks-dev)'s [#252](https://github.com/saya-ch/dsh-mobile/pull/252) contributes authenticated same-computer endpoint switching and limited plain-text draft transfer; [@chintoleung](https://github.com/chintoleung)'s [#253](https://github.com/saya-ch/dsh-mobile/pull/253) remembers DSH's language for browser pairing/reconnect pages. Original author commits are retained alongside maintainer Bridge-lifecycle and regression-test corrections. These features remain unreleased candidates, not capabilities of the current stable App.
+
+[@abworks-dev](https://github.com/abworks-dev) 的 [#249](https://github.com/saya-ch/dsh-mobile/pull/249) 提供相册图片选择入口；[@ayiejosh](https://github.com/ayiejosh) 的 [#241](https://github.com/saya-ch/dsh-mobile/pull/241) 提供前台恢复与原生续期方案。两份 PR 的原作者提交保留，随后追加选择器、恢复归属、取消和 Cookie 写入修正；未保留上游前端包改写。感谢 [@chenyxuan](https://github.com/chenyxuan) 在 [#250](https://github.com/saya-ch/dsh-mobile/issues/250) 反馈 FRP 表单报错不明确，推动字段级提示改进。这批改动尚未发布；审查与整合历史见对应 PR。
+
+[@abworks-dev](https://github.com/abworks-dev)'s [#249](https://github.com/saya-ch/dsh-mobile/pull/249) contributes the Gallery image-picker shortcut; [@ayiejosh](https://github.com/ayiejosh)'s [#241](https://github.com/saya-ch/dsh-mobile/pull/241) contributes foreground recovery and native renewal proposals. Both authors' original commits are retained alongside picker, recovery ownership, cancellation and Cookie-write corrections; upstream frontend-bundle rewriting is not retained. Thanks [@chenyxuan](https://github.com/chenyxuan) for reporting unclear FRP form errors in [#250](https://github.com/saya-ch/dsh-mobile/issues/250), informing field-level feedback. These changes are unreleased; the linked PRs record their review and integration history.
+
+## 0.6.15 反馈 / Reports for 0.6.15
+
+感谢 [@axlrose](https://github.com/axlrose) 在 [#246](https://github.com/saya-ch/dsh-mobile/issues/246) 提供 Firefox 管理请求被拒的复现线索，促成 0.6.15 对缺少来源头场景的兼容与跨站拒绝测试。
+
+Thanks [@axlrose](https://github.com/axlrose) for the Firefox management-request rejection report in [#246](https://github.com/saya-ch/dsh-mobile/issues/246), informing compatibility for omitted source headers and cross-origin rejection tests in 0.6.15.
+
+感谢 [@Void-LifeStream](https://github.com/Void-LifeStream) 在 [#243](https://github.com/saya-ch/dsh-mobile/issues/243) 反馈启动、重载和会话显示问题，推动本轮模块通知、Android 自动恢复与诊断检查。插件 0.6.15 和 App 0.6.6 分别包含相关改进，不代表该报告中的全部现象已复现或解决。
+
+Thanks [@Void-LifeStream](https://github.com/Void-LifeStream) for reporting startup, reload and session-display problems in [#243](https://github.com/saya-ch/dsh-mobile/issues/243), prompting the module-notification, Android recovery and diagnostic investigation. Related improvements belong to plugin 0.6.15 and App 0.6.6 independently; not every reported symptom has been reproduced or resolved.
 
 ## 0.6.14 代码贡献与反馈 / Code contributions and reports for 0.6.14
 

package/README.en.md

@@ -26,20 +26,20 @@
   <a href="#compatibility">Compatibility</a> ·
   <a href="docs/README.md">Documentation</a> ·
   <a href="#contributors">Contributors</a> ·
-  <a href="https://github.com/saya-ch/dsh-mobile/releases/tag/v0.6.14">Release notes</a> ·
+  <a href="https://github.com/saya-ch/dsh-mobile/releases/tag/v0.6.16">Release notes</a> ·
   <a href="README.md">简体中文</a>
 </p>
 
 > DSH Mobile is a DeepSeek Harness community plugin; the native app supports Android only.
 >
-> **Current stable release: 0.6.14**. Improve history-loading gestures and shared sidebar-footer entries, and support IPv6 loopback/ULA backends for an existing HTTPS reverse proxy. Android App **0.6.5** is unchanged and needs no matching update. [Release notes and downloads](https://github.com/saya-ch/dsh-mobile/releases/tag/v0.6.14) · [Full changelog](CHANGELOG.md).
+> **Current stable release: 0.6.16**. Add Gallery, remembered browser language and FRP field feedback, and improve foreground reconnection. Independently released Android App **0.6.7** offers optional same-computer LAN/remote switching with eligible plain-text draft transfer. [Plugin release notes and downloads](https://github.com/saya-ch/dsh-mobile/releases/tag/v0.6.16) · [Full changelog](CHANGELOG.md).
 >
 > **Version policy**: since plugin **0.6.2**, the Android app and plugin use independent version numbers and releases. Their numbers do not need to match, and a plugin update does not imply an app update. [Compatibility notes](#compatibility).
 
 <p align="center">
-  <a href="https://github.com/saya-ch/dsh-mobile/releases/download/android-v0.6.5/dsh-mobile-android-v0.6.5.apk"><img src="https://raw.githubusercontent.com/saya-ch/dsh-mobile/main/assets/brand/app-icon-rounded.svg" alt="DSH Mobile Android app icon" width="72" height="72"></a><br>
-  <a href="https://github.com/saya-ch/dsh-mobile/releases/download/android-v0.6.5/dsh-mobile-android-v0.6.5.apk"><strong>Download Android app 0.6.5</strong></a><br>
-  <sub><a href="https://github.com/saya-ch/dsh-mobile/releases/tag/android-v0.6.5">Release notes and checksums</a></sub>
+  <a href="https://github.com/saya-ch/dsh-mobile/releases/download/android-v0.6.7/dsh-mobile-android-v0.6.7.apk"><img src="https://raw.githubusercontent.com/saya-ch/dsh-mobile/main/assets/brand/app-icon-rounded.svg" alt="DSH Mobile Android app icon" width="72" height="72"></a><br>
+  <a href="https://github.com/saya-ch/dsh-mobile/releases/download/android-v0.6.7/dsh-mobile-android-v0.6.7.apk"><strong>Download Android app 0.6.7</strong></a><br>
+  <sub><a href="https://github.com/saya-ch/dsh-mobile/releases/tag/android-v0.6.7">Release notes and checksums</a></sub>
 </p>
 
 DSH Mobile is a DeepSeek Harness plugin that lets a mobile browser or the Android app connect over a protected LAN or an optional Tailscale Funnel, cpolar, cloudflared, self-hosted FRP, or own reverse-proxy remote path. Both routes reach the same sessions, Workspaces, messages, and tools. The computer manages their switches and pairing authorizations separately; the Android app lists paired computers together. The plugin does not modify DeepSeek Harness source.
@@ -143,7 +143,7 @@ For a routed network such as WireGuard, 0.6.0 offers [additional trusted network
 
 The app is optional: select **Copy pairing link** and open it in a mobile browser. LAN uses a private certificate, which the browser may warn about on first visit; continue only after confirming that this is your DSH gateway. A public-certificate remote origin should not show a certificate warning. If it does, check the channel and certificate instead of bypassing the warning.
 
-Browser pairing and reauthentication pages use the browser's `Accept-Language` to show Simplified Chinese, English, or Italian. Android screens follow the system language, while the DSH plugin control panel follows the language selected by DSH.
+Browser pairing and reauthentication pages support Simplified Chinese, English and Italian. Since plugin 0.6.16, they prefer the DSH display language remembered for that gateway hostname, falling back to the browser's `Accept-Language` when no usable preference exists; clearing site data or changing hostname can reset it. Native Android screens follow the system language, while the DSH plugin control panel follows DSH's current language.
 
 For manual browser pairing, enter the 43-character pairing code shown on the computer. Keys starting with `dsh1.` or `dsh2.` belong in the Android app, not the browser field. Prefer the pairing link copied from the computer, which fills the code automatically; generate a new link when it expires.
 
@@ -264,6 +264,8 @@ Each row shows its custom name, transport, Origin, periodically refreshed reacha
 - Open DSH **Settings → General → Switch computer** in the WebView to return to the list. An online computer-side revocation keeps the row as **Removed on computer**, stops reconnection and offers re-pairing or local deletion.
 - **Added in 0.6.0**: fixed order, new computers appended, and migration of the previously visible order. **Move up / Move to top** save the arrangement independently from startup selection. Inside the app, hold the top-left drawer toggle to return to the list; a normal tap still toggles the drawer. Browsers have no such native action.
 
+With App 0.6.7 and plugin 0.6.16, open the list's **Settings → Automatic same-computer connection** to choose **Manual** (default), **Detect and ask**, or **Automatic switch and notify**. Pair the computer's LAN and remote entries separately. Automatic mode transfers only eligible plain-text drafts in the current Session, not full page state; attachments, references or pending operations require confirmation. See the [App switching guide](apps/mobile/README.md#automatic-same-computer-connection).
+
 Revoking a device permanently deletes its durable record and token digest instead of retaining a `revokedAt` tombstone. Startup also removes legacy revoked rows. A deleted token receives `401 authentication_failed`, just like an unknown token. Existing apps checking a device that was revoked while offline may therefore show **Pairing expired** and require pairing again; online Sessions still receive the revocation notification and disconnect immediately.
 
 <table>

package/README.md

@@ -26,20 +26,20 @@
   <a href="#兼容性">兼容性</a> ·
   <a href="docs/README.md">文档</a> ·
   <a href="#贡献者">贡献者</a> ·
-  <a href="https://github.com/saya-ch/dsh-mobile/releases/tag/v0.6.14">更新记录</a> ·
+  <a href="https://github.com/saya-ch/dsh-mobile/releases/tag/v0.6.16">更新记录</a> ·
   <a href="README.en.md">English</a>
 </p>
 
 > DSH Mobile 是 DeepSeek Harness 社区插件，原生 App 仅支持 Android。
 >
-> **当前正式版本：0.6.14**。改善历史消息加载手势与侧栏入口共存，支持自有反向代理的 IPv6 回环／ULA 后端。Android App **0.6.5** 保持不变，无需同步升级。[更新与下载](https://github.com/saya-ch/dsh-mobile/releases/tag/v0.6.14) · [完整更新记录](CHANGELOG.md)。
+> **当前正式版本：0.6.16**。新增相册入口、浏览器语言记忆和 FRP 字段提示，改善前台重连；配合独立发布的 Android App **0.6.7**，可选择同电脑局域网／远程切换，并迁移符合条件的纯文本草稿。[插件更新与下载](https://github.com/saya-ch/dsh-mobile/releases/tag/v0.6.16) · [完整更新记录](CHANGELOG.md)。
 >
 > **版本说明**：自插件 **0.6.2** 起，Android App 与插件独立编号、独立发布，版本号无需一致；插件升级不代表 App 需要同步升级。[兼容说明](#兼容性)。
 
 <p align="center">
-  <a href="https://github.com/saya-ch/dsh-mobile/releases/download/android-v0.6.5/dsh-mobile-android-v0.6.5.apk"><img src="https://raw.githubusercontent.com/saya-ch/dsh-mobile/main/assets/brand/app-icon-rounded.svg" alt="DSH Mobile 安卓应用图标" width="72" height="72"></a><br>
-  <a href="https://github.com/saya-ch/dsh-mobile/releases/download/android-v0.6.5/dsh-mobile-android-v0.6.5.apk"><strong>下载 Android App 0.6.5</strong></a><br>
-  <sub><a href="https://github.com/saya-ch/dsh-mobile/releases/tag/android-v0.6.5">版本说明与校验文件</a></sub>
+  <a href="https://github.com/saya-ch/dsh-mobile/releases/download/android-v0.6.7/dsh-mobile-android-v0.6.7.apk"><img src="https://raw.githubusercontent.com/saya-ch/dsh-mobile/main/assets/brand/app-icon-rounded.svg" alt="DSH Mobile 安卓应用图标" width="72" height="72"></a><br>
+  <a href="https://github.com/saya-ch/dsh-mobile/releases/download/android-v0.6.7/dsh-mobile-android-v0.6.7.apk"><strong>下载 Android App 0.6.7</strong></a><br>
+  <sub><a href="https://github.com/saya-ch/dsh-mobile/releases/tag/android-v0.6.7">版本说明与校验文件</a></sub>
 </p>
 
 DSH Mobile 是一个 DeepSeek Harness 插件，让手机浏览器或 Android App 通过局域网，或可选的 Tailscale Funnel、cpolar、cloudflared、自建 FRP 或自有反向代理远程通道连接电脑，继续使用同一份会话、工作区、消息和工具。电脑端分别启停局域网与远程访问、分别管理配对授权；Android App 统一显示已配对电脑。插件不修改 DeepSeek Harness 源码。
@@ -143,7 +143,7 @@ dsh plugin --profile web add dshmarket
 
 不安装 App 也可以访问：点击 **复制配对链接**，在手机浏览器中打开。局域网使用私有证书，浏览器首次访问可能提示不受信任；只在确认这是自己的 DSH 网关后按浏览器指引继续。公开证书的远程入口不应出现证书警告，若出现请检查通道和证书，不要直接忽略。
 
-手机浏览器中的配对和重新连接页面会按浏览器的 `Accept-Language` 显示简体中文、英文或意大利文；Android App 则跟随系统语言。DSH 内的插件控制面板继续跟随 DSH 当前语言。
+手机浏览器中的配对和重新连接页面支持简体中文、英文和意大利文。插件 0.6.16 起优先使用当前网关主机名下记住的 DSH 显示语言，没有可用偏好时再按浏览器的 `Accept-Language` 选择；清除网站数据或更换主机名可能重置偏好。Android 原生界面跟随系统语言；DSH 内的插件控制面板跟随 DSH 当前语言。
 
 浏览器手动配对时填写电脑端显示的 43 位配对码；以 `dsh1.` 或 `dsh2.` 开头的是 Android App 密钥，不要填入浏览器配对框。优先打开电脑端复制的配对链接，它会自动填写配对码；过期后在电脑端重新生成。
 
@@ -264,6 +264,8 @@ Android App 在“已配对设备”中统一显示电脑及其局域网／远
 - 在 WebView 页面打开 DSH **设置 → 通用设置 → 切换电脑** 可回到已配对设备列表。在线收到电脑端撤销通知后，App 保留条目并显示“电脑端已移除”，停止自动重连，提供重新配对和删除本地记录。
 - **0.6.0 新增**：列表保持固定顺序，新配对追加到末尾，升级保留旧版可见顺序；操作面板提供 **上移／置顶**，顺序与启动选择分开。App 内还可长按左上角抽屉开关返回列表，短按仍开关抽屉；手机浏览器没有此原生动作。
 
+App 0.6.7 配合插件 0.6.16，可在列表 **设置 → 同电脑自动连接** 中选择 **手动**（默认）、**自动检测并提示** 或 **自动切换并提醒**。同一电脑的局域网和远程入口须分别配对；自动模式只迁移符合条件的当前会话纯文本草稿，不是完整页面状态迁移。附件、引用或待完成操作等情况需要确认，详见 [App 切换说明](apps/mobile/README.zh-CN.md#同电脑自动连接)。
+
 电脑端撤销会永久删除持久化存储中的设备记录及令牌摘要，而不是保留 `revokedAt` 标记；启动时也会清理旧版留下的已撤销记录。删除后，旧令牌与未知令牌一样返回 `401 authentication_failed`。现有 App 若在离线期间被撤销，再次检测时可能显示“配对已过期”，需要重新配对；在线会话仍会收到撤销通知并立即断开。
 
 <table>

package/SECURITY.md

@@ -18,7 +18,9 @@ The maintainer will acknowledge a complete report within seven days. Publication
 
 - Keep the ordinary DSH Web listener on loopback.
 - Expose only the plugin-owned HTTPS listener to the LAN.
-- The desktop admin API may accept an RFC1918 or IPv4 link-local Host only when the TCP peer is loopback, for a trusted local reverse proxy or headless host. Do not publicly forward `/api/mobile-access`; Host and loopback checks are not a replacement for proxy access control. Mutating admin requests require a same-origin `Origin` header, except official DSH Desktop requests: its forwarder strips `Origin` and `Sec-Fetch-Site` and supplies a signed Host browser-session Cookie, so the plugin client sends an exact non-simple marker that survives forwarding. The plugin requires both that marker and Connection's successful browser-session verification before accepting an Origin-less write.
+- The desktop admin API may accept an RFC1918 or IPv4 link-local Host only when the TCP peer is loopback, for a trusted local reverse proxy or headless host. Do not publicly forward `/api/mobile-access`; Host and loopback checks are not a replacement for proxy access control.
+- Mutating Web admin requests normally require a same-origin `Origin`. When a browser omits it, the plugin accepts only a JSON POST with its exact non-simple Web marker and absent or `same-origin` Fetch Metadata. Explicit foreign Origins/sites remain rejected. This marker is not a credential: its CSRF protection relies on browser CORS enforcement and the management prefix refusing OPTIONS without CORS permission. A trusted reverse proxy must not answer allowed CORS preflights or inject CORS authorization for `/api/mobile-access`.
+- Official DSH Desktop uses a separate path: its forwarder strips `Origin` and `Sec-Fetch-Site` and supplies a signed Host browser-session Cookie. The plugin requires both its separate Desktop marker and Connection's successful browser-session verification before accepting an Origin-less Desktop write. The Web marker cannot replace that authentication.
 ### Discovery, pairing and TLS
 
 - DNS-SD/mDNS, periodic UDP announcements, active UDP query replies, and HTTPS discovery return only the device name, public HTTPS origin, port, protocol version, and stable non-secret installation identifier. Discovery never returns the CA, a pairing key, a device token, Cookies, credentials, or private configuration.
@@ -38,6 +40,7 @@ The maintainer will acknowledge a complete report within seven days. Publication
 ### Installation identity and device-state upgrades
 
 - Automatically identified entries without a pairing CA use the random `installation-id` file in the active Mobile state directory for new pairings, not a hash of the state-file path. Explicit operator IDs and CA-bound LAN/self-signed FRP identities remain unchanged. The identifier is public, not an authentication secret. Copying the entire state directory also copies its identity and credentials; this fix does not distinguish cloned installations. Do not delete the identity file to troubleshoot a connection.
+- Native pairing, renewal and authenticated reachability responses can additionally expose `installationId` for grouping independently paired LAN and remote entries from the same Mobile installation. New clients explicitly request this capability with `X-DSH-Mobile-Capabilities: installation-id`; legacy requests retain the exact prior response keys because published older Apps reject unexpected fields. This is separate from the existing channel-specific `instanceId`: CA fingerprints, legacy credential bindings and explicit operator identities retain their existing checks. The grouping identifier does not authorize a connection, replace endpoint credentials or permit sending a token to a different Origin. Discovery and QR metadata alone must not establish an automatic-switch group. Missing identifiers on older gateways disable automatic grouping; copying state can still clone the installation identity.
 - Initial identity creation requires a filesystem that supports hard links within the Mobile state directory. A complete private candidate is published without replacing an existing identity, so concurrent starts cannot read a partially written identifier. Unsupported filesystems or invalid identity files fail explicitly; the plugin does not silently generate a replacement. Reading an existing valid identity does not require creating a hard link.
 - Plugin 0.6.8 reads device-state versions 1 and 2 and writes version 2 on the next mutation. New records retain an optional `nativeInstanceId` binding, so authenticated native renewal and probe return the identity used for their pairing. Older unbound records keep the gateway's legacy identity during an ordinary upgrade with the same state path and gateway configuration; moving their state or changing their certificate/operator identity is not covered by this preservation. They are not reassigned from discovery metadata. The native response fields remain unchanged and the published Android App 0.6.3 needs no update for this fix.
 - Stop the old Gateway normally before updating, then restart DSH. Do not run old and new plugins against the same state concurrently. Plugin 0.6.7 and earlier cannot read version 2; if downgrade may be necessary, stop DSH and back up the complete Mobile state directory before upgrading. There is no automatic rollback or data reset. Restoring a pre-upgrade backup is a separate operator action and can also restore credentials revoked since that backup: review and revoke those devices again before exposing the entry.
@@ -70,6 +73,7 @@ The maintainer will acknowledge a complete report within seven days. Publication
 ### Framed content and browser policy
 
 - Proxied GUI responses allow HTTP iframe sources for compatibility with community surfaces. HTTP content is unauthenticated and unencrypted; Android still blocks mixed HTTP content inside HTTPS pages, and browsers may block it too. Prefer HTTPS and do not treat a gateway framing allowance as a transport-security guarantee.
+- Proxied GUI responses allow same-origin and Blob audio/video through `media-src 'self' blob:`; Gateway-owned login and pairing pages do not gain Blob media permission. External media and connections remain restricted. This permits a trusted page plugin to play a same-origin file fetched into an object URL; it does not bypass browser codec support or autoplay rules. Android retains its media user-gesture requirement. Media plugins should provide a visible poster and a user-initiated playback fallback rather than assume autoplay always succeeds.
 
 ## Known limitation
 

package/THIRD_PARTY_NOTICES.md

@@ -16,7 +16,7 @@ The optional [cloudflared](https://github.com/cloudflare/cloudflared) client is
 
 The optional managed Caddy component is not included in the npm package or Android App. Since plugin 0.6.9, users on Windows/Linux x64 can explicitly confirm an on-demand download of the fixed [DSH Mobile component distribution](https://github.com/saya-ch/dsh-mobile/releases/tag/caddy-component-2.11.7-tencentcloud-0.4.3-r1); its source, exact size and SHA-256 are pinned in the plugin. This distribution builds [Caddy v2.11.7](https://github.com/caddyserver/caddy/blob/v2.11.7/LICENSE), under Apache License 2.0, with [caddy-dns/tencentcloud v0.4.3](https://github.com/caddy-dns/tencentcloud/blob/v0.4.3/LICENSE), under the MIT License. The component release supplies each platform's exact embedded dependency manifest, Go build metadata and complete third-party license/notice texts as separate assets. It is a DSH Mobile build, not an upstream Caddy release or a dynamically generated download. Existing user-managed proxies are separate from this optional component.
 
-The npm package declares direct runtime dependencies on [Schemastery](https://github.com/shigma/schemastery) `^3.18.1`, [@noble/hashes](https://github.com/paulmillr/noble-hashes) `1.8.0`, [bonjour-service](https://github.com/onlxltd/bonjour-service) `1.4.4`, [qrcode](https://github.com/soldair/node-qrcode) `^1.5.4`, [selfsigned](https://github.com/jfromaniello/selfsigned) `^5.5.0`, and [ws](https://github.com/websockets/ws) `8.22.0`. These packages are distributed under the MIT License; the release checkout's exact transitive versions appear in the attached CycloneDX npm SBOM.
+The npm package declares direct runtime dependencies on [Schemastery](https://github.com/shigma/schemastery) `^3.18.1`, [@noble/hashes](https://github.com/paulmillr/noble-hashes) `1.8.0`, [bonjour-service](https://github.com/onlxltd/bonjour-service) `1.4.4`, [eventsource-parser](https://github.com/rexxars/eventsource-parser) `3.1.0`, [qrcode](https://github.com/soldair/node-qrcode) `^1.5.4`, [selfsigned](https://github.com/jfromaniello/selfsigned) `^5.5.0`, and [ws](https://github.com/websockets/ws) `8.22.0`. These packages are distributed under the MIT License; the release checkout's exact transitive versions appear in the attached CycloneDX npm SBOM.
 
 The Android App runtime contains [Kotlin standard library](https://github.com/JetBrains/kotlin) `2.1.0`, [kotlinx.coroutines](https://github.com/Kotlin/kotlinx.coroutines) `1.6.4`, [JetBrains annotations](https://github.com/JetBrains/java-annotations) `13.0`, [AndroidX Core](https://developer.android.com/jetpack/androidx/releases/core) `1.15.0`, [AndroidX WebKit](https://developer.android.com/jetpack/androidx/releases/webkit) `1.17.1`, their AndroidX transitive components, [Guava listenablefuture](https://github.com/google/guava) `1.0`, and [ZXing Core](https://github.com/zxing/zxing) `3.5.4`. These runtime libraries are distributed under the Apache License 2.0; the exact resolved tree is attached to each release as `dsh-mobile-android-v<version>-dependencies.txt`.
 
@@ -48,9 +48,37 @@ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
 THE SOFTWARE.
 ```
 
+## Event-stream parsing
+
+The Gateway uses eventsource-parser for Server-Sent Events framing. Its MIT license is included below:
+
+```text
+MIT License
+
+Copyright (c) 2026 Espen Hovlandsdal <espen@hovlandsdal.com>
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+```
+
 ## core-js browser compatibility bundle
 
-The standalone `lib/mobile-compat.js` bundles selected Iterator and `Promise.withResolvers` modules from [core-js](https://github.com/zloirock/core-js) `^3.50.0` (exact version recorded in `package-lock.json`). It is built into the npm package; browsers do not download a polyfill from a CDN. core-js is distributed under the following MIT License:
+The standalone `lib/mobile-compat.js` bundles selected compatibility modules, including Iterator, `Promise.withResolvers`, collection methods and structured cloning, from [core-js](https://github.com/zloirock/core-js) `^3.50.0` (exact version recorded in `package-lock.json`). It is built into the npm package; browsers do not download a polyfill from a CDN. core-js is distributed under the following MIT License:
 
 ```text
 Copyright (c) 2013–2025 Denis Pushkarev (zloirock.ru)

package/apps/mobile/README.md

@@ -4,14 +4,14 @@
 
 DeepSeek Harness is the display name of this community-maintained Android WebView app. It opens the plugin's authenticated HTTPS page rather than bundling another DSH frontend. The app and mobile browsers receive the same DSH features and computer-side mobile customizations.
 
-The current stable app is **0.6.5** (build 81). The npm plugin and Android App have independent versions: a plugin update does not automatically require another APK. See the [0.6.5 changes](#065-update).
+The current stable app is **0.6.7** (build 83). The npm plugin and Android App have independent versions: a plugin update does not automatically require another APK. See the [0.6.7 changes](#067-update).
 
 Android 10 or later is supported. The local iOS experiment is not a published or supported client.
 
 ## Install and pair
 
 1. Install and enable the plugin using the [project quick start](../../README.en.md#quick-start). Complete LAN setup from the command line or the computer's **Mobile Access** panel.
-2. Install the signed Android APK from [GitHub Releases](https://github.com/saya-ch/dsh-mobile/releases/tag/android-v0.6.5). Upgrade an official installation in place using the same release signer to retain its pairings. A differently signed Debug APK cannot replace it; do not uninstall or clear data just to bypass that mismatch.
+2. Install the signed Android APK from [GitHub Releases](https://github.com/saya-ch/dsh-mobile/releases/tag/android-v0.6.7). Upgrade an official installation in place using the same release signer to retain its pairings. A differently signed Debug APK cannot replace it; do not uninstall or clear data just to bypass that mismatch.
 3. On the computer, generate a pairing key/link under **Mobile Access → Local network**, or configure a remote provider and generate its remote pairing QR code. In the app, choose the matching connection mode and scan or paste the link.
 4. Name the computer. The app stores each LAN or remote pairing as its own record. The phone does not need a cpolar, Cloudflare or Tailscale app.
 
@@ -25,6 +25,7 @@ The **Paired computers** list shows names, connection types, addresses, reachabi
 | --- | --- |
 | Device list → Settings → Startup behavior | **Open DSH directly** (default) selects the last-used eligible pairing, even when several computers are saved. **Show device list** asks you to choose at each launch. |
 | Device list → Settings → App icon | Choose the mascot or one of six whale-mark colors without changing package identity or paired data. |
+| Device list → Settings → Automatic same-computer connection | App 0.6.7+ with plugin 0.6.16+: keep **Manual** (default), choose **Detect and ask**, or enable **Automatic switch and notify**. Pair LAN and remote independently; [switching rules](#automatic-same-computer-connection) explain draft handling. |
 | DSH page → Settings → General → Switch computer | Return to the paired-computer list. Holding the top-left drawer toggle provides another entry. These actions belong inside the app's webpage, not the device-list settings. |
 | <a id="062-update"></a>DSH page → Settings → General → Page zoom | App 0.6.2+ with plugin 0.6.3+: 80–125%, reset to 100%. Saved app-wide without reloading the conversation. |
 | DSH page → Settings → General → Mobile font size | Default 16px, range 12–32px; saved for the current address. Supported themes also expose code size and body/code font choices. Editable inputs retain a 16px minimum; terminal fonts remain DSH-owned. |
@@ -35,6 +36,20 @@ Page zoom changes the whole page and is separate from per-address text preferenc
 
 Deleting a local record removes its saved token and pinned CA, not the computer's authorization or every short-lived WebView cookie. Use **Mobile Access** on the computer to revoke access immediately. A full Android clear-app-data reset removes all pairings and web data and is not a normal reconnection step.
 
+## 0.6.7 update
+
+App 0.6.7/build 83 adds optional same-computer LAN/remote switching when used with plugin 0.6.16 or later. Manual remains the default. Pair both entries independently, then choose a switching mode in device-list Settings. Eligible same-Session plain-text drafts can follow an automatic switch; this is not full-page state migration. See the [switching rules](#automatic-same-computer-connection).
+
+Foreground recovery uses DSH's public reconnect operation. App 0.6.7 also advertises `auth.renew` for one native renewal attempt during a continuous disconnection. Page-requested renewal uses the existing cancellation and connection deadline, retains a compact **Stop reconnecting** action over an already displayed document and does not deliberately hide its keyboard. Session Cookie writes wait for platform callbacks and are serialized by host across Activity replacement. Recovery neither automatically replays operations nor refreshes the current page; Back at the root still exits the app. Existing official pairings and the release signer are retained.
+
+Plugin 0.6.16 adds **Gallery → Take photo → File** to the dedicated mobile attachment menu when image attachments are supported. Gallery requests images through the standard picker, without a capture request; cancellation keeps the draft unchanged and old results cannot attach to another composer or document. App 0.6.4+ already supports this picker path, so the shortcut alone does not require another APK. **File** remains the general attachment entry; the picker shown depends on Android and the available providers. Browser pairing and reconnect pages also remember the supported DSH display language for the gateway hostname; native Android screens still follow the system language.
+
+## 0.6.6 update
+
+Android 0.6.6/build 82 prevents repeated automatic recovery while renewal or Cookie installation is already pending. Background restore work for the same credential waits for the previous worker to exit instead of overlapping it.
+
+Cancellation and the connection deadline withdraw queued work and late results so an older recovery cannot replace a newer action. Existing pairings, package identity and the pairing protocol are unchanged; no data reset or re-pairing is required for this update. Network availability and recovery of an unsaved webpage still depend on the connection and WebView state.
+
 ## 0.6.5 update
 
 Android 0.6.5/build 81 adds an immediate **Cancel connection** action during startup, saved-computer connection, LAN scanning and pairing. Cancellation returns to the device list or editable form without deleting existing pairings. **Stop reconnecting** retains a usable DSH page; a blank or failed document returns to the list.
@@ -45,6 +60,18 @@ One overall budget covers each connection, including queued work, native authent
 
 Cancellation withdraws queued retries and late navigation results and requests native network disconnection. It cannot roll back a pairing already accepted on the computer; generate a new QR code if its one-time code was consumed. These native controls require App 0.6.5 or later; updating npm alone does not install them.
 
+## Automatic same-computer connection
+
+App 0.6.7 with plugin 0.6.16 or later offers three modes under Device list → Settings → Automatic same-computer connection: **Manual**, **Detect and ask**, and **Automatic switch and notify**. Manual remains the default. Pair LAN and remote independently. Only matching authenticated `installationId` values from successful native pair/renew/probe responses group endpoints. Older plugins/records without this value remain separate until authenticated refresh or renewal learns it; no re-pair/reset is needed. Discovery, names and matching addresses never authorize grouping. Every endpoint retains its own token, `instanceId` pin and CA.
+
+Enabled modes prefer that same computer’s eligible LAN pairing on cold startup. When Wi-Fi is lost while using LAN, foreground detection probes the trusted remote candidate immediately instead of waiting for LAN renewal to time out. Foreground network callbacks and 30-second checks still use debounce, rate limiting and a switch cooldown. A transient LAN renewal failure may try only its trusted same-computer remote pairing; revocation, expiry, TLS and identity errors do not trigger fallback. Background callbacks and stale navigation results cannot switch pages. No sends or other writes are replayed.
+
+**Limited plain-text migration, without DSH core changes.** When a page is already open, Detect and ask requires confirmation before replacing it. Automatic switch and notify can transfer one observed session's plain-text draft (including an empty draft, at most 256 KiB UTF-8) using the plugin's public session-scoped input facade. It keeps the source WebView alive while independently authenticating the target, opens that same session through the public UI navigation API, and imports only into an empty or identical target draft. The target import and final source revision must still match immediately before adoption; changed/conflicting text, stale callbacks, navigation or failed authentication cannot authorize adoption. A successful switch shows a brief notice; the old page is discarded only after adoption. Same-Origin recovery retains its existing preservation path.
+
+This is **not full cross-Origin state migration**. Attachments, structured references, command mode, queues, observed submission/media/IME activity, multiple observed composers, and unknown or missing protocol state are not eligible for this automatic plain-text path. An ineligible source requires confirmation before switching. Target readiness or migration failure retains the source rather than silently discarding it. Cancel/defer keeps the page. Unobserved hidden drafts, detached/in-flight work, scroll and open panels are not transferred; these public APIs cannot prove their exhaustive safety. Save/copy that work before a confirmed reload.
+
+Migration snapshots and leases are temporary in-memory state, not new cross-Origin storage. Writing the target uses DSH's normal draft persistence. Abort conditionally undoes only this import if its target revision is still unchanged; renderer loss or unavailable rollback cannot guarantee removal of a target draft already persisted by DSH. No send/upload is replayed. Device-test coverage and remaining network limits are listed under [acceptance and known limits](#acceptance-and-known-limits).
+
 ## Connections, recovery and trust
 
 Device records, long-lived revocable tokens and pinned CAs are encrypted with Android Keystore. Existing LAN/remote slots migrate without re-pairing. Temporarily unreadable encrypted data is reported, not treated as an empty list or overwritten. An expired CA record remains available for deletion or re-pairing, while TLS continues to reject the expired certificate.
@@ -69,7 +96,7 @@ App 0.6.4+ uses the system Photo Picker on Android 13+ for supported image filte
 
 Standard file callbacks belong to the current WebView, Origin and document. With navigation-listener support, pending requests are withdrawn before document replacement and new selection waits for navigation to finish. Older WebViews use available callbacks; if selection stops opening after changing pages, update WebView or return to the device list and reopen the computer, without clearing data.
 
-DSH keeps its file action in **Add**; Mobile adds **Take photo** when the active attachment owner accepts images. Camera capture explicitly requests permission and returns a full-resolution JPEG. For troubleshooting, select one small JPEG/PNG and inspect the unsent draft preview. Files awaiting submission need not already exist as computer-side image objects; no model request is necessary to check selection.
+DSH keeps its file action in **Add**; Mobile adds **Take photo** and **Gallery** when the active attachment owner accepts images. Only the dedicated Mobile page puts **Gallery → Take photo → File** first; all other official actions retain their upstream order, and stock/desktop menu ordering is unchanged. **Gallery** opens an image-only standard file selector without requesting camera capture, using the system picker described above in the App and the browser's file picker elsewhere. It does not require a new Bridge capability or App build. **Take photo** explicitly requests camera permission and returns a full-resolution JPEG. Both use DSH's existing draft attachment intake; cancelling selection adds nothing, and a result belonging to a previous conversation or disposed page is ignored. For troubleshooting, select one small JPEG/PNG and inspect the unsent draft preview. Files awaiting submission need not already exist as computer-side image objects; no model request is necessary to check selection.
 
 ### Keyboard and page space
 
@@ -120,12 +147,15 @@ Set-Location apps/mobile/android
 
 The Debug APK is `app/build/outputs/apk/debug/app-debug.apk`. Official releases use the established signing key stored only in repository Secrets. A local unsigned Release build or a Debug install is not official-signer evidence.
 
-The verified stable release is [Android 0.6.5](https://github.com/saya-ch/dsh-mobile/releases/tag/android-v0.6.5), SHA-256 `41bd476c5ccf90020ecf624844a29886d55060a79533b599e9aa5bf0a1d71844`. Earlier release history belongs in [CHANGELOG](../../CHANGELOG.md).
+Current-source Debug builds use package `io.github.sayach.dshmobile.debug` with a `-debug` version suffix. They install beside the official App with separate storage and pairings. They do not upgrade or migrate an older unsuffixed Debug installation; preserve that app and its data rather than uninstalling or clearing it to switch packages. Release builds keep `io.github.sayach.dshmobile` and the established signer.
+
+The verified stable release is [Android 0.6.7](https://github.com/saya-ch/dsh-mobile/releases/tag/android-v0.6.7), build 83, SHA-256 `919153244e6b84eb55c4701146f50454995330e080da9c91389e8816b2bd9b79`. The downloaded APK retains the established release signer and package `io.github.sayach.dshmobile`. Earlier release history belongs in [CHANGELOG](../../CHANGELOG.md).
 
 ## Acceptance and known limits
 
+- App 0.6.7 Debug builds were checked on PJW110, Android 16 and WebView 153 with isolated DSH 0.2.1-rc.2 over USB-reversed pinned HTTPS. Actual automatic staged adoption retained a same-Session Unicode draft and kept target native zoom/renewal working without another page load. Confirmation cancellation, held-target Back cancellation and late responses, native renewal cancellation, keyboard Back and picker cancellation also passed; QA pairings and mappings were removed afterward. This was not a real Wi-Fi/cellular transition or an installation of the formally signed APK.
 - Connection-control development builds used Debug metadata 0.6.4/build 80 on PJW110, Android 16 and Google WebView 153.0.8010.36. Against an isolated DSH 0.2.0-rc.2/plugin 0.6.10 instance over USB and pinned HTTPS, checks covered pairing/startup/saved-connection cancellation, Back, failed manual connections and return from a failed page after stopping native recovery. Held module responses also verified early webpage display, touch-through outside compact cancellation, cancellation and later completion. Pairings were retained and owned QA records removed.
 - Debug builds of App 0.6.4 retained one WebView across document replacement/reload, rejected an old selection, and received controlled PNG bytes with a decoded DSH draft preview. A held navigation and HTTP 204 also checked selector availability. Earlier checks covered model-menu Back, rotation with draft/reference/image retention, known revocation, re-pairing, icon choices and list ordering. None required a model prompt.
-- These observations do not establish final 0.6.5/build 81 official-signer device acceptance, every public provider, remote 60-second timing, full native recovery with a still-live draft, HyperOS/older WebViews or every screen/gesture configuration. Self-signed FRP still lacks a recorded real-VPS-plus-phone end-to-end check. Permission grants alone do not establish voice transcription, and process-death restoration is not guaranteed.
+- These observations do not establish final official-signer APK device acceptance, every public provider, remote 60-second timing, every outage/recovery sequence, HyperOS/older WebViews or every screen/gesture configuration. Self-signed FRP still lacks a recorded real-VPS-plus-phone end-to-end check. Permission grants alone do not establish voice transcription, and process-death restoration is not guaranteed.
 
 Apache-2.0 licensed. See [LICENSE](../../LICENSE).

package/apps/mobile/README.zh-CN.md

@@ -4,14 +4,14 @@
 
 DeepSeek Harness 是这个社区维护的 Android WebView App 的显示名称。它直接打开插件提供的已认证 HTTPS 页面，不打包另一套 DSH 前端；App 与手机浏览器获得相同的 DSH 功能，以及电脑端配置的移动页面定制。
 
-当前正式 App 为 **0.6.5**；构建号为 81。npm 插件与 Android App 独立编号、独立更新；插件升级不代表需要重新安装 APK。此次改进见 [0.6.5 更新](#065-更新)。
+当前正式 App 为 **0.6.7**；构建号为 83。npm 插件与 Android App 独立编号、独立更新；插件升级不代表需要重新安装 APK。此次改进见 [0.6.7 更新](#067-更新)。
 
 支持 Android 10 及以上系统。iOS 本地实验不属于已发布或受支持的客户端。
 
 ## 安装与配对
 
 1. 按[项目快速开始](../../README.md#快速开始)安装并启用插件。局域网配置可通过命令行或电脑端的 **移动访问** 面板完成。
-2. 从 [GitHub Releases](https://github.com/saya-ch/dsh-mobile/releases/tag/android-v0.6.5) 安装已签名 APK。正式版沿用相同发布签名，可原位升级并保留配对；不同签名的 Debug 包不能直接覆盖正式版，不要为绕过签名不匹配而卸载或清除数据。
+2. 从 [GitHub Releases](https://github.com/saya-ch/dsh-mobile/releases/tag/android-v0.6.7) 安装已签名 APK。正式版沿用相同发布签名，可原位升级并保留配对；不同签名的 Debug 包不能直接覆盖正式版，不要为绕过签名不匹配而卸载或清除数据。
 3. 在电脑 **移动访问 → 局域网访问** 中生成密钥／配对链接，或配置远程通道并生成远程配对二维码。在 App 选择对应方式，扫码或粘贴链接。
 4. 为电脑命名。每条局域网或远程配对单独保存；手机无需安装 cpolar、Cloudflare 或 Tailscale App。
 
@@ -25,6 +25,7 @@ DeepSeek Harness 是这个社区维护的 Android WebView App 的显示名称。
 | --- | --- |
 | 设备列表 → 右上角设置 → 启动行为 | **直接进入 DSH**（默认）优先连接最近使用且配对仍有效的电脑，即使保存了多台设备；**显示设备列表**则每次启动先选择。 |
 | 设备列表 → 右上角设置 → 应用图标 | 可选鲸鱼娘和六种鲸鱼标志配色，不改变包名或配对数据。 |
+| 设备列表 → 右上角设置 → 同电脑自动连接 | App 0.6.7+ 与插件 0.6.16+：保留默认的 **手动**，或选择 **自动检测并提示**、**自动切换并提醒**。局域网和远程须分别配对，草稿处理见[切换规则](#同电脑自动连接)。 |
 | DSH 页面 → 设置 → 通用设置 → 切换电脑 | 返回已配对设备列表；长按左上角抽屉按钮也可进入。这是 App 内网页的操作，不在设备列表设置里重复提供。 |
 | <a id="062-更新"></a>DSH 页面 → 设置 → 通用设置 → 页面缩放 | App 0.6.2+ 与插件 0.6.3+：80–125%，可恢复 100%；保存在当前 App 中，不刷新会话。 |
 | DSH 页面 → 设置 → 通用设置 → 移动端字号 | 默认 16px、范围 12–32px，按当前地址保存；受支持主题还提供代码字号及正文／代码字体选项。编辑输入框至少 16px，终端字体由 DSH 管理。 |
@@ -35,6 +36,20 @@ DeepSeek Harness 是这个社区维护的 Android WebView App 的显示名称。
 
 删除本机记录会移除保存的设备令牌和固定 CA，不等于撤销电脑授权或清除所有 WebView 短期 Cookie。需要立即终止访问时，请在电脑的 **移动访问** 中撤销设备。Android“清除应用数据”会删除全部配对和网页数据，不是普通重连的处理步骤。
 
+## 0.6.7 更新
+
+App 0.6.7／构建 83 配合插件 0.6.16 及以上版本，新增可选的同电脑局域网／远程切换，默认仍为手动。分别配对两个入口后，在设备列表设置中选择切换方式；符合条件的同会话纯文本草稿可随自动切换迁移，但这不是完整页面状态迁移，详见[切换规则](#同电脑自动连接)。
+
+前台恢复使用 DSH 的公开重连操作；App 0.6.7 还声明 `auth.renew` 能力，在一次持续断连中尝试一次原生续期。网页请求的续期沿用已有取消和连接期限，已显示文档上只保留小型 **停止重连** 按钮，不主动收起键盘；Session Cookie 按主机串行写入，跨 Activity 重建也等待系统真实回调。恢复不自动重放操作或刷新当前页面，根页面按返回仍退出 App。已有正式版配对和发布签名保持不变。
+
+插件 0.6.16 在支持图片附件的专用移动菜单中提供 **相册 → 拍照 → 文件**。相册通过标准选择器只请求图片，不触发拍摄；取消不改变草稿，旧结果不能附加到其他输入框或文档。App 0.6.4 起已支持这条选择器路径，因此相册入口本身不要求另装 APK。**文件**仍是通用附件入口，实际选择器取决于 Android 与可用应用。浏览器配对和重连页还会记住当前网关主机名下受支持的 DSH 显示语言，Android 原生界面仍跟随系统语言。
+
+## 0.6.6 更新
+
+Android 0.6.6／构建 82 避免续期或安装 Cookie 尚未完成时重复触发自动恢复。同一凭据的后台恢复会等待上一项任务真正退出，不再重叠执行。
+
+取消和连接总期限会撤销排队任务及迟到结果，避免旧恢复覆盖新的操作。已有配对、包名和配对协议保持不变，升级无需清除数据或重新配对；网络是否可达、未保存网页能否恢复，仍取决于连接与 WebView 状态。
+
 ## 0.6.5 更新
 
 Android 0.6.5／构建 81 在启动连接、已配对电脑连接、局域网扫描和配对过程中均提供立即可用的 **取消连接**。取消后回到设备列表或可编辑表单，不删除原有配对；**停止重连**保留仍可用的 DSH 页面，空白或失效文档则返回列表。
@@ -45,6 +60,18 @@ Android 0.6.5／构建 81 在启动连接、已配对电脑连接、局域网扫
 
 取消会撤销排队重试和迟到的导航结果，并请求断开原生网络操作；无法回滚电脑端已经接受的配对，一次性二维码若已被消耗，请重新生成。这些原生控制需要 App 0.6.5 及以上版本，仅升级 npm 不会安装它们。
 
+## 同电脑自动连接
+
+App 0.6.7 配合插件 0.6.16 及以上版本，在设备列表 → 设置 → 同电脑自动连接中提供三种方式：**手动**、**自动检测并提示**、**自动切换并提醒**。默认仍为手动。局域网与远程须分别配对；只有成功原生配对／续期／探测响应中认证的 `installationId` 一致才分组。旧插件或无该字段的旧记录保持独立，直至认证刷新或续期学习，无需重新配对／重置；发现信息、名称和相同地址都不能授权分组。每个入口保留自己的令牌、`instanceId` 固定身份和 CA。
+
+开启检测后，冷启动优先同电脑的有效局域网配对。使用局域网时 Wi-Fi 断开，会提前独立探测可信远程入口，不再等局域网续期超时才处理。前台网络回调及每 30 秒检查仍有防抖、限频与切换冷却。局域网续期仅在临时网络故障时可回退到该电脑可信远程配对；撤销、过期、TLS 和身份错误不会触发回退。后台或过期回调不能切换页面，不重放发送或其他写请求。
+
+**不改 DSH 核心的受限纯文本迁移。** 已打开网页时，“自动检测并提示”会在替换页面前弹窗确认；“自动切换并提醒”可通过插件的公开会话输入接口，迁移当前唯一被观察会话的纯文本草稿（可为空，最大 256 KiB UTF-8）。源 WebView 会保留到目标独立认证成功、通过公开导航接口打开同一会话、恢复文本并读回验证完成。目标原稿必须为空或与待迁移文本完全一致；接管前还需核对目标导入版本和最终源版本。文本变化、目标冲突、迟到回调、导航或认证失败不能授权接管。成功后仅轻提示，接管完成才丢弃源页。同源恢复仍沿用原有页面保留逻辑。
+
+这**不是完整跨地址状态迁移**：附件、结构化引用、命令模式、队列、已观察到的发送／媒体／输入法活动、多个输入会话或协议未知／缺失，不符合该自动迁移路径。源页不符合条件时仍提示确认；目标加载或迁移失败保留源页，不静默丢弃。取消／推迟保留页面。未观察到的隐藏草稿、分离的待完成发送／上传，以及滚动和面板不会迁移；公开接口不能证明这些内部状态全部安全。确认重载前请保存／复制相关内容。
+
+迁移快照和租约仅在内存中短暂保存，不额外持久化跨地址传输数据；目标写入仍会使用 DSH 自身正常的草稿持久化。取消时仅在导入版本仍未变化的情况下回滚本次写入；渲染器崩溃或回滚接口不可用时，不能保证清除已被 DSH 保存的目标草稿。不重放发送或上传。真机覆盖范围与剩余网络限制见[验收与已知限制](#验收与已知限制)。
+
 ## 连接恢复与信任
 
 设备记录、可撤销的长期令牌和固定 CA 使用 Android Keystore 加密保存，旧版局域网／远程槽可迁移，无需重新配对。暂时无法解密时会报告错误，不当成空列表或用新凭据覆盖。CA 已过期的记录仍能删除或重新配对，但 TLS 继续拒绝过期证书。
@@ -69,7 +96,7 @@ App 0.6.4+ 在 Android 13+ 对支持的图片过滤优先使用系统 Photo Pick
 
 标准文件回调绑定当前 WebView、Origin 和文档。支持导航监听时，文档替换前撤销旧请求，导航结束后才能再次选择。较旧 WebView 使用可用回调；如换页后选择器不再打开，可更新 WebView，或回设备列表重新打开电脑，无需清除数据。
 
-DSH 的文件入口仍在 **添加** 组；当前附件 owner 支持图片时，Mobile 加入 **拍照**，明确申请相机权限后返回完整分辨率 JPEG。排查时可选一张小 JPEG／PNG，检查未发送草稿的预览；尚未提交的文件不必已经成为电脑端图片对象，无需发送模型请求来验证选择结果。
+DSH 的文件入口仍在 **添加** 组；当前附件 owner 支持图片时，Mobile 加入 **拍照** 和 **相册**。仅专用移动页面将 **相册 → 拍照 → 文件** 放在最前；其他官方项目保持上游默认顺序，普通／桌面页面的菜单排序不变。**相册** 打开仅选择图片的标准文件选择器，不请求拍摄；在 App 内使用上文所述的系统选择器，在手机浏览器内使用浏览器的文件选择器，无需新增 Bridge 能力或安装新版 App。**拍照** 仍明确申请相机权限后返回完整分辨率 JPEG。两者均交给 DSH 现有的草稿附件入口处理；取消选择不会添加附件，属于旧会话或已销毁页面的结果会被忽略。排查时可选一张小 JPEG／PNG，检查未发送草稿的预览；尚未提交的文件不必已经成为电脑端图片对象，无需发送模型请求来验证选择结果。
 
 ### 键盘与页面空间
 
@@ -120,12 +147,15 @@ Set-Location apps/mobile/android
 
 Debug APK 位于 `app/build/outputs/apk/debug/app-debug.apk`。正式发布沿用只保存在仓库 Secrets 中的签名密钥，本地未签名 Release 构建或 Debug 安装不能替代正式签名核验。
 
-已核验的正式版本为 [Android 0.6.5](https://github.com/saya-ch/dsh-mobile/releases/tag/android-v0.6.5)，SHA-256：`41bd476c5ccf90020ecf624844a29886d55060a79533b599e9aa5bf0a1d71844`。旧版本历史集中在 [CHANGELOG](../../CHANGELOG.md)。
+当前源码的 Debug 构建使用包名 `io.github.sayach.dshmobile.debug` 与 `-debug` 版本后缀，可与正式 App 并存，存储和配对彼此独立。它不会升级或迁移旧版无后缀 Debug 应用；切换包名时应保留旧应用和数据，不要为此卸载或清除。Release 构建继续使用 `io.github.sayach.dshmobile` 与既定正式签名。
+
+已核验的正式版本为 [Android 0.6.7](https://github.com/saya-ch/dsh-mobile/releases/tag/android-v0.6.7)，构建 83，SHA-256：`919153244e6b84eb55c4701146f50454995330e080da9c91389e8816b2bd9b79`。下载的 APK 沿用正式发布签名及包名 `io.github.sayach.dshmobile`。旧版本历史集中在 [CHANGELOG](../../CHANGELOG.md)。
 
 ## 验收与已知限制
 
+- App 0.6.7 Debug 构建在 PJW110、Android 16、WebView 153 上，通过 USB 映射和固定 CA 的 HTTPS 连接隔离的 DSH 0.2.1-rc.2。真实自动接管保留同会话 Unicode 草稿，目标原生缩放／续期可用且不额外刷新；还通过确认取消、目标加载中按返回取消与迟到响应、原生续期取消、键盘返回和选择器取消。临时配对与映射已清理；这不是实际 Wi-Fi／蜂窝切网，也不是正式签名 APK 的装机验收。
 - 连接控制的开发包使用 Debug 元数据 0.6.4／构建 80，在 PJW110、Android 16、Google WebView 153.0.8010.36 上，通过 USB 和固定 CA 的 HTTPS 连接隔离的 DSH 0.2.0-rc.2／插件 0.6.10。检查了配对／启动／已保存连接取消、系统返回、手动失败收尾，以及停止原生恢复后从失效页面返回；暂停模块响应时也验证了提前露出网页、非按钮区域触摸透传、取消和放行后完成。原配对保留，临时 QA 记录已清理。
 - App 0.6.4 的 Debug 构建在同一 WebView 中覆盖文档替换／刷新、拒绝旧选择、接收受控 PNG 字节并形成已解码草稿预览；还检查了暂停导航及 HTTP 204 后选择器的可用性。更早的检查覆盖模型菜单返回、旋转保留草稿／引用／图片、已知撤销、重新配对、图标选择与列表顺序，均未发送模型请求。
-- 这些观察不代表最终 0.6.5／构建 81 正式签名 APK 已完成真机验收，也不覆盖所有公网提供方、远程 60 秒期限、保留活动草稿的完整原生恢复、HyperOS／旧 WebView 或所有屏幕／手势组合。自签 FRP 尚无真实 VPS 加手机的端到端验收记录；权限授予不代表语音转写成功，进程终止后的状态恢复也不作保证。
+- 这些观察不代表最终正式签名 APK 已完成真机验收，也不覆盖所有公网提供方、远程 60 秒期限、全部断连／恢复时序、HyperOS／旧 WebView 或所有屏幕／手势组合。自签 FRP 尚无真实 VPS 加手机的端到端验收记录；权限授予不代表语音转写成功，进程终止后的状态恢复也不作保证。
 
 Apache-2.0 licensed. See [LICENSE](../../LICENSE).

package/apps/mobile/release.json

@@ -1,5 +1,5 @@
 {
-  "version": "0.6.5",
-  "versionCode": 81,
-  "releaseTag": "android-v0.6.5"
+  "version": "0.6.7",
+  "versionCode": 83,
+  "releaseTag": "android-v0.6.7"
 }

package/docs/ATTACH_EXISTING_FRPS.en.md

@@ -17,6 +17,14 @@ frps `proxyBindAddr` is global to proxy listeners, not a per-entry switch. Bindi
 
 The [official frps configuration reference](https://gofrp.org/en/docs/reference/server-configures/) defines `proxyBindAddr` as the proxy listening address and `vhostHTTPPort` as the HTTP-proxy listening port; use the values actually configured on your server.
 
+## Enter addresses and ports separately
+
+**VPS address** takes a hostname or IP only, without `https://`, a path or a port; enter the frps control port in its own field. **Public entry** requires a complete `https://domain` or `https://PUBLIC_IPV4` without a nonstandard port, path, query or credentials. The plugin does not add a missing scheme. Private, loopback and reserved IPv4 addresses are not public entries.
+
+Public-CA mode uses HTTPS 443. For self-signed mode, keep `https://PUBLIC_IPV4` in the address field and put the TCP port, such as `33080`, in **Public entry port**; the plugin builds the actual pairing address from both. Use public-CA mode for domains rather than the current IPv4-only self-signed mode.
+
+Plugin 0.6.16 adds Chinese, English and Italian field-level feedback: submission or preview marks invalid fields and focuses the first error; editing rechecks and clears corrected errors. It does not relax the validation above or change server listeners or ports for you.
+
 ## Public-CA mode
 
 1. In **Self-hosted FRP**, choose **Attach to my existing frps** and **Public CA certificate**. Enter the VPS address, frps control port, high-entropy shared token, public domain or IPv4 HTTPS origin, and the frps instance's actual `vhostHTTPPort`. Do not assume the managed deployment's default of 7080.

package/docs/ATTACH_EXISTING_FRPS.md

@@ -18,6 +18,14 @@
 
 [FRP 官方服务端配置](https://gofrp.org/zh-cn/docs/reference/server-configures/)将 `proxyBindAddr` 定义为代理监听地址，将 `vhostHTTPPort` 定义为 HTTP 类型代理监听端口；两者都由你既有 frps 的实际配置决定。
 
+## 正确填写地址与端口
+
+**VPS 地址**只填主机名或 IP，不带 `https://`、路径或端口；frps 的控制端口单独填写。**公网入口**必须写完整的 `https://域名` 或 `https://公网IPv4`，不带非标准端口、路径、查询参数或账号密码，插件不会自动补协议。私网、回环和保留 IPv4 不能用作公网入口。
+
+公开 CA 档使用 HTTPS 443。自签档的公网入口仍填 `https://公网IPv4`，把例如 `33080` 的 TCP 端口单独填入 **公网入口端口**；插件据此生成实际配对地址。域名应使用公开 CA 档，不适用于当前自签 IPv4 档。
+
+插件 0.6.16 起提供中文、英文和意大利文字段级提示：提交或预览时标记错误字段、聚焦第一处错误，修改后重新检查并清除已修正的提示。它不放宽上述校验，也不会替你更改服务器监听或端口。
+
 ## 两档入口证书
 
 ### A. 公开 CA 证书档（`public-ip-cert`，缺省）

package/docs/SLOW_CONNECTIONS.en.md

@@ -20,6 +20,12 @@ Both [#126](https://github.com/saya-ch/dsh-mobile/issues/126) and [#146](https:/
 
 Plugin 0.6.11 and later write limited `auth failure` HTTP diagnostics to the plugin log (`$DSH_HOME/mobile-access/logs/dsh-mobile.log`): authorization versus CSRF rejection, status, method, a safe route or route category, related Cookie/header presence and counts, normalized Origin and recognized fetch-site values. It omits tokens, Cookie values, query strings and arbitrary original paths. Each Gateway rate-limits its two categories separately: the first event is immediate and same-category rejections aggregate within a 30-second window; `suppressed` counts previously suppressed records of that category, not all requests or only the current path. This helps investigate missing credentials and CSRF failures; it does not automatically repair a 401/403. The absence of a record does not establish successful authentication: earlier Host/Origin rejections, WebSocket upgrades and native pairing/renewal are outside these two recording points. Review logs before sharing them.
 
+### Internal authentication exchange diagnostics (plugin 0.6.15+)
+
+`upstream auth` records the Gateway's internal Cookie exchange with local DSH separately from a phone request's `auth failure`. Each entry contains only the Gateway-local exchange `sequence`, `stage`, fixed `outcome`, `durationMs` and the upstream HTTP `status` after response headers arrive; this is not the phone-facing status. `accepted` means the strict 303, Cookie and expiry checks passed. Other outcomes distinguish an invalid target, unexpected status, invalid Cookie, timeout or transport failure. Logs omit the internal launch URL, Tokens, Cookie names and values, response bodies and raw errors.
+
+Success and failure each have one fixed sampling slot: the first result is immediate, then at most one per 30 seconds, with `suppressed` counting earlier omitted exchanges of that category. Concurrent requests sharing an exchange produce one record; cached Cookie use produces none. Sequences correlate only within one Gateway instance and are not device identifiers. Absence of a record establishes neither authentication nor successful frontend startup, and these logs cannot determine whether Session data was damaged.
+
 ## HTTP 400, 408 and 431 (plugin 0.6.13+)
 
 Plugin 0.6.13 and later distinguish request receive timeouts as `408 request_timeout` and oversized headers as `431 headers_too_large`; other malformed HTTP requests remain `400 bad_request`. Older versions may return 400 with the same short JSON for all of them, so a status and a 24-byte body do not identify the cause.
@@ -32,6 +38,10 @@ The `http failure` diagnostics distinguish three per-Gateway categories: `parser
 
 In DSH 0.2.0-rc.2, `/plugins/events` is the SSE stream for plugin-module graph and build updates, not conversation-message delivery. Its `200` response, small body or repeated reconnects alone cannot establish successful delivery, failure or a missing processing animation. Inspect the `/api/remote.mux` WebSocket and the actual HTTP request for that operation as well.
 
+Plugin 0.6.15 and later repair the idle cutoff and gzip buffering for new dedicated Mobile pages supporting the authenticated transport. The page identifies its current authorized view when requesting module events; only a bodyless `GET /plugins/events` with an actual `200 text/event-stream` response uses `upstreamApiTimeoutMs` for later frames. Event graphs use the same layout, dependency and module-selection projection as the initial Mobile page, rather than replacing the running Mobile layout with the raw desktop graph. Newly saved module choices still apply on the next page load. Connection/header deadlines, authentication, revocation, cancellation and concurrency limits remain. An expired view stops notifications rather than falling back to the raw graph or automatically refreshing the Session. Old pages and `frontend=stock` do not enable this projection; reload the dedicated page after upgrading to use it. This repair does not establish the cause of every startup or reload symptom in [#243](https://github.com/saya-ch/dsh-mobile/issues/243).
+
+A page view does not migrate to a new authentication Session. Native renewal may retain the WebView and draft without restoring the old module-event stream. A new Session using the old view receives `409 mobile_document_view_invalid`; loading the dedicated page again obtains a new view. This does not require removing a pairing or automatically refresh the current Session.
+
 An ordinary message bubble and cleared draft can precede `POST /api/session/prompt`: they are an optimistic local echo, not Host acceptance. If no corresponding request appears, retain redacted request timing, status codes and DSH logs to distinguish a request never started by the browser, proxy rejection and Host acceptance. The plugin does not automatically replay messages, approvals or other writes; check the Session before retrying an operation with an unknown outcome.
 
 ## Slow transfers can exceed the default deadlines
@@ -106,7 +116,7 @@ Resources without upstream validators do not automatically acquire a reliable on
 
 Commands such as `/compact` sent from the phone traverse the Mobile gateway's HTTP API. Automatic compaction inside DSH does not traverse that gateway request. Older gateways used the default 30-second `upstreamTimeoutMs` for every proxied request, so manual compaction could return `502 upstream_unavailable` while the model was still producing the summary. [#171](https://github.com/saya-ch/dsh-mobile/issues/171) records this case.
 
-The gateway now separates transport waits from authenticated API response waits. `upstreamTimeoutMs` still defaults to 30000 milliseconds (1000–300000) for uploads, static assets, boot resources, and WebSocket handshakes; incoming request headers retain their existing 10-second deadline. Only `/api` and `/api/…` HTTP requests that pass device authentication, Host/Origin checks, and any required CSRF check switch to `upstreamApiTimeoutMs` after the request body is sent to DSH. The new field defaults to `0`, disabling the API response idle timeout. To set a limit, use an integer from `1` through `2147483647` milliseconds; the upper limit is Node's timer representation limit. This is not a total execution deadline: arriving response data resets the idle timer.
+The gateway separates transport waits from authenticated API response waits. `upstreamTimeoutMs` still defaults to 30000 milliseconds (1000–300000) for uploads, static assets, boot resources, and WebSocket handshakes; incoming request headers retain their existing 10-second deadline. `/api` and `/api/…` HTTP requests that pass device authentication, Host/Origin checks, and any required CSRF check switch to `upstreamApiTimeoutMs` after the request body is sent to DSH. The field defaults to `0`, disabling these response idle timeouts. To set a limit, use an integer from `1` through `2147483647` milliseconds; the upper limit is Node's timer representation limit. Plugin 0.6.15 and later also apply it to dedicated module-event streams after valid response headers, under the event-stream conditions above. This is not a total execution deadline: arriving response data resets the idle timer.
 
 Add the property below to the existing `mobile-access` entry's `config` and keep all other settings. This is a configuration fragment, not a complete profile patch. `0` is the default; this example sets a 10-minute API response idle timeout: