npm - dsh-mobile - Versions diffs - 0.6.16 → 0.6.17 - Mend

dsh-mobile 0.6.16 → 0.6.17

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (16) hide show

package/CHANGELOG.md +9 -0
package/CONTRIBUTORS.md +19 -7
package/README.en.md +2 -2
package/README.md +2 -2
package/cordis.patch.yml +10 -17
package/docs/CLIENT_MODULES.en.md +10 -2
package/docs/CLIENT_MODULES.md +10 -2
package/docs/SLOW_CONNECTIONS.en.md +11 -1
package/docs/SLOW_CONNECTIONS.md +11 -1
package/lib/client.js +932 -31
package/lib/client.js.map +1 -1
package/lib/index.d.mts +50 -1
package/lib/index.mjs +576 -34
package/lib/index.mjs.map +1 -1
package/package.json +2 -1
package/packages/question-fixes/package.json +1 -1

package/CHANGELOG.md CHANGED Viewed

@@ -2,6 +2,15 @@
 Notable changes are recorded here. GitHub Releases provide the downloadable packages and generated commit notes.
+## 0.6.17 - 2026-10-25
+- Keep DSH's own directory-picker composition instead of registering a second Host service and Client surface. Official Desktop retains its native chooser, **Add workspace** action and `Ctrl+O` shortcut independently of Mobile's in-page picker. Thanks @ChaoPhone for [#257](https://github.com/saya-ch/dsh-mobile/issues/257) and @bvbhu for [#258](https://github.com/saya-ch/dsh-mobile/issues/258).
+- Keep a familiar in-page folder browser on the dedicated, paired Mobile page, with editable paths, parent navigation, retry and cancellation while browsing or loading. Late responses cannot replace a newer selection, and Back closes the picker before the page underneath. Once a directory is submitted, DSH owns workspace creation; it is not reported as cancelled. The mobile flow does not open an OS dialog on the remote computer or change the desktop's picker.
+- Add an authenticated, read-only workspace-directory listing route for the Mobile picker. It lists folders without creating them and rejects unauthorized requests; the existing photo picker and its routes are unchanged.
+- Improve slow-link loading with compression for complete text responses and the assembled start page, smaller merged script batches, and revalidation of owned static resources. Keep Session-bound HTML non-storable and preserve streaming and write behavior. Large valid module graphs fall back to individual resources rather than failing only because the optimization reached its batch count. Thanks @LUgABeEEE for [#259](https://github.com/saya-ch/dsh-mobile/pull/259), [#260](https://github.com/saya-ch/dsh-mobile/pull/260) and [#262](https://github.com/saya-ch/dsh-mobile/pull/262).
+- Add explicit module transfer-size measurement, partial-size feedback and a required-modules preset without applying choices until saved. Measurement must not delay ordinary catalog reads or saving. Thanks @LUgABeEEE for [#261](https://github.com/saya-ch/dsh-mobile/pull/261).
+- Keep fresh API reads and the existing backpressured proxy. The generic short API-cache proposal in [#263](https://github.com/saya-ch/dsh-mobile/pull/263) is not enabled in this release; the author's original contribution remains in the integration history. Thanks @LUgABeEEE for [#263](https://github.com/saya-ch/dsh-mobile/pull/263).
 ## 0.6.16 - 2026-10-22
 - Support App 0.6.7's optional same-computer LAN/remote switching with authenticated installation grouping and limited same-Session plain-text draft transfer through public DSH APIs. Independently paired endpoints keep separate credentials and CA pins; conflicts and unsupported editor state are not silently migrated. Stop disposed draft observers from subscribing again. Thanks @abworks-dev for [#252](https://github.com/saya-ch/dsh-mobile/pull/252).

package/CONTRIBUTORS.md CHANGED Viewed

@@ -1,18 +1,28 @@
 # 贡献者 / Contributors
-GitHub 的 [Contributors 图表](https://github.com/saya-ch/dsh-mobile/graphs/contributors) 按进入默认分支的提交自动统计，无法手动加入仅提交 issue 或 PR 提案的成员。本页按截至 2026-10-22 的实际参与方式感谢社区成员；仓库维护者与自动依赖更新仍可在 GitHub 历史记录中查看。
+GitHub 的 [Contributors 图表](https://github.com/saya-ch/dsh-mobile/graphs/contributors) 按进入默认分支的提交自动统计，无法手动加入仅提交 issue 或 PR 提案的成员。本页按截至 2026-10-25 的实际参与方式感谢社区成员；仓库维护者与自动依赖更新仍可在 GitHub 历史记录中查看。
-GitHub's Contributors graph counts commits on the default branch; issue reports and PR proposals cannot be manually added to it. This page credits community members by how they contributed, through 2026-10-22. The repository maintainer and automated dependency updates remain visible in GitHub's history.
+GitHub's Contributors graph counts commits on the default branch; issue reports and PR proposals cannot be manually added to it. This page credits community members by how they contributed, through 2026-10-25. The repository maintainer and automated dependency updates remain visible in GitHub's history.
-## 待发布贡献与反馈 / Unreleased contributions and reports
+## 0.6.17 代码贡献与反馈 / Code contributions and reports for 0.6.17
-[@abworks-dev](https://github.com/abworks-dev) 的 [#252](https://github.com/saya-ch/dsh-mobile/pull/252) 提供经认证的同电脑通道切换与有限纯文本草稿迁移；[@chintoleung](https://github.com/chintoleung) 的 [#253](https://github.com/saya-ch/dsh-mobile/pull/253) 让浏览器配对／重连页记住 DSH 语言偏好。原作者提交保留，维护者另补桥接生命周期和回归测试修正。这批功能仍为待发布候选，不代表正式 App 已具备。
+感谢 [@LUgABeEEE](https://github.com/LUgABeEEE) 提供 [#259](https://github.com/saya-ch/dsh-mobile/pull/259)、[#260](https://github.com/saya-ch/dsh-mobile/pull/260)、[#261](https://github.com/saya-ch/dsh-mobile/pull/261)、[#262](https://github.com/saya-ch/dsh-mobile/pull/262) 的慢链路压缩、启动分批、模块体积与最小预设、静态资源校验方案。原始提交已随 0.6.17 进入默认分支，维护者的兼容性、生命周期和交互修正作为追加提交保留在旁。另保留 [#263](https://github.com/saya-ch/dsh-mobile/pull/263) 的 API 短缓存提案与贡献历史，但本版不启用泛 API 响应缓存；该提案不计入本版功能。
-[@abworks-dev](https://github.com/abworks-dev)'s [#252](https://github.com/saya-ch/dsh-mobile/pull/252) contributes authenticated same-computer endpoint switching and limited plain-text draft transfer; [@chintoleung](https://github.com/chintoleung)'s [#253](https://github.com/saya-ch/dsh-mobile/pull/253) remembers DSH's language for browser pairing/reconnect pages. Original author commits are retained alongside maintainer Bridge-lifecycle and regression-test corrections. These features remain unreleased candidates, not capabilities of the current stable App.
+Thanks [@LUgABeEEE](https://github.com/LUgABeEEE) for the slow-link compression, boot batching, module-size/minimal-preset and static-resource revalidation work in [#259](https://github.com/saya-ch/dsh-mobile/pull/259), [#260](https://github.com/saya-ch/dsh-mobile/pull/260), [#261](https://github.com/saya-ch/dsh-mobile/pull/261) and [#262](https://github.com/saya-ch/dsh-mobile/pull/262). Original commits entered the default branch with 0.6.17, with maintainer compatibility, lifecycle and interaction corrections retained as follow-up commits. The proposal and original history of [#263](https://github.com/saya-ch/dsh-mobile/pull/263) are also retained, but generic API-response caching is not enabled in this release and does not count as a 0.6.17 feature.
-[@abworks-dev](https://github.com/abworks-dev) 的 [#249](https://github.com/saya-ch/dsh-mobile/pull/249) 提供相册图片选择入口；[@ayiejosh](https://github.com/ayiejosh) 的 [#241](https://github.com/saya-ch/dsh-mobile/pull/241) 提供前台恢复与原生续期方案。两份 PR 的原作者提交保留，随后追加选择器、恢复归属、取消和 Cookie 写入修正；未保留上游前端包改写。感谢 [@chenyxuan](https://github.com/chenyxuan) 在 [#250](https://github.com/saya-ch/dsh-mobile/issues/250) 反馈 FRP 表单报错不明确，推动字段级提示改进。这批改动尚未发布；审查与整合历史见对应 PR。
+感谢 [@ChaoPhone](https://github.com/ChaoPhone) 在 [#257](https://github.com/saya-ch/dsh-mobile/issues/257) 提供官方 Desktop 目录选择器重复注册的分析，以及 [@bvbhu](https://github.com/bvbhu) 在 [#258](https://github.com/saya-ch/dsh-mobile/issues/258) 提供停用目录选择界面后工作区入口消失的复现，帮助明确桌面原生选择器与移动页面浏览器应分别管理。对应修复随 0.6.17 发布。
-[@abworks-dev](https://github.com/abworks-dev)'s [#249](https://github.com/saya-ch/dsh-mobile/pull/249) contributes the Gallery image-picker shortcut; [@ayiejosh](https://github.com/ayiejosh)'s [#241](https://github.com/saya-ch/dsh-mobile/pull/241) contributes foreground recovery and native renewal proposals. Both authors' original commits are retained alongside picker, recovery ownership, cancellation and Cookie-write corrections; upstream frontend-bundle rewriting is not retained. Thanks [@chenyxuan](https://github.com/chenyxuan) for reporting unclear FRP form errors in [#250](https://github.com/saya-ch/dsh-mobile/issues/250), informing field-level feedback. These changes are unreleased; the linked PRs record their review and integration history.
+Thanks [@ChaoPhone](https://github.com/ChaoPhone) for analyzing duplicate directory-picker registration in official Desktop in [#257](https://github.com/saya-ch/dsh-mobile/issues/257), and [@bvbhu](https://github.com/bvbhu) for reproducing missing workspace actions after disabling the picker surface in [#258](https://github.com/saya-ch/dsh-mobile/issues/258). These reports helped separate desktop-native selection from mobile in-page browsing. The related fix shipped in 0.6.17.
+## 0.6.16 代码贡献与反馈 / Code contributions and reports for 0.6.16
+[@abworks-dev](https://github.com/abworks-dev) 的 [#252](https://github.com/saya-ch/dsh-mobile/pull/252) 提供经认证的同电脑通道切换与有限纯文本草稿迁移；[@chintoleung](https://github.com/chintoleung) 的 [#253](https://github.com/saya-ch/dsh-mobile/pull/253) 让浏览器配对／重连页记住 DSH 语言偏好。原作者提交保留，维护者另补桥接生命周期和回归测试修正。插件相关改动随 0.6.16 发布，原生切换功能随独立的 Android App 0.6.7 发布。
+[@abworks-dev](https://github.com/abworks-dev)'s [#252](https://github.com/saya-ch/dsh-mobile/pull/252) contributes authenticated same-computer endpoint switching and limited plain-text draft transfer; [@chintoleung](https://github.com/chintoleung)'s [#253](https://github.com/saya-ch/dsh-mobile/pull/253) remembers DSH's language for browser pairing/reconnect pages. Original author commits are retained alongside maintainer Bridge-lifecycle and regression-test corrections. Plugin changes shipped in 0.6.16; native switching shipped independently in Android App 0.6.7.
+[@abworks-dev](https://github.com/abworks-dev) 的 [#249](https://github.com/saya-ch/dsh-mobile/pull/249) 提供相册图片选择入口；[@ayiejosh](https://github.com/ayiejosh) 的 [#241](https://github.com/saya-ch/dsh-mobile/pull/241) 提供前台恢复与原生续期方案。两份 PR 的原作者提交保留，随后追加选择器、恢复归属、取消和 Cookie 写入修正；未保留上游前端包改写。感谢 [@chenyxuan](https://github.com/chenyxuan) 在 [#250](https://github.com/saya-ch/dsh-mobile/issues/250) 反馈 FRP 表单报错不明确，推动字段级提示改进。插件改进随 0.6.16 发布，原生恢复改进随 App 0.6.7 发布；审查与整合历史见对应 PR。
+[@abworks-dev](https://github.com/abworks-dev)'s [#249](https://github.com/saya-ch/dsh-mobile/pull/249) contributes the Gallery image-picker shortcut; [@ayiejosh](https://github.com/ayiejosh)'s [#241](https://github.com/saya-ch/dsh-mobile/pull/241) contributes foreground recovery and native renewal proposals. Both authors' original commits are retained alongside picker, recovery ownership, cancellation and Cookie-write corrections; upstream frontend-bundle rewriting is not retained. Thanks [@chenyxuan](https://github.com/chenyxuan) for reporting unclear FRP form errors in [#250](https://github.com/saya-ch/dsh-mobile/issues/250), informing field-level feedback. Plugin improvements shipped in 0.6.16, while native recovery improvements shipped in App 0.6.7; the linked PRs record their review and integration history.
 ## 0.6.15 反馈 / Reports for 0.6.15
@@ -129,7 +139,9 @@ Thanks [@xhwxt](https://github.com/xhwxt) for the document-picker proposal in [#
 | [@Anyways366](https://github.com/Anyways366) | [#223](https://github.com/saya-ch/dsh-mobile/issues/223) |
 | [@azri57806-design](https://github.com/azri57806-design) | [#97](https://github.com/saya-ch/dsh-mobile/issues/97) |
 | [@BrainZombie](https://github.com/BrainZombie) | [#128](https://github.com/saya-ch/dsh-mobile/issues/128) |
+| [@bvbhu](https://github.com/bvbhu) | [#258](https://github.com/saya-ch/dsh-mobile/issues/258) |
 | [@CESAEREE](https://github.com/CESAEREE) | [#1](https://github.com/saya-ch/dsh-mobile/issues/1) |
+| [@ChaoPhone](https://github.com/ChaoPhone) | [#257](https://github.com/saya-ch/dsh-mobile/issues/257) |
 | [@CharlesLueng](https://github.com/CharlesLueng) | [#68](https://github.com/saya-ch/dsh-mobile/issues/68) |
 | [@chintoleung](https://github.com/chintoleung) | [#103](https://github.com/saya-ch/dsh-mobile/issues/103), [#166](https://github.com/saya-ch/dsh-mobile/issues/166), [#189](https://github.com/saya-ch/dsh-mobile/issues/189), [#228](https://github.com/saya-ch/dsh-mobile/issues/228) |
 | [@chmzs](https://github.com/chmzs) | [#73](https://github.com/saya-ch/dsh-mobile/issues/73) |

package/README.en.md CHANGED Viewed

@@ -26,13 +26,13 @@
   <a href="#compatibility">Compatibility</a> ·
   <a href="docs/README.md">Documentation</a> ·
   <a href="#contributors">Contributors</a> ·
-  <a href="https://github.com/saya-ch/dsh-mobile/releases/tag/v0.6.16">Release notes</a> ·
+  <a href="https://github.com/saya-ch/dsh-mobile/releases/tag/v0.6.17">Release notes</a> ·
   <a href="README.md">简体中文</a>
 </p>
 > DSH Mobile is a DeepSeek Harness community plugin; the native app supports Android only.
 >
-> **Current stable release: 0.6.16**. Add Gallery, remembered browser language and FRP field feedback, and improve foreground reconnection. Independently released Android App **0.6.7** offers optional same-computer LAN/remote switching with eligible plain-text draft transfer. [Plugin release notes and downloads](https://github.com/saya-ch/dsh-mobile/releases/tag/v0.6.16) · [Full changelog](CHANGELOG.md).
+> **Current stable release: 0.6.17**. Fix directory-picker ownership: official Desktop keeps its native chooser, **Add workspace** action and `Ctrl+O`, while the Mobile page uses its own in-page browser. On slow links, compress HTML and API responses, bound boot batches and reuse downloaded resources; module settings gain transfer sizes and a minimal preset. Android App **0.6.7** still applies; this release contains no new APK. [Plugin release notes and downloads](https://github.com/saya-ch/dsh-mobile/releases/tag/v0.6.17) · [Full changelog](CHANGELOG.md).
 >
 > **Version policy**: since plugin **0.6.2**, the Android app and plugin use independent version numbers and releases. Their numbers do not need to match, and a plugin update does not imply an app update. [Compatibility notes](#compatibility).

package/README.md CHANGED Viewed

@@ -26,13 +26,13 @@
   <a href="#兼容性">兼容性</a> ·
   <a href="docs/README.md">文档</a> ·
   <a href="#贡献者">贡献者</a> ·
-  <a href="https://github.com/saya-ch/dsh-mobile/releases/tag/v0.6.16">更新记录</a> ·
+  <a href="https://github.com/saya-ch/dsh-mobile/releases/tag/v0.6.17">更新记录</a> ·
   <a href="README.en.md">English</a>
 </p>
 > DSH Mobile 是 DeepSeek Harness 社区插件，原生 App 仅支持 Android。
 >
-> **当前正式版本：0.6.16**。新增相册入口、浏览器语言记忆和 FRP 字段提示，改善前台重连；配合独立发布的 Android App **0.6.7**，可选择同电脑局域网／远程切换，并迁移符合条件的纯文本草稿。[插件更新与下载](https://github.com/saya-ch/dsh-mobile/releases/tag/v0.6.16) · [完整更新记录](CHANGELOG.md)。
+> **当前正式版本：0.6.17**。修正目录选择器归属：官方 Desktop 保留原生选择器、**添加工作区**与 `Ctrl+O`，移动页改用页内目录浏览；慢链路下压缩 HTML 与 API 响应、缩小启动批次并复用已下载资源；模块设置新增传输体积和最小预设。Android App **0.6.7** 继续适用，本版不含新 APK。[插件更新与下载](https://github.com/saya-ch/dsh-mobile/releases/tag/v0.6.17) · [完整更新记录](CHANGELOG.md)。
 >
 > **版本说明**：自插件 **0.6.2** 起，Android App 与插件独立编号、独立发布，版本号无需一致；插件升级不代表 App 需要同步升级。[兼容说明](#兼容性)。

package/cordis.patch.yml CHANGED Viewed

@@ -1,22 +1,16 @@
 # Community bundle for the stock DSH Web profile. Installation contributes a
 # Host gateway and a browser Client face; it does not patch DSH source files.
-- id: directory-picker
-  name: '@deepseek-ai/dsh-host-directory-picker-auto'
-  disabled: true
+#
+# The directory picker is deliberately NOT composed here. Since DSH 0.2.1 the
+# `directory-picker` row is `@deepseek-ai/dsh-host-directory-picker-auto`, which
+# resolves the backend once at boot and mounts both its Host and Client faces
+# itself; the official Desktop no longer inserts its own pair. Inserting a second
+# picker here therefore collides on the single `directoryFlow` slots and on the
+# `directoryPicker` service, which makes the "Add workspace" action and its
+# Ctrl+O shortcut disappear. The dedicated Mobile page registers its own in-page
+# flow from the client face instead (see src/client.ts), so the desktop keeps its
+# native OS chooser without a second Host entry.
 - insert:
-    - id: directory-picker-mobile-host
-      name: '@deepseek-ai/dsh-host-directory-picker-browse'
-      # Windows DSH Desktop supplies its own browse pair after user patches.
-      # Its `desktopProfiles` service can appear before `desktopRuntime`; keep
-      # the platform guard so a Desktop profile on macOS/Linux retains the
-      # portable in-page picker.
-      disabled: !!js process.platform === 'win32' && (ctx.get('desktopRuntime')?.platform === 'win32' || ctx.get('desktopProfiles') !== undefined)
-    - id: directory-picker-mobile-surface
-      name: '@deepseek-ai/dsh-client-ui-directory-picker-browse'
-      disabled: !!js process.platform === 'win32' && (ctx.get('desktopRuntime')?.platform === 'win32' || ctx.get('desktopProfiles') !== undefined)
     - id: mobile-access
       name: dsh-mobile
       inject: [webServer, connection]
@@ -38,4 +32,3 @@
     # DSH anchors this file entry beside the bundle patch, independent of pnpm's linker.
     - id: dsh-ui-fixes
       name: ./packages/question-fixes/lib/index.mjs

package/docs/CLIENT_MODULES.en.md CHANGED Viewed

@@ -34,11 +34,19 @@ After a DSH or plugin update, an old exclusion may be missing from the catalog o
 Close, Escape and the App's Back action ask before discarding unsaved changes. A failed save keeps choices. A write timeout means the result is unconfirmed, not rolled back; reread to confirm. Writes are not retried automatically, and closing cannot undo a completed save. Long lists scroll independently while close and footer actions remain reachable.
-Computer pages and `?frontend=stock` pages are unaffected. DSH or community-plugin updates can change the catalog and dependencies. When a saved selection prevents the mobile page from starting, the page offers “Load all modules for this device and retry”; it changes this device’s selection only when you click, without changing computer defaults, other devices or pairing authorization. Settings APIs still reject invalid selections and enforce required-module and dependency checks. Module sizes depend on the installation, so no fixed traffic reduction is promised.
+Computer pages and `?frontend=stock` pages are unaffected. DSH or community-plugin updates can change the catalog and dependencies. When a saved selection prevents the mobile page from starting, the page offers “Load all modules for this device and retry”; it changes this device’s selection only when you click, without changing computer defaults, other devices or pairing authorization. Settings APIs still reject invalid selections and enforce required-module and dependency checks.
+## Measure sizes and minimize loading
+Only **Measure sizes** fetches module resources and calculates their individual gzip sizes. Ordinary reads, saves and resets do not wait for these probes. Measurement can be cancelled without replacing unsaved choices, saving or reloading the page. Each measurement has a five-second budget; completed results remain available and the rest stay unknown. Known results are cached for ten minutes and must be measured again after a DSH module-graph update.
+Each group lists measured modules largest first and unknown sizes last. Totals always identify any selected modules with unknown sizes rather than presenting a partial result as complete. The mobile layout is measured from the actual Gateway layout file. Batch merging, browser caches, encoding negotiation and plugin versions affect actual transfers, so the numbers compare current modules rather than promise exact next-open downloads or fixed savings.
+Modules whose package metadata is resolvable in the installation may also show the plugin's own `package.json` description: links removed, collapsed to one line, at most 200 characters. This is not an upstream endorsement. Unexported or unreadable metadata stays absent instead of guessing its purpose. **Required only (minimal load)** keeps required boot entries and their dependencies and marks other entries as not loaded. It edits the draft only; **Save selection** remains a separate action.
 ## Data and authorization
-Selections are atomically stored in the computer's private DSH Mobile data directory, without copying conversation drafts. The catalog returns only module IDs, required markers, dependencies, and selections—not upstream download URLs, host file paths, or pairing credentials. A phone reads its own selection through the authenticated Gateway; changes also require same-origin and CSRF checks.
+Selections are atomically stored in the computer's private DSH Mobile data directory, without copying conversation drafts. The catalog returns module IDs, required markers, dependencies, selections, and available sizes and package descriptions—not upstream download URLs, host file paths, or pairing credentials. A phone reads its own selection through the authenticated Gateway; changes and explicit measurements also require same-origin and CSRF checks.
 Revoking a pairing removes that identity's module override. To stop a phone from operating the computer, revoke the device on the computer rather than disabling one client component.

package/docs/CLIENT_MODULES.md CHANGED Viewed

@@ -34,11 +34,19 @@ DSH 或插件更新后，旧排除项可能已不在目录中，或变为启动
 关闭、Escape 或 App 返回动作触发时，有未保存改动会提示确认。保存失败保留选择；保存超时只表示结果尚未确认，不等于服务器已回滚。可重新读取确认保存结果，不会自动重试写入，关闭弹窗也不能撤销已经完成的保存。长列表独立滚动，关闭和底部操作保持可达。
-电脑页面与 `?frontend=stock` 页面不受模块选择影响。DSH 或社区插件更新可能改变模块目录和依赖；已保存的选择阻止移动页面启动时，页面提供“为本设备加载全部模块并重试”，由你点击后恢复本设备的加载选择，不改变电脑默认、其他设备或配对授权。设置接口仍拒绝无效选择，不绕过启动必需或依赖检查。模块大小因安装环境而异，不承诺固定的加载流量节省比例。
+电脑页面与 `?frontend=stock` 页面不受模块选择影响。DSH 或社区插件更新可能改变模块目录和依赖；已保存的选择阻止移动页面启动时，页面提供“为本设备加载全部模块并重试”，由你点击后恢复本设备的加载选择，不改变电脑默认、其他设备或配对授权。设置接口仍拒绝无效选择，不绕过启动必需或依赖检查。
+## 体积测量与最小加载
+点击“测量体积”才会读取模块资源并计算各模块独立 gzip 后的体积。普通读取、保存和恢复默认不会等待这些探测；测量期间可随时取消，未保存选择不会被覆盖，也不会保存或刷新页面。每次测量最多使用五秒预算；结束后显示已完成的结果，其余保持未知，已知结果缓存十分钟，DSH 模块图更新后重新测量。
+每个分组按已测体积从大到小排列，未知项放在最后。合计始终说明仍有多少勾选项未测到，不把部分结果当作完整流量。移动布局测量的是网关实际提供的布局文件。模块合并、浏览器缓存、压缩协商和插件版本都会影响真实下载量，所以数字只帮助比较当前模块，不代表精确的下次下载量或固定节省比例。
+能通过当前安装环境解析到包元数据的模块还会显示插件自己的 `package.json` 描述：去除链接、压成一行、最长 200 字，不代表上游认证；包未导出元数据或无法读取时不显示，不猜测用途。“仅必需（最小加载）”只保留启动必需项及其依赖，其他项设为不加载；它只修改草稿，仍需点击“保存选择”。
 ## 数据与授权
-选择原子保存在电脑的 DSH Mobile 私有数据目录，不复制会话草稿。目录接口只返回模块 ID、必需标记、依赖和选择，不返回上游下载 URL、本机文件路径或配对凭据。手机只能通过已认证的 Gateway 读取自己的选择；修改还需同源和 CSRF 校验。
+选择原子保存在电脑的 DSH Mobile 私有数据目录，不复制会话草稿。目录接口返回模块 ID、必需标记、依赖、选择及可用的体积和包描述，不返回上游下载 URL、本机文件路径或配对凭据。手机只能通过已认证的 Gateway 读取自己的选择；修改和显式测量还需同源和 CSRF 校验。
 撤销配对授权会移除该授权的模块覆盖。要停止某台手机操作电脑，请在电脑端撤销设备，而不是只关闭一个客户端模块。

package/docs/SLOW_CONNECTIONS.en.md CHANGED Viewed

@@ -32,6 +32,8 @@ Plugin 0.6.13 and later distinguish request receive timeouts as `408 request_tim
 The `http failure` diagnostics distinguish three per-Gateway categories: `parser` for HTTP parsing/receive failures, `target` for invalid request targets, and `upstream` for an authenticated `POST /api/session/prompt` rejected upstream. The first event of each kind is immediate; repeats aggregate for 30 seconds, with `suppressed` counting earlier suppressed events of that kind. Logs exclude raw errors, request bodies, raw packets, Cookies, Tokens, queries and arbitrary URLs. No record does not establish success.
+`slow api` samples authenticated, forwarded `/api/` requests taking at least 3 seconds: a bounded method, a fixed route category such as `/api/session` (unknown categories become `/api/other`), the status and `durationMs`. The duration spans entry into upstream forwarding until the response closes, including a client-abandoned response; it is a proxy wait, not a measurement of upstream processing time or proof of the slow layer. Logs exclude path suffixes such as Session IDs, query strings, request bodies and arbitrary raw paths. Each Gateway records its first event immediately and aggregates subsequent samples within 30 seconds. This changes no timeout, retry or caching policy.
 `upstreamTimeoutMs` governs upstream transport waits and also configures the complete inbound-request receive deadline. A continuously active upload can still exceed that total deadline, and Node's periodic checks affect the observed firing time. Do not delete pairings, clear App data or automatically resend because of HTTP 400 alone. Identify the rejection layer using the actual response body, Content-Type, exact versions and redacted proxy upstream status. Check the Session result before retrying an operation whose execution outcome is unknown.
 ## Keep event streams distinct
@@ -108,7 +110,15 @@ Restart DSH and reopen the phone page after a change. Developer tools can show w
 ## Static-resource caching and repeated downloads
-Gateway-generated resources use quoted ETags and process conditional GET/HEAD requests only after device authentication and resource checks. When the gateway applies streaming gzip to an upstream static resource, a valid upstream ETag can remain usable as a weak validator with `Vary: Accept-Encoding`. Identity lengths and range metadata are not reused as compressed-representation metadata. Failed responses are not cached, and API requests receive no new caching policy.
+Owned static resources (`/mobile-access/compat.js`, `mobile-layout.js` and custom CSS/JS) use quoted content ETags and `Cache-Control: private, no-cache`. A browser may store the body but must revalidate before reuse. The gateway checks device authorization and the current resource before processing conditional GET/HEAD requests: unchanged content receives `304`, while a file edit returns the new body. Actual cache reuse still depends on browser behavior.
+The Mobile start HTML includes a page identifier bound to the current authenticated Session and remains `no-store`; it does not reuse another page's or Session's start document. Pairing pages and API responses also remain `no-store`. When the gateway applies streaming gzip to an upstream static resource, a valid upstream ETag can remain usable as a weak validator with `Vary: Accept-Encoding`. Identity lengths and range metadata are not reused as compressed-representation metadata. Failed responses are not cached, and API requests receive no new caching policy.
+Every compressible text response uses that streaming pipeline: static assets, HTML documents and `/api/` JSON are gzipped when the phone advertises `Accept-Encoding: gzip`, with `Vary` maintained. Static assets under `/plugins/` and `/assets/` **keep their existing decision unchanged**, including paths the upstream already compressed. Outside static assets, `text/event-stream` stays identity so gzip blocks cannot buffer event frames, and a response that declares fewer than 1KB or no length at all stays identity because compressing it costs more than it saves or may be consumed incrementally. Range requests, already encoded responses and 304s keep their previous behavior, and a client that sends no `Accept-Encoding` receives the same bytes as before.
+The Mobile start document is assembled by the gateway rather than the proxy compression pipeline. Bodies of at least 1KiB are gzipped when the request accepts gzip; both identity and gzip responses maintain `Vary: Accept-Encoding`. The document retains `no-store` because it contains boot information for the current session and module selection.
+The gateway groups upstream application modules into start batches (`/mobile-access/mobile-boot/<hash>.js`), targeting 3MiB of source per batch. It retains at most 16 merged batches, always including the Mobile layout replacement; overflow modules use their original individual resource URLs instead of rejecting the entire boot graph. A module larger than the target remains whole, and existing per-module and assembly limits still apply. Smaller responses and cache reuse reduce repeated transfers but do not guarantee total startup time or repair every cause of reconnection. Merged batches carry a quoted ETag and `private, max-age=30, must-revalidate`: a quick reload can reuse its local copy. After a layout-file edit, an already cached batch can remain fresh for up to 30 seconds before revalidation. The ETag identifies the body, so changed content produces a new body rather than a 304.
 Resources without upstream validators do not automatically acquire a reliable one. Compare the same complete resource URL during ordinary navigation, reload and app cold start: inspect `200`/`304`, cache hits, `If-None-Match`, encoding and actual transfer volume. Do not clear site data first and treat the result as normal cache behavior. Improved HTTP validation does not guarantee cache reuse in every WebView, and these headers alone do not establish a complete fix for [#107](https://github.com/saya-ch/dsh-mobile/issues/107).

package/docs/SLOW_CONNECTIONS.md CHANGED Viewed

@@ -32,6 +32,8 @@
 `http failure` 日志按网关区分 `parser`、`target`、`upstream` 三类：分别表示 HTTP 解析／接收失败、非法请求目标、已认证的 `POST /api/session/prompt` 被上游拒绝。每类首条立即记录，后续 30 秒内聚合，下一条的 `suppressed` 是此前被抑制的同类数量。日志不保留原始报错、请求正文、原始包、Cookie、Token、查询参数或任意 URL；不记录某条也不能证明它成功。
+`slow api` 日志采样已认证并转发、耗时至少 3 秒的 `/api/` 请求：固定方法、`/api/session` 等固定路由类别（未知类别归为 `/api/other`）、状态和 `durationMs`。耗时从进入上游代理转发算到响应关闭，包含客户端中途放弃的响应；它是代理等待时间，不是上游处理耗时，也不能单凭该数字确定哪一层慢。日志不保留会话 ID 等路径后缀、查询参数、请求正文或任意原始路径，每个网关首条立即记录、后续采样在 30 秒窗口内聚合。不改变超时、重试或缓存策略。
 `upstreamTimeoutMs` 既用于上游传输等待，也配置了入站完整请求的接收期限；持续上传不保证避开这个总期限，Node 的定期检查会影响实际触发时刻。不要仅凭 HTTP 400 就删除配对、清空 App 数据或自动重发。先区分拒绝来源，并查看实际响应正文、Content-Type、准确版本和脱敏的代理上游状态；消息或工具是否已执行不明时，先核对会话结果。
 ## 不同事件流不能混为一谈
@@ -108,7 +110,15 @@ websocketCompression:
 ## 静态资源缓存与重复下载
-网关自身生成的资源使用带引号的 ETag，并在设备鉴权和资源检查之后处理 GET/HEAD 的条件请求。网关对上游静态资源做流式 gzip 时，可保留合法上游 ETag 的弱校验形式，并维护 `Vary: Accept-Encoding`；不会把原始内容的长度或范围元信息当作压缩内容的元信息，也不会缓存失败响应或为 API 请求新增缓存。
+网关自有静态资源（`/mobile-access/compat.js`、`mobile-layout.js`、自定义 CSS/JS）使用带引号的内容 ETag 和 `Cache-Control: private, no-cache`。浏览器可保存正文，但每次复用前必须重新校验；网关先检查设备授权和当前资源，再处理 GET/HEAD 条件请求，内容未变时返回 `304`，文件改动后返回新正文。实际缓存复用仍取决于浏览器行为。
+移动启动 HTML 包含绑定当前认证 Session 的页面标识，保持 `no-store`，不复用其他页面或 Session 的启动文档；配对页和 API 响应也保持 `no-store`。网关对上游静态资源做流式 gzip 时，可保留合法上游 ETag 的弱校验形式，并维护 `Vary: Accept-Encoding`；不会把原始内容的长度或范围元信息当作压缩内容的元信息，也不会缓存失败响应或为 API 请求新增缓存。
+可压缩的文本响应都走这条流式管道：静态资源、HTML 文档和 `/api/` 的 JSON 都会在手机声明 `Accept-Encoding: gzip` 时压缩，并维护 `Vary`。`/plugins/`、`/assets/` 下的静态资源**沿用原有判定，行为不变**（包括上游原本就会压缩的路径）。静态路径之外，`text/event-stream` 保持不压缩，否则逐帧事件会被 gzip 块缓冲；声明长度小于 1KB 或没有声明长度的响应也保持原样，压缩开销大于收益或可能被逐段消费。范围请求、已编码响应和 304 仍按原规则处理，不带 `Accept-Encoding` 的客户端收到的字节与以前一致。
+移动端启动页由网关拼装，不经过上面的代理压缩流程；正文至少 1KiB 且请求接受 gzip 时会压缩，压缩和未压缩响应都维护 `Vary: Accept-Encoding`。页面仍使用 `no-store`，不复用旧启动文档；它包含当前会话与模块选择对应的启动信息。
+网关把上游应用模块组合为启动批（`/mobile-access/mobile-boot/<hash>.js`），按 3MiB 源码目标大小切分，最多保留 16 个合并批，始终保留移动布局替换；超出数量的模块改用其原有独立资源地址，不因这项优化拒绝整个启动图。大于目标大小的单个模块不会拆开，原有单模块和组装大小限制不变。较小的响应和缓存复用可减少重复传输，但不能保证总启动时间或修复所有自动重连原因。合并批使用带引号 ETag 和 `private, max-age=30, must-revalidate`：短时间内重载可复用本地副本；布局文件改动后，已缓存的旧批最多可继续使用 30 秒，随后重新校验。ETag 与正文绑定，内容改变后返回新正文而不是 304。
 上游未提供校验标识的资源不会因此自动得到一个可靠标识。检查重复下载时，比较同一完整资源 URL 在普通打开、重新加载和 App 冷启动中的 `200`/`304`、缓存命中、`If-None-Match`、编码与实际传输量；不要先清除站点数据再把结果当作正常缓存行为。HTTP 校验语义改善不保证每个 WebView 都会复用缓存，也不能仅凭这些响应头认定 [#107](https://github.com/saya-ch/dsh-mobile/issues/107) 已完全解决。