dsh-mobile 0.8.2 → 0.8.4

package/CHANGELOG.md

@@ -2,6 +2,26 @@
 
 Notable changes are recorded here. GitHub Releases provide the downloadable packages and generated commit notes.
 
+## 0.8.4 - 2026-11-07
+
+- Resolve query-only and relative upstream redirects against the URL that actually requested them. This fixes mobile `/api/file` image previews receiving the app document after a redirect, while external redirect targets remain unchanged. Thanks @owenzhao for the report in [#361](https://github.com/saya-ch/dsh-mobile/issues/361). Thanks @aaalzk for independently confirming it.
+- Keep the conversation clear of the folded icon rail when the drawer is closed, without changing open-drawer, docked or stock DSH layouts. Thanks @LUgABeEEE for [#362](https://github.com/saya-ch/dsh-mobile/pull/362).
+- Add browser access guidance for HarmonyOS and for using an existing virtual LAN such as StarVPN. Neither new environment is claimed as device- or end-to-end-tested.
+- Plugin-only update. Android 0.7.2 remains the published App; this release contains no native App change or device-cache activation.
+
+## 0.8.3 - 2026-11-05
+
+- Move the current DSH 0.2.2 compatibility test lane to 0.2.2-rc.1. Preserve the dedicated Mobile layout by default, and route App Back on a foreground upstream drawer to DSH's own dismissal handler.
+- Keep a landscape phone's drawer and panel return action even above the wide-window threshold; a tablet's keyboard does not change its layout band. Update sidebar scroll ownership after the new layout commits. Thanks @LUgABeEEE for [#346](https://github.com/saya-ch/dsh-mobile/pull/346).
+- Align the Plugins panel heading with its content and restore compact built-in plugin cards while keeping their full-card tap area. Stack Web Push categories and actions in General settings without changing delivery or consent. Thanks @chintoleung for [#351](https://github.com/saya-ch/dsh-mobile/pull/351) and [#353](https://github.com/saya-ch/dsh-mobile/pull/353).
+- Support the optional frpc username for shared servers. Clear a saved username without reentering the token when the frps address and control port are unchanged. Thanks @xaxka for [#344](https://github.com/saya-ch/dsh-mobile/pull/344).
+- Update the optional managed cloudflared component from 2026.9.1 to 2026.10.7. Install the new component explicitly from the desktop panel; it is not fetched automatically. Existing tunnel settings are not deleted.
+- Describe Funnel listener startup separately from verified public access. The bundled Funnel remains public-ingress-only; this change neither enables tailnet ingress nor fixes an unverified public-route failure.
+- Add optional folder-permission guidance to the remote panel on macOS. It does not probe or request Full Disk Access, change system settings, or block pairing. Thanks @LunarFeller for [#354](https://github.com/saya-ch/dsh-mobile/issues/354).
+- Render iroh pairing QR codes with a four-module quiet zone and keep the copy action available when a valid pairing descriptor has no QR image. Do not reuse the previous image after opening a new pairing window. This does not establish the cause of the transport failures in [#338](https://github.com/saya-ch/dsh-mobile/issues/338).
+- Update the browser-bundled SHA-256 dependency, noble-hashes, to 2.4.0 and adapt its imports and UTF-8 input without changing native notification tags. [#334](https://github.com/saya-ch/dsh-mobile/pull/334)
+- Plugin-only update. Android 0.7.2 remains the published App; this update does not introduce a native WebView cache.
+
 ## Android 0.7.2 - 2026-11-04
 
 - Android: accept a pinned gateway's WebSocket certificate callback when the secure authority and verified leaf match the paired HTTPS origin. Host, port, CA, certificate validity, signature and SAN checks remain required. Cleartext, foreign authorities and URL credentials remain rejected. Thanks @LUgABeEEE for [#343](https://github.com/saya-ch/dsh-mobile/pull/343).

package/CONTRIBUTORS.md

@@ -1,10 +1,22 @@
 # 贡献者 / Contributors
 
-GitHub 的 [Contributors 图表](https://github.com/saya-ch/dsh-mobile/graphs/contributors) 按进入默认分支的提交自动统计，无法手动加入仅提交 issue 或 PR 提案的成员。本页按截至 2026-11-03 的实际参与方式感谢社区成员；仓库维护者与自动依赖更新仍可在 GitHub 历史记录中查看。
+GitHub 的 [Contributors 图表](https://github.com/saya-ch/dsh-mobile/graphs/contributors) 按进入默认分支的提交自动统计，无法手动加入仅提交 issue 或 PR 提案的成员。本页按实际参与方式感谢社区成员；仓库维护者与自动依赖更新仍可在 GitHub 历史记录中查看。
 
-GitHub's Contributors graph counts commits on the default branch; issue reports and PR proposals cannot be manually added to it. This page credits community members by how they contributed, through 2026-11-03. The repository maintainer and automated dependency updates remain visible in GitHub's history.
+GitHub's Contributors graph counts commits on the default branch; issue reports and PR proposals cannot be manually added to it. This page credits community members by how they contributed. The repository maintainer and automated dependency updates remain visible in GitHub's history.
 
-## 0.8.2 候选贡献 / Candidate contributions for 0.8.2
+## 0.8.4 贡献 / Contributions for 0.8.4
+
+感谢 [@owenzhao](https://github.com/owenzhao) 在 [#361](https://github.com/saya-ch/dsh-mobile/issues/361) 报告相对重定向导致移动图片预览失败。感谢 [@aaalzk](https://github.com/aaalzk) 独立确认，以及 [@LUgABeEEE](https://github.com/LUgABeEEE) 在 [#362](https://github.com/saya-ch/dsh-mobile/pull/362) 提供折叠栏布局修复。原作者提交保留；维护者修正另记。
+
+Thanks [@owenzhao](https://github.com/owenzhao) for reporting the mobile image-preview redirect failure in [#361](https://github.com/saya-ch/dsh-mobile/issues/361). Thanks [@aaalzk](https://github.com/aaalzk) for independently confirming it, and [@LUgABeEEE](https://github.com/LUgABeEEE) for the folded-rail layout fix in [#362](https://github.com/saya-ch/dsh-mobile/pull/362). Original commits are retained, with maintainer corrections recorded separately.
+
+## 0.8.3 贡献 / Contributions for 0.8.3
+
+感谢 [@xaxka](https://github.com/xaxka) 在 [#344](https://github.com/saya-ch/dsh-mobile/pull/344) 提供共享 FRP 用户名支持，[@LUgABeEEE](https://github.com/LUgABeEEE) 在 [#346](https://github.com/saya-ch/dsh-mobile/pull/346) 提供横屏布局判断，以及 [@chintoleung](https://github.com/chintoleung) 在 [#351](https://github.com/saya-ch/dsh-mobile/pull/351) 和 [#353](https://github.com/saya-ch/dsh-mobile/pull/353) 修复推送设置与插件页布局。原作者提交保留，维护者修正另记。
+
+Thanks [@xaxka](https://github.com/xaxka) for the shared-FRP username in [#344](https://github.com/saya-ch/dsh-mobile/pull/344), [@LUgABeEEE](https://github.com/LUgABeEEE) for the landscape layout in [#346](https://github.com/saya-ch/dsh-mobile/pull/346), and [@chintoleung](https://github.com/chintoleung) for the push-settings and Plugins-page layout fixes in [#351](https://github.com/saya-ch/dsh-mobile/pull/351) and [#353](https://github.com/saya-ch/dsh-mobile/pull/353). Original commits are retained, with maintainer corrections recorded separately.
+
+## 0.8.2 贡献 / Contributions for 0.8.2
 
 感谢 [@LUgABeEEE](https://github.com/LUgABeEEE) 通过 [#343](https://github.com/saya-ch/dsh-mobile/pull/343) 修正 Android 固定证书的 WebSocket 地址判断。原作者提交保留；维护者补充完整证书决策组合回归。该原生改动归入独立编号的 Android 0.7.2 候选，不由 npm 升级替代。
 

package/README.en.md

@@ -28,7 +28,7 @@
   <a href="#compatibility">Compatibility</a> ·
   <a href="docs/README.md">Documentation</a> ·
   <a href="#contributors">Contributors</a> ·
-  <a href="https://github.com/saya-ch/dsh-mobile/releases/tag/v0.8.2">Release notes</a> ·
+  <a href="https://github.com/saya-ch/dsh-mobile/releases/tag/v0.8.4">Release notes</a> ·
   <a href="README.md">简体中文</a>
 </p>
 
@@ -36,7 +36,7 @@
 >
 > **Using an iPhone or iPad?** Use Safari or [add DSH Mobile to your Home Screen as a web app (PWA)](<#iphone-and-ipad-home-screen-web-app-pwa>)—no native iOS download needed.
 >
-> **Current stable release: 0.8.2**. Improve connection diagnostics, minimal module loading and device recovery; fix the FRP attach panel and Android Back hierarchy; and adapt to DSH 0.2.2-alpha.3. Plugin and Android App releases remain independent. [Plugin release notes and downloads](https://github.com/saya-ch/dsh-mobile/releases/tag/v0.8.2) · [Full changelog](CHANGELOG.md).
+> **Current stable release: 0.8.4**. Fix mobile images loading the app document after a relative redirect, and keep the folded rail clear of the conversation. Plugin and Android App releases remain independent. [Plugin release notes and downloads](https://github.com/saya-ch/dsh-mobile/releases/tag/v0.8.4) · [Full changelog](CHANGELOG.md).
 >
 > **Version policy**: since plugin **0.6.2**, the Android app and plugin use independent version numbers and releases. Their numbers do not need to match, and a plugin update does not imply an app update. [Compatibility notes](#compatibility).
 
@@ -167,6 +167,8 @@ Browser pairing and reauthentication pages support Simplified Chinese, English a
 
 For manual browser pairing, enter the 43-character pairing code shown on the computer. Keys starting with `dsh1.` or `dsh2.` belong in the Android app, not the browser field. Prefer the pairing link copied from the computer, which fills the code automatically; generate a new link when it expires.
 
+**HarmonyOS phones and tablets:** If you cannot install the Android APK, try opening the browser pairing link copied from the computer, preferably through a trusted HTTPS entry. There is no native HarmonyOS package, and browser use on physical HarmonyOS devices has not been verified. Check pairing, opening a conversation, and reconnecting. If one of these fails, report the device model, system and browser versions, and the failing step without sharing the original pairing link.
+
 ### Remote access
 
 Use this after the phone leaves the computer's network. Remote access is disabled by default, and the phone needs no separate Tailscale, cpolar, cloudflared, or FRP app.
@@ -445,7 +447,9 @@ On macOS, local network, cloudflared, self-hosted FRP and the own reverse proxy
 
 | DSH Mobile plugin | Verified DeepSeek Harness version |
 | --- | --- |
-| `0.8.2` | The current preview target is `0.2.2-alpha.3`, alongside existing checks including `0.2.1-rc.5`. Fresh `0.2.2-alpha.2` installs can fail to save settings because of an upstream dependency mismatch; upgrade to alpha.3. See the [independent reproduction](https://github.com/deepseek-ai/deepseek-harness/discussions/11994#discussioncomment-19373554). Historical alpha.2 verification does not establish that its freshly resolved dependencies still work |
+| `0.8.4` | Plugin maintenance update. The packed DSH test target remains `0.2.2-rc.1`, alongside existing compatibility checks. The upstream rc.1 npm CLI requires Node.js 24.9 or later |
+| `0.8.3` | Adapted to DSH 0.2.2-rc.1 with landscape, Plugins and Web Push settings layout fixes, shared FRP usernames and iroh pairing improvements |
+| `0.8.2` | The DSH 0.2.2 preview target for this release was `0.2.2-alpha.3`. Fresh `0.2.2-alpha.2` installs can fail to save settings because of an upstream dependency mismatch; see the [independent reproduction](https://github.com/deepseek-ai/deepseek-harness/discussions/11994#discussioncomment-19373554). Users still on alpha.2 should upgrade to rc.1 |
 | `0.8.1` | Add packed boot, settings, directory selection, attachments, sidebar and compressed Workspace checks on `0.2.1-rc.5` and `0.2.2-alpha.2`; see [CI](https://github.com/saya-ch/dsh-mobile/actions/workflows/ci.yml) for the complete version matrix |
 | `0.8.0` | Push public-contract, settings, encrypted-payload and tap-ownership checks are pinned to `0.2.1-rc.2 / rc.3`; see [CI](https://github.com/saya-ch/dsh-mobile/actions/workflows/ci.yml) for the general boot/layout matrix. iOS device results accept contributor testing; browser checks do not establish every phone, plugin or public route |
 

package/README.md

@@ -28,7 +28,7 @@
   <a href="#兼容性">兼容性</a> ·
   <a href="docs/README.md">文档</a> ·
   <a href="#贡献者">贡献者</a> ·
-  <a href="https://github.com/saya-ch/dsh-mobile/releases/tag/v0.8.2">更新记录</a> ·
+  <a href="https://github.com/saya-ch/dsh-mobile/releases/tag/v0.8.4">更新记录</a> ·
   <a href="README.en.md">English</a>
 </p>
 
@@ -36,7 +36,7 @@
 >
 > **使用 iPhone 或 iPad？** 可以用 Safari 访问，或[添加到主屏幕作为 Web App（PWA）使用](<#iphone-与-ipad主屏幕-web-apppwa>)，无需下载原生 iOS App。
 >
-> **当前正式版本：0.8.2**。改进连接诊断、最小模块加载与设备恢复，修复 FRP 接入面板和 Android 返回层级，并适配 DSH 0.2.2-alpha.3。插件与 Android App 独立更新。[插件更新与下载](https://github.com/saya-ch/dsh-mobile/releases/tag/v0.8.2) · [完整更新记录](CHANGELOG.md)。
+> **当前正式版本：0.8.4**。修复移动端图片在相对重定向后加载成首页的问题，并修正折叠侧栏覆盖会话的布局。插件与 Android App 独立更新。[插件更新与下载](https://github.com/saya-ch/dsh-mobile/releases/tag/v0.8.4) · [完整更新记录](CHANGELOG.md)。
 >
 > **版本说明**：自插件 **0.6.2** 起，Android App 与插件独立编号、独立发布，版本号无需一致；插件升级不代表 App 需要同步升级。[兼容说明](#兼容性)。
 
@@ -169,6 +169,8 @@ dsh plugin --profile web add dshmarket
 
 浏览器手动配对时填写电脑端显示的 43 位配对码；以 `dsh1.` 或 `dsh2.` 开头的是 Android App 密钥，不要填入浏览器配对框。优先打开电脑端复制的配对链接，它会自动填写配对码；过期后在电脑端重新生成。
 
+**鸿蒙手机／平板**：如果无法安装 Android APK，可先用浏览器打开电脑端复制的网页配对链接，优先使用受信任的 HTTPS 入口。目前没有原生鸿蒙安装包，也未完成鸿蒙浏览器真机验收。请先确认能否配对、打开会话和重连；若失败，反馈时附机型、系统和浏览器版本，以及失败发生在哪一步，不要附原始配对链接。
+
 ### 远程访问
 
 适合手机离开电脑所在网络后使用。远程访问默认关闭，手机不需要另外安装 Tailscale、cpolar、cloudflared 或 FRP。
@@ -447,7 +449,9 @@ macOS 上局域网、cloudflared、自建 FRP 与自有反向代理可用；Funn
 
 | DSH Mobile 插件 | 已验证的 DeepSeek Harness 版本与范围 |
 | --- | --- |
-| `0.8.2` | 当前预览验证目标为 `0.2.2-alpha.3`，同时保留 `0.2.1-rc.5` 等既有版本检查。`0.2.2-alpha.2` 全新安装可能因上游依赖组合不一致而无法保存设置，请升级到 alpha.3；[独立复现](https://github.com/deepseek-ai/deepseek-harness/discussions/11994#discussioncomment-19373554)。历史 alpha.2 验证不代表其当前新装依赖仍可用 |
+| `0.8.4` | 插件维护更新，继续使用 `0.2.2-rc.1` 的 DSH 打包验证目标，并保留既有版本检查。使用 rc.1 的 npm CLI 时，按上游要求使用 Node.js 24.9 或更新版本 |
+| `0.8.3` | 当时适配 DSH 0.2.2-rc.1，修复横屏、插件页和网页推送设置布局，支持共享 FRP 用户名，并改进 iroh 配对 |
+| `0.8.2` | 当时的 DSH 0.2.2 预览目标是 `0.2.2-alpha.3`。`0.2.2-alpha.2` 全新安装可能因上游依赖组合不一致而无法保存设置；[独立复现](https://github.com/deepseek-ai/deepseek-harness/discussions/11994#discussioncomment-19373554)。仍在使用 alpha.2 的用户建议升级到 rc.1 |
 | `0.8.1` | 新增 `0.2.1-rc.5`、`0.2.2-alpha.2` 的打包启动与设置、目录选择、附件、侧栏、压缩 Workspace 连接检查；完整版本矩阵见 [CI](https://github.com/saya-ch/dsh-mobile/actions/workflows/ci.yml) |
 | `0.8.0` | 网页推送的公共接口、设置、加密载荷与点击归属检查固定在 `0.2.1-rc.2 / rc.3`；通用启动与布局矩阵见 [CI](https://github.com/saya-ch/dsh-mobile/actions/workflows/ci.yml)。iOS 真机结果采信贡献者实测；浏览器检查不代表所有手机、第三方插件或公网线路已验收 |
 

package/THIRD_PARTY_NOTICES.md

@@ -18,7 +18,7 @@ The optional managed Caddy component is not included in the npm package or Andro
 
 The experimental Rust transport is adapted from [dsh-mobile-iroh](https://github.com/saya-ch/dsh-mobile-iroh), copyright 2026 Guangqi Zhang, under the MIT License, and the host baseline preserves zexadev's MIT-licensed dsh-tether attribution. The source notices and complete licenses are retained under `native/iroh-host/` and included with the npm package. The optional sidecar is not bundled: explicit installation reuses a verified companion copy or downloads the size- and SHA-256-pinned companion release payload. Enabling the channel alone does not download it.
 
-The npm package declares direct runtime dependencies on [Schemastery](https://github.com/shigma/schemastery) `^3.18.1`, [@noble/hashes](https://github.com/paulmillr/noble-hashes) `1.8.0`, [bonjour-service](https://github.com/onlxltd/bonjour-service) `1.4.4`, [eventsource-parser](https://github.com/rexxars/eventsource-parser) `3.1.0`, [qrcode](https://github.com/soldair/node-qrcode) `^1.5.4`, [selfsigned](https://github.com/jfromaniello/selfsigned) `^5.5.0`, [ws](https://github.com/websockets/ws) `8.22.0`, and [Zod](https://zod.dev/) `4.6.7`. These packages are distributed under the MIT License; the release checkout's exact transitive versions appear in the attached CycloneDX npm SBOM.
+The npm package declares direct runtime dependencies on [Schemastery](https://github.com/shigma/schemastery) `^3.18.1`, [@noble/hashes](https://github.com/paulmillr/noble-hashes) `2.4.0`, [bonjour-service](https://github.com/onlxltd/bonjour-service) `1.4.4`, [eventsource-parser](https://github.com/rexxars/eventsource-parser) `4.1.3`, [qrcode](https://github.com/soldair/node-qrcode) `^1.5.4`, [selfsigned](https://github.com/jfromaniello/selfsigned) `^5.5.0`, [ws](https://github.com/websockets/ws) `8.22.0`, and [Zod](https://zod.dev/) `4.6.7`. These packages are distributed under the MIT License; the release checkout's exact transitive versions appear in the attached CycloneDX npm SBOM.
 
 Browser Web Push uses [web-push](https://github.com/web-push-libs/web-push) `3.6.7`, distributed under the Mozilla Public License 2.0 (MPL-2.0), for payload encryption and VAPID signing/key generation. It remains an unmodified, external Node runtime dependency, not part of the browser bundle; its npm package supplies the covered source and license. DSH Mobile owns the bounded HTTPS transport and endpoint validation. Exact transitive versions appear in the [npm lockfile](<package-lock.json>) and release SBOM.
 

package/docs/ATTACH_EXISTING_FRPS.en.md

@@ -25,6 +25,8 @@ Public-CA mode uses HTTPS 443. For self-signed mode, keep `https://PUBLIC_IPV4`
 
 Plugin 0.6.16 adds Chinese, English and Italian field-level feedback: submission or preview marks invalid fields and focuses the first error; editing rechecks and clears corrected errors. It does not relax the validation above or change server listeners or ports for you.
 
+With plugin 0.8.3 or later, fill **frpc user (optional)** only if your shared frps provider supplies a username for proxy registration. The server uses it as a proxy-name prefix; it does not replace the shared token. To remove a saved username, clear the field and save. If the frps address and control port have not changed, you can reuse the saved token without displaying or reentering it.
+
 ## Public-CA mode
 
 1. In **Self-hosted FRP**, choose **Attach to my existing frps** and **Public CA certificate**. Enter the VPS address, frps control port, high-entropy shared token, public domain or IPv4 HTTPS origin, and the frps instance's actual `vhostHTTPPort`. Do not assume the managed deployment's default of 7080.

package/docs/ATTACH_EXISTING_FRPS.md

@@ -26,6 +26,8 @@
 
 插件 0.6.16 起提供中文、英文和意大利文字段级提示：提交或预览时标记错误字段、聚焦第一处错误，修改后重新检查并清除已修正的提示。它不放宽上述校验，也不会替你更改服务器监听或端口。
 
+插件 0.8.3 起，如果共享 frps 服务商提供了用于代理注册的用户名，可填写 **用户名（可选）**。服务端用它为代理名添加前缀，它不能替代共享 Token。要移除已保存的用户名，清空该字段后保存即可；frps 地址和控制端口未变时，已有 Token 不会显示，也无需重输。
+
 ## 两档入口证书
 
 ### A. 公开 CA 证书档（`public-ip-cert`，缺省）

package/docs/CONNECTION_DIAGNOSTICS.en.md

@@ -2,7 +2,7 @@
 
 [中文](CONNECTION_DIAGNOSTICS.md) · [Documentation](README.md)
 
-> Layered reporting applies to the plugin 0.8.2 candidate. Published 0.8.1 has fewer diagnostic fields and explanations. This computer-side change does not advance the App version.
+> Layered reporting is available from plugin 0.8.2; 0.8.1 has fewer diagnostic fields and explanations. This computer-side feature does not require an App update.
 
 On the computer, open **Mobile access → Diagnostics** and start the check. It reads configuration, component state and bounded network observations without model requests or changes to DNS, proxies, firewall or pairings. Duplicate actions are disabled while checking; a redacted report can be copied afterward.
 
@@ -43,6 +43,14 @@ This result requires comparison rather than marking public ingress failed or hea
 
 Working conversations with failed customization need separate manifest, CSS, script and event-stream investigation. Transport errors, parser rejection and upstream HTTP rejection are distinct; see [slow-link diagnostics](SLOW_CONNECTIONS.en.md). Local readiness for iroh or an own reverse proxy is not public-route acceptance; see [iroh](IROH.en.md) and [own reverse proxy](SELF_HOSTED_ORIGIN.en.md).
 
+## macOS: timeout when opening a workspace folder
+
+macOS can ask on the computer whether DSH may access a protected location such as Desktop, Documents or Downloads. If remote access times out just as you open a folder, check the Mac for a pending system prompt. The timeout alone does not show that pairing was lost or that permissions caused the failure.
+
+Before leaving the Mac unattended, start DSH the way you normally run it and open the workspace folder you intend to use remotely. Grant only the access you need, and review existing grants in **System Settings → Privacy & Security → Files and Folders**. You can also choose a location for new workspaces that does not require this permission. After addressing a prompt, retry with your existing pairing. Remote access does not require Full Disk Access. See [Apple's guide to file and folder access](https://support.apple.com/en-us/guide/mac-help/mchld5a35146/mac).
+
+Before leaving, use an already paired device on the intended remote channel, open **the same folder** in the web directory picker, and confirm that it lists the contents. Gateway health and terminal `ls` do not test DSH's access to the folder. If macOS prompts, address it and retry with the existing pairing; do not reset system permissions or reinstall the plugin.
+
 ## Share the report
 
 Reports retain versions, interface names, masked endpoint suffixes, failure stages, timings, DNS categories and measurement scope. They do not read conversations or include pairing secrets, Tokens, Cookies, complete hostnames/IPs or proxy credentials. Context such as an interface name can still be identifying; review before posting.

package/docs/CONNECTION_DIAGNOSTICS.md

@@ -2,7 +2,7 @@
 
 [English](CONNECTION_DIAGNOSTICS.en.md) · [返回文档](README.md)
 
-> 分层报告适用于插件 0.8.2 候选；已发布 0.8.1 的诊断字段与提示较少。当前 App 版本不因这项电脑侧改进而改变。
+> 分层报告自插件 0.8.2 起提供；0.8.1 的诊断字段与提示较少。这项电脑侧功能不要求更新 App。
 
 电脑端打开 **移动访问 → 诊断**，点击开始检查。诊断只读取配置、组件状态和有限的网络结果，不发送模型请求、不修改 DNS、代理、防火墙或配对。运行中的检查会禁用重复操作；报告生成后可复制脱敏结果。
 
@@ -43,6 +43,14 @@
 
 会话可用但定制失败，应另外检查清单、CSS、脚本和更新流。`http failure` 的传输错误、解析错误与上游拒绝也不能混在一起；见[慢链路诊断](SLOW_CONNECTIONS.md)。iroh 和自有反向代理的本机就绪信息，不是公网验证；见 [iroh](IROH.md) 与[自有反向代理](SELF_HOSTED_ORIGIN.md)。
 
+## macOS：打开工作区目录时超时
+
+macOS 可能在电脑上要求 DSH 授权访问「桌面」「文稿」「下载」等受保护的位置。如果远程超时恰好发生在打开目录时，先回到 Mac 检查是否有待确认的系统提示；超时本身不能证明配对失效，也不能单凭它断定是权限问题。
+
+无人值守前，在 Mac 上用实际启动方式运行 DSH，并打开远程会用到的工作区目录。若弹出提示，只在确有需要时授权；已有目录权限可在「系统设置 → 隐私与安全性 → 文件与文件夹」检查。也可将新的工作区放在不需要此类授权的目录。处理提示后，先用原有配对重试。远程访问不以开启「完全磁盘访问」为前提。参见 [Apple 的文件与文件夹权限指南](https://support.apple.com/zh-cn/guide/mac-help/mchld5a35146/mac)。
+
+离开前，用已配对设备走计划使用的远程通道，在网页目录选择器里进入**同一个目录**并确认能列出内容。只检查网关健康或在终端运行 `ls`，不能验证 DSH 有权访问该目录。如果 Mac 弹出提示，处理后用原有配对重试；不用重置系统权限或重装插件。
+
 ## 分享报告
 
 报告保留版本、接口名称、脱敏端点后缀、失败阶段、耗时、系统 DNS 类别和测量范围。不读取会话正文，不包含配对密钥、Token、Cookie、完整域名、完整 IP 或代理凭据。接口名称等上下文仍可能具有辨识性，公开前应再检查一遍。

package/docs/IROH.en.md

@@ -20,7 +20,7 @@ iroh replaces public domains and tunnel accounts with an encrypted direct connec
 4. Press **Generate iroh pairing QR code** and scan it with the full App. The descriptor binds the sidecar's six-digit code, the Gateway's one-time token and pinned CA. Generating another descriptor replaces the previous pairing window; pairing a phone redeems the Gateway token through the normal pair endpoint over iroh.
 5. Switching off or switching providers stops the owned process and Gateway without deleting stored pairings. The independent App has a different package identity; its Keystore credentials are not automatically migrated into this App.
 
-Main actions stay hidden before component installation. Afterwards, the toggle, QR generation and Copy pairing link buttons share one row. Copy stays visible but disabled without valid pairing data; copying an existing descriptor does not generate another pairing code.
+Main actions stay hidden before component installation. Afterwards, the toggle, QR generation and Copy pairing link buttons share one row. Copy stays visible but disabled without valid pairing data. From plugin 0.8.3, when pairing data is valid but no QR image was generated, you can copy it and paste it into the App's iroh pairing screen. Copying does not generate another pairing code.
 
 To reclaim component storage, turn off iroh remote access, expand the component details and choose **Remove the downloaded iroh component**. This removes only the pinned program downloaded by this plugin, keeping identities, pairings and external companion packages. Later use can reinstall it or reuse a verified external copy. Removal while enabled is refused by the management API as well as the panel.
 

package/docs/IROH.md

@@ -20,7 +20,7 @@ iroh 用加密直连（打不通时走中继）代替公网域名和隧道账号
 4. 点 **生成 iroh 配对二维码**，用完整版 App 扫描。描述符绑定 sidecar 的 6 位码、网关的一次性 token 和固定 CA；再次生成会替换旧配对窗口，手机通过 iroh 上的普通 pair 接口核销网关 token。
 5. 关闭或切换通道会停止自有进程与网关，不删除已保存的配对。独立实验 App 的包名不同，其 Keystore 凭据不会自动迁移到本 App。
 
-未安装组件时不显示主操作按钮；安装后，开关、生成二维码和复制配对链接三个按钮保持同排。复制按钮在没有有效配对内容时置灰，生成后才可用，重复复制不会重新生成配对码。
+未安装组件时不显示主操作按钮；安装后，开关、生成二维码和复制配对链接三个按钮保持同排。复制按钮在没有有效配对内容时置灰；从插件 0.8.3 起，已有有效配对内容但二维码图片未生成时，也可复制并粘贴到 App 的 iroh 配对页。重复复制不会重新生成配对码。
 
 需要回收组件占用空间时，先关闭 iroh 远程访问，再展开组件详情，选择 **移除已下载的 iroh 组件**。它只删除本插件下载的固定版本程序，不删除身份、配对或外部伴随包；再次使用时可重新安装或复用已校验的外部副本。运行中不允许清理，直接调用管理 API 也会被拒绝。
 

package/docs/MOBILE_PLUGIN_ADAPTATION.en.md

@@ -130,7 +130,7 @@ Verify actual visibility, focus and `document.elementFromPoint()` while the draw
 
 When a third-party panel is open in the main slot, the mobile layer provides three safety measures:
 
-- on a coarse pointer, ordinary buttons, selects and text inputs get **44×44 CSS px minimum layout boxes**. This changes visual geometry; it is not an invisible hit-area extension. Switches, checkboxes and ranges keep their own geometry, and the panel owns multiline inputs;
+- on a coarse pointer, ordinary buttons, selects and text inputs get **44×44 CSS px minimum layout boxes**. This changes visual geometry; it is not an invisible hit-area extension. Switches, checkboxes and ranges keep their own geometry, and the panel owns multiline inputs. The built-in plugin-manager page's cards open through a title button whose overlay already owns the whole card hit area, so those title buttons keep their compact size instead of being floored;
 - a panel root that is `width:100vw` or a fixed pixel width is capped to the available width instead of overflowing;
 - the panel content can scroll and contain the gesture without also making the outer main pane a second scroll container; the plugin's own scroll container remains the first choice.
 

package/docs/MOBILE_PLUGIN_ADAPTATION.md

@@ -130,7 +130,7 @@ h('button', { className: 'icon-button', 'aria-label': label }, h(Icon, { 'aria-h
 
 主槽打开第三方插件面板时，移动层会做三件兜底的事：
 
-- 粗指针下，面板中的普通按钮、选择框和文本输入控件获得 **44×44 CSS px 的最小布局尺寸**。这会改变控件盒子及其视觉尺寸，不是不可见的命中区扩展；开关、复选框、范围滑块等控件保持自有几何，多行输入由面板自己处理；
+- 粗指针下，面板中的普通按钮、选择框和文本输入控件获得 **44×44 CSS px 的最小布局尺寸**。这会改变控件盒子及其视觉尺寸，不是不可见的命中区扩展；开关、复选框、范围滑块等控件保持自有几何，多行输入由面板自己处理。DSH 内置插件管理页的卡片通过标题按钮打开详情，其覆盖层已拥有整张卡片的命中区，因此这类标题按钮保持紧凑尺寸、不参与最小尺寸兜底；
 - 面板根若是 `width:100vw` 或固定像素宽，会被收进可用宽度，不再横向溢出；
 - 面板内容区可以滚动并阻止滚动链，不把整个主区也变成第二层滚动容器；插件自己的滚动容器仍是第一选择。
 

package/docs/SLOW_CONNECTIONS.en.md

@@ -46,7 +46,9 @@ Plugin 0.6.15 and later repair the idle cutoff and gzip buffering for new dedica
 
 A page view does not migrate to a new authentication Session. Native renewal may retain the WebView and draft without restoring the old module-event stream. A new Session using the old view receives `409 mobile_document_view_invalid`; loading the dedicated page again obtains a new view. This does not require removing a pairing or automatically refresh the current Session.
 
-An ordinary message bubble and cleared draft can precede `POST /api/session/prompt`: they are an optimistic local echo, not Host acceptance. If no corresponding request appears, retain redacted request timing, status codes and DSH logs to distinguish a request never started by the browser, proxy rejection and Host acceptance. The plugin does not automatically replay messages, approvals or other writes; check the Session before retrying an operation with an unknown outcome.
+On some older DSH versions, a message bubble and cleared draft can precede `POST /api/session/prompt`: they are an optimistic local echo, not Host acceptance. If no corresponding request appears, retain redacted request timing, status codes and DSH logs to distinguish a request never started by the browser, proxy rejection and Host acceptance. The plugin does not automatically replay messages, approvals or other writes; check the Session before retrying an operation with an unknown outcome.
+
+In controlled HTTP 400 tests on DSH 0.2.2-rc.1, staying in the same Session showed a send error and restored the text and image draft. Leaving while the request was still pending could lose that draft on return, including in stock DSH without Mobile installed. On a slow link, wait for the current Session to show the send result before switching. If the result is unknown, check whether the message arrived before retrying. This does not identify the original rejection reported in [#234](https://github.com/saya-ch/dsh-mobile/issues/234).
 
 ## Slow transfers can exceed the default deadlines
 

package/docs/SLOW_CONNECTIONS.md

@@ -46,7 +46,9 @@
 
 页面标识不会迁移到新的认证 Session：原生续期即使保留了当前 WebView 和草稿，也不代表旧模块通知流已恢复。新 Session 使用旧标识会收到 `409 mobile_document_view_invalid`；重新加载专用页面会取得新标识。这个限制不要求删除配对，也不会主动刷新当前会话。
 
-普通消息的气泡和清空草稿可能先于 `POST /api/session/prompt`，属于本地乐观回显，不是 Host 受理确认。若找不到对应请求，请保留脱敏后的请求时序、状态码及 DSH 日志，区分浏览器未发起、代理拒绝与 Host 已受理。插件不会自动重放消息、审批或其他写请求；结果不明时先确认会话，避免重复副作用。
+部分旧版 DSH 的消息气泡和清空草稿可能先于 `POST /api/session/prompt`，属于本地乐观回显，不是 Host 受理确认。若找不到对应请求，请保留脱敏后的请求时序、状态码及 DSH 日志，区分浏览器未发起、代理拒绝与 Host 已受理。插件不会自动重放消息、审批或其他写请求；结果不明时先确认会话，避免重复副作用。
+
+在 DSH 0.2.2-rc.1 的受控 HTTP 400 测试中，留在原会话时，发送失败会显示提示并恢复文本和图片草稿。但请求仍挂起时切走会话，返回后草稿可能无法恢复；不装 Mobile 的 DSH 也能复现。慢链路上，发送后请等到当前会话确认结果再切换；若结果不明，先检查消息是否已送达再决定是否重试。这不代表已经查明 [#234](https://github.com/saya-ch/dsh-mobile/issues/234) 报告中的原始拒绝原因。
 
 ## 慢速传输可能超过默认等待时间
 

package/docs/TRUSTED_NETWORKS.en.md

@@ -25,6 +25,12 @@ A routed network may not support LAN broadcast discovery. If the computer is not
 
 This setting controls source access to the LAN Gateway, not source CIDRs for an external reverse proxy. Configure that separately with the [own HTTPS reverse proxy guide](SELF_HOSTED_ORIGIN.en.md). Do not expose the LAN Gateway or private HTTP backend directly to the public internet.
 
+## Use an existing virtual LAN
+
+A virtual LAN such as [StarVPN](https://doc.starvpn.cn/) can carry an existing Mobile connection. DSH Mobile does not install the provider's client, sign in to its account, or select direct or relayed paths. Join both devices to the same controlled network, then check that the phone can reach the **actual Mobile HTTPS listener at an address covered by its certificate**. Use that entry to test pairing, resource loading, opening a conversation, and reconnecting. If broadcast discovery is unavailable, use the pairing link copied from the computer. StarVPN has not been tested end to end.
+
+Adding a trusted subnet only changes which sources are allowed. It does not bind the service to another virtual IP or add that IP to its certificate. If the pairing link's address cannot be routed, use an existing controlled route to the original HTTPS address, or configure a reachable address with a valid certificate using the [own HTTPS reverse proxy guide](SELF_HOSTED_ORIGIN.en.md). Do not rewrite the pairing link to an arbitrary virtual IP, bypass certificate validation, or forward the DSH administration port.
+
 ## Accessing the NAS administration page
 
 The administration page's `/api/mobile-access` and the phone Gateway are separate entries. The additional trusted networks above do not open the management API. By default, the management API still accepts only direct loopback peers.

package/docs/TRUSTED_NETWORKS.md

@@ -25,6 +25,12 @@ DSH Mobile 的默认 Windows HTTPS / Discovery 入站规则只允许 `LocalSubne
 
 此设置用于局域网 Gateway 的来源访问范围，不改变外部反向代理的来源 CIDR。自有代理请按[自有 HTTPS 反向代理指南](SELF_HOSTED_ORIGIN.md)配置；不要把局域网 Gateway 或私有 HTTP 后端映射到公网。
 
+## 接入已有虚拟局域网
+
+[星空组网](https://doc.starvpn.cn/)等虚拟局域网可作为现有通道的网络层；DSH Mobile 不负责安装客户端、登录账号或选择直连／中转。两端加入同一受控网络后，先验证手机能否访问电脑**实际监听且证书匹配**的 Mobile HTTPS 地址，再用该入口配对并验证资源加载、会话和重连。广播发现不通时用电脑端复制的配对链接。星空组网尚未做过端到端验收。
+
+额外可信网段只控制来源，不会让服务监听新的虚拟 IP，也不会把虚拟 IP 加进证书。如果配对链接里的地址不能跨网路由，优先用组网已有的受控路由访问原 HTTPS 地址，或按[自有 HTTPS 反向代理指南](SELF_HOSTED_ORIGIN.md)配置手机能访问的、证书有效的地址。不要把配对链接里的地址随意替换成虚拟 IP、绕过证书校验或转发 DSH 管理端口。
+
 ## NAS 的管理网页访问
 
 管理网页的 `/api/mobile-access` 与手机连接的 Gateway 是两个入口。上面的额外可信网段设置不会开放管理 API。默认情况下，管理 API 仍只允许直连来源为回环地址。