dsh-mobile 0.8.3 → 0.8.4

package/CHANGELOG.md

@@ -2,6 +2,13 @@
 
 Notable changes are recorded here. GitHub Releases provide the downloadable packages and generated commit notes.
 
+## 0.8.4 - 2026-11-07
+
+- Resolve query-only and relative upstream redirects against the URL that actually requested them. This fixes mobile `/api/file` image previews receiving the app document after a redirect, while external redirect targets remain unchanged. Thanks @owenzhao for the report in [#361](https://github.com/saya-ch/dsh-mobile/issues/361). Thanks @aaalzk for independently confirming it.
+- Keep the conversation clear of the folded icon rail when the drawer is closed, without changing open-drawer, docked or stock DSH layouts. Thanks @LUgABeEEE for [#362](https://github.com/saya-ch/dsh-mobile/pull/362).
+- Add browser access guidance for HarmonyOS and for using an existing virtual LAN such as StarVPN. Neither new environment is claimed as device- or end-to-end-tested.
+- Plugin-only update. Android 0.7.2 remains the published App; this release contains no native App change or device-cache activation.
+
 ## 0.8.3 - 2026-11-05
 
 - Move the current DSH 0.2.2 compatibility test lane to 0.2.2-rc.1. Preserve the dedicated Mobile layout by default, and route App Back on a foreground upstream drawer to DSH's own dismissal handler.

package/CONTRIBUTORS.md

@@ -4,6 +4,12 @@ GitHub 的 [Contributors 图表](https://github.com/saya-ch/dsh-mobile/graphs/co
 
 GitHub's Contributors graph counts commits on the default branch; issue reports and PR proposals cannot be manually added to it. This page credits community members by how they contributed. The repository maintainer and automated dependency updates remain visible in GitHub's history.
 
+## 0.8.4 贡献 / Contributions for 0.8.4
+
+感谢 [@owenzhao](https://github.com/owenzhao) 在 [#361](https://github.com/saya-ch/dsh-mobile/issues/361) 报告相对重定向导致移动图片预览失败。感谢 [@aaalzk](https://github.com/aaalzk) 独立确认，以及 [@LUgABeEEE](https://github.com/LUgABeEEE) 在 [#362](https://github.com/saya-ch/dsh-mobile/pull/362) 提供折叠栏布局修复。原作者提交保留；维护者修正另记。
+
+Thanks [@owenzhao](https://github.com/owenzhao) for reporting the mobile image-preview redirect failure in [#361](https://github.com/saya-ch/dsh-mobile/issues/361). Thanks [@aaalzk](https://github.com/aaalzk) for independently confirming it, and [@LUgABeEEE](https://github.com/LUgABeEEE) for the folded-rail layout fix in [#362](https://github.com/saya-ch/dsh-mobile/pull/362). Original commits are retained, with maintainer corrections recorded separately.
+
 ## 0.8.3 贡献 / Contributions for 0.8.3
 
 感谢 [@xaxka](https://github.com/xaxka) 在 [#344](https://github.com/saya-ch/dsh-mobile/pull/344) 提供共享 FRP 用户名支持，[@LUgABeEEE](https://github.com/LUgABeEEE) 在 [#346](https://github.com/saya-ch/dsh-mobile/pull/346) 提供横屏布局判断，以及 [@chintoleung](https://github.com/chintoleung) 在 [#351](https://github.com/saya-ch/dsh-mobile/pull/351) 和 [#353](https://github.com/saya-ch/dsh-mobile/pull/353) 修复推送设置与插件页布局。原作者提交保留，维护者修正另记。

package/README.en.md

@@ -28,7 +28,7 @@
   <a href="#compatibility">Compatibility</a> ·
   <a href="docs/README.md">Documentation</a> ·
   <a href="#contributors">Contributors</a> ·
-  <a href="https://github.com/saya-ch/dsh-mobile/releases/tag/v0.8.3">Release notes</a> ·
+  <a href="https://github.com/saya-ch/dsh-mobile/releases/tag/v0.8.4">Release notes</a> ·
   <a href="README.md">简体中文</a>
 </p>
 
@@ -36,7 +36,7 @@
 >
 > **Using an iPhone or iPad?** Use Safari or [add DSH Mobile to your Home Screen as a web app (PWA)](<#iphone-and-ipad-home-screen-web-app-pwa>)—no native iOS download needed.
 >
-> **Current stable release: 0.8.3**. Adapt to DSH 0.2.2-rc.1, fix landscape, Plugins and Web Push settings layouts, support shared FRP usernames, and improve iroh pairing. Plugin and Android App releases remain independent. [Plugin release notes and downloads](https://github.com/saya-ch/dsh-mobile/releases/tag/v0.8.3) · [Full changelog](CHANGELOG.md).
+> **Current stable release: 0.8.4**. Fix mobile images loading the app document after a relative redirect, and keep the folded rail clear of the conversation. Plugin and Android App releases remain independent. [Plugin release notes and downloads](https://github.com/saya-ch/dsh-mobile/releases/tag/v0.8.4) · [Full changelog](CHANGELOG.md).
 >
 > **Version policy**: since plugin **0.6.2**, the Android app and plugin use independent version numbers and releases. Their numbers do not need to match, and a plugin update does not imply an app update. [Compatibility notes](#compatibility).
 
@@ -167,6 +167,8 @@ Browser pairing and reauthentication pages support Simplified Chinese, English a
 
 For manual browser pairing, enter the 43-character pairing code shown on the computer. Keys starting with `dsh1.` or `dsh2.` belong in the Android app, not the browser field. Prefer the pairing link copied from the computer, which fills the code automatically; generate a new link when it expires.
 
+**HarmonyOS phones and tablets:** If you cannot install the Android APK, try opening the browser pairing link copied from the computer, preferably through a trusted HTTPS entry. There is no native HarmonyOS package, and browser use on physical HarmonyOS devices has not been verified. Check pairing, opening a conversation, and reconnecting. If one of these fails, report the device model, system and browser versions, and the failing step without sharing the original pairing link.
+
 ### Remote access
 
 Use this after the phone leaves the computer's network. Remote access is disabled by default, and the phone needs no separate Tailscale, cpolar, cloudflared, or FRP app.
@@ -445,7 +447,8 @@ On macOS, local network, cloudflared, self-hosted FRP and the own reverse proxy
 
 | DSH Mobile plugin | Verified DeepSeek Harness version |
 | --- | --- |
-| `0.8.3` | The current DSH 0.2.2 test target is `0.2.2-rc.1`, alongside existing checks including `0.2.1-rc.5`. The upstream rc.1 npm CLI requires Node.js 24.9 or later |
+| `0.8.4` | Plugin maintenance update. The packed DSH test target remains `0.2.2-rc.1`, alongside existing compatibility checks. The upstream rc.1 npm CLI requires Node.js 24.9 or later |
+| `0.8.3` | Adapted to DSH 0.2.2-rc.1 with landscape, Plugins and Web Push settings layout fixes, shared FRP usernames and iroh pairing improvements |
 | `0.8.2` | The DSH 0.2.2 preview target for this release was `0.2.2-alpha.3`. Fresh `0.2.2-alpha.2` installs can fail to save settings because of an upstream dependency mismatch; see the [independent reproduction](https://github.com/deepseek-ai/deepseek-harness/discussions/11994#discussioncomment-19373554). Users still on alpha.2 should upgrade to rc.1 |
 | `0.8.1` | Add packed boot, settings, directory selection, attachments, sidebar and compressed Workspace checks on `0.2.1-rc.5` and `0.2.2-alpha.2`; see [CI](https://github.com/saya-ch/dsh-mobile/actions/workflows/ci.yml) for the complete version matrix |
 | `0.8.0` | Push public-contract, settings, encrypted-payload and tap-ownership checks are pinned to `0.2.1-rc.2 / rc.3`; see [CI](https://github.com/saya-ch/dsh-mobile/actions/workflows/ci.yml) for the general boot/layout matrix. iOS device results accept contributor testing; browser checks do not establish every phone, plugin or public route |

package/README.md

@@ -28,7 +28,7 @@
   <a href="#兼容性">兼容性</a> ·
   <a href="docs/README.md">文档</a> ·
   <a href="#贡献者">贡献者</a> ·
-  <a href="https://github.com/saya-ch/dsh-mobile/releases/tag/v0.8.3">更新记录</a> ·
+  <a href="https://github.com/saya-ch/dsh-mobile/releases/tag/v0.8.4">更新记录</a> ·
   <a href="README.en.md">English</a>
 </p>
 
@@ -36,7 +36,7 @@
 >
 > **使用 iPhone 或 iPad？** 可以用 Safari 访问，或[添加到主屏幕作为 Web App（PWA）使用](<#iphone-与-ipad主屏幕-web-apppwa>)，无需下载原生 iOS App。
 >
-> **当前正式版本：0.8.3**。适配 DSH 0.2.2-rc.1，修复横屏、插件页和网页推送设置布局，支持共享 FRP 用户名，并改进 iroh 配对。插件与 Android App 独立更新。[插件更新与下载](https://github.com/saya-ch/dsh-mobile/releases/tag/v0.8.3) · [完整更新记录](CHANGELOG.md)。
+> **当前正式版本：0.8.4**。修复移动端图片在相对重定向后加载成首页的问题，并修正折叠侧栏覆盖会话的布局。插件与 Android App 独立更新。[插件更新与下载](https://github.com/saya-ch/dsh-mobile/releases/tag/v0.8.4) · [完整更新记录](CHANGELOG.md)。
 >
 > **版本说明**：自插件 **0.6.2** 起，Android App 与插件独立编号、独立发布，版本号无需一致；插件升级不代表 App 需要同步升级。[兼容说明](#兼容性)。
 
@@ -169,6 +169,8 @@ dsh plugin --profile web add dshmarket
 
 浏览器手动配对时填写电脑端显示的 43 位配对码；以 `dsh1.` 或 `dsh2.` 开头的是 Android App 密钥，不要填入浏览器配对框。优先打开电脑端复制的配对链接，它会自动填写配对码；过期后在电脑端重新生成。
 
+**鸿蒙手机／平板**：如果无法安装 Android APK，可先用浏览器打开电脑端复制的网页配对链接，优先使用受信任的 HTTPS 入口。目前没有原生鸿蒙安装包，也未完成鸿蒙浏览器真机验收。请先确认能否配对、打开会话和重连；若失败，反馈时附机型、系统和浏览器版本，以及失败发生在哪一步，不要附原始配对链接。
+
 ### 远程访问
 
 适合手机离开电脑所在网络后使用。远程访问默认关闭，手机不需要另外安装 Tailscale、cpolar、cloudflared 或 FRP。
@@ -447,7 +449,8 @@ macOS 上局域网、cloudflared、自建 FRP 与自有反向代理可用；Funn
 
 | DSH Mobile 插件 | 已验证的 DeepSeek Harness 版本与范围 |
 | --- | --- |
-| `0.8.3` | 当前 DSH 0.2.2 验证目标为 `0.2.2-rc.1`，同时保留 `0.2.1-rc.5` 等既有版本检查。使用 rc.1 的 npm CLI 时，按上游要求使用 Node.js 24.9 或更新版本 |
+| `0.8.4` | 插件维护更新，继续使用 `0.2.2-rc.1` 的 DSH 打包验证目标，并保留既有版本检查。使用 rc.1 的 npm CLI 时，按上游要求使用 Node.js 24.9 或更新版本 |
+| `0.8.3` | 当时适配 DSH 0.2.2-rc.1，修复横屏、插件页和网页推送设置布局，支持共享 FRP 用户名，并改进 iroh 配对 |
 | `0.8.2` | 当时的 DSH 0.2.2 预览目标是 `0.2.2-alpha.3`。`0.2.2-alpha.2` 全新安装可能因上游依赖组合不一致而无法保存设置；[独立复现](https://github.com/deepseek-ai/deepseek-harness/discussions/11994#discussioncomment-19373554)。仍在使用 alpha.2 的用户建议升级到 rc.1 |
 | `0.8.1` | 新增 `0.2.1-rc.5`、`0.2.2-alpha.2` 的打包启动与设置、目录选择、附件、侧栏、压缩 Workspace 连接检查；完整版本矩阵见 [CI](https://github.com/saya-ch/dsh-mobile/actions/workflows/ci.yml) |
 | `0.8.0` | 网页推送的公共接口、设置、加密载荷与点击归属检查固定在 `0.2.1-rc.2 / rc.3`；通用启动与布局矩阵见 [CI](https://github.com/saya-ch/dsh-mobile/actions/workflows/ci.yml)。iOS 真机结果采信贡献者实测；浏览器检查不代表所有手机、第三方插件或公网线路已验收 |

package/docs/CONNECTION_DIAGNOSTICS.en.md

@@ -49,6 +49,8 @@ macOS can ask on the computer whether DSH may access a protected location such a
 
 Before leaving the Mac unattended, start DSH the way you normally run it and open the workspace folder you intend to use remotely. Grant only the access you need, and review existing grants in **System Settings → Privacy & Security → Files and Folders**. You can also choose a location for new workspaces that does not require this permission. After addressing a prompt, retry with your existing pairing. Remote access does not require Full Disk Access. See [Apple's guide to file and folder access](https://support.apple.com/en-us/guide/mac-help/mchld5a35146/mac).
 
+Before leaving, use an already paired device on the intended remote channel, open **the same folder** in the web directory picker, and confirm that it lists the contents. Gateway health and terminal `ls` do not test DSH's access to the folder. If macOS prompts, address it and retry with the existing pairing; do not reset system permissions or reinstall the plugin.
+
 ## Share the report
 
 Reports retain versions, interface names, masked endpoint suffixes, failure stages, timings, DNS categories and measurement scope. They do not read conversations or include pairing secrets, Tokens, Cookies, complete hostnames/IPs or proxy credentials. Context such as an interface name can still be identifying; review before posting.

package/docs/CONNECTION_DIAGNOSTICS.md

@@ -49,6 +49,8 @@ macOS 可能在电脑上要求 DSH 授权访问「桌面」「文稿」「下载
 
 无人值守前，在 Mac 上用实际启动方式运行 DSH，并打开远程会用到的工作区目录。若弹出提示，只在确有需要时授权；已有目录权限可在「系统设置 → 隐私与安全性 → 文件与文件夹」检查。也可将新的工作区放在不需要此类授权的目录。处理提示后，先用原有配对重试。远程访问不以开启「完全磁盘访问」为前提。参见 [Apple 的文件与文件夹权限指南](https://support.apple.com/zh-cn/guide/mac-help/mchld5a35146/mac)。
 
+离开前，用已配对设备走计划使用的远程通道，在网页目录选择器里进入**同一个目录**并确认能列出内容。只检查网关健康或在终端运行 `ls`，不能验证 DSH 有权访问该目录。如果 Mac 弹出提示，处理后用原有配对重试；不用重置系统权限或重装插件。
+
 ## 分享报告
 
 报告保留版本、接口名称、脱敏端点后缀、失败阶段、耗时、系统 DNS 类别和测量范围。不读取会话正文，不包含配对密钥、Token、Cookie、完整域名、完整 IP 或代理凭据。接口名称等上下文仍可能具有辨识性，公开前应再检查一遍。

package/docs/TRUSTED_NETWORKS.en.md

@@ -25,6 +25,12 @@ A routed network may not support LAN broadcast discovery. If the computer is not
 
 This setting controls source access to the LAN Gateway, not source CIDRs for an external reverse proxy. Configure that separately with the [own HTTPS reverse proxy guide](SELF_HOSTED_ORIGIN.en.md). Do not expose the LAN Gateway or private HTTP backend directly to the public internet.
 
+## Use an existing virtual LAN
+
+A virtual LAN such as [StarVPN](https://doc.starvpn.cn/) can carry an existing Mobile connection. DSH Mobile does not install the provider's client, sign in to its account, or select direct or relayed paths. Join both devices to the same controlled network, then check that the phone can reach the **actual Mobile HTTPS listener at an address covered by its certificate**. Use that entry to test pairing, resource loading, opening a conversation, and reconnecting. If broadcast discovery is unavailable, use the pairing link copied from the computer. StarVPN has not been tested end to end.
+
+Adding a trusted subnet only changes which sources are allowed. It does not bind the service to another virtual IP or add that IP to its certificate. If the pairing link's address cannot be routed, use an existing controlled route to the original HTTPS address, or configure a reachable address with a valid certificate using the [own HTTPS reverse proxy guide](SELF_HOSTED_ORIGIN.en.md). Do not rewrite the pairing link to an arbitrary virtual IP, bypass certificate validation, or forward the DSH administration port.
+
 ## Accessing the NAS administration page
 
 The administration page's `/api/mobile-access` and the phone Gateway are separate entries. The additional trusted networks above do not open the management API. By default, the management API still accepts only direct loopback peers.

package/docs/TRUSTED_NETWORKS.md

@@ -25,6 +25,12 @@ DSH Mobile 的默认 Windows HTTPS / Discovery 入站规则只允许 `LocalSubne
 
 此设置用于局域网 Gateway 的来源访问范围，不改变外部反向代理的来源 CIDR。自有代理请按[自有 HTTPS 反向代理指南](SELF_HOSTED_ORIGIN.md)配置；不要把局域网 Gateway 或私有 HTTP 后端映射到公网。
 
+## 接入已有虚拟局域网
+
+[星空组网](https://doc.starvpn.cn/)等虚拟局域网可作为现有通道的网络层；DSH Mobile 不负责安装客户端、登录账号或选择直连／中转。两端加入同一受控网络后，先验证手机能否访问电脑**实际监听且证书匹配**的 Mobile HTTPS 地址，再用该入口配对并验证资源加载、会话和重连。广播发现不通时用电脑端复制的配对链接。星空组网尚未做过端到端验收。
+
+额外可信网段只控制来源，不会让服务监听新的虚拟 IP，也不会把虚拟 IP 加进证书。如果配对链接里的地址不能跨网路由，优先用组网已有的受控路由访问原 HTTPS 地址，或按[自有 HTTPS 反向代理指南](SELF_HOSTED_ORIGIN.md)配置手机能访问的、证书有效的地址。不要把配对链接里的地址随意替换成虚拟 IP、绕过证书校验或转发 DSH 管理端口。
+
 ## NAS 的管理网页访问
 
 管理网页的 `/api/mobile-access` 与手机连接的 Gateway 是两个入口。上面的额外可信网段设置不会开放管理 API。默认情况下，管理 API 仍只允许直连来源为回环地址。

package/lib/index.mjs

@@ -8244,7 +8244,7 @@ var MobileAccessGateway = class {
 				}
 			}
 			operation.signal.throwIfAborted();
-			const headers = sanitizeResponseHeaders(index.headers, this.config.upstreamOrigin);
+			const headers = sanitizeResponseHeaders(index.headers, new URL(request.url ?? "/", this.config.upstreamOrigin));
 			delete headers["content-length"];
 			delete headers["content-encoding"];
 			delete headers.etag;
@@ -8749,7 +8749,7 @@ var MobileAccessGateway = class {
 			}
 			if (graphEvents) holder.request?.setTimeout(this.config.upstreamApiTimeoutMs);
 			setSecurityHeaders(response, this.tlsEnabled, "proxied");
-			const headers = sanitizeResponseHeaders(proxied.headers, this.config.upstreamOrigin);
+			const headers = sanitizeResponseHeaders(proxied.headers, new URL(request$2.url ?? "/", this.config.upstreamOrigin));
 			if (graphEvents) {
 				if (proxied.headers["content-encoding"] !== void 0 && proxied.headers["content-encoding"] !== "identity") throw new HttpError(502, "upstream_unavailable");
 				delete headers["content-length"];