dsh-mobile 0.8.4 → 0.8.6

package/lib/client.js

@@ -803,7 +803,7 @@ window.__ModuleLoader__.load({
 			lanSetupConfiguring: "Creating private certificates and local network rules…",
 			lanSetupRequired: "Local network setup has not been completed. Choose a network above to continue.",
 			lanSetupRestart: "Setup complete for {origin}. Restart DSH once to start local network access.",
-			lanSetupFailed: "Setup was not completed. Confirm the network selection and approve the Windows prompt, then try again.",
+			lanSetupFailed: "Setup was not completed. Existing firewall rules were retained when possible. Approve the Windows prompt and retry; if it still fails, check dsh-mobile.log for the exact firewall error.",
 			lanChangeTitle: "Change network",
 			lanChangeIntro: "Move local network access to another interface. The private CA and paired devices are kept; connected phones reconnect with the new address.",
 			lanChangeSelect: "New network",
@@ -833,7 +833,7 @@ window.__ModuleLoader__.load({
 			lanSetupConfiguring: "Creazione dei certificati privati e delle regole di rete locale…",
 			lanSetupRequired: "La configurazione della rete locale non è completa. Scegli una rete qui sopra per continuare.",
 			lanSetupRestart: "Configurazione completata per {origin}. Riavvia DSH una volta per attivare l’accesso locale.",
-			lanSetupFailed: "Configurazione non completata. Controlla la rete e approva la richiesta di Windows, quindi riprova.",
+			lanSetupFailed: "Configurazione non completata. Le regole firewall esistenti sono state mantenute quando possibile. Approva la richiesta di Windows e riprova; se fallisce ancora, controlla dsh-mobile.log per l’errore esatto.",
 			lanChangeTitle: "Cambia rete",
 			lanChangeIntro: "Sposta l’accesso alla rete locale su un’altra interfaccia. La CA privata e i dispositivi abbinati restano; i telefoni collegati si riconnettono con il nuovo indirizzo.",
 			lanChangeSelect: "Nuova rete",
@@ -863,7 +863,7 @@ window.__ModuleLoader__.load({
 			lanSetupConfiguring: "正在生成私有证书并配置局域网规则…",
 			lanSetupRequired: "尚未完成局域网配置，请选择上方网络继续。",
 			lanSetupRestart: "已为 {origin} 完成配置。请重启一次 DSH，局域网访问会自动开启。",
-			lanSetupFailed: "配置未完成。请确认网卡选择并允许 Windows 授权提示，然后重试。",
+			lanSetupFailed: "配置未完成。原有防火墙规则已尽量保留；请允许 Windows 授权提示后重试，若仍失败请查看 dsh-mobile.log 中的具体错误。",
 			lanChangeTitle: "更换网络",
 			lanChangeIntro: "把局域网访问切换到另一块网卡。私有 CA 与已配对设备都会保留，已连接的手机需要用新地址重新连接。",
 			lanChangeSelect: "新网络",
@@ -1172,6 +1172,7 @@ window.__ModuleLoader__.load({
 			irohConnecting: "Sidecar connected; starting the DSH authentication gateway…",
 			irohCompanionMissing: "No verified iroh sidecar is available. Use Install official component below; a separate companion plugin is optional.",
 			irohDataDirectoryInvalid: "Could not prepare the private sidecar directory. Check that DSH can manage its own profile directory, then retry.",
+			irohDataDirectoryInsecure: "Windows parent folders of the iroh state path must not grant write or replacement rights to other users. Choose a private profile directory or correct the parent ACLs, then retry.",
 			irohSidecarInvalid: "The installed sidecar failed checksum verification. Reinstall the component.",
 			irohDownloadFailed: "The sidecar download failed before verification. Check the network and retry.",
 			irohPlatformUnsupported: "iroh sidecars are published for Windows x64 and Linux x64 only.",
@@ -1207,6 +1208,7 @@ window.__ModuleLoader__.load({
 			irohConnecting: "Sidecar connesso; avvio del gateway di autenticazione DSH…",
 			irohCompanionMissing: "Nessun sidecar iroh verificato disponibile. Usa Installa componente ufficiale qui sotto; il plugin complementare è facoltativo.",
 			irohDataDirectoryInvalid: "Impossibile preparare la directory privata del sidecar. Verifica che DSH possa gestire la propria directory del profilo, poi riprova.",
+			irohDataDirectoryInsecure: "Le cartelle Windows superiori del percorso di stato iroh non devono concedere ad altri utenti diritti di scrittura o sostituzione. Scegli una directory profilo privata o correggi le ACL superiori, poi riprova.",
 			irohSidecarInvalid: "Il sidecar installato non ha superato la verifica del checksum. Reinstalla il componente.",
 			irohDownloadFailed: "Download del sidecar non riuscito prima della verifica. Controlla la rete e riprova.",
 			irohPlatformUnsupported: "I sidecar iroh sono pubblicati solo per Windows x64 e Linux x64.",
@@ -1242,6 +1244,7 @@ window.__ModuleLoader__.load({
 			irohConnecting: "Sidecar 已连接，正在启动 DSH 认证网关…",
 			irohCompanionMissing: "尚无校验通过的 iroh 组件，请点击下方「安装官方组件」；无需另装配套插件。",
 			irohDataDirectoryInvalid: "无法准备 sidecar 私有目录。请确认 DSH 能管理自己的配置目录后重试。",
+			irohDataDirectoryInsecure: "iroh 状态路径的 Windows 上级目录不能向其他用户授予写入或替换权限；请改用私有配置目录或修正上级目录 ACL 后重试。",
 			irohSidecarInvalid: "已安装的 sidecar 哈希校验失败，请重装组件。",
 			irohDownloadFailed: "下载 sidecar 失败，还没开始校验。请检查网络后重试。",
 			irohPlatformUnsupported: "iroh sidecar 仅发布 Windows x64 与 Linux x64 版本。",
@@ -2213,6 +2216,27 @@ window.__ModuleLoader__.load({
 			frpConfigurationMissingAttach: "填写既有 frps 信息，在本机安装 frpc，然后保存并验证连接。",
 			purgeFrpConfirmSelfSigned: "要停止 FRP 并删除本机 frpc、Token、配置、证书、私钥、身份记录、临时文件和日志吗？通过此自签入口配对的手机都需重新配对；VPS 不会改变。"
 		});
+		Object.assign(MOBILE_CONTROL_MESSAGES.zh, {
+			macPermissionTitle: "请确认已开启「完全磁盘访问权限」",
+			macPermissionSummary: "开启后，远程使用期间不会再弹出需要确认的文件夹授权窗口，连接也不会因此中断。",
+			macPermissionSteps: "系统设置 → 隐私与安全性 → 完全磁盘访问权限 → 打开 DeepSeek Harness",
+			macPermissionOpen: "打开系统设置",
+			macPermissionDismiss: "我知道了"
+		});
+		Object.assign(MOBILE_CONTROL_MESSAGES.en, {
+			macPermissionTitle: "Confirm Full Disk Access is enabled",
+			macPermissionSummary: "With it enabled, remote use will not raise folder authorization dialogs, and the connection will not stall on them.",
+			macPermissionSteps: "System Settings → Privacy & Security → Full Disk Access → turn on DeepSeek Harness",
+			macPermissionOpen: "Open System Settings",
+			macPermissionDismiss: "Got it"
+		});
+		Object.assign(MOBILE_CONTROL_MESSAGES.it, {
+			macPermissionTitle: "Verifica che l’accesso completo al disco sia attivo",
+			macPermissionSummary: "Se attivo, durante l’uso remoto non compariranno finestre di autorizzazione per le cartelle e la connessione non si bloccherà.",
+			macPermissionSteps: "Impostazioni di Sistema → Privacy e sicurezza → Accesso completo al disco → attiva DeepSeek Harness",
+			macPermissionOpen: "Apri Impostazioni di Sistema",
+			macPermissionDismiss: "Ho capito"
+		});
 		/** Caddy snippet owned entirely by DSH Mobile; the main Caddyfile only imports it. */
 		const FRP_CADDY_SNIPPET_PATH = "/etc/caddy/dsh-mobile-dsh.caddy";
 		/** First line of the owned snippet; also the legacy whole-file marker. */
@@ -3767,6 +3791,28 @@ window.__ModuleLoader__.load({
 			if (bridge === void 0 || typeof bridge.capabilities !== "function" || typeof bridge.invoke !== "function") return void 0;
 			return bridge;
 		}
+		/** Encode one opaque Session id for the App's internal notification route. */
+		function taskNotificationNavigate(sessionId) {
+			if (sessionId === "") return void 0;
+			const bytes = new TextEncoder().encode(sessionId);
+			let binary = "";
+			for (const byte of bytes) binary += String.fromCharCode(byte);
+			const route = `/?dsh-session=${globalThis.btoa(binary).replaceAll("+", "-").replaceAll("/", "_").replace(/=+$/u, "")}`;
+			return route.length <= 270 ? route : void 0;
+		}
+		/** Decode only the App's bounded internal Session route. */
+		function decodeTaskNotificationNavigate(value) {
+			if (value === null || value === void 0 || !/^[A-Za-z0-9_-]{1,256}$/u.test(value)) return void 0;
+			try {
+				const padded = value.replaceAll("-", "+").replaceAll("_", "/") + "=".repeat((4 - value.length % 4) % 4);
+				const binary = globalThis.atob(padded);
+				const bytes = Uint8Array.from(binary, (character) => character.charCodeAt(0));
+				const decoded = new TextDecoder("utf-8", { fatal: true }).decode(bytes);
+				return decoded === "" ? void 0 : decoded;
+			} catch {
+				return;
+			}
+		}
 		/** Parse a `task-notify` SSE payload; rejects anything malformed or empty. */
 		function parseTaskNotifyPayload(value) {
 			let record;
@@ -3821,7 +3867,8 @@ window.__ModuleLoader__.load({
 				return bridge.invoke("notification.notify", {
 					title: event.title,
 					body: event.body,
-					tag: event.tag
+					tag: event.tag,
+					...event.navigate === void 0 ? {} : { navigate: event.navigate }
 				});
 			}).then(() => void 0, (error) => {
 				const code = typeof error === "object" && error !== null && "code" in error ? String(error.code) : "";
@@ -9558,10 +9605,7 @@ window.__ModuleLoader__.load({
 						});
 						if (currentHostSubscription) consentedSubscriptions.delete(currentHostSubscription);
 						currentHostSubscription = void 0;
-						const sub = ownedSubscription;
-						if (sub) {
-							if (await sub.unsubscribe().catch(() => false) && ownedSubscription === sub) ownedSubscription = void 0;
-						}
+						ownedSubscription = void 0;
 						if (await refresh(token) && current(token) && operation === attempt && config?.status === "disabled") publish({
 							state: "disabled",
 							preferences: config.preferences
@@ -9722,7 +9766,13 @@ window.__ModuleLoader__.load({
 		const MOBILE_PUSH_SETTINGS_COPY = {
 			en: {
 				title: "Web push notifications",
-				desc: "Receive notifications when this page is closed.",
+				desc: "Receive notifications when this page is closed. Disable stops sends but keeps the browser subscription so it can be reused safely.",
+				permission: {
+					granted: "System permission: granted. A reinstalled Home Screen app can inherit this site-level grant.",
+					default: "System permission: not decided.",
+					denied: "System permission: blocked.",
+					unknown: "System permission: unavailable."
+				},
 				enable: "Enable",
 				disable: "Disable",
 				test: "Send test",
@@ -9747,7 +9797,13 @@ window.__ModuleLoader__.load({
 			},
 			zh: {
 				title: "网页推送通知",
-				desc: "关闭此页面后仍可接收通知。",
+				desc: "关闭此页面后仍可接收通知。停用会停止发送，但保留浏览器订阅，便于安全地重新启用。",
+				permission: {
+					granted: "系统权限：已允许。重新安装的主屏幕 App 可能继承站点级授权。",
+					default: "系统权限：尚未选择。",
+					denied: "系统权限：已阻止。",
+					unknown: "系统权限：不可读取。"
+				},
 				enable: "启用",
 				disable: "停用",
 				test: "发送测试",
@@ -9772,7 +9828,13 @@ window.__ModuleLoader__.load({
 			},
 			it: {
 				title: "Notifiche Web push",
-				desc: "Ricevi notifiche quando la pagina è chiusa.",
+				desc: "Ricevi notifiche quando la pagina è chiusa. La disattivazione interrompe gli invii ma conserva l’iscrizione del browser per poterla riutilizzare.",
+				permission: {
+					granted: "Permesso di sistema: concesso. Una Web App reinstallata può ereditare questa autorizzazione del sito.",
+					default: "Permesso di sistema: non ancora scelto.",
+					denied: "Permesso di sistema: bloccato.",
+					unknown: "Permesso di sistema: non disponibile."
+				},
 				enable: "Attiva",
 				disable: "Disattiva",
 				test: "Invia test",
@@ -9821,6 +9883,7 @@ window.__ModuleLoader__.load({
 			if (snapshot.state === "unsupported") return null;
 			const prefs = snapshot.preferences;
 			const Switch = switchComponent ?? requirePublicMobilePushSwitch();
+			const permission = typeof Notification === "undefined" ? "unknown" : Notification.permission;
 			const toggle = (key, checked) => {
 				if (!prefs) return;
 				controller.updatePreferences({
@@ -9842,7 +9905,7 @@ window.__ModuleLoader__.load({
 			}, (0, react.createElement)("div", { className: "dsh-mobile-settings_title" }, copy.title), (0, react.createElement)("div", {
 				className: "dsh-mobile-settings_desc",
 				"aria-live": "polite"
-			}, message(snapshot, copy)), prefs && Switch !== void 0 ? (0, react.createElement)("div", { className: "dsh-mobile-push-categories" }, ...KEYS.map((key, index) => {
+			}, message(snapshot, copy)), (0, react.createElement)("div", { className: "dsh-mobile-settings_desc" }, copy.permission[permission]), prefs && Switch !== void 0 ? (0, react.createElement)("div", { className: "dsh-mobile-push-categories" }, ...KEYS.map((key, index) => {
 				const name = copy.categories[index];
 				if (name === void 0) return null;
 				return (0, react.createElement)("label", {
@@ -9883,7 +9946,6 @@ window.__ModuleLoader__.load({
 			}, copy.busy)));
 		}
 		// src/mobile-push/navigation.ts
-		const REF_PARAMETER = "mobile-push";
 		/**
 		* Consume one authenticated tap reference after the public Workspace and Session
 		* list baselines are ready. Return the disposal function for list subscriptions.
@@ -9894,15 +9956,16 @@ window.__ModuleLoader__.load({
 				location: window.location,
 				history: window.history
 			};
+			const refParameter = options.parameter ?? "mobile-push";
 			const params = new URLSearchParams(browser.location.search);
-			const reference = params.get(REF_PARAMETER);
+			const reference = params.get(refParameter);
 			let disposed = false;
 			let consumed = false;
 			let resolving = false;
 			let opened = false;
 			const clearReference = () => {
-				if (!params.has(REF_PARAMETER)) return;
-				params.delete(REF_PARAMETER);
+				if (!params.has(refParameter)) return;
+				params.delete(refParameter);
 				const query = params.toString();
 				const url = `${browser.location.pathname}${query ? `?${query}` : ""}${browser.location.hash}`;
 				browser.history.replaceState(null, "", url);
@@ -11388,6 +11451,111 @@ dialog.dshm-picker[open]{display:grid;place-items:center}dialog.dshm-picker::bac
 				onClick: invoke
 			}, state === "busy" ? copy.busy : state === "success" ? copy.reopen : state === "error" ? copy.retry : copy.action));
 		}
+		function mobileBackgroundNotificationCopy(locale) {
+			if (locale === "zh") return {
+				title: "后台任务提醒",
+				description: "App 页面被系统挂起后，通过可关闭的常驻连接继续接收任务完成提醒。",
+				enabled: "关闭后台提醒",
+				disabled: "开启后台提醒",
+				busy: "正在处理…",
+				error: "无法更新后台提醒；请确认任务通知权限和当前连接。"
+			};
+			if (locale === "it") return {
+				title: "Promemoria in background",
+				description: "Continua a ricevere gli avvisi quando Android sospende la pagina, tramite una connessione persistente disattivabile.",
+				enabled: "Disattiva promemoria",
+				disabled: "Attiva promemoria",
+				busy: "Operazione…",
+				error: "Impossibile aggiornare i promemoria; controlla il permesso notifiche e la connessione attiva."
+			};
+			return {
+				title: "Background task reminders",
+				description: "Keep receiving completion alerts after Android suspends the page, through a dismissible persistent connection.",
+				enabled: "Disable background reminders",
+				disabled: "Enable background reminders",
+				busy: "Working…",
+				error: "Could not update background reminders. Check notification permission and the active connection."
+			};
+		}
+		/** Android-only opt-in for the foreground SSE fallback when the WebView is suspended. */
+		function MobileBackgroundNotificationRow() {
+			const [supported, setSupported] = (0, react.useState)(false);
+			const [enabled, setEnabled] = (0, react.useState)(false);
+			const [busy, setBusy] = (0, react.useState)(false);
+			const [error, setError] = (0, react.useState)(false);
+			const generation = (0, react.useRef)(0);
+			(0, react.useEffect)(() => {
+				let active = true;
+				const refresh = () => {
+					const attempt = ++generation.current;
+					const bridge = window.__DSH_MOBILE_NATIVE__;
+					if (bridge === void 0) {
+						if (active) {
+							setSupported(false);
+							setError(false);
+						}
+						return;
+					}
+					Promise.resolve(bridge.capabilities()).then(async (capabilities) => {
+						const available = capabilities.includes("notification.background.get") && capabilities.includes("notification.background.set");
+						if (!active || attempt !== generation.current) return;
+						setSupported(available);
+						if (!available) return;
+						const result = await bridge.invoke("notification.background.get", {});
+						if (!active || attempt !== generation.current) return;
+						if (typeof result?.enabled !== "boolean") throw new Error("invalid background notification status");
+						setEnabled(result.enabled);
+						setError(false);
+					}).catch(() => {
+						if (active && attempt === generation.current) {
+							setSupported(true);
+							setError(true);
+						}
+					});
+				};
+				refresh();
+				window.addEventListener("dsh-mobile-native-ready", refresh);
+				return () => {
+					active = false;
+					generation.current += 1;
+					window.removeEventListener("dsh-mobile-native-ready", refresh);
+				};
+			}, []);
+			if (!supported) return null;
+			const locale = selectedMobileControlLocale();
+			const copy = mobileBackgroundNotificationCopy(locale);
+			const toggle = () => {
+				const bridge = window.__DSH_MOBILE_NATIVE__;
+				if (bridge === void 0 || busy) return;
+				const attempt = ++generation.current;
+				setBusy(true);
+				setError(false);
+				bridge.invoke("notification.background.set", { enabled: !enabled }).then((result) => {
+					if (attempt !== generation.current) return;
+					const next = result?.enabled;
+					if (typeof next !== "boolean") throw new Error("invalid background notification status");
+					setEnabled(next);
+				}).catch(() => {
+					if (attempt === generation.current) setError(true);
+				}).finally(() => {
+					if (attempt === generation.current) setBusy(false);
+				});
+			};
+			return (0, react.createElement)("div", {
+				className: "dsh-mobile-settings_row",
+				lang: locale
+			}, (0, react.createElement)("div", { className: "dsh-mobile-settings_rowText" }, (0, react.createElement)("div", { className: "dsh-mobile-settings_title" }, copy.title), (0, react.createElement)("div", {
+				className: "dsh-mobile-settings_desc",
+				"aria-live": "polite"
+			}, error ? copy.error : copy.description)), (0, react.createElement)("button", {
+				type: "button",
+				className: "dsh-mobile-settings_selector",
+				disabled: busy,
+				"aria-busy": busy ? "true" : void 0,
+				"aria-pressed": enabled ? "true" : "false",
+				onClick: toggle
+			}, busy ? copy.busy : enabled ? copy.enabled : copy.disabled));
+		}
 		const CONTROL_REQUEST_TIMEOUT_MS = 15e3;
 		const LONG_CONTROL_REQUEST_TIMEOUT_MS = 21e4;
 		const GITHUB_RELEASES_URL = "https://github.com/saya-ch/dsh-mobile/releases";
@@ -11617,6 +11785,7 @@ dialog.dshm-picker[open]{display:grid;place-items:center}dialog.dshm-picker::bac
 			frp_exited: "frpExited",
 			iroh_companion_missing: "irohCompanionMissing",
 			iroh_data_directory_invalid: "irohDataDirectoryInvalid",
+			iroh_data_directory_insecure: "irohDataDirectoryInsecure",
 			iroh_sidecar_invalid: "irohSidecarInvalid",
 			iroh_download_failed: "irohDownloadFailed",
 			iroh_download_size_mismatch: "irohDownloadFailed",
@@ -12950,6 +13119,7 @@ dialog.dshm-picker[open]{display:grid;place-items:center}dialog.dshm-picker::bac
 			remoteStatus.setAttribute("aria-live", "polite");
 			const remoteGuide = element("section", "dsh-mobile-control__guide");
 			remoteGuide.hidden = true;
+			remoteGuide.dataset.dshMobileGuide = "funnel";
 			remoteGuide.setAttribute("aria-label", t("funnelGuideAria"));
 			const remoteGuideTitle = element("h3", "dsh-mobile-control__guide-title");
 			remoteGuideTitle.textContent = t("funnelGuideTitle");
@@ -12976,6 +13146,26 @@ dialog.dshm-picker[open]{display:grid;place-items:center}dialog.dshm-picker::bac
 			remoteSetupRetry.textContent = t("retryNow");
 			remoteGuideActions.append(remoteSetup, remoteSetupRetry);
 			remoteGuide.append(remoteGuideTitle, remoteGuideSummary, remoteGuideSteps, remoteGuideNote, remoteGuideActions);
+			const remotePermission = element("section", "dsh-mobile-control__guide");
+			remotePermission.hidden = true;
+			remotePermission.dataset.dshMobileGuide = "mac-file-access";
+			remotePermission.setAttribute("aria-label", t("macPermissionTitle"));
+			remotePermission.setAttribute("role", "status");
+			const remotePermissionTitle = element("h3", "dsh-mobile-control__guide-title");
+			remotePermissionTitle.textContent = t("macPermissionTitle");
+			const remotePermissionSummary = element("p", "dsh-mobile-control__guide-summary");
+			remotePermissionSummary.textContent = t("macPermissionSummary");
+			const remotePermissionSteps = element("p", "dsh-mobile-control__guide-note");
+			remotePermissionSteps.textContent = t("macPermissionSteps");
+			const remotePermissionActions = element("div", "dsh-mobile-control__guide-actions");
+			const remotePermissionOpen = element("button", "dsh-mobile-control__primary");
+			remotePermissionOpen.type = "button";
+			remotePermissionOpen.textContent = t("macPermissionOpen");
+			const remotePermissionDismissButton = element("button", "dsh-mobile-control__secondary");
+			remotePermissionDismissButton.type = "button";
+			remotePermissionDismissButton.textContent = t("macPermissionDismiss");
+			remotePermissionActions.append(remotePermissionOpen, remotePermissionDismissButton);
+			remotePermission.append(remotePermissionTitle, remotePermissionSummary, remotePermissionSteps, remotePermissionActions);
 			const remoteActions = element("div", "dsh-mobile-control__actions");
 			const remoteToggle = element("button", "dsh-mobile-control__primary");
 			remoteToggle.type = "button";
@@ -13224,7 +13414,7 @@ dialog.dshm-picker[open]{display:grid;place-items:center}dialog.dshm-picker::bac
 			macosFolderHelpBody.append(macosFolderHelpNote);
 			macosFolderHelp.append(macosFolderHelpSummary, macosFolderHelpBody);
 			setupDetailsRow.append(macosFolderHelp);
-			remoteWorkspace.append(remoteStatus, remoteAccess, remoteGuide, providerSetupBody, remoteQr, pairingValidity, providerInstallRow, remoteActions, remotePairLink, setupDetailsRow);
+			remoteWorkspace.append(remoteStatus, remoteAccess, remoteGuide, remotePermission, providerSetupBody, remoteQr, pairingValidity, providerInstallRow, remoteActions, remotePairLink, setupDetailsRow);
 			const diagnosticsView = element("div", "dsh-mobile-control__view is-diagnostics");
 			diagnosticsView.hidden = true;
 			const devicesView = element("div", "dsh-mobile-control__view is-devices");
@@ -13323,6 +13513,7 @@ dialog.dshm-picker[open]{display:grid;place-items:center}dialog.dshm-picker::bac
 			let remoteLoginUrl = "";
 			let remoteSetupUrl = "";
 			let remoteSetupPending = false;
+			let remotePermissionDismissed = false;
 			let remoteSetupOpenedAt = 0;
 			let remoteReconnectBusy = false;
 			let remoteProviderBusy = false;
@@ -14202,6 +14393,8 @@ dialog.dshm-picker[open]{display:grid;place-items:center}dialog.dshm-picker::bac
 				const needsFunnelSetup = state === "error" && remoteSetupUrl !== "";
 				remoteReady = remoteRunning && state === "ready" && remoteOrigin !== "";
 				macosFolderHelp.hidden = data.macosHost !== true || !remoteReady;
+				const macFileAccess = data.macFileAccess === "missing" ? "missing" : data.macFileAccess === "ok" ? "ok" : void 0;
+				remotePermission.hidden = macFileAccess !== "missing" || remotePermissionDismissed || !remoteReady;
 				frpChoiceBadge.textContent = frpConfigured && frpInstalled ? t("ready") : t("advanced");
 				originChoiceBadge.textContent = managedOrigin ? t(remoteReady ? "ready" : "advanced") : originListening ? t("originBackendReady") : t("advanced");
 				if (remoteStatus.style) remoteStatus.style.display = state === "off" && remoteFailureText === "" ? "none" : "";
@@ -15620,6 +15813,13 @@ dialog.dshm-picker[open]{display:grid;place-items:center}dialog.dshm-picker::bac
 				remoteSetupPending = false;
 				reconnectRemote();
 			});
+			remotePermissionOpen.addEventListener("click", () => {
+				controlRequestJson("/api/mobile-access/remote/macos-file-access/open-settings", { method: "POST" }).catch(() => {});
+			});
+			remotePermissionDismissButton.addEventListener("click", () => {
+				remotePermissionDismissed = true;
+				remotePermission.hidden = true;
+			});
 			remoteSetup.addEventListener("click", () => {
 				if (remoteSetupUrl === "") return;
 				remoteSetupPending = true;
@@ -17196,7 +17396,8 @@ dialog.dshm-picker[open]{display:grid;place-items:center}dialog.dshm-picker::bac
 					kind: "done",
 					title: label("Attività completata", "Task finished", "任务已完成"),
 					body: label("Il tuo task DSH è terminato", "Your DSH task finished", "你的 DSH 任务已完成"),
-					tag: taskCompletionTag(parsed.sessionId, parsed.turn)
+					tag: taskCompletionTag(parsed.sessionId, parsed.turn),
+					navigate: taskNotificationNavigate(parsed.sessionId)
 				});
 			}, () => {
 				fireDeviceRevoked();
@@ -17415,6 +17616,46 @@ dialog.dshm-picker[open]{display:grid;place-items:center}dialog.dshm-picker::bac
 			page.body.append(node);
 			view.setTimeout(() => node.remove(), 3e3);
 		}
+		/** Consume the Android background service's opaque Session route on cold or warm launch. */
+		function installTaskNotificationNavigation(ctx, page, view) {
+			if (view.__DSH_MOBILE_FRONTEND__ !== "dedicated" || ctx.inject === void 0) return () => void 0;
+			if (new URLSearchParams(view.location.search).get("dsh-session") === null) return () => void 0;
+			let closed = false;
+			let removeNavigation;
+			const fiber = ctx.inject(mobilePushNavigationServices, (navigationContext) => {
+				if (closed) return () => void 0;
+				if (new URLSearchParams(view.location.search).get("dsh-session") === null) return () => void 0;
+				const remove = installPushNavigation(navigationContext, {
+					parameter: "dsh-session",
+					resolve: async (value) => {
+						const sessionId = decodeTaskNotificationNavigate(value);
+						return sessionId === void 0 ? void 0 : {
+							sessionId,
+							interaction: "current"
+						};
+					},
+					notify: (key) => {
+						if (key === "session-unavailable" || key === "session-resolved") showMobilePushNavigationNotice(page, view, key);
+					},
+					browser: {
+						location: view.location,
+						history: view.history
+					}
+				});
+				removeNavigation = remove;
+				return () => {
+					if (removeNavigation === remove) removeNavigation = void 0;
+					remove();
+				};
+			});
+			return () => {
+				if (closed) return;
+				closed = true;
+				removeNavigation?.();
+				removeNavigation = void 0;
+				fiber.dispose();
+			};
+		}
 		/** Own the browser-only push controller, settings row, and optional authenticated tap navigation. */
 		function installMobilePushBrowserClient(ctx, runtime) {
 			const { page, view } = runtime;
@@ -17526,6 +17767,7 @@ dialog.dshm-picker[open]{display:grid;place-items:center}dialog.dshm-picker::bac
 				page: document,
 				view: window
 			}), "dsh-mobile: authenticated browser push lifecycle");
+			ctx.effect(() => installTaskNotificationNavigation(ctx, document, window), "dsh-mobile: native task notification navigation");
 			ctx.effect(() => {
 				const desktopAdmin = isDesktopAdminSurface(location.hostname, location.search, window.__DSH_MOBILE_FRONTEND__, location.protocol);
 				const gatewayCustomization = ownsMobileCustomization(document.querySelector("meta[name=\"dsh-mobile-gateway\"][content=\"authenticated\"]") !== null, window.__DSH_MOBILE_FRONTEND__);
@@ -17583,7 +17825,13 @@ dialog.dshm-picker[open]{display:grid;place-items:center}dialog.dshm-picker::bac
 							id: "dsh-mobile-task-notifications",
 							order: 110
 						}, MobileTaskNotificationRow);
+						const removeBackgroundNotifications = ctx.slots.register({
+							name: "settings.general.item",
+							id: "dsh-mobile-background-notifications",
+							order: 111
+						}, MobileBackgroundNotificationRow);
 						return () => {
+							removeBackgroundNotifications();
 							removeTaskNotifications();
 							removeSwitchComputer();
 							removeDisplayScale();
@@ -17696,6 +17944,7 @@ dialog.dshm-picker[open]{display:grid;place-items:center}dialog.dshm-picker::bac
 		exports.installDshLanguageBoundSurface = installDshLanguageBoundSurface;
 		exports.installMobileNativeBack = installMobileNativeBack;
 		exports.installMobilePushBrowserClient = installMobilePushBrowserClient;
+		exports.installTaskNotificationNavigation = installTaskNotificationNavigation;
 		exports.localizedDiagnosticEntryCopy = localizedDiagnosticEntryCopy;
 		exports.mobileBackBlockedMessage = mobileBackBlockedMessage;
 		exports.mobilePushNavigationNotice = mobilePushNavigationNotice;