feat(mobile): require a desktop PIN for internet pairing

README.md

@@ -67,9 +67,12 @@ PPT is preinstalled, and its automatic instructions apply only to sessions where
 
 ## Phone access
 
-Choose **Connect Phone…** from the `Harness` menu and scan the pairing code. The desktop asks you to approve the connection before the phone can access sessions.
+Choose **Connect Phone…** from the `Harness` menu and scan the pairing code.
 
-Harness itself remains on a random `127.0.0.1` port. Phone access uses a separate paired bridge. It can stay on the local network or, when you choose remote access, use a temporary Cloudflare Quick Tunnel. Disconnecting the phone from the desktop invalidates the mobile session.
+- On Wi-Fi, scanning connects immediately.
+- Over the internet tunnel, the phone enters a 6-digit pairing password shown only on the computer. By default the password is temporary (5 minutes, memory only). A durable password is created only after you opt in on the Connect Phone window.
+
+Harness itself remains on a random `127.0.0.1` port. Phone access uses a separate paired bridge. Cloudflare Quick Tunnel is the usual long-lived remote path. Free Pinggy is the fallback when Cloudflare is unavailable (for example in mainland China) and expires after about 60 minutes. Disconnecting the phone from the desktop invalidates the mobile session.
 
 If Cloudflare fails to start, the app tries Pinggy. If a Cloudflare pairing link appears but your phone cannot open it, choose **Can’t open? Try another link** to switch to Pinggy.
 
@@ -94,7 +97,7 @@ open -a "DSH Desktop" --args --safe-mode
 - Webviews, untrusted in-app navigation, and unexpected permission requests are blocked.
 - External web links open in the system browser.
 - User profiles and sessions live under Electron's per-user application data directory, not inside the installed app.
-- Phone access requires a short-lived pairing token and explicit desktop approval.
+- Phone access requires a short-lived pairing token. Wi-Fi connects on scan; the internet tunnel also requires the pairing password shown on the computer.
 
 ## Platform support
 

README.zh.md

@@ -66,9 +66,12 @@ PPT 功能保持预装，相关自动提示词仅在选中 PPT 按钮的会话
 
 ## 手机连接
 
-从 `Harness` 菜单选择“连接手机…”，再扫描配对二维码。手机获得会话访问权限前，桌面端必须明确批准连接。
+从 `Harness` 菜单选择“连接手机…”，再扫描配对二维码。
 
-Harness 本身始终运行在随机的 `127.0.0.1` 端口。手机访问由独立的配对 Bridge 提供：可以只在局域网内使用，也可以在你选择远程访问时启用临时 Cloudflare Quick Tunnel。桌面端断开连接后，手机会话随即失效。
+- WiFi 下扫码即可连接。
+- 互联网隧道需要再输入电脑上显示的 6 位连接密码。默认是 5 分钟、只存在内存里的临时密码；只有在「连接手机」窗口勾选同意后，才会在本机生成长效密码。
+
+Harness 本身始终运行在随机的 `127.0.0.1` 端口。手机访问由独立的配对 Bridge 提供。Cloudflare Quick Tunnel 是常态长连接路径；免费 Pinggy 是 Cloudflare 不可用时（如中国大陆）的备用通道，大约 60 分钟后失效。桌面端断开连接后，手机会话随即失效。
 
 Cloudflare 启动失败时会尝试 Pinggy。若已显示 Cloudflare 配对链接，但手机无法打开，可点击“**扫码打不开？换一条线路**”切换到 Pinggy。
 
@@ -93,7 +96,7 @@ open -a "DSH Desktop" --args --safe-mode
 - WebView、不可信站内跳转和非预期权限请求会被阻止。
 - 外部网页链接交给系统浏览器打开。
 - Profile 与会话保存在 Electron 的用户级应用数据目录，不在安装目录内。
-- 手机访问需要短时配对 Token 和桌面端明确批准。
+- 手机访问需要短时配对 Token。WiFi 扫码即连；互联网隧道还需要电脑上显示的连接密码。
 
 ## 平台支持
 

docs/architecture.md

@@ -80,10 +80,11 @@ Safe Mode is non-destructive: it starts an isolated official-core profile, keeps
 Harness itself stays on a random loopback port. Phone access is provided by a separate bridge:
 
 - The bridge listens on a dedicated LAN port.
-- Pairing uses a short-lived random token and desktop approval.
-- Mobile API access requires an authorized session.
+- Pairing uses a short-lived random token. Wi-Fi scanning creates a session immediately. An internet tunnel also requires a 6-digit pairing password shown only on the desktop pairing window.
+- The password is temporary (5 minutes, in memory) unless the user opts into a durable password stored in `mobile-pairing-pin.json`.
+- Mobile API access requires an authorized session. Tunnel sessions are cookie-only; LAN sessions may also match a private remote address.
 - Requests are restricted by origin, address, and connection state.
-- A temporary Cloudflare Quick Tunnel can be enabled for access outside the LAN.
+- Cloudflare Quick Tunnel is the usual remote path. Free Pinggy is the fallback when Cloudflare is unavailable and is expected to expire after about 60 minutes.
 
 The public tunnel is optional and forwards only the paired mobile surface; it does not rebind the Harness service to a public interface.