v0.6.0

A tighter proxy, and tool calls that survive the way DeepSeek Web writes them.

• This computer only. With no access key, the proxy accepts a connection only from the user that started it. If that check cannot be read, the connection is refused.
• Proof-of-work. The wasm module is loaded only from DeepSeek's own site. A redirect is ignored, and the solve runs off the request thread.
• Images. A MEDIA path is used only when it is a real image in the temp folder. An image URL that points at this machine is refused, including an IPv4 address written inside IPv6.
• Errors. Tokens and cookies are stripped from upstream errors before they are stored, logged, or returned.
• Sessions. The in-memory map stops at 200 chats and drops the least recently used.
• Chrome sign-in. DevTools listens on 127.0.0.1, and the profile directory is mode 0700.
• Agent files. A config that holds a real proxy key is written mode 0600.
• HTTPS. Set TLS_CERT_FILE and TLS_KEY_FILE and the same proxy serves HTTPS. An update is installed only after you confirm it.
• Dashboard. Chinese sits next to English and Russian. The layout is the same.
• Tool calls. A fullwidth <｜tool_call> block is parsed. Garbled DeepSeek Web DSML is parsed instead of being shown as text or retried. A short final answer after a tool result is kept in any language. A bare ok is still retried.
• Removed. The old client.js command is gone.

Update: Settings → Updates → Latest → Check for updates, or git fetch origin && git switch latest && git merge --ff-only origin/latest, then restart.