slock v0.3.1

Check for Updates… now disappears when GitHub confirms the installed version
matches the latest release. Automatic checks continue at launch and hourly;
Update slock… appears when a newer release is available.

An unchecked version or failed initial check keeps the action available. Update
progress remains visible while checking, downloading, or installing.

Install: choose Check for Updates… / Update slock… in slock, or download
slock.app.zip below. SHA256SUMS contains the ZIP checksum;
slock-update.json is used by the native updater.

Supports macOS 13+, Apple Silicon and Intel. Signed with the same Developer ID
identity as v0.3.0 and the existing update-signing key. The app is not notarized.

slock v0.3.0

slock now uses a persistent Developer ID signing identity so macOS can recognize
future updates as the same app.

• Releases are signed with Developer ID Application and a secure timestamp.
  Later releases signed with the same identity should retain privacy approvals.
• This first upgrade may require one final permission approval on each Mac.
  If keyboard access is missing, follow Permissions Required; remove and
  re-add an old entry if macOS still associates it with a previous build.
• The native updater still verifies every package using the existing Ed25519
  update key. Pairings, preferences, and the app's bundle identifier are preserved.
• The release process requires Developer ID signing, preventing accidental
  publication of another ad-hoc build. Signing keys can be securely transferred
  to a new release Mac without changing the app's identity.

Install: use Check for Updates… in slock, or download slock.app.zip
below. Versions 0.2.6–0.2.8 need one manual app replacement to receive the native
updater. SHA256SUMS contains the ZIP's checksum; slock-update.json is used
by the native updater.

This release supports macOS 13+, Apple Silicon and Intel. It is Developer ID
signed but not notarized, so macOS may still block an initial download.
Actual permission persistence across a future signed update still needs manual
validation. See
SECURITY.md for the
security limits and reporting guidance.

slock v0.2.9

In-place updates are back, without additional updater permissions or dependencies.

• Check for Updates… is always available and becomes Update slock… when
  a newer stable release is known. Clicking it rechecks the latest release instead
  of opening a cached, older release page.
• slock downloads and verifies the update, replaces itself in the same writable
  location, and relaunches. Pairings and preferences stay intact. The updater does
  not request administrator or Keychain access.
• Update packages require a signature from slock's dedicated Ed25519 signing key.
  Only the app's fixed set of regular files can be staged; no archive extraction
  or downloaded installation script is used. A failed replacement or relaunch
  restores the previous app.

Upgrading from 0.2.6–0.2.8: download slock.app.zip below, quit slock,
replace the app in Applications, and reopen it once to receive the restored
updater. macOS may still require renewed keyboard permissions. SHA256SUMS
contains the ZIP's checksum; slock-update.json is used by the native updater.

This remains a prototype for macOS 13+, Apple Silicon and Intel. The app is
ad-hoc signed and not notarized. See
SECURITY.md for the
security limits and reporting guidance.

slock v0.2.8

This release makes lights more responsive, improves pairing feedback and recovery,
and respects Do Not Disturb and Focus during voice conversations.

• Light signals start as soon as they arrive. Short blinks and gaps retain their
  timing when packets arrive in time, while a hold or gap longer than one second
  resets playback to the earliest opportunity.
• Dit's tail slowly pulses green after pairing is accepted until the first light
  signal in either direction. With Reduce Motion enabled, it stays steady green.
• A missed peer unpair message no longer leaves the other Mac stuck in a stale
  pairing after reconnecting.
• Do Not Disturb and other Focus modes pause voice transmission and playback,
  including an ongoing talk. Lights keep working and PTT consent stays enabled.
  When Focus ends, release Caps Lock and hold it again to talk. The menu shows
  Audio Paused while Focus is active; voice also stays paused if macOS's Focus
  status cannot be read.

Download slock.app.zip below. Quit the old app, replace it in Applications,
and reopen it on both Macs. Pairings and preferences remain, but macOS may require
renewed keyboard permissions. SHA256SUMS contains the ZIP's checksum.

This remains a prototype for macOS 13+, Apple Silicon and Intel. It is ad-hoc
signed and not notarized, uses an unauthenticated public test relay, and has no
forward secrecy. Please keep sensitive conversations elsewhere. See
SECURITY.md for the
security limits and reporting guidance.

slock v0.2.7

A small hardening release after a second pre-announcement security review, plus a
README written for people meeting Dit for the first time.

• Nicknames sent by the other Mac are now sanitized by Unicode category. Control,
  formatting, bidirectional-override, zero-width and line-separator characters are
  removed, whitespace runs collapse, names with no visible character become empty,
  and length is bounded. Emoji sequences still display correctly.
• Saved peer and Recent keys are validated as well-formed public keys before being
  used for routing or key agreement.
• The README leads with what slock does, a five-step quick start, and a
  "Privacy at a glance" section. Maintainer release steps moved to
  docs/RELEASING.md.
• Security docs record the follow-up review; no new high- or medium-severity
  code findings were identified.

Download slock.app.zip below. Quit the old app, replace it in Applications,
and reopen it on both Macs. Pairings and preferences remain, but macOS may require
renewed keyboard permissions. SHA256SUMS contains the ZIP's checksum.

This remains a prototype for macOS 13+, Apple Silicon and Intel. It is ad-hoc
signed and not notarized, uses an unauthenticated public test relay, and has no
forward secrecy. Please keep sensitive conversations elsewhere. See
SECURITY.md for the
security limits and reporting guidance.

slock v0.2.6

Dit has had a little tidy-up: friendlier instructions, a few nicer menu details,
and a substantial security review.

• The README gives the blinking-keyboard idea a gentler introduction, with setup
  details tucked away and the prototype's limits kept in plain sight.
• Microphone capture and playback stop correctly when re-pairing clears consent.
  Pausing stops voice, and queued packets cannot restart playback after disconnect.
• Identity storage rejects links and special files, uses private directory/file
  permissions, and keeps file descriptors out of helper processes.
• Pairing now displays a 128-bit verification fingerprint. Compare the whole
  fingerprint or full pairing code through a trusted channel. Existing pairing
  codes are unchanged.
• Unsolicited requests cannot read your nickname or displace a selected peer.
  Incoming processing is rate-limited, and MQTT connection IDs are randomized.
• Download Update… opens the GitHub release page. The previous custom
  self-installer was removed because ad-hoc signatures and release-hosted checksums
  do not establish publisher identity.
• Dit stays blue when a paired Mac is unavailable. Hold Option to see the
  installed version; pairing text fields support Command+V and Control+V.
• Added security regression coverage, a security policy, private vulnerability
  reporting, and read-only CI checks for pull requests and main.

Download slock.app.zip below. Quit the old app, replace it in Applications,
and reopen it on both Macs. Pairings and preferences remain, but macOS may require
renewed keyboard permissions. SHA256SUMS contains the ZIP's checksum.

This remains a prototype for macOS 13+, Apple Silicon and Intel. It is ad-hoc
signed and not notarized, uses an unauthenticated public test relay, and has no
forward secrecy. Please keep sensitive conversations elsewhere. See
SECURITY.md for the
security limits and reporting guidance.

slock v0.2.5

This release improves permission setup, light timing, and everyday controls.

• One red Permissions Required item replaces the separate permission and recovery menu items. It disappears when all permissions for the current mode are granted.
• Dit's tail turns red while local permissions are missing, taking priority over activity and peer status.
• Push-to-talk also checks Microphone access. The guide includes a microphone step for active or locally requested PTT; Use lights only turns PTT off. An incoming invitation alone never requests microphone access.
• Input Monitoring requests run without blocking the setup window. The app waits for the native registration request before opening Settings, and skips permissions macOS already grants.
• A peer whose capture is paused or inactive turns Dit's tail blue once your own permissions are satisfied. Pausing cancels pending incoming light playback.
• Timestamped light playback buffers about one second to preserve short flashes and dark gaps. It adds eight bytes per transition without increasing message frequency; PTT remains immediate.
• Update slock appears when a newer stable release is available and downloads, verifies, installs, and relaunches it. Pairings and preferences are retained.
• The unzipped app now includes Dit's Finder icon. The status line includes your peer's name, and Unpair acts immediately without a confirmation popup.

macOS owns permission approval. Microphone uses its approval dialog; keyboard access requires System Settings. If macOS does not list slock, the guide retains Show App in Finder and instructions to add the current app. Some permission changes require reopening slock.

Upgrade both Macs for the timing and pause-state improvements. From v0.2.4 or earlier, quit the old app, replace the copy in Applications, and reopen it. Later updates can use Update slock. The universal app supports Apple Silicon and Intel on macOS 13+. It remains ad-hoc signed and not notarized, so an update may require renewed permissions.

Download slock.app.zip below. SHA256SUMS contains its checksum.

slock v0.2.4

Fresh installs now explain and request the permissions needed for Caps Lock sharing.

• Set up slock opens when keyboard access is missing and explains why both Accessibility and Input Monitoring must be enabled.
• macOS permission requests happen in order, after the guide appears. Enable Accessibility… and Enable Input Monitoring… provide a Settings fallback when macOS does not show another dialog.
• Show App in Finder helps you add the correct copy to System Settings. Permissions… keeps the guide available from the menu.
• Saved settings from an earlier install no longer hide setup when the current app lacks permission.
• Capture waits for both permissions. Once they are granted it retries automatically, while a paused app stays paused.

Upgrade both Macs: quit slock, replace the app in Applications, and reopen it. In System Settings → Privacy & Security, enable slock in both lists. If slock is missing, use + to add the current app. If an old entry is already on, remove it and add the current copy again. Quit and reopen if macOS asks.

The universal app supports Apple Silicon and Intel on macOS 13+. It is ad-hoc signed and not notarized; an update can require renewed permissions. macOS controls the native dialogs and permission grants. Physical keyboard LED support varies.

Download slock.app.zip below. SHA256SUMS contains its checksum.

slock v0.2.3

This release improves Caps Lock capture, keyboard light recovery, pairing, and voice.

• Pause Slock / Resume Slock now reflects whether Caps Lock is actually captured.
• Capture rejects incomplete keyboard event access instead of reporting that it is active.
• Keyboard light devices are created after permission is granted and recreated after failures, so the driver can recover from an earlier denial.
• Copy Diagnostics, Retry Keyboard Light, and Input Monitoring recovery controls help distinguish capture, message delivery, and LED problems.
• Pairing uses one window, supports nicknames, and remembers recent peers.
• Session replay protection, keyboard mapping recovery, and push-to-talk negotiation and audio handling have additional fixes and regression coverage.

Upgrade both Macs. Quit the old app, replace the copy in Applications, then reopen it. If macOS permissions appear enabled but capture remains inactive, follow the permission recovery instructions.

The download is a universal macOS 13+ app for Apple Silicon and Intel. It is ad-hoc signed and not notarized. Automated tests cover the logic; physical light control across the two reported Macs still needs a hardware check. Keyboard LED support varies.

Download slock.app.zip below. SHA256SUMS contains its checksum.

slock v0.2.2 — full-height Dit

Dit now fills the menu-bar height and uses its tail as the status light:

• hollow when idle or receiving a peer key press
• yellow-green while sending
• red when a pairing or PTT request needs attention

While capture is active, every local Caps Lock press now forces the local lock state off and reapplies only the peer-driven LED state. This prevents a local press from latching the keyboard light or triggering normal Caps Lock behavior.

The release is a universal macOS 13+ build for Apple Silicon and Intel. It is ad-hoc signed and not notarized.