DeckTech v0.1.0

DeckTech v0.1.0 is the first public release: a control deck on your phone for
the apps on your computer, for Windows and macOS hosts and Android, iPhone and
browser clients, in English and Brazilian Portuguese.

Added

• New DeckTech identity with the MaxVision colours, a new logo and new icons on every platform.
• quickLiquid look: glass on the desktop, a full-screen PWA that follows the device's physical corners, and native Liquid Glass on macOS 26.
• Desktop "Slots" view: the deck's five pages as an overview grid (three columns, two in windows narrower than 1100 px) where every tile shows its app's name and all cards share one geometry; the scrollbar follows the light or dark theme.
• Desktop title bar with the DeckTech mark and a vertically aligned wordmark on the left, and the live phone-connection status (a dot that turns green once at least one phone is connected, with the number of connected phones) at the right edge, next to the window buttons.
• Redesigned OBS drawer on the phone:
  • one header with the connection status, the settings gear and the close button, and the "OBS Commander" title shown once;
  • an ON AIR card ("NO AR" in Portuguese) that follows the live scene;
  • a List / Columns / Tabs switch (Lista / Colunas / Abas), remembered on each device;
  • scenes grouped into numbered scenes and "Sources and utilities" (scenes whose names are not numbered);
  • a dock-pin mode (the star) to choose which scenes become dock buttons;
  • recording and streaming controls in the footer;
  • tinted quickLiquid glass in every mode, including when the device asks for reduced transparency;
  • redesigned not-connected states: an offline panel with numbered steps to set up the OBS WebSocket server (using OBS's own labels in English and Portuguese), the password form and a "Try now" button ("Tentar agora").
• OBS connection even without a password, when the WebSocket authentication is off, with a notice recommending you turn it on.
• Android connects to the computer only over HTTPS with that installation's certificate pinned: pairing through the "Android app" QR or a 16-character security code checked on the Connect screen, a warning if the certificate changes, and a confirmation before accepting a pairing link opened outside the app.
• Pairing links are accepted only for private-network addresses (RFC 1918), Tailscale's 100.64.0.0/10 range or .local names; any other host is refused with a notice explaining why. On Windows and macOS the address offered for pairing always prefers a private-network address when there is more than one, and the Connect screen shows a notice when the computer has none.
• A pairing link opened outside the app (camera, browser or another app) asks for confirmation with the host and port highlighted and Cancel focused (never the button that continues). Only a link identical to the connection the app already has saved skips the dialog.
• 6-digit PIN access protected against brute force (see Security).
• New license agreement (EULA) window on Windows: a card with the brand, a three-point summary (free, local, closed source) and a checkbox that must be ticked to enable Accept; the window keeps its controls visible at its minimum size. The agreement is required on first run of the Windows, macOS and Android apps.
• Windows installer and app properties, and the Settings > Apps (or Programs and Features) entry, identify Produtora MaxVision as the publisher instead of Electron's default name.
• The Connect screen reports when the HTTPS port is in use without affecting browser access.
• Faster, cleaner shutdown that leaves no helper processes running, and new performance budgets that protect startup, smoothness and resource use.
• Portuguese (Brazil) and English in the phone deck and APK (following the device language), on macOS (language picker) and on the website. The Windows host window is Portuguese only in this release.
• Automatic discovery and validation of DeckTech hosts on the local network.
• Connection, safe-area, viewport, gesture and orientation improvements on Android and the PWA.
• macOS layout, icon, hover, picker and dock reordering polish.
• Website shortcuts with their favicon on macOS and in the phone deck, a monogram on the Windows host, and a confirmation before removal.
• PWA login submits automatically when the sixth PIN digit is entered.
• Windows app icons are more reliable for Store/MSIX apps, .lnk shortcuts and Squirrel launchers.
• macOS update through a DMG verified with SHA-256, and Android update through an APK whose package, version and signature are validated.
• New-version notice in the deck, based on DeckTech's public releases page.
• The macOS DMG is built, and the macOS validation (Swift tests and the Node suite) is run, on a GitHub-hosted macOS runner by the public repository's manual mac-build workflow, pinned to the exact release commit; the release tooling verifies the DMG against that run before publishing. The embedded Node runtime in the DMG keeps its executable permission.
• Website: dark by default with a persistent light theme option, copy rewritten in DeckTech's own voice and a deck-keycap background.
• Public documentation is English by default, with Brazilian Portuguese copies named <NAME>.pt-BR.md and language switchers; the EULA keeps the Portuguese text as the legally binding one, with an English translation. It now covers OBS Studio setup and troubleshooting.

Changed

• Windows app startup: when a DeckTech server already holds the port and is only slow to respond, the app connects to that instance instead of reporting the port as busy.
• A 4-digit PIN written by an earlier install is replaced by a new 6-digit PIN on the next start, with a log notice and the old sessions revoked; it is never accepted as it is.
• The OBS connection is made in the background after the server is already up, so starting the app no longer waits for OBS to answer.
• The mobile connection-lost notice says "Computador desconectado" in Portuguese ("Computer disconnected" in English) instead of "Mac desconectado", which also appeared when DeckTech ran on Windows.
• On Windows, every permission request from the embedded browser (camera, notifications, geolocation and so on) is denied by default, from before the first window opens, as defense in depth even though no screen asks for permissions today.

Fixed

• The APK shows the apps correctly again after fixing the translator scope conflict.
• API, macOS and Android error messages follow the selected or detected language.
• Dock, authentication and host-validation limits were tightened.
• The phone grid keeps showing the pinned apps when the process or icon listing fails, and recovers on its own without a reload.
• The OBS password field no longer loses what you typed, or the cursor, while the app refreshes the status in the background.
• On Windows, quitting no longer hangs waiting for a PowerShell process (or the theme watcher) that never reports it finished; the wait is bounded and cleanup happens the same way.
• The app no longer exits unexpectedly on an unhandled promise rejection; it is logged and the app keeps running.
• On macOS, the Connect screen shows the same "no local-network address available" notice as Windows when the computer has none for the Android app, instead of a QR the phone would refuse anyway.
• The OBS drawer keeps the connected view on screen during brief status failures without duplicating scene rows, and shows an honest notice when a command is cancelled by the app itself instead of reporting the computer as disconnected.
• The PWA quickLiquid look covers the top safe-area strip again when the phone is in portrait.
• On Android, notices and dialogs use an opaque background to keep AA contrast, including buttons over a chip; resuming the app after it was minimized refreshes the screen without a full reload, and a notice is no longer hidden by another one that appears before it, in any order.

Security

• PIN brute-force protection: 5 wrong codes from one address lock that address for 60 seconds, doubling up to 1 hour with each consecutive lockout; a global limiter blocks new PIN logins from any address for 30 minutes after 5 DISTINCT addresses fail within 2 hours (repeated failures from the same address count once), doubling up to 24 hours with each new trigger. Devices already signed in keep working. Even the correct PIN is refused while a lockout is active, and the response says how much time is left.
• The server only accepts requests for localhost or an IP address of the computer itself, and refuses state changes from another origin (protection against DNS rebinding).
• The OBS password stays on the computer (.obs-password, owner-only permissions) and is never returned in API responses.

The SHA-256 checksum of each installer is in this release's SHA256SUMS.txt. The
Windows installer is not code-signed; the macOS app is ad-hoc signed and not
notarized. See the README for first-run instructions.

Português (Brasil)

O DeckTech v0.1.0 é a primeira versão pública: um painel de controle no
celular para os apps do seu computador, com hosts Windows e macOS e clientes
Android, iPhone e navegador, em português (Brasil) e inglês.

Novidades

• Nova identidade DeckTech com as cores da MaxVision, novo logo e novos ícones em todas as plataformas.
• Visual quickLiquid: vidro no desktop, PWA em tela cheia acompanhando os cantos físicos do dispositivo e Liquid Glass nativo no macOS 26.
• Visão "Slots" no desktop: as cinco páginas do painel em uma grade de visão geral (três colunas, duas em janelas mais estreitas que 1100 px) em que cada peça mostra o nome do app e todos os cartões têm a mesma geometria; a barra de rolagem acompanha o tema claro ou escuro.
• Barra de título do desktop com a marca DeckTech e o nome alinhado verticalmente à esquerda, e o status de conexão dos celulares em tempo real (um ponto que fica verde quando há ao menos um celular ...