CW Studio 1.1.0

What's new in 1.1.0 — transmitting is fenced off from the decoder

Both tools were served from a single origin, which meant the Decoder page had
full access to the keying API simply by virtue of being same-origin. And if the
Keyer page was closed or crashed while Tune was held down, nothing released
the key — it would have sat on the air until the service itself timed out about
ninety seconds later.

The Decoder can no longer transmit, by construction.

• The service only honours keying requests that came from the Keyer page. A
  browser sets Referer itself and a page cannot forge it, so the Decoder
  cannot reach those endpoints even by mistake. Verified: the Decoder receives
  403 for both tune and text.
• The Decoder additionally refuses to issue such a request at all, so a future
  fault in the receiving code could not transmit even if that check were
  bypassed.

Nothing keys a transmitter unless the Keyer is present and armed.

• Keying must be armed, and the Keyer page has to keep checking in. Going quiet
  for a few seconds disarms it and releases the port, so a held-down Tune
  cannot stay on the air. Verified: after eight seconds of silence both text
  and tune are refused.
• Closing the Keyer disarms immediately rather than waiting for that timeout.

Arming asks you to acknowledge the safety points — every time.

Ticking Key transmitter now presents the risks of automatic transmission —
licence conditions, wiring, RF energy, and that the software is unsupported and
used at your own risk. Declining leaves keying switched off rather than merely
warning about it. Beacon mode, being the unattended case, is confirmed
separately.

The user guide gains a Transmit safety section describing the arrangement.

One thing worth treating with the same care: the sidetone is only audio, but
if you have wired the computer's audio output into an SSB transceiver with VOX
or PTT, then anything that makes a tone can transmit.

⚠️ Windows SmartScreen warning

Windows will show "Windows protected your PC". Click More info →
Run anyway. The installer is not code-signed, so Windows shows this for any
installer without a purchased certificate regardless of what it contains.

Get-FileHash CWStudio-1.1.0-x64.msi -Algorithm SHA256

SHA-256: 4f50455d1e0e64804674ecd534e359d78e83b205786572dcfe16cf7f91eec874

Built reproducibly from the source in this repository via installer/build.ps1.

---

Installation — download and run CWStudio-1.1.0-x64.msi. Self-contained;
no Python or other prerequisites. Upgrades an earlier version cleanly.
Requires Windows 10/11 and a current Edge or Chrome browser.