Prepare OpenAI Build Week submission

.github/workflows/ci.yml

@@ -0,0 +1,32 @@
+name: CI
+
+on:
+  push:
+    branches:
+      - master
+  pull_request:
+
+permissions:
+  contents: read
+
+jobs:
+  verify:
+    runs-on: windows-latest
+    timeout-minutes: 20
+    steps:
+      - name: Check out source
+        uses: actions/checkout@v4
+
+      - name: Set up .NET
+        uses: actions/setup-dotnet@v4
+        with:
+          dotnet-version: "8.0.x"
+
+      - name: Set up Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: "22"
+
+      - name: Run canonical source gate
+        shell: pwsh
+        run: .\scripts\test-product-flow.ps1 -Source

.github/workflows/release-windows.yml

@@ -20,6 +20,11 @@ jobs:
         with:
           dotnet-version: "8.0.x"
 
+      - name: Set up Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: "22"
+
       - name: Install Inno Setup
         shell: pwsh
         run: choco install innosetup --no-progress --yes

.gitignore

@@ -24,8 +24,10 @@ captures/
 third_party/Windows-driver-samples/
 
 # Local inspection / temp dumps (never publish)
+scratch/
 test-results/
 *.user.json
+driver/*-capture.png
 
 # Local secrets templates may live under docs; real secrets stay out of git
 .env

THIRD_PARTY_NOTICES.md

@@ -12,3 +12,14 @@ VibeDeck 的「建立虛擬螢幕」會在使用者明確操作後，下載並
   - SHA-256: `a15557da24a9efca203158de3b43b0eaf982db231f0194031f1ed428bc13e669`
 
 安裝器固定版本、驗證下載檔雜湊與驅動 Authenticode 簽章，驗證失敗時不會安裝。VibeDeck 不會關閉 Secure Boot，也不會開啟 Windows 測試簽章模式。
+
+
+
+## Managed HTTPS Connector
+
+VibeDeck Windows Setup bundles:
+
+- cloudflared 2026.7.2
+  - Source: https://github.com/cloudflare/cloudflared
+  - The packaging script pins the binary and license SHA-256 values and verifies the binary's Cloudflare, Inc. Authenticode signature.
+  - The upstream license text is bundled in each installation at `licenses/cloudflared-LICENSE.txt`.

docs/build-week-submission.md

@@ -1,64 +1,97 @@
-# VibeDeck — Build Week Submission Kit
+# VibeDeck — OpenAI Build Week Submission Kit
 
-This file contains the final English copy and asset checklist for the OpenAI Build Week Devpost submission. It is written for the **Work & Productivity** category.
+This is the final English source copy for the Devpost submission. Official deadline: **July 21, 2026 at 5:00 PM PDT** (**July 22 at 8:00 AM UTC+8**).
 
 ## Submission Fields
 
-| Field | Copy |
+| Field | Final copy |
 |---|---|
 | Project name | `VibeDeck` |
 | Category | `Work & Productivity` |
-| Tagline | `Your spare screen, securely connected to your Windows workspace from anywhere.` |
-| Short description | `VibeDeck turns a spare phone or BOOX into a trusted Windows work surface—wireless display, live sideboard, and AI quota view—that reconnects through one secure browser/PWA path across local or remote networks.` |
+| Tagline | `A trusted second surface for your Windows work.` |
+| Repository | `https://github.com/mabyes1/phoneMonitor` |
+| Release/testing URL | `https://github.com/mabyes1/phoneMonitor/releases/latest` |
+| Primary `/feedback` Codex Session ID | `019f6890-877f-71e0-9ffa-7cf4d4457f2a` |
+
+**Short description**
+
+> VibeDeck turns a spare phone or e-paper reader into a secure Windows display, system sideboard, and AI-usage companion through one browser/PWA—locally or across networks, with approval staying on the PC.
 
 ## Long Description
 
 ### Bring idle screens back to work
 
-Most desks already have a second screen: an older phone, a small tablet, or an e-paper reader that is no longer central to daily work. Existing virtual-monitor tools can mirror a desktop, but a phone-sized screen is often a poor miniature desktop. It is better at a focused role: a glanceable system sideboard, an AI quota view, or a small display surface when one is actually needed.
+Most desks already have another screen: an older phone, a small tablet, or an e-paper reader. Generic mirroring makes that device a cramped miniature desktop. VibeDeck gives it a role that matches its size: a real Windows display when needed, a glanceable system sideboard the rest of the time, and a persistent view of AI-tool usage.
+
+One Windows Host serves iPhone, Android, and BOOX through Safari, Chrome, or an installable PWA. A browser requests access, shows a six-digit code, and must be explicitly approved on the PC. Once approved, it can reconnect on the same Wi-Fi or through the installation's browser-trusted HTTPS address. There is no native mobile app, VibeDeck account, VPN, or router port-forwarding setup.
 
-VibeDeck turns those devices into persistent companions for a Windows workstation. One Windows Host serves iPhone, Android, and BOOX through Safari, Chrome, or an installable PWA. Pair once with explicit approval on the PC, then reconnect from the same Wi-Fi or another network through an automatically assigned, browser-trusted HTTPS address. There is no native mobile app, VibeDeck account, VPN, or router port forwarding to configure.
+### Three useful roles
 
-### What VibeDeck does
+- **Display:** stream a real Windows virtual display or choose an existing monitor. The approved browser receives WebRTC H.264 with a JPEG fallback and can use touch/mouse control plus its mobile keyboard.
+- **Sideboard:** show live CPU, GPU, memory, storage, network, weather, processes, activity, and custom cards in a phone-first layout.
+- **Quota:** keep Codex and AGY usage, reset windows, accounts, and remaining credits visible without opening another dashboard.
 
-- **Display mode:** creates an optional, real Windows virtual monitor or securely switches to an existing physical monitor. The approved browser receives WebRTC H.264 with a JPEG compatibility fallback and can use touch/mouse control plus its mobile keyboard.
-- **Sideboard mode:** shows live system telemetry, activity, and focused work context in a phone-first layout instead of shrinking the whole desktop.
-- **Quota mode:** keeps Codex and AGY limits, reset windows, accounts, and remaining ChatGPT Credits visible without opening another dashboard.
-- **Trusted pairing:** the PC presents a secure URL and QR code; the phone request is matched with a six-digit code and explicitly approved on the PC. Pairings persist with the browser identity.
-- **Secure access across networks:** every installation can receive its own managed HTTPS route. An approved browser can reconnect away from the original LAN, while the PC remains the sole pairing authority.
-- **Product behavior:** Windows Setup supports in-place updates, product data survives replaceable application files, and a diagnostic trail makes the next issue easier to locate.
+Only the extended-display workflow needs the optional virtual display. Existing-monitor control, Sideboard, Quota, pairing, and Device Lab work without it.
 
 ### Why it is different
 
-VibeDeck is not trying to replace a large second monitor or stop at generic screen mirroring. It gives a spare device a durable, role-specific place in a Windows workflow, whether that device is beside the keyboard, elsewhere in the building, or on another network. The same paired browser can become an extended display, a trusted remote-control surface for an existing monitor, a glanceable information board, or an AI usage companion. The product is designed around the awkward realities that prototypes usually skip: browser trust, explicit pairing, secure cross-network routing, signed-in Windows desktop sessions, persistent state, e-paper constraints, multilingual UI, installation, updates, and real-device verification.
+VibeDeck is built around the realities that prototypes often skip: Windows interactive-session boundaries, explicit device trust, secure reconnect across networks, browser-media fallback, persistent state, installation and updates, e-paper readability, multilingual UI, diagnostics, and repeatable release checks. The cloud control plane can route encrypted traffic and resolve one-time connection codes, but it cannot approve or revoke a device; the Windows PC remains authoritative.
+
+### Built with Codex and GPT-5.6
+
+VibeDeck existed before Build Week as a Windows virtual-display and browser-streaming prototype. The official cutoff was `2026-07-13 09:00 PDT` (`2026-07-14 00:00 UTC+8`). The last pre-event baseline is commit [`872a985`](https://github.com/mabyes1/phoneMonitor/commit/872a985c27dbb8c486aef50b7e76a2b1c67d5f8d), and the 21-commit core event range is [`21c27e3..fc81cce`](https://github.com/mabyes1/phoneMonitor/compare/872a985...fc81cce).
 
-### Built with Codex + GPT-5.6
+During the event, Codex and GPT-5.6 helped turn the prototype into a coherent product: Windows Setup and updates, signed-in-session startup, persistent product data, one browser/PWA path across three device classes, managed HTTPS routing, hardened pairing, existing-monitor control, mobile keyboard input, e-paper and multilingual layouts, Device Lab, diagnostics, tests, packaging, and delivery assets.
 
-Codex was the engineering partner throughout the Build Week: planning, implementation, debugging, review, test design, packaging, and final delivery preparation. GPT-5.6 helped reason about the cross-system decisions that made the prototype a usable product: the Windows interactive-session boundary, display enumeration, browser-media fallbacks, secure pairing and cross-network routing, persistent data ownership, e-paper layout constraints, and installer/update behavior.
+Codex accelerated planning, implementation, debugging, review, test design, and release preparation. GPT-5.6 was used for the cross-system decisions where a local fix could break another layer: Session 0 versus interactive display capture, browser trust versus remote access, pairing authority versus cloud routing, media fallbacks, state ownership, and installer lifecycle. Human judgment owned the product scope, security trade-offs, real-device validation, and final acceptance.
 
-The work was intentionally routed by task. Faster model tiers accelerated repetitive layout and workflow loops. Deeper reasoning was used for product planning, larger refactors, and review. Human judgment owned the actual product trade-offs, real-device validation, and the final quality bar. AI amplified a solo builder's throughput; it did not replace responsibility for the finished result.
+## Testing Instructions — Paste into Devpost
 
-### How to run and verify
+> **Platform:** Windows 10 or 11 x64. The client is a current Safari or Chromium browser on any phone/tablet; a physical phone is optional for the first review.
+>
+> 1. Download `VibeDeck-Setup-<version>.exe` and its `.sha256` from the latest GitHub Release.
+> 2. Run Setup, then open `http://127.0.0.1:5000` on the Windows PC.
+> 3. Without a phone, run `scripts\open-device-lab.ps1` from the repository. Switch among BOOX Go Color 7, Galaxy S23, and iPhone XS profiles; these load the real client at the target viewport.
+> 4. With a phone, open the QR URL, select Start pairing, match the six-digit code, and approve the request on the PC.
+> 5. Try Sideboard and Quota first; neither requires the optional virtual display. Display mode can control an existing monitor immediately. Creating a separate extended display is optional and requires one local elevation prompt.
+> 6. Automated source verification: `scripts\test-product-flow.ps1 -Source`. Installed-product verification: `scripts\test-product-flow.ps1 -Installed`.
+>
+> Setup may show the standard Windows unknown-publisher warning because this early open-source release does not yet have a production code-signing certificate. The project does not disable Secure Boot or enable Windows test-signing mode.
 
-VibeDeck runs on Windows 10 or 11 x64. Run the supplied `VibeDeck-Setup-<version>.exe` for the product path, or install the .NET 8 SDK and run `start.bat` from this repository for source development. Visit `http://127.0.0.1:5000` to open the PC console.
+## Demo Video Plan — Maximum 2:40
 
-The repository includes `scripts\test-product-flow.ps1 -Source` and `scripts\test-product-flow.ps1 -Installed` for product-path checks. The local Device Lab can load the real client at BOOX Go Color 7, Galaxy S23, and iPhone XS viewports, so reviewers can inspect responsive and e-paper behavior without owning all three devices.
+The official requirement is a **public YouTube video under three minutes with audio** that explains both what was built and how Codex and GPT-5.6 were used.
 
-### Notes for reviewers
+| Time | Show | Narration goal |
+|---:|---|---|
+| 0:00–0:15 | Spare phone/BOOX beside the Windows PC | State the problem and one-line promise |
+| 0:15–0:45 | QR → browser request → matching six-digit code → PC Allow | Prove the trust model and usable onboarding |
+| 0:45–1:20 | Existing-monitor or virtual-display stream, touch, keyboard | Show a working non-trivial product, not slides |
+| 1:20–1:45 | Sideboard and Quota on phone and e-paper layouts | Show why this is more useful than generic mirroring |
+| 1:45–2:05 | Reconnect through the managed HTTPS URL or explain the route | Show cross-network value while PC approval remains authoritative |
+| 2:05–2:35 | Commit range, tests/Device Lab, installer/release | Explain exactly how Codex + GPT-5.6 accelerated the Build Week extension and what remained human-owned |
+| 2:35–2:40 | Product name + repository URL | End with one clear call to test it |
 
-The Windows Host must be running in a signed-in desktop session; a Windows Service cannot capture or enumerate that user's display. For cross-network access, the PC must be online with the Host and managed connector running. Existing-monitor remote control does not require the optional virtual display; only the extended second-screen workflow does. Sideboard and Quota also work without it. Phone clients are intentionally browser/PWA-only, so the mobile path remains identical across iPhone, Android, and BOOX. Access is not public: the PC must explicitly approve each browser, and paired devices can be revoked from the PC.
+Do not include copyrighted music, personal account details, unsafe QR codes, reusable device credentials, or local IP addresses in the uploaded video.
 
-## Attach Before Submitting
+## Final Human Checklist
 
-- [ ] Public YouTube URL for the V9 demo video (under three minutes, with audio that explains both Codex and GPT-5.6 use).
-- [ ] Public repository URL, or a private repository shared with `testing@devpost.com` and `build-week-event@openai.com`.
-- [ ] `/feedback` Codex Session ID: `019f6890-877f-71e0-9ffa-7cf4d4457f2a`.
-- [ ] Optional companion PDF upload: `VibeDeck-Build-Week-Companion-Book-v8-bilingual.pdf`.
-- [ ] Confirm that the uploaded video, PDF, screenshots, and repository contain no personal account details, local IP addresses, unsafe QR code, or third-party material without permission.
+### Required before clicking Submit
 
-## Prepared Local Assets
+- [ ] Register/join OpenAI Build Week on Devpost and confirm eligibility/team representation.
+- [ ] Merge and push the final submission branch to the public repository.
+- [ ] Tag the exact tested commit (for example `v0.1.31`) and verify GitHub Release contains the Setup and `.sha256` assets.
+- [ ] Download the release assets from GitHub—not the local build folder—and smoke-test them on Windows.
+- [ ] Upload a public YouTube video under three minutes; verify it plays while signed out and contains audible Codex + GPT-5.6 explanation.
+- [ ] Add the public YouTube URL to Devpost.
+- [ ] Select **Work & Productivity**.
+- [ ] Paste the repository, release/testing URL, short/long description, and testing instructions.
+- [ ] Paste `/feedback` Session ID `019f6890-877f-71e0-9ffa-7cf4d4457f2a`.
+- [ ] Confirm the submitted repo/video/screenshots contain no PII, secrets, unsafe QR codes, or unlicensed music/assets.
+- [ ] Submit before **July 21, 2026 5:00 PM PDT / July 22 8:00 AM UTC+8**.
 
-These files are prepared locally and must be uploaded separately because `artifacts/` is intentionally ignored by Git:
+### Recommended final evidence
 
-- `artifacts\hackathon-trailer\v8\out\VibeDeck-Build-Week-Demo-v9.mp4`
-- `artifacts\hackathon-trailer\v8\companion-book\out\VibeDeck-Build-Week-Companion-Book-v8-bilingual.pdf`
+- [ ] Record the final .NET test count, Worker test count, and installer smoke result in the submission notes.
+- [ ] Keep the baseline/compare links visible in README so judges can distinguish pre-event work.
+- [ ] Confirm the release remains freely downloadable through the end of judging.

docs/release-checklist.md

@@ -10,9 +10,10 @@ scripts\test-product-flow.ps1 -Source
 
 必須通過：
 
-- Release 單元測試。
+- Release 單元測試（命令會先 restore，乾淨 runner 不得以零測試假綠）。
+- Managed connector Worker 測試。
 - 所有 Web JavaScript 語法檢查。
-- 安裝／更新 PowerShell 語法檢查。
+- 安裝／更新與 payload 內 PowerShell 語法檢查。
 - 不存在原生手機 App、portable ZIP 或 Host Windows Service 產品路徑。
 
 ## 2. 建立唯一正式安裝包
@@ -26,7 +27,7 @@ scripts\package-windows-setup.ps1
 或指定新版本：
 
 ```powershell
-scripts\package-windows-setup.ps1 -Version 0.1.1
+scripts\package-windows-setup.ps1 -Version 0.1.31
 ```
 
 確認 `artifacts\windows-setup\VibeDeck-Setup-<version>.exe` 已建立。打包腳本會再次驗證 staged payload。

packaging/windows-setup/VibeDeck.iss

@@ -2,7 +2,7 @@
 ; Built by scripts\package-windows-setup.ps1
 
 #ifndef MyAppVersion
-  #define MyAppVersion "0.1.0"
+  #define MyAppVersion "0.1.31"
 #endif
 
 #ifndef MyPayloadDir