diff --git a/.github/workflows/build-cli.yml b/.github/workflows/build-cli.yml
index a57e0d03..6d96e53a 100644
--- a/.github/workflows/build-cli.yml
+++ b/.github/workflows/build-cli.yml
@@ -97,7 +97,7 @@ jobs:
         uses: actions/cache/restore@v5
         with:
           path: ${{ env.XMAKE_PKG_INSTALLDIR }}
-          key: cli-deps-v1-${{ matrix.runner }}-${{ matrix.target }}-image${{ steps.runner-image.outputs.version }}-xmake${{ env.XMAKE_VERSION }}-${{ hashFiles('xmake.lua', 'apps/cli/xmake.lua', 'apps/desktop/xmake/options.lua', 'deps/thirdparty/openssl/**', 'deps/submodules/minirtc/xmake.lua', 'deps/submodules/minirtc/thirdparty/**', 'deps/patches/**', '.github/workflows/build-cli.yml') }}
+          key: cli-deps-v1-${{ matrix.runner }}-${{ matrix.target }}-image${{ steps.runner-image.outputs.version }}-xmake${{ env.XMAKE_VERSION }}-${{ hashFiles('xmake.lua', 'apps/cli/xmake.lua', 'apps/desktop/xmake/options.lua', 'deps/thirdparty/openssl/**', 'deps/submodules/minirtc/xmake.lua', 'deps/submodules/minirtc/thirdparty/**', '.github/workflows/build-cli.yml') }}
       - name: Configure macOS
         if: runner.os == 'macOS'
         run: xmake f -y -p macosx -a ${{ matrix.arch }} -m release --target_minver=13.0 --CROSSDESK_BUILD_DESKTOP=n --CROSSDESK_BUILD_CLI=y --USE_CUDA=n
diff --git a/apps/cli/docs/npm-distribution.md b/apps/cli/docs/npm-distribution.md
index ede98a18..94a962c7 100644
--- a/apps/cli/docs/npm-distribution.md
+++ b/apps/cli/docs/npm-distribution.md
@@ -57,7 +57,7 @@ codesign --force --sign - build/macosx/arm64/release/crossdesk-cli
 npm --prefix apps/cli run pack:npm
 ```
 
-脚本读取 `apps/cli/package.json` 与 `apps/cli/xmake.lua` 的版本，检查二者一致；确认源码中的 MiniRTC 日志脱敏补丁已应用，再检查当前平台二进制格式、CPU、动态链接依赖，并运行离线 `doctor --json`。macOS 只接受系统动态库，Linux 只接受列明的基础系统运行库，Windows 拒绝未随产品处理的 DLL 和动态 MSVC 运行库。Windows 在含 `dumpbin.exe` 的 Visual Studio 开发者环境中运行打包。脚本预先检查两个输出文件是否存在，并在临时目录中完成两个包后再写入输出目录；写入失败时清理本次已写入的包，已有同名产物不会被覆盖。
+脚本读取 `apps/cli/package.json` 与 `apps/cli/xmake.lua` 的版本，检查二者一致；检查当前平台二进制格式、CPU、动态链接依赖，并运行离线 `doctor --json`。macOS 只接受系统动态库，Linux 只接受列明的基础系统运行库，Windows 拒绝未随产品处理的 DLL 和动态 MSVC 运行库。Windows 在含 `dumpbin.exe` 的 Visual Studio 开发者环境中运行打包。脚本预先检查两个输出文件是否存在，并在临时目录中完成两个包后再写入输出目录；写入失败时清理本次已写入的包，已有同名产物不会被覆盖。
 
 默认从 `build/<platform>/<arch>/release/` 读取原生程序，将两个 `.tgz` 写入 `build/npm/`。可指定路径：
 
@@ -67,7 +67,7 @@ npm --prefix apps/cli run pack:npm -- --binary /absolute/path/crossdesk-cli --ou
 
 每台构建机生成当前平台的原生包与相同版本的通用启动包。以 macOS arm64、版本 0.1.0 为例，文件名为 `chunkdash-crossdesk-cli-darwin-arm64-0.1.0.tgz` 和 `chunkdash-crossdesk-cli-0.1.0.tgz`；npm 将 `@scope/name` 的 tarball 文件名写作 `scope-name-version.tgz`。五个 CI artifact 各含一份入口包，最终需要五个平台包和一份入口包，共六个 tarball。
 
-`apps/cli/npm/platforms.json` 集中定义五个平台；脚本校验平台包名合法且不重复，启动包通过精确版本的 `optionalDependencies` 让 npm 仅安装匹配系统和 CPU 的原生包。生成的六个包都包含作者、源码仓库、主页、问题反馈地址，以及面向 npm 官方注册表的公开发布配置。原生包包含二进制、运行要求、SHA-256，以及当前控制端和已应用修补的 MiniRTC 源码快照。外部 Xmake 依赖的许可证、对应源码和重链接材料需要随正式版本一并提供，参见 [源码来源](source-provenance.md)。源码快照已含 MiniRTC，解包后无需运行 `prepare-deps.sh`；在 `source/` 目录按上述构建说明显式关闭桌面、开启 CLI，再构建 `crossdesk-cli`。源码包仅包含 CLI 及其依赖，不包含桌面或移动应用。
+`apps/cli/npm/platforms.json` 集中定义五个平台；脚本校验平台包名合法且不重复，启动包通过精确版本的 `optionalDependencies` 让 npm 仅安装匹配系统和 CPU 的原生包。生成的六个包都包含作者、源码仓库、主页、问题反馈地址，以及面向 npm 官方注册表的公开发布配置。原生包包含二进制、运行要求、SHA-256，以及当前控制端和 MiniRTC 源码快照。外部 Xmake 依赖的许可证、对应源码和重链接材料需要随正式版本一并提供，参见 [源码来源](source-provenance.md)。源码快照已含 MiniRTC，解包后无需运行 `prepare-deps.sh`；在 `source/` 目录按上述构建说明显式关闭桌面、开启 CLI，再构建 `crossdesk-cli`。源码包仅包含 CLI 及其依赖，不包含桌面或移动应用。
 
 `apps/cli/package.json` 的 `private: true` 表示源码目录不是发布产物。只发布打包脚本生成的 tarball；生成的包不带 private 标记。
 
diff --git a/apps/cli/docs/source-provenance.md b/apps/cli/docs/source-provenance.md
index 26e26682..fb908af0 100644
--- a/apps/cli/docs/source-provenance.md
+++ b/apps/cli/docs/source-provenance.md
@@ -8,8 +8,8 @@ CLI 从独立开发目录整合到 CrossDesk，入口、打包脚本、npm 启
 - 帧缓存遵守 `MiniRtcVideoFrame` 回调借用契约，直接复制到有界 CPU 存储，不跨回调保留 native 指针。
 - PreviewSubscription 复用 wire 实现与对端 capability 字段，不新增被控端协议。
 
-`deps/patches/minirtc-credential-logs.patch` 是 CLI 所需的 MiniRTC 修补：Join、排队 Join、取消 Join、Leave 四个日志点只记录 `@` 前的 ID，不记录密码。`apps/cli/scripts/prepare-deps.sh` 按主仓库记录初始化子模块并幂等应用补丁，不另行校验提交哈希；更新 MiniRTC 时无需修改脚本中的版本。CLI 构建检查补丁已存在。共享子模块中的脱敏同样适用于桌面程序；补丁没有改变鉴权、TLS、TURN 或媒体协议。
+MiniRTC 已在提交 `b9ee1fa7fe038fdf771f5dec1b1d561d78273f15` 中合入凭据日志脱敏：Join、排队 Join、取消 Join、Leave 四个日志点只记录 `@` 前的 ID，不记录密码。`apps/cli/scripts/prepare-deps.sh` 仅按主仓库记录初始化子模块，不再应用独立补丁；更新 MiniRTC 时只需更新子模块提交。共享子模块中的脱敏同样适用于桌面程序；该修改没有改变鉴权、TLS、TURN 或媒体协议。
 
-npm 原生包携带 CLI、共享库、构建配置和已修补 MiniRTC 的源码快照，不复制桌面、移动端、测试或本机构建缓存。源码包保留仓库目录结构，在 `source/` 中配置 `--CROSSDESK_BUILD_DESKTOP=n --CROSSDESK_BUILD_CLI=y` 后构建。
+npm 原生包携带 CLI、共享库、构建配置和 MiniRTC 的源码快照，不复制桌面、移动端、测试或本机构建缓存。源码包保留仓库目录结构，在 `source/` 中配置 `--CROSSDESK_BUILD_DESKTOP=n --CROSSDESK_BUILD_CLI=y` 后构建。
 
 LICENSE 沿用 CrossDesk GPL-3.0；MiniRTC 子模块保留其 LGPL-3.0 和第三方声明。外部 Xmake 依赖的许可证、对应源码及重链接材料仍需随正式版本提供。
diff --git a/apps/cli/docs/terminal-client.md b/apps/cli/docs/terminal-client.md
index 2b248241..e4e25268 100644
--- a/apps/cli/docs/terminal-client.md
+++ b/apps/cli/docs/terminal-client.md
@@ -11,7 +11,7 @@ xmake build crossdesk-cli
 xmake run crossdesk-cli doctor --json
 ```
 
-`prepare-deps.sh` 按主仓库记录的提交初始化 MiniRTC 子模块，并应用凭据日志脱敏补丁，可重复执行。脚本不另行校验提交哈希，升级 MiniRTC 时只需更新子模块提交；如果补丁与新版源码不兼容，准备步骤仍会失败，需要同步调整补丁。构建会检查补丁，缺失时失败。仓库默认开启桌面构建、关闭 CLI。上述参数只构建 CLI；需要同时构建桌面和 CLI 时，将 `CROSSDESK_BUILD_DESKTOP` 设为 `y`。恢复默认桌面配置使用 `xmake f -y --CROSSDESK_BUILD_DESKTOP=y --CROSSDESK_BUILD_CLI=n`。所有命令均从仓库根目录执行。
+`prepare-deps.sh` 按主仓库记录的提交初始化 MiniRTC 子模块，可重复执行。凭据日志脱敏已合入 MiniRTC，无需额外应用补丁；升级 MiniRTC 时只需更新子模块提交。仓库默认开启桌面构建、关闭 CLI。上述参数只构建 CLI；需要同时构建桌面和 CLI 时，将 `CROSSDESK_BUILD_DESKTOP` 设为 `y`。恢复默认桌面配置使用 `xmake f -y --CROSSDESK_BUILD_DESKTOP=y --CROSSDESK_BUILD_CLI=n`。所有命令均从仓库根目录执行。
 
 构建产物在 `build/<platform>/<arch>/<mode>/crossdesk-cli`。可把对应目录加入 PATH 或复制可执行文件到自己的 bin 目录。Pi 需要直接启动该可执行文件，不能使用会输出构建日志的 `xmake run` 作为桥接程序。
 
diff --git a/apps/cli/docs/validation.md b/apps/cli/docs/validation.md
index 71268bdb..64745e6a 100644
--- a/apps/cli/docs/validation.md
+++ b/apps/cli/docs/validation.md
@@ -18,7 +18,7 @@
 - Release 构建、实际二进制 bridge/PTY 回归通过。ASan/UBSan 检查覆盖原有会话和渲染行为，以及无效帧保留、NV12 缓冲复用、预览参数去重、ACK 状态、重复断开和重连网络统计复位。
 - 生产 bridge 配合工程外假传输验证静止画面重绘、细节模式、质量切换、窗口变化、无效配置原子性和帧 ACK 背压，通过。
 - ANSI 渲染前后对比覆盖 8/24/256 色、UTF-8/ASCII、half/quadrant、全景/细节模式，输出校验值一致。在本机 240×100 网格连续执行 200 次差分生成，静止网格约 447.4 ms → 3.6 ms，单行变化约 422.8 ms → 9.5 ms。该结果只衡量差分文本生成，不包含视频解码、图像缩放和终端显示时间。
-- npm 真实打包、离线安装及源码包重建通过；工程外故障注入确认已有产物保留、第二个包生成失败时无半套输出、缺失脱敏补丁时拒绝打包。
+- npm 真实打包、离线安装及源码包重建通过；工程外故障注入确认已有产物保留、第二个包生成失败时无半套输出。
 
 新增回归代码、基准、假传输和验证产物均位于工程外临时目录，未向工程或子模块添加测试。此次完整构建与运行验证覆盖 macOS arm64，未重新进行 Linux/Windows 实机验证。
 
diff --git a/apps/cli/scripts/pack-npm.cjs b/apps/cli/scripts/pack-npm.cjs
index 2d10d7fc..98f87447 100644
--- a/apps/cli/scripts/pack-npm.cjs
+++ b/apps/cli/scripts/pack-npm.cjs
@@ -132,8 +132,6 @@ try {
     const filename = tarballName(name, version);
     if (fs.existsSync(path.join(output, filename))) throw new Error(`Output already exists: ${filename}`);
   }
-  run('git', ['-C', path.join(root, 'deps/submodules/minirtc'), 'apply', '--reverse', '--check',
-              path.join(root, 'deps/patches/minirtc-credential-logs.patch')]);
   const executable = process.platform === 'win32' ? 'crossdesk-cli.exe' : 'crossdesk-cli';
   binary ||= path.join(root, 'build', platform.xmakePlatform, platform.xmakeArch, 'release', executable);
   const info = inspect(binary, target);
@@ -144,7 +142,7 @@ try {
   fs.copyFileSync(binary, path.join(native, 'bin', executable));
   fs.chmodSync(path.join(native, 'bin', executable), 0o755);
   copy('LICENSE', path.join(native, 'LICENSE'));
-  // Include the controller and patched MiniRTC sources used by this checkout.
+  // Include the controller and MiniRTC sources used by this checkout.
   // External Xmake dependency source/licenses still belong to the release's
   // dependency bundle; see source/apps/cli/docs/source-provenance.md.
   // Keep desktop build definitions for Xmake's initial option discovery;
@@ -153,11 +151,11 @@ try {
                        'libs/controller/include',
                        'libs/controller/src', 'libs/terminal', 'libs/wire/include',
                        'libs/wire/src', 'deps/submodules/minirtc',
-                       'deps/submodules/xmake.lua', 'deps/thirdparty', 'deps/patches', 'xmake.lua',
+                       'deps/submodules/xmake.lua', 'deps/thirdparty', 'xmake.lua',
                        'LICENSE', '.gitmodules'])
     copy(entry, path.join(native, 'source', entry));
   json(path.join(native, 'build-info.json'), { version, ...info });
-  fs.writeFileSync(path.join(native, 'README.md'), `# ${platform.packageName}\n\nNative ${target} dependency for [${project.name}](https://www.npmjs.com/package/${project.name}) ${version}, published under the ${platform.packageName.split('/')[0]} scope.\n\nInstall the cross-platform entry package with \`npm install -g ${project.name}\` or run \`npx ${project.name} doctor --json\`. This platform package contains the native binary and does not register a shell command.\n\nSource repository: [CrossDesk](${project.repository.url.replace(/^git\+/, '').replace(/\.git$/, '')}). Report problems at ${project.bugs.url}.\n\nRuntime requirements and linked libraries: [build-info.json](build-info.json).\n\nController and patched MiniRTC sources are included in source/. From source/, configure with xmake f -y --CROSSDESK_BUILD_DESKTOP=n --CROSSDESK_BUILD_CLI=y --USE_CUDA=n -m release, then run xmake build crossdesk-cli. External dependency notices and corresponding sources must accompany the product release; see source/apps/cli/docs/source-provenance.md.\n`);
+  fs.writeFileSync(path.join(native, 'README.md'), `# ${platform.packageName}\n\nNative ${target} dependency for [${project.name}](https://www.npmjs.com/package/${project.name}) ${version}, published under the ${platform.packageName.split('/')[0]} scope.\n\nInstall the cross-platform entry package with \`npm install -g ${project.name}\` or run \`npx ${project.name} doctor --json\`. This platform package contains the native binary and does not register a shell command.\n\nSource repository: [CrossDesk](${project.repository.url.replace(/^git\+/, '').replace(/\.git$/, '')}). Report problems at ${project.bugs.url}.\n\nRuntime requirements and linked libraries: [build-info.json](build-info.json).\n\nController and MiniRTC sources are included in source/. From source/, configure with xmake f -y --CROSSDESK_BUILD_DESKTOP=n --CROSSDESK_BUILD_CLI=y --USE_CUDA=n -m release, then run xmake build crossdesk-cli. External dependency notices and corresponding sources must accompany the product release; see source/apps/cli/docs/source-provenance.md.\n`);
   const metadata = {
     license: project.license, author: project.author, repository: project.repository,
     homepage: project.homepage, bugs: project.bugs,
diff --git a/apps/cli/scripts/prepare-deps.sh b/apps/cli/scripts/prepare-deps.sh
index cb4a8b19..b64e6780 100755
--- a/apps/cli/scripts/prepare-deps.sh
+++ b/apps/cli/scripts/prepare-deps.sh
@@ -2,9 +2,3 @@
 set -eu
 cd "$(dirname "$0")/../../.."
 git submodule update --init --recursive
-patch_file="$(pwd)/deps/patches/minirtc-credential-logs.patch"
-if git -C deps/submodules/minirtc apply --reverse --check "$patch_file" 2>/dev/null; then
-    exit 0
-fi
-git -C deps/submodules/minirtc apply --check "$patch_file"
-git -C deps/submodules/minirtc apply "$patch_file"
diff --git a/apps/cli/xmake.lua b/apps/cli/xmake.lua
index ba021ee4..52d19fa4 100644
--- a/apps/cli/xmake.lua
+++ b/apps/cli/xmake.lua
@@ -2,7 +2,6 @@ local source_dir = path.absolute("../..", os.scriptdir())
 local controller_dir = path.join(source_dir, "libs/controller")
 local terminal_dir = path.join(source_dir, "libs/terminal")
 local minirtc_dir = path.join(source_dir, "deps/submodules/minirtc")
-local credential_patch = path.join(source_dir, "deps/patches/minirtc-credential-logs.patch")
 
 add_requires("spdlog 1.14.1", {system = false})
 if is_plat("windows") then
@@ -17,10 +16,6 @@ target("crossdesk_controller")
         path.join(minirtc_dir, "src/api"), {public = true})
     add_includedirs(path.join(minirtc_dir, "src/log"))
     add_files(path.join(controller_dir, "src/*.cpp"))
-    before_build(function ()
-        -- Require the same credential redaction in checkouts and source bundles.
-        os.vrunv("git", {"-C", minirtc_dir, "apply", "--reverse", "--check", credential_patch})
-    end)
 target_end()
 
 target("crossdesk_terminal")
diff --git a/deps/patches/minirtc-credential-logs.patch b/deps/patches/minirtc-credential-logs.patch
deleted file mode 100644
index 2eb86b55..00000000
--- a/deps/patches/minirtc-credential-logs.patch
+++ /dev/null
@@ -1,24 +0,0 @@
-diff --git a/src/pc/peer_connection.cpp b/src/pc/peer_connection.cpp
-index bb9eb49..eda133f 100644
---- a/src/pc/peer_connection.cpp
-+++ b/src/pc/peer_connection.cpp
-@@ -459,3 +459,3 @@ int PeerConnection::SendJoinRequestLocked(
-     LOG_INFO("[{}] sends join transmission [{}] request", user_id_,
--             transmission_id);
-+             transmission_id.substr(0, transmission_id.find('@')));
-   }
-@@ -481,3 +481,3 @@ int PeerConnection::Join(const std::string& transmission_id) {
-     LOG_INFO("Queue join transmission [{}] until signal login completes",
--             transmission_id);
-+             transmission_id.substr(0, transmission_id.find('@')));
-     return 0;
-@@ -498,3 +498,3 @@ int PeerConnection::Leave(const std::string& transmission_id) {
-       LOG_INFO("Cancel queued join transmission [{}]",
--               *pending_join_transmission_id_);
-+               pending_join_transmission_id_->substr(0, pending_join_transmission_id_->find('@')));
-       pending_join_transmission_id_.reset();
-@@ -508,3 +508,3 @@ int PeerConnection::Leave(const std::string& transmission_id) {
-         LOG_INFO("[{}] leave transmission [{}] notification queued",
--                 user_id_, transmission_id);
-+                 user_id_, transmission_id.substr(0, transmission_id.find('@')));
-       }