[feat] add SignPath release signing and manual Windows tests

[skip ci]
[fix] use WinHTTP and Windows security checks for installer updates
2026-10-21 20:18:12 +08:00 · 2026-09-09 22:57:49 +08:00 · 2026-09-09 22:07:42 +08:00 · 2026-09-09 18:13:21 +08:00
102 changed files with 1534 additions and 6856 deletions
@@ -0,0 +1,62 @@
+name: Sign Windows artifact
+description: Submit one raw EXE or ZIP to SignPath and download the signed result.
+inputs:
+  api-token:
+    description: SignPath submitter token.
+    required: true
+  organization-id:
+    description: SignPath organization ID.
+    required: true
+  signing-policy:
+    description: test-signing or release-signing.
+    required: true
+  artifact-configuration:
+    description: Artifact configuration slug in the crossdesk project.
+    required: true
+  artifact:
+    description: Absolute path to one EXE or ZIP file.
+    required: true
+  output-directory:
+    description: Absolute directory for the downloaded signed file.
+    required: true
+  version:
+    description: CrossDesk ProductVersion and FileVersion.
+    required: true
+runs:
+  using: composite
+  steps:
+    - name: Upload unsigned artifact
+      id: unsigned
+      uses: actions/upload-artifact@v7
+      with:
+        path: ${{ inputs.artifact }}
+        archive: false
+        if-no-files-found: error
+        retention-days: 7
+
+    - name: Submit signing request and wait for approval
+      id: sign
+      uses: signpath/github-action-submit-signing-request@v2
+      with:
+        api-token: ${{ inputs.api-token }}
+        organization-id: ${{ inputs.organization-id }}
+        project-slug: crossdesk
+        signing-policy-slug: ${{ inputs.signing-policy }}
+        artifact-configuration-slug: ${{ inputs.artifact-configuration }}
+        github-artifact-id: ${{ steps.unsigned.outputs.artifact-id }}
+        wait-for-completion: true
+        wait-for-completion-timeout-in-seconds: 3600
+        output-artifact-directory: ${{ inputs.output-directory }}
+        skip-decompress: true
+        parameters: |
+          version: ${{ toJSON(inputs.version) }}
+
+    - name: Record signing request
+      if: always() && steps.sign.outputs.signing-request-web-url != ''
+      shell: pwsh
+      env:
+        SIGNING_REQUEST_URL: ${{ steps.sign.outputs.signing-request-web-url }}
+        SIGNING_CONFIGURATION: ${{ inputs.artifact-configuration }}
+        SIGNING_POLICY: ${{ inputs.signing-policy }}
+      run: |
+        "- $env:SIGNING_CONFIGURATION ($env:SIGNING_POLICY): $env:SIGNING_REQUEST_URL" >> $env:GITHUB_STEP_SUMMARY
@@ -14,7 +14,17 @@ on:
        required: false
        default: "0"
      sign_windows_test:
-        description: "Submit the Windows installer to SignPath using test-signing."
+        description: "Test-sign Windows binaries and installer (Actions artifacts only)."
+        required: false
+        type: boolean
+        default: false
+      sign_windows_release:
+        description: "Test release-signing with the production certificate (Actions artifacts only)."
+        required: false
+        type: boolean
+        default: false
+      windows_only:
+        description: "Build only Windows, for signing tests."
        required: false
        type: boolean
        default: false
@@ -28,6 +38,7 @@ env:

 jobs:
  build-linux:
+    if: github.event_name != 'workflow_dispatch' || !inputs.windows_only
    name: Build Linux (${{ matrix.arch }})
    runs-on: ${{ matrix.runner }}
    strategy:
@@ -176,6 +187,7 @@ jobs:

  # macOS
  build-macos:
+    if: github.event_name != 'workflow_dispatch' || !inputs.windows_only
    name: Build on macOS
    runs-on: ${{ matrix.runner }}
    env:
@@ -271,7 +283,7 @@ jobs:

      - name: Build CrossDesk
        run: |
-          xmake f --target_minver=${MACOSX_DEPLOYMENT_TARGET} --CROSSDESK_VERSION=${VERSION_NUM} --USE_CUDA=false -vyD
+          xmake f --target_minver=${MACOSX_DEPLOYMENT_TARGET} --CROSSDESK_VERSION=${VERSION_NUM} --USE_CUDA=false -y
          xmake b -vy crossdesk

      - name: Package CrossDesk app
@@ -308,6 +320,7 @@ jobs:

  # iOS
  build-ios:
+    if: github.event_name != 'workflow_dispatch' || !inputs.windows_only
    name: Build on iOS (arm64)
    runs-on: macos-26
    timeout-minutes: 120
@@ -504,9 +517,37 @@ jobs:
  build-windows-x64:
    name: Build on Windows x64
    runs-on: windows-2022
+    timeout-minutes: 240
+    outputs:
+      signing-policy: ${{ steps.signing.outputs.policy }}
    env:
      XMAKE_GLOBALDIR: D:\xmake_global
    steps:
+      - name: Select Windows signing policy
+        id: signing
+        shell: pwsh
+        env:
+          TEST_SIGNING: ${{ github.event_name == 'workflow_dispatch' && inputs.sign_windows_test }}
+          RELEASE_SIGNING: ${{ github.event_name == 'workflow_dispatch' && inputs.sign_windows_release }}
+          PUBLISH_RELEASE: ${{ github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v') }}
+          SIGNPATH_API_TOKEN: ${{ secrets.SIGNPATH_API_TOKEN }}
+          SIGNPATH_ORGANIZATION_ID: ${{ vars.SIGNPATH_ORGANIZATION_ID }}
+        run: |
+          if ($env:TEST_SIGNING -eq 'true' -and $env:RELEASE_SIGNING -eq 'true') {
+            throw 'Select only one of sign_windows_test and sign_windows_release.'
+          }
+          $policy = ''
+          if ($env:PUBLISH_RELEASE -eq 'true' -or $env:RELEASE_SIGNING -eq 'true') {
+            $policy = 'release-signing'
+          } elseif ($env:TEST_SIGNING -eq 'true') {
+            $policy = 'test-signing'
+          }
+          if ($policy -and (!$env:SIGNPATH_API_TOKEN -or !$env:SIGNPATH_ORGANIZATION_ID)) {
+            throw 'Signing requires SIGNPATH_API_TOKEN and SIGNPATH_ORGANIZATION_ID.'
+          }
+          "policy=$policy" >> $env:GITHUB_OUTPUT
+          "Windows signing policy: $(if ($policy) { $policy } else { 'unsigned development build' })" >> $env:GITHUB_STEP_SUMMARY
+
      - name: Extract version number
        shell: pwsh
        run: |
@@ -611,67 +652,99 @@ jobs:
          $nsisPluginDir = "C:\Program Files (x86)\NSIS\Plugins\x86-unicode"
          copy "${{ github.workspace }}\apps\desktop\scripts\windows\nsProcess.dll" $nsisPluginDir

+      - name: Test Windows signing helpers
+        shell: pwsh
+        run: ./apps/desktop/tests/windows_signing_test.ps1
+
      - name: Build CrossDesk
        run: |
          xmake f --CROSSDESK_VERSION=${{ env.VERSION_NUM }} --USE_CUDA=true -y
          xmake b -vy crossdesk

+      - name: Prepare installer binaries for signing
+        if: steps.signing.outputs.policy != ''
+        shell: pwsh
+        run: |
+          ./apps/desktop/scripts/windows/signpath-artifact.ps1 -Operation PrepareBinaries -Directory ./build/windows/x64/release -Artifact ./signpath/unsigned/installer-binaries.zip
+
+      - name: Sign installer binaries
+        if: steps.signing.outputs.policy != ''
+        uses: ./.github/actions/sign-windows
+        with:
+          api-token: ${{ secrets.SIGNPATH_API_TOKEN }}
+          organization-id: ${{ vars.SIGNPATH_ORGANIZATION_ID }}
+          signing-policy: ${{ steps.signing.outputs.policy }}
+          artifact-configuration: windows-binaries
+          artifact: ${{ github.workspace }}/signpath/unsigned/installer-binaries.zip
+          output-directory: ${{ github.workspace }}/signpath/signed/installer-binaries
+          version: ${{ env.VERSION_NUM }}
+
+      - name: Verify and restore signed installer binaries
+        if: steps.signing.outputs.policy != ''
+        shell: pwsh
+        env:
+          SIGNING_POLICY: ${{ steps.signing.outputs.policy }}
+        run: |
+          ./apps/desktop/scripts/windows/signpath-artifact.ps1 -Operation RestoreBinaries -Directory ./build/windows/x64/release -Artifact ./signpath/signed/installer-binaries/installer-binaries.zip -SigningPolicy $env:SIGNING_POLICY
+
      - name: Package
        shell: pwsh
        run: |
          & "${{ github.workspace }}\apps\desktop\scripts\windows\pkg_x64.ps1" $env:VERSION_NUM

-      - name: Upload unsigned Windows installer for test signing
-        if: github.event_name == 'workflow_dispatch' && inputs.sign_windows_test
-        id: upload-unsigned-windows-installer
-        uses: actions/upload-artifact@v7
-        with:
-          path: ${{ github.workspace }}/apps/desktop/scripts/windows/crossdesk-win-x64-${{ env.VERSION_NUM }}.exe
-          archive: false
-          if-no-files-found: error
-          retention-days: 1
-
-      - name: Sign Windows installer with SignPath test certificate
-        if: github.event_name == 'workflow_dispatch' && inputs.sign_windows_test
-        uses: signpath/github-action-submit-signing-request@v2
+      - name: Sign Windows installer
+        if: steps.signing.outputs.policy != ''
+        uses: ./.github/actions/sign-windows
        with:
          api-token: ${{ secrets.SIGNPATH_API_TOKEN }}
          organization-id: ${{ vars.SIGNPATH_ORGANIZATION_ID }}
-          project-slug: crossdesk
-          signing-policy-slug: test-signing
-          github-artifact-id: ${{ steps.upload-unsigned-windows-installer.outputs.artifact-id }}
-          wait-for-completion: true
-          output-artifact-directory: ${{ github.workspace }}\signpath\signed-installer
-          skip-decompress: true
-          parameters: |
-            version: ${{ toJSON(env.VERSION_NUM) }}
+          signing-policy: ${{ steps.signing.outputs.policy }}
+          artifact-configuration: initial
+          artifact: ${{ github.workspace }}/apps/desktop/scripts/windows/crossdesk-win-x64-${{ env.VERSION_NUM }}.exe
+          output-directory: ${{ github.workspace }}/signpath/signed/installer
+          version: ${{ env.VERSION_NUM }}

-      - name: Verify and use test-signed Windows installer
-        if: github.event_name == 'workflow_dispatch' && inputs.sign_windows_test
+      - name: Verify and use signed Windows installer
+        if: steps.signing.outputs.policy != ''
        shell: pwsh
+        env:
+          SIGNING_POLICY: ${{ steps.signing.outputs.policy }}
        run: |
-          $installerName = "crossdesk-win-x64-${{ env.VERSION_NUM }}.exe"
-          $signedInstaller = Join-Path "${{ github.workspace }}\signpath\signed-installer" $installerName
-          $destination = Join-Path "${{ github.workspace }}\apps\desktop\scripts\windows" $installerName
-
-          if (!(Test-Path $signedInstaller)) {
-            throw "SignPath did not return the signed installer: $signedInstaller"
-          }
-
-          $signature = Get-AuthenticodeSignature $signedInstaller
-          if (!$signature.SignerCertificate -or $signature.Status -eq "NotSigned") {
-            throw "SignPath returned an installer without an Authenticode signature."
-          }
-
-          Write-Host "Signer: $($signature.SignerCertificate.Subject)"
-          Write-Host "Signature status: $($signature.Status)"
-          Copy-Item $signedInstaller $destination -Force
+          $installerName = "crossdesk-win-x64-$env:VERSION_NUM.exe"
+          ./apps/desktop/scripts/windows/signpath-artifact.ps1 -Operation VerifyInstaller -Artifact "./signpath/signed/installer/$installerName" -SigningPolicy $env:SIGNING_POLICY
+          Copy-Item "./signpath/signed/installer/$installerName" ./apps/desktop/scripts/windows/ -Force

      - name: Build Portable CrossDesk
        run: |
          xmake f --CROSSDESK_VERSION=${{ env.VERSION_NUM }} --USE_CUDA=true --CROSSDESK_PORTABLE=true -y
          xmake b -vy crossdesk

+      - name: Prepare portable binaries for signing
+        if: steps.signing.outputs.policy != ''
+        shell: pwsh
+        run: |
+          ./apps/desktop/scripts/windows/signpath-artifact.ps1 -Operation PrepareBinaries -Directory ./build/windows/x64/release -Artifact ./signpath/unsigned/portable-binaries.zip
+
+      - name: Sign portable binaries
+        if: steps.signing.outputs.policy != ''
+        uses: ./.github/actions/sign-windows
+        with:
+          api-token: ${{ secrets.SIGNPATH_API_TOKEN }}
+          organization-id: ${{ vars.SIGNPATH_ORGANIZATION_ID }}
+          signing-policy: ${{ steps.signing.outputs.policy }}
+          artifact-configuration: windows-binaries
+          artifact: ${{ github.workspace }}/signpath/unsigned/portable-binaries.zip
+          output-directory: ${{ github.workspace }}/signpath/signed/portable-binaries
+          version: ${{ env.VERSION_NUM }}
+
+      - name: Verify and restore signed portable binaries
+        if: steps.signing.outputs.policy != ''
+        shell: pwsh
+        env:
+          SIGNING_POLICY: ${{ steps.signing.outputs.policy }}
+        run: |
+          ./apps/desktop/scripts/windows/signpath-artifact.ps1 -Operation RestoreBinaries -Directory ./build/windows/x64/release -Artifact ./signpath/signed/portable-binaries/portable-binaries.zip -SigningPolicy $env:SIGNING_POLICY
+
      - name: Package Portable
        shell: pwsh
        run: |
@@ -682,9 +755,7 @@ jobs:
          $portableFiles = @(
            @("crossdesk.exe", "CrossDesk.exe"),
            @("crossdesk_service.exe", "crossdesk_service.exe"),
-            @("crossdesk_session_helper.exe", "crossdesk_session_helper.exe"),
-            @("crossdesk_privacy_cursor_helper.exe", "crossdesk_privacy_cursor_helper.exe"),
-            @("crossdesk_privacy_window.dll", "crossdesk_privacy_window.dll")
+            @("crossdesk_session_helper.exe", "crossdesk_session_helper.exe")
          )

          foreach ($file in $portableFiles) {
@@ -721,7 +792,7 @@ jobs:

  release:
    name: Publish Release
-    if: startsWith(github.ref, 'refs/tags/v')
+    if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v') && needs.build-windows-x64.outputs.signing-policy == 'release-signing'
    needs: [build-linux, build-macos, build-ios, build-windows-x64]
    runs-on: ubuntu-latest

@@ -92,8 +92,9 @@ jobs:

      - name: Generate or update version.json
        run: |
-          # If version.json exists, try to preserve downloads section
-          if [ -f version.json ] && jq -e '.downloads' version.json > /dev/null 2>&1; then
+          # Preserve download URLs only for this release, never an older version.
+          if [ -f version.json ] && jq -e --arg tag "${{ steps.version.outputs.TAG_NAME }}" \
+            '.tagName == $tag and (.downloads | type == "object")' version.json > /dev/null 2>&1; then
            EXISTING_DOWNLOADS=$(jq -c '.downloads' version.json)
            if [ "$EXISTING_DOWNLOADS" != "null" ] && [ "$EXISTING_DOWNLOADS" != "{}" ]; then
              DOWNLOADS_JSON="$EXISTING_DOWNLOADS"
@@ -1,13 +0,0 @@
-/*
- * @Author: DI JUNKUN
- * @Date: 2026-09-11
- * Copyright (c) 2026 by DI JUNKUN, All Rights Reserved.
- */
-
-IDI_CROSSDESK_LOGO ICON "crossdesk.ico"
-
-#define CROSSDESK_FILE_DESCRIPTION "CrossDesk Privacy Window"
-#define CROSSDESK_ORIGINAL_FILENAME "crossdesk_privacy_window.dll"
-#define CROSSDESK_FILE_TYPE VFT_DLL
-
-#include "version_info.rcinc"
@@ -87,7 +87,7 @@ if [[ ! -x "$BUILD_BINARY" ]]; then
    exit 1
 fi

-for command_name in readelf ldd dpkg-deb strip; do
+for command_name in readelf ldd dpkg-deb; do
    if ! command -v "$command_name" >/dev/null 2>&1; then
        echo "Required packaging command is missing: $command_name" >&2
        exit 1
@@ -128,9 +128,6 @@ if [[ -n "$SLINT_NEEDED" ]]; then
        exit 1
    fi
    install -m 0755 "$SLINT_LIBRARY" "$PRIVATE_DIR/$SLINT_NEEDED"
-    # Keep dynamic exports/relocations while removing unneeded symbols from the
-    # staged copy. Never strip Xmake's cached runtime in place.
-    strip --strip-unneeded "$PRIVATE_DIR/$SLINT_NEEDED"
 fi

 cat > "$BIN_DIR/$PKG_NAME" <<'EOF'
@@ -164,7 +161,7 @@ Architecture: $DEBIAN_ARCH
 Maintainer: $MAINTAINER
 Description: $DESCRIPTION
 Depends: libc6 (>= 2.31), libstdc++6 (>= 10), libx11-6, libxext6,
- libxrender1, libxft2, libxrandr2, libxfixes3, libxcursor1, libxi6, libxcb1, libxcb-randr0,
+ libxrender1, libxft2, libxrandr2, libxfixes3, libxcursor1, libxcb1, libxcb-randr0,
 libxcb-xtest0, libxcb-xinerama0, libxcb-shape0, libxcb-xkb1,
 libxcb-xfixes0, libxv1, libxtst6, $ALSA_RUNTIME_DEP, libsndio7.0,
 libxcb-shm0, libpulse0, libdrm2, libdbus-1-3, libgl1
@@ -11,7 +11,7 @@ EXPECTED_ARCH="$2"
 APP_EXECUTABLE="$APP_BUNDLE/Contents/MacOS/CrossDesk"
 FRAMEWORKS_DIR="$APP_BUNDLE/Contents/Frameworks"

-for command_name in codesign install_name_tool lipo otool strip; do
+for command_name in codesign install_name_tool lipo otool; do
    if ! command -v "$command_name" >/dev/null 2>&1; then
        echo "Required bundling command is missing: $command_name" >&2
        exit 1
@@ -123,11 +123,7 @@ if ! otool -l "$APP_EXECUTABLE" | awk '
    install_name_tool -add_rpath "@executable_path/../Frameworks" "$APP_EXECUTABLE"
 fi

-# Strip only the staged runtime, retaining exported symbols for Slint's C ABI.
-# The package cache remains intact for debugging and other consumers.
-strip -S -x "$FRAMEWORKS_DIR/$SLINT_NAME"
-
-# install_name_tool and strip invalidate the linker's ad-hoc signature. Sign nested code
+# install_name_tool invalidates the linker's ad-hoc signature. Sign nested code
 # first, then seal the complete app bundle so local packages remain launchable.
 codesign --force --sign - "$FRAMEWORKS_DIR/$SLINT_NAME"
 codesign --force --deep --sign - "$APP_BUNDLE"
@@ -88,10 +88,8 @@ installApp:
    ; Bundle service-side binaries required by the Windows service flow
    File "..\..\..\..\build\windows\x64\release\crossdesk_service.exe"
    File "..\..\..\..\build\windows\x64\release\crossdesk_session_helper.exe"
-    File "..\..\..\..\build\windows\x64\release\crossdesk_privacy_cursor_helper.exe"
-    File "..\..\..\..\build\windows\x64\release\crossdesk_privacy_window.dll"
    ; Bundle runtime DLLs from the release output directory
-    File /x crossdesk_privacy_window.dll "..\..\..\..\build\windows\x64\release\*.dll"
+    File "..\..\..\..\build\windows\x64\release\*.dll"

    Call RegisterInstalledService

@@ -147,8 +145,6 @@ uninstallApp:
    Delete "$INSTDIR\CrossDesk.exe"
    Delete "$INSTDIR\crossdesk_service.exe"
    Delete "$INSTDIR\crossdesk_session_helper.exe"
-    Delete "$INSTDIR\crossdesk_privacy_cursor_helper.exe"
-    Delete "$INSTDIR\crossdesk_privacy_window.dll"
    Delete "$INSTDIR\uninstall.exe"

    ; Recursively delete installation directory
@@ -0,0 +1,65 @@
+param(
+  [Parameter(Mandatory)]
+  [ValidateSet('PrepareBinaries', 'RestoreBinaries', 'VerifyInstaller')]
+  [string]$Operation,
+  [Parameter(Mandatory)] [string]$Artifact,
+  [string]$Directory,
+  [ValidateSet('test-signing', 'release-signing')] [string]$SigningPolicy
+)
+
+. "$PSScriptRoot/signpath-common.ps1"
+
+if ($Operation -ne 'PrepareBinaries' -and !$SigningPolicy) {
+  throw 'SigningPolicy is required when verifying signed artifacts.'
+}
+if ($Operation -eq 'VerifyInstaller') {
+  Assert-CrossDeskSignature -Path $Artifact -SigningPolicy $SigningPolicy
+  return
+}
+if (!$Directory -or !(Test-Path -LiteralPath $Directory -PathType Container)) {
+  throw "Binaries directory does not exist: $Directory"
+}
+
+$files = @(Get-CrossDeskSigningFiles)
+$temporaryDirectory = Join-Path ([IO.Path]::GetTempPath()) "crossdesk-signing-$([guid]::NewGuid())"
+New-Item -ItemType Directory -Path $temporaryDirectory | Out-Null
+try {
+  if ($Operation -eq 'PrepareBinaries') {
+    foreach ($name in $files) {
+      $source = Join-Path $Directory $name
+      if (!(Test-Path -LiteralPath $source -PathType Leaf)) {
+        throw "Missing CrossDesk binary: $source"
+      }
+      Copy-Item -LiteralPath $source -Destination (Join-Path $temporaryDirectory $name)
+    }
+    $artifactPath = [IO.Path]::GetFullPath($Artifact)
+    New-Item -ItemType Directory -Path (Split-Path -Parent $artifactPath) -Force | Out-Null
+    Compress-Archive -Path "$temporaryDirectory/*" -DestinationPath $artifactPath -Force
+    return
+  }
+
+  # Inspect the ZIP before extraction: reject missing, duplicate or unexpected
+  # entries (including paths) so only the four intended files can be replaced.
+  $archive = [IO.Compression.ZipFile]::OpenRead([IO.Path]::GetFullPath($Artifact))
+  try {
+    $entries = @($archive.Entries | ForEach-Object { $_.FullName })
+    $uniqueEntries = @($entries | Sort-Object -Unique)
+    if ($entries.Count -ne $files.Count -or $uniqueEntries.Count -ne $files.Count -or
+        @(Compare-Object $files $entries).Count -ne 0) {
+      throw "Signed archive must contain exactly: $($files -join ', ')"
+    }
+  } finally {
+    $archive.Dispose()
+  }
+  Expand-Archive -LiteralPath $Artifact -DestinationPath $temporaryDirectory
+
+  # Verify every file before replacing any build output.
+  foreach ($name in $files) {
+    Assert-CrossDeskSignature -Path (Join-Path $temporaryDirectory $name) -SigningPolicy $SigningPolicy
+  }
+  foreach ($name in $files) {
+    Copy-Item -LiteralPath (Join-Path $temporaryDirectory $name) -Destination (Join-Path $Directory $name) -Force
+  }
+} finally {
+  Remove-Item -LiteralPath $temporaryDirectory -Recurse -Force
+}
@@ -0,0 +1,21 @@
+<?xml version="1.0" encoding="utf-8"?>
+<artifact-configuration xmlns="http://signpath.io/artifact-configuration/v1">
+  <parameters>
+    <parameter name="version" required="true" />
+  </parameters>
+  <zip-file>
+    <pe-file-set product-name="CrossDesk"
+                 product-version="${version}"
+                 file-version="${version}"
+                 company-name="CrossDesk"
+                 copyright="Copyright (C) CrossDesk contributors">
+      <include path="crossdesk.exe" original-filename="CrossDesk.exe" />
+      <include path="crossdesk_service.exe" original-filename="crossdesk_service.exe" />
+      <include path="crossdesk_session_helper.exe" original-filename="crossdesk_session_helper.exe" />
+      <include path="wgc_plugin.dll" original-filename="wgc_plugin.dll" />
+      <for-each>
+        <authenticode-sign />
+      </for-each>
+    </pe-file-set>
+  </zip-file>
+</artifact-configuration>
@@ -0,0 +1,57 @@
+$ErrorActionPreference = 'Stop'
+
+function Get-CrossDeskSigningFiles {
+  # Only binaries built from this project's sources. Never include third-party DLLs.
+  return @('crossdesk.exe', 'crossdesk_service.exe', 'crossdesk_session_helper.exe', 'wgc_plugin.dll')
+}
+
+function Find-CrossDeskSignTool {
+  $command = Get-Command signtool.exe -ErrorAction SilentlyContinue
+  if ($command) {
+    return $command.Source
+  }
+  $sdk = Join-Path ${env:ProgramFiles(x86)} 'Windows Kits/10/bin'
+  $tool = Get-ChildItem "$sdk/*/x64/signtool.exe" |
+    Sort-Object { [version]$_.Directory.Parent.Name } |
+    Select-Object -Last 1
+  if (!$tool) {
+    throw 'SignTool from the Windows SDK is required to verify release signatures.'
+  }
+  return $tool.FullName
+}
+
+function Assert-CrossDeskSignature {
+  param(
+    [Parameter(Mandatory)] [string]$Path,
+    [Parameter(Mandatory)] [ValidateSet('test-signing', 'release-signing')] [string]$SigningPolicy
+  )
+
+  if (!(Test-Path -LiteralPath $Path -PathType Leaf)) {
+    throw "Missing signed file: $Path"
+  }
+  $signature = Get-AuthenticodeSignature -LiteralPath $Path
+  if (!$signature.SignerCertificate) {
+    throw "File has no Authenticode signing certificate: $Path"
+  }
+  Write-Host "Signature: $Path | $($signature.Status) | $($signature.SignerCertificate.Subject)"
+  if ($SigningPolicy -eq 'test-signing') {
+    # Self-signed test certificates are not trusted by stock GitHub runners.
+    # HashMismatch, NotSigned, UnknownError, etc. must still stop the build.
+    if ($signature.Status -notin @('Valid', 'NotTrusted')) {
+      throw "Invalid test signature on ${Path}: $($signature.Status)"
+    }
+    return
+  }
+
+  if ($signature.Status -ne 'Valid') {
+    throw "Release signature is not trusted on ${Path}: $($signature.Status)"
+  }
+  if (!$signature.TimeStamperCertificate) {
+    throw "Release signature has no timestamp: $Path"
+  }
+  $signTool = Find-CrossDeskSignTool
+  & $signTool verify /pa /all /v $Path
+  if ($LASTEXITCODE -ne 0) {
+    throw "SignTool verification failed for $Path (exit $LASTEXITCODE)."
+  }
+}
@@ -24,10 +24,6 @@
 #include "path_manager.h"
 #include "render.h"

-#ifdef __linux__
-#include "platform/linux/privacy/privacy_guard.h"
-#endif
-
 #ifdef _WIN32
 namespace {

@@ -179,14 +175,6 @@ int HandleServiceCliCommand(const std::string& command) {
 #endif

 int main(int argc, char* argv[]) {
-#ifdef __linux__
-  // Run before GUI, configuration, logging or daemon initialization. The
-  // guard owns native privacy resources and restores them if this app exits.
-  if (argc == 2 &&
-      std::strcmp(argv[1], crossdesk::kLinuxPrivacyGuardArgument) == 0) {
-    return crossdesk::RunLinuxPrivacyGuard();
-  }
-#endif
 #ifdef _WIN32
  if (argc == 2 &&
      std::strcmp(argv[1], crossdesk::kSlintRendererProbeArgument) == 0) {
@@ -245,4 +233,4 @@ int main(int argc, char* argv[]) {
  crossdesk::Render render;
  render.Run();
  return 0;
-}
+}
@@ -58,14 +58,6 @@ int ConfigCenter::Load() {
  video_frame_rate_ = static_cast<VIDEO_FRAME_RATE>(ini_.GetLongValue(
      section_, "video_frame_rate", static_cast<long>(video_frame_rate_)));

-  const long screen_capture_method_value = ini_.GetLongValue(
-      section_, "screen_capture_method",
-      static_cast<long>(ScreenCaptureMethod::Auto));
-  screen_capture_method_ = IsValidScreenCaptureMethod(screen_capture_method_value)
-                               ? static_cast<ScreenCaptureMethod>(
-                                     screen_capture_method_value)
-                               : ScreenCaptureMethod::Auto;
-
  const long video_adaptation_policy_value = ini_.GetLongValue(
      section_, "video_adaptation_policy",
      static_cast<long>(video_adaptation_policy_));
@@ -127,8 +119,6 @@ int ConfigCenter::Load() {
  enable_autostart_ =
      ini_.GetBoolValue(section_, "enable_autostart", enable_autostart_);
  enable_daemon_ = ini_.GetBoolValue(section_, "enable_daemon", enable_daemon_);
-  enable_privacy_screen_.store(
-      ini_.GetBoolValue(section_, "enable_privacy_screen", true));
  portable_service_prompt_suppressed_ =
      ini_.GetBoolValue(section_, "portable_service_prompt_suppressed",
                        portable_service_prompt_suppressed_);
@@ -155,8 +145,6 @@ int ConfigCenter::Save() {
                    static_cast<long>(video_quality_));
  ini_.SetLongValue(section_, "video_frame_rate",
                    static_cast<long>(video_frame_rate_));
-  ini_.SetLongValue(section_, "screen_capture_method",
-                    static_cast<long>(screen_capture_method_));
  ini_.SetLongValue(section_, "video_adaptation_policy",
                    static_cast<long>(video_adaptation_policy_));
  ini_.SetLongValue(section_, "video_encode_format",
@@ -177,8 +165,6 @@ int ConfigCenter::Save() {

  ini_.SetBoolValue(section_, "enable_autostart", enable_autostart_);
  ini_.SetBoolValue(section_, "enable_daemon", enable_daemon_);
-  ini_.SetBoolValue(section_, "enable_privacy_screen",
-                    enable_privacy_screen_.load());
  ini_.SetBoolValue(section_, "portable_service_prompt_suppressed",
                    portable_service_prompt_suppressed_);

@@ -227,20 +213,6 @@ int ConfigCenter::SetVideoFrameRate(VIDEO_FRAME_RATE video_frame_rate) {
  return 0;
 }

-int ConfigCenter::SetScreenCaptureMethod(ScreenCaptureMethod method) {
-  if (!IsValidScreenCaptureMethod(static_cast<long>(method))) {
-    return -1;
-  }
-  ini_.SetLongValue(section_, "screen_capture_method", static_cast<long>(method));
-  if (ini_.SaveFile(config_path_.c_str()) < 0) {
-    ini_.SetLongValue(section_, "screen_capture_method",
-                      static_cast<long>(screen_capture_method_));
-    return -1;
-  }
-  screen_capture_method_ = method;
-  return 0;
-}
-
 int ConfigCenter::SetVideoAdaptationPolicy(
    VIDEO_ADAPTATION_POLICY policy) {
  video_adaptation_policy_ = policy;
@@ -398,21 +370,6 @@ int ConfigCenter::SetDaemon(bool enable_daemon) {
  return 0;
 }

-int ConfigCenter::SetPrivacyScreen(bool enable_privacy_screen) {
-  const bool previous = enable_privacy_screen_.load();
-  if (previous == enable_privacy_screen) return 0;
-  ini_.SetBoolValue(section_, "enable_privacy_screen", enable_privacy_screen);
-  if (ini_.SaveFile(config_path_.c_str()) < 0) {
-    ini_.SetBoolValue(section_, "enable_privacy_screen", previous);
-    LOG_ERROR("Failed to save automatic privacy screen preference");
-    return -1;
-  }
-  // RTC callbacks read only the value committed by the settings thread.
-  enable_privacy_screen_.store(enable_privacy_screen);
-  LOG_INFO("Privacy screen on incoming connection: {}", enable_privacy_screen);
-  return 0;
-}
-
 int ConfigCenter::SetPortableServicePromptSuppressed(bool suppressed) {
  portable_service_prompt_suppressed_ = suppressed;
  ini_.SetBoolValue(section_, "portable_service_prompt_suppressed",
@@ -437,10 +394,6 @@ ConfigCenter::VIDEO_FRAME_RATE ConfigCenter::GetVideoFrameRate() const {
  return video_frame_rate_;
 }

-ScreenCaptureMethod ConfigCenter::GetScreenCaptureMethod() const {
-  return screen_capture_method_;
-}
-
 ConfigCenter::VIDEO_ADAPTATION_POLICY
 ConfigCenter::GetVideoAdaptationPolicy() const {
  return video_adaptation_policy_;
@@ -450,18 +403,8 @@ ConfigCenter::VIDEO_ENCODE_FORMAT ConfigCenter::GetVideoEncodeFormat() const {
  return video_encode_format_;
 }

-bool ConfigCenter::IsHardwareVideoCodecAvailable() {
-#if (((defined(_WIN32) || defined(__linux__)) && !defined(__aarch64__) && \
-      !defined(__arm__) && USE_CUDA) ||                                   \
-     defined(__APPLE__))
-  return true;
-#else
-  return false;
-#endif
-}
-
 bool ConfigCenter::IsHardwareVideoCodec() const {
-  return IsHardwareVideoCodecAvailable() && hardware_video_codec_;
+  return hardware_video_codec_;
 }

 ConfigCenter::TURN_MODE ConfigCenter::GetTurnMode() const {
@@ -494,10 +437,6 @@ bool ConfigCenter::IsEnableAutostart() const { return enable_autostart_; }

 bool ConfigCenter::IsEnableDaemon() const { return enable_daemon_; }

-bool ConfigCenter::IsEnablePrivacyScreen() const {
-  return enable_privacy_screen_.load();
-}
-
 bool ConfigCenter::IsPortableServicePromptSuppressed() const {
  return portable_service_prompt_suppressed_;
 }
@@ -7,11 +7,9 @@
 #ifndef _CONFIG_CENTER_H_
 #define _CONFIG_CENTER_H_

-#include <atomic>
 #include <string>

 #include "SimpleIni.h"
-#include "screen_capturer/screen_capture_method.h"

 namespace crossdesk {

@@ -41,7 +39,6 @@ class ConfigCenter {
  int SetLanguage(LANGUAGE language);
  int SetVideoQuality(VIDEO_QUALITY video_quality);
  int SetVideoFrameRate(VIDEO_FRAME_RATE video_frame_rate);
-  int SetScreenCaptureMethod(ScreenCaptureMethod method);
  int SetVideoAdaptationPolicy(VIDEO_ADAPTATION_POLICY policy);
  int SetVideoEncodeFormat(VIDEO_ENCODE_FORMAT video_encode_format);
  int SetHardwareVideoCodec(bool hardware_video_codec);
@@ -53,7 +50,6 @@ class ConfigCenter {
  int SetSelfHosted(bool enable_self_hosted);
  int SetAutostart(bool enable_autostart);
  int SetDaemon(bool enable_daemon);
-  int SetPrivacyScreen(bool enable_privacy_screen);
  int SetPortableServicePromptSuppressed(bool suppressed);
  int SetFileTransferSavePath(const std::string& path);

@@ -62,11 +58,8 @@ class ConfigCenter {
  LANGUAGE GetLanguage() const;
  VIDEO_QUALITY GetVideoQuality() const;
  VIDEO_FRAME_RATE GetVideoFrameRate() const;
-  ScreenCaptureMethod GetScreenCaptureMethod() const;
  VIDEO_ADAPTATION_POLICY GetVideoAdaptationPolicy() const;
  VIDEO_ENCODE_FORMAT GetVideoEncodeFormat() const;
-  // Whether this build includes a hardware video codec backend.
-  static bool IsHardwareVideoCodecAvailable();
  bool IsHardwareVideoCodec() const;
  TURN_MODE GetTurnMode() const;
  bool IsEnableTurn() const;
@@ -78,7 +71,6 @@ class ConfigCenter {
  bool IsSelfHosted() const;
  bool IsEnableAutostart() const;
  bool IsEnableDaemon() const;
-  bool IsEnablePrivacyScreen() const;
  bool IsPortableServicePromptSuppressed() const;
  std::string GetFileTransferSavePath() const;

@@ -93,7 +85,6 @@ class ConfigCenter {
  LANGUAGE language_ = LANGUAGE::CHINESE;
  VIDEO_QUALITY video_quality_ = VIDEO_QUALITY::HIGH;
  VIDEO_FRAME_RATE video_frame_rate_ = VIDEO_FRAME_RATE::FPS_60;
-  ScreenCaptureMethod screen_capture_method_ = ScreenCaptureMethod::Auto;
  VIDEO_ADAPTATION_POLICY video_adaptation_policy_ =
      VIDEO_ADAPTATION_POLICY::QUALITY_PRIORITY;
  VIDEO_ENCODE_FORMAT video_encode_format_ = VIDEO_ENCODE_FORMAT::H264;
@@ -107,7 +98,6 @@ class ConfigCenter {
  bool enable_self_hosted_ = false;
  bool enable_autostart_ = false;
  bool enable_daemon_ = false;
-  std::atomic<bool> enable_privacy_screen_{true};
  bool portable_service_prompt_suppressed_ = false;
  std::string file_transfer_save_path_ = "";
 };
@@ -34,7 +34,6 @@
 #include "platform.h"
 #include "platform/video_renderer.h"
 #include "rendering/slint_video_presenter.h"
-#include "runtime/privacy_control_state.h"
 #if _WIN32
 #include <windows.h>

@@ -1028,8 +1027,6 @@ void GuiApplication::InitializeSettings() {
  language_button_value_ = localization_language_index_;
  localization_language_ =
      static_cast<ConfigCenter::LANGUAGE>(localization_language_index_);
-  privacy_.SetText({
-      localization::privacy_screen_unlock_hint[localization_language_index_]});
 }

 bool GuiApplication::InitializeSDL() {
@@ -1224,28 +1221,12 @@ void GuiApplication::ResetSettingsUi() {
  ui_->main->set_adaptation_policy_index(
      video_adaptation_policy_button_value_);
  ui_->main->set_codec_index(video_encode_format_button_value_);
-  const bool hardware_codec_available =
-      ConfigCenter::IsHardwareVideoCodecAvailable();
-  ui_->main->set_hardware_codec_available(hardware_codec_available);
-  ui_->main->set_hardware_codec_enabled(hardware_codec_available &&
-                                       enable_hardware_video_codec_);
+  ui_->main->set_hardware_codec_enabled(enable_hardware_video_codec_);
  ui_->main->set_turn_enabled(enable_turn_);
  ui_->main->set_srtp_enabled(enable_srtp_);
  ui_->main->set_self_hosted_enabled(enable_self_hosted_);
  ui_->main->set_autostart_enabled(enable_autostart_);
  ui_->main->set_daemon_enabled(enable_daemon_);
-  ui_->main->set_privacy_on_connect_enabled(
-      config_center_->IsEnablePrivacyScreen());
-#ifdef _WIN32
-  ui_->main->set_capture_method_visible(true);
-  ui_->main->set_capture_method_index(
-      static_cast<int>(config_center_->GetScreenCaptureMethod()));
-#endif
-#if defined(_WIN32) || defined(__APPLE__) || defined(__linux__)
-  ui_->main->set_privacy_setting_available(true);
-#else
-  ui_->main->set_privacy_setting_available(false);
-#endif
  ui_->main->set_file_save_path(file_transfer_save_path_buf_);
  ui_->main->set_server_host(signal_server_ip_self_);
  ui_->main->set_server_port(signal_server_port_self_);
@@ -1432,6 +1413,21 @@ void GuiApplication::BindMainCallbacks() {
                                   : slint::SharedString{});
  });
  main->on_open_download([this] { OpenUrl("https://crossdesk.cn"); });
+  main->on_start_update([this] {
+#if _WIN32
+    windows_updater_.Start(latest_version_info_);
+    SyncWindowsUpdate();
+#else
+    OpenUrl("https://crossdesk.cn");
+    ui_->main->set_update_open(false);
+#endif
+  });
+  main->on_cancel_update([this] {
+#if _WIN32
+    windows_updater_.Cancel();
+#endif
+    ui_->main->set_update_open(false);
+  });
  main->on_connection_cancel([this] {
    const auto props = FindRemoteSession(ui_->connection_dialog_remote_id);
    if (!props) {
@@ -1606,36 +1602,6 @@ void GuiApplication::BindStreamCallbacks() {
    SendReliableDataFrame(props->peer_, message.c_str(), message.size(),
                          props->control_data_label_.c_str());
  });
-  stream->on_toggle_privacy([this] {
-    auto props = SelectedSession();
-    if (!props || !props->peer_ || !props->control_mouse_ ||
-        props->connection_status_.load() != ConnectionStatus::Connected) return;
-    RemoteAction action{};
-    action.type = ControlType::privacy_command;
-    {
-      std::lock_guard lock(props->privacy_status_mutex_);
-      const auto& status = props->privacy_status_;
-      const uint64_t now = SDL_GetTicks();
-      const auto controls = GetPrivacyControlState(
-          status, props->privacy_status_received_, props->privacy_command_pending_,
-          now - props->privacy_status_tick_, now - props->privacy_command_tick_);
-      if (!controls.can_toggle) return;
-      action.pc.flag = controls.active ? PrivacyCommandFlag::disable
-                                      : PrivacyCommandFlag::enable;
-      action.pc.block_local_input = true;
-      props->privacy_command_pending_ = true;
-      props->privacy_command_tick_ = now;
-      props->privacy_request_revision_ = status.revision;
-    }
-    const auto message = action.to_json();
-    if (SendReliableDataFrame(props->peer_, message.data(), message.size(),
-                              props->control_data_label_.c_str()) != 0) {
-      std::lock_guard lock(props->privacy_status_mutex_);
-      props->privacy_command_pending_ = false;
-      props->privacy_status_received_ = false;
-      LOG_WARN("Privacy command send failed, remote_id={}", props->remote_id_);
-    }
-  });
  stream->on_toggle_mouse_control([this] {
    auto props = SelectedSession();
    if (!props || !props->connection_established_) {
@@ -1843,7 +1809,6 @@ void GuiApplication::Tick() {
  HandleConnectionStatusChange();
  HandlePendingPresenceProbe();
  HandlePresenceProbeTimeout();
-  HandlePrivacy();
  HandleWindowsServiceIntegration();
 #if defined(__linux__) && !defined(__APPLE__)
  SyncXWaylandWindowActivation();
@@ -2150,11 +2115,22 @@ void GuiApplication::SyncMainWindow() {
  ui_->main->set_signal_tls_error(signal_status_ ==
                                  SignalStatus::SignalTlsCertError);
  ui_->main->set_update_available(update_available_);
+#if _WIN32
+  SyncWindowsUpdate();
+#endif
  ui_->main->set_current_version(CROSSDESK_VERSION);
  ui_->main->set_latest_version(UiText(latest_version_));
  ui_->main->set_release_name(UiText(release_name_));
  ui_->main->set_release_date(UiText(release_date_));
-  ui_->main->set_settings_session_active(HasActiveSession());
+  ui_->main->set_settings_session_active(stream_window_inited_);
+#if (((defined(_WIN32) || defined(__linux__)) && !defined(__aarch64__) && \
+      !defined(__arm__) && USE_CUDA) ||                                   \
+     defined(__APPLE__))
+  ui_->main->set_hardware_codec_available(true);
+#else
+  ui_->main->set_hardware_codec_available(false);
+#endif
+
  if (show_offline_warning_window_) {
    ui_->main->set_offline_warning(UiText(offline_warning_text_));
    show_offline_warning_window_ = false;
@@ -2549,29 +2525,6 @@ void GuiApplication::SyncStreamWindow() {
              ? localization::receiving_screen[localization_language_index_]
              : std::string{}));
  (*ui_->stream)->set_mouse_control_enabled(props->control_mouse_);
-  {
-    std::lock_guard lock(props->privacy_status_mutex_);
-    const auto& status = props->privacy_status_;
-    const uint64_t now = SDL_GetTicks();
-    const auto controls = GetPrivacyControlState(
-        status, props->privacy_status_received_, props->privacy_command_pending_,
-        now - props->privacy_status_tick_, now - props->privacy_command_tick_);
-    const bool connected =
-        props->connection_status_.load() == ConnectionStatus::Connected;
-    (*ui_->stream)->set_privacy_active(controls.active);
-    (*ui_->stream)->set_privacy_off(connected && controls.off);
-    (*ui_->stream)->set_privacy_unsupported(controls.unsupported);
-    (*ui_->stream)->set_privacy_can_toggle(
-        props->control_mouse_ && connected && controls.can_toggle);
-    const int language = localization_language_index_;
-    std::string text = !connected || !props->privacy_status_received_
-        ? localization::privacy_screen[language]
-        : controls.unsupported ? localization::privacy_unsupported[language]
-        : controls.enabled ? localization::privacy_on[language]
-        : controls.off ? localization::privacy_off[language]
-        : localization::privacy_screen[language];
-    (*ui_->stream)->set_privacy_status_text(UiText(text));
-  }
  int remote_cursor_shape =
      static_cast<int>(RemoteCursorShape::default_cursor);
  bool remote_cursor_active = false;
@@ -2815,19 +2768,7 @@ void GuiApplication::SyncServerWindow() {
                    });
  }

-  // Privacy protects local display output while preserving capture.
-  // Keep the panel alive throughout privacy transitions so remote
-  // controllers can still see and operate it without resetting its UI state.
-  bool show_controller_window = has_connected_controller;
-#if !defined(_WIN32) && !defined(__APPLE__) && !defined(__linux__)
-  // Preserve the existing panel behavior on other platforms.
-  const auto privacy_status = privacy_.Snapshot();
-  const bool privacy_covering = privacy_status.overlay_active ||
-      privacy_status.state == PrivacyState::starting ||
-      privacy_status.state == PrivacyState::stopping;
-  show_controller_window = show_controller_window && !privacy_covering;
-#endif
-  if (show_controller_window && !ui_->server) {
+  if (has_connected_controller && !ui_->server) {
    ui_->server.emplace(ui::ServerWindow::create());
    RegisterFontAwesome((*ui_->server)->window());
    (*ui_->server)->set_controllers(ui_->controller_model);
@@ -2851,7 +2792,7 @@ void GuiApplication::SyncServerWindow() {
    server_window_created_ = true;
    server_window_inited_ = true;
  }
-  if (!show_controller_window && ui_->server) {
+  if (!has_connected_controller && ui_->server) {
    (*ui_->server)->hide();
    ui_->server.reset();
    server_window_created_ = false;
@@ -2984,8 +2925,7 @@ void GuiApplication::SaveSettingsFromUi() {
  video_adaptation_policy_button_value_ =
      std::clamp(main->get_adaptation_policy_index(), 0, 2);
  video_encode_format_button_value_ = std::clamp(main->get_codec_index(), 0, 1);
-  enable_hardware_video_codec_ = ConfigCenter::IsHardwareVideoCodecAvailable() &&
-                                  main->get_hardware_codec_enabled();
+  enable_hardware_video_codec_ = main->get_hardware_codec_enabled();
  enable_turn_ = main->get_turn_enabled();
  enable_srtp_ = main->get_srtp_enabled();
  enable_self_hosted_ = main->get_self_hosted_enabled();
@@ -2996,8 +2936,6 @@ void GuiApplication::SaveSettingsFromUi() {
      static_cast<ConfigCenter::LANGUAGE>(language_button_value_);
  localization_language_index_ = language_button_value_;
  config_center_->SetLanguage(localization_language_);
-  privacy_.SetText({
-      localization::privacy_screen_unlock_hint[localization_language_index_]});
  config_center_->SetVideoQuality(
      static_cast<ConfigCenter::VIDEO_QUALITY>(video_quality_button_value_));
  config_center_->SetVideoFrameRate(static_cast<ConfigCenter::VIDEO_FRAME_RATE>(
@@ -3014,24 +2952,6 @@ void GuiApplication::SaveSettingsFromUi() {
  config_center_->SetSelfHosted(enable_self_hosted_);
  config_center_->SetAutostart(enable_autostart_);
  config_center_->SetDaemon(enable_daemon_);
-#ifdef _WIN32
-  if (!HasActiveSession()) {
-    const auto capture_method = static_cast<ScreenCaptureMethod>(
-        std::clamp(main->get_capture_method_index(), 0, 3));
-    if (config_center_->SetScreenCaptureMethod(capture_method) != 0) {
-      LOG_ERROR("Failed to save screen capture method");
-    }
-  }
-  main->set_capture_method_index(
-      static_cast<int>(config_center_->GetScreenCaptureMethod()));
-#endif
-#if defined(_WIN32) || defined(__APPLE__) || defined(__linux__)
-  if (config_center_->SetPrivacyScreen(main->get_privacy_on_connect_enabled()) !=
-      0) {
-    main->set_privacy_on_connect_enabled(
-        config_center_->IsEnablePrivacyScreen());
-  }
-#endif

  const std::string path(main->get_file_save_path());
  std::memset(file_transfer_save_path_buf_, 0,
@@ -3063,7 +2983,7 @@ void GuiApplication::SaveSettingsFromUi() {
  file_transfer_save_path_last_ = path;
  ui_->localized_language = -1;

-  if (!HasActiveSession()) {
+  if (!stream_window_inited_) {
    CloseAllRemoteSessions();
    CreateConnectionPeer();
  }
@@ -3355,7 +3275,59 @@ bool GuiApplication::OpenUrl(const std::string& url) {
  return SDL_OpenURL(url.c_str());
 }

+#if _WIN32
+void GuiApplication::SyncWindowsUpdate() {
+  using State = WindowsUpdater::State;
+  if (windows_updater_.GetState() == State::Ready) {
+    windows_updater_.Launch();
+    if (windows_updater_.GetState() == State::Launched) {
+      ui_->main->set_update_open(false);
+    }
+  }
+  const State state = windows_updater_.GetState();
+  const bool downloading = state == State::Downloading;
+  ui_->main->set_update_downloading(downloading || state == State::Checking ||
+                                    state == State::Launching);
+  ui_->main->set_update_security_blocked(state == State::SecurityBlocked);
+  ui_->main->set_update_failed(state == State::Failed ||
+                               state == State::LaunchFailed ||
+                               state == State::SecurityBlocked);
+  const int language = localization_language_index_;
+  std::string status;
+  if (downloading) {
+    status = localization::update_downloading[language];
+    const uint64_t total = windows_updater_.Total();
+    const uint64_t received = windows_updater_.Downloaded();
+    if (total > 0) {
+      const int percent = static_cast<int>(std::min(100.0, 100.0 * received / total));
+      status += " " + std::to_string(percent) + "%";
+      ui_->main->set_update_progress(static_cast<float>(percent) / 100.0f);
+    } else {
+      status += " " + std::to_string(received / (1024 * 1024)) + " MB";
+      ui_->main->set_update_progress(-1.0f);
+    }
+  } else if (state == State::Failed) {
+    status = localization::update_download_failed[language];
+  } else if (state == State::LaunchFailed) {
+    status = localization::update_launch_failed[language];
+  } else if (state == State::Checking) {
+    status = localization::update_checking[language];
+    ui_->main->set_update_progress(1.0f);
+  } else if (state == State::SecurityBlocked) {
+    status = localization::update_security_blocked[language];
+  } else if (state == State::Launching) {
+    status = localization::update_launching[language];
+  } else if (state == State::Launched) {
+    status = localization::update_installer_opened[language];
+  }
+  ui_->main->set_update_status(UiText(status));
+}
+#endif
+
 void GuiApplication::Cleanup() {
+#if _WIN32
+  windows_updater_.Cancel();
+#endif
  if (!ui_) {
    SDL_Quit();
    return;
@@ -3365,12 +3337,9 @@ void GuiApplication::Cleanup() {
 #if _WIN32 && CROSSDESK_PORTABLE
  JoinPortableWindowsServiceInstallThread();
 #endif
-  privacy_.Disable();
  clipboard_.Shutdown();
  keyboard_.ForceReleasePressedKeys();
-  keyboard_.ReleaseAllRemotePressedKeys("application_exit");
  devices_.DestroyDevices();
-  privacy_.Shutdown();
  devices_.DestroyFactories();
  CloseAllRemoteSessions();
  WaitForSessionCleanup();
@@ -16,6 +16,9 @@

 #include "runtime/cursor_state_provider.h"
 #include "runtime/gui_runtime.h"
+#if _WIN32
+#include "platform/windows/windows_updater.h"
+#endif

 namespace crossdesk {

@@ -52,6 +55,9 @@ private:
  void HandlePasswordChangeResult();
  void HandleCredentialRecovery();
  void SyncMainWindow();
+#if _WIN32
+  void SyncWindowsUpdate();
+#endif
  void SyncConnectionDialog();
  void SyncPlatformDialogs();
  void SyncStreamWindow();
@@ -87,6 +93,9 @@ private:
  bool OpenUrl(const std::string &url);

  std::unique_ptr<SlintUi> ui_;
+#if _WIN32
+  WindowsUpdater windows_updater_;
+#endif
  CursorStateProvider cursor_state_provider_;
  std::unordered_map<std::string, CursorDeliveryState>
      cursor_delivery_states_;
@@ -100,4 +109,4 @@ private:

 } // namespace crossdesk

-#endif
+#endif
@@ -20,12 +20,6 @@ struct TranslationRow {

 // Single source of truth for all UI strings.
 #define CROSSDESK_LOCALIZATION_ALL(X)                                          \
-  X(privacy_screen, u8"隐私屏", "Privacy screen", u8"Приватный экран") \
-  X(privacy_enable, u8"开启隐私屏", "Enable privacy screen", u8"Включить приватный экран") \
-  X(privacy_disable, u8"关闭隐私屏", "Disable privacy screen", u8"Выключить приватный экран") \
-  X(privacy_on, u8"隐私屏：已开启", "Privacy screen: on", u8"Приватный экран: включён") \
-  X(privacy_off, u8"隐私屏：已关闭", "Privacy screen: off", u8"Приватный экран: выключен") \
-  X(privacy_unsupported, u8"隐私屏：不可用", "Privacy screen: unavailable", u8"Приватный экран: недоступен") \
  X(local_desktop, u8"本桌面", "Local Desktop", u8"Локальный рабочий стол")    \
  X(local_id, u8"本机ID", "Local ID", u8"Локальный ID")                        \
  X(local_id_copied_to_clipboard, u8"已复制到剪贴板", "Copied to clipboard",   \
@@ -126,9 +120,6 @@ struct TranslationRow {
    u8"стола")                                                                 \
  X(settings, u8"设置", "Settings", u8"Настройки")                             \
  X(language, u8"语言:", "Language:", u8"Язык:")                               \
-  X(screen_capture_method, u8"采集方式:", "Capture Method:",                  \
-    u8"Способ захвата:")                                                      \
-  X(screen_capture_method_auto, u8"自动", "Auto", u8"Авто")                 \
  X(video_quality, u8"画面质量:", "Video Quality:", u8"Качество видео:")       \
  X(video_frame_rate, u8"画面采集帧率:",                                       \
    "Video Capture Frame Rate:", u8"Частота захвата видео:")                   \
@@ -193,6 +184,26 @@ struct TranslationRow {
  X(notification, u8"通知", "Notification", u8"Уведомление")                   \
  X(new_version_available, u8"新版本可用", "New Version Available",            \
    u8"Доступна новая версия")                                                 \
+  X(update_downloading, u8"正在下载安装包…", "Downloading installer…",        \
+    u8"Загрузка установщика…")                                                 \
+  X(update_checking, u8"正在进行 Windows 安全检查…",                           \
+    "Running Windows security checks…", u8"Проверка безопасности Windows…")    \
+  X(update_security_blocked,                                                 \
+    u8"Windows 安全检查未通过，请查看安全软件日志并核实发布者。",               \
+    "Windows security checks failed. Review security logs and verify the publisher.", \
+    u8"Проверка Windows не пройдена. Проверьте журнал защиты и издателя.")     \
+  X(update_launching, u8"正在打开安装包，请确认管理员权限请求…",               \
+    "Opening installer. Please confirm the administrator permission request…", \
+    u8"Запуск установщика. Подтвердите запрос прав администратора…")           \
+  X(update_download_failed, u8"下载失败，请点击更新重试，或访问官网。",         \
+    "Download failed. Click Update to retry, or visit the website.",           \
+    u8"Ошибка загрузки. Повторите обновление или откройте сайт.")              \
+  X(update_launch_failed, u8"安装包未能启动或授权已取消，请点击更新重试。",     \
+    "Installer launch failed or permission was cancelled. Click Update to retry.", \
+    u8"Установщик не запущен или доступ отменён. Повторите обновление.")        \
+  X(update_installer_opened, u8"安装包已打开，请在安装向导中完成更新。",         \
+    "Installer opened. Follow the setup wizard to finish updating.",          \
+    u8"Установщик открыт. Следуйте указаниям мастера установки.")              \
  X(release_notes, u8"更新内容", "Release Notes", u8"Содержание обновления") \
  X(version, u8"版本", "Version", u8"Версия")                                  \
  X(release_date, u8"发布日期: ", "Release Date: ", u8"Дата релиза: ")         \
@@ -211,8 +222,6 @@ struct TranslationRow {
    "Confirm to delete this connection", u8"Удалить это подключение?")         \
  X(enable_autostart, u8"开机自启:", "Auto Start:", u8"Автозапуск:")           \
  X(enable_daemon, u8"启用守护进程:", "Enable Daemon:", u8"Включить демон:")   \
-  X(privacy_on_connect, u8"被连接时开启隐私屏:", "Privacy screen on connect:", \
-    u8"Приватность при подключении:")                                       \
  X(takes_effect_after_restart, u8"重启后生效", "Takes effect after restart",  \
    u8"Вступит в силу после перезапуска")                                      \
  X(select_file, u8"选择文件发送", "Select File to Send",                      \
@@ -248,9 +257,6 @@ struct TranslationRow {
    u8"Для работы приложения требуются следующие разрешения:")                 \
  X(show_main_window, u8"显示主界面", "Show Main Window",                    \
    u8"Показать главное окно")                                                \
-  X(privacy_screen_unlock_hint, u8"按下快捷键，解除隐私屏",                    \
-    "To turn off the privacy screen, press",                                 \
-    u8"Чтобы отключить приватный экран, нажмите")                             \
  X(exit_program, u8"退出", "Exit", u8"Выход")

 inline constexpr TranslationRow kTranslationRows[] = {
@@ -10,10 +10,6 @@
 #include "rd_log.h"
 #include "runtime/gui_runtime.h"
 #include "speaker_capturer_factory.h"
-#ifdef _WIN32
-#include "platform/windows/screen_capturer/screen_capturer_win.h"
-#include "platform/windows/input/mouse/mouse_controller.h"
-#endif

 namespace crossdesk {
 namespace {
@@ -79,12 +75,6 @@ int SessionDeviceManager::InitializeScreenCapturer() {
    screen_capturer_ =
        static_cast<ScreenCapturer *>(screen_capturer_factory_->Create());
  }
-  screen_capturer_->SetPrivacyController(&owner_.privacy_);
-#ifdef _WIN32
-  if (auto windows = dynamic_cast<ScreenCapturerWin*>(screen_capturer_)) {
-    windows->SetCaptureMethod(owner_.config_center_->GetScreenCaptureMethod());
-  }
-#endif

  last_frame_time_ = {};
  next_frame_deadline_ = {};
@@ -226,13 +216,6 @@ int SessionDeviceManager::StopScreenCapturer() {
  return 0;
 }

-#ifdef _WIN32
-void SessionDeviceManager::ReleaseRemoteMouseButtons() {
-  if (auto mouse = dynamic_cast<PlatformMouseController*>(mouse_controller_))
-    mouse->ReleasePressedButtons();
-}
-#endif
-
 void SessionDeviceManager::StartSpeakerCapturer() {
  speaker_capture_.SetEnabled(true);
 }
@@ -505,7 +488,6 @@ void SessionDeviceManager::DrainCapturedKeyboardInput() {
    std::lock_guard<std::mutex> lock(captured_keyboard_inputs_mutex_);
    inputs.swap(captured_keyboard_inputs_);
  }
-  if (owner_.privacy_.Snapshot().input_blocked) return;
  for (const CapturedKeyboardInput &input : inputs) {
    owner_.keyboard_.SendKeyCommand(input.key_code, input.is_down,
                                    input.scan_code, input.extended);
@@ -46,9 +46,6 @@ public:
  int InitializeScreenCapturer();
  int StartScreenCapturer();
  int StopScreenCapturer();
-#ifdef _WIN32
-  void ReleaseRemoteMouseButtons();
-#endif
  // Requests are asynchronous; Stop drains/revokes audio delivery before
  // returning so the connection peer can be destroyed safely.
  void StartSpeakerCapturer();
@@ -105,4 +102,4 @@ private:

 } // namespace crossdesk

-#endif
+#endif
@@ -213,9 +213,6 @@ int KeyboardController::SendKeyCommand(int key_code, bool is_down,
 bool KeyboardController::InjectRemoteKey(int key_code, bool is_down,
                                         uint32_t scan_code, bool extended) {
 #if _WIN32
-  if (owner_.privacy_.Engaged() && !IsWindowsPrivacyDesktopAvailable()) {
-    owner_.privacy_.Fail("Secure desktop or locked session; privacy screen will turn off");
-  }
  if (owner_.local_service_status_received_ &&
      IsSecureDesktopInteractionRequired(owner_.local_interactive_stage_)) {
    const std::string response = SendCrossDeskSecureDesktopKeyInput(
@@ -249,7 +246,6 @@ bool KeyboardController::InjectRemoteKey(int key_code, bool is_down,
    return true;
  }
 #endif
-  // Recheck after the desktop query; key-up cleanup remains allowed while paused.
  return owner_.devices_.SendKeyboardCommand(key_code, is_down, scan_code,
                                             extended);
 }
@@ -346,50 +342,11 @@ void KeyboardController::ReleaseRemotePressedKeys(const std::string& remote_id,
             keys_to_release.size(), remote_id, reason ? reason : "unknown");
  }
  for (const PressedKey& key : keys_to_release) {
-    if (!InjectRemoteKey(key.key_code, false, key.scan_code, key.extended)) {
-#ifdef _WIN32
-      if (owner_.privacy_.Engaged()) {
-        std::lock_guard lock(remote_states_mutex_);
-        pending_privacy_releases_[key.key_code] = key;
-      }
-#endif
-    }
+    InjectRemoteKey(key.key_code, false, key.scan_code, key.extended);
  }
 }

-void KeyboardController::ReleaseAllRemotePressedKeys(const char* reason) {
-  std::vector<std::string> remotes;
-  {
-    std::lock_guard lock(remote_states_mutex_);
-    for (const auto& [id, state] : remote_states_) remotes.push_back(id);
-  }
-  for (const auto& id : remotes) ReleaseRemotePressedKeys(id, reason);
-  CheckRemoteTimeouts();
-}
-
 void KeyboardController::CheckRemoteTimeouts() {
-#ifdef _WIN32
-  bool pending = false;
-  {
-    std::lock_guard lock(remote_states_mutex_);
-    pending = !pending_privacy_releases_.empty();
-  }
-  // A key-up rejected on the secure desktop is retained until the ordinary
-  // desktop returns. Never route cleanup through the security UI helper.
-  if (pending && IsWindowsPrivacyDesktopAvailable()) {
-    std::unordered_map<int, PressedKey> releases;
-    {
-      std::lock_guard lock(remote_states_mutex_);
-      releases.swap(pending_privacy_releases_);
-    }
-    for (const auto& [code, key] : releases) {
-      if (!owner_.devices_.SendKeyboardCommand(code, false, key.scan_code, key.extended)) {
-        std::lock_guard lock(remote_states_mutex_);
-        pending_privacy_releases_[code] = key;
-      }
-    }
-  }
-#endif
  const uint32_t now = static_cast<uint32_t>(SDL_GetTicks());
  std::vector<std::string> timed_out_remotes;
  {
@@ -30,7 +30,6 @@ public:
                        const RemoteAction &remote_action);
  void ReleaseRemotePressedKeys(const std::string &remote_id,
                                const char *reason);
-  void ReleaseAllRemotePressedKeys(const char* reason);
  void CheckRemoteTimeouts();

 private:
@@ -59,9 +58,6 @@ private:
  uint32_t last_heartbeat_tick_ = 0;
  std::unordered_map<std::string, RemoteState> remote_states_;
  std::mutex remote_states_mutex_;
-#ifdef _WIN32
-  std::unordered_map<int, PressedKey> pending_privacy_releases_;
-#endif
 };

 } // namespace crossdesk
@@ -25,16 +25,6 @@ constexpr auto kPresenceRefreshInterval = std::chrono::seconds(30);
 constexpr auto kPresenceRetryInterval = std::chrono::seconds(1);
 }  // namespace

-bool GuiRuntime::HasActiveSession() {
-  if (stream_window_inited_) return true;
-  std::shared_lock lock(connection_status_mutex_);
-  return std::any_of(connection_status_.begin(), connection_status_.end(),
-                     [](const auto& entry) {
-                       return entry.second == ConnectionStatus::Connecting ||
-                              entry.second == ConnectionStatus::Connected;
-                     });
-}
-
 void GuiRuntime::HandleConnectionStatusChange() {
  if (!signal_connected_ || !peer_) {
    return;
@@ -131,9 +121,6 @@ void GuiRuntime::HandlePresenceProbeTimeout() {
 void GuiRuntime::HandleServerControllerDisconnected(
    const std::string& remote_id, const char* reason) {
  keyboard_.ReleaseRemotePressedKeys(remote_id, reason);
-#ifdef _WIN32
-  devices_.ReleaseRemoteMouseButtons();
-#endif
  {
    std::lock_guard lock(remote_pointer_input_mutex_);
    last_remote_pointer_input_time_.erase(remote_id);
@@ -164,10 +151,6 @@ void GuiRuntime::HandleServerControllerDisconnected(
    return;
  }

-  LOG_INFO("Last remote controller disconnected; recovering privacy, reason={}",
-           reason ? reason : "unknown");
-  privacy_.Disconnected();
-
  need_to_create_server_window_.store(false, std::memory_order_release);
  need_to_destroy_server_window_.store(true, std::memory_order_release);
  is_server_mode_ = false;
@@ -8,7 +8,6 @@
 #define _GUI_RUNTIME_H_

 #include <atomic>
-#include <deque>
 #include <memory>
 #include <string>

@@ -17,7 +16,6 @@
 #include "features/file_transfer/file_transfer_manager.h"
 #include "features/input/keyboard_controller.h"
 #include "features/settings/settings_manager.h"
-#include "privacy_controller.h"
 #include "runtime/gui_state.h"
 #include "runtime/peer_event_handler.h"

@@ -57,13 +55,9 @@ class GuiRuntime : protected gui_detail::GuiState {
  void HandleConnectionStatusChange();
  void HandlePendingPresenceProbe();
  void HandlePresenceProbeTimeout();
-  bool HasActiveSession();
  void HandleServerControllerDisconnected(const std::string& remote_id,
                                          const char* reason);
  void HandleWindowsServiceIntegration();
-  void HandlePrivacy();
-  bool IsAuthorizedController(const std::string& remote_id);
-  void QueuePrivacyCommand(const std::string& remote_id, const PrivacyCommand& command);

  void CloseRemoteSession(std::shared_ptr<RemoteSession> props);
  void CloseAllRemoteSessions();
@@ -93,11 +87,6 @@ class GuiRuntime : protected gui_detail::GuiState {
  bool EnsureMacAccessibilityPermission();
 #endif

-  PrivacyController privacy_;
-  std::mutex privacy_commands_mutex_;
-  std::deque<std::pair<std::string, PrivacyCommand>> privacy_commands_;
-  uint32_t last_privacy_revision_ = 0;
-  uint64_t last_privacy_status_tick_ = 0;
  ClipboardController clipboard_;
  SessionDeviceManager devices_;
  FileTransferManager transfers_;
@@ -147,46 +147,6 @@ void PeerEventHandler::OnReceiveDataBuffer(
  }

  std::string remote_id(user_id, user_id_size);
-  if (remote_action.type == ControlType::privacy_status) {
-    if (auto props = runtime->FindRemoteSession(remote_id)) {
-      if (source_id != props->control_data_label_) return;
-      std::lock_guard lock(props->privacy_status_mutex_);
-      if (!props->privacy_status_received_ ||
-          static_cast<int32_t>(remote_action.ps.revision - props->privacy_status_.revision) >= 0) {
-        props->privacy_status_ = remote_action.ps;
-        props->privacy_status_received_ = true;
-        props->privacy_status_tick_ = SDL_GetTicks();
-        if (static_cast<int32_t>(remote_action.ps.revision - props->privacy_request_revision_) > 0 &&
-            remote_action.ps.state != PrivacyState::starting &&
-            remote_action.ps.state != PrivacyState::stopping)
-          props->privacy_command_pending_ = false;
-      }
-    }
-    return;
-  }
-  if (remote_action.type == ControlType::privacy_command) {
-    if (source_id == runtime->control_data_label_)
-      runtime->QueuePrivacyCommand(remote_id, remote_action.pc);
-    return;
-  }
-  const bool operates_host = remote_action.type == ControlType::mouse ||
-      remote_action.type == ControlType::keyboard || remote_action.type == ControlType::keyboard_state ||
-      remote_action.type == ControlType::service_command || remote_action.type == ControlType::display_id ||
-      remote_action.type == ControlType::audio_capture;
-  if (operates_host) {
-    if (!runtime->IsAuthorizedController(remote_id)) return;
-#ifdef _WIN32
-    // KeyboardController checks the desktop immediately before each native
-    // key injection, including state reconciliation and cleanup. Avoid a
-    // second synchronous session query for every received keyboard packet.
-    const bool keyboard_input = remote_action.type == ControlType::keyboard ||
-                                remote_action.type == ControlType::keyboard_state;
-    if (!keyboard_input && runtime->privacy_.Engaged() &&
-        !IsWindowsPrivacyDesktopAvailable()) {
-      runtime->privacy_.Fail("Secure desktop or lock screen; privacy screen will turn off");
-    }
-#endif
-  }
  if (remote_action.type == ControlType::service_status) {
    if (auto props = runtime->FindRemoteSession(remote_id)) {
      runtime->ApplyRemoteServiceStatus(*props, remote_action.ss);
@@ -195,9 +155,6 @@ void PeerEventHandler::OnReceiveDataBuffer(
  }

  if (remote_action.type == ControlType::service_command) {
-    if (runtime->privacy_.Engaged()) {
-      runtime->privacy_.Fail("Security shortcut requested; privacy screen will turn off");
-    }
 #if _WIN32
    if (remote_action.c.flag == ServiceCommandFlag::send_sas) {
      runtime->pending_windows_service_sas_.store(true,
@@ -405,20 +405,6 @@ void PeerEventHandler::OnConnectionStatus(ConnectionStatus status,
    runtime->show_connection_status_window_ = true;
    {
      std::unique_lock lock(runtime->connection_status_mutex_);
-#if defined(_WIN32) || defined(__APPLE__) || defined(__linux__)
-      if (status == ConnectionStatus::Connected &&
-          runtime->config_center_->IsEnablePrivacyScreen() &&
-          std::none_of(runtime->connection_status_.begin(),
-                       runtime->connection_status_.end(), [](const auto& entry) {
-                         return entry.second == ConnectionStatus::Connected;
-                       })) {
-        // Request optional privacy without delaying connection or capture.
-        // Only the first controller takes over local input. A later join must
-        // not release an existing controller's keys or re-enable privacy that
-        // the current session explicitly turned off.
-        runtime->privacy_.EnableOnConnection();
-      }
-#endif
      runtime->connection_status_[remote_id] = status;
    }

@@ -1,53 +0,0 @@
-/*
- * @Author: DI JUNKUN
- * @Date: 2026-09-12
- * Copyright (c) 2026 by DI JUNKUN, All Rights Reserved.
- */
-
-#ifndef _PRIVACY_CONTROL_STATE_H_
-#define _PRIVACY_CONTROL_STATE_H_
-
-#include <cstdint>
-
-#include "remote_action.h"
-
-namespace crossdesk {
-
-struct PrivacyControlState {
-  bool active = false;
-  bool enabled = false;
-  bool off = false;
-  bool unsupported = false;
-  bool can_toggle = false;
-};
-
-// Use the same host-confirmed state for presentation and command admission.
-// Missing confirmation or a failure makes only this toolbar control unavailable.
-inline PrivacyControlState GetPrivacyControlState(
-    const PrivacyStatus& status, bool received, bool command_pending,
-    uint64_t status_age_ms, uint64_t command_age_ms) {
-  PrivacyControlState result;
-  const bool timeout = command_pending && command_age_ms > 15000;
-  result.unsupported = timeout ||
-      (received && (status_age_ms > 5000 || !status.supported ||
-                    status.state == PrivacyState::failed));
-  if (result.unsupported) return result;
-
-  result.active = status.overlay_active || status.remote_paused ||
-                  status.state == PrivacyState::on ||
-                  status.state == PrivacyState::starting ||
-                  status.state == PrivacyState::stopping ||
-                  status.state == PrivacyState::failed;
-  // A command in flight only gates repeated clicks; it adds no display state.
-  result.enabled = received &&
-                   status.state == PrivacyState::on && status.overlay_active &&
-                   !status.remote_paused;
-  result.off = received &&
-               status.state == PrivacyState::off && !result.active;
-  result.can_toggle = !command_pending && (result.active || received);
-  return result;
-}
-
-}  // namespace crossdesk
-
-#endif
@@ -1,78 +0,0 @@
-/*
- * @Author: DI JUNKUN
- * @Date: 2026-09-11
- * Copyright (c) 2026 by DI JUNKUN, All Rights Reserved.
- */
-
-#include <shared_mutex>
-
-#include "rd_log.h"
-#include "runtime/gui_runtime.h"
-
-namespace crossdesk {
-
-bool GuiRuntime::IsAuthorizedController(const std::string& remote_id) {
-  // Connections appear here only after the existing password/signalling/RTC
-  // admission path. Outgoing/viewer sessions live in remote_sessions_ instead.
-  std::shared_lock lock(connection_status_mutex_);
-  const auto found = connection_status_.find(remote_id);
-  return found != connection_status_.end() &&
-         found->second == ConnectionStatus::Connected;
-}
-
-void GuiRuntime::QueuePrivacyCommand(const std::string& remote_id,
-                                     const PrivacyCommand& command) {
-  if (!IsAuthorizedController(remote_id)) return;
-  std::lock_guard lock(privacy_commands_mutex_);
-  if (privacy_commands_.size() < 32)
-    privacy_commands_.emplace_back(remote_id, command);
-}
-
-void GuiRuntime::HandlePrivacy() {
-  std::deque<std::pair<std::string, PrivacyCommand>> commands;
-  {
-    std::lock_guard lock(privacy_commands_mutex_);
-    commands.swap(privacy_commands_);
-  }
-  for (const auto& [remote_id, command] : commands) {
-    if (!IsAuthorizedController(remote_id)) continue;
-    if (command.flag == PrivacyCommandFlag::enable) {
-      privacy_.Enable(command.block_local_input);
-    } else if (command.flag == PrivacyCommandFlag::disable) {
-      privacy_.Disable();
-    }
-    last_privacy_status_tick_ = 0;
-  }
-  const auto status = privacy_.Snapshot();
-  const uint64_t now = SDL_GetTicks();
-  if (!peer_ || (last_privacy_status_tick_ != 0 &&
-                 status.revision == last_privacy_revision_ &&
-                 now - last_privacy_status_tick_ < 1000))
-    return;
-  std::vector<std::string> controllers;
-  {
-    std::shared_lock lock(connection_status_mutex_);
-    for (const auto& [id, state] : connection_status_)
-      if (state == ConnectionStatus::Connected) controllers.push_back(id);
-  }
-  RemoteAction action{};
-  action.type = ControlType::privacy_status;
-  action.ps = status;
-  const auto message = action.to_json();
-  bool sent = true;
-  for (const auto& id : controllers) {
-    const int result = SendReliableDataFrameToPeer(
-        peer_, message.data(), message.size(), control_data_label_.c_str(),
-        id.data(), id.size());
-    if (result != 0) {
-      sent = false;
-      LOG_WARN("Privacy status send failed, peer={}, ret={}", id, result);
-    }
-  }
-  if (sent) {
-    last_privacy_revision_ = status.revision;
-    last_privacy_status_tick_ = now;
-  }
-}
-
-}  // namespace crossdesk
@@ -157,13 +157,6 @@ struct RemoteSession {
  std::string audio_capture_button_label_ = "Audio Capture";
  std::string remote_host_name_;
  bool remote_service_status_received_ = false;
-  std::mutex privacy_status_mutex_;
-  PrivacyStatus privacy_status_{};
-  bool privacy_status_received_ = false;
-  bool privacy_command_pending_ = false;
-  uint64_t privacy_command_tick_ = 0;
-  uint32_t privacy_request_revision_ = 0;
-  uint64_t privacy_status_tick_ = 0;
  bool remote_service_available_ = false;
  std::string remote_interactive_stage_;
  std::vector<DisplayInfo> display_info_list_;
@@ -191,4 +184,4 @@ using RemoteSessionPtr = std::shared_ptr<RemoteSession>;

 }  // namespace crossdesk::gui_detail

-#endif
+#endif
@@ -45,7 +45,6 @@ export global FontAwesomeIcons {
    out property <string> shield-halved: "\u{f3ed}";
    out property <string> square-full: "\u{f45c}";
    out property <string> trash-can: "\u{f2ed}";
-    out property <string> user-secret: "\u{f21b}";
    out property <string> volume-high: "\u{f028}";
    out property <string> volume-xmark: "\u{f6a9}";
    out property <string> xmark: "\u{f00d}";
@@ -39,8 +39,6 @@ export global UiStrings {
    in-out property <string> language: "Language";
    in-out property <string> video-quality: "Video quality";
    in-out property <string> frame-rate: "Frame rate";
-    in-out property <string> capture-method: "Capture method";
-    in-out property <string> capture-method-auto: "Auto";
    in-out property <string> adaptation-policy: "Video preference";
    in-out property <string> priority-frame-rate: "Frame rate";
    in-out property <string> priority-quality: "Quality";
@@ -52,7 +50,6 @@ export global UiStrings {
    in-out property <string> self-hosted: "Self-hosted server";
    in-out property <string> autostart: "Start with system";
    in-out property <string> daemon: "Run in background";
-    in-out property <string> privacy-on-connect: "Privacy screen on connect";
    in-out property <string> file-save-path: "File save path";
    in-out property <string> default-desktop: "Desktop";
    in-out property <string> server-host: "Server host";
@@ -213,6 +210,11 @@ export component MainWindow inherits Window {
    in property <bool> signal-tls-error: false;
    in property <[RecentConnection]> recent-connections;
    in property <bool> update-available: false;
+    in property <bool> update-downloading: false;
+    in property <bool> update-failed: false;
+    in property <bool> update-security-blocked: false;
+    in property <float> update-progress: 0;
+    in property <string> update-status: "";
    in property <string> current-version: "";
    in property <string> latest-version: "";
    in property <string> release-name: "";
@@ -241,8 +243,6 @@ export component MainWindow inherits Window {
    in-out property <int> language-index: 0;
    in-out property <int> video-quality-index: 2;
    in-out property <int> frame-rate-index: 1;
-    in property <bool> capture-method-visible: false;
-    in-out property <int> capture-method-index: 0;
    in-out property <int> adaptation-policy-index: 1;
    in-out property <int> codec-index: 0;
    in-out property <bool> hardware-codec-enabled: true;
@@ -251,9 +251,6 @@ export component MainWindow inherits Window {
    in-out property <bool> self-hosted-enabled: false;
    in-out property <bool> autostart-enabled: false;
    in-out property <bool> daemon-enabled: false;
-    // Show the preference on every platform; only adapted hosts can change it.
-    in property <bool> privacy-setting-available: false;
-    in-out property <bool> privacy-on-connect-enabled: true;
    in-out property <string> file-save-path: "";
    in-out property <string> server-host: "";
    in-out property <string> server-port: "";
@@ -276,6 +273,8 @@ export component MainWindow inherits Window {
    callback cancel-self-hosted-settings;
    callback browse-save-path;
    callback open-download;
+    callback start-update;
+    callback cancel-update;
    callback connection-cancel;
    callback connection-acknowledge;
    callback connection-submit-password(string, bool);
@@ -1453,11 +1452,6 @@ export component MainWindow inherits Window {
                        Text { x: 8px; y: 3px; width: root.compact-language ? 94px : 162px; height: 24px; text: UiStrings.language; font-size: ImGuiFontStyle.body; overflow: elide; vertical-alignment: center; }
                        CompactComboBox { x: root.compact-language ? 106px : 174px; y: 2px; model: ["中文", "English", "Русский"]; current-index <=> root.language-index; }
                    }
-                    if root.capture-method-visible: Rectangle {
-                        height: 30px;
-                        Text { x: 8px; y: 3px; width: root.compact-language ? 94px : 162px; height: 24px; text: UiStrings.capture-method; font-size: ImGuiFontStyle.body; overflow: elide; vertical-alignment: center; }
-                        CompactComboBox { x: root.compact-language ? 106px : 174px; y: 2px; enabled: !root.settings-session-active; model: [UiStrings.capture-method-auto, "DXGI", "WGC", "GDI"]; current-index <=> root.capture-method-index; }
-                    }
                    Rectangle {
                        height: 30px;
                        Text { x: 8px; y: 3px; width: root.compact-language ? 94px : 162px; height: 24px; text: UiStrings.video-quality; font-size: ImGuiFontStyle.body; overflow: elide; vertical-alignment: center; }
@@ -1493,11 +1487,6 @@ export component MainWindow inherits Window {
                        Text { x: 8px; y: 3px; width: root.compact-language ? 145px : 212px; height: 24px; text: UiStrings.srtp; font-size: ImGuiFontStyle.body; overflow: elide; vertical-alignment: center; }
                        ImGuiCheckBox { x: root.compact-language ? 157px : 224px; y: 3px; checked <=> root.srtp-enabled; enabled: !root.settings-session-active; }
                    }
-                    Rectangle {
-                        height: 30px;
-                        Text { x: 8px; y: 3px; width: root.compact-language ? 145px : 212px; height: 24px; text: UiStrings.privacy-on-connect; color: root.privacy-setting-available ? #202124 : #8b8f95; font-size: ImGuiFontStyle.body; overflow: elide; vertical-alignment: center; }
-                        ImGuiCheckBox { x: root.compact-language ? 157px : 224px; y: 3px; checked <=> root.privacy-on-connect-enabled; enabled: root.privacy-setting-available; }
-                    }
                    Rectangle {
                        height: 30px;
                        CompactButton { x: 8px; y: 3px; width: root.compact-language ? 70px : 206px; text: UiStrings.self-hosted; enabled: !root.settings-session-active; clicked => { root.self-host-settings-open = true; } }
@@ -1662,7 +1651,7 @@ export component MainWindow inherits Window {
                x: 30px;
                y: 105px;
                width: 360px;
-                height: 190px;
+                height: root.update-status != "" ? 136px : 190px;
                background: white;
                border-width: 1px;
                border-color: #b9bdc3;
@@ -1689,8 +1678,27 @@ export component MainWindow inherits Window {
                    }
                }
            }
-            CompactButton { x: root.compact-language ? 163px : 130px; y: 309px; width: root.compact-language ? 34px : 70px; primary: true; text: UiStrings.download; clicked => { root.open-download(); root.update-open = false; } }
-            CompactButton { x: root.compact-language ? 204px : 207px; y: 309px; width: root.compact-language ? 34px : 56px; text: UiStrings.later; clicked => { root.update-open = false; } }
+            if root.update-status != "": Text {
+                x: 30px; y: 247px; width: 340px; height: 40px;
+                text: root.update-status;
+                color: root.update-failed ? #b23b3b : #3d434d;
+                font-size: ImGuiFontStyle.body;
+                wrap: word-wrap;
+                vertical-alignment: center;
+            }
+            if root.update-downloading: Rectangle {
+                x: 30px; y: 291px; width: 340px; height: 4px;
+                background: #e2e4e7;
+                clip: true;
+                Rectangle {
+                    x: root.update-progress < 0 ? (parent.width + self.width) * (mod(animation-tick(), 1500ms) / 1500ms) - self.width : 0px;
+                    width: parent.width * (root.update-progress < 0 ? 0.25 : root.update-progress);
+                    height: parent.height;
+                    background: #334fd1;
+                }
+            }
+            CompactButton { x: root.compact-language ? 163px : 130px; y: 309px; width: root.compact-language ? 34px : 70px; primary: true; text: UiStrings.download; enabled: !root.update-downloading && !root.update-security-blocked; clicked => { root.start-update(); } }
+            CompactButton { x: root.compact-language ? 204px : 207px; y: 309px; width: root.compact-language ? 34px : 56px; text: UiStrings.later; clicked => { root.cancel-update(); } }
        }
    }

@@ -25,8 +25,6 @@ export struct NetworkStatsRow {
 export global StreamStrings {
    in-out property <string> select-display: "Select Display";
    in-out property <string> send-shortcut: "Send Shortcut";
-    in-out property <string> privacy-enable: "Enable privacy screen";
-    in-out property <string> privacy-disable: "Turn privacy off / recover";
    in-out property <string> control-mouse: "Control Mouse";
    in-out property <string> release-mouse: "Release Mouse";
    in-out property <string> audio: "Audio Capture";
@@ -47,11 +45,6 @@ export global StreamStrings {
    in-out property <string> stats-connection-mode: "Mode";
 }

-struct ControlBarTooltip {
-    text: string,
-    anchor-x: length,
-}
-
 // The legacy ImGui control bar uses 24px buttons with Font Awesome rendered
 // at half of the 32px atlas size.  Keep this local to the stream window: the
 // shared IconButton is intentionally larger and is used by the other windows.
@@ -61,27 +54,19 @@ component ControlBarButton inherits Rectangle {
    in property <string> tooltip: "";
    in property <bool> selected: false;
    in property <bool> slashed: false;
-    in property <bool> action-enabled: true;
-    // Capability and temporary command availability have different visuals.
-    in property <bool> muted: false;
    in property <length> icon-size: 16px;
-    out property <bool> has-hover: touch.has-hover;
-    out property <ControlBarTooltip> tooltip-info: {
-        text: root.visible && touch.has-hover && !touch.pressed ? root.tooltip : "",
-        anchor-x: root.x + root.width / 2,
-    };
    callback clicked;

    width: 24px;
    height: 24px;
-    background: root.muted ? #eef0f3 : touch.pressed && root.action-enabled ? #0f87fa
+    background: touch.pressed ? #0f87fa
                              : touch.has-hover ? #4296fa
                                                : root.selected ? #4296fa : #4296fa66;
    border-radius: 3px;

    Text {
        text: root.icon;
-        color: root.muted ? #8a8f96 : #24272d;
+        color: #24272d;
        font-family: "Font Awesome 6 Free";
        font-weight: 900;
        font-size: root.icon-size;
@@ -120,8 +105,7 @@ component ControlBarButton inherits Rectangle {
    }

    touch := TouchArea {
-        // Keep disabled controls hit-testable so clicks cannot reach the peer.
-        clicked => { if root.action-enabled { root.clicked(); } }
+        clicked => { root.clicked(); }
    }
 }

@@ -150,12 +134,6 @@ export component StreamWindow inherits Window {
    in property <[string]> displays;
    in-out property <int> selected-display: 0;
    in property <bool> mouse-control-enabled: true;
-    in property <bool> privacy-can-toggle: false;
-    in property <bool> privacy-active: false;
-    in property <bool> privacy-off: false;
-    in property <bool> privacy-unsupported: false;
-    // Privacy feedback stays on its toolbar button and hover tooltip.
-    in property <string> privacy-status-text: "Privacy screen";
    // Numeric values mirror crossdesk::RemoteCursorShape and Slint's MouseCursor.
    in property <bool> remote-cursor-active: false;
    in property <int> remote-cursor-shape: 0;
@@ -176,7 +154,6 @@ export component StreamWindow inherits Window {
    callback switch-display(int);
    callback send-shortcut(string);
    callback toggle-mouse-control;
-    callback toggle-privacy;
    callback toggle-audio;
    callback select-file;
    callback close-file-transfer;
@@ -199,25 +176,6 @@ export component StreamWindow inherits Window {
    private property <bool> display-menu-animation-enabled: false;
    private property <float> display-menu-progress: 0.0;
    private property <bool> shortcut-menu-open: false;
-    private property <bool> control-tooltip-visible: false;
-    private property <ControlBarTooltip> hovered-control: {
-        if root.window-active && !root.control-dragging
-            && !root.display-menu-open && !root.shortcut-menu-open {
-            if collapse-button.has-hover { return collapse-button.tooltip-info; }
-            if root.control-expanded {
-                if display-button.has-hover { return display-button.tooltip-info; }
-                if shortcut-button.has-hover { return shortcut-button.tooltip-info; }
-                if mouse-button.has-hover { return mouse-button.tooltip-info; }
-                if privacy-button.has-hover { return privacy-button.tooltip-info; }
-                if audio-button.has-hover { return audio-button.tooltip-info; }
-                if file-button.has-hover { return file-button.tooltip-info; }
-                if stats-button.has-hover { return stats-button.tooltip-info; }
-                if fullscreen-button.has-hover { return fullscreen-button.tooltip-info; }
-                if close-button.has-hover { return close-button.tooltip-info; }
-            }
-        }
-        return { text: "", anchor-x: 0px };
-    }
    // A popup can remove itself from the scene in its clicked callback before
    // the video input layer observes the same pointer release. Remember that
    // the press belonged to local UI so that release cannot reach the peer.
@@ -257,20 +215,6 @@ export component StreamWindow inherits Window {
        }
    }

-    changed hovered-control => {
-        root.control-tooltip-visible = false;
-        control-tooltip-timer.running = root.hovered-control.text != "";
-        if root.hovered-control.text != "" { control-tooltip-timer.restart(); }
-    }
-    control-tooltip-timer := Timer {
-        interval: 450ms;
-        running: false;
-        triggered => {
-            self.running = false;
-            root.control-tooltip-visible = true;
-        }
-    }
-
    is-local-control-area(pointer-x, pointer-y) => {
        let over-control = pointer-x >= control.x
            && pointer-x <= control.x + control.width
@@ -288,7 +232,7 @@ export component StreamWindow inherits Window {
        let shortcut-menu-y = control.y + 40px;
        let over-shortcut-menu = root.shortcut-menu-open
            && pointer-x >= shortcut-menu-x
-            && pointer-x <= shortcut-menu-x + 180px
+            && pointer-x <= shortcut-menu-x + 150px
            && pointer-y >= shortcut-menu-y
            && pointer-y <= shortcut-menu-y + 68px;
        return over-control || over-display-menu || over-shortcut-menu;
@@ -695,7 +639,7 @@ export component StreamWindow inherits Window {
            control := Rectangle {
                x: root.control-dragging ? root.control-drag-x : root.control-docked-left ? 0px : parent.width - self.width;
                y: min(max(0px, root.control-pos-y), parent.height - self.height);
-                width: root.control-expanded ? min(332px, parent.width) : 20px;
+                width: root.control-expanded ? min(300px, parent.width) : 20px;
                height: root.stats-visible && root.control-expanded ? min(180px, parent.height) : 38px;
                background: white;
                border-width: 1px;
@@ -713,8 +657,7 @@ export component StreamWindow inherits Window {
                    background: ImGuiLineStyle.control-separator;
                }

-                display-button := ControlBarButton {
-                    visible: root.control-expanded;
+                if root.control-expanded: display-button := ControlBarButton {
                    x: root.control-docked-left ? 9px : 42px; y: 7px;
                    icon: FontAwesomeIcons.display;
                    badge: root.selected-display + 1;
@@ -730,8 +673,7 @@ export component StreamWindow inherits Window {
                        }
                    }
                }
-                shortcut-button := ControlBarButton {
-                    visible: root.control-expanded;
+                if root.control-expanded: shortcut-button := ControlBarButton {
                    x: root.control-docked-left ? 41px : 74px; y: 7px;
                    icon: FontAwesomeIcons.keyboard; tooltip: StreamStrings.send-shortcut;
                    clicked => {
@@ -742,53 +684,47 @@ export component StreamWindow inherits Window {
                        root.display-menu-open = false;
                    }
                }
-                mouse-button := ControlBarButton {
-                    visible: root.control-expanded;
+                if root.control-expanded: mouse-button := ControlBarButton {
                    x: root.control-docked-left ? 73px : 106px; y: 7px;
                    icon: FontAwesomeIcons.computer-mouse; slashed: !root.mouse-control-enabled;
                    tooltip: root.mouse-control-enabled ? StreamStrings.release-mouse : StreamStrings.control-mouse;
                    clicked => { root.toggle-mouse-control(); }
                }
-                audio-button := ControlBarButton {
-                    visible: root.control-expanded;
-                    x: root.control-docked-left ? 137px : 170px; y: 7px;
+                if root.control-expanded: audio-button := ControlBarButton {
+                    x: root.control-docked-left ? 105px : 138px; y: 7px;
                    icon: FontAwesomeIcons.volume-high; slashed: !root.audio-enabled;
                    tooltip: root.audio-enabled ? StreamStrings.mute : StreamStrings.audio;
                    clicked => { root.toggle-audio(); }
                }
-                file-button := ControlBarButton {
-                    visible: root.control-expanded;
-                    x: root.control-docked-left ? 169px : 202px; y: 7px;
+                if root.control-expanded: file-button := ControlBarButton {
+                    x: root.control-docked-left ? 137px : 170px; y: 7px;
                    icon: FontAwesomeIcons.folder-open; tooltip: StreamStrings.select-file;
                    clicked => { root.select-file(); }
                }
-                stats-button := ControlBarButton {
-                    visible: root.control-expanded;
-                    x: root.control-docked-left ? 201px : 234px; y: 7px;
+                if root.control-expanded: stats-button := ControlBarButton {
+                    x: root.control-docked-left ? 169px : 202px; y: 7px;
                    icon: FontAwesomeIcons.signal; selected: root.stats-visible;
                    tooltip: root.stats-visible ? StreamStrings.hide-stats : StreamStrings.show-stats;
                    clicked => { root.toggle-stats(); }
                }
-                fullscreen-button := ControlBarButton {
-                    visible: root.control-expanded;
-                    x: root.control-docked-left ? 233px : 266px; y: 7px;
+                if root.control-expanded: fullscreen-button := ControlBarButton {
+                    x: root.control-docked-left ? 201px : 234px; y: 7px;
                    icon: root.fullscreen-enabled ? FontAwesomeIcons.compress : FontAwesomeIcons.expand;
                    tooltip: root.fullscreen-enabled ? StreamStrings.exit-fullscreen : StreamStrings.fullscreen;
                    clicked => { root.toggle-fullscreen(); }
                }
-                close-button := ControlBarButton {
-                    visible: root.control-expanded;
-                    x: root.control-docked-left ? 265px : 298px; y: 7px;
+                if root.control-expanded: close-button := ControlBarButton {
+                    x: root.control-docked-left ? 233px : 266px; y: 7px;
                    icon: FontAwesomeIcons.xmark; tooltip: StreamStrings.disconnect;
                    clicked => { root.disconnect(); }
                }

                if root.control-expanded && root.control-docked-left: Rectangle {
-                    x: 299px; y: 12px; width: 2px; height: 15px;
+                    x: 267px; y: 12px; width: 2px; height: 15px;
                    background: ImGuiLineStyle.control-separator;
                }
                collapse-button := ControlBarButton {
-                    x: root.control-expanded ? (root.control-docked-left ? 307px : 10px) : 2px;
+                    x: root.control-expanded ? (root.control-docked-left ? 275px : 10px) : 2px;
                    y: 7px;
                    width: 15px;
                    icon: root.control-expanded
@@ -798,19 +734,6 @@ export component StreamWindow inherits Window {
                    clicked => { root.control-expanded = !root.control-expanded; }
                }

-                privacy-button := ControlBarButton {
-                    visible: root.control-expanded;
-                    x: root.control-docked-left ? 105px : 138px; y: 7px;
-                    icon: FontAwesomeIcons.user-secret;
-                    slashed: root.privacy-off && !root.privacy-unsupported;
-                    muted: root.privacy-unsupported;
-                    action-enabled: root.privacy-can-toggle;
-                    tooltip: root.privacy-status-text
-                        + (root.privacy-can-toggle ? "\n" + (root.privacy-active
-                            ? StreamStrings.privacy-disable : StreamStrings.privacy-enable) : "");
-                    clicked => { root.toggle-privacy(); }
-                }
-
                if root.stats-visible && root.control-expanded: stats-table := Rectangle {
                    x: 14px;
                    y: 38px;
@@ -1020,7 +943,7 @@ export component StreamWindow inherits Window {
            }

            if root.shortcut-menu-open: Rectangle {
-                x: control.x + (root.control-docked-left ? 41px : 74px); y: control.y + 40px; width: 180px; height: 68px;
+                x: control.x + (root.control-docked-left ? 41px : 74px); y: control.y + 40px; width: 150px; height: 68px;
                background: white; border-width: 1px; border-color: ImGuiLineStyle.border; border-radius: 5px; z: 11;
                VerticalLayout {
                    padding: 4px; spacing: 1px;
@@ -1039,29 +962,6 @@ export component StreamWindow inherits Window {
                }
            }

-            // Measure unwrapped text so short hints stay compact. Render outside
-            // the clipped control bar, capping longer hints before wrapping.
-            control-tooltip-width-probe := Text {
-                visible: false;
-                text: root.hovered-control.text;
-                font-size: ImGuiFontStyle.body;
-            }
-            if root.hovered-control.text != "" && root.control-tooltip-visible: Rectangle {
-                width: min(240px, video.width - 8px,
-                    control-tooltip-width-probe.preferred-width + 16px);
-                x: min(max(4px, control.x + root.hovered-control.anchor-x - self.width / 2),
-                    video.width - self.width - 4px);
-                height: control-tip.preferred-height + 12px;
-                y: control.y + control.height + self.height + 8px <= video.height
-                    ? control.y + control.height + 4px : max(4px, control.y - self.height - 4px);
-                background: #30343bf5; border-radius: 5px; z: 12;
-                control-tip := Text {
-                    x: 8px; y: 6px; width: parent.width - 16px;
-                    text: root.hovered-control.text;
-                    color: white; font-size: ImGuiFontStyle.body; wrap: word-wrap;
-                }
-            }
-
            // Transfer progress overlay at bottom-left.
            if root.file-transfer-visible: Rectangle {
                x: 18px; y: parent.height - min(210px, parent.height * 0.35); width: min(430px, parent.width * 0.6); height: min(190px, parent.height * 0.32);
@@ -54,9 +54,6 @@ inline int ApplyMainWindowStrings(
  strings.set_language(Text(localization::language[language]));
  strings.set_video_quality(Text(localization::video_quality[language]));
  strings.set_frame_rate(Text(localization::video_frame_rate[language]));
-  strings.set_capture_method(Text(localization::screen_capture_method[language]));
-  strings.set_capture_method_auto(
-      Text(localization::screen_capture_method_auto[language]));
  strings.set_adaptation_policy(
      Text(localization::video_adaptation_policy[language]));
  strings.set_priority_frame_rate(
@@ -74,7 +71,6 @@ inline int ApplyMainWindowStrings(
      Text(localization::self_hosted_server_config[language]));
  strings.set_autostart(Text(localization::enable_autostart[language]));
  strings.set_daemon(Text(localization::enable_daemon[language]));
-  strings.set_privacy_on_connect(Text(localization::privacy_on_connect[language]));
  strings.set_file_save_path(
      Text(localization::file_transfer_save_path[language]));
  strings.set_default_desktop(Text(localization::default_desktop[language]));
@@ -142,8 +138,6 @@ inline int ApplyStreamWindowStrings(
  auto& strings = window->template global<ui::StreamStrings>();
  strings.set_select_display(Text(localization::select_display[language]));
  strings.set_send_shortcut(Text(localization::send_shortcut[language]));
-  strings.set_privacy_enable(Text(localization::privacy_enable[language]));
-  strings.set_privacy_disable(Text(localization::privacy_disable[language]));
  strings.set_control_mouse(Text(localization::control_mouse[language]));
  strings.set_release_mouse(Text(localization::release_mouse[language]));
  strings.set_audio(Text(localization::audio_capture[language]));
@@ -173,4 +167,4 @@ inline int ApplyStreamWindowStrings(
 }  // namespace crossdesk::ui_localization


-#endif
+#endif
@@ -3,13 +3,6 @@
 namespace crossdesk {

 void GuiRuntime::ResetRemoteServiceStatus(RemoteSession& props) {
-  {
-    std::lock_guard lock(props.privacy_status_mutex_);
-    props.privacy_status_ = {};
-    props.privacy_status_received_ = false;
-    props.privacy_command_pending_ = false;
-    props.privacy_status_tick_ = 0;
-  }
  props.remote_service_status_received_ = false;
  props.remote_service_available_ = false;
  props.remote_interactive_stage_.clear();
@@ -1,244 +0,0 @@
-/*
- * @Author: DI JUNKUN
- * @Date: 2026-09-13
- * Copyright (c) 2026 by DI JUNKUN, All Rights Reserved.
- */
-
-#ifndef _PRIVACY_BACKEND_LINUX_H_
-#define _PRIVACY_BACKEND_LINUX_H_
-
-#include <poll.h>
-#include <spawn.h>
-#include <sys/eventfd.h>
-#include <sys/socket.h>
-#include <sys/wait.h>
-#include <unistd.h>
-
-#include <algorithm>
-#include <cerrno>
-#include <chrono>
-#include <cstring>
-#include <thread>
-
-#include "privacy_backend.h"
-#include "privacy_guard.h"
-
-extern char** environ;
-
-namespace crossdesk {
-namespace {
-using Clock = std::chrono::steady_clock;
-
-class LinuxPrivacyBackend final : public PrivacyBackend {
- public:
-  LinuxPrivacyBackend() : wake_(eventfd(0, EFD_CLOEXEC | EFD_NONBLOCK)) {}
-  ~LinuxPrivacyBackend() override {
-    // EOF also recovers after a crash, SIGKILL, or a normal shutdown. Never
-    // terminate the guard: it must finish restoring the saved display ramps.
-    if (socket_ >= 0) close(socket_);
-    if (wake_ >= 0) close(wake_);
-    if (child_ > 0) {
-      const pid_t child = child_;
-      std::thread([child] {
-        while (waitpid(child, nullptr, 0) < 0 && errno == EINTR) {
-        }
-      }).detach();
-    }
-  }
-
-  PrivacyCapabilities Query() override {
-    if (wake_ < 0)
-      return {false, false, "Cannot create Linux privacy wake event"};
-    if (!StartGuard()) return {false, false, failure_};
-    if (!Send(LinuxPrivacyCommand::query)) return {false, false, failure_};
-    // The first query also serves automatic privacy on the first connection.
-    // Bound process startup so an unavailable helper cannot stall the GUI.
-    if (!discovered_) {
-      pollfd fd{socket_, POLLIN, 0};
-      poll(&fd, 1, 1000);
-    }
-    ReadReplies();
-    return {reply_.supported, reply_.input_supported,
-            reply_.capability_reason[0] ? reply_.capability_reason
-                                        : "Checking Linux privacy support"};
-  }
-
-  bool Enable(bool block_input, const PrivacyScreenText&,
-              std::string& error) override {
-    failure_.clear();
-    emergency_ = false;
-    if (!Send(block_input ? LinuxPrivacyCommand::enable_blocking
-                          : LinuxPrivacyCommand::enable)) {
-      error = failure_;
-      return false;
-    }
-    engaged_ = true;
-    ++generation_;
-    last_reply_ = Clock::now();
-    recovered_ = false;
-    reply_.active = false;
-    return true;
-  }
-
-  void Recover() override {
-    ReadReplies();
-    if (recovered_) {
-      failure_.clear();
-      return;
-    }
-    if (recovering_) return;
-    if (Send(LinuxPrivacyCommand::recover)) recovering_ = true;
-  }
-  bool IsRecovered() const override { return recovered_; }
-  bool RecoveryPending() const override { return recovering_; }
-
-  PrivacyHealth Poll() override {
-    ReadReplies();
-    if (engaged_ && Clock::now() - last_reply_ > std::chrono::seconds(1))
-      failure_ = "Linux privacy guard stopped responding";
-    if (engaged_ &&
-        Clock::now() - last_heartbeat_ >= std::chrono::milliseconds(100)) {
-      Send(LinuxPrivacyCommand::heartbeat);
-      last_heartbeat_ = Clock::now();
-    }
-    const bool emergency = emergency_;
-    emergency_ = false;
-    return {failure_, emergency, reply_.active};
-  }
-
-  void WaitForEvents(unsigned timeout_ms) override {
-    pollfd fds[] = {{wake_, POLLIN, 0}, {socket_, POLLIN, 0}};
-    poll(fds, 2, static_cast<int>(timeout_ms));
-    uint64_t value;
-    if (fds[0].revents & POLLIN) {
-      while (read(wake_, &value, sizeof(value)) == sizeof(value)) {
-      }
-    }
-  }
-  void Wake() override {
-    const uint64_t value = 1;
-    if (wake_ >= 0) {
-      const auto ignored = write(wake_, &value, sizeof(value));
-      (void)ignored;
-    }
-  }
-
- private:
-  bool StartGuard() {
-    if (socket_ >= 0) return true;
-    if (child_ > 0) {
-      const auto result = waitpid(child_, nullptr, WNOHANG);
-      if (result == 0) return false;
-      child_ = -1;
-    }
-    int sockets[2];
-    if (socketpair(AF_UNIX, SOCK_SEQPACKET | SOCK_CLOEXEC | SOCK_NONBLOCK, 0,
-                   sockets) != 0) {
-      failure_ = "Cannot create Linux privacy guard socket";
-      return false;
-    }
-    posix_spawn_file_actions_t actions;
-    int result = posix_spawn_file_actions_init(&actions);
-    if (result == 0) {
-      // Close the parent end first: it may occupy the guard's destination fd.
-      result = posix_spawn_file_actions_addclose(&actions, sockets[0]);
-      if (result == 0)
-        result = posix_spawn_file_actions_adddup2(&actions, sockets[1],
-                                                  kLinuxPrivacyGuardSocket);
-      if (result == 0 && sockets[1] != kLinuxPrivacyGuardSocket)
-        result = posix_spawn_file_actions_addclose(&actions, sockets[1]);
-      if (result == 0) {
-        char executable[] = "/proc/self/exe";
-        char* args[] = {executable,
-                        const_cast<char*>(kLinuxPrivacyGuardArgument), nullptr};
-        result =
-            posix_spawn(&child_, executable, &actions, nullptr, args, environ);
-      }
-      posix_spawn_file_actions_destroy(&actions);
-    }
-    close(sockets[1]);
-    if (result != 0) {
-      close(sockets[0]);
-      child_ = -1;
-      failure_ = std::string("Cannot start Linux privacy guard: ") +
-                 std::strerror(result);
-      return false;
-    }
-    socket_ = sockets[0];
-    reply_ = {};
-    discovered_ = false;
-    generation_ = 0;
-    failure_.clear();
-    return true;
-  }
-
-  void LostGuard() {
-    if (socket_ >= 0) close(socket_);
-    socket_ = -1;
-    reply_ = {};
-    recovering_ = false;
-    failure_ =
-        "Linux privacy guard disconnected; local protection is unavailable";
-    // Do not claim successful recovery after an unexpected guard failure.
-    // A normal guard reports restoration before closing its socket.
-  }
-  bool Send(LinuxPrivacyCommand command) {
-    if (socket_ < 0) return false;
-    if (send(socket_, &command, sizeof(command), MSG_NOSIGNAL) ==
-        sizeof(command))
-      return true;
-    if (errno != EAGAIN && errno != EWOULDBLOCK && errno != EINTR) LostGuard();
-    return false;
-  }
-  void ReadReplies() {
-    if (socket_ < 0) return;
-    for (;;) {
-      LinuxPrivacyReply next;
-      const auto bytes = recv(socket_, &next, sizeof(next), 0);
-      if (bytes < 0 &&
-          (errno == EAGAIN || errno == EWOULDBLOCK || errno == EINTR))
-        return;
-      if (bytes != sizeof(next)) {
-        LostGuard();
-        return;
-      }
-      next.capability_reason[sizeof(next.capability_reason) - 1] = '\0';
-      next.failure[sizeof(next.failure) - 1] = '\0';
-      discovered_ = true;
-      // Ignore queued capability/heartbeat replies from before this enable.
-      // A matching generation can also acknowledge watchdog-driven recovery.
-      if (next.generation != generation_) continue;
-      reply_ = next;
-      last_reply_ = Clock::now();
-      emergency_ = emergency_ || next.emergency;
-      if (next.failure[0]) failure_ = next.failure;
-      recovered_ = next.recovered;
-      if (next.recovered) {
-        recovering_ = false;
-        engaged_ = false;
-      }
-    }
-  }
-
-  int wake_ = -1;
-  int socket_ = -1;
-  pid_t child_ = -1;
-  LinuxPrivacyReply reply_;
-  uint64_t generation_ = 0;
-  bool engaged_ = false;
-  bool discovered_ = false;
-  bool recovering_ = false;
-  bool recovered_ = true;
-  bool emergency_ = false;
-  std::string failure_;
-  Clock::time_point last_heartbeat_{};
-  Clock::time_point last_reply_{};
-};
-}  // namespace
-
-std::unique_ptr<PrivacyBackend> CreateLinuxPrivacyBackend() {
-  return std::make_unique<LinuxPrivacyBackend>();
-}
-}  // namespace crossdesk
-
-#endif
@@ -1,721 +0,0 @@
-/* Copyright (c) 2026 by DI JUNKUN, All Rights Reserved. */
-#include "privacy_guard.h"
-
-#include <X11/XKBlib.h>
-#include <X11/Xatom.h>
-#include <X11/extensions/XInput.h>
-#include <X11/extensions/XInput2.h>
-#include <X11/extensions/XTest.h>
-#include <X11/extensions/Xfixes.h>
-#include <X11/extensions/Xrandr.h>
-#include <X11/keysym.h>
-#include <fcntl.h>
-#include <poll.h>
-#include <sys/socket.h>
-#include <unistd.h>
-
-#include <algorithm>
-#include <array>
-#include <cerrno>
-#include <chrono>
-#include <csignal>
-#include <cstdlib>
-#include <cstring>
-#include <map>
-#include <memory>
-#include <string>
-#include <tuple>
-#include <vector>
-
-namespace crossdesk {
-namespace {
-using Clock = std::chrono::steady_clock;
-using Gamma = std::unique_ptr<XRRCrtcGamma, decltype(&XRRFreeGamma)>;
-using Resources =
-    std::unique_ptr<XRRScreenResources, decltype(&XRRFreeScreenResources)>;
-using CrtcInfo = std::unique_ptr<XRRCrtcInfo, decltype(&XRRFreeCrtcInfo)>;
-volatile std::sig_atomic_t stopping = 0;
-int x_error = 0;
-
-void StopGuard(int) { stopping = 1; }
-int OnXError(Display*, XErrorEvent* event) {
-  x_error = event->error_code;
-  return 0;
-}
-
-template <size_t N>
-void SetText(char (&dest)[N], const std::string& text) {
-  std::strncpy(dest, text.c_str(), N - 1);
-  dest[N - 1] = '\0';
-}
-
-struct Output {
-  Window root = 0;
-  RRCrtc crtc = 0;
-  RRMode mode = 0;
-  int x = 0, y = 0;
-  unsigned width = 0, height = 0;
-  Rotation rotation = 0;
-  std::vector<RROutput> connectors;
-  Gamma saved{nullptr, XRRFreeGamma};
-
-  bool SameLayout(const Output& other) const {
-    return std::tie(root, crtc, mode, x, y, width, height, rotation,
-                    connectors) == std::tie(other.root, other.crtc, other.mode,
-                                            other.x, other.y, other.width,
-                                            other.height, other.rotation,
-                                            other.connectors);
-  }
-};
-
-struct Device {
-  int id = 0, use = 0, attachment = 0;
-  bool keyboard = false, touch = false;
-  std::string name;
-
-  bool operator==(const Device& other) const {
-    return std::tie(id, use, attachment, keyboard, touch, name) ==
-           std::tie(other.id, other.use, other.attachment, other.keyboard,
-                    other.touch, other.name);
-  }
-};
-
-bool IsBlack(const XRRCrtcGamma* gamma) {
-  if (!gamma || gamma->size <= 0) return false;
-  for (int i = 0; i < gamma->size; ++i)
-    if (gamma->red[i] || gamma->green[i] || gamma->blue[i]) return false;
-  return true;
-}
-
-// This class lives only in the exec'd guard process. Its Xlib error handler is
-// isolated from the GUI and capture threads' process-global error handlers.
-class NativePrivacy {
- public:
-  ~NativePrivacy() {
-    Recover();
-    if (display_) XCloseDisplay(display_);
-  }
-
-  void Query() {
-    reply_.supported = reply_.input_supported = false;
-    std::string error;
-    if (!Initialize(error)) {
-      SetText(reply_.capability_reason, error);
-      return;
-    }
-    std::vector<Output> outputs;
-    std::vector<Device> devices;
-    if (!ReadOutputs(outputs, true, error) || !ReadDevices(devices, error)) {
-      SetText(reply_.capability_reason, error);
-      return;
-    }
-    const bool keyboard = std::any_of(devices.begin(), devices.end(),
-                                      [](const auto& d) { return d.keyboard; });
-    if (!keyboard) {
-      SetText(reply_.capability_reason,
-              "No local keyboard available for privacy recovery");
-      return;
-    }
-    reply_.supported = true;
-    // XIGrabDevice does not suppress XI 2.2 touch delivery. Do not advertise
-    // input protection for touchscreens without a separate touch grab.
-    reply_.input_supported = std::none_of(
-        devices.begin(), devices.end(), [](const auto& d) { return d.touch; });
-    SetText(reply_.capability_reason,
-            reply_.input_supported
-                ? "X11 privacy black screen available; local recovery: "
-                  "Ctrl+Alt+Shift+F12"
-                : "X11 privacy black screen available; touchscreen input "
-                  "blocking is unavailable");
-  }
-
-  void Enable(bool block_input) {
-    ++reply_.generation;
-    reply_.failure[0] = '\0';
-    reply_.emergency = false;
-    if (!reply_.recovered) {
-      Fail("Linux privacy resources are still in use");
-      return;
-    }
-    Query();
-    if (!reply_.supported || (block_input && !reply_.input_supported)) {
-      Fail(reply_.capability_reason);
-      return;
-    }
-    std::string error;
-    keys_.clear();
-    if (!Acquire(error) || !ReadOutputs(outputs_, true, error) ||
-        !ReadDevices(devices_, error) || !ProtectInput(block_input, error)) {
-      Fail(error);
-      return;
-    }
-    // No display ramp is changed until every original ramp has been saved.
-    // Gamma is applied at scanout, after XGetImage/DRM framebuffer capture.
-    // There is deliberately no cover window to contaminate remote frames.
-    x_error = 0;
-    for (const auto& output : outputs_) {
-      Gamma black(XRRAllocGamma(output.saved->size), XRRFreeGamma);
-      if (!black) {
-        Fail("Cannot allocate Linux privacy display ramp");
-        return;
-      }
-      std::fill_n(black->red, black->size, 0);
-      std::fill_n(black->green, black->size, 0);
-      std::fill_n(black->blue, black->size, 0);
-      XRRSetCrtcGamma(display_, output.crtc, black.get());
-    }
-    for (int i = 0; i < ScreenCount(display_); ++i) {
-      XFixesHideCursor(display_, RootWindow(display_, i));
-      hidden_roots_.push_back(RootWindow(display_, i));
-    }
-    XSync(display_, False);
-    if (x_error) {
-      Fail("Cannot blank Linux displays or hide the local cursor");
-      return;
-    }
-    // Active slave grabs temporarily detach devices. Snapshot after grabbing,
-    // and monitor subsequent hardware/hierarchy changes during protection.
-    if (!ReadDevices(devices_, error)) {
-      Fail(error);
-      return;
-    }
-    reply_.active = true;
-    Check();
-  }
-
-  void Recover() {
-    reply_.active = false;
-    if (!display_) {
-      reply_.recovered = true;
-      return;
-    }
-    for (int id : grabbed_) XIUngrabDevice(display_, id, CurrentTime);
-    grabbed_.clear();
-    for (Window root : hidden_roots_) XFixesShowCursor(display_, root);
-    hidden_roots_.clear();
-    // Keep failed restorations for retry. Removed CRTCs no longer own a local
-    // output; all still-present CRTCs must acknowledge the original ramp.
-    for (auto it = outputs_.begin(); it != outputs_.end();) {
-      x_error = 0;
-      Resources resources(XRRGetScreenResourcesCurrent(display_, it->root),
-                          XRRFreeScreenResources);
-      if (!resources) {
-        ++it;
-        continue;
-      }
-      const bool exists =
-          std::find(resources->crtcs, resources->crtcs + resources->ncrtc,
-                    it->crtc) != resources->crtcs + resources->ncrtc;
-      if (exists && it->saved) {
-        XRRSetCrtcGamma(display_, it->crtc, it->saved.get());
-        XSync(display_, False);
-        if (x_error) {
-          ++it;
-          continue;
-        }
-      }
-      it = outputs_.erase(it);
-    }
-    keys_.clear();
-    if (outputs_.empty() && owner_) {
-      XDestroyWindow(display_, owner_);
-      owner_ = 0;
-    }
-    XSync(display_, False);
-    reply_.recovered = outputs_.empty() && !owner_;
-  }
-
-  void Fail(const std::string& reason) {
-    SetText(reply_.failure, reason);
-    Recover();
-  }
-
-  void Poll() {
-    if (!display_) return;
-    while (XPending(display_)) {
-      XEvent event{};
-      XNextEvent(display_, &event);
-      if (event.type != GenericEvent || event.xcookie.extension != xi_opcode_ ||
-          !XGetEventData(display_, &event.xcookie))
-        continue;
-      if (reply_.active) {
-        const int type = event.xcookie.evtype;
-        if (type == XI_KeyPress || type == XI_KeyRelease) {
-          const auto* key = static_cast<XIDeviceEvent*>(event.xcookie.data);
-          Key(key->sourceid, key->detail, type == XI_KeyPress);
-        } else if (!blocking_ &&
-                   (type == XI_RawKeyPress || type == XI_RawKeyRelease)) {
-          const auto* key = static_cast<XIRawEvent*>(event.xcookie.data);
-          Key(key->sourceid, key->detail, type == XI_RawKeyPress);
-        }
-      }
-      XFreeEventData(display_, &event.xcookie);
-    }
-    if (reply_.active &&
-        Clock::now() - checked_ >= std::chrono::milliseconds(100))
-      Check();
-    if (!reply_.active && !reply_.recovered) Recover();
-  }
-
-  const LinuxPrivacyReply& Reply() const { return reply_; }
-  int Connection() const { return display_ ? ConnectionNumber(display_) : -1; }
-  void AcknowledgeEmergency() { reply_.emergency = false; }
-
- private:
-  bool Initialize(std::string& error) {
-    if (initialized_) return true;
-    const char* session = std::getenv("XDG_SESSION_TYPE");
-    const char* wayland = std::getenv("WAYLAND_DISPLAY");
-    if ((session && std::strcmp(session, "wayland") == 0) ||
-        (wayland && *wayland)) {
-      error =
-          "Linux privacy screen requires an X11 session; Wayland is "
-          "unsupported";
-      return false;
-    }
-    const char* address = std::getenv("DISPLAY");
-    if (!address ||
-        (*address != ':' && std::strncmp(address, "unix:", 5) != 0)) {
-      error = "Linux privacy screen requires a local X11 display";
-      return false;
-    }
-    if (!display_) display_ = XOpenDisplay(nullptr);
-    if (!display_) {
-      error = "Cannot open the local X11 display";
-      return false;
-    }
-    int event = 0, code = 0, opcode = 0;
-    int major = 1, minor = 3;
-    if (XQueryExtension(display_, "XWAYLAND", &opcode, &event, &code)) {
-      error = "XWayland cannot protect native Wayland displays";
-      return false;
-    }
-    if (!XRRQueryExtension(display_, &event, &code) ||
-        !XRRQueryVersion(display_, &major, &minor) || major < 1 ||
-        (major == 1 && minor < 3)) {
-      error = "Linux privacy screen requires RandR 1.3 display gamma control";
-      return false;
-    }
-    major = 4;
-    minor = 0;
-    if (!XFixesQueryExtension(display_, &event, &code) ||
-        !XFixesQueryVersion(display_, &major, &minor) || major < 4) {
-      error = "Linux privacy screen requires XFixes 4 cursor hiding";
-      return false;
-    }
-    major = 2;
-    minor = 2;
-    if (!XQueryExtension(display_, "XInputExtension", &xi_opcode_, &event,
-                         &code) ||
-        XIQueryVersion(display_, &major, &minor) != Success || major < 2) {
-      error = "Linux privacy screen requires XInput 2 local input monitoring";
-      return false;
-    }
-    xtest_property_ = XInternAtom(display_, "XTEST Device", True);
-    if (!xtest_property_ ||
-        !XTestQueryExtension(display_, &event, &code, &major, &minor)) {
-      error = "Cannot identify X11 remote input devices";
-      return false;
-    }
-    selection_ = XInternAtom(display_, "_CROSSDESK_PRIVACY_GUARD", False);
-    std::array<unsigned char, XIMaskLen(XI_LASTEVENT)> bits{};
-    XISetMask(bits.data(), XI_RawKeyPress);
-    XISetMask(bits.data(), XI_RawKeyRelease);
-    XIEventMask mask{XIAllDevices, static_cast<int>(bits.size()), bits.data()};
-    x_error = 0;
-    for (int i = 0; i < ScreenCount(display_); ++i)
-      XISelectEvents(display_, RootWindow(display_, i), &mask, 1);
-    XSync(display_, False);
-    if (x_error) {
-      error = "Cannot monitor the local privacy recovery shortcut";
-      return false;
-    }
-    initialized_ = true;
-    return true;
-  }
-
-  bool ReadOutputs(std::vector<Output>& outputs, bool save,
-                   std::string& error) {
-    outputs.clear();
-    x_error = 0;
-    for (int screen = 0; screen < ScreenCount(display_); ++screen) {
-      const Window root = RootWindow(display_, screen);
-      Resources resources(XRRGetScreenResourcesCurrent(display_, root),
-                          XRRFreeScreenResources);
-      if (!resources) {
-        error = "Cannot enumerate Linux display outputs";
-        return false;
-      }
-      for (int i = 0; i < resources->ncrtc; ++i) {
-        CrtcInfo info(
-            XRRGetCrtcInfo(display_, resources.get(), resources->crtcs[i]),
-            XRRFreeCrtcInfo);
-        if (!info) {
-          error = "Cannot inspect Linux display controller";
-          return false;
-        }
-        if (!info->mode || !info->noutput) continue;
-        Output output;
-        output.root = root;
-        output.crtc = resources->crtcs[i];
-        output.mode = info->mode;
-        output.x = info->x;
-        output.y = info->y;
-        output.width = info->width;
-        output.height = info->height;
-        output.rotation = info->rotation;
-        output.connectors.assign(info->outputs, info->outputs + info->noutput);
-        std::sort(output.connectors.begin(), output.connectors.end());
-        if (save) {
-          output.saved.reset(XRRGetCrtcGamma(display_, output.crtc));
-          if (!output.saved || output.saved->size <= 0 ||
-              IsBlack(output.saved.get())) {
-            error =
-                "Display gamma control is unavailable or the display is "
-                "already blank";
-            return false;
-          }
-        }
-        outputs.push_back(std::move(output));
-      }
-    }
-    XSync(display_, False);
-    if (x_error || outputs.empty()) {
-      error = "No controllable Linux display outputs";
-      return false;
-    }
-    return true;
-  }
-
-  bool ReadDevices(std::vector<Device>& devices, std::string& error) {
-    devices.clear();
-    x_error = 0;
-    int count = 0;
-    XIDeviceInfo* info = XIQueryDevice(display_, XIAllDevices, &count);
-    if (!info) {
-      error = "Cannot enumerate local X11 input devices";
-      return false;
-    }
-    for (int i = 0; i < count; ++i) {
-      const auto& d = info[i];
-      if (!d.enabled || d.use == XIMasterPointer || d.use == XIMasterKeyboard)
-        continue;
-      Atom type = None;
-      int format = 0;
-      unsigned long items = 0, remaining = 0;
-      unsigned char* value = nullptr;
-      const int result =
-          XIGetProperty(display_, d.deviceid, xtest_property_, 0, 1, False,
-                        XA_INTEGER, &type, &format, &items, &remaining, &value);
-      const bool injected = result == Success && type == XA_INTEGER &&
-                            format == 8 && items == 1 && value && value[0] == 1;
-      if (value) XFree(value);
-      if (injected) continue;
-      Device device;
-      device.id = d.deviceid;
-      device.use = d.use;
-      device.attachment = d.attachment;
-      device.name = d.name ? d.name : "";
-      for (int c = 0; c < d.num_classes; ++c) {
-        device.keyboard |= d.classes[c]->type == XIKeyClass;
-        device.touch |= d.classes[c]->type == XITouchClass;
-      }
-      devices.push_back(std::move(device));
-    }
-    XIFreeDeviceInfo(info);
-    XSync(display_, False);
-    if (x_error) {
-      error = "Cannot verify local X11 input devices";
-      return false;
-    }
-    return true;
-  }
-
-  bool Acquire(std::string& error) {
-    // A second instance must not save the first instance's black ramps as its
-    // originals. Selection ownership and creation are atomic on this server.
-    XGrabServer(display_);
-    if (XGetSelectionOwner(display_, selection_) == None) {
-      owner_ = XCreateSimpleWindow(display_, DefaultRootWindow(display_), 0, 0,
-                                   1, 1, 0, 0, 0);
-      XSetSelectionOwner(display_, selection_, owner_, CurrentTime);
-    }
-    XUngrabServer(display_);
-    XSync(display_, False);
-    if (!owner_ || XGetSelectionOwner(display_, selection_) != owner_) {
-      error = "Another CrossDesk instance owns Linux privacy protection";
-      return false;
-    }
-    reply_.recovered = false;
-    return true;
-  }
-
-  bool ProtectInput(bool block_input, std::string& error) {
-    blocking_ = block_input;
-    if (!block_input) return true;
-    for (const auto& device : devices_) {
-      if (device.touch) {
-        error = "Touchscreen privacy input blocking is unavailable";
-        return false;
-      }
-      if (device.keyboard) {
-        // Preserve held local modifiers for the emergency chord independently
-        // of the releases sent to the master keyboard below.
-        XDevice* keyboard = XOpenDevice(display_, device.id);
-        XDeviceState* state =
-            keyboard ? XQueryDeviceState(display_, keyboard) : nullptr;
-        if (!state) {
-          if (keyboard) XCloseDevice(display_, keyboard);
-          error = "Cannot inspect held local keyboard input";
-          return false;
-        }
-        XInputClass* input = state->data;
-        for (int i = 0; i < state->num_classes; ++i) {
-          if (input->c_class == KeyClass) {
-            const auto* keys = reinterpret_cast<XKeyState*>(input);
-            for (int key = 0; key < 256; ++key)
-              keys_[device.id][key] = keys->keys[key / 8] & (1 << (key % 8));
-          }
-          input = reinterpret_cast<XInputClass*>(
-              reinterpret_cast<char*>(input) + input->length);
-        }
-        XFreeDeviceState(state);
-        XCloseDevice(display_, keyboard);
-      }
-      std::array<unsigned char, XIMaskLen(XI_LASTEVENT)> bits{};
-      for (int type : {XI_KeyPress, XI_KeyRelease, XI_ButtonPress,
-                       XI_ButtonRelease, XI_Motion})
-        XISetMask(bits.data(), type);
-      XIEventMask mask{device.id, static_cast<int>(bits.size()), bits.data()};
-      const int result = XIGrabDevice(
-          display_, device.id, DefaultRootWindow(display_), CurrentTime, None,
-          GrabModeAsync, GrabModeAsync, False, &mask);
-      if (result != GrabSuccess) {
-        error = "Cannot grab every local X11 input device";
-        return false;
-      }
-      grabbed_.push_back(device.id);
-    }
-    return ReleaseHeldInput(error);
-  }
-
-  bool ReleaseHeldInput(std::string& error) {
-    // Slave grabs float physical devices, but their previous presses can
-    // remain on the master. Release them after all grabs are installed so a
-    // held local Ctrl/button cannot alter the remote controller's next input.
-    int original_pointer = 0, count = 0;
-    XIGetClientPointer(display_, None, &original_pointer);
-    XIDeviceInfo* masters = XIQueryDevice(display_, XIAllMasterDevices, &count);
-    if (!masters) {
-      error = "Cannot inspect held X11 input";
-      return false;
-    }
-    x_error = 0;
-    bool ok = true;
-    for (int i = 0; i < count; ++i) {
-      if (masters[i].use != XIMasterPointer || !masters[i].enabled) continue;
-      XISetClientPointer(display_, None, masters[i].deviceid);
-      char keys[32]{};
-      XQueryKeymap(display_, keys);
-      for (int key = 8; key < 256; ++key)
-        if (keys[key / 8] & (1 << (key % 8)))
-          ok &= XTestFakeKeyEvent(display_, key, False, CurrentTime) != 0;
-      Window root = None, child = None;
-      double root_x = 0, root_y = 0, win_x = 0, win_y = 0;
-      XIButtonState buttons{};
-      XIModifierState modifiers{};
-      XIGroupState group{};
-      XIQueryPointer(display_, masters[i].deviceid, DefaultRootWindow(display_),
-                     &root, &child, &root_x, &root_y, &win_x, &win_y, &buttons,
-                     &modifiers, &group);
-      for (int button = 1; button < buttons.mask_len * 8; ++button)
-        if (XIMaskIsSet(buttons.mask, button))
-          ok &= XTestFakeButtonEvent(display_, button, False, CurrentTime) != 0;
-      if (buttons.mask) XFree(buttons.mask);
-      XSync(display_, False);
-      XQueryKeymap(display_, keys);
-      for (char pressed : keys) ok &= pressed == 0;
-      buttons = {};
-      XIQueryPointer(display_, masters[i].deviceid, DefaultRootWindow(display_),
-                     &root, &child, &root_x, &root_y, &win_x, &win_y, &buttons,
-                     &modifiers, &group);
-      for (int byte = 0; byte < buttons.mask_len; ++byte)
-        ok &= buttons.mask[byte] == 0;
-      if (buttons.mask) XFree(buttons.mask);
-    }
-    XIFreeDeviceInfo(masters);
-    if (original_pointer) XISetClientPointer(display_, None, original_pointer);
-    XSync(display_, False);
-    if (!ok || x_error) {
-      error = "Cannot release held X11 input for privacy";
-      return false;
-    }
-    return true;
-  }
-
-  void Key(int source, int keycode, bool down) {
-    if (keycode < 0 || keycode >= 256 ||
-        std::none_of(devices_.begin(), devices_.end(), [source](const auto& d) {
-          return d.id == source && d.keyboard;
-        }))
-      return;
-    keys_[source][keycode] = down;
-    bool ctrl = false, alt = false, shift = false;
-    for (const auto& [id, keys] : keys_) {
-      for (int code = 0; code < 256; ++code) {
-        if (!keys[code]) continue;
-        const KeySym symbol = XkbKeycodeToKeysym(display_, code, 0, 0);
-        ctrl |= symbol == XK_Control_L || symbol == XK_Control_R;
-        alt |= symbol == XK_Alt_L || symbol == XK_Alt_R;
-        shift |= symbol == XK_Shift_L || symbol == XK_Shift_R;
-      }
-    }
-    if (down && ctrl && alt && shift &&
-        XkbKeycodeToKeysym(display_, keycode, 0, 0) == XK_F12) {
-      reply_.emergency = true;
-      Recover();
-    }
-  }
-
-  void Check() {
-    checked_ = Clock::now();
-    std::string error;
-    std::vector<Output> current;
-    std::vector<Device> devices;
-    if (!ReadOutputs(current, false, error) || !ReadDevices(devices, error)) {
-      Fail(error);
-      return;
-    }
-    if (current.size() != outputs_.size() ||
-        !std::equal(
-            current.begin(), current.end(), outputs_.begin(),
-            [](const auto& a, const auto& b) { return a.SameLayout(b); })) {
-      Fail("Display topology changed; Linux privacy has been turned off");
-      return;
-    }
-    if (devices != devices_) {
-      Fail("Local input devices changed; Linux privacy has been turned off");
-      return;
-    }
-    x_error = 0;
-    for (const auto& output : outputs_) {
-      Gamma ramp(XRRGetCrtcGamma(display_, output.crtc), XRRFreeGamma);
-      if (!IsBlack(ramp.get())) {
-        Fail(
-            "Display gamma protection was changed; Linux privacy is "
-            "unavailable");
-        return;
-      }
-    }
-    XSync(display_, False);
-    if (x_error || XGetSelectionOwner(display_, selection_) != owner_)
-      Fail("Cannot verify Linux privacy protection");
-  }
-
-  Display* display_ = nullptr;
-  bool initialized_ = false;
-  bool blocking_ = false;
-  int xi_opcode_ = 0;
-  Atom xtest_property_ = None, selection_ = None;
-  Window owner_ = 0;
-  std::vector<Output> outputs_;
-  std::vector<Device> devices_;
-  std::vector<int> grabbed_;
-  std::vector<Window> hidden_roots_;
-  std::map<int, std::array<bool, 256>> keys_;
-  LinuxPrivacyReply reply_;
-  Clock::time_point checked_{};
-};
-}  // namespace
-
-int RunLinuxPrivacyGuard() {
-  const int socket = kLinuxPrivacyGuardSocket;
-  int type = 0;
-  socklen_t length = sizeof(type);
-  if (getsockopt(socket, SOL_SOCKET, SO_TYPE, &type, &length) != 0 ||
-      type != SOCK_SEQPACKET)
-    return 1;
-  fcntl(socket, F_SETFD, FD_CLOEXEC);
-  fcntl(socket, F_SETFL, O_NONBLOCK);
-  struct sigaction action {};
-  action.sa_handler = StopGuard;
-  sigemptyset(&action.sa_mask);
-  sigaction(SIGTERM, &action, nullptr);
-  sigaction(SIGINT, &action, nullptr);
-  sigaction(SIGHUP, &action, nullptr);
-  XSetErrorHandler(OnXError);
-  NativePrivacy privacy;
-  auto heartbeat = Clock::now();
-  bool connected = true;
-  bool dirty = false;
-  while (connected && !stopping) {
-    pollfd fds[] = {{socket, POLLIN, 0}, {privacy.Connection(), POLLIN, 0}};
-    poll(fds, 2, privacy.Reply().active ? 25 : 250);
-    if (fds[0].revents & (POLLERR | POLLHUP | POLLNVAL)) break;
-    for (int i = 0; i < 64; ++i) {
-      LinuxPrivacyCommand command;
-      const auto bytes = recv(socket, &command, sizeof(command), 0);
-      if (bytes < 0 &&
-          (errno == EAGAIN || errno == EWOULDBLOCK || errno == EINTR))
-        break;
-      if (bytes != sizeof(command)) {
-        connected = false;
-        break;
-      }
-      heartbeat = Clock::now();
-      switch (command) {
-        case LinuxPrivacyCommand::query:
-          if (!privacy.Reply().active) privacy.Query();
-          break;
-        case LinuxPrivacyCommand::enable:
-          privacy.Enable(false);
-          break;
-        case LinuxPrivacyCommand::enable_blocking:
-          privacy.Enable(true);
-          break;
-        case LinuxPrivacyCommand::recover:
-          privacy.Recover();
-          break;
-        case LinuxPrivacyCommand::heartbeat:
-          break;
-        default:
-          connected = false;
-          break;
-      }
-      dirty = true;
-    }
-    if (!connected || stopping) break;
-    const auto before = privacy.Reply();
-    privacy.Poll();
-    if (privacy.Reply().active &&
-        Clock::now() - heartbeat > std::chrono::seconds(3))
-      privacy.Fail(
-          "Privacy controller stopped responding; local desktop and input "
-          "restored");
-    const auto& after = privacy.Reply();
-    dirty |= before.active != after.active ||
-             before.recovered != after.recovered ||
-             before.emergency != after.emergency ||
-             std::strcmp(before.failure, after.failure) != 0;
-    if (dirty) {
-      const auto& reply = privacy.Reply();
-      if (send(socket, &reply, sizeof(reply), MSG_NOSIGNAL) == sizeof(reply)) {
-        dirty = false;
-        privacy.AcknowledgeEmergency();
-      } else if (errno != EAGAIN && errno != EWOULDBLOCK && errno != EINTR)
-        break;
-    }
-  }
-  // Keep trying if the X server temporarily rejected restoration, even after
-  // the parent exited. Disconnecting releases XI grabs and cursor hiding too.
-  do {
-    privacy.Recover();
-    if (!privacy.Reply().recovered) poll(nullptr, 0, 250);
-  } while (!privacy.Reply().recovered);
-  const auto& reply = privacy.Reply();
-  const auto ignored = send(socket, &reply, sizeof(reply), MSG_NOSIGNAL);
-  (void)ignored;
-  close(socket);
-  return 0;
-}
-}  // namespace crossdesk
@@ -1,42 +0,0 @@
-/*
- * @Author: DI JUNKUN
- * @Date: 2026-09-13
- * Copyright (c) 2026 by DI JUNKUN, All Rights Reserved.
- */
-
-#ifndef _PRIVACY_GUARD_H_
-#define _PRIVACY_GUARD_H_
-
-#include <cstdint>
-
-namespace crossdesk {
-
-inline constexpr char kLinuxPrivacyGuardArgument[] = "--linux-privacy-guard";
-inline constexpr int kLinuxPrivacyGuardSocket = 3;
-
-// Private protocol over an inherited SOCK_SEQPACKET socket. No listening
-// socket, shell, elevated privileges or separately installed helper is needed.
-enum class LinuxPrivacyCommand : uint8_t {
-  query,
-  enable,
-  enable_blocking,
-  recover,
-  heartbeat,
-};
-
-struct LinuxPrivacyReply {
-  uint64_t generation = 0;
-  bool supported = false;
-  bool input_supported = false;
-  bool active = false;
-  bool recovered = true;
-  bool emergency = false;
-  char capability_reason[256]{};
-  char failure[256]{};
-};
-
-int RunLinuxPrivacyGuard();
-
-}  // namespace crossdesk
-
-#endif
@@ -8,7 +8,6 @@

 #include <display_stream_id.h>
 #include "platform.h"
-#include "privacy_controller.h"
 #include "rd_log.h"
 #if defined(CROSSDESK_HAS_DRM) && CROSSDESK_HAS_DRM
 #include "screen_capturer_drm.h"
@@ -65,13 +64,6 @@ int ScreenCapturerLinux::Init(const int fps, cb_desktop_data cb) {
      return;
    }
    invalid_stream_id_logged_.store(false, std::memory_order_relaxed);
-    {
-      std::lock_guard lock(privacy_mutex_);
-      if (privacy_ && !capture_paused_ && !capture_announced_) {
-        capture_announced_ = true;
-        privacy_->CaptureChanged(true);
-      }
-    }
    if (callback_orig_) {
      callback_orig_(data, size, width, height, mapped_stream_id.c_str(),
                     native_frame);
@@ -153,7 +145,6 @@ int ScreenCapturerLinux::Init(const int fps, cb_desktop_data cb) {
 }

 int ScreenCapturerLinux::Destroy() {
-  Stop();
  if (impl_) {
    impl_->Destroy();
    impl_.reset();
@@ -178,11 +169,6 @@ int ScreenCapturerLinux::Start(bool show_cursor) {
    return -1;
  }

-  {
-    std::lock_guard lock(privacy_mutex_);
-    capture_paused_ = false;
-  }
-
  // X11 output names, DRM connectors and Wayland stream handles may all change
  // after an HDMI hotplug, so rebuild the current backend before each session.
  const int refresh_ret = RefreshCurrentBackend();
@@ -240,11 +226,6 @@ int ScreenCapturerLinux::Stop() {
    return 0;
  }
  const int ret = impl_->Stop();
-  {
-    std::lock_guard lock(privacy_mutex_);
-    capture_announced_ = false;
-    if (privacy_) privacy_->CaptureChanged(false);
-  }
  UpdateAliasesFromBackend(impl_.get());
  return ret;
 }
@@ -253,25 +234,13 @@ int ScreenCapturerLinux::Pause(int monitor_index) {
  if (!impl_) {
    return -1;
  }
-  const int ret = impl_->Pause(monitor_index);
-  {
-    // An in-flight frame must not announce running again after a pause.
-    std::lock_guard lock(privacy_mutex_);
-    capture_paused_ = true;
-    capture_announced_ = false;
-    if (privacy_) privacy_->CaptureChanged(false);
-  }
-  return ret;
+  return impl_->Pause(monitor_index);
 }

 int ScreenCapturerLinux::Resume(int monitor_index) {
  if (!impl_) {
    return -1;
  }
-  {
-    std::lock_guard lock(privacy_mutex_);
-    capture_paused_ = false;
-  }
  return impl_->Resume(monitor_index);
 }

@@ -25,7 +25,6 @@ class ScreenCapturerLinux : public ScreenCapturer {

 public:
  int Init(const int fps, cb_desktop_data cb) override;
-  void SetPrivacyController(PrivacyController* privacy) override { privacy_ = privacy; }
  int Destroy() override;
  int Start(bool show_cursor) override;
  int Stop() override;
@@ -54,10 +53,6 @@ class ScreenCapturerLinux : public ScreenCapturer {

 private:
  std::unique_ptr<ScreenCapturer> impl_;
-  PrivacyController* privacy_ = nullptr;
-  std::mutex privacy_mutex_;
-  bool capture_announced_ = false;
-  bool capture_paused_ = false;
  BackendType backend_ = BackendType::kNone;
  int fps_ = 60;
  cb_desktop_data callback_;
@@ -11,7 +11,6 @@
 #include <vector>

 #include "runtime/cursor_position.h"
-#include "../../privacy/privacy_cursor_mac.h"

 namespace crossdesk {
 namespace {
@@ -162,9 +161,7 @@ bool CursorStateProvider::Sample(const std::vector<DisplayInfo>& displays,
 #pragma clang diagnostic push
 #pragma clang diagnostic ignored "-Wdeprecated-declarations"
  NSCursor* cursor = NSCursor.currentSystemCursor;
-  const bool privacy_hidden = IsMacPrivacyCursorHidden();
-  const bool visible = CGCursorIsVisible() || privacy_hidden;
-  if (!cursor && privacy_hidden) cursor = NSCursor.arrowCursor;
+  const bool visible = CGCursorIsVisible();
 #pragma clang diagnostic pop

  state->seq = 0;
@@ -4,7 +4,6 @@
 #include <unordered_map>

 #include "keyboard_converter.h"
-#include "../mac_injected_event.h"
 #include "rd_log.h"

 namespace crossdesk {
@@ -12,6 +11,7 @@ namespace crossdesk {
 static OnKeyAction g_on_key_action = nullptr;
 static void* g_user_ptr = nullptr;
 static std::unordered_map<int, int> g_unmapped_keycode_to_vk;
+constexpr int64_t kCrossDeskInjectedKeyboardEvent = 0x43524f5353444553;

 static int VkCodeFromUnicode(UniChar ch) {
  if (ch >= 'a' && ch <= 'z') {
@@ -106,7 +106,7 @@ CGEventRef eventCallback(CGEventTapProxy proxy, CGEventType type,
                         CGEventRef event, void* userInfo) {
  (void)proxy;
  if (CGEventGetIntegerValueField(event, kCGEventSourceUserData) ==
-      kCrossDeskInjectedEvent) {
+      kCrossDeskInjectedKeyboardEvent) {
    return event;
  }
  if (!g_on_key_action) {
@@ -309,7 +309,7 @@ int PlatformKeyboardCapturer::SendKeyboardCommand(int key_code, bool is_down,

    CGEventSetFlags(event, ToCGEventFlags(injected_flags));
    CGEventSetIntegerValueField(event, kCGEventSourceUserData,
-                               kCrossDeskInjectedEvent);
+                               kCrossDeskInjectedKeyboardEvent);
    CGEventPost(kCGHIDEventTap, event);
    CFRelease(event);

@@ -323,7 +323,7 @@ int PlatformKeyboardCapturer::SendKeyboardCommand(int key_code, bool is_down,
        return -1;
      }
      CGEventSetIntegerValueField(fn_release_event, kCGEventSourceUserData,
-                                 kCrossDeskInjectedEvent);
+                                 kCrossDeskInjectedKeyboardEvent);
      CGEventPost(kCGHIDEventTap, fn_release_event);
      CFRelease(fn_release_event);
    }
@@ -1,17 +0,0 @@
-/*
- * @Author: DI JUNKUN
- * @Date: 2026-09-13
- * Copyright (c) 2026 by DI JUNKUN, All Rights Reserved.
- */
-
-#ifndef _MAC_INJECTED_EVENT_H_
-#define _MAC_INJECTED_EVENT_H_
-
-#include <cstdint>
-
-namespace crossdesk {
-// Shared by the keyboard/mouse injectors and the privacy input tap.
-inline constexpr int64_t kCrossDeskInjectedEvent = 0x43524f5353444553;
-}
-
-#endif
@@ -1,5 +1,4 @@
 #include "mouse_controller.h"
-#include "../mac_injected_event.h"

 #include <remote_action.h>

@@ -211,8 +210,6 @@ int PlatformMouseController::SendMouseCommand(RemoteAction remote_action,
  }

  if (mouse_event) {
-    CGEventSetIntegerValueField(mouse_event, kCGEventSourceUserData,
-                                kCrossDeskInjectedEvent);
    CGEventPost(kCGHIDEventTap, mouse_event);
    CFRelease(mouse_event);
  }
@@ -1,400 +0,0 @@
-/* Copyright (c) 2026 by DI JUNKUN, All Rights Reserved. */
-
-#import <AppKit/AppKit.h>
-#import <ApplicationServices/ApplicationServices.h>
-
-#include <algorithm>
-#include <chrono>
-#include <deque>
-#include <functional>
-#include <cstdlib>
-#include <libproc.h>
-#include <mutex>
-#include <utility>
-#include <unistd.h>
-
-#include "privacy_backend.h"
-#include "privacy_capture_state.h"
-#include "privacy_cover_view.h"
-#include "privacy_cursor_mac.h"
-#include "rd_log.h"
-#include "../input/mac_injected_event.h"
-
-// These windows never take keyboard focus. Remote clicks pass through them;
-// physical input is intercepted independently on the controller's run loop.
-@interface CrossDeskPrivacyPanel : NSPanel
-@end
-@implementation CrossDeskPrivacyPanel
- (BOOL)canBecomeKeyWindow { return NO; }
- (BOOL)canBecomeMainWindow { return NO; }
-@end
-
-namespace crossdesk {
-namespace {
-using Clock = std::chrono::steady_clock;
-std::mutex tasks_mutex;
-std::deque<std::function<void()>> tasks;
-std::mutex capture_mutex;
-MacPrivacyCaptureState capture_state;
-
-void OnMain(std::function<void()> task) {
-  {
-    std::lock_guard lock(tasks_mutex);
-    tasks.push_back(std::move(task));
-  }
-  dispatch_async(dispatch_get_main_queue(), ^{ FlushMacPrivacyTasks(); });
-}
-
-void PublishCovers(std::vector<uint32_t> windows, uint32_t cursor_window = 0) {
-  {
-    std::lock_guard lock(capture_mutex);
-    capture_state.excluded_windows = std::move(windows);
-    capture_state.cursor_window = cursor_window;
-    ++capture_state.revision;
-  }
-  dispatch_async(dispatch_get_main_queue(), ^{
-    [NSNotificationCenter.defaultCenter postNotificationName:@"CrossDeskPrivacyCoversChanged"
-                                                     object:nil];
-  });
-}
-
-struct Monitor {
-  CGDirectDisplayID id = 0;
-  CGRect bounds{};  // CoreGraphics desktop coordinates (points).
-  NSRect frame{};   // AppKit desktop coordinates (bottom left).
-  CrossDeskPrivacyPanel* __strong cover = nil;
-};
-struct WindowState {
-  std::mutex mutex;
-  std::vector<Monitor> monitors;
-  bool recovered = true;
-  bool recovering = false;
-  bool covers_shown = false;
-  bool check_queued = false;
-  MacPrivacyCursor cursor;
-  std::string failure;
-  Clock::time_point checked = Clock::now();
-};
-
-CrossDeskPrivacyPanel* MakePanel(NSRect frame, NSInteger level) {
-  auto* panel = [[CrossDeskPrivacyPanel alloc]
-      initWithContentRect:frame
-                styleMask:NSWindowStyleMaskBorderless | NSWindowStyleMaskNonactivatingPanel
-                  backing:NSBackingStoreBuffered defer:NO];
-  panel.releasedWhenClosed = NO;
-  panel.hidesOnDeactivate = NO;
-  panel.opaque = YES;
-  panel.backgroundColor = NSColor.blackColor;
-  panel.hasShadow = NO;
-  panel.ignoresMouseEvents = YES;
-  panel.level = level;
-  panel.animationBehavior = NSWindowAnimationBehaviorNone;
-  panel.collectionBehavior = NSWindowCollectionBehaviorCanJoinAllSpaces |
-      NSWindowCollectionBehaviorFullScreenAuxiliary |
-      NSWindowCollectionBehaviorStationary |
-      NSWindowCollectionBehaviorIgnoresCycle;
-  // Exclusion is explicit in ScreenCaptureKit. SharingNone alone does not
-  // exclude windows on recent macOS releases, and can hide them from discovery.
-  panel.sharingType = NSWindowSharingReadOnly;
-  return panel;
-}
-
-bool IsSystemCursorPlane(NSDictionary* info, CGRect bounds) {
-  const auto layer = [info[(__bridge NSString*)kCGWindowLayer] intValue];
-  // WindowServer's cursor plane also carries small recording indicators.
-  // Validate both its geometry and executable identity before ignoring it.
-  if (layer != CGWindowLevelForKey(kCGCursorWindowLevelKey) ||
-      bounds.size.width <= 0 || bounds.size.height <= 0 ||
-      bounds.size.width > 512 || bounds.size.height > 512)
-    return false;
-  char executable[PROC_PIDPATHINFO_MAXSIZE]{};
-  const auto pid = [info[(__bridge NSString*)kCGWindowOwnerPID] intValue];
-  static const std::string system_executable = [] {
-    char resolved[PROC_PIDPATHINFO_MAXSIZE]{};
-    return realpath("/System/Library/PrivateFrameworks/SkyLight.framework/Resources/WindowServer",
-                    resolved) ? std::string(resolved) : std::string();
-  }();
-  return proc_pidpath(pid, executable, sizeof(executable)) > 0 &&
-      !system_executable.empty() && system_executable == executable;
-}
-
-std::string CoverageFailure(const std::vector<Monitor>& monitors) {
-  uint32_t count = 0;
-  if (CGGetActiveDisplayList(0, nullptr, &count) != kCGErrorSuccess || !count)
-    return "No active macOS desktop; privacy screen unavailable";
-  std::vector<CGDirectDisplayID> displays(count);
-  if (CGGetActiveDisplayList(count, displays.data(), &count) != kCGErrorSuccess ||
-      count != monitors.size())
-    return "Display topology changed; turn privacy off to recover";
-  for (const auto& m : monitors) {
-    if (std::find(displays.begin(), displays.end(), m.id) == displays.end() ||
-        !CGRectEqualToRect(CGDisplayBounds(m.id), m.bounds) ||
-        !m.cover.visible || !m.cover.isOnActiveSpace ||
-        !NSEqualRects(m.cover.frame, m.frame) || m.cover.alphaValue != 1.0)
-      return "Privacy cover or display geometry changed; privacy screen unavailable";
-  }
-  NSDictionary* session = CFBridgingRelease(CGSessionCopyCurrentDictionary());
-  if (!session || ![session[(__bridge NSString*)kCGSessionOnConsoleKey] boolValue])
-    return "macOS session is not on console; privacy screen unavailable";
-
-  NSArray* windows = CFBridgingRelease(CGWindowListCopyWindowInfo(
-      kCGWindowListOptionOnScreenOnly | kCGWindowListExcludeDesktopElements,
-      kCGNullWindowID));
-  if (!windows) return "Unable to verify macOS privacy window order";
-  for (const auto& m : monitors) {
-    bool found = false;
-    for (NSDictionary* info in windows) {
-      const auto window = [info[(__bridge NSString*)kCGWindowNumber] unsignedIntValue];
-      if (window == m.cover.windowNumber) { found = true; break; }
-      if ([info[(__bridge NSString*)kCGWindowAlpha] doubleValue] <= 0) continue;
-      CGRect bounds{};
-      if (!CGRectMakeWithDictionaryRepresentation(
-              (__bridge CFDictionaryRef)info[(__bridge NSString*)kCGWindowBounds], &bounds))
-        return "Unable to verify a window above the privacy cover";
-      if (CGRectIntersectsRect(bounds, m.bounds)) {
-        if (IsSystemCursorPlane(info, bounds)) continue;
-        LOG_WARN("macOS privacy overlap: window={}, pid={}, layer={}, alpha={}, "
-                 "bounds=({}, {}, {}, {}), cover={}, cover_level={}",
-                 window,
-                 [info[(__bridge NSString*)kCGWindowOwnerPID] intValue],
-                 [info[(__bridge NSString*)kCGWindowLayer] intValue],
-                 [info[(__bridge NSString*)kCGWindowAlpha] doubleValue],
-                 bounds.origin.x, bounds.origin.y, bounds.size.width, bounds.size.height,
-                 m.cover.windowNumber, m.cover.level);
-        return "A system or application window overlaps the privacy cover; privacy screen unavailable";
-      }
-    }
-    if (!found) return "Privacy cover disappeared; privacy screen unavailable";
-  }
-  return {};
-}
-
-class MacPrivacyBackend final : public PrivacyBackend {
- public:
-  MacPrivacyBackend() : state_(std::make_shared<WindowState>()) {
-    loop_ = CFRunLoopGetCurrent();
-    CFRetain(loop_);
-    CFRunLoopSourceContext context{};
-    wake_source_ = CFRunLoopSourceCreate(nullptr, 0, &context);
-    CFRunLoopAddSource(loop_, wake_source_, kCFRunLoopDefaultMode);
-  }
-  ~MacPrivacyBackend() override {
-    Recover();
-    CFRunLoopRemoveSource(loop_, wake_source_, kCFRunLoopDefaultMode);
-    CFRelease(wake_source_);
-    CFRelease(loop_);
-  }
-  PrivacyCapabilities Query() override {
-    if (@available(macOS 14.0, *)) {
-      if (!CGPreflightScreenCaptureAccess())
-        return {false, false, "Grant Screen Recording permission to use privacy screen"};
-      if (!AXIsProcessTrusted())
-        return {false, false, "Grant Accessibility permission to protect local input and enable local recovery"};
-      if (!MacPrivacyCursor::Supported())
-        return {false, false, "Background cursor control unavailable on this macOS version"};
-      return {true, true, "macOS privacy screen available (ScreenCaptureKit)"};
-    }
-    return {false, false, "Privacy screen requires macOS 14 or newer"};
-  }
-  bool Enable(bool block_input, const PrivacyScreenText& text, std::string& error) override {
-    const auto caps = Query();
-    if (!caps.overlay) { error = caps.reason; return false; }
-    block_input_ = block_input;
-    emergency_ = false;
-    tap_failed_ = false;
-    CGEventMask mask = CGEventMaskBit(kCGEventKeyDown) | CGEventMaskBit(kCGEventKeyUp) |
-        CGEventMaskBit(kCGEventFlagsChanged) | CGEventMaskBit(kCGEventLeftMouseDown) |
-        CGEventMaskBit(kCGEventLeftMouseUp) | CGEventMaskBit(kCGEventRightMouseDown) |
-        CGEventMaskBit(kCGEventRightMouseUp) | CGEventMaskBit(kCGEventMouseMoved) |
-        CGEventMaskBit(kCGEventLeftMouseDragged) | CGEventMaskBit(kCGEventRightMouseDragged) |
-        CGEventMaskBit(kCGEventOtherMouseDown) | CGEventMaskBit(kCGEventOtherMouseUp) |
-        CGEventMaskBit(kCGEventOtherMouseDragged) | CGEventMaskBit(kCGEventScrollWheel) |
-        CGEventMaskBit(14); // NX_SYSDEFINED: media/brightness keys.
-    tap_ = CGEventTapCreate(kCGHIDEventTap, kCGHeadInsertEventTap,
-                           kCGEventTapOptionDefault, mask, Input, this);
-    if (!tap_) { error = "Cannot install macOS privacy input tap"; return false; }
-    tap_source_ = CFMachPortCreateRunLoopSource(nullptr, tap_, 0);
-    if (!tap_source_) { error = "Cannot create macOS privacy input run loop"; return false; }
-    CFRunLoopAddSource(loop_, tap_source_, kCFRunLoopDefaultMode);
-    CGEventTapEnable(tap_, true);
-    {
-      std::lock_guard lock(state_->mutex);
-      state_->recovered = false;
-      state_->failure.clear();
-      state_->checked = Clock::now();
-    }
-    auto state = state_;
-    OnMain([state, text] {
-      @autoreleasepool {
-        std::lock_guard lock(state->mutex);
-        if (!state->cursor.Prepare()) {
-          state->failure = "Cannot prepare the privacy cursor";
-          return;
-        }
-        std::vector<uint32_t> covers;
-        for (NSScreen* screen in NSScreen.screens) {
-          Monitor m;
-          m.id = [screen.deviceDescription[@"NSScreenNumber"] unsignedIntValue];
-          m.bounds = CGDisplayBounds(m.id);
-          m.frame = screen.frame;
-          NSView* content = CreateMacPrivacyCoverView(
-              NSMakeRect(0, 0, m.frame.size.width, m.frame.size.height),
-              [NSString stringWithUTF8String:text.unlock_hint.c_str()]);
-          if (!content) {
-            state->failure = "Could not load the CrossDesk privacy screen logo";
-            break;
-          }
-          m.cover = MakePanel(m.frame, CGWindowLevelForKey(kCGScreenSaverWindowLevelKey) + 1);
-          m.cover.contentView = content;
-          // Register transparent windows first. Make them opaque only after
-          // SCK has acknowledged exclusion, avoiding a black remote frame.
-          m.cover.alphaValue = 0;
-          [m.cover orderFrontRegardless];
-          covers.push_back(static_cast<uint32_t>(m.cover.windowNumber));
-          state->monitors.push_back(std::move(m));
-        }
-        PublishCovers(std::move(covers), state->cursor.WindowId());
-        if (state->monitors.empty()) state->failure = "No active macOS desktop";
-        state->checked = Clock::now();
-      }
-    });
-    return true;
-  }
-  void Recover() override {
-    if (tap_) { CGEventTapEnable(tap_, false); CFMachPortInvalidate(tap_); }
-    if (tap_source_) {
-      CFRunLoopRemoveSource(loop_, tap_source_, kCFRunLoopDefaultMode);
-      CFRelease(tap_source_); tap_source_ = nullptr;
-    }
-    if (tap_) { CFRelease(tap_); tap_ = nullptr; }
-    {
-      std::lock_guard lock(state_->mutex);
-      if (state_->recovered || state_->recovering) return;
-      state_->recovering = true;
-    }
-    auto state = state_;
-    OnMain([state] {
-      std::lock_guard lock(state->mutex);
-      for (auto& m : state->monitors) {
-        [m.cover orderOut:nil]; [m.cover close]; m.cover = nil;
-      }
-      state->monitors.clear();
-      state->covers_shown = false;
-      state->cursor.Restore();
-      PublishCovers({});
-      state->failure.clear();
-      state->recovering = false;
-      state->recovered = true;
-    });
-  }
-  bool IsRecovered() const override {
-    std::lock_guard lock(state_->mutex);
-    return state_->recovered && !tap_;
-  }
-  bool RecoveryPending() const override {
-    std::lock_guard lock(state_->mutex);
-    return state_->recovering;
-  }
-  PrivacyHealth Poll() override {
-    if (emergency_) { emergency_ = false; return {{}, true}; }
-    if (tap_ && (tap_failed_ || !CGEventTapIsEnabled(tap_) || !AXIsProcessTrusted()))
-      return {"Local input protection interrupted; privacy screen unavailable", false};
-    auto state = state_;
-    std::lock_guard lock(state->mutex);
-    if (state->recovered || state->recovering) return {};
-    if (!state->failure.empty()) return {state->failure, false};
-    const auto age = Clock::now() - state->checked;
-    if (age > std::chrono::seconds(1))
-      return {"macOS privacy window checks stopped responding; privacy screen unavailable", false};
-    if (!state->check_queued && age > std::chrono::milliseconds(100)) {
-      state->check_queued = true;
-      OnMain([state] {
-        std::lock_guard lock(state->mutex);
-        if (!state->recovered && !state->recovering && state->failure.empty()) {
-          const auto capture = GetMacPrivacyCaptureState();
-          if (!state->covers_shown && !state->monitors.empty() &&
-              capture.revision == capture.applied_revision) {
-            if (!state->cursor.Hide()) {
-              state->failure = "Cannot hide the local privacy cursor";
-              state->checked = Clock::now();
-              state->check_queued = false;
-              return;
-            }
-            for (auto& m : state->monitors) {
-              m.cover.alphaValue = 1;
-              [m.cover displayIfNeeded];
-              [m.cover orderFrontRegardless];
-            }
-            state->covers_shown = true;
-          }
-          if (state->covers_shown) {
-            state->failure = state->cursor.Healthy() ? CoverageFailure(state->monitors)
-                : "Cannot keep the local privacy cursor hidden";
-          }
-        }
-        state->checked = Clock::now();
-        state->check_queued = false;
-      });
-    }
-    const auto capture = GetMacPrivacyCaptureState();
-    return {{}, false, state->covers_shown &&
-                       capture.revision == capture.applied_revision};
-  }
-  void WaitForEvents(unsigned timeout_ms) override {
-    @autoreleasepool {
-      CFRunLoopRunInMode(kCFRunLoopDefaultMode, timeout_ms / 1000.0, true);
-    }
-  }
-  void Wake() override { CFRunLoopSourceSignal(wake_source_); CFRunLoopWakeUp(loop_); }
- private:
-  static CGEventRef Input(CGEventTapProxy, CGEventType type, CGEventRef event, void* context) {
-    auto* self = static_cast<MacPrivacyBackend*>(context);
-    if (type == kCGEventTapDisabledByTimeout || type == kCGEventTapDisabledByUserInput) {
-      self->tap_failed_ = true;
-      CGEventTapEnable(self->tap_, true); // Keep the local recovery chord usable.
-      return event;
-    }
-    if (!event) return event;
-    if (CGEventGetIntegerValueField(event, kCGEventSourceUserData) == kCrossDeskInjectedEvent &&
-        CGEventGetIntegerValueField(event, kCGEventSourceUnixProcessID) == getpid()) return event;
-    const auto flags = CGEventGetFlags(event);
-    const auto chord = kCGEventFlagMaskControl | kCGEventFlagMaskAlternate | kCGEventFlagMaskShift;
-    if (type == kCGEventKeyDown && (flags & chord) == chord &&
-        CGEventGetIntegerValueField(event, kCGKeyboardEventKeycode) == 53) {
-      self->emergency_ = true;
-      return nullptr;
-    }
-    return self->block_input_ ? nullptr : event;
-  }
-  std::shared_ptr<WindowState> state_;
-  CFRunLoopRef loop_ = nullptr;
-  CFRunLoopSourceRef wake_source_ = nullptr;
-  CFMachPortRef tap_ = nullptr;
-  CFRunLoopSourceRef tap_source_ = nullptr;
-  bool block_input_ = false;
-  bool emergency_ = false;
-  bool tap_failed_ = false;
-};
-}  // namespace
-
-void FlushMacPrivacyTasks() {
-  if (![NSThread isMainThread]) return;
-  std::deque<std::function<void()>> pending;
-  {
-    std::lock_guard lock(tasks_mutex);
-    pending.swap(tasks);
-  }
-  @autoreleasepool { for (auto& task : pending) task(); }
-}
-MacPrivacyCaptureState GetMacPrivacyCaptureState() {
-  std::lock_guard lock(capture_mutex);
-  return capture_state;
-}
-void AcknowledgeMacPrivacyCapture(uint64_t revision) {
-  std::lock_guard lock(capture_mutex);
-  if (revision == capture_state.revision) capture_state.applied_revision = revision;
-}
-std::unique_ptr<PrivacyBackend> CreateMacPrivacyBackend() {
-  return std::make_unique<MacPrivacyBackend>();
-}
-}  // namespace crossdesk
@@ -1,23 +0,0 @@
-/*
- * @Author: DI JUNKUN
- * @Date: 2026-09-13
- * Copyright (c) 2026 by DI JUNKUN, All Rights Reserved.
- */
-#ifndef _PRIVACY_CAPTURE_STATE_H_
-#define _PRIVACY_CAPTURE_STATE_H_
-
-#include <cstdint>
-#include <vector>
-
-namespace crossdesk {
-struct MacPrivacyCaptureState {
-  uint64_t revision = 0;
-  uint64_t applied_revision = 0;
-  std::vector<uint32_t> excluded_windows;
-  uint32_t cursor_window = 0;
-};
-MacPrivacyCaptureState GetMacPrivacyCaptureState();
-void AcknowledgeMacPrivacyCapture(uint64_t revision);
-}
-
-#endif
@@ -1,17 +0,0 @@
-/*
- * @Author: DI JUNKUN
- * @Date: 2026-09-13
- * Copyright (c) 2026 by DI JUNKUN, All Rights Reserved.
- */
-
-#ifndef _PRIVACY_COVER_VIEW_H_
-#define _PRIVACY_COVER_VIEW_H_
-
-#import <AppKit/AppKit.h>
-
-namespace crossdesk {
-// Returns nil if the CrossDesk icon resource cannot be loaded.
-NSView* CreateMacPrivacyCoverView(NSRect frame, NSString* unlock_hint);
-}
-
-#endif
@@ -1,106 +0,0 @@
-/* Copyright (c) 2026 by DI JUNKUN, All Rights Reserved. */
-
-#include "privacy_cover_view.h"
-
-#include <algorithm>
-#include <cmath>
-
-namespace {
-NSImage* LoadPrivacyLogo() {
-  // The macOS installer currently packages the icon as "crossedesk.icns".
-  for (NSString* name in @[@"crossdesk", @"crossedesk"]) {
-    NSString* path = [NSBundle.mainBundle pathForResource:name ofType:@"icns"];
-    if (path) {
-      NSImage* image = [[NSImage alloc] initWithContentsOfFile:path];
-      if (image.valid) return image;
-    }
-  }
-  // Support unbundled development builds, including launches from outside
-  // the repository. No source-tree path is embedded in the executable.
-  NSString* resource = @"apps/desktop/resources/macos/crossdesk.icns";
-  NSString* directory = NSBundle.mainBundle.executablePath.stringByDeletingLastPathComponent;
-  NSMutableArray<NSString*>* paths = [NSMutableArray arrayWithObject:
-      [NSFileManager.defaultManager.currentDirectoryPath stringByAppendingPathComponent:resource]];
-  for (int depth = 0; directory.length && depth <= 4; ++depth) {
-    [paths addObject:[directory stringByAppendingPathComponent:resource]];
-    directory = directory.stringByDeletingLastPathComponent;
-  }
-  for (NSString* path in paths) {
-    NSImage* image = [[NSImage alloc] initWithContentsOfFile:path.stringByStandardizingPath];
-    if (image.valid) return image;
-  }
-  return nil;
-}
-
-NSAttributedString* Text(NSString* value, CGFloat size, NSFontWeight weight, NSColor* color) {
-  NSMutableParagraphStyle* paragraph = [[NSMutableParagraphStyle alloc] init];
-  paragraph.lineBreakMode = NSLineBreakByWordWrapping;
-  return [[NSAttributedString alloc] initWithString:value attributes:@{
-      NSFontAttributeName: [NSFont systemFontOfSize:size weight:weight],
-      NSForegroundColorAttributeName: color,
-      NSParagraphStyleAttributeName: paragraph}];
-}
-constexpr NSStringDrawingOptions kTextOptions =
-    NSStringDrawingUsesLineFragmentOrigin | NSStringDrawingUsesFontLeading;
-
-CGFloat TextHeight(NSAttributedString* text, CGFloat width) {
-  return std::ceil([text boundingRectWithSize:NSMakeSize(width, CGFLOAT_MAX)
-                                    options:kTextOptions].size.height);
-}
-}
-
-@interface CrossDeskPrivacyCoverView : NSView
-@property(nonatomic, strong) NSImage* logo;
-@property(nonatomic, copy) NSString* unlockHint;
-@end
-
-@implementation CrossDeskPrivacyCoverView
- (BOOL)isOpaque { return YES; }
- (BOOL)isFlipped { return YES; }
- (void)drawRect:(NSRect)dirtyRect {
-  [NSColor.blackColor setFill];
-  NSRectFill(self.bounds);
-  const CGFloat width = NSWidth(self.bounds), height = NSHeight(self.bounds);
-  if (width <= 0 || height <= 0) return;
-  // Match the Windows cover's sizes, colors and bottom-left alignment.
-  // AppKit coordinates are points; Retina backing scale is applied by AppKit.
-  const CGFloat scale = std::min({CGFloat(1), width / 640, height / 200});
-  const CGFloat margin = 32 * scale, text_width = 398 * scale;
-  NSColor* foreground = [NSColor colorWithSRGBRed:245.0 / 255 green:247.0 / 255
-                                           blue:250.0 / 255 alpha:1];
-  NSColor* muted = [NSColor colorWithSRGBRed:181.0 / 255 green:190.0 / 255
-                                      blue:204.0 / 255 alpha:1];
-  NSAttributedString* brand = Text(@"CrossDesk", 14 * scale, NSFontWeightSemibold, foreground);
-  NSAttributedString* hint = Text(self.unlockHint, 16 * scale, NSFontWeightRegular, muted);
-  NSAttributedString* shortcut = Text(@"Control + Option + Shift + Esc", 24 * scale,
-                                      NSFontWeightSemibold, foreground);
-  const CGFloat logo_size = std::ceil(brand.size.width);
-  const CGFloat brand_height = TextHeight(brand, logo_size);
-  const CGFloat hint_height = TextHeight(hint, text_width);
-  const CGFloat shortcut_height = TextHeight(shortcut, text_width);
-  const CGFloat bottom = height - margin;
-  const CGFloat logo_top = bottom - brand_height - 6 * scale - logo_size;
-  [self.logo drawInRect:NSMakeRect(margin, logo_top, logo_size, logo_size)
-              fromRect:NSZeroRect operation:NSCompositingOperationSourceOver
-              fraction:1 respectFlipped:YES hints:@{NSImageHintInterpolation: @(NSImageInterpolationHigh)}];
-  [brand drawWithRect:NSMakeRect(margin, bottom - brand_height, logo_size, brand_height)
-             options:kTextOptions];
-  const CGFloat text_left = margin + logo_size + 24 * scale;
-  [hint drawWithRect:NSMakeRect(text_left, bottom - shortcut_height - 12 * scale - hint_height,
-                               text_width, hint_height) options:kTextOptions];
-  [shortcut drawWithRect:NSMakeRect(text_left, bottom - shortcut_height,
-                                   text_width, shortcut_height) options:kTextOptions];
-}
-@end
-
-namespace crossdesk {
-NSView* CreateMacPrivacyCoverView(NSRect frame, NSString* unlock_hint) {
-  NSImage* logo = LoadPrivacyLogo();
-  if (!logo) return nil;
-  auto* view = [[CrossDeskPrivacyCoverView alloc] initWithFrame:frame];
-  view.logo = logo;
-  view.unlockHint = unlock_hint ?: @"To turn off the privacy screen, press";
-  view.autoresizingMask = NSViewWidthSizable | NSViewHeightSizable;
-  return view;
-}
-}
@@ -1,35 +0,0 @@
-/*
- * @Author: DI JUNKUN
- * @Date: 2026-09-13
- * Copyright (c) 2026 by DI JUNKUN, All Rights Reserved.
- */
-
-#ifndef _PRIVACY_CURSOR_MAC_H_
-#define _PRIVACY_CURSOR_MAC_H_
-
-#include <memory>
-#include <cstdint>
-
-namespace crossdesk {
-// Main-thread resource. Hides only for the lifetime of a local privacy cover;
-// does not take focus, move the pointer, or suppress remote input.
-class MacPrivacyCursor {
- public:
-  MacPrivacyCursor();
-  ~MacPrivacyCursor();
-  static bool Supported();
-  bool Prepare();
-  bool Hide();
-  bool Healthy() const;
-  uint32_t WindowId() const;
-  void Restore();
- private:
-  struct Impl;
-  std::unique_ptr<Impl> impl_;
-};
-
-// Local hiding must not be reported as an invisible cursor to controllers.
-bool IsMacPrivacyCursorHidden();
-}
-
-#endif
@@ -1,157 +0,0 @@
-/* Copyright (c) 2026 by DI JUNKUN, All Rights Reserved. */
-#include "privacy_cursor_mac.h"
-
-#import <AppKit/AppKit.h>
-#import <ApplicationServices/ApplicationServices.h>
-#include <atomic>
-#include <dlfcn.h>
-
-@interface CrossDeskPrivacyCursorPanel : NSPanel
-@end
-@implementation CrossDeskPrivacyCursorPanel
- (BOOL)canBecomeKeyWindow { return NO; }
- (BOOL)canBecomeMainWindow { return NO; }
-@end
-
-namespace crossdesk {
-namespace {
-std::atomic<bool> hidden_by_privacy{false};
-struct CursorApi {
-  using Connection = int (*)();
-  using Copy = CGError (*)(int, int, CFStringRef, CFTypeRef*);
-  using Set = CGError (*)(int, int, CFStringRef, CFTypeRef);
-  Connection connection = reinterpret_cast<Connection>(dlsym(RTLD_DEFAULT, "CGSMainConnectionID"));
-  Copy copy = reinterpret_cast<Copy>(dlsym(RTLD_DEFAULT, "CGSCopyConnectionProperty"));
-  Set set = reinterpret_cast<Set>(dlsym(RTLD_DEFAULT, "CGSSetConnectionProperty"));
-};
-const CursorApi& Api() { static const CursorApi api; return api; }
-CFStringRef const kBackgroundCursor = CFSTR("SetsCursorInBackground");
-}
-
-struct MacPrivacyCursor::Impl {
-  int connection = 0;
-  bool previous_background = false;
-  bool background_changed = false;
-  unsigned hide_count = 0;
-  unsigned visible_ticks = 0;
-  bool healthy = true;
-  NSTimer* __strong timer = nil;
-  CrossDeskPrivacyCursorPanel* __strong panel = nil;
-  NSImageView* __strong view = nil;
-
-  void UpdateImage() {
-#pragma clang diagnostic push
-#pragma clang diagnostic ignored "-Wdeprecated-declarations"
-    NSCursor* cursor = NSCursor.currentSystemCursor ?: NSCursor.arrowCursor;
-#pragma clang diagnostic pop
-    NSImage* image = cursor.image;
-    if (!image || image.size.width <= 0 || image.size.height <= 0) return;
-    const NSPoint point = NSEvent.mouseLocation;
-    const NSSize size = image.size;
-    [panel setFrame:NSMakeRect(point.x - cursor.hotSpot.x,
-        point.y - size.height + cursor.hotSpot.y, size.width, size.height) display:NO];
-    view.image = image;
-    [panel displayIfNeeded];
-  }
-
-  bool KeepHidden() {
-#pragma clang diagnostic push
-#pragma clang diagnostic ignored "-Wdeprecated-declarations"
-    if (hide_count && !CGCursorIsVisible()) { visible_ticks = 0; return true; }
-#pragma clang diagnostic pop
-    if (++visible_ticks > 6 ||
-        CGDisplayHideCursor(kCGDirectMainDisplay) != kCGErrorSuccess) return false;
-    ++hide_count;
-    return true;
-  }
-};
-
-MacPrivacyCursor::MacPrivacyCursor() : impl_(std::make_unique<Impl>()) {}
-MacPrivacyCursor::~MacPrivacyCursor() { Restore(); }
-bool MacPrivacyCursor::Supported() {
-  return Api().connection && Api().copy && Api().set;
-}
-bool MacPrivacyCursor::Prepare() {
-  if (impl_->panel) return true;
-  if (!Supported()) return false;
-  // A cursor sprite below the local cover is captured only for clients that
-  // request an embedded cursor. Desktop clients exclude it and use metadata.
-  impl_->panel = [[CrossDeskPrivacyCursorPanel alloc] initWithContentRect:NSMakeRect(0, 0, 32, 32)
-      styleMask:NSWindowStyleMaskBorderless | NSWindowStyleMaskNonactivatingPanel
-      backing:NSBackingStoreBuffered defer:NO];
-  auto* panel = impl_->panel;
-  panel.releasedWhenClosed = NO;
-  panel.hidesOnDeactivate = NO;
-  panel.opaque = NO;
-  panel.backgroundColor = NSColor.clearColor;
-  panel.hasShadow = NO;
-  panel.ignoresMouseEvents = YES;
-  panel.level = CGWindowLevelForKey(kCGScreenSaverWindowLevelKey);
-  panel.animationBehavior = NSWindowAnimationBehaviorNone;
-  panel.collectionBehavior = NSWindowCollectionBehaviorCanJoinAllSpaces |
-      NSWindowCollectionBehaviorFullScreenAuxiliary | NSWindowCollectionBehaviorStationary |
-      NSWindowCollectionBehaviorIgnoresCycle;
-  panel.sharingType = NSWindowSharingReadOnly;
-  impl_->view = [[NSImageView alloc] initWithFrame:panel.contentView.bounds];
-  impl_->view.imageScaling = NSImageScaleNone;
-  impl_->view.autoresizingMask = NSViewWidthSizable | NSViewHeightSizable;
-  panel.contentView = impl_->view;
-  panel.alphaValue = 0;
-  impl_->UpdateImage();
-  [panel orderFrontRegardless];
-  return panel != nil && panel.windowNumber > 0;
-}
-bool MacPrivacyCursor::Hide() {
-  if (impl_->timer) return true;
-  if (!Prepare()) return false;
-  impl_->connection = Api().connection();
-  impl_->previous_background = false;
-  CFTypeRef previous = nullptr;
-  if (Api().copy(impl_->connection, impl_->connection, kBackgroundCursor, &previous) == kCGErrorSuccess && previous)
-    impl_->previous_background = CFEqual(previous, kCFBooleanTrue);
-  if (previous) CFRelease(previous);
-  // This connection-scoped WindowServer property is also used by Deskflow.
-  // Resolve it dynamically: an unavailable API disables optional privacy only.
-  if (Api().set(impl_->connection, impl_->connection, kBackgroundCursor, kCFBooleanTrue) != kCGErrorSuccess)
-    return false;
-  impl_->background_changed = true;
-  impl_->healthy = true;
-  impl_->visible_ticks = 0;
-  hidden_by_privacy = true;
-  if (!impl_->KeepHidden()) { Restore(); return false; }
-  impl_->UpdateImage();
-  impl_->panel.alphaValue = 1;
-  auto* state = impl_.get();
-  impl_->timer = [NSTimer timerWithTimeInterval:1.0 / 60 repeats:YES block:^(NSTimer*) {
-    if (state->healthy) state->healthy = state->KeepHidden();
-    state->UpdateImage();
-  }];
-  [[NSRunLoop mainRunLoop] addTimer:impl_->timer forMode:NSRunLoopCommonModes];
-  return true;
-}
-bool MacPrivacyCursor::Healthy() const { return impl_->timer && impl_->healthy; }
-uint32_t MacPrivacyCursor::WindowId() const {
-  return impl_->panel ? static_cast<uint32_t>(impl_->panel.windowNumber) : 0;
-}
-void MacPrivacyCursor::Restore() {
-  [impl_->timer invalidate];
-  impl_->timer = nil;
-  [impl_->panel orderOut:nil];
-  [impl_->panel close];
-  impl_->panel = nil;
-  impl_->view = nil;
-  // Balance only our own successful hide calls, including re-hides after
-  // WindowServer changes cursor ownership when a remote click activates an app.
-  while (impl_->hide_count) {
-    CGDisplayShowCursor(kCGDirectMainDisplay);
-    --impl_->hide_count;
-  }
-  hidden_by_privacy = false;
-  if (impl_->background_changed) {
-    Api().set(impl_->connection, impl_->connection, kBackgroundCursor,
-              impl_->previous_background ? kCFBooleanTrue : kCFBooleanFalse);
-    impl_->background_changed = false;
-  }
-}
-bool IsMacPrivacyCursorHidden() { return hidden_by_privacy.load(); }
-}
@@ -7,12 +7,6 @@ namespace crossdesk {
 ScreenCapturerSck::ScreenCapturerSck() {}
 ScreenCapturerSck::~ScreenCapturerSck() {}

-void ScreenCapturerSck::SetPrivacyController(PrivacyController* privacy) {
-  privacy_ = privacy;
-  if (screen_capturer_sck_impl_)
-    screen_capturer_sck_impl_->SetPrivacyController(privacy);
-}
-
 int ScreenCapturerSck::Init(const int fps, cb_desktop_data cb) {
  if (cb) {
    on_data_ = cb;
@@ -22,7 +16,6 @@ int ScreenCapturerSck::Init(const int fps, cb_desktop_data cb) {
  }

  screen_capturer_sck_impl_ = CreateScreenCapturerSck();
-  screen_capturer_sck_impl_->SetPrivacyController(privacy_);
  const int ret = screen_capturer_sck_impl_->Init(fps, on_data_);
  if (ret != 0) {
    screen_capturer_sck_impl_.reset();
@@ -25,7 +25,6 @@ class ScreenCapturerSck : public ScreenCapturer {

 public:
  int Init(const int fps, cb_desktop_data cb) override;
-  void SetPrivacyController(PrivacyController* privacy) override;
  int Destroy() override;
  int Start(bool show_cursor) override;
  int Stop() override;
@@ -58,7 +57,6 @@ class ScreenCapturerSck : public ScreenCapturer {

 private:
  std::unique_ptr<ScreenCapturer> screen_capturer_sck_impl_;
-  PrivacyController* privacy_ = nullptr;
 };
 }  // namespace crossdesk
-#endif
+#endif
@@ -26,9 +26,6 @@
 #include "display_info.h"
 #include <display_stream_id.h>
 #include "rd_log.h"
-#include "privacy_controller.h"
-#include "../privacy/privacy_capture_state.h"
-#include <algorithm>

 using namespace crossdesk;

@@ -113,18 +110,13 @@ API_AVAILABLE(macos(14.0))

 - (instancetype)initWithCapturer:(ScreenCapturerSckImpl *)capturer;

- (void)onShareableContentCreated:(SCShareableContent *)content generation:(uint64_t)generation
-                       revision:(uint64_t)revision;
+- (void)onShareableContentCreated:(SCShareableContent *)content;

 // Called just before the capturer is destroyed. This avoids a dangling pointer,
 // and prevents any new calls into a deleted capturer. If any method-call on the
 // capturer is currently running on a different thread, this blocks until it
 // completes.
 - (void)releaseCapturer;
- (void)privacyCoversChanged:(NSNotification*)notification;
- (void)configurationFinished:(SCStream*)stream generation:(uint64_t)generation
-                     revision:(uint64_t)revision complete:(BOOL)complete
-                configuration:(SCStreamConfiguration*)configuration error:(NSError*)error;
@end

 class API_AVAILABLE(macos(14.0)) ScreenCapturerSckImpl : public ScreenCapturer {
@@ -137,7 +129,6 @@ class API_AVAILABLE(macos(14.0)) ScreenCapturerSckImpl : public ScreenCapturer {

 public:
  int Init(const int fps, cb_desktop_data cb) override;
-  void SetPrivacyController(PrivacyController* privacy) override { privacy_ = privacy; }

  int Start(bool show_cursor) override;

@@ -165,30 +156,11 @@ class API_AVAILABLE(macos(14.0)) ScreenCapturerSckImpl : public ScreenCapturer {
  bool capture_requested_ = false;
  bool invalid_stream_id_logged_ = false;
  bool native_output_logged_ = false;
-  PrivacyController* privacy_ = nullptr;
-  uint64_t configuration_generation_ = 0;
-  bool configuration_in_flight_ = false;
-  bool reconfigure_pending_ = false;
-  SCStreamConfiguration* __strong applied_configuration_ = nil;

 public:
  // Called by SckHelper when shareable content is returned by ScreenCaptureKit. `content` will be
  // nil if an error occurred. May run on an arbitrary thread.
-  void OnShareableContentCreated(SCShareableContent *content, uint64_t generation,
-                                uint64_t revision);
-  void ConfigurationFinished(SCStream* source, uint64_t generation, uint64_t revision,
-                             bool complete, SCStreamConfiguration* configuration,
-                             NSError* error);
-  void RetryPrivacyFilter();
-  void PrivacyCoversChanged() { StartOrReconfigureCapturer(); }
-  void CaptureStopped(SCStream* source, NSError* error) {
-    {
-      std::lock_guard lock(lock_);
-      if (!capture_requested_ || source != stream_) return;
-    }
-    LOG_ERROR("ScreenCaptureKit stream stopped: {}", NSErrorToString(error));
-    if (privacy_) privacy_->Fail("ScreenCaptureKit stream stopped");
-  }
+  void OnShareableContentCreated(SCShareableContent *content);
  // Called by SckHelper to notify of a newly captured frame. May run on an arbitrary thread.
  // void OnNewIOSurface(IOSurfaceRef io_surface, CFDictionaryRef attachment);
  void OnNewCVPixelBuffer(CVPixelBufferRef pixelBuffer, CFDictionaryRef attachment);
@@ -417,7 +389,6 @@ int ScreenCapturerSckImpl::Start(bool show_cursor) {
    capture_requested_ = true;
    invalid_stream_id_logged_ = false;
  }
-  if (privacy_) privacy_->CaptureChanged(true);
  StartOrReconfigureCapturer();
  return 0;
 }
@@ -475,7 +446,6 @@ int ScreenCapturerSckImpl::ResetToInitialMonitor() {
 }

 int ScreenCapturerSckImpl::Destroy() {
-  if (privacy_) privacy_->CaptureChanged(false);
  SckHelper *helper_to_release = nil;
  {
    std::lock_guard<std::mutex> lock(lock_);
@@ -485,9 +455,6 @@ int ScreenCapturerSckImpl::Destroy() {
      stream_ = nil;
    }
    capture_requested_ = false;
-    configuration_in_flight_ = reconfigure_pending_ = false;
-    applied_configuration_ = nil;
-    ++configuration_generation_;
    current_display_ = 0;
    current_stream_id_.clear();
    permanent_error_ = false;
@@ -502,12 +469,8 @@ int ScreenCapturerSckImpl::Destroy() {
 }

 int ScreenCapturerSckImpl::Stop() {
-  if (privacy_) privacy_->CaptureChanged(false);
  std::lock_guard<std::mutex> lock(lock_);
  capture_requested_ = false;
-  configuration_in_flight_ = reconfigure_pending_ = false;
-  applied_configuration_ = nil;
-  ++configuration_generation_;
  if (stream_) {
    LOG_INFO("Stopping stream");
    [stream_ stopCaptureWithCompletionHandler:nil];
@@ -518,36 +481,24 @@ int ScreenCapturerSckImpl::Stop() {
  return 0;
 }

-void ScreenCapturerSckImpl::OnShareableContentCreated(SCShareableContent *content,
-                                                     uint64_t generation, uint64_t revision) {
+void ScreenCapturerSckImpl::OnShareableContentCreated(SCShareableContent *content) {
  {
    std::lock_guard<std::mutex> lock(lock_);
-    if (!capture_requested_ || generation != configuration_generation_) {
+    if (!capture_requested_) {
      LOG_INFO("Ignoring stale ScreenCaptureKit display refresh after stop");
      return;
    }
  }

-  // The window list belongs to the privacy revision present when the request
-  // was issued. A newer cover must be enumerated by a new request.
-  if (GetMacPrivacyCaptureState().revision != revision) {
-    StartOrReconfigureCapturer();
-    return;
-  }
-
  if (!content) {
    LOG_ERROR("getShareableContent failed");
-    if (privacy_) privacy_->Fail("Could not refresh ScreenCaptureKit privacy content");
-    std::lock_guard lock(lock_);
-    if (!stream_) permanent_error_ = true;
+    permanent_error_ = true;
    return;
  }

  if (!content.displays || content.displays.count == 0) {
    LOG_ERROR("getShareableContent returned no displays");
-    if (privacy_) privacy_->Fail("No shareable displays available for privacy");
-    std::lock_guard lock(lock_);
-    if (!stream_) permanent_error_ = true;
+    permanent_error_ = true;
    return;
  }

@@ -555,7 +506,7 @@ void ScreenCapturerSckImpl::OnShareableContentCreated(SCShareableContent *conten
  bool show_cursor = false;
  {
    std::lock_guard<std::mutex> lock(lock_);
-    if (!capture_requested_ || generation != configuration_generation_) return;
+    if (!capture_requested_) return;

    int logical_index = current_monitor_index_;
    if (logical_index < 0 ||
@@ -625,40 +576,8 @@ void ScreenCapturerSckImpl::OnShareableContentCreated(SCShareableContent *conten
    return;
  }

-  const auto privacy_capture = GetMacPrivacyCaptureState();
-  // The cursor sprite is included only when this stream embeds the cursor.
-  // Other controllers receive the unchanged cursor metadata separately.
-  auto excluded_ids = privacy_capture.excluded_windows;
-  if (!show_cursor && privacy_capture.cursor_window)
-    excluded_ids.push_back(privacy_capture.cursor_window);
-  NSMutableArray<SCWindow*>* excluded = [NSMutableArray array];
-  for (SCWindow* window in content.windows) {
-    if (std::find(excluded_ids.begin(), excluded_ids.end(), window.windowID) != excluded_ids.end())
-      [excluded addObject:window];
-  }
-  // Newly registered transparent covers may need another enumeration. Never
-  // acknowledge a partial exclusion or remove an active cover's filter.
-  const bool privacy_filter_complete = excluded.count == excluded_ids.size();
-  LOG_INFO("macOS privacy filter: generation={}, revision={}, requested={}, excluded={}",
-           generation, privacy_capture.revision, excluded_ids.size(),
-           excluded.count);
-  if (!privacy_filter_complete) {
-    bool have_stream;
-    { std::lock_guard lock(lock_); have_stream = stream_ != nil; }
-    if (privacy_capture.applied_revision == privacy_capture.revision) {
-      if (privacy_) privacy_->Fail("ScreenCaptureKit could not enumerate every privacy cover");
-      return; // Preserve the existing exclusion until recovery removes covers.
-    }
-    if (have_stream) {
-      RetryPrivacyFilter();
-      return; // Transparent covers are still being registered by WindowServer.
-    }
-    // Start ordinary capture even if a newly created, still-transparent cover
-    // is not enumerable yet. Retry exclusion after start; never acknowledge it.
-    [excluded removeAllObjects];
-  }
  SCContentFilter *filter = [[SCContentFilter alloc] initWithDisplay:captured_display
-                                                    excludingWindows:excluded];
+                                                    excludingWindows:@[]];
  if (!filter) {
    LOG_ERROR("Failed to create SCContentFilter");
    permanent_error_ = true;
@@ -679,39 +598,13 @@ void ScreenCapturerSckImpl::OnShareableContentCreated(SCShareableContent *conten
  config.captureResolution = SCCaptureResolutionAutomatic;
  config.minimumFrameInterval = CMTimeMake(1, fps_);

-  std::unique_lock<std::mutex> lock(lock_);
-  if (!capture_requested_ || generation != configuration_generation_) return;
-  if (configuration_in_flight_) { reconfigure_pending_ = true; return; }
-  if (GetMacPrivacyCaptureState().revision != revision) {
-    lock.unlock();
-    RetryPrivacyFilter();
-    return;
-  }
-  configuration_in_flight_ = true;
+  std::lock_guard<std::mutex> lock(lock_);
+  if (!capture_requested_) return;

  if (stream_) {
-    SckHelper* helper = helper_;
-    SCStream* source = stream_;
-    auto finished = ^(NSError* error) {
-      [helper configurationFinished:source generation:generation revision:revision
-                            complete:privacy_filter_complete configuration:config error:error];
-    };
-    // Apply configuration before its filter and acknowledge the final update.
-    // Privacy-only toggles do not need a configuration change.
-    const bool same_config = applied_configuration_ &&
-        applied_configuration_.width == config.width &&
-        applied_configuration_.height == config.height &&
-        applied_configuration_.showsCursor == config.showsCursor &&
-        applied_configuration_.pixelFormat == config.pixelFormat &&
-        CMTimeCompare(applied_configuration_.minimumFrameInterval, config.minimumFrameInterval) == 0;
-    if (same_config) {
-      [source updateContentFilter:filter completionHandler:finished];
-    } else {
-      [source updateConfiguration:config completionHandler:^(NSError* error) {
-        if (error) finished(error);
-        else [source updateContentFilter:filter completionHandler:finished];
-      }];
-    }
+    LOG_INFO("Updating stream configuration");
+    [stream_ updateContentFilter:filter completionHandler:nil];
+    [stream_ updateConfiguration:config completionHandler:nil];
  } else {
    stream_ = [[SCStream alloc] initWithFilter:filter configuration:config delegate:helper_];

@@ -725,62 +618,28 @@ void ScreenCapturerSckImpl::OnShareableContentCreated(SCShareableContent *conten
                                                       error:&add_stream_output_error];

    if (!add_stream_output_result) {
-      configuration_in_flight_ = false;
      stream_ = nil;
      LOG_ERROR("addStreamOutput failed: {}", NSErrorToString(add_stream_output_error));
      permanent_error_ = true;
      return;
    }

-    SckHelper* helper = helper_;
-    SCStream* source = stream_;
    auto handler = ^(NSError *error) {
-      [helper configurationFinished:source generation:generation revision:revision
-                            complete:privacy_filter_complete configuration:config error:error];
+      if (error) {
+        // It should be safe to access `this` here, because the C++ destructor
+        // calls stopCaptureWithCompletionHandler on the stream, which cancels
+        // this handler.
+        permanent_error_ = true;
+        LOG_ERROR("startCaptureWithCompletionHandler failed: {}", NSErrorToString(error));
+      } else {
+        LOG_INFO("Capture started");
+      }
    };

    [stream_ startCaptureWithCompletionHandler:handler];
  }
 }

-void ScreenCapturerSckImpl::RetryPrivacyFilter() {
-  SckHelper* helper;
-  {
-    std::lock_guard lock(lock_);
-    if (!capture_requested_) return;
-    helper = helper_;
-  }
-  // The retained helper safely ignores this callback after Destroy().
-  dispatch_after(dispatch_time(DISPATCH_TIME_NOW, 50 * NSEC_PER_MSEC),
-                 dispatch_get_main_queue(), ^{ [helper privacyCoversChanged:nil]; });
-}
-
-void ScreenCapturerSckImpl::ConfigurationFinished(SCStream* source, uint64_t generation,
-                                                  uint64_t revision, bool complete,
-                                                  SCStreamConfiguration* configuration,
-                                                  NSError* error) {
-  bool refresh = false;
-  {
-    std::lock_guard lock(lock_);
-    if (!capture_requested_ || source != stream_) return;
-    configuration_in_flight_ = false;
-    const auto current = GetMacPrivacyCaptureState();
-    refresh = reconfigure_pending_ || current.revision != revision;
-    reconfigure_pending_ = false;
-    if (!error) {
-      applied_configuration_ = configuration;
-      if (complete && !refresh && generation == configuration_generation_)
-        AcknowledgeMacPrivacyCapture(revision);
-      refresh = refresh || !complete;
-    }
-    LOG_INFO("macOS privacy filter completed: generation={}, revision={}, complete={}, refresh={}, error={}",
-             generation, revision, complete, refresh, NSErrorToString(error));
-  }
-  if (error && privacy_)
-    privacy_->Fail("ScreenCaptureKit privacy filter: " + NSErrorToString(error));
-  if (refresh) RetryPrivacyFilter();
-}
-
 void ScreenCapturerSckImpl::OnNewCVPixelBuffer(CVPixelBufferRef pixelBuffer,
                                               CFDictionaryRef attachment) {
  (void)attachment;
@@ -868,18 +727,7 @@ void ScreenCapturerSckImpl::StartOrReconfigureCapturer() {
    }
  }

-  SckHelper *local_helper;
-  uint64_t generation;
-  uint64_t revision;
-  {
-    std::lock_guard lock(lock_);
-    if (!capture_requested_) return;
-    if (configuration_in_flight_) { reconfigure_pending_ = true; return; }
-    reconfigure_pending_ = false;
-    local_helper = helper_;
-    generation = ++configuration_generation_;
-    revision = GetMacPrivacyCaptureState().revision;
-  }
+  SckHelper *local_helper = helper_;
  if (!local_helper) {
    LOG_ERROR("Cannot reconfigure capturer: helper is null");
    return;
@@ -888,14 +736,12 @@ void ScreenCapturerSckImpl::StartOrReconfigureCapturer() {
  auto handler = ^(SCShareableContent *content, NSError *error) {
    if (error) {
      LOG_ERROR("getShareableContent failed: {}", NSErrorToString(error));
-      [local_helper onShareableContentCreated:nil generation:generation revision:revision];
+      [local_helper onShareableContentCreated:nil];
      return;
    }
-    [local_helper onShareableContentCreated:content generation:generation revision:revision];
+    [local_helper onShareableContentCreated:content];
  };
-  [SCShareableContent getShareableContentExcludingDesktopWindows:NO
-                                           onScreenWindowsOnly:NO
-                                             completionHandler:handler];
+  [SCShareableContent getShareableContentWithCompletionHandler:handler];
 }

@implementation SckHelper {
@@ -909,28 +755,14 @@ void ScreenCapturerSckImpl::StartOrReconfigureCapturer() {
  self = [super init];
  if (self) {
    _capturer = capturer;
-    [NSNotificationCenter.defaultCenter addObserver:self selector:@selector(privacyCoversChanged:)
-        name:@"CrossDeskPrivacyCoversChanged" object:nil];
  }
  return self;
 }

- (void)privacyCoversChanged:(NSNotification*)notification {
-  std::lock_guard<std::mutex> lock(_capturer_lock);
-  if (_capturer) _capturer->PrivacyCoversChanged();
-}
- (void)configurationFinished:(SCStream*)stream generation:(uint64_t)generation
-                     revision:(uint64_t)revision complete:(BOOL)complete
-                configuration:(SCStreamConfiguration*)configuration error:(NSError*)error {
-  std::lock_guard<std::mutex> lock(_capturer_lock);
-  if (_capturer)
-    _capturer->ConfigurationFinished(stream, generation, revision, complete, configuration, error);
-}
- (void)onShareableContentCreated:(SCShareableContent *)content generation:(uint64_t)generation
-                       revision:(uint64_t)revision {
+- (void)onShareableContentCreated:(SCShareableContent *)content {
  std::lock_guard<std::mutex> lock(_capturer_lock);
  if (_capturer) {
-    _capturer->OnShareableContentCreated(content, generation, revision);
+    _capturer->OnShareableContentCreated(content);
  } else {
    LOG_ERROR("Invalid capturer");
  }
@@ -965,16 +797,10 @@ void ScreenCapturerSckImpl::StartOrReconfigureCapturer() {
 }

 - (void)releaseCapturer {
-  [NSNotificationCenter.defaultCenter removeObserver:self];
  std::lock_guard<std::mutex> lock(_capturer_lock);
  _capturer = nullptr;
 }

- (void)stream:(SCStream*)stream didStopWithError:(NSError*)error {
-  std::lock_guard<std::mutex> lock(_capturer_lock);
-  if (_capturer) _capturer->CaptureStopped(stream, error);
-}
-
@end

 std::unique_ptr<ScreenCapturer> ScreenCapturerSck::CreateScreenCapturerSck() {
@@ -114,9 +114,6 @@ void GuiRuntime::HandleWindowsServiceIntegration() {

  bool force_broadcast = false;
  if (pending_windows_service_sas_.exchange(false, std::memory_order_relaxed)) {
-    if (privacy_.Engaged()) {
-      privacy_.Fail("Security shortcut requested; privacy screen will turn off");
-    }
    const std::string response =
        QueryCrossDeskService("sas", kWindowsServiceSasTimeoutMs);
    auto json = nlohmann::json::parse(response, nullptr, false);
@@ -1,20 +1,16 @@
 #include "mouse_controller.h"

-#include <Windows.h>
 #include <remote_action.h>

-#include <algorithm>
-#include <cmath>
+#include <Windows.h>

-#include "../../windows_thread_dpi.h"
 #include "rd_log.h"
-#include "windows_input_marker.h"

 namespace crossdesk {

 PlatformMouseController::PlatformMouseController() {}

-PlatformMouseController::~PlatformMouseController() { Destroy(); }
+PlatformMouseController::~PlatformMouseController() {}

 int PlatformMouseController::Init(std::vector<DisplayInfo> display_info_list) {
  display_info_list_ = display_info_list;
@@ -22,27 +18,10 @@ int PlatformMouseController::Init(std::vector<DisplayInfo> display_info_list) {
  return 0;
 }

-int PlatformMouseController::Destroy() { return ReleasePressedButtons(); }
-
-int PlatformMouseController::ReleasePressedButtons() {
-  const unsigned pressed = pressed_buttons_.load();
-  if (!pressed) return 0;
-  INPUT input{};
-  input.type = INPUT_MOUSE;
-  input.mi.dwExtraInfo = kInjectedMouseInputMarker;
-  if (pressed & 1) input.mi.dwFlags |= MOUSEEVENTF_LEFTUP;
-  if (pressed & 2) input.mi.dwFlags |= MOUSEEVENTF_RIGHTUP;
-  if (pressed & 4) input.mi.dwFlags |= MOUSEEVENTF_MIDDLEUP;
-  if (SendInput(1, &input, sizeof(INPUT)) != 1) {
-    LOG_WARN("Release remote mouse buttons failed, error={}", GetLastError());
-    return -1;
-  }
-  pressed_buttons_.fetch_and(~pressed);
-  return 0;
-}
+int PlatformMouseController::Destroy() { return 0; }

 int PlatformMouseController::SendMouseCommand(RemoteAction remote_action,
-                                              int display_index) {
+                                      int display_index) {
  if (display_index < 0 ||
      display_index >= static_cast<int>(display_info_list_.size())) {
    LOG_WARN("Mouse command skipped, invalid display_index={}, displays={}",
@@ -51,82 +30,68 @@ int PlatformMouseController::SendMouseCommand(RemoteAction remote_action,
  }

  INPUT ip = {0};
-  ScopedWindowsPhysicalCoordinates physical_coordinates;

-  if (remote_action.type != ControlType::mouse) return 0;
-  if (!std::isfinite(remote_action.m.x) || !std::isfinite(remote_action.m.y))
-    return -1;
-  ip.type = INPUT_MOUSE;
-  ip.mi.dx = (LONG)(std::clamp(remote_action.m.x, 0.0f, 1.0f) *
-                    (display_info_list_[display_index].width - 1)) +
-             display_info_list_[display_index].left;
-  ip.mi.dy = (LONG)(std::clamp(remote_action.m.y, 0.0f, 1.0f) *
-                    (display_info_list_[display_index].height - 1)) +
-             display_info_list_[display_index].top;
+  if (remote_action.type == ControlType::mouse) {
+    ip.type = INPUT_MOUSE;
+    ip.mi.dx =
+        (LONG)(remote_action.m.x * display_info_list_[display_index].width) +
+        display_info_list_[display_index].left;
+    ip.mi.dy =
+        (LONG)(remote_action.m.y * display_info_list_[display_index].height) +
+        display_info_list_[display_index].top;

-  switch (remote_action.m.flag) {
-    case MouseFlag::left_down:
-      ip.mi.dwFlags = MOUSEEVENTF_LEFTDOWN;
-      break;
-    case MouseFlag::left_up:
-      ip.mi.dwFlags = MOUSEEVENTF_LEFTUP;
-      break;
-    case MouseFlag::right_down:
-      ip.mi.dwFlags = MOUSEEVENTF_RIGHTDOWN;
-      break;
-    case MouseFlag::right_up:
-      ip.mi.dwFlags = MOUSEEVENTF_RIGHTUP;
-      break;
-    case MouseFlag::middle_down:
-      ip.mi.dwFlags = MOUSEEVENTF_MIDDLEDOWN;
-      break;
-    case MouseFlag::middle_up:
-      ip.mi.dwFlags = MOUSEEVENTF_MIDDLEUP;
-      break;
-    case MouseFlag::wheel_vertical:
-      ip.mi.dwFlags = MOUSEEVENTF_WHEEL;
-      ip.mi.mouseData = remote_action.m.s * 120;
-      break;
-    case MouseFlag::wheel_horizontal:
-      ip.mi.dwFlags = MOUSEEVENTF_HWHEEL;
-      ip.mi.mouseData = remote_action.m.s * 120;
-      break;
-    default:
-      break;
-  }
+    switch (remote_action.m.flag) {
+      case MouseFlag::left_down:
+        ip.mi.dwFlags = MOUSEEVENTF_LEFTDOWN | MOUSEEVENTF_ABSOLUTE;
+        break;
+      case MouseFlag::left_up:
+        ip.mi.dwFlags = MOUSEEVENTF_LEFTUP | MOUSEEVENTF_ABSOLUTE;
+        break;
+      case MouseFlag::right_down:
+        ip.mi.dwFlags = MOUSEEVENTF_RIGHTDOWN | MOUSEEVENTF_ABSOLUTE;
+        break;
+      case MouseFlag::right_up:
+        ip.mi.dwFlags = MOUSEEVENTF_RIGHTUP | MOUSEEVENTF_ABSOLUTE;
+        break;
+      case MouseFlag::middle_down:
+        ip.mi.dwFlags = MOUSEEVENTF_MIDDLEDOWN | MOUSEEVENTF_ABSOLUTE;
+        break;
+      case MouseFlag::middle_up:
+        ip.mi.dwFlags = MOUSEEVENTF_MIDDLEUP | MOUSEEVENTF_ABSOLUTE;
+        break;
+      case MouseFlag::wheel_vertical:
+        ip.mi.dwFlags = MOUSEEVENTF_WHEEL;
+        ip.mi.mouseData = remote_action.m.s * 120;
+        break;
+      case MouseFlag::wheel_horizontal:
+        ip.mi.dwFlags = MOUSEEVENTF_HWHEEL;
+        ip.mi.mouseData = remote_action.m.s * 120;
+        break;
+      default:
+        ip.mi.dwFlags = MOUSEEVENTF_MOVE;
+        break;
+    }

-  const int virtual_left = GetSystemMetrics(SM_XVIRTUALSCREEN);
-  const int virtual_top = GetSystemMetrics(SM_YVIRTUALSCREEN);
-  const int virtual_width = GetSystemMetrics(SM_CXVIRTUALSCREEN);
-  const int virtual_height = GetSystemMetrics(SM_CYVIRTUALSCREEN);
-  if (virtual_width <= 0 || virtual_height <= 0) {
-    LOG_WARN("Remote mouse skipped: invalid virtual desktop geometry");
-    return -1;
+    ip.mi.time = 0;
+
+    if (!SetCursorPos(ip.mi.dx, ip.mi.dy)) {
+      LOG_WARN("SetCursorPos failed for mouse x={}, y={}, flag={}, err={}",
+               ip.mi.dx, ip.mi.dy, static_cast<int>(remote_action.m.flag),
+               GetLastError());
+      return -1;
+    }
+
+    if (ip.mi.dwFlags != MOUSEEVENTF_MOVE) {
+      UINT sent = SendInput(1, &ip, sizeof(INPUT));
+      if (sent != 1) {
+        LOG_WARN(
+            "SendInput failed for mouse x={}, y={}, wheel={}, flag={}, err={}",
+            ip.mi.dx, ip.mi.dy, remote_action.m.s,
+            static_cast<int>(remote_action.m.flag), GetLastError());
+        return -1;
+      }
+    }
  }
-  // Pixel centres in the virtual desktop, including negative monitor origins.
-  // SetCursorPos cannot carry dwExtraInfo through the privacy mouse hook.
-  ip.mi.dx = static_cast<LONG>(
-      (static_cast<int64_t>(ip.mi.dx - virtual_left) * 65536 + 32768) /
-      virtual_width);
-  ip.mi.dy = static_cast<LONG>(
-      (static_cast<int64_t>(ip.mi.dy - virtual_top) * 65536 + 32768) /
-      virtual_height);
-  ip.mi.dwFlags |=
-      MOUSEEVENTF_MOVE | MOUSEEVENTF_ABSOLUTE | MOUSEEVENTF_VIRTUALDESK;
-  ip.mi.dwExtraInfo = kInjectedMouseInputMarker;
-  const UINT sent = SendInput(1, &ip, sizeof(INPUT));
-  if (sent != 1) {
-    LOG_WARN("SendInput failed for mouse x={}, y={}, wheel={}, flag={}, err={}",
-             ip.mi.dx, ip.mi.dy, remote_action.m.s,
-             static_cast<int>(remote_action.m.flag), GetLastError());
-    return -1;
-  }
-  if (ip.mi.dwFlags & MOUSEEVENTF_LEFTDOWN) pressed_buttons_.fetch_or(1);
-  if (ip.mi.dwFlags & MOUSEEVENTF_RIGHTDOWN) pressed_buttons_.fetch_or(2);
-  if (ip.mi.dwFlags & MOUSEEVENTF_MIDDLEDOWN) pressed_buttons_.fetch_or(4);
-  if (ip.mi.dwFlags & MOUSEEVENTF_LEFTUP) pressed_buttons_.fetch_and(~1u);
-  if (ip.mi.dwFlags & MOUSEEVENTF_RIGHTUP) pressed_buttons_.fetch_and(~2u);
-  if (ip.mi.dwFlags & MOUSEEVENTF_MIDDLEUP) pressed_buttons_.fetch_and(~4u);

  return 0;
 }
@@ -8,7 +8,6 @@
 #define _MOUSE_CONTROLLER_H_

 #include <vector>
-#include <atomic>

 #include <remote_action.h>

@@ -26,11 +25,9 @@ class PlatformMouseController final : public MouseController {
  virtual int Init(std::vector<DisplayInfo> display_info_list);
  virtual int Destroy();
  virtual int SendMouseCommand(RemoteAction remote_action, int display_index);
-  int ReleasePressedButtons();

 private:
  std::vector<DisplayInfo> display_info_list_;
-  std::atomic<unsigned> pressed_buttons_{0};
 };
 }  // namespace crossdesk
 #endif
@@ -9,7 +9,6 @@ namespace crossdesk {
 // keyboard input so the controller hook can ignore only its own injections
 // while still accepting input from accessibility tools or remote sessions.
 inline constexpr std::uintptr_t kInjectedKeyboardInputMarker = 0x4353444B;
-inline constexpr std::uintptr_t kInjectedMouseInputMarker = 0x4353444D;

 }  // namespace crossdesk

@@ -1,293 +0,0 @@
-/*
- * @Author: DI JUNKUN
- * @Date: 2026-09-10
- * Copyright (c) 2026 by DI JUNKUN, All Rights Reserved.
- */
-
-#include <Windows.h>
-#include <dwmapi.h>
-
-#include <algorithm>
-#include <array>
-#include <cwchar>
-#include <vector>
-
-#include "../../windows_thread_dpi.h"
-#include "../privacy_band_ipc.h"
-#include "privacy_cover_renderer.h"
-
-namespace {
-using namespace crossdesk;
-constexpr wchar_t kWindowClass[] = L"CrossDesk.HighBandPrivacy";
-constexpr DWORD kCoverStyles = WS_EX_TOPMOST | WS_EX_NOACTIVATE |
-                               WS_EX_TOOLWINDOW | WS_EX_LAYERED |
-                               WS_EX_TRANSPARENT;
-HMODULE module = nullptr;
-
-bool SameRect(const RECT& a, const RECT& b) {
-  return a.left == b.left && a.top == b.top && a.right == b.right &&
-         a.bottom == b.bottom;
-}
-
-class Windows {
- public:
-  explicit Windows(PrivacyBandShared* shared) : shared_(shared) {}
-  ~Windows() {
-    for (const auto& window : windows_)
-      DestroyWindow(reinterpret_cast<HWND>(window.hwnd));
-    if (atom_) UnregisterClassW(kWindowClass, module);
-  }
-  bool Fail(const wchar_t* operation, DWORD code = GetLastError()) {
-    wcsncpy_s(shared_->operation, operation, _TRUNCATE);
-    InterlockedExchange(&shared_->error, code ? code : ERROR_GEN_FAILURE);
-    return false;
-  }
-  bool Initialize() {
-    const HMODULE user = GetModuleHandleW(L"user32.dll");
-    create_ = reinterpret_cast<CreatePrivacyWindowInBand>(
-        GetProcAddress(user, "CreateWindowInBand"));
-    get_band_ = reinterpret_cast<GetPrivacyWindowBand>(
-        GetProcAddress(user, "GetWindowBand"));
-    if (!create_ || !get_band_)
-      return Fail(L"Resolve high-band APIs", ERROR_PROC_NOT_FOUND);
-    WNDCLASSEXW cls{sizeof(cls)};
-    cls.hInstance = module;
-    cls.lpfnWndProc = WindowProc;
-    cls.lpszClassName = kWindowClass;
-    cls.hbrBackground = static_cast<HBRUSH>(GetStockObject(BLACK_BRUSH));
-    atom_ = RegisterClassExW(&cls);
-    return atom_ ? Reconcile() : Fail(L"Register high-band window class");
-  }
-  bool Reconcile() {
-    std::vector<RECT> monitors;
-    if (!EnumDisplayMonitors(
-            nullptr, nullptr,
-            [](HMONITOR, HDC, LPRECT rect, LPARAM data) -> BOOL {
-              auto& result = *reinterpret_cast<std::vector<RECT>*>(data);
-              if (result.size() >= kPrivacyMaxMonitors) return FALSE;
-              result.push_back(*rect);
-              return TRUE;
-            },
-            reinterpret_cast<LPARAM>(&monitors)) ||
-        monitors.empty())
-      return Fail(L"Enumerate high-band displays");
-    bool changed = monitors.size() != windows_.size();
-    for (const auto& rect : monitors) {
-      const auto found =
-          std::find_if(windows_.begin(), windows_.end(),
-                       [&](const auto& w) { return SameRect(w.rect, rect); });
-      if (found != windows_.end()) continue;
-      changed = true;
-      HWND hwnd = create_(kCoverStyles, atom_, L"CrossDesk Privacy", WS_POPUP,
-                          rect.left, rect.top, rect.right - rect.left,
-                          rect.bottom - rect.top, nullptr, nullptr, module,
-                          this, kPrivacyWindowBand);
-      if (!hwnd) return Fail(L"CreateWindowInBand ZBID_ABOVELOCK_UX");
-      windows_.push_back({reinterpret_cast<uint64_t>(hwnd), rect});
-      if (!SetLayeredWindowAttributes(hwnd, 0, 255, LWA_ALPHA))
-        return Fail(L"Make high-band cover opaque");
-      if (!SetWindowDisplayAffinity(hwnd, 0x11))
-        return Fail(L"Exclude high-band cover from capture");
-      const BOOL yes = TRUE;
-      const HRESULT peek = DwmSetWindowAttribute(hwnd, DWMWA_EXCLUDED_FROM_PEEK,
-                                                 &yes, sizeof(yes));
-      if (FAILED(peek)) return Fail(L"Exclude high-band cover from Peek", peek);
-      if (!SetWindowPos(hwnd, nullptr, rect.left, rect.top,
-                        rect.right - rect.left, rect.bottom - rect.top,
-                        SWP_NOZORDER | SWP_NOACTIVATE | SWP_SHOWWINDOW) ||
-          !RedrawWindow(hwnd, nullptr, nullptr, RDW_INVALIDATE | RDW_UPDATENOW))
-        return Fail(L"Present high-band cover");
-    }
-    if (changed) {
-      const HRESULT result = DwmFlush();
-      if (FAILED(result))
-        return Fail(L"Flush high-band cover presentation", result);
-      // New areas are covered before old windows are removed.
-      for (auto it = windows_.begin(); it != windows_.end();) {
-        if (std::none_of(
-                monitors.begin(), monitors.end(),
-                [&](const auto& rect) { return SameRect(rect, it->rect); })) {
-          if (!DestroyWindow(reinterpret_cast<HWND>(it->hwnd)))
-            return Fail(L"Destroy obsolete high-band cover");
-          it = windows_.erase(it);
-        } else
-          ++it;
-      }
-    }
-    if (!Validate()) return false;
-    if (changed) {
-      InterlockedIncrement(&shared_->sequence);
-      shared_->count = static_cast<uint32_t>(windows_.size());
-      std::copy(windows_.begin(), windows_.end(), shared_->windows);
-      InterlockedIncrement(&shared_->sequence);
-    }
-    return true;
-  }
-  bool Validate() {
-    if (paint_failed_) return false;
-    for (const auto& w : windows_) {
-      HWND hwnd = reinterpret_cast<HWND>(w.hwnd);
-      DWORD band = 0, affinity = 0, flags = 0, cloaked = 0;
-      BYTE alpha = 0;
-      RECT rect{};
-      if ((GetWindowLongPtrW(hwnd, GWL_EXSTYLE) & kCoverStyles) !=
-              kCoverStyles ||
-          !get_band_(hwnd, &band) || band != kPrivacyWindowBand ||
-          !GetWindowDisplayAffinity(hwnd, &affinity) || affinity != 0x11 ||
-          !GetLayeredWindowAttributes(hwnd, nullptr, &alpha, &flags) ||
-          alpha != 255 || flags != LWA_ALPHA || !IsWindowVisible(hwnd) ||
-          !GetWindowRect(hwnd, &rect) || !SameRect(rect, w.rect) ||
-          FAILED(DwmGetWindowAttribute(hwnd, DWMWA_CLOAKED, &cloaked,
-                                       sizeof(cloaked))) ||
-          cloaked)
-        return Fail(L"High-band cover lost style/band/affinity/visibility",
-                    ERROR_INVALID_STATE);
-    }
-    return true;
-  }
-  bool changed = false;
-
- private:
-  static LRESULT CALLBACK WindowProc(HWND hwnd, UINT message, WPARAM wp,
-                                     LPARAM lp) {
-    if (message == WM_NCCREATE) {
-      auto create = reinterpret_cast<CREATESTRUCTW*>(lp);
-      SetWindowLongPtrW(hwnd, GWLP_USERDATA,
-                        reinterpret_cast<LONG_PTR>(create->lpCreateParams));
-    }
-    auto self =
-        reinterpret_cast<Windows*>(GetWindowLongPtrW(hwnd, GWLP_USERDATA));
-    if (message == WM_MOUSEACTIVATE) return MA_NOACTIVATE;
-    if (message == WM_NCHITTEST) return HTTRANSPARENT;
-    if (message == WM_SETCURSOR) {
-      SetCursor(nullptr);
-      return TRUE;
-    }
-    if (message == WM_CLOSE) return 0;
-    if ((message == WM_DISPLAYCHANGE || message == WM_DPICHANGED) && self) {
-      self->changed = true;
-      InvalidateRect(hwnd, nullptr, TRUE);
-      return 0;
-    }
-    if (message == WM_PAINT) {
-      PAINTSTRUCT paint{};
-      HDC dc = BeginPaint(hwnd, &paint);
-      RECT rect{};
-      GetClientRect(hwnd, &rect);
-      if (self && !DrawPrivacyCover(dc, rect, PrivacyWindowDpi(hwnd), module,
-                                    self->shared_->unlock_hint)) {
-        self->paint_failed_ = true;
-        self->Fail(L"Paint privacy logo and unlock instructions");
-      }
-      EndPaint(hwnd, &paint);
-      return 0;
-    }
-    return DefWindowProcW(hwnd, message, wp, lp);
-  }
-  PrivacyBandShared* shared_;
-  bool paint_failed_ = false;
-  std::vector<PrivacyBandWindow> windows_;
-  ATOM atom_ = 0;
-  CreatePrivacyWindowInBand create_ = nullptr;
-  GetPrivacyWindowBand get_band_ = nullptr;
-};
-
-DWORD WINAPI Run(void*) {
-  wchar_t bootstrap[256]{};
-  if (!GetEnvironmentVariableW(kPrivacyBandBootstrap, bootstrap, 256))
-    return ERROR_INVALID_PARAMETER;
-  SetEnvironmentVariableW(kPrivacyBandBootstrap, nullptr);
-  std::array<HANDLE, 4> handles{};
-  wchar_t* item = bootstrap;
-  for (size_t i = 0; i < handles.size(); ++i) {
-    wchar_t* end = nullptr;
-    const auto value = wcstoull(item, &end, 10);
-    if (!value || end == item ||
-        (i + 1 == handles.size() ? *end != 0 : *end != L','))
-      return ERROR_INVALID_PARAMETER;
-    handles[i] = reinterpret_cast<HANDLE>(value);
-    item = end + 1;
-  }
-  HANDLE parent = handles[0], stop = handles[1], ready = handles[2],
-         mapping = handles[3];
-  auto shared = static_cast<PrivacyBandShared*>(MapViewOfFile(
-      mapping, FILE_MAP_ALL_ACCESS, 0, 0, sizeof(PrivacyBandShared)));
-  if (!shared) return GetLastError();
-  if (shared->magic != kPrivacyBandMagic ||
-      shared->version != kPrivacyBandVersion ||
-      shared->size != sizeof(PrivacyBandShared) ||
-      shared->broker_pid != GetCurrentProcessId() ||
-      shared->parent_pid != GetProcessId(parent) ||
-      WaitForSingleObject(parent, 0) != WAIT_TIMEOUT) {
-    UnmapViewOfFile(shared);
-    return ERROR_INVALID_DATA;
-  }
-  DWORD exit_code = ERROR_SUCCESS;
-  {
-    ScopedWindowsPhysicalCoordinates dpi;
-    Windows windows(shared);
-    try {
-      bool healthy = dpi.active() && windows.Initialize();
-      const bool initialized = healthy;
-      if (!dpi.active()) windows.Fail(L"Set high-band thread DPI context");
-      InterlockedExchange64(&shared->heartbeat, GetTickCount64());
-      if (healthy) {
-        InterlockedExchange(&shared->error, ERROR_SUCCESS);
-        InterlockedExchange(&shared->active, 1);
-      }
-      SetEvent(ready);
-      auto last_check = GetTickCount64();
-      HANDLE watched[] = {parent, stop};
-      // Once enabled, retain surviving covers on a validation/layout fault.
-      // The parent pauses the session after reading the latched error. Only
-      // an explicit stop or parent death tears the remaining windows down.
-      while (initialized) {
-        const DWORD wait = MsgWaitForMultipleObjectsEx(
-            2, watched, 100, QS_ALLINPUT, MWMO_INPUTAVAILABLE);
-        if (wait == WAIT_OBJECT_0 || wait == WAIT_OBJECT_0 + 1) break;
-        if (wait == WAIT_FAILED) {
-          windows.Fail(L"Wait for high-band lifecycle");
-          break;
-        }
-        MSG message{};
-        while (PeekMessageW(&message, nullptr, 0, 0, PM_REMOVE)) {
-          if (message.message == WM_QUIT) healthy = false;
-          TranslateMessage(&message);
-          DispatchMessageW(&message);
-        }
-        const auto now = GetTickCount64();
-        if (healthy && (windows.changed || now - last_check >= 250)) {
-          windows.changed = false;
-          last_check = now;
-          healthy = windows.Reconcile();
-        }
-        InterlockedExchange64(&shared->heartbeat, now);
-      }
-    } catch (...) {
-      windows.Fail(L"High-band window thread exception",
-                   ERROR_UNHANDLED_EXCEPTION);
-      SetEvent(ready);
-    }
-    exit_code = InterlockedCompareExchange(&shared->error, 0, 0);
-    InterlockedExchange(&shared->active, 0);
-  }
-  UnmapViewOfFile(shared);
-  for (HANDLE handle : handles) CloseHandle(handle);
-  // This module runs only in the dedicated process created for this session.
-  // Exit outside DllMain/loader lock, after HWND destruction on their UI
-  // thread.
-  ExitProcess(exit_code);
-  return exit_code;
-}
-}  // namespace
-
-BOOL WINAPI DllMain(HINSTANCE instance, DWORD reason, LPVOID) {
-  if (reason == DLL_PROCESS_ATTACH) {
-    module = instance;
-    // Keep thread notifications enabled: this module uses the static CRT.
-    HANDLE thread = CreateThread(nullptr, 0, Run, nullptr, 0, nullptr);
-    if (!thread) return FALSE;
-    CloseHandle(thread);
-  }
-  return TRUE;
-}
@@ -1,123 +0,0 @@
-/*
- * @Author: DI JUNKUN
- * @Date: 2026-09-11
- * Copyright (c) 2026 by DI JUNKUN, All Rights Reserved.
- */
-
-#include "privacy_cover_renderer.h"
-
-#include <algorithm>
-#include <array>
-
-namespace crossdesk {
-namespace {
-
-constexpr size_t kInstructionLines = 2;
-constexpr size_t kBrandLine = kInstructionLines;
-
-struct PaintResources {
-  HDC dc;
-  int saved;
-  HICON logo = nullptr;
-  std::array<HFONT, kInstructionLines + 1> fonts{};
-  ~PaintResources() {
-    // Deselect every owned GDI object before releasing it.
-    if (saved) RestoreDC(dc, saved);
-    for (auto font : fonts)
-      if (font) DeleteObject(font);
-    if (logo) DestroyIcon(logo);
-  }
-};
-
-bool Select(HDC dc, HGDIOBJ object) {
-  const auto previous = SelectObject(dc, object);
-  return previous && previous != HGDI_ERROR;
-}
-
-}  // namespace
-
-bool DrawPrivacyCover(HDC dc, const RECT& rect, UINT dpi, HINSTANCE module,
-                      const wchar_t* unlock_hint) {
-  if (!FillRect(dc, &rect, static_cast<HBRUSH>(GetStockObject(BLACK_BRUSH))))
-    return false;
-  const int width = rect.right - rect.left;
-  const int height = rect.bottom - rect.top;
-  if (width <= 0 || height <= 0) return false;
-  // Scale with the monitor DPI, shrinking the whole group on small displays.
-  // All coordinates remain in the owning window's physical-pixel context.
-  const double scale = (std::min)({dpi / 96.0, width / 640.0, height / 200.0});
-  const auto px = [scale](int value) {
-    return (std::max)(1, static_cast<int>(value * scale + 0.5));
-  };
-  const int margin = px(32);
-  const int text_width = px(398);
-  PaintResources resources{dc, SaveDC(dc)};
-  if (!resources.saved || !SetBkMode(dc, TRANSPARENT)) return false;
-
-  struct Line {
-    const wchar_t* text;
-    int size;
-    int weight;
-    COLORREF color;
-    RECT bounds{};
-  };
-  std::array<Line, kInstructionLines + 1> lines{{
-      {unlock_hint, 16, FW_NORMAL, RGB(181, 190, 204)},
-      {L"Ctrl + Alt + Shift + F12", 24, FW_SEMIBOLD, RGB(245, 247, 250)},
-      {L"CrossDesk", 14, FW_SEMIBOLD, RGB(245, 247, 250)},
-  }};
-  constexpr UINT flags = DT_LEFT | DT_WORDBREAK | DT_NOPREFIX;
-  for (size_t i = 0; i < lines.size(); ++i) {
-    auto& line = lines[i];
-    resources.fonts[i] =
-        CreateFontW(-px(line.size), 0, 0, 0, line.weight, FALSE, FALSE, FALSE,
-                    DEFAULT_CHARSET, OUT_DEFAULT_PRECIS, CLIP_DEFAULT_PRECIS,
-                    ANTIALIASED_QUALITY, DEFAULT_PITCH, L"Microsoft YaHei UI");
-    if (!resources.fonts[i] || !Select(dc, resources.fonts[i])) return false;
-    line.bounds = {0, 0, text_width, 0};
-    if (!DrawTextW(dc, line.text, -1, &line.bounds, flags | DT_CALCRECT) ||
-        line.bounds.right > text_width)
-      return false;
-  }
-  const int content_height =
-      static_cast<int>(lines[0].bounds.bottom + lines[1].bounds.bottom) +
-      px(12);
-  // Match the icon width to the name; each side keeps its own height.
-  const int brand_gap = px(6);
-  const int brand_width = static_cast<int>(lines[kBrandLine].bounds.right);
-  const int logo_size = brand_width;
-  const int brand_height =
-      logo_size + brand_gap + static_cast<int>(lines[kBrandLine].bounds.bottom);
-  if (logo_size <= 0 ||
-      (std::max)(brand_height, content_height) + 2 * margin > height ||
-      brand_width + px(24) + text_width + 2 * margin > width)
-    return false;
-  resources.logo = static_cast<HICON>(LoadImageW(
-      module, L"IDI_CROSSDESK_LOGO", IMAGE_ICON, logo_size, logo_size, 0));
-  if (!resources.logo) return false;
-  const int brand_left = rect.left + margin;
-  const int left = brand_left + brand_width + px(24);
-  const int brand_top = rect.bottom - margin - brand_height;
-  int top = rect.bottom - margin - content_height;
-  if (!DrawIconEx(dc, brand_left, brand_top, resources.logo, logo_size,
-                  logo_size, 0, nullptr, DI_NORMAL))
-    return false;
-  if (!Select(dc, resources.fonts[kBrandLine])) return false;
-  RECT brand_bounds{brand_left, brand_top + logo_size + brand_gap,
-                    brand_left + brand_width, rect.bottom - margin};
-  SetTextColor(dc, lines[kBrandLine].color);
-  if (!DrawTextW(dc, lines[kBrandLine].text, -1, &brand_bounds,
-                 DT_CENTER | DT_SINGLELINE | DT_NOPREFIX))
-    return false;
-  for (size_t i = 0; i < kInstructionLines; ++i) {
-    const auto& line = lines[i];
-    if (!Select(dc, resources.fonts[i])) return false;
-    RECT bounds{left, top, left + text_width, top + line.bounds.bottom};
-    SetTextColor(dc, line.color);
-    if (!DrawTextW(dc, line.text, -1, &bounds, flags)) return false;
-    top += line.bounds.bottom + px(12);
-  }
-  return true;
-}
-
-}  // namespace crossdesk
@@ -1,20 +0,0 @@
-/*
- * @Author: DI JUNKUN
- * @Date: 2026-09-11
- * Copyright (c) 2026 by DI JUNKUN, All Rights Reserved.
- */
-
-#ifndef _PRIVACY_COVER_RENDERER_H_
-#define _PRIVACY_COVER_RENDERER_H_
-
-#include <Windows.h>
-
-namespace crossdesk {
-
-// Paints the local, opaque cover. The caller owns the HWND and its DPI context.
-bool DrawPrivacyCover(HDC dc, const RECT& rect, UINT dpi, HINSTANCE module,
-                      const wchar_t* unlock_hint);
-
-}  // namespace crossdesk
-
-#endif  // _PRIVACY_COVER_RENDERER_H_
@@ -1,83 +0,0 @@
-/*
- * @Author: DI JUNKUN
- * @Date: 2026-09-11
- * Copyright (c) 2026 by DI JUNKUN, All Rights Reserved.
- */
-
-#include <Windows.h>
-
-#include <cerrno>
-#include <cstdint>
-#include <cwchar>
-#include <limits>
-
-#include "../privacy_cursor_api.h"
-
-namespace {
-HANDLE ParseHandle(const wchar_t* text) {
-  wchar_t* end = nullptr;
-  errno = 0;
-  const auto value = std::wcstoull(text, &end, 10);
-  if (errno || !text[0] || *end || text[0] == L'-' || value == 0 ||
-      value > (std::numeric_limits<uintptr_t>::max)())
-    return nullptr;
-  return reinterpret_cast<HANDLE>(static_cast<uintptr_t>(value));
-}
-DWORD FailureCode() {
-  const DWORD code = GetLastError();
-  return code ? code : ERROR_GEN_FAILURE;
-}
-}  // namespace
-
-int wmain(int argc, wchar_t** argv) {
-  if (argc != 5) return ERROR_INVALID_PARAMETER;
-  HANDLE parent = ParseHandle(argv[1]);
-  HANDLE stop = ParseHandle(argv[2]);
-  HANDLE ready = ParseHandle(argv[3]);
-  HANDLE mapping = ParseHandle(argv[4]);
-  // Observe the inherited process OBJECT, never a reused PID or a process name.
-  if (!parent || !stop || !ready || !mapping ||
-      WaitForSingleObject(parent, 0) != WAIT_TIMEOUT ||
-      WaitForSingleObject(stop, 0) != WAIT_TIMEOUT)
-    return ERROR_INVALID_HANDLE;
-  auto shared = static_cast<crossdesk::PrivacyCursorReady*>(MapViewOfFile(
-      mapping, FILE_MAP_WRITE, 0, 0, sizeof(crossdesk::PrivacyCursorReady)));
-  if (!shared) return static_cast<int>(FailureCode());
-
-  crossdesk::PrivacyCursorApi cursor;
-  DWORD error = ERROR_SUCCESS;
-  if (!cursor.Initialize() || !cursor.Hide()) error = FailureCode();
-  InterlockedExchange(&shared->error, static_cast<LONG>(error));
-  if (!SetEvent(ready)) error = FailureCode();
-  if (!error) {
-    HANDLE watched[] = {parent, stop};
-    for (;;) {
-      const DWORD result =
-          MsgWaitForMultipleObjects(2, watched, FALSE, 250, QS_ALLINPUT);
-      if (result == WAIT_OBJECT_0 || result == WAIT_OBJECT_0 + 1) break;
-      if (result == WAIT_OBJECT_0 + 2) {
-        MSG message{};
-        while (PeekMessageW(&message, nullptr, 0, 0, PM_REMOVE)) {
-          TranslateMessage(&message);
-          DispatchMessageW(&message);
-        }
-      } else if (result != WAIT_TIMEOUT) {
-        error = FailureCode();
-        break;
-      }
-      if (!cursor.Hide()) {
-        error = FailureCode();
-        break;
-      }
-    }
-  }
-  // Also runs when the parent is force-terminated or crashes. The helper does
-  // not own any input hooks or privacy HWNDs and never changes magnification.
-  if (!cursor.RestoreAndClose()) error = FailureCode();
-  UnmapViewOfFile(shared);
-  CloseHandle(mapping);
-  CloseHandle(ready);
-  CloseHandle(stop);
-  CloseHandle(parent);
-  return static_cast<int>(error);
-}
@@ -1,573 +0,0 @@
-/*
- * @Author: DI JUNKUN
- * @Date: 2026-09-11
- * Copyright (c) 2026 by DI JUNKUN, All Rights Reserved.
- */
-
-#include <ShlObj.h>
-#include <Windows.h>
-#include <dwmapi.h>
-#include <winternl.h>
-#include <wtsapi32.h>
-
-#include <algorithm>
-#include <vector>
-
-#include "../windows_thread_dpi.h"
-#include "privacy_backend.h"
-#include "privacy_band_guard.h"
-#include "privacy_cursor_guard.h"
-#include "privacy_input_guard.h"
-#include "privacy_window_visibility.h"
-#include "rd_log.h"
-
-#ifndef WDA_EXCLUDEFROMCAPTURE
-#define WDA_EXCLUDEFROMCAPTURE 0x00000011
-#endif
-
-namespace crossdesk {
-namespace {
-
-constexpr wchar_t kClassName[] = L"CrossDesk.PrivacyWindow";
-constexpr UINT kEmergency = WM_APP + 71;
-constexpr int kHotkeyId = 0x4353;
-
-std::string Error(const char* operation, DWORD code = GetLastError()) {
-  const std::string result = std::string(operation) +
-                             " failed (Windows error " + std::to_string(code) +
-                             ")";
-  LOG_ERROR("Privacy: {}", result);
-  return result;
-}
-
-bool DesktopName(HDESK desktop, wchar_t (&name)[256]) {
-  DWORD needed = 0;
-  return desktop && GetUserObjectInformationW(desktop, UOI_NAME, name,
-                                              sizeof(name), &needed);
-}
-
-bool SameRect(const RECT& a, const RECT& b) {
-  return a.left == b.left && a.top == b.top && a.right == b.right &&
-         a.bottom == b.bottom;
-}
-
-struct MonitorEnumeration {
-  std::vector<RECT> rects;
-  bool ok = true;
-};
-
-BOOL CALLBACK EnumMonitor(HMONITOR monitor, HDC, LPRECT, LPARAM data) {
-  auto& result = *reinterpret_cast<MonitorEnumeration*>(data);
-  MONITORINFO info{sizeof(info)};
-  if (!GetMonitorInfoW(monitor, &info)) {
-    Error("GetMonitorInfoW");
-    result.ok = false;
-    return FALSE;
-  }
-  result.rects.push_back(info.rcMonitor);
-  return TRUE;
-}
-
-class WindowsPrivacyBackend final : public PrivacyBackend {
- public:
-  WindowsPrivacyBackend() {
-    wake_event_ = CreateEventW(nullptr, FALSE, FALSE, nullptr);
-    if (!wake_event_) wake_error_ = Error("CreateEventW privacy commands");
-  }
-
-  ~WindowsPrivacyBackend() override {
-    Recover();
-    if (sink_) DestroyWindow(sink_);
-    if (registered_) UnregisterClassW(kClassName, GetModuleHandleW(nullptr));
-    if (wake_event_) CloseHandle(wake_event_);
-  }
-
-  PrivacyCapabilities Query() override {
-    if (!wake_event_) return {false, false, wake_error_};
-    using RtlGetVersionFn = LONG(WINAPI*)(PRTL_OSVERSIONINFOW);
-    const auto rtl = reinterpret_cast<RtlGetVersionFn>(
-        GetProcAddress(GetModuleHandleW(L"ntdll.dll"), "RtlGetVersion"));
-    RTL_OSVERSIONINFOW version{};
-    version.dwOSVersionInfoSize = sizeof(version);
-    if (!rtl || rtl(&version) != 0 || version.dwMajorVersion < 10 ||
-        version.dwBuildNumber < 19041) {
-      return {false, false, "Requires Windows 10 2004 (build 19041) or later"};
-    }
-    BOOL composed = FALSE;
-    if (FAILED(DwmIsCompositionEnabled(&composed)) || !composed) {
-      return {false, false, "Desktop composition is unavailable"};
-    }
-    if (GetSystemMetrics(SM_REMOTESESSION)) {
-      return {false, false, "Privacy screen requires a local console session"};
-    }
-    if (!IsWindowsPrivacyDesktopAvailable()) {
-      return {false, false,
-              "Privacy screen requires the unlocked Default desktop"};
-    }
-    QUERY_USER_NOTIFICATION_STATE shell_state{};
-    if (FAILED(SHQueryUserNotificationState(&shell_state)) ||
-        shell_state == QUNS_RUNNING_D3D_FULL_SCREEN) {
-      return {false, false,
-              "Exclusive fullscreen or unknown display presentation cannot "
-              "guarantee privacy coverage"};
-    }
-    std::string high_band_error;
-    if (!PrivacyBandGuard::Available(high_band_error))
-      return {false, false, high_band_error};
-    return {true, true,
-            "High-band privacy screen available"};
-  }
-
-  bool Enable(bool block_input, const PrivacyScreenText& text,
-              std::string& error) override {
-    const auto caps = Query();
-    if (!caps.overlay) {
-      error = caps.reason;
-      return false;
-    }
-    if (!Initialize(error)) return false;
-    emergency_ = false;
-    health_error_.clear();
-    if (!RegisterHotKey(sink_, kHotkeyId,
-                        MOD_CONTROL | MOD_ALT | MOD_SHIFT | MOD_NOREPEAT,
-                        VK_F12)) {
-      error = Error("RegisterHotKey Ctrl+Alt+Shift+F12");
-      return false;
-    }
-    hotkey_ = true;
-    if (!cursor_guard_.Start(error)) return false;
-    block_input_ = block_input;
-    if (block_input && !input_guard_.Start(sink_, kEmergency, error))
-      return false;
-    if (!band_guard_.Start(text, error)) return false;
-    if (!ReconcileMonitors(error)) return false;
-    event_owner_ = this;
-    for (DWORD event : {EVENT_OBJECT_SHOW, EVENT_OBJECT_REORDER,
-                        EVENT_OBJECT_LOCATIONCHANGE}) {
-      auto hook = SetWinEventHook(event, event, nullptr, WindowEvent, 0, 0,
-                                  WINEVENT_OUTOFCONTEXT);
-      if (!hook) {
-        error = Error("Watch privacy window coverage changes");
-        return false;
-      }
-      window_events_.push_back(hook);
-    }
-    return true;
-  }
-
-  void Recover() override {
-    for (auto& hook : window_events_) {
-      if (UnhookWinEvent(hook))
-        hook = nullptr;
-      else
-        Error("Unhook privacy window events");
-    }
-    window_events_.erase(
-        std::remove(window_events_.begin(), window_events_.end(), nullptr),
-        window_events_.end());
-    if (window_events_.empty()) event_owner_ = nullptr;
-    std::string band_error;
-    band_guard_.Stop(band_error);
-    if (band_guard_.stopped()) windows_.clear();
-    input_guard_.Stop();
-    block_input_ = false;
-    if (hotkey_) {
-      if (UnregisterHotKey(sink_, kHotkeyId) ||
-          GetLastError() == ERROR_HOTKEY_NOT_REGISTERED)
-        hotkey_ = false;
-      else
-        Error("UnregisterHotKey");
-    }
-    // The sink lives across sessions. Do not let an already-posted emergency
-    // command from a closed session cancel a subsequent connection.
-    if (sink_) {
-      MSG discarded{};
-      while (PeekMessageW(&discarded, sink_, WM_HOTKEY, WM_HOTKEY, PM_REMOVE)) {
-      }
-      while (
-          PeekMessageW(&discarded, sink_, kEmergency, kEmergency, PM_REMOVE)) {
-      }
-    }
-    last_check_ = 0;
-    last_health_ = {};
-    last_obstruction_ = nullptr;
-    last_obstruction_log_ = 0;
-    layout_changed_ = false;
-    coverage_dirty_ = false;
-    emergency_ = false;
-    health_error_.clear();
-    std::string cursor_error;
-    cursor_guard_.Stop(cursor_error);
-  }
-
-  bool IsRecovered() const override {
-    return band_guard_.stopped() && windows_.empty() &&
-           window_events_.empty() && input_guard_.stopped() && !hotkey_ &&
-           cursor_guard_.stopped();
-  }
-
-  void Wake() override {
-    if (wake_event_) SetEvent(wake_event_);
-  }
-
-  void WaitForEvents(unsigned timeout_ms) override {
-    const DWORD result = MsgWaitForMultipleObjectsEx(
-        wake_event_ ? 1 : 0, wake_event_ ? &wake_event_ : nullptr, timeout_ms,
-        QS_ALLINPUT, MWMO_INPUTAVAILABLE);
-    if (result == WAIT_FAILED)
-      health_error_ = Error("MsgWaitForMultipleObjectsEx privacy thread");
-  }
-
-  PrivacyHealth Poll() override {
-    MSG message{};
-    while (PeekMessageW(&message, nullptr, 0, 0, PM_REMOVE)) {
-      if (message.message == WM_QUIT)
-        health_error_ =
-            "Privacy message thread is exiting";
-      TranslateMessage(&message);
-      DispatchMessageW(&message);
-    }
-    if (emergency_) {
-      emergency_ = false;
-      return {{}, true};
-    }
-    if (block_input_) {
-      std::string error;
-      if (!input_guard_.Healthy(error)) return {error, false};
-    }
-    if (windows_.empty()) return {health_error_, false};
-    // Input messages wake the thread immediately; expensive health queries
-    // must retain their own cadence instead of running once per input event.
-    if (!layout_changed_ &&
-        GetTickCount64() - last_check_ < 100) {
-      if (coverage_dirty_ && last_health_.failure.empty()) {
-        coverage_dirty_ = false;
-        last_health_ = CheckCoverage();
-      }
-      return last_health_;
-    }
-    coverage_dirty_ = false;
-    last_check_ = GetTickCount64();
-    last_health_ = CheckHealth();
-    return last_health_;
-  }
-
- private:
-  PrivacyHealth CheckHealth() {
-    if (!health_error_.empty()) return {health_error_, false};
-    if (!band_guard_.Healthy(health_error_)) return {health_error_, false};
-    if (!IsWindowsPrivacyDesktopAvailable()) {
-      std::string cursor_error;
-      cursor_guard_.Stop(cursor_error);
-      return {
-          "Secure desktop, lock screen or unavailable input desktop; "
-          "privacy screen will turn off",
-          false};
-    }
-    std::string cursor_error;
-    if (!cursor_guard_.Healthy(cursor_error)) return {cursor_error, false};
-    QUERY_USER_NOTIFICATION_STATE shell_state{};
-    if (FAILED(SHQueryUserNotificationState(&shell_state)) ||
-        shell_state == QUNS_RUNNING_D3D_FULL_SCREEN) {
-      return {
-          "Exclusive fullscreen or unknown display presentation",
-          false};
-    }
-    MonitorEnumeration monitors;
-    if (!EnumDisplayMonitors(nullptr, nullptr, EnumMonitor,
-                             reinterpret_cast<LPARAM>(&monitors)) ||
-        !monitors.ok) {
-      return {Error("EnumDisplayMonitors"), false};
-    }
-    const bool changed =
-        monitors.rects.size() != windows_.size() ||
-        std::any_of(monitors.rects.begin(), monitors.rects.end(),
-                    [this](const RECT& rect) {
-                      return std::none_of(windows_.begin(), windows_.end(),
-                                          [&](const auto& w) {
-                                            return SameRect(w.rect, rect);
-                                          });
-                    });
-    if (changed || layout_changed_) {
-      layout_changed_ = false;
-      // Retain old covers until the monitor check completes, then release
-      // privacy so capture can refresh its display mapping independently.
-      std::string error;
-      if (!ReconcileMonitors(error))
-        health_error_ = error;
-      else
-        health_error_ =
-            "Display layout/DPI changed; privacy screen will turn off";
-    }
-    if (!health_error_.empty()) return {health_error_, false};
-    BOOL composed = FALSE;
-    if (FAILED(DwmIsCompositionEnabled(&composed)) || !composed) {
-      return {
-          "Desktop composition stopped; privacy coverage cannot be guaranteed",
-          false};
-    }
-    return CheckCoverage();
-  }
-
-  PrivacyHealth CheckCoverage() {
-    const auto get_band = reinterpret_cast<GetPrivacyWindowBand>(
-        GetProcAddress(GetModuleHandleW(L"user32.dll"), "GetWindowBand"));
-    if (!get_band) return {"High-band window API became unavailable", false};
-    for (const auto& w : windows_) {
-      DWORD band = 0;
-      DWORD affinity = 0;
-      BYTE alpha = 0;
-      DWORD layered_flags = 0;
-      RECT rect{};
-      DWORD cloaked = 0;
-      if (!get_band(w.cover, &band) || band != kPrivacyWindowBand ||
-          !IsWindowVisible(w.cover) || !GetWindowRect(w.cover, &rect) ||
-          !SameRect(rect, w.rect) ||
-          !(GetWindowLongPtrW(w.cover, GWL_EXSTYLE) & WS_EX_TOPMOST) ||
-          !GetLayeredWindowAttributes(w.cover, nullptr, &alpha,
-                                      &layered_flags) ||
-          alpha != 255 || layered_flags != LWA_ALPHA ||
-          !GetWindowDisplayAffinity(w.cover, &affinity) ||
-          affinity != WDA_EXCLUDEFROMCAPTURE ||
-          FAILED(DwmGetWindowAttribute(w.cover, DWMWA_CLOAKED, &cloaked,
-                                       sizeof(cloaked))) ||
-          cloaked) {
-        return {
-            "Privacy window visibility, geometry or capture affinity was lost",
-            false};
-      }
-    }
-    for (const auto& w : windows_) {
-      // Detect windows in special bands above the cover. A high-band window
-      // still cannot cover another desktop or guarantee exclusive fullscreen.
-      for (HWND above = GetWindow(w.cover, GW_HWNDPREV); above;
-           above = GetWindow(above, GW_HWNDPREV)) {
-        if (!IsWindowVisible(above) || IsIconic(above)) continue;
-        DWORD above_band = 0;
-        if (!get_band(above, &above_band))
-          return {"Could not inspect a window above the high-band cover",
-                  false};
-        // HWND list order alone does not express compositor band order.
-        // Only skip the two known ordinary desktop bands, never unknown bands.
-        if (above_band == 0 || above_band == 1) continue;
-        if (std::any_of(windows_.begin(), windows_.end(),
-                        [above](const auto& own) {
-                          return above == own.cover;
-                        }))
-          continue;
-        RECT bounds{}, intersection{};
-        DWORD hidden = 0;
-        if (SUCCEEDED(DwmGetWindowAttribute(above, DWMWA_CLOAKED, &hidden,
-                                            sizeof(hidden))) &&
-            hidden)
-          continue;
-        if (GetWindowRect(above, &bounds) &&
-            IntersectRect(&intersection, &bounds, &w.rect)) {
-          if (IsNonObstructingPrivacyWindow(above, bounds)) continue;
-          char window_class[128]{};
-          DWORD process_id = 0;
-          GetClassNameA(above, window_class, sizeof(window_class));
-          GetWindowThreadProcessId(above, &process_id);
-          const auto now = GetTickCount64();
-          if (above != last_obstruction_ ||
-              now - last_obstruction_log_ >= 1000) {
-            LOG_WARN(
-                "Potential privacy cover overlap: class={}, process={}, "
-                "band={}, bounds=({}, {})-({}, {}), exstyle=0x{:x}",
-                window_class, process_id, above_band, bounds.left, bounds.top,
-                bounds.right, bounds.bottom,
-                GetWindowLongPtrW(above, GWL_EXSTYLE));
-            last_obstruction_ = above;
-            last_obstruction_log_ = now;
-          }
-          // HWND order cannot prove compositor order, but this window may
-          // display content. Report failure so optional privacy is released.
-          return {
-              "A visible window may overlap privacy coverage",
-              false};
-        }
-      }
-    }
-    return {health_error_, false};
-  }
-
-  struct Window {
-    RECT rect{};
-    HWND cover = nullptr;
-  };
-
-  bool Initialize(std::string& error) {
-    if (sink_) return true;
-    // This dedicated thread owns no existing application windows. Never alter
-    // process-wide or Slint/SDL DPI awareness.
-    if (!dpi_scope_ || !dpi_scope_->active()) {
-      dpi_scope_.reset();
-      dpi_scope_ = std::make_unique<ScopedWindowsPhysicalCoordinates>();
-    }
-    if (!dpi_scope_->active()) {
-      error = Error("SetThreadDpiAwarenessContext");
-      return false;
-    }
-    WNDCLASSEXW cls{sizeof(cls)};
-    cls.lpfnWndProc = WindowProc;
-    cls.hInstance = GetModuleHandleW(nullptr);
-    cls.lpszClassName = kClassName;
-    cls.hCursor = nullptr;
-    cls.hbrBackground = static_cast<HBRUSH>(GetStockObject(BLACK_BRUSH));
-    if (!registered_ && !RegisterClassExW(&cls)) {
-      error = Error("RegisterClassExW");
-      return false;
-    }
-    registered_ = true;
-    sink_ = CreateWindowExW(WS_EX_TOOLWINDOW | WS_EX_NOACTIVATE, kClassName,
-                            L"", WS_POPUP, 0, 0, 0, 0, nullptr, nullptr,
-                            cls.hInstance, this);
-    if (!sink_) {
-      error = Error("CreateWindowExW message sink");
-      return false;
-    }
-    return true;
-  }
-
-  bool ReconcileMonitors(std::string& error) {
-    MonitorEnumeration monitors;
-    if (!EnumDisplayMonitors(nullptr, nullptr, EnumMonitor,
-                             reinterpret_cast<LPARAM>(&monitors)) ||
-        !monitors.ok || monitors.rects.empty()) {
-      error = Error("EnumDisplayMonitors");
-      return false;
-    }
-    std::vector<PrivacyBandWindow> covers;
-    if (!band_guard_.Windows(covers, error)) return false;
-    for (const RECT& rect : monitors.rects) {
-      auto existing =
-          std::find_if(windows_.begin(), windows_.end(),
-                       [&](const auto& w) { return SameRect(w.rect, rect); });
-      if (existing != windows_.end()) continue;
-      const auto cover = std::find_if(covers.begin(), covers.end(),
-                                      [&](const auto& candidate) {
-                                        return SameRect(candidate.rect, rect);
-                                      });
-      if (cover == covers.end()) {
-        error = "High-band broker has not covered every physical monitor";
-        return false;
-      }
-      windows_.push_back({rect, reinterpret_cast<HWND>(cover->hwnd)});
-      LOG_INFO(
-          "Privacy high-band cover ready: bounds=({}, {})-({}, {}), "
-          "affinity=0x11, alpha=255",
-          rect.left, rect.top, rect.right, rect.bottom);
-    }
-    // Cover windows are owned and released by the broker.
-    windows_.erase(std::remove_if(windows_.begin(), windows_.end(),
-        [&](const auto& window) {
-          return std::none_of(monitors.rects.begin(), monitors.rects.end(),
-              [&](const RECT& rect) { return SameRect(window.rect, rect); });
-        }), windows_.end());
-    return true;
-  }
-
-  static LRESULT CALLBACK WindowProc(HWND hwnd, UINT msg, WPARAM wp,
-                                     LPARAM lp) {
-    if (msg == WM_NCCREATE) {
-      const auto create = reinterpret_cast<CREATESTRUCTW*>(lp);
-      SetWindowLongPtrW(hwnd, GWLP_USERDATA,
-                        reinterpret_cast<LONG_PTR>(create->lpCreateParams));
-    }
-    auto self = reinterpret_cast<WindowsPrivacyBackend*>(
-        GetWindowLongPtrW(hwnd, GWLP_USERDATA));
-    if (msg == WM_HOTKEY || msg == kEmergency) {
-      if (self && hwnd == self->sink_) self->emergency_ = true;
-      return 0;
-    }
-    if (msg == WM_MOUSEACTIVATE) return MA_NOACTIVATE;
-    if (msg == WM_SETCURSOR) {
-      SetCursor(nullptr);
-      return TRUE;
-    }
-    if (msg == WM_NCHITTEST) return HTTRANSPARENT;
-    if (msg == WM_CLOSE) return 0;
-    if ((msg == WM_DISPLAYCHANGE || msg == WM_DPICHANGED) && self) {
-      self->layout_changed_ = true;
-      return 0;
-    }
-    return DefWindowProcW(hwnd, msg, wp, lp);
-  }
-
-  static void CALLBACK WindowEvent(HWINEVENTHOOK, DWORD, HWND hwnd, LONG object,
-                                   LONG child, DWORD, DWORD) {
-    auto self = event_owner_;
-    if (!self || !hwnd || object != OBJID_WINDOW || child != CHILDID_SELF ||
-        hwnd == self->sink_ || GetAncestor(hwnd, GA_ROOT) != hwnd)
-      return;
-    for (const auto& w : self->windows_)
-      if (hwnd == w.cover) return;
-    // OUTOFCONTEXT delivers on this window thread. Only mark work here;
-    // monitor/session queries and Z-order changes remain in the control loop.
-    const auto get_band = reinterpret_cast<GetPrivacyWindowBand>(
-        GetProcAddress(GetModuleHandleW(L"user32.dll"), "GetWindowBand"));
-    DWORD band = 0;
-    if (get_band && get_band(hwnd, &band) && (band == 0 || band == 1)) return;
-    self->coverage_dirty_ = true;
-  }
-
-  inline static thread_local WindowsPrivacyBackend* event_owner_ = nullptr;
-  std::vector<HWINEVENTHOOK> window_events_;
-  std::vector<Window> windows_;
-  HWND sink_ = nullptr;
-  HANDLE wake_event_ = nullptr;
-  std::string wake_error_;
-  PrivacyInputGuard input_guard_;
-  bool block_input_ = false;
-  PrivacyCursorGuard cursor_guard_;
-  PrivacyBandGuard band_guard_;
-  std::unique_ptr<ScopedWindowsPhysicalCoordinates> dpi_scope_;
-  bool registered_ = false;
-  bool hotkey_ = false;
-  bool emergency_ = false;
-  bool layout_changed_ = false;
-  bool coverage_dirty_ = false;
-  uint64_t last_check_ = 0;
-  PrivacyHealth last_health_;
-  HWND last_obstruction_ = nullptr;
-  uint64_t last_obstruction_log_ = 0;
-  std::string health_error_;
-};
-
-}  // namespace
-
-bool IsWindowsPrivacyDesktopAvailable() {
-  // LockApp can display the lock screen while OpenInputDesktop still reports
-  // Default. Desktop-name checks alone are NOT a session-unlocked check.
-  DWORD session = 0;
-  if (!ProcessIdToSessionId(GetCurrentProcessId(), &session) ||
-      session != WTSGetActiveConsoleSessionId())
-    return false;
-  LPWSTR buffer = nullptr;
-  DWORD bytes = 0;
-  if (!WTSQuerySessionInformationW(WTS_CURRENT_SERVER_HANDLE, session,
-                                   WTSSessionInfoEx, &buffer, &bytes))
-    return false;
-  const auto info = reinterpret_cast<WTSINFOEXW*>(buffer);
-  const bool unlocked =
-      bytes >= sizeof(WTSINFOEXW) && info->Level == 1 &&
-      info->Data.WTSInfoExLevel1.SessionFlags == WTS_SESSIONSTATE_UNLOCK;
-  WTSFreeMemory(buffer);
-  if (!unlocked) return false;
-  HDESK input = OpenInputDesktop(0, FALSE, DESKTOP_READOBJECTS);
-  if (!input) return false;
-  wchar_t input_name[256]{}, thread_name[256]{};
-  const bool ok =
-      DesktopName(input, input_name) &&
-      DesktopName(GetThreadDesktop(GetCurrentThreadId()), thread_name) &&
-      _wcsicmp(input_name, L"Default") == 0 &&
-      _wcsicmp(input_name, thread_name) == 0;
-  CloseDesktop(input);
-  return ok;
-}
-
-std::unique_ptr<PrivacyBackend> CreateWindowsPrivacyBackend() {
-  return std::make_unique<WindowsPrivacyBackend>();
-}
-
-}  // namespace crossdesk
@@ -1,323 +0,0 @@
-/*
- * @Author: DI JUNKUN
- * @Date: 2026-09-10
- * Copyright (c) 2026 by DI JUNKUN, All Rights Reserved.
- */
-
-#include "privacy_band_guard.h"
-
-#include <objbase.h>
-
-#include <algorithm>
-#include <iterator>
-#include <new>
-
-#include "privacy_backend.h"
-#include "rd_log.h"
-
-namespace crossdesk {
-namespace {
-struct ScopedHandle {
-  HANDLE value = nullptr;
-  ~ScopedHandle() {
-    if (value && value != INVALID_HANDLE_VALUE) CloseHandle(value);
-  }
-};
-bool Failed(const char* operation, std::string& error,
-            DWORD code = GetLastError()) {
-  error =
-      std::string(operation) + " (Windows error " + std::to_string(code) + ")";
-  LOG_ERROR("Privacy high-band: {}", error);
-  return false;
-}
-
-std::filesystem::path ModuleDirectory() {
-  std::vector<wchar_t> path(32768);
-  const DWORD length = GetModuleFileNameW(nullptr, path.data(), path.size());
-  if (!length || length >= path.size()) return {};
-  return std::filesystem::path(path.data()).parent_path();
-}
-
-std::vector<wchar_t> ChildEnvironment(const std::wstring& bootstrap) {
-  std::vector<std::wstring> entries;
-  LPWCH environment = GetEnvironmentStringsW();
-  if (!environment) return {};
-  const std::wstring prefix = std::wstring(kPrivacyBandBootstrap) + L"=";
-  for (const wchar_t* item = environment; *item; item += wcslen(item) + 1) {
-    if (_wcsnicmp(item, prefix.c_str(), prefix.size()) != 0)
-      entries.emplace_back(item);
-  }
-  FreeEnvironmentStringsW(environment);
-  entries.push_back(prefix + bootstrap);
-  std::sort(entries.begin(), entries.end(), [](const auto& a, const auto& b) {
-    return _wcsicmp(a.c_str(), b.c_str()) < 0;
-  });
-  std::vector<wchar_t> result;
-  for (const auto& entry : entries) {
-    result.insert(result.end(), entry.begin(), entry.end());
-    result.push_back(0);
-  }
-  result.push_back(0);
-  return result;
-}
-}  // namespace
-
-PrivacyBandGuard::~PrivacyBandGuard() {
-  std::string error;
-  if (!Stop(error)) {
-    // Last-resort teardown still targets only this object's dedicated job.
-    if (job_) CloseHandle(job_);
-    job_ = nullptr;
-    Stop(error);
-  }
-}
-
-bool PrivacyBandGuard::Available(std::string& error) {
-#if !defined(_M_X64) && !defined(__x86_64__)
-  error = "High-band privacy currently requires an x64 Windows process";
-  return false;
-#else
-  const HMODULE user = GetModuleHandleW(L"user32.dll");
-  if (!GetProcAddress(user, "CreateWindowInBand") ||
-      !GetProcAddress(user, "GetWindowBand")) {
-    error = "Windows high-band window APIs are unavailable";
-    return false;
-  }
-  const auto directory = ModuleDirectory();
-  if (directory.empty())
-    return Failed("Resolve privacy module directory", error);
-  const auto dll = directory / kPrivacyBandDll;
-  if (GetFileAttributesW(dll.c_str()) == INVALID_FILE_ATTRIBUTES)
-    return Failed("Missing crossdesk_privacy_window.dll", error);
-  return true;
-#endif
-}
-
-bool PrivacyBandGuard::Start(const PrivacyScreenText& text,
-                             std::string& error) {
-  if (process_)
-    return Failed("High-band broker is already running", error, ERROR_BUSY);
-  if (!Available(error)) return false;
-  const auto directory = ModuleDirectory();
-  if (directory.empty())
-    return Failed("Resolve privacy module directory", error);
-  const auto dll = directory / kPrivacyBandDll;
-  wchar_t system[MAX_PATH]{}, temporary[MAX_PATH]{}, guid_text[40]{};
-  GUID guid{};
-  if (!GetSystemDirectoryW(system, MAX_PATH) ||
-      !GetTempPathW(MAX_PATH, temporary) || FAILED(CoCreateGuid(&guid)) ||
-      !StringFromGUID2(guid, guid_text, 40))
-    return Failed("Resolve high-band broker paths", error);
-  broker_directory_ = std::filesystem::path(temporary) /
-                      (std::wstring(L"CrossDesk-privacy-") + guid_text);
-  if (!CreateDirectoryW(broker_directory_.c_str(), nullptr))
-    return Failed("Create private broker directory", error);
-  broker_path_ = broker_directory_ / L"RuntimeBroker_crossdesk.exe";
-  if (!CopyFileW((std::filesystem::path(system) / L"RuntimeBroker.exe").c_str(),
-                 broker_path_.c_str(), TRUE))
-    return Failed("Copy system RuntimeBroker for this session", error);
-  // Keep both images immutable throughout creation/injection and the session.
-  image_lock_ = CreateFileW(broker_path_.c_str(), GENERIC_READ, FILE_SHARE_READ,
-                            nullptr, OPEN_EXISTING, 0, nullptr);
-  dll_lock_ = CreateFileW(dll.c_str(), GENERIC_READ, FILE_SHARE_READ, nullptr,
-                          OPEN_EXISTING, 0, nullptr);
-  if (image_lock_ == INVALID_HANDLE_VALUE || dll_lock_ == INVALID_HANDLE_VALUE)
-    return Failed("Lock privacy broker images", error);
-
-  SECURITY_ATTRIBUTES inherit{sizeof(inherit), nullptr, TRUE};
-  ScopedHandle parent;
-  if (!DuplicateHandle(GetCurrentProcess(), GetCurrentProcess(),
-                       GetCurrentProcess(), &parent.value,
-                       SYNCHRONIZE | PROCESS_QUERY_LIMITED_INFORMATION, TRUE,
-                       0))
-    return Failed("Duplicate privacy parent process handle", error);
-  stop_ = CreateEventW(&inherit, TRUE, FALSE, nullptr);
-  ready_ = CreateEventW(&inherit, TRUE, FALSE, nullptr);
-  mapping_ = CreateFileMappingW(INVALID_HANDLE_VALUE, &inherit, PAGE_READWRITE,
-                                0, sizeof(PrivacyBandShared), nullptr);
-  if (!stop_ || !ready_ || !mapping_) {
-    const auto code = GetLastError();
-    return Failed("Create high-band broker IPC", error, code);
-  }
-  shared_ = static_cast<PrivacyBandShared*>(MapViewOfFile(
-      mapping_, FILE_MAP_ALL_ACCESS, 0, 0, sizeof(PrivacyBandShared)));
-  if (!shared_) {
-    return Failed("Map high-band broker IPC", error);
-  }
-  new (shared_) PrivacyBandShared{};
-  // Immutable after process startup; no cross-process string objects or
-  // concurrent writes while the window thread paints.
-  if (!MultiByteToWideChar(CP_UTF8, MB_ERR_INVALID_CHARS,
-                           text.unlock_hint.c_str(), -1, shared_->unlock_hint,
-                           static_cast<int>(std::size(shared_->unlock_hint))))
-    return Failed("Encode privacy screen text", error);
-  shared_->parent_pid = GetCurrentProcessId();
-  HANDLE handles[] = {parent.value, stop_, ready_, mapping_};
-  std::wstring bootstrap;
-  for (HANDLE handle : handles) {
-    if (!bootstrap.empty()) bootstrap += L",";
-    bootstrap += std::to_wstring(reinterpret_cast<uintptr_t>(handle));
-  }
-  auto environment = ChildEnvironment(bootstrap);
-  if (environment.empty()) {
-    return Failed("Build broker environment", error);
-  }
-
-  job_ = CreateJobObjectW(nullptr, nullptr);
-  JOBOBJECT_EXTENDED_LIMIT_INFORMATION limits{};
-  limits.BasicLimitInformation.LimitFlags = JOB_OBJECT_LIMIT_KILL_ON_JOB_CLOSE;
-  if (!job_ || !SetInformationJobObject(job_, JobObjectExtendedLimitInformation,
-                                        &limits, sizeof(limits))) {
-    return Failed("Bind high-band broker lifetime", error);
-  }
-  SIZE_T bytes = 0;
-  InitializeProcThreadAttributeList(nullptr, 1, 0, &bytes);
-  std::vector<unsigned char> attributes(bytes);
-  STARTUPINFOEXW startup{};
-  startup.StartupInfo.cb = sizeof(startup);
-  startup.lpAttributeList =
-      reinterpret_cast<LPPROC_THREAD_ATTRIBUTE_LIST>(attributes.data());
-  if (!InitializeProcThreadAttributeList(startup.lpAttributeList, 1, 0,
-                                         &bytes)) {
-    return Failed("Initialize broker handle list", error);
-  }
-  bool ok = UpdateProcThreadAttribute(
-                startup.lpAttributeList, 0, PROC_THREAD_ATTRIBUTE_HANDLE_LIST,
-                handles, sizeof(handles), nullptr, nullptr) != FALSE;
-  PROCESS_INFORMATION child{};
-  std::wstring command = L"\"" + broker_path_.wstring() + L"\"";
-  if (ok) {
-    ok = CreateProcessW(
-             broker_path_.c_str(), command.data(), nullptr, nullptr, TRUE,
-             CREATE_SUSPENDED | CREATE_NO_WINDOW | CREATE_UNICODE_ENVIRONMENT |
-                 EXTENDED_STARTUPINFO_PRESENT,
-             environment.data(), broker_directory_.c_str(),
-             &startup.StartupInfo, &child) != FALSE;
-  }
-  const DWORD create_error = GetLastError();
-  DeleteProcThreadAttributeList(startup.lpAttributeList);
-  if (!ok)
-    return Failed("Create owned RuntimeBroker process", error, create_error);
-  process_ = child.hProcess;
-  shared_->broker_pid = child.dwProcessId;
-  if (!AssignProcessToJobObject(job_, process_)) {
-    const DWORD code = GetLastError();
-    TerminateProcess(process_, code);
-    CloseHandle(child.hThread);
-    return Failed("Assign owned RuntimeBroker to privacy job", error, code);
-  }
-  const auto path = dll.wstring();
-  const auto size = (path.size() + 1) * sizeof(wchar_t);
-  void* remote_path = VirtualAllocEx(process_, nullptr, size,
-                                     MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE);
-  SIZE_T written = 0;
-  const auto loader =
-      GetProcAddress(GetModuleHandleW(L"kernel32.dll"), "LoadLibraryW");
-  ok =
-      remote_path && loader &&
-      WriteProcessMemory(process_, remote_path, path.c_str(), size, &written) &&
-      written == size &&
-      QueueUserAPC(reinterpret_cast<PAPCFUNC>(loader), child.hThread,
-                   reinterpret_cast<ULONG_PTR>(remote_path));
-  DWORD injection_error = GetLastError();
-  if (ok && ResumeThread(child.hThread) == DWORD(-1)) {
-    ok = false;
-    injection_error = GetLastError();
-  }
-  CloseHandle(child.hThread);
-  if (!ok)
-    return Failed("Load high-band window module into owned broker", error,
-                  injection_error);
-  HANDLE startup_events[] = {ready_, process_};
-  const DWORD result = WaitForMultipleObjects(2, startup_events, FALSE, 5000);
-  if (result != WAIT_OBJECT_0) {
-    DWORD code = ERROR_TIMEOUT;
-    if (result == WAIT_OBJECT_0 + 1) GetExitCodeProcess(process_, &code);
-    return Failed("High-band broker did not become ready", error, code);
-  }
-  std::vector<PrivacyBandWindow> windows;
-  if (!Windows(windows, error)) return false;
-  LOG_INFO("Privacy high-band broker ready: process={}, band={}, monitors={}",
-           process_id(), kPrivacyWindowBand, windows.size());
-  return true;
-}
-
-bool PrivacyBandGuard::Healthy(std::string& error) {
-  if (!process_ || !shared_)
-    return Failed("High-band broker is not initialized", error,
-                  ERROR_INVALID_HANDLE);
-  const LONG code = InterlockedCompareExchange(&shared_->error, 0, 0);
-  if (code != ERROR_SUCCESS) {
-    char operation[256]{};
-    WideCharToMultiByte(CP_UTF8, 0, shared_->operation, -1, operation,
-                        sizeof(operation), nullptr, nullptr);
-    return Failed(operation[0] ? operation : "High-band window startup failed",
-                  error, code);
-  }
-  if (WaitForSingleObject(process_, 0) != WAIT_TIMEOUT) {
-    DWORD exit_code = ERROR_PROCESS_ABORTED;
-    GetExitCodeProcess(process_, &exit_code);
-    return Failed("High-band window process exited", error, exit_code);
-  }
-  if (!InterlockedCompareExchange(&shared_->active, 0, 0) ||
-      GetTickCount64() - static_cast<ULONGLONG>(InterlockedCompareExchange64(
-                             &shared_->heartbeat, 0, 0)) >
-          1500)
-    return Failed("High-band window thread stopped responding", error,
-                  ERROR_TIMEOUT);
-  return true;
-}
-
-bool PrivacyBandGuard::Windows(std::vector<PrivacyBandWindow>& windows,
-                               std::string& error) {
-  if (!Healthy(error)) return false;
-  for (int attempt = 0; attempt < 4; ++attempt) {
-    const LONG before = InterlockedCompareExchange(&shared_->sequence, 0, 0);
-    if (before & 1) continue;
-    const auto count = shared_->count;
-    if (count == 0 || count > kPrivacyMaxMonitors) break;
-    windows.assign(shared_->windows, shared_->windows + count);
-    if (before == InterlockedCompareExchange(&shared_->sequence, 0, 0)) {
-      for (const auto& window : windows) {
-        DWORD pid = 0;
-        GetWindowThreadProcessId(reinterpret_cast<HWND>(window.hwnd), &pid);
-        if (pid != process_id())
-          return Failed("Invalid high-band window owner", error,
-                        ERROR_INVALID_HANDLE);
-      }
-      return true;
-    }
-  }
-  return Failed("High-band monitor snapshot is changing or invalid", error,
-                ERROR_RETRY);
-}
-
-bool PrivacyBandGuard::Stop(std::string& error) {
-  bool ok = true;
-  if (process_) {
-    if (stop_) SetEvent(stop_);
-    if (WaitForSingleObject(process_, 1500) != WAIT_OBJECT_0) {
-      // This handle came only from our CreateProcessW call, never discovery.
-      if (!TerminateProcess(process_, ERROR_CANCELLED) ||
-          WaitForSingleObject(process_, 1500) != WAIT_OBJECT_0)
-        ok = Failed("Stop owned high-band broker", error);
-    }
-    if (!ok) return false;
-    CloseHandle(process_);
-    process_ = nullptr;
-  }
-  if (job_) CloseHandle(job_);
-  job_ = nullptr;
-  if (shared_) UnmapViewOfFile(shared_);
-  shared_ = nullptr;
-  for (HANDLE handle : {stop_, ready_, mapping_, image_lock_, dll_lock_})
-    if (handle && handle != INVALID_HANDLE_VALUE) CloseHandle(handle);
-  stop_ = ready_ = mapping_ = image_lock_ = dll_lock_ = nullptr;
-  if (!broker_path_.empty()) DeleteFileW(broker_path_.c_str());
-  if (!broker_directory_.empty()) RemoveDirectoryW(broker_directory_.c_str());
-  broker_path_.clear();
-  broker_directory_.clear();
-  return true;
-}
-
-}  // namespace crossdesk
@@ -1,51 +0,0 @@
-/*
- * @Author: DI JUNKUN
- * @Date: 2026-09-10
- * Copyright (c) 2026 by DI JUNKUN, All Rights Reserved.
- */
-
-#ifndef _PRIVACY_BAND_GUARD_H_
-#define _PRIVACY_BAND_GUARD_H_
-
-#include <Windows.h>
-
-#include <filesystem>
-#include <string>
-#include <vector>
-
-#include "privacy_band_ipc.h"
-
-namespace crossdesk {
-
-struct PrivacyScreenText;
-
-// Lifecycle and snapshots are owned by the privacy control thread. The broker
-// owns all high-band HWND operations. This class never injects an existing
-// process and never terminates a process found by name or PID.
-class PrivacyBandGuard {
- public:
-  ~PrivacyBandGuard();
-  static bool Available(std::string& error);
-  bool Start(const PrivacyScreenText& text, std::string& error);
-  bool Stop(std::string& error);
-  bool Healthy(std::string& error);
-  bool Windows(std::vector<PrivacyBandWindow>& windows, std::string& error);
-  bool stopped() const { return !process_; }
-  DWORD process_id() const { return process_ ? GetProcessId(process_) : 0; }
-
- private:
-  HANDLE process_ = nullptr;
-  HANDLE job_ = nullptr;
-  HANDLE stop_ = nullptr;
-  HANDLE ready_ = nullptr;
-  HANDLE mapping_ = nullptr;
-  HANDLE image_lock_ = nullptr;
-  HANDLE dll_lock_ = nullptr;
-  PrivacyBandShared* shared_ = nullptr;
-  std::filesystem::path broker_path_;
-  std::filesystem::path broker_directory_;
-};
-
-}  // namespace crossdesk
-
-#endif  // _PRIVACY_BAND_GUARD_H_
@@ -1,53 +0,0 @@
-/*
- * @Author: DI JUNKUN
- * @Date: 2026-09-10
- * Copyright (c) 2026 by DI JUNKUN, All Rights Reserved.
- */
-
-#ifndef _PRIVACY_BAND_IPC_H_
-#define _PRIVACY_BAND_IPC_H_
-
-#include <Windows.h>
-
-#include <cstdint>
-
-namespace crossdesk {
-
-constexpr uint32_t kPrivacyBandMagic = 0x43534231;
-constexpr uint32_t kPrivacyBandVersion = 2;
-constexpr DWORD kPrivacyWindowBand = 18;  // ZBID_ABOVELOCK_UX, current desktop.
-constexpr size_t kPrivacyMaxMonitors = 64;
-constexpr wchar_t kPrivacyBandBootstrap[] = L"CROSSDESK_PRIVACY_BAND_BOOTSTRAP";
-constexpr wchar_t kPrivacyBandDll[] = L"crossdesk_privacy_window.dll";
-
-struct PrivacyBandWindow {
-  uint64_t hwnd = 0;
-  RECT rect{};
-};
-
-// Unnamed mapping and synchronization/process handles are inherited only by
-// the newly created broker. No global window-name/PID discovery or named IPC.
-struct PrivacyBandShared {
-  uint32_t magic = kPrivacyBandMagic;
-  uint32_t version = kPrivacyBandVersion;
-  uint32_t size = sizeof(PrivacyBandShared);
-  DWORD parent_pid = 0;
-  DWORD broker_pid = 0;
-  volatile LONG sequence = 0;
-  volatile LONG error = ERROR_IO_PENDING;
-  volatile LONG active = 0;
-  alignas(8) volatile LONG64 heartbeat = 0;
-  wchar_t operation[128]{};
-  wchar_t unlock_hint[128]{};
-  uint32_t count = 0;
-  PrivacyBandWindow windows[kPrivacyMaxMonitors]{};
-};
-
-using CreatePrivacyWindowInBand = HWND(WINAPI*)(DWORD, ATOM, LPCWSTR, DWORD,
-                                                int, int, int, int, HWND, HMENU,
-                                                HINSTANCE, LPVOID, DWORD);
-using GetPrivacyWindowBand = BOOL(WINAPI*)(HWND, DWORD*);
-
-}  // namespace crossdesk
-
-#endif  // _PRIVACY_BAND_IPC_H_
@@ -1,70 +0,0 @@
-/*
- * @Author: DI JUNKUN
- * @Date: 2026-09-10
- * Copyright (c) 2026 by DI JUNKUN, All Rights Reserved.
- */
-
-#ifndef _PRIVACY_CURSOR_API_H_
-#define _PRIVACY_CURSOR_API_H_
-
-#include <Windows.h>
-
-namespace crossdesk {
-
-// A separate cursor plane can remain visible above a capture-excluded HWND.
-// Magnification's documented cursor API hides that plane across input queues;
-// it does not change cursor schemes, shapes, positions, focus or DPI awareness.
-class PrivacyCursorApi {
- public:
-  PrivacyCursorApi() = default;
-  PrivacyCursorApi(const PrivacyCursorApi&) = delete;
-  PrivacyCursorApi& operator=(const PrivacyCursorApi&) = delete;
-  ~PrivacyCursorApi() { RestoreAndClose(); }
-  bool Initialize() {
-    module_ = LoadLibraryExW(L"Magnification.dll", nullptr,
-                             LOAD_LIBRARY_SEARCH_SYSTEM32);
-    if (!module_) return false;
-    const auto initialize = reinterpret_cast<InitializeFn>(
-        GetProcAddress(module_, "MagInitialize"));
-    uninitialize_ = reinterpret_cast<InitializeFn>(
-        GetProcAddress(module_, "MagUninitialize"));
-    show_ = reinterpret_cast<ShowFn>(
-        GetProcAddress(module_, "MagShowSystemCursor"));
-    if (!initialize || !uninitialize_ || !show_) {
-      SetLastError(ERROR_PROC_NOT_FOUND);
-      return false;
-    }
-    initialized_ = initialize() != FALSE;
-    return initialized_;
-  }
-  bool Hide() { return initialized_ && show_(FALSE); }
-  bool RestoreAndClose() {
-    bool ok = true;
-    if (initialized_) {
-      ok = show_(TRUE) != FALSE;
-      ok = (uninitialize_() != FALSE) && ok;
-      initialized_ = false;
-    }
-    if (module_) {
-      FreeLibrary(module_);
-      module_ = nullptr;
-    }
-    return ok;
-  }
-
- private:
-  using InitializeFn = BOOL(WINAPI*)();
-  using ShowFn = BOOL(WINAPI*)(BOOL);
-  HMODULE module_ = nullptr;
-  InitializeFn uninitialize_ = nullptr;
-  ShowFn show_ = nullptr;
-  bool initialized_ = false;
-};
-
-struct PrivacyCursorReady {
-  volatile LONG error;
-};
-
-}  // namespace crossdesk
-
-#endif  // _PRIVACY_CURSOR_API_H_
@@ -1,158 +0,0 @@
-/*
- * @Author: DI JUNKUN
- * @Date: 2026-09-11
- * Copyright (c) 2026 by DI JUNKUN, All Rights Reserved.
- */
-
-#include "privacy_cursor_guard.h"
-
-#include <filesystem>
-#include <vector>
-
-#include "privacy_cursor_api.h"
-#include "rd_log.h"
-
-namespace crossdesk {
-namespace {
-struct Handle {
-  HANDLE value = nullptr;
-  ~Handle() {
-    if (value) CloseHandle(value);
-  }
-};
-bool Failed(const char* operation, std::string& error,
-            DWORD code = GetLastError()) {
-  error = std::string(operation) + " failed (Windows error " +
-          std::to_string(code) + ")";
-  LOG_ERROR("Privacy cursor: {}", error);
-  return false;
-}
-}  // namespace
-
-PrivacyCursorGuard::~PrivacyCursorGuard() {
-  std::string error;
-  Stop(error);
-  // The inherited parent handle still lets a slow helper restore on exit.
-  if (process_) CloseHandle(process_);
-  if (stop_event_) CloseHandle(stop_event_);
-}
-
-bool PrivacyCursorGuard::Start(std::string& error) {
-  if (process_ || restore_pending_)
-    return Failed("Cursor guard already active", error, ERROR_BUSY);
-  helper_failure_reported_ = false;
-  std::vector<wchar_t> module(32768);
-  const DWORD count = GetModuleFileNameW(nullptr, module.data(),
-                                         static_cast<DWORD>(module.size()));
-  if (!count || count >= module.size())
-    return Failed("GetModuleFileNameW", error);
-  const auto helper = std::filesystem::path(module.data()).parent_path() /
-                      L"crossdesk_privacy_cursor_helper.exe";
-  SECURITY_ATTRIBUTES security{sizeof(security), nullptr, TRUE};
-  Handle parent;
-  if (!DuplicateHandle(GetCurrentProcess(), GetCurrentProcess(),
-                       GetCurrentProcess(), &parent.value, SYNCHRONIZE, TRUE,
-                       0))
-    return Failed("Duplicate parent process handle", error);
-  Handle stop{CreateEventW(&security, TRUE, FALSE, nullptr)};
-  Handle ready{CreateEventW(&security, TRUE, FALSE, nullptr)};
-  Handle mapping{CreateFileMappingW(INVALID_HANDLE_VALUE, &security,
-                                    PAGE_READWRITE, 0,
-                                    sizeof(PrivacyCursorReady), nullptr)};
-  if (!stop.value || !ready.value || !mapping.value)
-    return Failed("Create cursor guard IPC", error);
-  auto shared = static_cast<PrivacyCursorReady*>(MapViewOfFile(
-      mapping.value, FILE_MAP_ALL_ACCESS, 0, 0, sizeof(PrivacyCursorReady)));
-  if (!shared) return Failed("Map cursor guard readiness", error);
-  InterlockedExchange(&shared->error, ERROR_IO_PENDING);
-
-  SIZE_T bytes = 0;
-  InitializeProcThreadAttributeList(nullptr, 1, 0, &bytes);
-  std::vector<unsigned char> attributes(bytes);
-  STARTUPINFOEXW startup{};
-  startup.StartupInfo.cb = sizeof(startup);
-  startup.lpAttributeList =
-      reinterpret_cast<LPPROC_THREAD_ATTRIBUTE_LIST>(attributes.data());
-  if (!InitializeProcThreadAttributeList(startup.lpAttributeList, 1, 0,
-                                         &bytes)) {
-    const DWORD code = GetLastError();
-    UnmapViewOfFile(shared);
-    return Failed("Initialize cursor guard handle list", error, code);
-  }
-  HANDLE inherited[] = {parent.value, stop.value, ready.value, mapping.value};
-  bool ok = UpdateProcThreadAttribute(
-                startup.lpAttributeList, 0, PROC_THREAD_ATTRIBUTE_HANDLE_LIST,
-                inherited, sizeof(inherited), nullptr, nullptr) != FALSE;
-  PROCESS_INFORMATION child{};
-  if (ok) {
-    std::wstring command = L"\"" + helper.wstring() + L"\"";
-    for (HANDLE handle : inherited)
-      command += L" " + std::to_wstring(reinterpret_cast<uintptr_t>(handle));
-    ok =
-        CreateProcessW(helper.c_str(), command.data(), nullptr, nullptr, TRUE,
-                       CREATE_NO_WINDOW | EXTENDED_STARTUPINFO_PRESENT |
-                           CREATE_BREAKAWAY_FROM_JOB,
-                       nullptr, nullptr, &startup.StartupInfo, &child) != FALSE;
-  }
-  const DWORD start_error = GetLastError();
-  DeleteProcThreadAttributeList(startup.lpAttributeList);
-  if (!ok) {
-    UnmapViewOfFile(shared);
-    return Failed("Start crossdesk_privacy_cursor_helper.exe", error,
-                  start_error);
-  }
-  CloseHandle(child.hThread);
-  process_ = child.hProcess;
-  stop_event_ = stop.value;
-  stop.value = nullptr;
-  HANDLE startup_events[] = {ready.value, process_};
-  const DWORD result = WaitForMultipleObjects(2, startup_events, FALSE, 2000);
-  const DWORD ready_error =
-      static_cast<DWORD>(InterlockedCompareExchange(&shared->error, 0, 0));
-  UnmapViewOfFile(shared);
-  if (result != WAIT_OBJECT_0 || ready_error != ERROR_SUCCESS) {
-    std::string cleanup;
-    Stop(cleanup);
-    return Failed(
-        "Hide system cursor", error,
-        ready_error == ERROR_IO_PENDING ? ERROR_TIMEOUT : ready_error);
-  }
-  return true;
-}
-
-bool PrivacyCursorGuard::RestoreAfterFailure(std::string& error) {
-  PrivacyCursorApi cursor;
-  if (!cursor.Initialize() || !cursor.RestoreAndClose()) {
-    restore_pending_ = true;
-    return Failed("Restore system cursor after helper failure", error);
-  }
-  restore_pending_ = false;
-  return true;
-}
-
-bool PrivacyCursorGuard::Healthy(std::string& error) {
-  if (process_ && WaitForSingleObject(process_, 0) == WAIT_TIMEOUT) return true;
-  if (restore_pending_ || (process_ && !helper_failure_reported_))
-    RestoreAfterFailure(error);
-  helper_failure_reported_ = true;
-  error = "System cursor helper exited; privacy screen will turn off";
-  return false;
-}
-
-bool PrivacyCursorGuard::Stop(std::string& error) {
-  if (!process_) return !restore_pending_ || RestoreAfterFailure(error);
-  if (!SetEvent(stop_event_)) return Failed("Stop cursor helper", error);
-  if (WaitForSingleObject(process_, 2000) != WAIT_OBJECT_0) {
-    return Failed("Wait for cursor helper restoration", error, ERROR_TIMEOUT);
-  }
-  DWORD code = ERROR_GEN_FAILURE;
-  GetExitCodeProcess(process_, &code);
-  CloseHandle(process_);
-  process_ = nullptr;
-  CloseHandle(stop_event_);
-  stop_event_ = nullptr;
-  if (code != ERROR_SUCCESS) return RestoreAfterFailure(error);
-  return true;
-}
-
-}  // namespace crossdesk
@@ -1,39 +0,0 @@
-/*
- * @Author: DI JUNKUN
- * @Date: 2026-09-10
- * Copyright (c) 2026 by DI JUNKUN, All Rights Reserved.
- */
-
-#ifndef _PRIVACY_CURSOR_GUARD_H_
-#define _PRIVACY_CURSOR_GUARD_H_
-
-#include <Windows.h>
-
-#include <string>
-
-namespace crossdesk {
-
-// Called only on the privacy message thread. The child owns cursor suppression
-// and restores it when either this guard stops it or its parent process exits.
-class PrivacyCursorGuard {
- public:
-  PrivacyCursorGuard() = default;
-  PrivacyCursorGuard(const PrivacyCursorGuard&) = delete;
-  PrivacyCursorGuard& operator=(const PrivacyCursorGuard&) = delete;
-  ~PrivacyCursorGuard();
-  bool Start(std::string& error);
-  bool Healthy(std::string& error);
-  bool Stop(std::string& error);
-  bool stopped() const { return !process_ && !restore_pending_; }
-
- private:
-  bool RestoreAfterFailure(std::string& error);
-  HANDLE process_ = nullptr;
-  HANDLE stop_event_ = nullptr;
-  bool restore_pending_ = false;
-  bool helper_failure_reported_ = false;
-};
-
-}  // namespace crossdesk
-
-#endif  // _PRIVACY_CURSOR_GUARD_H_
@@ -1,304 +0,0 @@
-/*
- * @Author: DI JUNKUN
- * @Date: 2026-09-10
- * Copyright (c) 2026 by DI JUNKUN, All Rights Reserved.
- */
-
-#include "privacy_input_guard.h"
-
-#include "rd_log.h"
-#include "windows_input_marker.h"
-
-namespace crossdesk {
-
-PrivacyInputGuard::~PrivacyInputGuard() { Stop(); }
-
-void PrivacyInputGuard::Fault(const std::string& operation, DWORD code) {
-  {
-    std::lock_guard lock(error_mutex_);
-    error_ = operation + " (Windows error " + std::to_string(code) + ")";
-    LOG_ERROR("Privacy input: {}", error_);
-  }
-  healthy_.store(false);
-  // Wake the owner's message loop; recovery is never performed in a hook.
-  PostMessageW(owner_, WM_NULL, 0, 0);
-}
-
-bool PrivacyInputGuard::Start(HWND owner, UINT exit_message,
-                              std::string& error) {
-  if (thread_.joinable()) {
-    error = "Privacy input thread is already running";
-    return false;
-  }
-  owner_ = owner;
-  exit_message_ = exit_message;
-  healthy_.store(false);
-  {
-    std::lock_guard lock(error_mutex_);
-    error_.clear();
-  }
-  stop_ = CreateEventW(nullptr, TRUE, FALSE, nullptr);
-  ready_ = CreateEventW(nullptr, TRUE, FALSE, nullptr);
-  if (!stop_ || !ready_) {
-    Fault("Create privacy input events failed", GetLastError());
-    Healthy(error);
-    Stop();
-    return false;
-  }
-  try {
-    thread_ = std::thread([this] { Run(); });
-  } catch (const std::exception& e) {
-    error = std::string("Start privacy input thread failed: ") + e.what();
-    Stop();
-    return false;
-  }
-  if (WaitForSingleObject(ready_, 2000) != WAIT_OBJECT_0) {
-    error = "Privacy input thread startup timed out";
-    Stop();
-    return false;
-  }
-  if (!Healthy(error)) {
-    Stop();
-    return false;
-  }
-  return true;
-}
-
-void PrivacyInputGuard::Stop() {
-  if (stop_) SetEvent(stop_);
-  if (thread_.joinable()) thread_.join();
-  if (stop_) CloseHandle(stop_);
-  if (ready_) CloseHandle(ready_);
-  stop_ = ready_ = nullptr;
-  owner_ = nullptr;
-}
-
-bool PrivacyInputGuard::Healthy(std::string& error) const {
-  if (healthy_.load() && running_.load() &&
-      GetTickCount64() - last_pump_.load() < 1500)
-    return true;
-  std::lock_guard lock(error_mutex_);
-  error = error_.empty() ? "Privacy input message thread stopped responding"
-                         : error_;
-  return false;
-}
-
-bool PrivacyInputGuard::Renew(HHOOK& hook, int kind, HOOKPROC procedure) {
-  HHOOK replacement =
-      SetWindowsHookExW(kind, procedure, GetModuleHandleW(nullptr), 0);
-  if (!replacement) {
-    Fault("Renew privacy input hook failed", GetLastError());
-    return false;
-  }
-  HHOOK previous = hook;
-  hook = replacement;
-  if (UnhookWindowsHookEx(previous)) return true;
-  const DWORD code = GetLastError();
-  if (code != ERROR_INVALID_HOOK_HANDLE) retired_.push_back(previous);
-  Fault("Privacy input hook was lost or could not be retired", code);
-  return false;
-}
-
-bool PrivacyInputGuard::PumpMessages() {
-  MSG message{};
-  while (PeekMessageW(&message, nullptr, 0, 0, PM_REMOVE)) {
-    if (message.message == WM_QUIT) return false;
-    TranslateMessage(&message);
-    DispatchMessageW(&message);
-  }
-  last_pump_.store(GetTickCount64());
-  return WaitForSingleObject(stop_, 0) == WAIT_TIMEOUT;
-}
-
-bool PrivacyInputGuard::ReleasePressedInputs() {
-  // Both hooks must already be installed: otherwise a new local press can
-  // slip between this snapshot and the transition to blocked input.
-  std::array<bool, 256> pressed{};
-  for (int key = 1; key < 256; ++key)
-    pressed[key] = (GetAsyncKeyState(key) & 0x8000) != 0;
-  // Keep held modifiers available to the physical emergency-exit chord.
-  // Our injected releases intentionally do not clear this hook-side state.
-  physical_keys_ = pressed;
-
-  std::vector<INPUT> releases;
-  for (int key = 1; key < 256; ++key) {
-    if (!pressed[key]) continue;
-    // Generic modifier VKs alias their left/right variants. Release each
-    // side once; use the generic VK only if Windows reports no specific side.
-    if ((key == VK_SHIFT && (pressed[VK_LSHIFT] || pressed[VK_RSHIFT])) ||
-        (key == VK_CONTROL && (pressed[VK_LCONTROL] || pressed[VK_RCONTROL])) ||
-        (key == VK_MENU && (pressed[VK_LMENU] || pressed[VK_RMENU])))
-      continue;
-    INPUT input{};
-    input.type = INPUT_MOUSE;
-    input.mi.dwExtraInfo = kInjectedMouseInputMarker;
-    switch (key) {
-      // GetAsyncKeyState reports physical mouse buttons, as do these flags,
-      // including when Windows swaps the primary and secondary buttons.
-      case VK_LBUTTON:
-        input.mi.dwFlags = MOUSEEVENTF_LEFTUP;
-        break;
-      case VK_RBUTTON:
-        input.mi.dwFlags = MOUSEEVENTF_RIGHTUP;
-        break;
-      case VK_MBUTTON:
-        input.mi.dwFlags = MOUSEEVENTF_MIDDLEUP;
-        break;
-      case VK_XBUTTON1:
-      case VK_XBUTTON2:
-        input.mi.dwFlags = MOUSEEVENTF_XUP;
-        input.mi.mouseData = key == VK_XBUTTON1 ? XBUTTON1 : XBUTTON2;
-        break;
-      default: {
-        input = {};
-        input.type = INPUT_KEYBOARD;
-        input.ki.wVk = static_cast<WORD>(key);
-        const UINT scan = MapVirtualKeyW(key, MAPVK_VK_TO_VSC_EX);
-        input.ki.wScan = static_cast<WORD>(scan & 0xff);
-        input.ki.dwFlags = KEYEVENTF_KEYUP;
-        if ((scan & 0xff00) == 0xe000)
-          input.ki.dwFlags |= KEYEVENTF_EXTENDEDKEY;
-        input.ki.dwExtraInfo = kInjectedKeyboardInputMarker;
-        break;
-      }
-    }
-    LOG_INFO("Privacy input handoff: releasing held input vk=0x{:02X}", key);
-    releases.push_back(input);
-  }
-  if (!releases.empty()) {
-    const UINT count = static_cast<UINT>(releases.size());
-    SetLastError(ERROR_SUCCESS);
-    const UINT sent = SendInput(count, releases.data(), sizeof(INPUT));
-    if (sent != count) {
-      Fault("Release held privacy inputs failed (sent " + std::to_string(sent) +
-                "/" + std::to_string(count) + ")",
-            GetLastError());
-      return false;
-    }
-  }
-
-  // SendInput acknowledges insertion, not delivery. Pump this hook thread
-  // until the tagged releases have passed through and Windows reports no
-  // pressed inputs. The caller cannot publish input_blocked/ready earlier.
-  const auto deadline = GetTickCount64() + 1000;
-  for (;;) {
-    if (!PumpMessages()) {
-      Fault("Privacy input handoff cancelled", ERROR_CANCELLED);
-      return false;
-    }
-    int held = 0;
-    for (int key = 1; key < 256; ++key) {
-      if (GetAsyncKeyState(key) & 0x8000) {
-        held = key;
-        break;
-      }
-    }
-    if (!held) {
-      LOG_INFO("Privacy input handoff complete: released {} held inputs",
-               releases.size());
-      return true;
-    }
-    if (GetTickCount64() >= deadline) {
-      Fault("Privacy input release timed out, still pressed vk=" +
-                std::to_string(held),
-            ERROR_TIMEOUT);
-      return false;
-    }
-    if (MsgWaitForMultipleObjectsEx(1, &stop_, 10, QS_ALLINPUT,
-                                    MWMO_INPUTAVAILABLE) == WAIT_FAILED) {
-      Fault("Wait for privacy input releases failed", GetLastError());
-      return false;
-    }
-  }
-}
-
-void PrivacyInputGuard::Run() {
-  current_ = this;
-  running_.store(true);
-  try {
-    keyboard_ = SetWindowsHookExW(WH_KEYBOARD_LL, KeyboardHook,
-                              GetModuleHandleW(nullptr), 0);
-    if (!keyboard_)
-      Fault("Install privacy keyboard hook failed", GetLastError());
-    if (keyboard_) {
-      mouse_ =
-          SetWindowsHookExW(WH_MOUSE_LL, MouseHook, GetModuleHandleW(nullptr), 0);
-      if (!mouse_) Fault("Install privacy mouse hook failed", GetLastError());
-    }
-    healthy_.store(keyboard_ && mouse_ && ReleasePressedInputs());
-    last_pump_.store(GetTickCount64());
-    SetEvent(ready_);
-    auto last_refresh = GetTickCount64();
-    LOG_INFO("Privacy input message thread started: thread={}",
-             GetCurrentThreadId());
-    while (keyboard_ && mouse_ &&
-           WaitForSingleObject(stop_, 0) == WAIT_TIMEOUT) {
-      if (!PumpMessages()) break;
-      const auto now = GetTickCount64();
-      if (healthy_.load() && now - last_refresh >= 1000) {
-        last_refresh = now;
-        // Install replacements before retiring old hooks, with no input gap.
-        if (Renew(keyboard_, WH_KEYBOARD_LL, KeyboardHook))
-          Renew(mouse_, WH_MOUSE_LL, MouseHook);
-      }
-      if (MsgWaitForMultipleObjectsEx(1, &stop_, 100, QS_ALLINPUT,
-                                      MWMO_INPUTAVAILABLE) == WAIT_FAILED) {
-        Fault("Wait for privacy input messages failed", GetLastError());
-        break;
-      }
-    }
-  } catch (const std::exception& e) {
-    Fault(std::string("Privacy input thread failed: ") + e.what(),
-          ERROR_GEN_FAILURE);
-    SetEvent(ready_);
-  }
-  healthy_.store(false);
-  auto unhook = [this](HHOOK hook) {
-    if (hook && !UnhookWindowsHookEx(hook) &&
-        GetLastError() != ERROR_INVALID_HOOK_HANDLE)
-      Fault("Release privacy input hook failed", GetLastError());
-  };
-  unhook(keyboard_);
-  unhook(mouse_);
-  for (auto hook : retired_) unhook(hook);
-  keyboard_ = mouse_ = nullptr;
-  retired_.clear();
-  physical_keys_.fill(false);
-  current_ = nullptr;
-  running_.store(false);
-  PostMessageW(owner_, WM_NULL, 0, 0);
-  // Windows also removes hooks installed by a thread when that thread exits.
-  LOG_INFO("Privacy input message thread stopped");
-}
-
-LRESULT CALLBACK PrivacyInputGuard::KeyboardHook(int code, WPARAM wp,
-                                                 LPARAM lp) {
-  auto self = current_;
-  if (code < 0 || !self) return CallNextHookEx(nullptr, code, wp, lp);
-  const auto& key = *reinterpret_cast<KBDLLHOOKSTRUCT*>(lp);
-  if ((key.flags & LLKHF_INJECTED) &&
-      key.dwExtraInfo == kInjectedKeyboardInputMarker)
-    return CallNextHookEx(nullptr, code, wp, lp);
-  if (!(key.flags & LLKHF_INJECTED) && key.vkCode < 256) {
-    self->physical_keys_[key.vkCode] = !(key.flags & LLKHF_UP);
-    const auto& keys = self->physical_keys_;
-    if (key.vkCode == VK_F12 && !(key.flags & LLKHF_UP) &&
-        (keys[VK_LCONTROL] || keys[VK_RCONTROL]) &&
-        (keys[VK_LMENU] || keys[VK_RMENU]) &&
-        (keys[VK_LSHIFT] || keys[VK_RSHIFT]))
-      PostMessageW(self->owner_, self->exit_message_, 0, 0);
-  }
-  return 1;
-}
-
-LRESULT CALLBACK PrivacyInputGuard::MouseHook(int code, WPARAM wp, LPARAM lp) {
-  auto self = current_;
-  if (code < 0 || !self) return CallNextHookEx(nullptr, code, wp, lp);
-  const auto& mouse = *reinterpret_cast<MSLLHOOKSTRUCT*>(lp);
-  if ((mouse.flags & LLMHF_INJECTED) &&
-      mouse.dwExtraInfo == kInjectedMouseInputMarker)
-    return CallNextHookEx(nullptr, code, wp, lp);
-  return 1;
-}
-
-}  // namespace crossdesk
@@ -1,59 +0,0 @@
-/*
- * @Author: DI JUNKUN
- * @Date: 2026-09-10
- * Copyright (c) 2026 by DI JUNKUN, All Rights Reserved.
- */
-
-#ifndef _PRIVACY_INPUT_GUARD_H_
-#define _PRIVACY_INPUT_GUARD_H_
-
-#include <Windows.h>
-
-#include <array>
-#include <atomic>
-#include <mutex>
-#include <string>
-#include <thread>
-#include <vector>
-
-namespace crossdesk {
-
-// The owner controls lifecycle; the dedicated message thread owns LL hooks.
-// Rendering and session queries never run on this thread.
-class PrivacyInputGuard {
- public:
-  ~PrivacyInputGuard();
-  bool Start(HWND owner, UINT exit_message, std::string& error);
-  void Stop();
-  bool Healthy(std::string& error) const;
-  bool stopped() const { return !thread_.joinable(); }
-
- private:
-  void Run();
-  bool ReleasePressedInputs();
-  bool PumpMessages();
-  void Fault(const std::string& operation, DWORD code);
-  bool Renew(HHOOK& hook, int kind, HOOKPROC procedure);
-  static LRESULT CALLBACK KeyboardHook(int code, WPARAM wp, LPARAM lp);
-  static LRESULT CALLBACK MouseHook(int code, WPARAM wp, LPARAM lp);
-
-  std::thread thread_;
-  HANDLE stop_ = nullptr;
-  HANDLE ready_ = nullptr;
-  HWND owner_ = nullptr;
-  UINT exit_message_ = 0;
-  std::atomic<bool> healthy_{false};
-  std::atomic<bool> running_{false};
-  std::atomic<ULONGLONG> last_pump_{0};
-  mutable std::mutex error_mutex_;
-  std::string error_;
-  HHOOK keyboard_ = nullptr;
-  HHOOK mouse_ = nullptr;
-  std::vector<HHOOK> retired_;
-  std::array<bool, 256> physical_keys_{};
-  inline static thread_local PrivacyInputGuard* current_ = nullptr;
-};
-
-}  // namespace crossdesk
-
-#endif  // _PRIVACY_INPUT_GUARD_H_
@@ -1,42 +0,0 @@
-/*
- * @Author: DI JUNKUN
- * @Date: 2026-09-11
- * Copyright (c) 2026 by DI JUNKUN, All Rights Reserved.
- */
-
-#ifndef _PRIVACY_WINDOW_VISIBILITY_H_
-#define _PRIVACY_WINDOW_VISIBILITY_H_
-
-#include <Windows.h>
-
-#include <cstdint>
-
-namespace crossdesk {
-
-// Called for a visible foreign window whose full bounds intersect a cover.
-// Inspect it on every check: an OSD helper can grow into a content window.
-inline bool IsNonObstructingPrivacyWindow(HWND window, const RECT& bounds) {
-  const auto styles = GetWindowLongPtrW(window, GWL_EXSTYLE);
-  if (!(styles & WS_EX_LAYERED)) return false;
-
-  BYTE alpha = 0;
-  DWORD flags = 0;
-  // WS_EX_TRANSPARENT alone does not imply invisible pixels. Likewise,
-  // UpdateLayeredWindow windows can reject this query; failure proves nothing.
-  if (GetLayeredWindowAttributes(window, nullptr, &alpha, &flags) &&
-      (flags & LWA_ALPHA) && alpha == 0)
-    return true;
-
-  constexpr LONG_PTR helper_styles =
-      WS_EX_TOOLWINDOW | WS_EX_NOACTIVATE | WS_EX_TRANSPARENT;
-  const auto width = static_cast<int64_t>(bounds.right) - bounds.left;
-  const auto height = static_cast<int64_t>(bounds.bottom) - bounds.top;
-  // Single-pixel, nonactivating OSD placeholders cannot display meaningful
-  // desktop content. Use the whole window, never its clipped intersection;
-  // larger OSDs and windows with unknown opacity still require coverage checks.
-  return (styles & helper_styles) == helper_styles && width == 1 && height == 1;
-}
-
-}  // namespace crossdesk
-
-#endif  // _PRIVACY_WINDOW_VISIBILITY_H_
@@ -1,12 +1,11 @@
 #include "screen_capturer_dxgi.h"

-#include <display_stream_id.h>
-
 #include <algorithm>
 #include <chrono>
 #include <string>
 #include <vector>

+#include <display_stream_id.h>
 #include "libyuv.h"
 #include "rd_log.h"

@@ -219,13 +218,11 @@ void ScreenCapturerDxgi::EnumerateDisplays() {
                         mi.rcMonitor.left, mi.rcMonitor.top,
                         mi.rcMonitor.right, mi.rcMonitor.bottom);
        // primary first
-        if (is_primary) {
+        if (is_primary)
          display_info_list_.insert(display_info_list_.begin(), info);
-          outputs_.insert(outputs_.begin(), output);
-        } else {
+        else
          display_info_list_.push_back(info);
-          outputs_.push_back(output);
-        }
+        outputs_.push_back(output);
      }
    }
  }
@@ -249,11 +246,6 @@ bool ScreenCapturerDxgi::CreateDuplicationForMonitor(int monitor_index) {
  }

  staging_.Reset();
-  DXGI_OUTDUPL_DESC desc{};
-  duplication_->GetDesc(&desc);
-  rotation_ = desc.Rotation;
-  LOG_INFO("DXGI: duplication ready, monitor={}, rotation={}", monitor_index,
-           static_cast<int>(rotation_));
  return true;
 }

@@ -284,7 +276,6 @@ bool ScreenCapturerDxgi::RecreateDuplicationForCurrentMonitor() {
 }

 void ScreenCapturerDxgi::ReleaseDuplication() {
-  ++duplication_generation_;
  staging_.Reset();
  if (duplication_) {
    duplication_->ReleaseFrame();
@@ -293,27 +284,16 @@ void ScreenCapturerDxgi::ReleaseDuplication() {
 }

 void ScreenCapturerDxgi::CaptureLoop() {
-  const int timeout_ms = (std::max)(1, 1000 / (std::max)(1, fps_));
-  bool cached_frame_valid = false;
-  int cached_monitor = -1;
-  uint64_t cached_generation = 0;
-  std::vector<uint8_t> rotated_frame;
+  const int timeout_ms = 33;
  auto last_duplication_retry =
      std::chrono::steady_clock::now() - std::chrono::milliseconds(1000);
  while (running_) {
    if (paused_) {
-      cached_frame_valid = false;
      std::this_thread::sleep_for(std::chrono::milliseconds(10));
      continue;
    }

-    // Duplication/staging textures belong to one monitor. Do not release or
-    // replace them in SwitchTo while AcquireNextFrame/Map is using them.
-    std::unique_lock capture_lock(switch_mutex_);
-    if (paused_ || !running_) continue;
    if (!duplication_) {
-      cached_frame_valid = false;
-      capture_lock.unlock();
      const auto now = std::chrono::steady_clock::now();
      if (now - last_duplication_retry >= std::chrono::milliseconds(500)) {
        last_duplication_retry = now;
@@ -323,31 +303,15 @@ void ScreenCapturerDxgi::CaptureLoop() {
      continue;
    }

-    const int frame_monitor = monitor_index_.load();
    DXGI_OUTDUPL_FRAME_INFO frame_info{};
    Microsoft::WRL::ComPtr<IDXGIResource> desktop_resource;
    HRESULT hr = duplication_->AcquireNextFrame(
        timeout_ms, &frame_info, desktop_resource.GetAddressOf());
    if (hr == DXGI_ERROR_WAIT_TIMEOUT) {
-      // DXGI explicitly reports an unchanged desktop. Re-emit only a frame
-      // successfully acquired for this monitor to keep delivering static frames.
-      if (cached_frame_valid && cached_generation == duplication_generation_ &&
-          cached_monitor == monitor_index_.load() && callback_ && nv12_frame_) {
-        const auto stream_id = MakeDisplayStreamId(cached_monitor);
-        capture_lock.unlock();
-        callback_(nv12_frame_, nv12_width_ * nv12_height_ * 3 / 2, nv12_width_,
-                  nv12_height_, stream_id.c_str(), nullptr);
-      }
      continue;
    }
-    // Never replay a cached image after an acquisition/conversion failure or
-    // a backend rebuild. Normal error/reset handling releases optional privacy.
-    cached_frame_valid = false;
    if (FAILED(hr)) {
      LOG_ERROR("DXGI: AcquireNextFrame failed, hr={}", (int)hr);
-      capture_lock.unlock();
-      if (callback_)
-        callback_(nullptr, ScreenCapturer::kBackendReset, 0, 0, "", nullptr);
      RecreateDuplicationForCurrentMonitor();
      continue;
    }
@@ -392,42 +356,9 @@ void ScreenCapturerDxgi::CaptureLoop() {
      continue;
    }

-    auto pixels = static_cast<const uint8_t*>(mapped.pData);
-    int stride = static_cast<int>(mapped.RowPitch);
    int logical_width = static_cast<int>(src_desc.Width);
-    int logical_height = static_cast<int>(src_desc.Height);
-    libyuv::RotationMode rotation = libyuv::kRotate0;
-    switch (rotation_) {
-      case DXGI_MODE_ROTATION_ROTATE90:
-        rotation = libyuv::kRotate90;
-        break;
-      case DXGI_MODE_ROTATION_ROTATE180:
-        rotation = libyuv::kRotate180;
-        break;
-      case DXGI_MODE_ROTATION_ROTATE270:
-        rotation = libyuv::kRotate270;
-        break;
-      default:
-        break;
-    }
-    if (rotation != libyuv::kRotate0) {
-      const bool swap_axes = rotation != libyuv::kRotate180;
-      const int rotated_width = swap_axes ? logical_height : logical_width;
-      rotated_frame.resize(static_cast<size_t>(logical_width) * logical_height *
-                           4);
-      if (libyuv::ARGBRotate(pixels, stride, rotated_frame.data(),
-                             rotated_width * 4, logical_width, logical_height,
-                             rotation) != 0) {
-        d3d_context_->Unmap(staging_.Get(), 0);
-        duplication_->ReleaseFrame();
-        continue;
-      }
-      pixels = rotated_frame.data();
-      stride = rotated_width * 4;
-      if (swap_axes) std::swap(logical_width, logical_height);
-    }
    int even_width = logical_width & ~1;
-    int even_height = logical_height & ~1;
+    int even_height = static_cast<int>(src_desc.Height) & ~1;
    if (even_width <= 0 || even_height <= 0) {
      d3d_context_->Unmap(staging_.Get(), 0);
      duplication_->ReleaseFrame();
@@ -443,29 +374,25 @@ void ScreenCapturerDxgi::CaptureLoop() {
      nv12_height_ = even_height;
    }

-    const int converted =
-        libyuv::ARGBToNV12(pixels, stride, nv12_frame_, even_width,
-                           nv12_frame_ + even_width * even_height, even_width,
-                           even_width, even_height);
+    libyuv::ARGBToNV12(static_cast<const uint8_t*>(mapped.pData),
+                       static_cast<int>(mapped.RowPitch), nv12_frame_,
+                       even_width, nv12_frame_ + even_width * even_height,
+                       even_width, even_width, even_height);

-    cached_generation = duplication_generation_;
-    d3d_context_->Unmap(staging_.Get(), 0);
-    duplication_->ReleaseFrame();
-    capture_lock.unlock();
-
-    if (converted == 0 && frame_monitor == monitor_index_.load() && callback_) {
-      int idx = frame_monitor;
+    if (callback_) {
+      int idx = monitor_index_.load();
      if (idx >= 0 && idx < static_cast<int>(display_info_list_.size())) {
        const std::string stream_id = MakeDisplayStreamId(idx);
        callback_(nv12_frame_, nv12_size, even_width, even_height,
                  stream_id.c_str(), nullptr);
-        cached_monitor = idx;
-        cached_frame_valid = true;
      } else {
        LOG_ERROR("DXGI: CaptureLoop invalid monitor_index {} (list size {})",
                  idx, display_info_list_.size());
      }
    }
+
+    d3d_context_->Unmap(staging_.Get(), 0);
+    duplication_->ReleaseFrame();
  }
 }

@@ -63,8 +63,6 @@ class ScreenCapturerDxgi : public ScreenCapturer {
  Microsoft::WRL::ComPtr<ID3D11DeviceContext> d3d_context_;
  Microsoft::WRL::ComPtr<IDXGIOutputDuplication> duplication_;
  Microsoft::WRL::ComPtr<ID3D11Texture2D> staging_;
-  DXGI_MODE_ROTATION rotation_ = DXGI_MODE_ROTATION_IDENTITY;
-  uint64_t duplication_generation_ = 0;

  std::atomic<bool> running_{false};
  std::atomic<bool> paused_{false};
@@ -351,10 +351,6 @@ int ScreenCapturerWgc::ResetToInitialMonitor() {
 }
 void ScreenCapturerWgc::OnFrame(const WgcSession::wgc_session_frame& frame,
                                int id) {
-  if (!frame.data && frame.width == 0 && frame.height == 0) {
-    if (on_data_) on_data_(nullptr, ScreenCapturer::kBackendReset, 0, 0, "", nullptr);
-    return;
-  }
  if (!running_ || !on_data_) {
    return;
  }
@@ -127,13 +127,6 @@ class WgcPluginCapturer final : public ScreenCapturer {
  DestroyFn destroy_fn_ = nullptr;
 };

-const char* CaptureBackendName(const ScreenCapturer* capturer) {
-  if (dynamic_cast<const ScreenCapturerDxgi*>(capturer)) return "DXGI";
-  if (dynamic_cast<const WgcPluginCapturer*>(capturer)) return "WGC";
-  if (dynamic_cast<const ScreenCapturerGdi*>(capturer)) return "GDI";
-  return "unavailable";
-}
-
 std::string BuildSecureCaptureCommand(int left, int top, int width, int height,
                                      bool show_cursor,
                                      const std::string& stage,
@@ -337,13 +330,7 @@ bool QuerySecureDesktopHelperFrame(
 ScreenCapturerWin::ScreenCapturerWin() {}
 ScreenCapturerWin::~ScreenCapturerWin() { Destroy(); }

-void ScreenCapturerWin::NotifyPrivacyCapture(bool running) {
-  if (privacy_)
-    privacy_->CaptureChanged(running);
-}
-
 int ScreenCapturerWin::Init(const int fps, cb_desktop_data cb) {
-  NotifyPrivacyCapture(false);
  fps_ = fps;
  cb_orig_ = cb;
  native_output_logged_.store(false, std::memory_order_relaxed);
@@ -357,10 +344,6 @@ int ScreenCapturerWin::Init(const int fps, cb_desktop_data cb) {
  cb_ = [this](unsigned char* data, int size, int w, int h,
               const char* reported_stream_id,
               const MiniRtcNativeVideoFrame* native_frame) {
-    if (size == ScreenCapturer::kBackendReset) {
-      if (privacy_) privacy_->Fail("Capture restarted; privacy screen will turn off");
-      return;
-    }
    if (secure_desktop_capture_active_.load(std::memory_order_relaxed)) {
      return;
    }
@@ -381,9 +364,6 @@ int ScreenCapturerWin::Init(const int fps, cb_desktop_data cb) {
          mapped_stream_id.c_str(), canonical_displays_.size(),
          monitor_index_.load(std::memory_order_relaxed));
    }
-    if (privacy_ && privacy_->Engaged() && !IsWindowsPrivacyDesktopAvailable()) {
-      privacy_->Fail("Secure or unavailable desktop; privacy screen will turn off");
-    }
    if (mapped_stream_id.empty()) {
      if (!invalid_stream_id_logged_.exchange(true,
                                              std::memory_order_relaxed)) {
@@ -413,34 +393,50 @@ int ScreenCapturerWin::Init(const int fps, cb_desktop_data cb) {
                      native_frame);
  };

-  impl_.reset();
  int ret = -1;
-  auto try_init = [&](std::unique_ptr<ScreenCapturer> candidate) {
-    ret = candidate ? candidate->Init(fps_, cb_) : -1;
-    if (ret != 0) {
-      LOG_WARN("Windows capturer: {} init failed (ret={})",
-               CaptureBackendName(candidate.get()), ret);
-      return false;
-    }
-    impl_ = std::move(candidate);
-    return true;
-  };
-  // Short-circuiting also keeps the unused WGC plugin unloaded.
-  if ((IsBackendEnabled(ScreenCaptureMethod::Dxgi) &&
-       try_init(std::make_unique<ScreenCapturerDxgi>())) ||
-      (IsBackendEnabled(ScreenCaptureMethod::Wgc) &&
-       try_init(WgcPluginCapturer::Create())) ||
-      (IsBackendEnabled(ScreenCaptureMethod::Gdi) &&
-       try_init(std::make_unique<ScreenCapturerGdi>()))) {
-    LOG_INFO("Windows capturer: using {}", CaptureBackendName(impl_.get()));
+
+  impl_ = WgcPluginCapturer::Create();
+  impl_is_wgc_plugin_ = (impl_ != nullptr);
+  ret = impl_ ? impl_->Init(fps_, cb_) : -1;
+  if (ret == 0) {
+    LOG_INFO("Windows capturer: using WGC plugin");
    BuildCanonicalFromImpl();
    monitor_index_.store(0, std::memory_order_relaxed);
    initial_monitor_index_ = 0;
    return 0;
  }

-  LOG_ERROR("Windows capturer: selected capture method {} failed, ret={}",
-            static_cast<int>(capture_method_), ret);
+  LOG_WARN("Windows capturer: WGC plugin init failed (ret={}), try DXGI", ret);
+  impl_.reset();
+  impl_is_wgc_plugin_ = false;
+
+  impl_ = std::make_unique<ScreenCapturerDxgi>();
+  impl_is_wgc_plugin_ = false;
+  ret = impl_->Init(fps_, cb_);
+  if (ret == 0) {
+    LOG_INFO("Windows capturer: using DXGI Desktop Duplication");
+    BuildCanonicalFromImpl();
+    monitor_index_.store(0, std::memory_order_relaxed);
+    initial_monitor_index_ = 0;
+    return 0;
+  }
+
+  LOG_WARN("Windows capturer: DXGI init failed (ret={}), fallback to GDI", ret);
+  impl_.reset();
+
+  impl_ = std::make_unique<ScreenCapturerGdi>();
+  impl_is_wgc_plugin_ = false;
+  ret = impl_->Init(fps_, cb_);
+  if (ret == 0) {
+    LOG_INFO("Windows capturer: using GDI BitBlt");
+    BuildCanonicalFromImpl();
+    monitor_index_.store(0, std::memory_order_relaxed);
+    initial_monitor_index_ = 0;
+    return 0;
+  }
+
+  LOG_ERROR("Windows capturer: all implementations failed, ret={}", ret);
+  impl_.reset();
  return -1;
 }

@@ -450,6 +446,7 @@ int ScreenCapturerWin::Destroy() {
  if (impl_) {
    impl_->Destroy();
    impl_.reset();
+    impl_is_wgc_plugin_ = false;
  }
  {
    std::lock_guard<std::mutex> lock(alias_mutex_);
@@ -462,13 +459,7 @@ int ScreenCapturerWin::Destroy() {

 void ScreenCapturerWin::EmitCapturedFrame(
    unsigned char* data, int size, int width, int height,
-    const char* stream_id, const MiniRtcNativeVideoFrame* native_frame,
-    bool from_secure_desktop) {
-  // Secure-desktop capture takes priority; remove privacy without dropping
-  // the helper frame or delaying the remote session.
-  if (from_secure_desktop && privacy_ && privacy_->Engaged()) {
-    privacy_->Fail("Secure desktop helper frame arrived; privacy screen will turn off");
-  }
+    const char* stream_id, const MiniRtcNativeVideoFrame* native_frame) {
  if (!cb_orig_) {
    return;
  }
@@ -508,43 +499,11 @@ void ScreenCapturerWin::EmitCapturedFrame(
  owned_frame->Release();
 }

-void ScreenCapturerWin::RestoreMonitor(int monitor_index) {
-  RebuildAliasesFromImpl();
-  if (monitor_index > 0 && impl_->SwitchTo(monitor_index) != 0) {
-    monitor_index_.store(0, std::memory_order_relaxed);
-  }
-}
-
-bool ScreenCapturerWin::TryStartBackend(
-    std::unique_ptr<ScreenCapturer> candidate, int monitor_index) {
-  if (!candidate) {
-    LOG_WARN("Windows capturer: WGC plugin unavailable");
-    return false;
-  }
-  const char* name = CaptureBackendName(candidate.get());
-  int ret = candidate->Init(fps_, cb_);
-  if (ret == 0)
-    ret = candidate->Start(show_cursor_.load(std::memory_order_relaxed));
-  if (ret != 0) {
-    LOG_WARN("Windows capturer: {} initialization/start failed (ret={})", name,
-             ret);
-    candidate->Destroy();
-    return false;
-  }
-  // Commit only after the replacement is running. Failed candidates release
-  // their resources without replacing the current backend.
-  impl_ = std::move(candidate);
-  RestoreMonitor(monitor_index);
-  LOG_INFO("Windows capturer: started {}", name);
-  return true;
-}
-
 int ScreenCapturerWin::Start(bool show_cursor) {
  if (!impl_) return -1;
  if (running_.load(std::memory_order_relaxed)) {
    return 0;
  }
-  NotifyPrivacyCapture(false);

  show_cursor_.store(show_cursor, std::memory_order_relaxed);
  paused_.store(false, std::memory_order_relaxed);
@@ -566,23 +525,40 @@ int ScreenCapturerWin::Start(bool show_cursor) {
    }
  }
  if (ret != 0) {
-    if (capture_method_ != ScreenCaptureMethod::Auto) {
-      LOG_ERROR("Windows capturer: selected backend {} failed to start (ret={})",
-                CaptureBackendName(impl_.get()), ret);
-      return ret;
-    }
    LOG_WARN("Windows capturer: refresh/start failed (ret={}), trying fallback",
             ret);

+    auto try_init_start = [&](std::unique_ptr<ScreenCapturer> cand) -> bool {
+      int r = cand->Init(fps_, cb_);
+      if (r != 0) return false;
+      int s = cand->Start(show_cursor);
+      if (s == 0) {
+        impl_ = std::move(cand);
+        impl_is_wgc_plugin_ = false;
+        RebuildAliasesFromImpl();
+        if (requested_monitor > 0 &&
+            impl_->SwitchTo(requested_monitor) != 0) {
+          monitor_index_.store(0, std::memory_order_relaxed);
+        }
+        return true;
+      }
+      return false;
+    };
+
    bool fallback_started = false;
-    if (dynamic_cast<ScreenCapturerDxgi*>(impl_.get()) &&
-        TryStartBackend(WgcPluginCapturer::Create(), requested_monitor)) {
-      fallback_started = true;
-    }
-    if (!fallback_started && (dynamic_cast<WgcPluginCapturer*>(impl_.get()) ||
-                              dynamic_cast<ScreenCapturerDxgi*>(impl_.get()))) {
-      fallback_started = TryStartBackend(std::make_unique<ScreenCapturerGdi>(),
-                                         requested_monitor);
+    if (impl_is_wgc_plugin_) {
+      if (try_init_start(std::make_unique<ScreenCapturerDxgi>())) {
+        LOG_INFO("Windows capturer: fallback to DXGI");
+        fallback_started = true;
+      } else if (try_init_start(std::make_unique<ScreenCapturerGdi>())) {
+        LOG_INFO("Windows capturer: fallback to GDI");
+        fallback_started = true;
+      }
+    } else if (dynamic_cast<ScreenCapturerDxgi*>(impl_.get())) {
+      if (try_init_start(std::make_unique<ScreenCapturerGdi>())) {
+        LOG_INFO("Windows capturer: fallback to GDI");
+        fallback_started = true;
+      }
    }

    if (!fallback_started) {
@@ -592,7 +568,6 @@ int ScreenCapturerWin::Start(bool show_cursor) {
  }

  running_.store(true, std::memory_order_relaxed);
-  NotifyPrivacyCapture(true);
  secure_desktop_capture_active_.store(false, std::memory_order_relaxed);
  post_secure_desktop_waiting_for_frame_.store(false,
                                               std::memory_order_relaxed);
@@ -606,7 +581,6 @@ int ScreenCapturerWin::Start(bool show_cursor) {
 }

 int ScreenCapturerWin::Stop() {
-  NotifyPrivacyCapture(false);
  running_.store(false, std::memory_order_relaxed);
  secure_desktop_capture_active_.store(false, std::memory_order_relaxed);
  post_secure_desktop_waiting_for_frame_.store(false,
@@ -639,8 +613,6 @@ int ScreenCapturerWin::SwitchTo(int monitor_index) {
  const int ret = impl_->SwitchTo(monitor_index);
  if (ret == 0) {
    monitor_index_.store(monitor_index, std::memory_order_relaxed);
-  } else if (privacy_) {
-    privacy_->Fail("Display switch failed; privacy screen will turn off");
  }
  return ret;
 }
@@ -763,19 +735,53 @@ void ScreenCapturerWin::StopSecureCaptureThread() {
 }

 bool ScreenCapturerWin::RestartCaptureBackendAfterSecureDesktop() {
-  NotifyPrivacyCapture(false);
  if (!impl_ || !running_.load(std::memory_order_relaxed)) {
    return false;
  }

  const bool show_cursor = show_cursor_.load(std::memory_order_relaxed);
  const int current_monitor = monitor_index_.load(std::memory_order_relaxed);
+  auto restore_monitor = [&]() {
+    RebuildAliasesFromImpl();
+    if (current_monitor > 0 && impl_->SwitchTo(current_monitor) != 0) {
+      monitor_index_.store(0, std::memory_order_relaxed);
+    }
+  };
+  auto try_started_backend = [&](std::unique_ptr<ScreenCapturer> cand,
+                                 const char* name,
+                                 bool is_wgc_plugin) -> bool {
+    if (!cand) {
+      return false;
+    }
+    const int init_ret = cand->Init(fps_, cb_);
+    if (init_ret != 0) {
+      LOG_WARN("Windows capturer: {} init after secure desktop failed (ret={})",
+               name, init_ret);
+      return false;
+    }
+    const int start_ret = cand->Start(show_cursor);
+    if (start_ret != 0) {
+      LOG_WARN(
+          "Windows capturer: {} start after secure desktop failed (ret={})",
+          name, start_ret);
+      cand->Destroy();
+      return false;
+    }
+    if (impl_) {
+      impl_->Destroy();
+    }
+    impl_ = std::move(cand);
+    impl_is_wgc_plugin_ = is_wgc_plugin;
+    restore_monitor();
+    LOG_INFO("Windows capturer: restarted {} after secure desktop", name);
+    return true;
+  };

  LOG_INFO("Windows capturer: restarting capture backend after secure desktop");
  impl_->Stop();
  int ret = impl_->Start(show_cursor);
  if (ret == 0) {
-    RestoreMonitor(current_monitor);
+    restore_monitor();
    return true;
  }

@@ -789,16 +795,20 @@ bool ScreenCapturerWin::RestartCaptureBackendAfterSecureDesktop() {
    ret = impl_->Start(show_cursor);
  }
  if (ret == 0) {
-    RestoreMonitor(current_monitor);
+    restore_monitor();
    return true;
  }

-  if ((IsBackendEnabled(ScreenCaptureMethod::Dxgi) &&
-       TryStartBackend(std::make_unique<ScreenCapturerDxgi>(), current_monitor)) ||
-      (IsBackendEnabled(ScreenCaptureMethod::Wgc) &&
-       TryStartBackend(WgcPluginCapturer::Create(), current_monitor)) ||
-      (IsBackendEnabled(ScreenCaptureMethod::Gdi) &&
-       TryStartBackend(std::make_unique<ScreenCapturerGdi>(), current_monitor))) {
+  if (impl_is_wgc_plugin_ &&
+      try_started_backend(WgcPluginCapturer::Create(), "WGC plugin", true)) {
+    return true;
+  }
+  if (try_started_backend(std::make_unique<ScreenCapturerDxgi>(), "DXGI",
+                          false)) {
+    return true;
+  }
+  if (try_started_backend(std::make_unique<ScreenCapturerGdi>(), "GDI",
+                          false)) {
    return true;
  }

@@ -1113,12 +1123,6 @@ void ScreenCapturerWin::SecureDesktopCaptureLoop() {
  std::vector<uint8_t> secure_frame;

  while (running_.load(std::memory_order_relaxed)) {
-    // Privacy covers belong to the ordinary desktop. Drop privacy on a
-    // secure desktop, while continuing the normal helper capture path.
-    if (privacy_ && privacy_->Engaged()) {
-      if (!IsWindowsPrivacyDesktopAvailable())
-        privacy_->Fail("Secure desktop or lock screen; privacy screen will turn off. Privacy cannot cover Windows security UI.");
-    }
    if (paused_.load(std::memory_order_relaxed)) {
      std::this_thread::sleep_for(std::chrono::milliseconds(10));
      continue;
@@ -1291,7 +1295,7 @@ void ScreenCapturerWin::SecureDesktopCaptureLoop() {
    if (frame_delivered && !secure_frame.empty()) {
      EmitCapturedFrame(secure_frame.data(),
                        static_cast<int>(secure_frame.size()), captured_width,
-                        captured_height, display_name.c_str(), nullptr, true);
+                        captured_height, display_name.c_str());
    }

    if (!frame_delivered && !frame_pending) {
@@ -20,8 +20,6 @@
 #include <vector>

 #include "screen_capturer.h"
-#include "screen_capture_method.h"
-#include "privacy_controller.h"

 namespace crossdesk {

@@ -45,19 +43,10 @@ class ScreenCapturerWin : public ScreenCapturer {
  int ResetToInitialMonitor() override;

  std::vector<DisplayInfo> GetDisplayInfoList() override;
-  void SetPrivacyController(PrivacyController* privacy) override { privacy_ = privacy; }
-  // Set before Init(), while capture is stopped.
-  void SetCaptureMethod(ScreenCaptureMethod method) { capture_method_ = method; }

 private:
  std::unique_ptr<ScreenCapturer> impl_;
-  ScreenCaptureMethod capture_method_ = ScreenCaptureMethod::Auto;
-  bool IsBackendEnabled(ScreenCaptureMethod method) const {
-    return capture_method_ == ScreenCaptureMethod::Auto ||
-           capture_method_ == method;
-  }
-  PrivacyController* privacy_ = nullptr;
-  void NotifyPrivacyCapture(bool running);
+  bool impl_is_wgc_plugin_ = false;
  int fps_ = 60;
  cb_desktop_data cb_;
  cb_desktop_data cb_orig_;
@@ -97,13 +86,9 @@ class ScreenCapturerWin : public ScreenCapturer {

  void BuildCanonicalFromImpl();
  void RebuildAliasesFromImpl();
-  void RestoreMonitor(int monitor_index);
-  bool TryStartBackend(std::unique_ptr<ScreenCapturer> candidate,
-                       int monitor_index);
  void EmitCapturedFrame(unsigned char* data, int size, int width, int height,
                         const char* stream_id,
-                         const MiniRtcNativeVideoFrame* native_frame = nullptr,
-                         bool from_secure_desktop = false);
+                         const MiniRtcNativeVideoFrame* native_frame = nullptr);
  void StopSecureCaptureThread();
  bool RestartCaptureBackendAfterSecureDesktop();
  void SecureDesktopCaptureLoop();
@@ -339,7 +339,6 @@ void WgcSessionImpl::OnClosed(
    winrt::Windows::Graphics::Capture::GraphicsCaptureItem const&,
    winrt::Windows::Foundation::IInspectable const&) {
  std::lock_guard locker(lock_);
-  if (observer_) observer_->OnFrame({}, id_);
  const bool was_running = is_running_;
  const bool was_paused = is_paused_;
  try {
@@ -0,0 +1,224 @@
+#include "windows_installer.h"
+
+#include <windows.h>
+
+#include <shobjidl.h>
+#include <winhttp.h>
+#include <wrl/client.h>
+
+#include <array>
+#include <fstream>
+#include <memory>
+#include <stdexcept>
+#include <system_error>
+
+#include "rd_log.h"
+
+namespace crossdesk {
+namespace {
+
+constexpr uint64_t kMaxInstallerSize = 1024ull * 1024 * 1024;
+// Stable identity used only for Windows Attachment Services policy/UI.
+constexpr GUID kAttachmentClient = {
+    0x72d17a6b,
+    0xeac1,
+    0x4816,
+    {0x91, 0x40, 0x33, 0x1b, 0xa7, 0x76, 0x22, 0xcd}};
+
+void CheckWin32(BOOL success, const char* operation) {
+  if (!success) {
+    throw std::system_error(static_cast<int>(GetLastError()),
+                            std::system_category(), operation);
+  }
+}
+
+struct InternetCloser {
+  void operator()(HINTERNET handle) const { WinHttpCloseHandle(handle); }
+};
+using InternetHandle = std::unique_ptr<void, InternetCloser>;
+
+struct PartialFile {
+  std::filesystem::path path;
+  ~PartialFile() {
+    std::error_code error;
+    std::filesystem::remove(path, error);
+  }
+};
+
+bool IsWindowsExecutable(const std::filesystem::path& path) {
+  std::ifstream input(path, std::ios::binary);
+  std::array<unsigned char, 64> header{};
+  input.read(reinterpret_cast<char*>(header.data()), header.size());
+  if (!input || header[0] != 'M' || header[1] != 'Z') return false;
+  const uint32_t pe_offset =
+      uint32_t(header[60]) | (uint32_t(header[61]) << 8) |
+      (uint32_t(header[62]) << 16) | (uint32_t(header[63]) << 24);
+  if (pe_offset < header.size()) return false;
+  input.seekg(pe_offset);
+  std::array<char, 4> signature{};
+  input.read(signature.data(), signature.size());
+  return input && signature == std::array<char, 4>{'P', 'E', 0, 0};
+}
+
+uint64_t ContentLength(HINTERNET request) {
+  std::array<wchar_t, 32> value{};
+  DWORD bytes = static_cast<DWORD>(sizeof(value));
+  if (!WinHttpQueryHeaders(request, WINHTTP_QUERY_CONTENT_LENGTH,
+                           WINHTTP_HEADER_NAME_BY_INDEX, value.data(), &bytes,
+                           WINHTTP_NO_HEADER_INDEX)) {
+    if (GetLastError() == ERROR_WINHTTP_HEADER_NOT_FOUND) return 0;
+    CheckWin32(FALSE, "WinHttpQueryHeaders(Content-Length)");
+  }
+  const std::wstring length(value.data());
+  if (length.empty() ||
+      length.find_first_not_of(L"0123456789") != std::wstring::npos) {
+    throw std::runtime_error("Invalid installer content length");
+  }
+  return std::stoull(length);
+}
+
+class ComApartment {
+ public:
+  ComApartment() : status_(CoInitializeEx(nullptr, COINIT_APARTMENTTHREADED)) {}
+  ~ComApartment() {
+    if (SUCCEEDED(status_)) CoUninitialize();
+  }
+  bool Ready() const {
+    return SUCCEEDED(status_) || status_ == RPC_E_CHANGED_MODE;
+  }
+
+ private:
+  HRESULT status_;
+};
+
+bool HandleAttachment(const std::filesystem::path& installer,
+                      const std::string& source, bool execute) {
+  ComApartment apartment;
+  if (!apartment.Ready()) {
+    LOG_WARN("Cannot initialize Windows Attachment Services");
+    return false;
+  }
+  Microsoft::WRL::ComPtr<IAttachmentExecute> attachment;
+  HRESULT result =
+      CoCreateInstance(CLSID_AttachmentServices, nullptr, CLSCTX_INPROC_SERVER,
+                       IID_PPV_ARGS(&attachment));
+  const std::wstring source_url(source.begin(), source.end());
+  if (SUCCEEDED(result)) result = attachment->SetClientGuid(kAttachmentClient);
+  if (SUCCEEDED(result))
+    result = attachment->SetClientTitle(L"CrossDesk Update");
+  if (SUCCEEDED(result)) result = attachment->SetLocalPath(installer.c_str());
+  if (SUCCEEDED(result)) result = attachment->SetSource(source_url.c_str());
+  if (SUCCEEDED(result)) {
+    if (execute) {
+      HANDLE process = nullptr;
+      // Execute applies attachment policy, scanning, and any required prompts.
+      // The installer's manifest, rather than this process, requests elevation.
+      result = attachment->Execute(GetActiveWindow(), L"open", &process);
+      if (process) CloseHandle(process);
+    } else {
+      // Save records the source zone and invokes installed trust/AV services.
+      result = attachment->Save();
+    }
+  }
+  if (FAILED(result)) {
+    LOG_WARN("Windows Attachment Services {} failed/blocked, HRESULT=0x{:08X}",
+             execute ? "execute" : "save", static_cast<uint32_t>(result));
+    return false;
+  }
+  return true;
+}
+
+}  // namespace
+
+bool DownloadWindowsInstaller(
+    const InstallerDownload& download, const std::filesystem::path& destination,
+    const std::function<bool(uint64_t, uint64_t)>& progress) {
+  auto partial_path = destination;
+  partial_path += ".part";
+  PartialFile partial{partial_path};
+  try {
+    if (!progress(0, 0)) return false;
+    const std::string agent = "CrossDesk/" CROSSDESK_VERSION " WindowsUpdater";
+    const std::wstring user_agent(agent.begin(), agent.end());
+    InternetHandle session(
+        WinHttpOpen(user_agent.c_str(), WINHTTP_ACCESS_TYPE_AUTOMATIC_PROXY,
+                    WINHTTP_NO_PROXY_NAME, WINHTTP_NO_PROXY_BYPASS, 0));
+    CheckWin32(session != nullptr, "WinHttpOpen");
+    CheckWin32(WinHttpSetTimeouts(session.get(), 5000, 5000, 5000, 5000),
+               "WinHttpSetTimeouts");
+    InternetHandle connection(WinHttpConnect(session.get(),
+                                             L"downloads.crossdesk.cn",
+                                             INTERNET_DEFAULT_HTTPS_PORT, 0));
+    CheckWin32(connection != nullptr, "WinHttpConnect");
+    const std::wstring path(download.path.begin(), download.path.end());
+    InternetHandle request(WinHttpOpenRequest(
+        connection.get(), L"GET", path.c_str(), nullptr, WINHTTP_NO_REFERER,
+        WINHTTP_DEFAULT_ACCEPT_TYPES, WINHTTP_FLAG_SECURE));
+    CheckWin32(request != nullptr, "WinHttpOpenRequest");
+    DWORD disabled = WINHTTP_DISABLE_REDIRECTS;
+    CheckWin32(WinHttpSetOption(request.get(), WINHTTP_OPTION_DISABLE_FEATURE,
+                                &disabled, sizeof(disabled)),
+               "Disable redirects");
+    // Use Windows certificate validation and configured proxies as-is. Do not
+    // ignore TLS errors, spoof a browser, or retry through alternative hosts.
+    CheckWin32(WinHttpSendRequest(request.get(), WINHTTP_NO_ADDITIONAL_HEADERS,
+                                  0, WINHTTP_NO_REQUEST_DATA, 0, 0, 0),
+               "WinHttpSendRequest");
+    CheckWin32(WinHttpReceiveResponse(request.get(), nullptr),
+               "WinHttpReceiveResponse");
+    DWORD status = 0;
+    DWORD status_size = sizeof(status);
+    CheckWin32(WinHttpQueryHeaders(
+                   request.get(),
+                   WINHTTP_QUERY_STATUS_CODE | WINHTTP_QUERY_FLAG_NUMBER,
+                   WINHTTP_HEADER_NAME_BY_INDEX, &status, &status_size,
+                   WINHTTP_NO_HEADER_INDEX),
+               "WinHttpQueryHeaders(status)");
+    if (status != 200) {
+      LOG_WARN("Windows installer download returned HTTP {}", status);
+      return false;
+    }
+    const uint64_t total = ContentLength(request.get());
+    if (total > kMaxInstallerSize || !progress(0, total)) return false;
+    std::ofstream output(partial.path, std::ios::binary | std::ios::trunc);
+    if (!output)
+      throw std::runtime_error("Cannot create installer download file");
+    uint64_t received = 0;
+    std::array<unsigned char, 64 * 1024> buffer{};
+    while (progress(received, total)) {
+      DWORD count = 0;
+      CheckWin32(WinHttpReadData(request.get(), buffer.data(),
+                                 static_cast<DWORD>(buffer.size()), &count),
+                 "WinHttpReadData");
+      if (count == 0) break;
+      received += count;
+      if (received > kMaxInstallerSize || (total > 0 && received > total))
+        return false;
+      output.write(reinterpret_cast<const char*>(buffer.data()), count);
+      if (!output)
+        throw std::runtime_error("Cannot write installer download file");
+    }
+    output.close();
+    if (output.fail() || received == 0 || (total > 0 && received != total) ||
+        !progress(received, total) || !IsWindowsExecutable(partial.path))
+      return false;
+    LOG_INFO("Windows installer downloaded, bytes={}", received);
+    std::filesystem::rename(partial.path, destination);
+    return true;
+  } catch (const std::exception& error) {
+    LOG_WARN("Windows installer download failed: {}", error.what());
+    return false;
+  }
+}
+
+bool CheckWindowsInstaller(const std::filesystem::path& installer,
+                           const std::string& source) {
+  return HandleAttachment(installer, source, false);
+}
+
+bool LaunchWindowsInstaller(const std::filesystem::path& installer,
+                            const std::string& source) {
+  return HandleAttachment(installer, source, true);
+}
+
+}  // namespace crossdesk
@@ -0,0 +1,33 @@
+/*
+ * @Author: DI JUNKUN
+ * @Date: 2026-09-09
+ * Copyright (c) 2026 by DI JUNKUN, All Rights Reserved.
+ */
+
+#ifndef _WINDOWS_INSTALLER_H_
+#define _WINDOWS_INSTALLER_H_
+
+#include <cstdint>
+#include <filesystem>
+#include <functional>
+#include <string>
+
+#include "installer_download.h"
+
+namespace crossdesk {
+
+bool DownloadWindowsInstaller(
+    const InstallerDownload& download, const std::filesystem::path& destination,
+    const std::function<bool(uint64_t, uint64_t)>& progress);
+
+// Attachment Services records the Internet source and applies Windows policy
+// and installed antivirus checks. Failure must never fall back to direct
+// launch.
+bool CheckWindowsInstaller(const std::filesystem::path& installer,
+                           const std::string& source);
+bool LaunchWindowsInstaller(const std::filesystem::path& installer,
+                            const std::string& source);
+
+}  // namespace crossdesk
+
+#endif
@@ -1,53 +0,0 @@
-/*
- * @Author: DI JUNKUN
- * @Date: 2026-09-10
- * Copyright (c) 2026 by DI JUNKUN, All Rights Reserved.
- */
-
-#ifndef _WINDOWS_THREAD_DPI_H_
-#define _WINDOWS_THREAD_DPI_H_
-
-#include <Windows.h>
-
-namespace crossdesk {
-
-// Keep newer DPI entry points out of the import table: privacy capability
-// checks must still be able to report unsupported on pre-2004 Windows.
-class ScopedWindowsPhysicalCoordinates {
- public:
-  using SetContext = DPI_AWARENESS_CONTEXT(WINAPI*)(DPI_AWARENESS_CONTEXT);
-  ScopedWindowsPhysicalCoordinates() {
-    setter_ = reinterpret_cast<SetContext>(GetProcAddress(
-        GetModuleHandleW(L"user32.dll"), "SetThreadDpiAwarenessContext"));
-    if (setter_) {
-      previous_ = setter_(DPI_AWARENESS_CONTEXT_PER_MONITOR_AWARE_V2);
-      // Ordinary remote input retains compatibility with Windows 10 1607.
-      // The privacy backend itself requires build 19041 before using this.
-      if (!previous_)
-        previous_ = setter_(DPI_AWARENESS_CONTEXT_PER_MONITOR_AWARE);
-    }
-  }
-  ~ScopedWindowsPhysicalCoordinates() {
-    if (setter_ && previous_) setter_(previous_);
-  }
-  ScopedWindowsPhysicalCoordinates(const ScopedWindowsPhysicalCoordinates&) =
-      delete;
-  ScopedWindowsPhysicalCoordinates& operator=(
-      const ScopedWindowsPhysicalCoordinates&) = delete;
-  bool active() const { return previous_ != nullptr; }
-
- private:
-  SetContext setter_ = nullptr;
-  DPI_AWARENESS_CONTEXT previous_ = nullptr;
-};
-
-inline UINT PrivacyWindowDpi(HWND hwnd) {
-  using GetDpi = UINT(WINAPI*)(HWND);
-  static const auto get_dpi = reinterpret_cast<GetDpi>(
-      GetProcAddress(GetModuleHandleW(L"user32.dll"), "GetDpiForWindow"));
-  return get_dpi ? get_dpi(hwnd) : 96;
-}
-
-}  // namespace crossdesk
-
-#endif  // _WINDOWS_THREAD_DPI_H_
@@ -0,0 +1,123 @@
+#include "windows_updater.h"
+
+#include <shlobj.h>
+#include <windows.h>
+
+#include <random>
+#include <stdexcept>
+
+#include "installer_download.h"
+#include "rd_log.h"
+#include "windows_installer.h"
+
+namespace crossdesk {
+
+WindowsUpdater::~WindowsUpdater() {
+  Cancel();
+  if (worker_.joinable()) worker_.join();
+  RemoveDownload();
+}
+
+void WindowsUpdater::RemoveDownload() {
+  // A running NSIS installer still needs its source file. Leave that one in
+  // the user's update cache; clean up cancelled/failed attempts.
+  if (installer_.empty() || installer_launched_) return;
+  std::error_code error;
+  std::filesystem::remove(installer_, error);
+  std::filesystem::remove(installer_.parent_path(), error);
+}
+
+void WindowsUpdater::Start(const nlohmann::json& metadata) {
+  const State state = GetState();
+  if (state == State::Downloading || state == State::Checking ||
+      state == State::Launching || state == State::SecurityBlocked)
+    return;
+  if (state == State::Ready || state == State::LaunchFailed ||
+      state == State::Launched) {
+    cancelled_ = false;
+    Launch();
+    return;
+  }
+  if (worker_.joinable()) worker_.join();
+  RemoveDownload();
+  installer_.clear();
+  installer_launched_ = false;
+  cancelled_ = false;
+  downloaded_ = 0;
+  total_ = 0;
+  const auto download = GetWindowsInstallerDownload(metadata);
+  if (!download) {
+    LOG_WARN("No valid Windows installer for the advertised version");
+    state_ = State::Failed;
+    return;
+  }
+  try {
+    std::random_device random;
+    PWSTR local_app_data = nullptr;
+    const HRESULT path_result = SHGetKnownFolderPath(
+        FOLDERID_LocalAppData, KF_FLAG_CREATE, nullptr, &local_app_data);
+    if (FAILED(path_result))
+      throw std::runtime_error("Cannot locate LocalAppData");
+    const std::filesystem::path data_path(local_app_data);
+    CoTaskMemFree(local_app_data);
+    const auto updates = data_path / L"CrossDesk" / L"Updates";
+    std::filesystem::create_directories(updates);
+    for (int attempt = 0; attempt < 10; ++attempt) {
+      const auto directory = updates / ("download-" + std::to_string(random()) +
+                                        "-" + std::to_string(random()));
+      if (std::filesystem::create_directory(directory)) {
+        installer_ = directory / download->filename;
+        break;
+      }
+    }
+    if (installer_.empty())
+      throw std::runtime_error("Cannot create update directory");
+    source_url_ = download->origin + download->path;
+    state_ = State::Downloading;
+    worker_ = std::thread([this, download = *download] {
+      const bool success = DownloadWindowsInstaller(
+          download, installer_, [this](uint64_t received, uint64_t total) {
+            downloaded_ = received;
+            total_ = total;
+            return !cancelled_.load();
+          });
+      if (success && !cancelled_) {
+        state_ = State::Checking;
+        state_ = CheckWindowsInstaller(installer_, source_url_)
+                     ? State::Ready
+                     : State::SecurityBlocked;
+      } else {
+        state_ = State::Failed;
+      }
+      if (cancelled_) state_ = State::Idle;
+    });
+  } catch (const std::exception& error) {
+    LOG_WARN("Cannot start Windows update: {}", error.what());
+    state_ = State::Failed;
+  }
+}
+
+void WindowsUpdater::Cancel() {
+  cancelled_ = true;
+  if (GetState() == State::Ready) state_ = State::Idle;
+}
+
+void WindowsUpdater::Launch() {
+  if (cancelled_) return;
+  const State state = GetState();
+  if (state != State::Ready && state != State::LaunchFailed &&
+      state != State::Launched)
+    return;
+  if (worker_.joinable()) worker_.join();
+  state_ = State::Launching;
+  if (!LaunchWindowsInstaller(installer_, source_url_)) {
+    state_ = State::LaunchFailed;
+    return;
+  }
+  installer_launched_ = true;
+  state_ = State::Launched;
+  // NSIS already prompts to close CrossDesk and stops the installed service.
+  // Keep this process alive if the user subsequently cancels installation.
+}
+
+}  // namespace crossdesk
@@ -0,0 +1,55 @@
+/*
+ * @Author: DI JUNKUN
+ * @Date: 2026-09-09
+ * Copyright (c) 2026 by DI JUNKUN, All Rights Reserved.
+ */
+
+#ifndef _WINDOWS_UPDATER_H_
+#define _WINDOWS_UPDATER_H_
+
+#include <atomic>
+#include <filesystem>
+#include <nlohmann/json.hpp>
+#include <string>
+#include <thread>
+
+namespace crossdesk {
+
+class WindowsUpdater {
+ public:
+  enum class State {
+    Idle,
+    Downloading,
+    Checking,
+    Ready,
+    Launching,
+    Failed,
+    SecurityBlocked,
+    LaunchFailed,
+    Launched
+  };
+
+  ~WindowsUpdater();
+  void Start(const nlohmann::json& metadata);
+  void Cancel();
+  void Launch();
+  State GetState() const { return state_.load(); }
+  uint64_t Downloaded() const { return downloaded_.load(); }
+  uint64_t Total() const { return total_.load(); }
+
+ private:
+  void RemoveDownload();
+
+  std::atomic<State> state_{State::Idle};
+  std::atomic<bool> cancelled_{false};
+  std::atomic<uint64_t> downloaded_{0};
+  std::atomic<uint64_t> total_{0};
+  std::thread worker_;
+  std::filesystem::path installer_;
+  std::string source_url_;
+  bool installer_launched_ = false;
+};
+
+}  // namespace crossdesk
+
+#endif
@@ -1,66 +0,0 @@
-/*
- * @Author: DI JUNKUN
- * @Date: 2026-09-10
- * Copyright (c) 2026 by DI JUNKUN, All Rights Reserved.
- */
-
-#ifndef _PRIVACY_BACKEND_H_
-#define _PRIVACY_BACKEND_H_
-
-#include <memory>
-#include <string>
-
-namespace crossdesk {
-
-struct PrivacyScreenText {
-  std::string unlock_hint = "To turn off the privacy screen, press";
-};
-
-struct PrivacyCapabilities {
-  bool overlay = false;
-  bool block_input = false;
-  std::string reason;
-};
-
-struct PrivacyHealth {
-  std::string failure;
-  bool emergency_exit = false;
-  bool ready = true;
-};
-
-// Lifecycle, message pumping and native resource operations run on the
-// controller's message thread. Const metadata queries are serialized with
-// those operations by the controller mutex and must not call native UI APIs.
-// AppKit work is queued to the main thread without waiting under this mutex.
-class PrivacyBackend {
- public:
-  virtual ~PrivacyBackend() = default;
-  virtual PrivacyCapabilities Query() = 0;
-  virtual bool Enable(bool block_input, const PrivacyScreenText& text,
-                      std::string& error) = 0;
-  virtual void Recover() = 0;
-  virtual bool IsRecovered() const = 0;
-  virtual bool RecoveryPending() const { return false; }
-  virtual PrivacyHealth Poll() = 0;
-  // Wait on both native window messages and controller commands.
-  // Wake is the only backend operation callable from another thread.
-  virtual void WaitForEvents(unsigned timeout_ms) = 0;
-  virtual void Wake() = 0;
-};
-
-#ifdef _WIN32
-std::unique_ptr<PrivacyBackend> CreateWindowsPrivacyBackend();
-bool IsWindowsPrivacyDesktopAvailable();
-#endif
-#ifdef __APPLE__
-std::unique_ptr<PrivacyBackend> CreateMacPrivacyBackend();
-// Flush queued AppKit cleanup after joining the controller at app shutdown.
-void FlushMacPrivacyTasks();
-#endif
-#ifdef __linux__
-std::unique_ptr<PrivacyBackend> CreateLinuxPrivacyBackend();
-#endif
-
-}  // namespace crossdesk
-
-#endif  // _PRIVACY_BACKEND_H_
@@ -1,210 +0,0 @@
-/* Copyright (c) 2026 by DI JUNKUN, All Rights Reserved. */
-#include "privacy_controller.h"
-#include <chrono>
-#include <cstring>
-#include "rd_log.h"
-
-namespace crossdesk {
-uint64_t PrivacyController::Now() {
-  return std::chrono::duration_cast<std::chrono::milliseconds>(
-      std::chrono::steady_clock::now().time_since_epoch()).count();
-}
-PrivacyController::PrivacyController(Factory factory) {
-  status_.state = PrivacyState::unsupported;
-  std::strcpy(status_.reason, "Privacy screen is not available on this platform");
-#ifdef _WIN32
-  if (!factory) factory = CreateWindowsPrivacyBackend;
-#elif defined(__APPLE__)
-  if (!factory) factory = CreateMacPrivacyBackend;
-#elif defined(__linux__)
-  if (!factory) factory = CreateLinuxPrivacyBackend;
-#endif
-  thread_ = std::thread([this, factory] { Run(factory); });
-}
-PrivacyController::~PrivacyController() { Shutdown(); }
-void PrivacyController::WakeLocked() {
-  if (backend_) backend_->Wake();
-  wake_.notify_all();
-}
-void PrivacyController::Shutdown() {
-  {
-    std::lock_guard lock(mutex_);
-    quit_ = true;
-    WakeLocked();
-  }
-  if (thread_.joinable()) thread_.join();
-#ifdef __APPLE__
-  FlushMacPrivacyTasks();
-#endif
-}
-PrivacyStatus PrivacyController::Snapshot() const {
-  std::lock_guard lock(mutex_);
-  return status_;
-}
-void PrivacyController::SetText(const PrivacyScreenText& text) {
-  std::lock_guard lock(mutex_);
-  text_ = text;
-}
-void PrivacyController::SetState(PrivacyState state, const std::string& reason) {
-  status_.state = state;
-  status_.remote_paused = false; // Wire compatibility; privacy never pauses a session.
-  ++status_.revision;
-  std::strncpy(status_.reason, reason.c_str(), sizeof(status_.reason) - 1);
-  status_.reason[sizeof(status_.reason) - 1] = '\0';
-  LOG_INFO("Privacy: state={}, overlay={}, input_blocked={}, reason={}",
-           static_cast<int>(state), status_.overlay_active, status_.input_blocked, reason);
-}
-void PrivacyController::Enable(bool block_input) {
-  std::lock_guard lock(mutex_);
-  if (quit_ || engaged_.load() || disable_pending_) return;
-  if (!status_.supported || (block_input && !status_.input_block_supported)) {
-    SetState(PrivacyState::unsupported, "Privacy screen is unavailable");
-    return;
-  }
-  engaged_.store(true);
-  block_requested_ = block_input;
-  automatic_enable_ = false;
-  enable_pending_ = true;
-  failure_.clear();
-  started_ = Now();
-  SetState(PrivacyState::starting, "Enabling privacy screen");
-  WakeLocked();
-}
-void PrivacyController::EnableOnConnection() {
-  std::lock_guard lock(mutex_);
-  if (quit_ || (engaged_.load() && !disable_pending_)) return;
-  // A reconnect may arrive before asynchronous AppKit recovery has completed.
-  engaged_.store(true);
-  block_requested_ = true;
-  automatic_enable_ = true;
-  enable_pending_ = true;
-  failure_.clear();
-  started_ = Now();
-  SetState(PrivacyState::starting, "Enabling privacy on connection");
-  WakeLocked();
-}
-void PrivacyController::Disable() {
-  std::lock_guard lock(mutex_);
-  if (quit_) return;
-  enable_pending_ = false;
-  failure_.clear();
-  disable_pending_ = true;
-  SetState(PrivacyState::stopping, "Restoring local desktop and input");
-  WakeLocked();
-}
-void PrivacyController::Disconnected() { Disable(); }
-void PrivacyController::FailLocked(const std::string& reason) {
-  if (!engaged_.load() || disable_pending_) return;
-  failure_ = reason;
-  enable_pending_ = false;
-  disable_pending_ = true;
-  SetState(PrivacyState::failed, reason);
-  WakeLocked();
-}
-void PrivacyController::Fail(const std::string& reason) {
-  std::lock_guard lock(mutex_);
-  FailLocked(reason);
-}
-void PrivacyController::CaptureChanged(bool running) {
-  std::lock_guard lock(mutex_);
-  // Windows announces a stopped capture while preparing the first session.
-  // Keep automatic privacy pending until capture starts, within its deadline.
-  // Once capture was running or backend enable began, a stop remains a fault.
-  const bool waiting_for_initial_capture =
-      automatic_enable_ && enable_pending_ && !capture_running_;
-  capture_running_ = running;
-  if (!running && !waiting_for_initial_capture)
-    FailLocked("Capture changed; privacy screen is being turned off");
-  WakeLocked();
-}
-void PrivacyController::Run(Factory factory) {
-  std::unique_lock lock(mutex_);
-  try {
-    if (factory) backend_ = factory();
-    while (!quit_) {
-      if (last_capability_check_ == 0 ||
-          (!engaged_.load() && Now() - last_capability_check_ >= 2000)) {
-        last_capability_check_ = Now();
-        const auto caps = backend_ ? backend_->Query() : PrivacyCapabilities{};
-        const bool changed = status_.supported != caps.overlay ||
-                             status_.input_block_supported != caps.block_input;
-        status_.supported = caps.overlay;
-        status_.input_block_supported = caps.block_input;
-        if (!engaged_.load() && (changed || status_.revision == 0))
-          SetState(caps.overlay ? PrivacyState::off : PrivacyState::unsupported, caps.reason);
-      }
-      if (disable_pending_) {
-        if (backend_) backend_->Recover();
-        if (backend_ && backend_->RecoveryPending()) {
-          lock.unlock();
-          backend_->WaitForEvents(25);
-          lock.lock();
-          continue;
-        }
-        disable_pending_ = false;
-        if (backend_ && !backend_->IsRecovered()) {
-          enable_pending_ = false;
-          disable_pending_ = true; // Retry native cleanup without affecting the session.
-          SetState(PrivacyState::failed, "Could not release every privacy resource");
-        } else {
-          status_.overlay_active = status_.input_blocked = false;
-          if (!enable_pending_) {
-            engaged_.store(false);
-            SetState(failure_.empty() ? PrivacyState::off : PrivacyState::failed,
-                     failure_.empty() ? "Privacy screen is off" : failure_);
-          }
-        }
-      }
-      if (enable_pending_) {
-        const auto caps = backend_ ? backend_->Query() : PrivacyCapabilities{};
-        status_.supported = caps.overlay;
-        status_.input_block_supported = caps.block_input;
-        if (!caps.overlay || (block_requested_ && !caps.block_input)) {
-          FailLocked("Privacy screen unavailable: " + caps.reason);
-        } else if (!capture_running_) {
-          if (!automatic_enable_ || Now() - started_ > 10000)
-            FailLocked("No desktop capture available for privacy screen");
-        } else {
-          enable_pending_ = false;
-          std::string error;
-          if (!backend_->Enable(block_requested_, text_, error)) {
-            FailLocked(error);
-          } else {
-            status_.overlay_active = true;
-            status_.input_blocked = block_requested_;
-            started_ = Now();
-          }
-        }
-      }
-      const auto health = backend_ ? backend_->Poll() : PrivacyHealth{};
-      if (engaged_.load() && !disable_pending_) {
-        if (health.emergency_exit) {
-          failure_.clear();
-          enable_pending_ = false;
-          disable_pending_ = true;
-          SetState(PrivacyState::stopping, "Local shortcut: restoring desktop and input");
-        } else if (!health.failure.empty()) {
-          FailLocked(health.failure);
-        } else if (!enable_pending_ && status_.state == PrivacyState::starting) {
-          if (health.ready)
-            SetState(PrivacyState::on, "Privacy screen is on");
-          else if (Now() - started_ > 3000)
-            FailLocked("Privacy screen did not become ready");
-        }
-      }
-      if (backend_) {
-        const unsigned timeout = engaged_.load() || disable_pending_ ? 25 : 2000;
-        lock.unlock();
-        backend_->WaitForEvents(timeout);
-        lock.lock();
-      } else {
-        wake_.wait(lock, [this] { return quit_ || enable_pending_ || disable_pending_; });
-      }
-    }
-  } catch (const std::exception& e) {
-    if (!lock.owns_lock()) lock.lock();
-    SetState(PrivacyState::failed, std::string("Privacy component failed: ") + e.what());
-  }
-  if (backend_) { backend_->Recover(); backend_.reset(); }
-}
-}  // namespace crossdesk
@@ -1,59 +0,0 @@
-/* Copyright (c) 2026 by DI JUNKUN, All Rights Reserved. */
-#ifndef _PRIVACY_CONTROLLER_H_
-#define _PRIVACY_CONTROLLER_H_
-
-#include <remote_action.h>
-#include <atomic>
-#include <condition_variable>
-#include <functional>
-#include <mutex>
-#include <thread>
-#include "privacy_backend.h"
-
-namespace crossdesk {
-
-// Privacy is optional: it must never gate desktop video, audio or remote input.
-// A failed backend is recovered automatically while the session keeps running.
-class PrivacyController {
- public:
-  using Factory = std::function<std::unique_ptr<PrivacyBackend>()>;
-  explicit PrivacyController(Factory factory = {});
-  ~PrivacyController();
-  PrivacyController(const PrivacyController&) = delete;
-  PrivacyController& operator=(const PrivacyController&) = delete;
-  PrivacyStatus Snapshot() const;
-  void SetText(const PrivacyScreenText& text);
-  void Enable(bool block_input);
-  void EnableOnConnection();
-  void Disable();
-  void Disconnected();
-  void Shutdown();
-  void Fail(const std::string& reason);
-  bool Engaged() const { return engaged_.load(); }
-  void CaptureChanged(bool running);
-
- private:
-  void Run(Factory factory);
-  void WakeLocked();
-  void SetState(PrivacyState state, const std::string& reason);
-  void FailLocked(const std::string& reason);
-  static uint64_t Now();
-  mutable std::mutex mutex_;
-  std::condition_variable wake_;
-  std::thread thread_;
-  std::unique_ptr<PrivacyBackend> backend_;
-  PrivacyStatus status_{};
-  PrivacyScreenText text_;
-  std::atomic<bool> engaged_{false};
-  bool quit_ = false;
-  bool enable_pending_ = false;
-  bool disable_pending_ = false;
-  bool block_requested_ = false;
-  bool automatic_enable_ = false;
-  bool capture_running_ = false;
-  std::string failure_;
-  uint64_t started_ = 0;
-  uint64_t last_capability_check_ = 0;
-};
-}  // namespace crossdesk
-#endif
@@ -1,22 +0,0 @@
-/*
- * @Author: DI JUNKUN
- * @Date: 2026-09-11
- * Copyright (c) 2026 by DI JUNKUN, All Rights Reserved.
- */
-
-#ifndef _SCREEN_CAPTURE_METHOD_H_
-#define _SCREEN_CAPTURE_METHOD_H_
-
-namespace crossdesk {
-
-// Persisted values; keep these in the same order as the settings choices.
-enum class ScreenCaptureMethod { Auto = 0, Dxgi = 1, Wgc = 2, Gdi = 3 };
-
-inline bool IsValidScreenCaptureMethod(long value) {
-  return value >= static_cast<long>(ScreenCaptureMethod::Auto) &&
-         value <= static_cast<long>(ScreenCaptureMethod::Gdi);
-}
-
-}  // namespace crossdesk
-
-#endif
@@ -14,13 +14,8 @@

 namespace crossdesk {

-class PrivacyController;
-
 class ScreenCapturer {
 public:
-  // Windows backends emit a control-only callback BEFORE automatic recovery.
-  // No video buffer accompanies this notification; wrappers must consume it.
-  static constexpr int kBackendReset = -1;
  // |stream_id| is a logical MiniRTC stream ID (DisplayN), not a platform
  // display name or physical handle. |native_frame| is borrowed for the
  // duration of the callback; retain its owner before using it asynchronously.
@@ -34,7 +29,6 @@ class ScreenCapturer {

 public:
  virtual int Init(const int fps, cb_desktop_data cb) = 0;
-  virtual void SetPrivacyController(PrivacyController*) {}
  virtual int Destroy() = 0;
  virtual int Start(bool show_cursor) = 0;
  virtual int Stop() = 0;
@@ -0,0 +1,41 @@
+#include "installer_download.h"
+
+namespace crossdesk {
+std::optional<InstallerDownload> GetWindowsInstallerDownload(
+    const nlohmann::json& metadata) {
+  if (!metadata.is_object()) return std::nullopt;
+  const auto version_it = metadata.find(
+      metadata.contains("latest_version") ? "latest_version" : "version");
+  if (version_it == metadata.end() || !version_it->is_string()) {
+    return std::nullopt;
+  }
+  std::string version = version_it->get<std::string>();
+  if (!version.empty() && version.front() == 'v') version.erase(0, 1);
+  if (version.empty() ||
+      version.find_first_not_of(
+          "0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ.-") !=
+          std::string::npos) {
+    return std::nullopt;
+  }
+  const auto downloads = metadata.find("downloads");
+  if (downloads == metadata.end() || !downloads->is_object())
+    return std::nullopt;
+  const auto installer = downloads->find("windows-x64");
+  if (installer == downloads->end() || !installer->is_object())
+    return std::nullopt;
+  const auto url = installer->find("url");
+  const auto filename = installer->find("filename");
+  InstallerDownload result{"https://downloads.crossdesk.cn", "",
+                           "crossdesk-win-x64-v" + version + ".exe"};
+  result.path = "/" + result.filename;
+  if (url == installer->end() || !url->is_string() ||
+      url->get<std::string>() != result.origin + result.path ||
+      (filename != installer->end() &&
+       (!filename->is_string() ||
+        filename->get<std::string>() != result.filename))) {
+    return std::nullopt;
+  }
+  return result;
+}
+
+}  // namespace crossdesk
@@ -0,0 +1,28 @@
+/*
+ * @Author: DI JUNKUN
+ * @Date: 2026-09-09
+ * Copyright (c) 2026 by DI JUNKUN, All Rights Reserved.
+ */
+
+#ifndef _INSTALLER_DOWNLOAD_H_
+#define _INSTALLER_DOWNLOAD_H_
+
+#include <nlohmann/json.hpp>
+#include <optional>
+#include <string>
+
+namespace crossdesk {
+
+struct InstallerDownload {
+  std::string origin;
+  std::string path;
+  std::string filename;
+};
+
+// Only accept the official Windows installer for the advertised version.
+std::optional<InstallerDownload> GetWindowsInstallerDownload(
+    const nlohmann::json& metadata);
+
+}  // namespace crossdesk
+
+#endif
@@ -1,78 +0,0 @@
-- Run from the repository root: xmake lua apps/desktop/tests/build_define_scope_test.lua windows true
-- Inspect the real Xmake target graph without configuring/downloading packages.
-function main(plat, portable)
-    import("core.project.config")
-    import("core.project.project")
-    config.load()
-    config.set("plat", plat or "windows", {force = true})
-    config.set("arch", plat == "macosx" and "arm64" or "x64", {force = true})
-    config.set("CROSSDESK_PORTABLE", portable == "true", {force = true})
-    config.set("CROSSDESK_VERSION", "v1.5.3-2-20260913", {force = true})
-    local targets = project.targets()
-    local function flatten(values)
-        local result = {}
-        local function append(value)
-            if type(value) == "table" then
-                for _, entry in ipairs(value) do append(entry) end
-            elseif value ~= nil then
-                table.insert(result, value)
-            end
-        end
-        append(values)
-        return result
-    end
-    local function contains(values, expected)
-        return table.contains(flatten(values), expected)
-    end
-    local function effective_defines(target)
-        return table.join(table.wrap(target:get("defines")),
-            flatten(target:get_from("defines", "dep::*")))
-    end
-
-    for _, name in ipairs({"minirtc", "media", "common", "crossdesk_wire", "rd_log"}) do
-        for _, define in ipairs(effective_defines(targets[name])) do
-            assert(not define:startswith("CROSSDESK_VERSION"), name .. " inherits version macros")
-            assert(not define:startswith("CROSSDESK_PORTABLE"), name .. " inherits portable macros")
-        end
-    end
-    for _, name in ipairs({"gui", "crossdesk", "path_manager"}) do
-        assert(contains(effective_defines(targets[name]), "CROSSDESK_PORTABLE=1") ==
-            (portable == "true"), name .. " has inconsistent portable layout/configuration")
-    end
-
-    local gui = targets.gui
-    local version_files = {
-        ["apps/desktop/src/gui/application/gui_application.cpp"] = true,
-        ["apps/desktop/src/gui/runtime/peer_event_handler.cpp"] = true
-    }
-    local seen = {}
-    for _, file in ipairs(gui:sourcefiles()) do
-        assert(not seen[file], "duplicate GUI source: " .. file)
-        seen[file] = true
-        local defines = (gui:fileconfig(file) or {}).defines
-        assert(contains(defines, 'CROSSDESK_VERSION="v1.5.3-2-20260913"') ==
-            (version_files[file] == true), "unexpected version scope: " .. file)
-    end
-    for file in pairs(version_files) do
-        assert(seen[file], "missing version consumer: " .. file)
-    end
-
-    if plat == "windows" then
-        local resources = {
-            crossdesk = portable == "true" and "crossdesk_portable" or "crossdesk",
-            crossdesk_service = "crossdesk_service",
-            crossdesk_session_helper = "crossdesk_session_helper",
-            crossdesk_privacy_window = "crossdesk_privacy_window",
-            wgc_plugin = "wgc_plugin"
-        }
-        for name, resource in pairs(resources) do
-            local defines = targets[name]:fileconfig(
-                "apps/desktop/resources/windows/" .. resource .. ".rc").defines
-            assert(contains(defines, 'CROSSDESK_VERSION_STRING="v1.5.3-2-20260913"'))
-            assert(contains(defines, "CROSSDESK_VERSION_NUMERIC=1,5,3,0"))
-            assert(contains(defines, "CROSSDESK_PORTABLE=1") ==
-                (name == "crossdesk_session_helper" and portable == "true"))
-        end
-    end
-    print("Build define scopes passed: %s portable=%s", plat, portable)
-end
@@ -56,6 +56,8 @@ int main() {
  bool ok = true;
  ok &= ExpectContains("mouse_controller.cpp", mouse_controller,
                       "INPUT ip = {0};");
+  ok &= ExpectContains("mouse_controller.cpp", mouse_controller,
+                       "SetCursorPos failed");
  ok &= ExpectContains("mouse_controller.cpp", mouse_controller,
                       "SendInput failed for mouse");
  return ok ? 0 : 1;
@@ -0,0 +1,123 @@
+# Portable tests for artifact handling and signature validation decisions.
+# Get-AuthenticodeSignature and SignTool are simulated; CI validates real files.
+$ErrorActionPreference = 'Stop'
+$scripts = Join-Path $PSScriptRoot '../scripts/windows'
+. "$scripts/signpath-common.ps1"
+$artifactScript = Join-Path $scripts 'signpath-artifact.ps1'
+$testDirectory = Join-Path ([IO.Path]::GetTempPath()) "crossdesk-signing-test-$([guid]::NewGuid())"
+New-Item -ItemType Directory -Path $testDirectory | Out-Null
+$checks = 0
+
+function Assert-True([bool]$Condition, [string]$Message) {
+  if (!$Condition) { throw $Message }
+  $script:checks++
+}
+
+function Assert-Throws([scriptblock]$Action, [string]$Expected) {
+  try { & $Action } catch {
+    if ($_.Exception.Message -notlike "*$Expected*") { throw }
+    $script:checks++
+    return
+  }
+  throw "Expected an error containing: $Expected"
+}
+
+function New-TestZip([string]$Path, [string[]]$Names) {
+  $zip = [IO.Compression.ZipFile]::Open($Path, [IO.Compression.ZipArchiveMode]::Create)
+  try {
+    foreach ($name in $Names) {
+      $writer = [IO.StreamWriter]::new($zip.CreateEntry($name).Open())
+      try { $writer.Write("signed $name") } finally { $writer.Dispose() }
+    }
+  } finally { $zip.Dispose() }
+}
+
+$mockStatus = 'NotTrusted'
+$mockBadFile = ''
+$mockCertificate = [pscustomobject]@{ Subject = "CN=Test certificate for 'CrossDesk [OSS]'" }
+$mockTimestamp = $null
+function Get-AuthenticodeSignature {
+  param([string]$LiteralPath)
+  $status = if ([IO.Path]::GetFileName($LiteralPath) -eq $mockBadFile) { 'HashMismatch' } else { $mockStatus }
+  return [pscustomobject]@{
+    Status = $status
+    SignerCertificate = $mockCertificate
+    TimeStamperCertificate = $mockTimestamp
+  }
+}
+
+try {
+  $files = @(Get-CrossDeskSigningFiles)
+  $build = Join-Path $testDirectory 'build'
+  New-Item -ItemType Directory -Path $build | Out-Null
+  foreach ($name in $files) { Set-Content -LiteralPath (Join-Path $build $name) -Value "original $name" }
+  Set-Content -LiteralPath (Join-Path $build 'third-party.dll') -Value 'upstream'
+  $unsigned = Join-Path $testDirectory 'unsigned.zip'
+  & $artifactScript -Operation PrepareBinaries -Directory $build -Artifact $unsigned
+  $zip = [IO.Compression.ZipFile]::OpenRead($unsigned)
+  try {
+    $entries = @($zip.Entries | ForEach-Object { $_.FullName })
+    Assert-True ($entries.Count -eq 4 -and @(Compare-Object $files $entries).Count -eq 0) 'Signing input must include only the four project binaries.'
+  } finally { $zip.Dispose() }
+
+  [xml]$config = Get-Content -Raw (Join-Path $scripts 'signpath-binaries.xml')
+  $configured = @($config.SelectNodes('//*[local-name()="include"]') | ForEach-Object { $_.path })
+  Assert-True (@(Compare-Object $files $configured).Count -eq 0) 'SignPath XML must cover exactly the files in the submitted ZIP.'
+
+  Remove-Item -LiteralPath (Join-Path $build 'wgc_plugin.dll')
+  Assert-Throws { & $artifactScript -Operation PrepareBinaries -Directory $build -Artifact (Join-Path $testDirectory 'missing.zip') } 'Missing CrossDesk binary'
+  Set-Content -LiteralPath (Join-Path $build 'wgc_plugin.dll') -Value 'original wgc_plugin.dll'
+
+  $signed = Join-Path $testDirectory 'signed.zip'
+  New-TestZip $signed $files
+  $mockBadFile = 'wgc_plugin.dll'
+  Assert-Throws { & $artifactScript -Operation RestoreBinaries -Directory $build -Artifact $signed -SigningPolicy test-signing } 'HashMismatch'
+  foreach ($name in $files) {
+    Assert-True ((Get-Content -Raw (Join-Path $build $name)).Trim() -eq "original $name") 'Failed verification must not replace any output.'
+  }
+  $mockBadFile = ''
+  & $artifactScript -Operation RestoreBinaries -Directory $build -Artifact $signed -SigningPolicy test-signing
+  foreach ($name in $files) {
+    Assert-True ((Get-Content -Raw (Join-Path $build $name)) -eq "signed $name") 'Verified signed files must replace the unsigned build output.'
+  }
+  Assert-True ((Get-Content -Raw (Join-Path $build 'third-party.dll')).Trim() -eq 'upstream') 'Third-party libraries must remain untouched.'
+
+  $badArchives = @(
+    @($files[0], $files[1], $files[2]),
+    @($files[0], $files[1], $files[2], '../wgc_plugin.dll'),
+    @($files[0], $files[1], $files[2], $files[0]),
+    @($files[0], $files[1], $files[2], $files[3], 'third-party.dll')
+  )
+  for ($i = 0; $i -lt $badArchives.Count; $i++) {
+    $badZip = Join-Path $testDirectory "bad-$i.zip"
+    New-TestZip $badZip $badArchives[$i]
+    Assert-Throws { & $artifactScript -Operation RestoreBinaries -Directory $build -Artifact $badZip -SigningPolicy test-signing } 'Signed archive must contain exactly'
+  }
+
+  $file = Join-Path $build 'crossdesk.exe'
+  foreach ($mockStatus in @('NotSigned', 'HashMismatch', 'UnknownError')) {
+    Assert-Throws { Assert-CrossDeskSignature $file test-signing } 'Invalid test signature'
+  }
+  $mockStatus = 'Valid'
+  $mockCertificate = $null
+  Assert-Throws { Assert-CrossDeskSignature $file test-signing } 'no Authenticode signing certificate'
+  $mockCertificate = [pscustomobject]@{ Subject = 'CN=SignPath Foundation' }
+  $mockStatus = 'NotTrusted'
+  Assert-Throws { Assert-CrossDeskSignature $file release-signing } 'Release signature is not trusted'
+  $mockStatus = 'Valid'
+  Assert-Throws { Assert-CrossDeskSignature $file release-signing } 'no timestamp'
+  $mockTimestamp = [pscustomobject]@{ Subject = 'CN=Timestamp authority' }
+
+  # Only the real SignTool process is replaced; exercise the actual exit-code check.
+  $fakeSignTool = Join-Path $testDirectory 'signtool.ps1'
+  function Find-CrossDeskSignTool { return $fakeSignTool }
+  Set-Content $fakeSignTool '$global:LASTEXITCODE = 1'
+  Assert-Throws { Assert-CrossDeskSignature $file release-signing } 'SignTool verification failed'
+  Set-Content $fakeSignTool '$global:LASTEXITCODE = 0'
+  Assert-CrossDeskSignature $file release-signing
+  $checks++
+
+  Write-Host "Passed $checks Windows signing checks."
+} finally {
+  Remove-Item -LiteralPath $testDirectory -Recurse -Force
+}
@@ -29,6 +29,30 @@ function setup_options_and_dependencies()
        set_description("Build CrossDesk as a portable package that stores data beside the executable")
    option_end()

+    -- Preserve the existing codebase/toolchain contract. Slint targets opt in to
+    -- C++20 locally because its generated C++ API requires it.
+    local crossdesk_version = get_config("CROSSDESK_VERSION") or "0.0.0"
+    local version_base = crossdesk_version:gsub("^v", ""):match("^(%d[%d%.]*)") or "0.0.0"
+    local version_parts = {}
+    for part in version_base:gmatch("%d+") do
+        local value = tonumber(part) or 0
+        if value > 65535 then
+            value = 0
+        end
+        table.insert(version_parts, value)
+        if #version_parts == 4 then
+            break
+        end
+    end
+    while #version_parts < 4 do
+        table.insert(version_parts, 0)
+    end
+
+    add_defines("CROSSDESK_VERSION_STRING=\"" .. crossdesk_version .. "\"")
+    if is_os("windows") then
+        add_defines("CROSSDESK_VERSION_NUMERIC=" .. table.concat(version_parts, ","))
+    end
+
    -- set_policy("build.warning", true)
    -- set_warnings("all", "extra")
    -- add_cxxflags("/W4", "/WX")
@@ -37,6 +61,10 @@ function setup_options_and_dependencies()
    add_defines("USE_CUDA=" .. (is_config("USE_CUDA", true) and "1" or "0"))
    add_defines("USE_WAYLAND=" .. (is_config("USE_WAYLAND", true) and "1" or "0"))
    add_defines("USE_DRM=" .. (is_config("USE_DRM", true) and "1" or "0"))
+    if is_config("CROSSDESK_PORTABLE", true) then
+        add_defines("CROSSDESK_PORTABLE=1")
+    end
+
    if is_mode("debug") then
        add_defines("CROSSDESK_DEBUG")
    end
@@ -3,30 +3,6 @@ function setup_targets()

    includes("deps/submodules", "deps/thirdparty")

-    local crossdesk_version = get_config("CROSSDESK_VERSION") or "0.0.0"
-    local version_define = "CROSSDESK_VERSION=\"" .. crossdesk_version .. "\""
-    local windows_resource_defines = {
-        "CROSSDESK_VERSION_STRING=\"" .. crossdesk_version .. "\""
-    }
-    local version_base = crossdesk_version:gsub("^v", ""):match("^(%d[%d%.]*)") or "0.0.0"
-    local version_parts = {}
-    for part in version_base:gmatch("%d+") do
-        local value = tonumber(part) or 0
-        table.insert(version_parts, value <= 65535 and value or 0)
-        if #version_parts == 4 then
-            break
-        end
-    end
-    while #version_parts < 4 do
-        table.insert(version_parts, 0)
-    end
-    table.insert(windows_resource_defines,
-        "CROSSDESK_VERSION_NUMERIC=" .. table.concat(version_parts, ","))
-    local windows_helper_resource_defines = table.join(windows_resource_defines)
-    if is_config("CROSSDESK_PORTABLE", true) then
-        table.insert(windows_helper_resource_defines, "CROSSDESK_PORTABLE=1")
-    end
-
    local function copy_slint_runtime(target)
        if not target:is_plat("windows") then
            return
@@ -74,9 +50,6 @@ function setup_targets()

    target("path_manager")
        set_kind("object")
-        if is_config("CROSSDESK_PORTABLE", true) then
-            add_defines("CROSSDESK_PORTABLE=1")
-        end
        add_deps("rd_log")
        add_files("apps/desktop/src/path_manager/*.cpp")
        if is_os("windows") then
@@ -183,48 +156,12 @@ function setup_targets()
            add_frameworks("Security", "CoreFoundation")
        end

-    target("privacy")
-        set_kind("object")
-        add_deps("rd_log", "crossdesk_wire")
-        add_files("apps/desktop/src/privacy/privacy_controller.cpp")
-        add_includedirs("apps/desktop/src/privacy", {public = true})
-        if is_os("windows") then
-            add_files("apps/desktop/src/platform/windows/privacy/*.cpp")
-            add_deps("crossdesk_privacy_cursor_helper")
-            add_deps("crossdesk_privacy_window", {inherit = false})
-            add_includedirs("apps/desktop/src/platform/windows/input")
-            add_syslinks("Wtsapi32", "Ole32", {public = true})
-        elseif is_os("macosx") then
-            add_files("apps/desktop/src/platform/macos/privacy/*.mm")
-            add_mxxflags("-fobjc-arc")
-            add_frameworks("AppKit", "ApplicationServices", {public = true})
-        elseif is_os("linux") then
-            add_files("apps/desktop/src/platform/linux/privacy/*.cpp")
-            add_syslinks("Xi", {public = true})
-        end
-
-    if is_os("windows") then
-        target("crossdesk_privacy_window")
-            set_kind("shared")
-            set_runtimes("MT")
-            add_files("apps/desktop/src/platform/windows/privacy/band_module/main.cpp")
-            add_files("apps/desktop/src/platform/windows/privacy/band_module/privacy_cover_renderer.cpp")
-            add_files("apps/desktop/resources/windows/crossdesk_privacy_window.rc",
-                {defines = windows_resource_defines})
-            add_syslinks("user32", "gdi32", "dwmapi")
-
-        target("crossdesk_privacy_cursor_helper")
-            set_kind("binary")
-            add_files("apps/desktop/src/platform/windows/privacy/cursor_helper/main.cpp")
-    end
-
    target("screen_capturer")
        set_kind("object")
        add_deps("rd_log", "common", "crossdesk_wire")
        add_includedirs("apps/desktop/src/screen_capturer", {public = true})
        add_includedirs("deps/submodules/minirtc/src/api", {public = true})
        if is_os("windows") then
-            add_deps("privacy")
            add_packages("libyuv")
            add_files("apps/desktop/src/screen_capturer/captured_nv12_frame.cpp")
            add_files("apps/desktop/src/platform/windows/screen_capturer/screen_capturer_dxgi.cpp",
@@ -234,13 +171,10 @@ function setup_targets()
            add_includedirs("apps/desktop/src/platform/windows/screen_capturer",
                "apps/desktop/src/platform/windows/service")
        elseif is_os("macosx") then
-            add_deps("privacy")
-            add_mxxflags("-fobjc-arc")
            add_files("apps/desktop/src/platform/macos/screen_capturer/*.cpp",
                "apps/desktop/src/platform/macos/screen_capturer/*.mm")
            add_includedirs("apps/desktop/src/platform/macos/screen_capturer")
        elseif is_os("linux") then
-            add_deps("privacy")
            add_packages("libyuv")
            add_files("apps/desktop/src/platform/linux/screen_capturer/screen_capturer_linux.cpp")
            add_files("apps/desktop/src/platform/linux/screen_capturer/screen_capturer_x11.cpp")
@@ -336,8 +270,7 @@ function setup_targets()
        set_kind("object")
        add_deps("rd_log", "autostart")
        add_files("apps/desktop/src/config_center/*.cpp")
-        add_includedirs("apps/desktop/src", "apps/desktop/src/config_center",
-            {public = true})
+        add_includedirs("apps/desktop/src/config_center", {public = true})

    target("assets")
        set_kind("headeronly")
@@ -349,8 +282,14 @@ function setup_targets()
    target("version_checker")
        set_kind("object")
        add_packages("cpp-httplib")
+        add_defines("CROSSDESK_VERSION=\"" .. (get_config("CROSSDESK_VERSION") or "Unknown") .. "\"")
        add_deps("rd_log")
        add_files("apps/desktop/src/version_checker/*.cpp")
+        if is_os("windows") then
+            add_files("apps/desktop/src/platform/windows/windows_updater.cpp",
+                "apps/desktop/src/platform/windows/windows_installer.cpp")
+            add_links("winhttp", "ole32", "uuid")
+        end
        add_includedirs("apps/desktop/src/version_checker", {public = true})
        if is_os("macosx") then
            add_defines("CPPHTTPLIB_USE_CERTS_FROM_MACOSX_KEYCHAIN")
@@ -380,15 +319,11 @@ function setup_targets()
        add_packages("slint", {public = true})
        add_packages("libyuv", "tinyfiledialogs")
        add_rules("slint")
-        if is_config("CROSSDESK_PORTABLE", true) then
-            -- RuntimeState changes layout in portable builds. Consumers of GUI
-            -- headers must see the same definition, without affecting its deps.
-            add_defines("CROSSDESK_PORTABLE=1", {public = true})
-        end
+        add_defines("CROSSDESK_VERSION=\"" .. (get_config("CROSSDESK_VERSION") or "Unknown") .. "\"")
        add_deps("rd_log", "common", "assets", "config_center", "minirtc",
            "path_manager", "screen_capturer", "speaker_capturer",
            "device_controller", "thumbnail", "version_checker", "tools",
-            "crossdesk_wire", "privacy")
+            "crossdesk_wire")
        add_files("apps/desktop/src/gui/render.cpp", "apps/desktop/src/gui/application/gui_application.cpp",
            "apps/desktop/src/gui/rendering/*.cpp",
            "apps/desktop/src/gui/runtime/*.cpp",
@@ -396,11 +331,6 @@ function setup_targets()
            "apps/desktop/src/gui/features/devices/*.cpp", "apps/desktop/src/gui/features/input/*.cpp",
            "apps/desktop/src/gui/features/clipboard/*.cpp", "apps/desktop/src/gui/features/file_transfer/*.cpp",
            "apps/desktop/src/gui/features/settings/*.cpp", "apps/desktop/src/gui/ui/crossdesk_ui.slint")
-        -- Only these translation units consume the application version. Keep
-        -- version changes out of the flags for media and the rest of the GUI.
-        add_files("apps/desktop/src/gui/application/gui_application.cpp",
-            "apps/desktop/src/gui/runtime/peer_event_handler.cpp",
-            {defines = version_define})
        add_includedirs("apps/desktop/src", "apps/desktop/src/gui", {public = true})
        add_includedirs("apps/desktop/src/platform/common/input")
        if is_os("windows") then
@@ -452,8 +382,7 @@ function setup_targets()
            add_files("apps/desktop/src/platform/windows/screen_capturer/screen_capturer_wgc.cpp",
                "apps/desktop/src/platform/windows/screen_capturer/wgc_session_impl.cpp",
                "apps/desktop/src/platform/windows/screen_capturer/wgc_plugin_entry.cpp")
-            add_files("apps/desktop/resources/windows/wgc_plugin.rc",
-                {defines = windows_resource_defines})
+            add_files("apps/desktop/resources/windows/wgc_plugin.rc")
            add_includedirs("apps/desktop/src/common", "apps/desktop/src/screen_capturer",
                "apps/desktop/src/platform/windows/screen_capturer",
                "deps/submodules/minirtc/src/api")
@@ -464,8 +393,7 @@ function setup_targets()
            add_links("Advapi32", "Wtsapi32", "Ole32", "Userenv")
            add_files("apps/desktop/src/platform/windows/service/main.cpp",
                "apps/desktop/src/platform/windows/service/service_host.cpp")
-            add_files("apps/desktop/resources/windows/crossdesk_service.rc",
-                {defines = windows_resource_defines})
+            add_files("apps/desktop/resources/windows/crossdesk_service.rc")
            add_includedirs("apps/desktop/src/platform/windows/service")

        target("crossdesk_session_helper")
@@ -474,8 +402,7 @@ function setup_targets()
            add_deps("rd_log", "path_manager")
            add_links("Advapi32", "User32", "Wtsapi32", "Gdi32")
            add_files("apps/desktop/src/platform/windows/service/session_helper_main.cpp")
-            add_files("apps/desktop/resources/windows/crossdesk_session_helper.rc",
-                {defines = windows_helper_resource_defines})
+            add_files("apps/desktop/resources/windows/crossdesk_session_helper.rc")
            add_includedirs("apps/desktop/src/common",
                "apps/desktop/src/platform/windows/service")
            add_includedirs("apps/desktop/src/platform/windows/input")
@@ -492,7 +419,7 @@ function setup_targets()
            add_includedirs("apps/desktop/src/platform/windows/service")
            add_links("Advapi32", "Wtsapi32", "Ole32", "Userenv")
            add_deps("wgc_plugin", "crossdesk_service", "crossdesk_session_helper")
-            add_files(crossdesk_windows_resource, {defines = windows_resource_defines})
+            add_files(crossdesk_windows_resource)
        elseif is_os("macosx") then
            add_files("apps/desktop/src/platform/common/posix_daemon_backend.cpp",
                "apps/desktop/src/platform/macos/daemon_backend.cpp")
@@ -56,17 +56,12 @@ the desktop-compatible `DisplayN`, `control_audio`, `mouse`, `keyboard`,

 ## Video codecs

-Every iOS build includes VideoToolbox, OpenH264, dav1d, and SVT-AV1. H.264 uses
+Every iOS build includes VideoToolbox, OpenH264, dav1d, libaom, and SVT-AV1. H.264 uses
 VideoToolbox by default; choose software processing under **设置 → 视频编解码 →
 处理方式** (Settings → Video codec → Processing mode) to use OpenH264 for H.264.
 The change takes effect on the next connection. AV1 encoding uses SVT-AV1 and AV1 decoding
 uses dav1d; VideoToolbox AV1 hardware decoding is currently unsupported.

-The unused libaom backends are excluded by default. To include them for development,
-set the `MINIRTC_ENABLE_AOM` environment variable (or Xcode user-defined build setting)
-to `true`. This includes libaom in the merged native archive without changing the
-AV1 factories' choice of SVT-AV1 and dav1d.
-
 ## Physical-device test checklist

 Run the app from Xcode on a physical device and connect to a current desktop
@@ -8,11 +8,6 @@ REPO_DIR="${IOS_DIR:h:h}"
 MINIRTC_DIR="${REPO_DIR}/deps/submodules/minirtc"
 CONFIG_NAME="${CONFIGURATION:-Debug}"
 MODE="${CONFIG_NAME:l}"
-MINIRTC_ENABLE_AOM="${MINIRTC_ENABLE_AOM:-false}"
-if [[ "${MINIRTC_ENABLE_AOM}" != "true" && "${MINIRTC_ENABLE_AOM}" != "false" ]]; then
-  print -u2 "MINIRTC_ENABLE_AOM must be true or false."
-  exit 64
-fi

 # Keep iOS dependencies isolated from desktop Xmake packages. Besides avoiding
 # cross-project cache collisions, this guarantees every archive is compiled
@@ -82,43 +77,17 @@ WIRE_MANIFEST_FILE="${WIRE_WORK_DIR}/xmake.lua"
 WIRE_LIBRARY="${WIRE_BUILD_DIR}/iphoneos/arm64/${MODE}/libcrossdesk_wire.a"

 mkdir -p "${OUTPUT_DIR}" "${WIRE_WORK_DIR}"
-if ! cmp -s "${REPO_DIR}/xmake.lua" "${WIRE_MANIFEST_FILE}"; then
-  cp "${REPO_DIR}/xmake.lua" "${WIRE_MANIFEST_FILE}"
-fi
-
-# Reuse Xmake's compiler/dependency probes unless the build environment changes.
-# Still configure on every invocation: Xmake must see manifest edits and restore
-# the iOS configuration if MiniRTC was built standalone for another platform.
-CONFIG_SIGNATURE="$(print -r -- "${XMAKE_BIN}" "${XMAKE_DEVELOPER_DIR}" \
-  "${MODE}" "${ARCH_NAME}" "16.0" "${XMAKE_PKG_INSTALLDIR}" "${MINIRTC_ENABLE_AOM}"
-  run_xmake --version | sed -n '1p'
-  DEVELOPER_DIR="${XMAKE_DEVELOPER_DIR}" xcodebuild -version
-  DEVELOPER_DIR="${XMAKE_DEVELOPER_DIR}" xcrun --sdk iphoneos --show-sdk-path
-  DEVELOPER_DIR="${XMAKE_DEVELOPER_DIR}" xcrun --sdk iphoneos --show-sdk-version)"
-
-configure_xmake() {
-  local project_dir="$1"
-  local build_dir="$2"
-  shift 2
-  local stamp="${build_dir}/ios-config-signature"
-  local clean_flags=()
-  if [[ ! -f "${stamp}" || "$(<"${stamp}")" != "${CONFIG_SIGNATURE}" ]]; then
-    clean_flags=(-c)
-  fi
-  run_xmake f -P "${project_dir}" "${clean_flags[@]}" -o "${build_dir}" \
-    -p iphoneos -a arm64 -m "${MODE}" --target_minver=16.0 -y "$@"
-  mkdir -p "${build_dir}"
-  print -r -- "${CONFIG_SIGNATURE}" > "${stamp}"
-}
+cp "${REPO_DIR}/xmake.lua" "${WIRE_MANIFEST_FILE}"

 # Xmake stores the configured build directory relative to the process working
 # directory. Xcode does not guarantee that directory for build phases, so keep
 # configuration, compilation and inspection anchored to the MiniRTC project.
 (
  cd "${MINIRTC_DIR}"
-  configure_xmake "${MINIRTC_DIR}" "${MINIRTC_BUILD_DIR}" \
-    --as="${XMAKE_TOOLCHAIN_BIN}/clang" --USE_CUDA=false \
-    --MINIRTC_ENABLE_AOM="${MINIRTC_ENABLE_AOM}"
+  run_xmake f -P "${MINIRTC_DIR}" -c -o "${MINIRTC_BUILD_DIR}" \
+    -p iphoneos -a arm64 -m "${MODE}" \
+    --as="${XMAKE_TOOLCHAIN_BIN}/clang" \
+    --target_minver=16.0 --USE_CUDA=false -y
  run_xmake b -P "${MINIRTC_DIR}" minirtc
 )

@@ -132,7 +101,9 @@ fi
 # no second project definition to maintain.
 (
  cd "${WIRE_WORK_DIR}"
-  configure_xmake "${WIRE_WORK_DIR}" "${WIRE_BUILD_DIR}"
+  run_xmake f -P "${WIRE_WORK_DIR}" -c -o "${WIRE_BUILD_DIR}" \
+    -p iphoneos -a arm64 -m "${MODE}" \
+    --target_minver=16.0 -y
  run_xmake b -P "${WIRE_WORK_DIR}" crossdesk_wire
 )

@@ -152,11 +123,8 @@ REQUIRED_LINKS=(
  nice glib-2.0 gobject-2.0 gmodule-2.0 gio-2.0 gthread-2.0 intl
  gupnp-igd-1.6 gupnp-1.6 gssdp-1.6 soup-3.0 nghttp2 sqlite3 psl xml2
  ffi pcre2-8 pcre2-posix z ssl crypto srtp2 openfec opus yuv kcp
-  datachannel usrsctp openh264 dav1d SvtAv1Enc
+  datachannel usrsctp openh264 dav1d aom SvtAv1Enc
 )
-if [[ "${MINIRTC_ENABLE_AOM}" == "true" ]]; then
-  REQUIRED_LINKS+=(aom)
-fi
 DEPENDENCY_ARCHIVES=()

 for link_name in "${REQUIRED_LINKS[@]}"; do
@@ -176,24 +144,10 @@ for link_name in "${REQUIRED_LINKS[@]}"; do
 done

 TEMP_LIBRARY="${OUTPUT_LIBRARY}.tmp"
-MERGE_MANIFEST="${OUTPUT_LIBRARY}.inputs.sha256"
-TEMP_MANIFEST="${MERGE_MANIFEST}.tmp"
-trap 'rm -f "${TEMP_LIBRARY}" "${TEMP_MANIFEST}"' EXIT
-
-# Hash contents as well as paths so same-size archives replaced within the same
-# timestamp tick cannot leave a stale merged library. Preserve the output mtime
-# on no-op builds to avoid relinking the Xcode app.
-shasum -a 256 "${SCRIPT_DIR}/build_minirtc_ios.sh" "${MINIRTC_LIBRARY}" \
-  "${DEPENDENCY_ARCHIVES[@]}" "${WIRE_LIBRARY}" > "${TEMP_MANIFEST}"
-if [[ -f "${OUTPUT_LIBRARY}" ]] && cmp -s "${TEMP_MANIFEST}" "${MERGE_MANIFEST}"; then
-  print "Up to date: ${OUTPUT_LIBRARY}"
-  exit 0
-fi
-
+rm -f "${TEMP_LIBRARY}"
 /usr/bin/libtool -static -o "${TEMP_LIBRARY}" \
  "${MINIRTC_LIBRARY}" "${DEPENDENCY_ARCHIVES[@]}" \
  "${WIRE_LIBRARY}"
 mv -f "${TEMP_LIBRARY}" "${OUTPUT_LIBRARY}"
-mv -f "${TEMP_MANIFEST}" "${MERGE_MANIFEST}"

 print "Created ${OUTPUT_LIBRARY}"
@@ -1,154 +0,0 @@
-"""Exercise the native build phase with fake Xmake and real Apple archives."""
-
-import os
-from pathlib import Path
-import re
-import shutil
-import subprocess
-import sys
-import tempfile
-import unittest
-
-
-@unittest.skipUnless(sys.platform == "darwin", "requires Apple libtool and zsh")
-class NativeBuildTest(unittest.TestCase):
-    def setUp(self):
-        self.temp = tempfile.TemporaryDirectory(prefix="crossdesk-ios-build-")
-        self.addCleanup(self.temp.cleanup)
-        self.root = Path(self.temp.name)
-        self.ios = self.root / "apps/ios"
-        scripts = self.ios / "scripts"
-        scripts.mkdir(parents=True)
-        source = Path(__file__).resolve().parents[1] / "scripts/build_minirtc_ios.sh"
-        self.script = scripts / source.name
-        shutil.copy2(source, self.script)
-        (self.root / "xmake.lua").write_text('-- fixture\n')
-        (self.root / "deps/submodules/minirtc").mkdir(parents=True)
-        self.bin = self.root / "bin"
-        self.bin.mkdir()
-        self.library_dir = self.root / "packages/lib"
-        self.library_dir.mkdir(parents=True)
-        obj = self.root / "fixture.o"
-        subprocess.run(["xcrun", "clang", "-x", "c", "-c", "-", "-o", str(obj)],
-                       input="int fixture(void) { return 1; }", text=True, check=True)
-        self.archive = self.root / "fixture.a"
-        subprocess.run(["/usr/bin/libtool", "-static", "-o", str(self.archive), str(obj)],
-                       check=True, capture_output=True)
-        links = re.search(r"REQUIRED_LINKS=\((.*?)\)", source.read_text(), re.S)[1].split()
-        for name in links:
-            shutil.copy2(self.archive, self.library_dir / f"lib{name}.a")
-        self.write_tool("xcodebuild", '#!/bin/sh\ncat "$(dirname "$0")/../xcode-version"\n')
-        self.write_tool("xcrun", '#!/bin/sh\necho fixture-iphoneos-sdk\n')
-        (self.root / "xcode-version").write_text("Xcode fixture-1\n")
-        self.write_tool("xmake", f"#!{sys.executable}\n" + r'''
-import json, pathlib, shutil, sys
-root = pathlib.Path(__file__).resolve().parents[1]
-args = sys.argv[1:]
-with (root / "calls.jsonl").open("a") as log:
-    log.write(json.dumps(args) + "\n")
-if args[0] == "--version":
-    print("xmake fixture")
-elif args[0] == "f":
-    if (root / "fail-config").exists():
-        sys.exit(1)
-    project = pathlib.Path(args[args.index("-P") + 1])
-    (project / "config.json").write_text(json.dumps(args))
-elif args[0] == "b":
-    project = pathlib.Path(args[args.index("-P") + 1])
-    config = json.loads((project / "config.json").read_text())
-    output = pathlib.Path(config[config.index("-o") + 1])
-    output /= "iphoneos/arm64/" + config[config.index("-m") + 1]
-    output.mkdir(parents=True, exist_ok=True)
-    library = output / ("lib" + args[-1] + ".a")
-    if not library.exists():
-        shutil.copy2(root / "fixture.a", library)
-elif args[0] == "show":
-    print("    -> " + str(root / "packages/lib") + " -> package fixture")
-''')
-        self.env = dict(os.environ, PATH=f"{self.bin}:{os.environ['PATH']}",
-                        XMAKE_BIN=str(self.bin / "xmake"), CONFIGURATION="Release",
-                        MINIRTC_ENABLE_AOM="false",
-                        CURRENT_ARCH="arm64", DEVELOPER_DIR=subprocess.check_output(
-                            ["xcode-select", "-p"], text=True).strip())
-        self.output = self.ios / "Vendor/iphoneos/Release/libCrossDeskMiniRTC.a"
-
-    def write_tool(self, name, contents):
-        path = self.bin / name
-        path.write_text(contents)
-        path.chmod(0o755)
-
-    def run_build(self, success=True):
-        result = subprocess.run(["/bin/zsh", str(self.script)], env=self.env,
-                                text=True, capture_output=True)
-        if success:
-            self.assertEqual(result.returncode, 0, result.stdout + result.stderr)
-        else:
-            self.assertNotEqual(result.returncode, 0)
-        return result
-
-    def config_calls(self):
-        import json
-        return [args for line in (self.root / "calls.jsonl").read_text().splitlines()
-                if (args := json.loads(line))[0] == "f"]
-
-    def test_noop_preserves_archives_and_manifest(self):
-        self.run_build()
-        manifest = self.ios / ".xmake/wire-work/xmake.lua"
-        old_times = (self.output.stat().st_mtime_ns, manifest.stat().st_mtime_ns)
-        self.run_build()
-        self.assertEqual(old_times, (self.output.stat().st_mtime_ns, manifest.stat().st_mtime_ns))
-        self.assertEqual(["-c" in args for args in self.config_calls()], [True, True, False, False])
-
-    def test_archive_content_change_with_same_size_and_mtime_is_merged(self):
-        self.run_build()
-        original = self.output.read_bytes()
-        library = self.library_dir / "libopus.a"
-        stat = library.stat()
-        data = library.read_bytes()
-        # Rename an archive member without changing the archive layout or size.
-        self.assertIn(b"fixture.o", data)
-        library.write_bytes(data.replace(b"fixture.o", b"changed.o"))
-        os.utime(library, ns=(stat.st_atime_ns, stat.st_mtime_ns))
-        self.run_build()
-        self.assertNotEqual(original, self.output.read_bytes())
-
-    def test_toolchain_and_mode_changes_clear_probes(self):
-        self.run_build()
-        (self.root / "xcode-version").write_text("Xcode fixture-2\n")
-        self.run_build()
-        self.env["CONFIGURATION"] = "Debug"
-        self.run_build()
-        self.assertEqual(["-c" in args for args in self.config_calls()], [True] * 6)
-        self.assertTrue((self.ios / "Vendor/iphoneos/Debug/libCrossDeskMiniRTC.a").exists())
-
-    def test_failed_configuration_does_not_commit_signature(self):
-        self.run_build()
-        stamp = self.ios / ".xmake/minirtc-build/ios-config-signature"
-        original = stamp.read_bytes()
-        (self.root / "xcode-version").write_text("Xcode fixture-2\n")
-        (self.root / "fail-config").touch()
-        self.run_build(success=False)
-        self.assertEqual(stamp.read_bytes(), original)
-        (self.root / "fail-config").unlink()
-        self.run_build()
-        self.assertTrue(all("-c" in args for args in self.config_calls()))
-
-    def test_aom_is_only_required_and_merged_when_enabled(self):
-        self.run_build()
-        manifest = Path(str(self.output) + ".inputs.sha256")
-        self.assertNotIn("libaom.a", manifest.read_text())
-        original = self.output.read_bytes()
-        self.env["MINIRTC_ENABLE_AOM"] = "true"
-        result = self.run_build(success=False)
-        self.assertIn("Unable to resolve static dependency libaom.a", result.stderr)
-        self.assertEqual(self.output.read_bytes(), original)
-        shutil.copy2(self.archive, self.library_dir / "libaom.a")
-        self.run_build()
-        self.assertIn("libaom.a", manifest.read_text())
-        self.env["MINIRTC_ENABLE_AOM"] = "false"
-        self.run_build()
-        self.assertNotIn("libaom.a", manifest.read_text())
-
-
-if __name__ == "__main__":
-    unittest.main()
@@ -11,7 +11,7 @@

 ## Windows

-安装 Visual Studio 2022 的“使用 C++ 的桌面开发”工作负载、Windows SDK 和“适用于 Windows 的 C++ Clang 编译器”组件，并安装 Xmake。Windows x64 的 libyuv 使用 clang-cl 编译，以启用 SIMD 图像转换和缩放；主程序仍使用 MSVC。在开发者 PowerShell 中执行：
+安装 Visual Studio 2022 的“使用 C++ 的桌面开发”工作负载及 Windows SDK，并安装 Xmake。在开发者 PowerShell 中执行：

 ```powershell
 git clone --recurse-submodules https://github.com/kunkundi/crossdesk.git
@@ -21,8 +21,6 @@ xmake b -vy crossdesk
 xmake r crossdesk
 ```

-性能复测应使用 `release`；`debug` 保留调试信息并关闭主程序编译优化。
-
 安装包还使用 NSIS，需将仓库中的 [nsProcess.dll](../apps/desktop/scripts/windows/nsProcess.dll) 放入 NSIS 的 `Plugins/x86-unicode` 目录，并确保 `makensis` 在 `PATH` 中。完成 Release 编译后运行：

 ```powershell
@@ -131,7 +129,6 @@ PipeWire 不属于强制运行时依赖：程序在运行时检测宿主系统
 --USE_DRM=true/false: 在 Linux 上启用 DRM 捕获，默认不启用
 --CROSSDESK_PORTABLE=true/false: 构建便携版本，默认不启用
 --CROSSDESK_VERSION=xxx: 指定 CrossDesk 的版本
--MINIRTC_ENABLE_AOM=true/false: 编译可选 libaom 后端，默认不启用；AV1 仍使用 SVT-AV1 / dav1d

 # 示例
 xmake f --CROSSDESK_VERSION=1.4.3 --USE_CUDA=true
@@ -11,7 +11,7 @@ After cloning, run build and packaging commands from the repository root. The [X

 ## Windows

-Install Visual Studio 2022 with the **Desktop development with C++** workload, Windows SDK, and **C++ Clang Compiler for Windows** component, plus Xmake. Windows x64 builds use clang-cl for libyuv to enable SIMD conversion and scaling; the application still uses MSVC. In a developer PowerShell, run:
+Install Visual Studio 2022 with the **Desktop development with C++** workload and Windows SDK, plus Xmake. In a developer PowerShell, run:

 ```powershell
 git clone --recurse-submodules https://github.com/kunkundi/crossdesk.git
@@ -21,8 +21,6 @@ xmake b -vy crossdesk
 xmake r crossdesk
 ```

-Use `release` for performance measurements; `debug` keeps symbols and disables application compiler optimizations.
-
 Installer packaging also uses NSIS. Copy the repository's [nsProcess.dll](../apps/desktop/scripts/windows/nsProcess.dll) into NSIS's `Plugins/x86-unicode` directory and ensure `makensis` is on `PATH`. After building Release, run:

 ```powershell
@@ -1,706 +0,0 @@
-# CrossDesk 双端 UDP 打洞增强实现方案
-
-状态：P0 门槛已通过；P1–P4 默认关闭原型、受控运行与跨平台构建已实现；P5 实验工具已交付，真实未知 NAT 对照和最终双端应用切换验收待执行。日期：2026-09-14。第 15 节保留 P0 历史记录，最新进展与边界见第 16 节。
-
-源码基线：CrossDesk `73e3bf709d7c054df7bd75cfafceda0721c6cda1`；MiniRTC 子模块 `f169a696cb4e6cb59037ec02e85532e30d3c1262`；libnice `0.1.24` 加仓库已有补丁。
-
-本文规定第一版的范围、接口职责、协议、资源预算、开发顺序和验收条件。第 1–14 节保留设计基线，实际接口及完成情况以第 15–16 节和所链接的执行报告为准。实现和受控测试不代表真实 NAT 成功率已得到验证。
-
-## 1. 目标与取证依据
-
-目标是在普通 ICE 检查未建立直连、TURN 已经可以传输的情况下，通过“固定端点一侧扩大目的端口探索＋另一侧使用多个本地 UDP 端点”寻找新的可达组合，再接入已有 ICE 检查及中继转直连流程。
-
-2026-09-13 两次连接提供了以下依据：
-
-| 项目 | CrossDesk 16:06 会话 | UU 21:30 会话 |
-| --- | --- | --- |
-| Mac 的直接探测 | 同一个本地端口，向 11 个公网端口发出 324 个 Binding Request，含重传 | 同一个本地端口，向 231 个离散目的端口发送短探测包 |
-| Windows 的直接探测 | 主 ICE 端口向 Mac 公网候选持续检查，双方未捕获到直接入站 | 两个常规端点检查失败后，49 个不同本地源端口轮流向 Mac 固定公网端点发短包 |
-| 成功组合 | 没有观察到 | Windows 第 46 个短包端点与 Mac 建立双向通信，随后 STUN 成功并持续传输 |
-| 成功端点是否继续传输 | 不适用 | Windows :52257，经 NAT 为 :11968，后续沿用该端点 |
-
-Mac 先前发往 :11968 的短包没有出现在 Windows 捕获中；成功开始于 Windows 自己发出的短包到达 Mac。无需把两个固定载荷短包解释成请求与回显，才能说明双方端口探索的作用。
-
-证据边界：
-
- 231、49 是成功附近实际执行的数量，不是已知的 UU 配置上限。
- 抓包证明多个源端口参与，没有证明所有历史 socket 句柄同时存活，也没有恢复 UU 的端口生成算法。
- NAT 内部建表和过滤过程仍是推断；本方案不宣称复刻 UU 私有实现。
- 两次应用运行时间、socket 和服务端不同，不能从这两个样本计算成功率提升幅度。
- 详细原始取证位于本次任务的本地分析产物；实现与验收必须能够独立于 `/tmp` 文件运行，不把抓包或会话密钥提交到仓库。
-
-## 2. 第一版范围和关键决策
-
-### 2.1 纳入范围
-
- 原生 MiniRTC ↔ 原生 MiniRTC；首先验证 Windows x64 与 macOS arm64，Linux 用于编译和可控网络测试。
- IPv4 UDP，单个 ICE component，选择一个明确的物理接口和原始 host socket。
- 非强制中继、非 reliable ICE；已有选中路径包含 relay，且 DTLS 握手和远端指纹验证已经成功。
- 本轮一侧具有同一 socket 对多个 STUN 目标的稳定公网映射观测，另一侧具有目的相关映射观测。
- 每个 ICE generation 至多执行一轮增强；失败继续使用原连接。
-
-### 2.2 暂不纳入
-
- 浏览器/libdatachannel 对端、iOS 启用、IPv6 探索、两侧都目的相关或两侧信息不足时的通用算法。
- TURN 尚未建立时的首次连接加速、`TurnDisabled` 下的增强协商、未启用 SRTP/DTLS 的会话。
- UPnP/PCP/NAT-PMP 的新实现、网关配置修改、跨多个接口同时建立端口池。
- 根据 UU 单个样本自动学习端口分布，或把端口枚举成全部普通 ICE 候选。
- 新增直连失效后无缝回切 TURN 的完整恢复算法。第一版遵循当前恢复行为，验证失败恢复；不得把“仍保留 TURN allocation”描述为已经具备自动回切能力。
-
-### 2.3 架构决策
-
-1. **先验证 socket 接入，再实现大范围探测。** 新端点在中继 READY 后必须能参与 ICE 并成为媒体端点，这是 P0 的前置验收项。
-2. **SDP 只协商能力，运行时协调复用已选中路径。** 第一版通过现有 relay 数据路径传递带认证的内部控制包，不新增 WSS 消息类型，也不要求修改 CrossDesk Server。
-3. **新 socket 由 libnice 管理。** 不在 GUI、业务数据通道或独立线程中建立脱离 ICE 生命周期的临时 socket 池。
-4. **探索和 ICE 检查分开调度。** 数百个目的端口属于有限的探索集合；只有少量命中端点进入普通检查表。
-5. **保留普通 ICE 与已有 30 秒升级窗口。** 增强操作不能重置该窗口、重启 DTLS，或延迟正常的中继可用状态。
-6. **默认关闭。** 编译扩展存在、运行配置开启、双方声明支持、网络和连接状态满足条件时才启动。
-
-这会使第一版主要改善“已通过中继连接，但希望随后升为 P2P”的场景。将来需要在没有中继时运行同类算法，应另行设计可验证的信令协调通道。
-
-## 3. 现有代码与拟增加模块
-
-| 位置 | 当前职责 / 后续变更 |
-| --- | --- |
-| [ice_utils.h](/Users/dijunkun/crossdesk/deps/submodules/minirtc/src/ice/ice_utils.h) | 已有精确匹配 SDP 能力行与 ufrag 解析；新增独立 v1 能力，不改变旧能力含义 |
-| [nat_traversal.h](/Users/dijunkun/crossdesk/deps/submodules/minirtc/src/ice/nat_traversal.h) | 已有映射观测和附近端口预测；提取带 socket/generation 的快照，新增角色选择和有界采样逻辑 |
-| [ice_agent.h/.cpp](/Users/dijunkun/crossdesk/deps/submodules/minirtc/src/ice/ice_agent.cpp) | 持有 NiceAgent、GMainContext 和 DTLS；接入协调器、验证后的 exporter、内部控制包分流和停止流程 |
-| [ice_transport.cpp](/Users/dijunkun/crossdesk/deps/submodules/minirtc/src/transport/ice_transport.cpp) | 已有选路日志、trickle 和媒体入口；防止内部端点误发普通候选，新增结果统计，保持媒体状态连续 |
-| [MiniRTC xmake.lua](/Users/dijunkun/crossdesk/deps/submodules/minirtc/xmake.lua) | 注册可选的纯逻辑测试和 ICE 集成测试目标，接入编译开关 |
-| [libnice 配方](/Users/dijunkun/crossdesk/deps/submodules/minirtc/thirdparty/libnice/xmake.lua) | 注册新补丁、哈希及包身份版本，增加扩展符号检查，确保双端重新构建依赖 |
-| [relay upgrade 补丁](/Users/dijunkun/crossdesk/deps/submodules/minirtc/thirdparty/libnice/patches/relay_upgrade_0.1.24.patch) | 已有保留直连检查、定期重试及再次提名；扩展接入点须遵守已有截止时间和优先级条件 |
-
-拟新增到 MiniRTC 的模块，路径以子模块根目录为基准：
-
-```text
-src/ice/punch_config.h                 配置、硬上限、实验模式
-src/ice/punch_protocol.h/.cpp          编解码、认证、去重、generation 校验
-src/ice/punch_scheduler.h/.cpp         端口采样、预算、时序；可注入时钟和随机源
-src/ice/punch_coordinator.h/.cpp       每个 IceAgent 的增强状态机
-src/ice/punch_budget.h/.cpp            进程级 socket/发包配额
-thirdparty/libnice/patches/punch_pool_0.1.24.patch
-tests/ice/punch_*                      纯逻辑和集成测试
-tests/ice/lab/                         可控 NAT 场景与抓包核验脚本
-```
-
-MiniRTC 和 CrossDesk 为不同 Git 仓库。后续先在子模块形成可验证的提交，再更新主仓库的子模块指针；不得只修改本机 Xmake 下载缓存中的 libnice 源码。
-
-## 4. 能力、身份和角色协商
-
-### 4.1 能力开关
-
-拟新增精确 SDP 行：
-
-```text
-a=x-minirtc-udp-punch:1
-```
-
-只有本地构建包含对应 libnice 扩展、运行配置开启、原生 UDP 路径允许时才通告。双方同时支持该能力和现有 relay-upgrade 能力才启用。旧的 `a=x-minirtc-p2p-enhancement:1` 继续表示原有增强能力，不隐式包含端口池协议。
-
-SDP 的能力行不是命令；资源数量由本地配置和认证后的协商共同限制。未知版本或异常重复能力声明只停用此增强，不使普通 ICE 失败。
-
-现有 `IceTransport::SetRemoteSdp` 会提取媒体段，并显式补回旧增强能力行；新增能力也必须经过该路径保留。需要测试能力位于 session、视频或其他媒体段，以及 fingerprint 提取前后的情况，避免完整 SDP 中支持、传入 IceAgent 后却丢失。
-
-### 4.2 连接和轮次身份
-
- 使用有序的 offer/answer ufrag 对标识 ICE generation；记录本地单调递增 generation 序号，防止异步旧回调误用新连接。
- 线上 `generation_id` 为长度前缀编码的 offer/answer ufrag 对的 SHA-256 前 16 字节；实际认证密钥另由本次已验证的 DTLS 会话导出。
- 原始 offer 发送方担任协调方，分配随机 128-bit `round_id`。协调角色不等于动态 ICE controlling 角色。
- 所有控制包、探测包、候选提升请求和回调必须携带 generation/round 范围。重连、ICE restart、接口改变时旧范围作废。
-
-### 4.3 网络角色
-
-命名：`anchor` 表示复用固定 socket 的一侧；`pool` 表示使用额外本地端点的一侧。角色根据观测选择，不与 Windows/macOS、主控/被控绑定。
-
-有效映射快照至少包含：同一原始 host socket 的不透明 ID、本地地址、候选 foundation、component、generation、目标 STUN 地址、公网结果、接收的单调时间、观测序号。
-
- `stable-observed`：当前 generation 的同一 socket 至少对两个不同公网服务器 IP 得到同一公网 IP:port，观测仍在有效期内。
- `dependent-observed`：同一 socket 对不同目标出现不同映射；不能把多个本地源端口的结果混在一起分类。
- `unknown`：不足、过期、来源不一致，或公网 IP 本身变化。
-
-第一版只在恰好一侧 `stable-observed`、另一侧 `dependent-observed` 时开始。前者为 anchor。其余组合记录跳过原因，保留常规 ICE；实验工具可显式固定角色验证接入，但不得在生产中把固定角色伪装成自动分类。
-
-快照默认有效期 15 秒。角色选择只表示实验条件，不把有限的 STUN 观测升级为对 NAT 过滤类型或未来分配行为的保证。anchor 的公网端点必须与被保留的那个真实 socket 对应；不能使用无关联的临时 STUN socket 的结果。
-
-## 5. 控制通道与报文契约
-
-### 5.1 通道和密钥
-
-控制包通过 NiceAgent 当前选中的 relay 路径发送，在 `IceAgent::OnNiceRecv` 中、DTLS/RTP/SRTP 判断之前识别和消费；不送入桌面业务协议，也不占用媒体 SSRC。
-
-直接探测包在被借用的 anchor socket 或 libnice 管理的 pool socket 上发送，使用相同的会话范围，但使用独立的密钥域。原始 socket 收包钩子只接收直接路径的探测种类；TURN 解封装后的逻辑来源不能产生“直连命中”事件。
-
-密钥方案：
-
-1. 新增 `dtls_peer_verified` 状态，仅在握手完成且远端 fingerprint 比较成功后设置。当前 `dtls_handshake_done_` 在 fingerprint 判断之前赋值，不能单独作为导出增强密钥的条件。
-2. 在 DTLS 所属上下文内调用 `SSL_export_keying_material`，使用独立标签 `EXPORTER-MiniRTC-UDP-Punch-v1`，context 使用上节有序 ufrag 编码，`use_context=1`。
-3. 导出 128 字节，依次拆为四个 32-byte 密钥：offer→answer 控制、answer→offer 控制、offer→answer 探测、answer→offer 探测。不得复用 SRTP 密钥或把密钥写入 SDP/日志。
-4. 报文采用 HMAC-SHA-256 前 16 字节认证完整头和载荷，常量时间比较。控制内容只含连接元数据，不承载媒体或密钥；它是带认证的内部数据报，不宣称因走 relay 就自动被 DTLS 加密。
-
-### 5.2 固定头
-
-采用显式序列化，整数为网络字节序，不直接发送 C/C++ struct。
-
-| 字段 | 长度 | 约束 |
-| --- | --- | --- |
-| magic | 4 | `f3 4d 50 31`，避免与常见 STUN、DTLS、RTP 首字节范围混淆 |
-| version | 1 | 1 |
-| kind | 1 | 见下表，控制与探测种类严格分离 |
-| payload_length | 2 | 总数据报必须恰好为 `44 + payload_length + 16` 字节 |
-| generation_id | 16 | 与当前连接一致 |
-| round_id | 16 | HELLO 阶段为全零；其他消息为已接受轮次 |
-| sequence | 4 | 按方向和密钥域递增，重传保持原序号与内容 |
-| payload | 可变 | v1 控制采用 UTF-8 JSON；直接探测采用固定二进制载荷 |
-| tag | 16 | HMAC 截断值 |
-
-控制包总长上限 1,200 字节，直接 PROBE/ACK 总长不超过 128 字节。先校验长度、版本、范围、认证，再解析业务字段；不支持分片重组。未知类型、越界数字、重复 JSON 字段、尾随内容均拒绝。
-
-控制 JSON 使用受限、版本化的字段集；HMAC 对线上原始字节计算，接收端不重新序列化后验签。v1 禁止未知字段，后续增加字段需升级协议契约或显式定义可选字段。
-
-### 5.3 消息和顺序
-
-| kind | 作用与必须字段 |
-| --- | --- |
-| `HELLO (0x01)` | 本地观测快照、候选锚点、运行预算、剩余升级时间；快照只发送分类所需的少量样本 |
-| `PREPARE (0x02)` | 协调方发送 round、角色、双方端点、配置摘要和本轮时长；不能授权任意第三方 IP |
-| `READY (0x03)` | 接收方已保留原始 socket 或分配所需 pool socket，返回实际预算与 PREPARE 摘要 |
-| `START (0x04)` | 协调方确认开始；双方按本地 monotonic clock 运行，不传递绝对系统时钟作为启动依据 |
-| `STARTED (0x05)` | 确认 START 已接受；重复 START 不重置计时器 |
-| `RESULT (0x06)` | 本端已选中直连，包含结果和地址摘要；该消息本身不能改变对端 selected pair |
-| `CANCEL (0x07)` | 超时、状态变化、资源不足或主动停止；对端同样有本地截止时间 |
-| `PROBE (0x20)` | 直接包；载荷为网络字节序 uint64 socket_id，随后为 12-byte probe_nonce，共 20 字节 |
-| `PROBE_ACK (0x21)` | 直接包；载荷原样返回 PROBE 的 socket_id 和 nonce，由接收它的同一个 socket 发回 |
-
-协调方通过已有能力与 HELLO 判定条件后发 PREPARE；双方准备完成后执行 START/STARTED。若协商出的实际预算改变，更新 PREPARE 并重新 READY，不在一端静默扩大或缩减配置。
-
-控制状态消息按 200/400/800 毫秒退避，最多重发 3 次；使用本轮总截止时间约束。每种消息响应幂等，重复 READY/START 不重复分配 socket，也不重启轮次。乱序消息只能在对应状态允许的范围内缓存或拒绝，不能越级启动。
-
-每方向、每密钥域保留 256 项序号重放窗口，允许正常乱序；已处理的控制请求可重新发送缓存响应，不能重新执行副作用。探测 ACK 必须匹配本轮尚有效的 nonce 和本地 socket_id。未认证包不回复。
-
-上述直接 socket_id 是本地注册表的不透明标识，不是 OS 文件描述符；不得由远端指定本地 FD。
-
-## 6. 探测算法与预算
-
-### 6.1 anchor 的行为
-
-1. 保留与稳定公网观测对应的实际 host socket，沿用当前物理接口绑定。
-2. 在已确认的对端公网 IP 上，从 1024–65535 无放回抽取目的端口，默认 512 个。先生成完整集合再按随机顺序调度，使用可注入的 CSPRNG；测试使用固定种子。
-3. 现有普通候选和邻近预测继续由原 ICE 调度；新探索集合避免重复消耗这些目标的探测预算。低于 1024 的探测以及非均匀采样留待后续实验，不声称第一版覆盖 UU 的全部端口范围。
-4. 每个新目标默认发一次 PROBE。收到 pool 的认证 PROBE 时，从同一 socket 向该包实际来源端点回 PROBE_ACK；该源 IP 必须仍属于本轮批准的对端公网 IP。
-5. 原始来包地址用于路径发现；不能用包内宣称的地址替代源地址，也不能把 TURN 逻辑地址当成直接源地址。
-
-### 6.2 pool 的行为
-
-1. 在同一选定物理接口上分配默认 64 个不同 UDP 本地端口；绑定地址和接口遵循原 ICE socket 的平台规则。
-2. 新 socket 不为每个端点申请 TURN allocation、启动独立 DTLS 或开展完整多 STUN 采集，只向 anchor 已协商的公网端点探索。
-3. 以 round-robin 调度 PROBE，最多 3 轮；相邻轮至少间隔 1 秒。全部端点保持可接收至本轮停止或被接入 ICE，不能发完就关闭。
-4. 收到 anchor 的有效 PROBE 或匹配 ACK 后，对该具体 socket 请求提升并启动普通 ICE 检查；收到 PROBE 时先从同一 socket 回复 ACK。
-5. 不根据本地源端口序列推算公网端口。探测过程中没有第三方 STUN 返回也不妨碍命中后的标准 ICE 验证。
-
-两侧时间窗需要重叠，但不要求包在同一毫秒发出。允许丢失第一包、控制消息重传和两端系统时钟有偏差。
-
-### 6.3 初始配置
-
-以下是第一轮实验参数，不是从 UU 反推的最佳值。所有值通过经过校验的不可变 `PunchConfig` 进入每个 IceAgent。
-
-| 参数 | 默认实验值 | v1 硬上限 / 规则 |
-| --- | --- | --- |
-| enabled | false | 必须双方开启 |
-| trigger_delay_ms | 1500 | 从首次选中 relay 计时，并等待 DTLS 指纹已验证 |
-| mapping_sample_max_age_ms | 15000 | 不跨 generation 或接口变化复用 |
-| pool_size | 64 | 每会话最多 128；禁止远端扩容越过本地上限 |
-| target_port_count | 512 | 最多 1024，唯一端口数 |
-| probe_pps | 100 | 本端全部新增 PROBE/ACK 合计最多 200 包/秒 |
-| burst_packets | 8 | token bucket；事件循环滞后时不能瞬间补发整个积压队列 |
-| pool_probe_rounds | 3 | v1 最多 3；重发也计入总预算 |
-| round_duration_ms | 10000 | 探索阶段时长，最多 15000，并受原 relay upgrade 截止时间限制 |
-| ice_finish_reserve_ms | 3000 | 到原升级截止前停止新探索，留给已命中 ICE 检查 |
-| probe_packet_budget | 1024 | 本端 PROBE/ACK 累计上限；发送失败也记录尝试计数 |
-| control_packet_budget | 48 | 本端全部控制消息与重传总量 |
-| promoted_endpoint_limit | 4 | 最多 8；只有命中端点进入普通 ICE 检查 |
-| rounds_per_generation | 1 | 重复能力/控制消息不创建新轮次 |
-| process_active_round_limit | 2 | 超额会话跳过增强，正常媒体不排队 |
-| process_extra_socket_limit | 256 | 进程内所有 IceAgent 共享配额 |
-| process_probe_pps | 200 | 进程级公平调度，优先及时 ACK，仍受总预算约束 |
-
-定义两个截止时间：`T_probe = min(本轮开始 + 探索时长, 原升级截止 - ICE 保留时间)`；`T_finish = min(T_probe + ICE 保留时间, 原升级截止)`。到 T_probe 停止新探索、释放未命中端点，已提升且正在检查的端点进入 DRAINING，继续标准 ICE 至 T_finish。到 T_finish 才取消仍未完成的增强检查；已选中的端点继续归正常 ICE 管理。协商、分配、重传均不延长原有 30 秒窗口。双方各自检查本地剩余时间；不足时拒绝开始。
-
-控制包与新增 PROBE/ACK 单独计数；提升后的普通 STUN 检查遵循 libnice 原节拍，但需要记录它们带来的额外事务和重传。媒体包不计入探测预算。
-
-首次实现用内部配置和明确命名的实验环境变量加载配置，仅读取一次，不增加公开 `Params` 布局或 GUI 开关；例如 `MINIRTC_UDP_PUNCH=off|wide-only|pool-wide`。无效值禁用增强并打印原因。端口池大小等调参入口统一由同一校验函数处理。
-
-`wide-only` 保留同样的协议、角色和锚点选择，但 pool 侧只用一个端点；`pool-wide` 使用配置的端点池。基线 `off` 仍保留已有附近端口预测。不能让实验分组顺带改变其他 ICE、TURN 或重试配置。
-
-单端点模式也经过新的协调和端点接入流程，因此 A/B 差异不能全部归因于采样范围；B/C 对比用于隔离多个本地端点带来的增量作用。
-
-## 7. libnice 接入与命中后的完整闭环
-
-### 7.1 后端职责
-
-新增能力全部在 NiceAgent 的 GMainContext 中执行。C++ 只持有带 generation 的不透明句柄，不直接持有可悬空的 `NiceSocket*`。
-
-拟提供的内部接口契约，确切 C 签名在 P0 验证后冻结：
-
-| 拟新增接口 | 语义 |
-| --- | --- |
-| `punch_get_capabilities()` | 扩展版本及可用能力；不能仅因头文件存在就通告支持 |
-| `punch_acquire_anchor(base_candidate)` | 借用并保留真实 anchor socket，返回句柄与实际本地地址 |
-| `punch_create_pool(base_candidate, count)` | component 拥有新 socket，逐项报告分配成功/失败；只做直接探索 |
-| `punch_send(handle, remote, bytes)` | 从指定 socket 发出原始直接 UDP，不走当前 selected relay |
-| `punch_packet` 事件 | 句柄、原始外层 src/dst、字节、generation；只在直接 socket 接收路径产生 |
-| `punch_promote_and_check(handle, anchor_candidate)` | 原子地把该 pool socket 注册为可检查的本地 host 候选，向已有 anchor 远端候选触发普通 STUN |
-| `punch_stop_discovery(round)` | 到探索截止时停止自定义探测，释放未命中端点；保留已提升并在验证的端点 |
-| `punch_cancel(round)` | 撤销探索 source、借用引用和未被 ICE 接管的 socket；幂等 |
-| `punch_get_upgrade_deadline()` | 返回已有升级截止的 monotonic 时间，避免 C++ 层另起不一致的 30 秒计时 |
-
-不要用 `nice_agent_set_port_range()` 代替端口池；该接口只约束 host 候选的端口分配范围。不要调用强制 selected-candidate API 绕过 ICE 验证。
-
-接入点要覆盖：component 的 socket source 管理、UDP 接收分流、候选与 socket 的关联、候选对入队、READY 后重新唤起检查计时器、候选裁剪和销毁。新增 socket 使用现有 UDP 后端的创建过程，保持 Windows/Apple 物理接口绑定行为。
-
-### 7.2 直接接收分流
-
- anchor 原始 socket：在 libnice 将未知源的非 STUN 数据丢弃之前，识别仅在已协商轮次生效的 PROBE/ACK，传给协调器验证。
- pool 探索 socket：只处理本轮的直接 PROBE/ACK；普通业务数据不向上交付。提升后允许该 socket 进入正常 libnice STUN/媒体处理。
- 接收钩子必须区分原始 UDP、TURN 服务器来源及 TURN 解封装后来源。嵌套的同 magic 载荷不得走直接命中分支。
- 在原来的 NiceSocket 事件循环中读取，禁止另一个 recvfrom 线程竞争同一 socket 的 STUN 或媒体包。
- 回调不能在 libnice 内部持有不可重入锁时同步反向调用后端；必要时保留有界字节副本和句柄，投递到同一 context 的后续任务。
-
-### 7.3 标准 ICE 验证路径
-
-第一版固定由 pool 端首先对新 socket 启动普通检查，避免将每个猜测端口伪装成已发现的远端候选：
-
-1. pool 从某个 socket 收到有效 PROBE 或匹配 ACK，确认该端点有直接入站证据。
-2. 后端保持该实际 socket 不关闭，将其提升为正常本地 host 候选，并与已有 anchor 公网候选建立检查对。
-3. pool 从该 socket 发出正常 Binding Request，使用当前 generation 的 ICE 凭据、真实 controlling/controlled 角色和既有 priority 规则。
-4. anchor 在原始 socket 上收到请求，经 libnice 认证后按标准逻辑学习新的 peer-reflexive 远端地址、响应并触发反向检查。
-5. 双向检查形成 valid pair，controlling 一侧通过现有 relay-upgrade 路径执行 nomination/renomination。
-6. 收到真实 selected-pair 变化，双方才各自将状态记为 `DIRECT_SELECTED`。RESULT、短包 ACK 或发现 prflx 均不能代替这个条件。
-
-直接 probe 认证和 ICE 认证是两个不同步骤。成功 probe 不标记候选 valid，不伪造 STUN 成功事务，也不提前对外报告“学到 prflx”。
-
-必须覆盖 pool 为 controlling 和 pool 为 controlled 两种情况。新增 pair 的优先级由现有候选计算规则产生，并验证满足已有“优先级高于所选 relay 才升级”的条件。
-
-### 7.4 候选数量与 end-of-candidates
-
-探索 socket 在命中之前不参加全量候选配对，不为 64×512 个组合建立检查对象；控制提升数量，逐个接入正常检查。
-
-内部增强端点不通过普通 `new_candidate` 信令发送。为这些端点明确添加内部来源标记，并在现有 `new-candidate-full` 回调处处理，防止在已发送 end-of-candidates 后又误发一批普通候选。既有 host/srflx/relay 的正常收集和结束标记不受影响。
-
-这属于双方协商的 MiniRTC 扩展；不能假定标准浏览器或未打补丁的 libnice 在 READY 后接受相同的动态行为。
-
-### 7.5 媒体连续性和所有权
-
- selected relay 在新的 pair 真正选中前持续传输；不调用 ICE restart，不创建第二套 DTLS/SRTP 会话，不重置 SSRC、编码器和传输控制器。
- 探索中：component 持有 pool socket；协调器持有不透明句柄。
- 提升后：所有权转入正常候选/检查生命周期，协调器只保留观察标记。
- 选中后：候选及 component 保持 socket 存活直到连接关闭；取消探测不能关闭它。
- 未选中的已提升 socket 若仍被进行中的 STUN/checklist 引用，先在 context 中安全移除相应工作，再释放。不能按一个“关闭整个池”的循环直接 close。
- 借用的 anchor socket 和原 relay socket 始终由原 ICE 生命周期管理，探测清理只释放额外引用。
-
-进程级额外 socket 配额随实际 socket 生命周期持有。提升或选中只转移配额所有者，不能提前返还配额后让进程实际句柄数越过上限。
-
-## 8. 状态机、取消和故障行为
-
-```text
-DISABLED / INELIGIBLE
-          |
-          v
-WAIT_RELAY_AND_VERIFIED_DTLS
-          |
-          v
-EXCHANGE_HELLO -> PREPARING -> READY -> PROBING
-                                      |    |
-                                      |    v
-                                      |  ICE_VALIDATING -> DIRECT_SELECTED
-                                      |    |
-                                      v    v
-                                      DRAINING -> DIRECT_SELECTED
-                                          |
-                                          v
-                                       STOPPED
-```
-
-`ICE_VALIDATING` 表示至少一个端点已提升；在数量与时间预算内可继续其余探索。单个命中检查失败不能立刻报告整个实验成功或关闭仍在工作的 relay。
-
-到 T_probe 或探索预算耗尽时停止新探索；存在待验证端点则进入 DRAINING，否则结束。DRAINING 只继续已经登记的 ICE 工作，不再创建新端点或扩大端口集合；最多持续到 T_finish。
-
-任何活动状态均可因下列事件进入 STOPPED：
-
- 对端不支持、模式不符、观测不足、预算不足、控制协商超时。
- 普通 ICE 提前选中了直连；立即停止本增强，区分成功来源为 `ordinary-ice`。
- 原升级窗口到期、会话断开、ICE generation 改变、被借用 socket/接口失效。
- 本轮 socket 分配不足、队列过载、认证上下文消失、协议冲突。
-
-无效外部包只丢弃和限频计数，不能让任意错误报文取消有效会话。已认证对端主动 CANCEL 可以停止本轮，但不关闭媒体连接。
-
-关闭顺序必须是：禁止新调度并标记取消 → 作废 generation/round 任务 → 移除 GSource/回调 → 释放探索资源 → 安全处理未选中提升端点 → 执行现有 NiceAgent 异步关闭 → 清理 exporter 密钥和 DTLS。工作不能阻塞或反向等待自己的 nice_thread。
-
-构建默认开关关闭时应没有额外 socket、计时器、控制包或能力通告。运行关闭后不能靠收到对端消息隐式开启。
-
-## 9. 日志与测量口径
-
-INFO 记录阶段和结论；逐包记录放入可选调试日志。所有记录包含 connection/generation/round 标识，不打印 ICE 密码、exporter 或完整认证 tag。
-
-| 事件 | 必须字段 |
-| --- | --- |
-| eligibility | 模式、双方能力、角色依据、样本 socket/年龄、跳过原因 |
-| prepare/start | 协商实际预算、本地截止时间、anchor 本地/公网端点、批准的对端 IP |
-| probe-tx/rx | 本地 socket_id、实际地址、原始外层源/目的、nonce、direct/control/relay 标记 |
-| promote | 命中的具体 socket、触发原因、候选 foundation、候选对标识 |
-| ICE check | TID、pair、角色、状态、外层地址、TURN peer（若有） |
-| selected | 完整本地/远端候选类型和地址、成功来源、是否沿用命中 socket |
-| stop | 原因、持续时间、唯一目标数、socket 峰值、发送尝试/成功/失败/重传、清理结果 |
-
-成功率至少分别报告：
-
- 全部连接尝试中的直连建立比例。
- 满足增强条件并实际启动的连接中的增强成功比例。
- 普通 ICE 自行成功、增强成功、继续 relay、连接失败的数量。
-
-分母包含失败/超时，不把“跳过增强”混入增强失败，也不能只汇总成功样本。记录 P50/P95 建立耗时、额外包数、峰值句柄、CPU 和切换期间的媒体间隙。每条结论都能追到 session ID、二进制版本和抓包。
-
-## 10. 分阶段实施与验收
-
-以下顺序是依赖关系。P0 未通过时先解决后端接入问题，不能通过增加扫描范围掩盖“已命中却无法接入 ICE”。
-
-### P0：验证 READY 后新增 socket 与媒体切换
-
-交付：最小 libnice 扩展及双端集成测试，在受控网络中创建一个额外 pool socket，获得直接入站后提升、普通 ICE 验证、选中并传输。
-
-验收：
-
- 从真实 selected relay、READY 和已验证 DTLS 状态开始，端点在此后创建。
- Windows/macOS 均验证创建、物理接口绑定、接收、提升及结束清理；两个 ICE 角色都覆盖。
- 捕获证明命中的本地端口和后续 STUN/媒体端口一致。
- 验证候选不会因 READY、检查上限、同 foundation/base 或 end-of-candidates 流程被错误抑制。
- 选路变化不重启 DTLS；未命中和主动取消保留原 relay。
- 冻结后端接口、所有权表和必要补丁范围，记录实际代码接入点。
-
-P0 工具只能使用实验提供的明确对端地址，不含广范围探测。
-
-### P1：协议、密钥与配置
-
-交付：能力行、验证后 exporter、报文编解码、重放窗口、HELLO/PREPARE/READY/START 协商和默认关闭配置。
-
-验收：新旧版本互连正常；关闭时无新增行为；无效 tag、旧 generation、重复 START、丢失 READY、时钟偏差不导致越级启动或重复分配。控制包不会进入 DTLS/SRTP/业务包解析。
-
-### P2：角色、端口采样和预算
-
-交付：映射快照、角色判断、无放回端口采样、token bucket、pool 轮发策略、进程级配额。
-
-验收：假时钟可以复现相同发送计划；延迟唤醒不超突发上限；观测过期/多 socket 混淆被拒绝；同进程多连接不突破共享限制；短 ACK 不绕过总预算。
-
-### P3：组合探测与提升
-
-交付：anchor、pool、直接报文接收钩子、命中后普通 ICE 检查、selected-pair 归因。
-
-验收：完整实现第 7 节闭环；只提升命中端点；来自 TURN 内层的相同短包不产生直接命中；成功、超时和普通 ICE 抢先成功均正确清理。
-
-### P4：生命周期、兼容与构建
-
-交付：断开/重连/接口变化处理，libnice 配方和包身份更新，新符号检测，Windows/macOS/Linux 编译验证。
-
-验收：连续创建/停止至少 100 轮无残留端口池或 source，关闭竞态检查通过；旧依赖缓存不能错误通告新能力；iOS/WebRTC 路径未启用此模式且正常构建。
-
-### P5：真实网络对照与启用决定
-
-交付：A/B/C 配置、自动汇总脚本、双端抓包复核和实验结论。
-
- A：现有策略，增强关闭。
- B：相同新协议与相同的自动角色判定规则，一侧单端点，另一侧扩大目的端口；角色必须由有效观测支持。
- C：与 B 相同，但使用端口池。
-
-按交错顺序重复 A/B/C，第一轮每组至少 30 次；保持网络、版本、STUN/TURN 和其余配置相同，记录每次启动间隔和真实端点。观察到一次成功不等于方案验收完成。
-
-先验收机制和无回归，再评价收益：每个增强成功样本必须能证明直接命中 → 标准 STUN → nomination → 直接媒体；默认关闭路径无行为变化；资源全部在上限内。报告成功比例的不确定性，不从小样本承诺固定提升幅度。
-
-在真实网络证明净收益且兼容/退出检查通过之前，保持默认关闭；通过后再单独形成默认启用及参数调整变更。
-
-## 11. 测试设计
-
-### 11.1 纯逻辑与协议测试
-
-新增拟定目标 `minirtc_punch_unit_test`，覆盖：
-
- 跨 generation、跨 socket 的样本隔离和角色对称性。
- 端口采样范围、唯一性、可复现性、耗尽与数量边界。
- 速率/包数/时长/进程配额，事件循环暂停后的行为。
- 报文截断、长度溢出、错误域密钥、错 tag、旧轮次、nonce/socket 不匹配、乱序与重放。
- READY/START/CANCEL 重复、断开在任意状态发生、部分分配失败。
- 默认关闭、新旧能力组合、强制 relay、reliable、无 DTLS 验证的跳过条件。
-
-### 11.2 libnice 集成测试
-
-新增拟定目标 `minirtc_punch_integration_test`。当前 MiniRTC 没有已注册的可直接运行的 ICE 测试目标，旧 `tests/peerconnection` 示例不是可用基线。实现时必须注册目标并写出准确的构建/执行命令。
-
-集成测试验证真实 NiceAgent、真实 socket、STUN 认证、triggered check、选路、媒体收发及销毁。模拟器内的单元测试不能替代 P0。
-
-### 11.3 可控网络场景
-
-搭建受控 UDP/NAT 测试拓扑，或具有真实 socket 和明确翻译规则的测试代理。不要默认 Linux 普通 MASQUERADE 就等于本次目的相关映射；必须先通过多目标 STUN 验证场景行为。
-
-必测：
-
-1. LAN/普通可直连网络：普通 ICE 成功，不启动或及时停止增强。
-2. 一侧稳定映射且有端口相关过滤，另一侧目的相关映射：未知新映射参与匹配。
-3. 丢弃 anchor 最早的探测，让 pool 后来的包首先到达：复现 UU 的关键可达顺序。
-4. 没有目标端口交集：到期后保持 relay，释放探索资源。
-5. 模拟 UDP 丢失、重复、乱序，控制包延迟，以及两端墙上时钟相差至少 500 ms。
-6. 只有 TURN 内层收到同内容数据：不得记录为直接命中。
-7. 两侧都目的相关、观测不足、IPv6-only：v1 跳过，原功能继续。
-8. pool 任一端点命中后断开、提名中取消、接口变化、旧任务到达新 generation。
-9. 进程中超过两个连接请求增强：资源限制与普通媒体均正常。
-
-### 11.4 真实会话验收
-
-双方记录二进制/提交版本、实际配置、网卡、抓包起止与内核丢包计数；按 nonce、STUN TID、外层地址和成功后的 socket 对齐。NAT 可能重写端口，不能仅按发端源端口搜索对端抓包。
-
-“直连成功”的严格条件：候选对两端均不含 relay，标准检查和提名完成，双端网卡观察到相匹配的外层 UDP，并持续承载应用数据。日志中的 prflx 或一个短包 ACK 不算成功。
-
-## 12. 已识别的实现风险与解决位置
-
-| 风险 | 解决阶段 |
-| --- | --- |
-| READY 后新增 socket 无法进入检查或被裁剪 | P0 验证并冻结必要 libnice 改动 |
-| 为全部端口组合创建 ICE 对象导致检查表膨胀 | P2/P3 将探索与少量提升分离 |
-| 临时 socket 成功后被清理，媒体仍发旧端口 | P0/P3 明确所有权转移并核对原始端口 |
-| 把 TURN 解封装逻辑来源当成直接来包 | P3 在原始 socket 层分类，P5 双端抓包验收 |
-| 现有 DTLS done 标志先于指纹验证 | P1 增加明确的 peer-verified 状态与导出门槛 |
-| 自定义控制包落入 SRTP/业务解析 | P1/P3 按版本和种类分流，协议测试与媒体回归 |
-| libnice/GLib 回调锁内重入、退出时悬空引用 | P0/P4 同 context 调度、句柄注册表与幂等停止 |
-| 两端升级窗口不同或旧消息延长新轮次 | P1/P2 本地 monotonic 截止、generation/round 隔离 |
-| 头文件与旧 libnice 静态库不匹配 | P4 包身份、补丁哈希、编译/链接及运行能力检测 |
-| 把一次成功当作普遍成功率提升 | P5 分组重复实验，保留全部失败和跳过样本 |
-
-## 13. 后续执行入口
-
-后续实现从 **P0** 开始，先读取本方案和当时仓库状态，确认源码基线是否变化。每完成一个阶段，在对应实现提交说明中记录：改动范围、验收证据、未解决问题和本方案是否需要修订。
-
-如果 P0 证明某个后端接口或 selected-pair 路径不可按本文实现，应先根据实际 libnice 代码修订这一处设计并给出替代路径，再继续后续阶段；不要把未完成的直接验证改成强制选路或延长超时。
-
-本方案当前的执行目标是一个默认关闭、可复现实验、完整管理 socket 生命周期的原型。通过 P5 后，才讨论默认启用、扩大网络适用范围，以及首次连接阶段的增强。
-
-## 14. 技术依据
-
- [RFC 8445：ICE 的认证、peer-reflexive 候选、触发检查和提名](https://www.rfc-editor.org/rfc/rfc8445.html)：命中后的验证复用 ICE；本文 READY 后探索为双方协商的额外能力。
- [libnice NiceAgent 文档](https://libnice.freedesktop.org/libnice/NiceAgent.html)：候选收集、端口范围、接收回调和检查参数；新增 pool API 不属于现有公共 API。
- [OpenSSL 3.3：SSL_export_keying_material](https://docs.openssl.org/3.3/man3/SSL_export_keying_material/)：独立标签及 context 导出会话密钥；本方案新增 peer-verified 前置条件。
- [NAT traversal：多 socket 与目的端口探索](https://tailscale.com/blog/how-nat-traversal-works#the-benefits-of-birthdays)：两个集合相交的通用思路，用于解释实验方向，不作为 UU 私有实现或成功率证明。
-
-
-## 15. 本轮 P0 实施记录（2026-09-13）
-
-MiniRTC 实施提交：`7f0e666216891c9b79bd4a8f75b63741fe1fabf2`。
-本机最终检查为 22/22 通过，包括 en1 实际 IPv4 与内核接口绑定读回；这不是跨 NAT
-成功率。详情见 [P0 测试记录](../deps/submodules/minirtc/tests/ice/lab/p0-validation-2026-09-13.md)
-与 [构建、双机执行和抓包步骤](../deps/submodules/minirtc/tests/ice/lab/p0-experiments.md)。
-
-本节是执行记录，不改变 P0→P5 的依赖门槛。**本轮没有完成可启用的“双端
-UDP 打洞增强”产品功能。** P0 的本机机制已可运行；Windows、双端物理网卡抓包
-和实际 CrossDesk 媒体尚待验收，因此不启动 P1–P5，不通告生产 v1 能力，也不进行
-512 目的端口/64 本地端点的广范围探索。
-
-交付位于 MiniRTC 子模块，不能仅依赖开发机缓存：
-
- `thirdparty/libnice/patches/punch_pool_0.1.24.patch`：在前三个现有补丁后应用，
-  新增 `nice/punch.h` 与单端点实验后端，补丁 SHA、包身份版本与符号链接检查已进配方。
- `tests/ice/punch_integration_test.cpp`：真实 NiceAgent、TURN、DTLS、SRTP 与 UDP
-  转发门控，pool 的两个 ICE 角色均可执行；在代码中检查内核实际 selected socket。
- `tests/ice/punch_peer_test.cpp`：两个独立进程/两台 LAN 主机的 P0 实验入口，
-  私有共享目录提供测试信令，便于 Windows/macOS 后续配合；不是生产控制协议。
- `tests/ice/lab/run_p0.py`：临时 coturn、STUN 就绪检查、场景矩阵、二进制 SHA、
-  结构化结果与清理；`tests/ice/lab/p0-experiments.md` 给出准确构建、双机操作和抓包清单。
- `src/ice/ice_agent.*`：明确 `dtls_peer_verified_`，统一两个握手完成入口的指纹
-  验证；导出 SRTP 前要求验证成功；有界保留早于本端 READY 的 DTLS flight。
-
-### 15.1 经源码和实验确认的调整
-
-1. `priv_conn_check_add_for_candidate_pair_matched()` 原来会将 READY 降为 CONNECTED。
-   对已打开 P0 端点且处于原升级窗口内的连接保留 READY，正常 STUN 排队、优先级、
-   valid pair 和 nomination 不变。取消增强检查时，尚存的 selected relay 不因
-   checklist 中提名对象已裁剪而被错误宣告 FAILED。
-2. 直接接收分流必须排除两类中继：本端 TURN 解封装，以及**对端 allocation 向
-   本端 host 发出的普通外层 UDP**。后者在 pool 为 controlling 的负向测试中被发现，
-   因而在原始接收钩子中额外排除已知远端 relay candidate 地址。
-3. 初始实验复现了既有 DTLS 次序问题：ClientHello 到达时本端仍为 CONNECTED，
-   原代码丢包且对端没有后续包推动握手。现在最多暂存 4 个、每个不超过 2048 字节的
-   早到 DTLS 数据报，仍由原 READY 回调启动同一个 DTLS 会话；没有重新握手、修改
-   ICE/DTLS 超时或延长升级窗口。BIO 方法初始化也改为线程安全的一次性初始化。
-4. libnice 的 SDP 解析器按 LF 切分，直接复制 ufrag/password；实验初版擅自将
-   libnice 输出改成 CRLF，造成密码尾部多出 CR 与真实 STUN integrity 失败。
-   夹具已保留原 LF 格式。此修正仅在测试信令中，不改写生产信令行为。
-
-### 15.2 当前后端契约及边界
-
-公开名称刻意标为 `NICE_PUNCH_P0_ABI`，不是 `udp-punch:1` 的运行能力证明。
-
-| 接口 | P0 实际语义 |
-| --- | --- |
-| `nice_agent_punch_get_abi/live_sockets` | 实验 ABI、进程额外 socket 存量 |
-| `nice_agent_punch_get_deadline` | 读取现有有效 relay upgrade 截止，无新窗口 |
-| `nice_agent_punch_open` | 指定真实 IPv4 host base，在 READY relay 上借用或创建一个端点 |
-| `nice_agent_punch_send` | 指定 generation/不透明 handle，向明确地址发送 80 字节实验探测 |
-| `punch-packet` | 锁外信号，带范围、实际外层地址与有界字节副本；不表示 ICE valid |
-| `nice_agent_punch_promote` | 保持 socket，加入一个普通 host/已知 anchor remote 检查对 |
-| `nice_agent_punch_stop(..., FALSE)` | 停止探索，关闭未提升端点，继续已提升检查 |
-| `nice_agent_punch_stop(..., TRUE)` | 先剪除未选中检查再关 socket；已选中端点保持传输 |
-
-原始 anchor、relay 的所有权始终属于原 ICE；新 socket 属于 component 的
-SocketSource；提升不关闭或重建 socket。额外 socket 配额在实际 SocketSource
-释放之后返还，选中后仍占配额直到关闭。句柄不暴露 FD，不在 libnice 锁内反向调用。
-
-P0 仅允许每 component 一个实验端点，进程硬限制 256 个额外 socket。它没有实现
-P1 的生产认证上下文、P2 速率公平预算、P3 广范围组合探测或 P4 完整重连协调器。
-实验 HMAC 密钥仅来自可信夹具/私有测试信令，不声称已经完成 DTLS exporter。
-`MINIRTC_UDP_PUNCH=wide-only|pool-wide` 目前没有被实现或读取；产品仍关闭。
-
-### 15.3 验收和下一步
-
-当前可运行的构建与实验步骤见子模块
-`tests/ice/lab/p0-experiments.md`；可公开的测试摘要保存在同目录的结果记录中。
-成功意味着本机真实中继 → 验证过的 DTLS → 新 socket 的认证入站 → 正常 STUN/
-nomination → 同一 socket 的双向 SRTP，不能将编译、短包 ACK 或一次局域网成功
-当作 P0 总验收或 P5 的真实网络收益。
-
-P0 总门槛仍需 Windows x64 编译/执行、Windows/macOS 双端抓包、两个 ICE 角色、
-实际桌面媒体连续性及退出检查。完成这些后再冻结生产后端接口并进入 P1，沿用本文
-其余协议、预算和 P1–P5 验收要求。此处没有通过降低验收要求提前启动广范围探索。
-
-2026-09-13 后续进展：用户报告同步后的 Windows 构建成功，尚未取得 Windows
-网络测试日志或二进制哈希；不能将构建成功记为 P0 运行验收。两端实际不在同一
-局域网，当前双机夹具要求明确且互相可达的 UDP 地址，因此不能直接使用两端
-私网 IP 运行该夹具。`run_p0.py` 新增外部实验 TURN 模式，使 Windows 可以先
-独立完成本机双 ICE 角色、SRTP 和资源清理矩阵，无需本机安装 coturn。外部 TURN
-不等于双机直连拓扑，此调整不改变 P0 门槛、原升级窗口或后续阶段依赖。
-
-### 15.4 两台 Mac 局域网实测
-
-用户提供同局域网的第二台 arm64 Mac 后，已在 `192.168.31.125/en1` 与
-`192.168.31.102/en0` 执行真实双机 P0；双方系统均为 macOS 26.6.2。
-`run_p0_ssh.py` 仅用 SSH 传递实验 JSON 信令，探测、STUN 和 SRTP 仍通过真实
-LAN UDP socket 与原受控门控转发。没有改用 SSH 隧道承载被测传输。
-
-四种 ICE/端口池角色组合的媒体断言均通过。首轮严格双端逐包核对为 3/4 通过，
-另一组有一个 SRTP 包只出现在发送端抓包中，原始失败记录已保留，未改判为成功。
-该组以新端口、新 run ID 复测后通过，两端均取得零内核丢包统计。四种组合现均有
-探测 HMAC → 认证 STUN/提名 → 命中 socket 上双向 SRTP 的双机报文证据。
-
-双机夹具增加开池前至少 10 个中继 SRTP、停止探测后至少 10 个直连 SRTP、
-selected socket 的物理接口绑定读回；全部仍在原升级窗口内。仓库新增
-`verify_p0_capture.py`，核对实际 pcapng、ICE MESSAGE-INTEGRITY、提名 TID 和
-门控两侧的相同报文，私有密钥和原始抓包不入库。
-
-完整次数、哈希、例外、复现和清理记录见
-[双 Mac P0 实测记录](../deps/submodules/minirtc/tests/ice/lab/p0-lan-validation-2026-09-13.md)。
-本轮完成 Mac 双机机制与抓包验证，**没有替代 Windows 运行、跨平台及实际应用
-媒体验收**。P0 总验收仍未完成，P1–P5 继续保持未启动，生产功能默认关闭。
-
-### 15.5 Windows 局域网验收准备（2026-09-14）
-
-用户另提供同局域网 Windows：WLAN `192.168.31.220/24`，仓库
-`D:\SourceCode\crossdesk`，账户 `desktop-ri1qfbe\kunkundi`。用户输出确认
-Python 3.13.5 可用，MiniRTC 为 `7f0e666`，两个 P0 测试 EXE 文件存在。
-这些信息不代表测试已运行；升级后的双机媒体断言需要同步并重新构建 peer 目标。
-
-实验驱动增加 `--remote-shell powershell`，通过编码命令传入 Windows 的字面路径，
-仍仅使用 SSH 管道传递私有信令。抓包核验器允许显式指定两端物理和本地回环接口名，
-以适配 Npcap 的命名；未将虚拟网卡或回环流量当作物理网卡交付证据。
-README 补充 Windows SSH 驱动、两接口抓包和精确接口名核验步骤。
-
-本机已检查 Python 语法、带空格/单引号/中文路径的命令编码、POSIX 参数兼容，
-并用原 Mac 抓包回归默认和显式接口选择；改写接口名后的同一份 Mac 报文也能核验，
-错误物理接口或 anchor 回环接口会被拒绝。这只是工具回归，**未执行 Windows
-PowerShell 启动、Windows 网络矩阵或 Npcap 验证**。当前等待 Windows SSH 接入，
-后续使用本机临时 TURN 开展单机矩阵和四种跨平台角色组合，保持原 P0 门槛。
-
-### 15.6 Windows/macOS P0 验收完成（2026-09-14）
-
-Windows 真实单机矩阵 20/20 通过，包含两个 ICE 角色、100 次生命周期、取消、
-未命中、错误指纹和原截止时间。跨平台四角色均已取得命中端口上的认证 STUN、
-提名及双向 SRTP 的严格双端抓包证据。完整结果、二进制和抓包 SHA、失败样本及
-边界见 [Windows/macOS P0 记录](../deps/submodules/minirtc/tests/ice/lab/p0-windows-validation-2026-09-14.md)。
-
-本轮没有把全部尝试改判为通过：初次双机抓包为 3/4，修正夹具收尾后为 4/5。
-最终普通 Mac pool/controlling 一组有中段一个 SRTP 包只出现在 Mac 抓包；同角色
-的单向通知延迟 1 秒组严格通过，因此四种角色均已有最终版本证据。另一次 Windows
-开池前 TURN 媒体基线失败，针对两种角色复测均通过，原失败仍保留且原因未确立。
-Windows 抓包统计包含 16 个 flushed，pcap/dumpcap/接口丢包为 0；未声称总丢包为 0。
-
-经源码和最小实验确认两处夹具修正：Windows `IP_UNICAST_IF` GET 已为主机序，
-去掉重复转换；旧夹具等待对端完成消息时仍发媒体，另一端可先销毁 gate，单向
-延迟实验复现最后 13 包未转发。新增停止发送、交换最终序号、双端认证接收确认后
-再销毁的屏障；没有修改标准 ICE、原窗口、DTLS 或降低媒体门槛。
-
-完整 CrossDesk 两端编译成功，Mac 使用 `xmake r crossdesk` 提供 Slint 运行环境。
-用户对双向画面、声音、鼠标键盘和三次重连请求回复已完成，未报告异常；此项作为
-用户报告的普通应用回归，不能声称独立测量了 pool 切换时的实际编解码连续性。
-命中 socket 的切换与认证媒体由 P0 真实 SRTP 夹具验证。
-
-P0 后端接口、所有权与取消语义按 15.2 冻结，允许进入 P1。P0 仍是每 component
-一个实验端点；P3 扩展数量时必须继续遵守同一 socket、标准检查和选中资源所有权。
-生产能力、广范围探索和默认启用尚未交付，P5 真实未知 NAT 的收益仍需后续对照。
-
-## 16. P1–P4 实现与 P5 实验入口（2026-09-14）
-
-本节更新当前状态；第 15 节“未开始 P1–P5”等文字是对应时间点的历史记录。
-在 P0 跨平台门槛通过后依次完成 P1/P2 基础、P3 多端点接入和 P4 生命周期/构建，
-没有在 P0 前放大探索范围。源码及实验工具由主仓库当前 gitlink 固定。完整证据见
-[P1–P4 验证记录](../deps/submodules/minirtc/tests/ice/lab/punch-runtime-validation-2026-09-14.md)，
-准确命令见 [v1 实验步骤](../deps/submodules/minirtc/tests/ice/lab/punch-v1-experiments.md)。
-
-| 阶段 | 当前交付及边界 |
-| --- | --- |
-| P0 | 已通过原门槛，保持单端点 ABI 1 与原始失败记录 |
-| P1 | 配置/能力、指纹验证后 exporter、认证协议与协商完成；默认关闭，新旧/未知能力纯逻辑及实际生成能力检查通过 |
-| P2 | 同源观测、角色、CSPRNG 采样、本地与进程预算完成；首次实现时 Mac/Windows/Linux 各 2,952 个单元断言通过，后续清理回归见验证记录 |
-| P3 | 独立 ABI 2、64/128 端点、同 socket 提升/标准检查/提名/媒体闭环实现；三个平台受控 runtime 各 12/12 |
-| P4 | owner context 清理、DRAINING、取消、重连身份和接口/base 检查实现；百次 source/agent 生命周期、Mac/Windows 完整应用、Linux ICE smoke、iOS 静态库已验证。物理网卡真实切换和最终应用互连仍待双端验证 |
-| P5 | 90 次交错清单与核验工具已准备；有 1 次增强成功双端日志但无该轮物理抓包。后续双端抓包取得 A/off 的 3 个完整窗口样本（均中继），B/wide-only 的 2 次已启动未命中和 1 次启动前跳过。跳过暴露的 READY 重查时序问题已修复，真实双端修复后复测及正式随机 A/B/C 仍待进行；保留先前 SDP 失败，不作收益或默认开启决定 |
-
-### 16.1 对实际源码的必要调整
-
- 保留已验收的 `punch_pool_0.1.24.patch`，追加 `punch_v1_0.1.24.patch`。
-  `nice_agent_punch_get_v1_abi/open_v1` 与 P0 API 区分；v1 每池最多 128、进程 256，
-  提升最多 8。补丁 SHA 与包身份版本进入 MiniRTC 配方，不依赖本机缓存改动。
- `PunchRuntime` 由 IceAgent 持有，在同一 GMainContext 使用真实句柄，直接收包
-  与 TURN 控制分流，认证命中后由 pool 提升。实际 selected pair 才报告结果，
-  各自的原始截止不会因 HELLO/重传/START 被延长。
- SDP 指纹最小实验发现原解析吞并 fingerprint 之后所有行并截断 SDP，导致新增
-  候选/能力位于其后时 DTLS 校验失败。改为逐行解析、保留其余 SDP、拒绝冲突指纹，
-  并加入真实握手与位置测试；没有通过禁用指纹校验绕过失败。
- 通用 DEBUG 日志在现有项目中编译关闭，因此添加独立、默认关闭的
-  `MINIRTC_UDP_PUNCH_TRACE=1`，只记录有界探测元数据。应用原有 SDP 日志包含 ICE
-  密码，原始实验文件必须保持私有；新代码不记录 exporter 或完整 tag。
- 首次启用后的真实应用试跑发现 eligibility 日志读取未赋值的旧 ufrag 指针，
-  在接收 SDP 时崩溃；最小实验复现后，eligibility/skip 与 exporter 统一从当前
-  libnice stream 读取 generation 凭据。补充双角色真实 SDP 接收/重建及自动 skip
-  的 TURN/SRTP 回归，详情见验证记录。此修复不改变协议或绕过探测前置条件。
- Mac off 试跑发现传输层复制指纹行后缺少 LF，追加原能力时产生 CR CR LF，
-  无 v1 能力的 SDP 被严格校验拒绝。完整 IceTransport 实验复现后在拼接处补齐
-  LF；三种运行模式各 36 个组合及错误指纹拒绝通过，证书校验和默认关闭不变。
- B 组一次启动遇到 READY → CONNECTED → READY 的正常候选重查。后端截止时间
-  查询只在 READY 有效，旧入口把暂时返回 0 当作最终跳过。保存首次 READY 时
-  后端提供的真实截止时间；在该时间内等待 CONNECTED 恢复，随后重新让后端验证
-  是否可探测。不在 CONNECTED 开池，不从恢复时间重新计算窗口；新增真实 TURN
-  的 `auto-recheck` 夹具，覆盖两个角色、原截止不变和单次 DTLS/认证中继媒体。
- 第 10 节 B 组原“固定角色”明确为**固定自动判定规则**，与第 4 节生产禁用强制
-  角色保持一致。受控夹具仍可固定角色；真实实验记录观测/角色变化及跳过，不把
-  它们隐藏为成功或擅自在生产中绕过适用条件。
-
-### 16.2 验收边界与下一步
-
-已验证 DRAINING 后真实 STUN 重传仍能提名并传输、认证 CANCEL 保留 relay、
-TURN 内层同形载荷不会产生直接命中，以及选中 socket 的实际存活和配额保持。
-Windows 64 端点百次压力测试在单一窗口到期后拒绝分配；工具通过多个新连接分批，
-最终两角色合计 20/20，各累计 100 次分配/停止/端口重绑定，没有扩大 ICE 窗口。
-分批首轮 15/20 暴露开池前基线只按发送次数判断的问题；改为原截止前等待双方
-各实际收到至少 10 个认证 SRTP 包后才开池。所有初次失败和修正理由保存在报告中，
-不追溯认定所有历史媒体缺包原因相同。
-
-用户已报告完成的普通画面/声音/控制/三次重连回归属于 P0 时点，不代表后续原型
-已通过真实应用切换验收。后续已有异网配对的双端成功日志，下一步补齐物理抓包，
-并在同步接收端修复后，用同一版本、同一信令
-与 STUN/TURN 配置，按文档交错执行 A/B/C；首先确认新鲜多 STUN 观测符合一侧稳定、
-另一侧目的相关。每个增强成功必须核验双端物理报文、标准提名、同一命中 socket、
-同一 DTLS/SRTP 会话以及实际画面/声音/控制。至少每组 30 次、保留全部失败/缺测。
-在这些工作完成前，原型仍默认关闭，不能声称已提高真实网络成功率。
@@ -0,0 +1,71 @@
+# Windows 签名与 Release 测试
+
+GitHub Actions 的 `Build and Release` 工作流构建 CrossDesk，调用 SignPath 签名，再发布已验证的 Windows 文件。
+
+## 触发方式
+
+| 触发方式 | 签名策略 | 输出 |
+| --- | --- | --- |
+| 普通分支 push，或未勾选签名的手动运行 | 无 | 开发构建工件 |
+| 手动运行，勾选 `sign_windows_test` | `test-signing` | 测试证书签名的 Actions 工件 |
+| 手动运行，勾选 `sign_windows_release` | `release-signing` | 正式证书签名的 Actions 工件 |
+| push `v*` tag | `release-signing` | 验证通过后发布 GitHub Release 和下载站 |
+
+两种手动签名选项不能同时启用。手动运行可勾选 `windows_only` 跳过其他平台；即使选择 tag 手动运行，也不会发布 Release、更新 `latest` 或同步下载站。
+
+## SignPath 配置
+
+GitHub 仓库需要 Secret `SIGNPATH_API_TOKEN` 和 Variable `SIGNPATH_ORGANIZATION_ID`。SignPath 项目 slug 为 `crossdesk`，已关联 GitHub.com Trusted Build System。
+
+该工作流明确使用以下 Artifact Configuration：
+
+| Slug | XML 文件 | 用途 |
+| --- | --- | --- |
+| `initial` | `apps/desktop/scripts/windows/signpath-installer.xml` | 现有安装包配置，只签外层 NSIS EXE |
+| `windows-binaries` | `apps/desktop/scripts/windows/signpath-binaries.xml` | 签 ZIP 内四个 CrossDesk 自有二进制 |
+
+`crossdesk` 后台已添加并验证 `windows-binaries`。新环境需要在项目的 Artifact Configurations 页面创建同名配置，使用仓库内对应的完整 XML。保留 `initial` 的默认配置和现有审批、来源验证要求。XML 文件仅提交到 GitHub 不会自动同步到 SignPath 后台。
+
+两种策略都必须允许提交这些配置。正式策略需要有效的 Release 证书、提交者权限和审批人。若证书仍为 `CSR PENDING`，需要 SignPath 完成签发/导入；切换工作流参数不会使证书生效。后台的来源限制也必须允许当前测试分支，若不允许，应按项目原有发布审批流程处理。
+
+## 签名顺序
+
+1. 构建安装版，将 `crossdesk.exe`、`crossdesk_service.exe`、`crossdesk_session_helper.exe`、`wgc_plugin.dll` 打成 `installer-binaries.zip`。
+2. 使用 `windows-binaries` 签名，验证四个文件后替换构建输出。
+3. NSIS 打包已签名的文件，使用 `initial` 签名安装器，验证后替换安装器。
+4. 构建便携版，将四个文件打成 `portable-binaries.zip`，同样签名并验证，然后生成包含已签名文件的便携 ZIP。
+5. 上传最终安装器与便携 ZIP。tag 发布等待 Windows 签名和其他平台构建全部成功。
+
+第三方 DLL 原样打包，不提交签名。外层 NSIS 签名不为内部文件添加独立签名；本流程在打包前签名自有文件。NSIS 生成的 `uninstall.exe` 尚未配置独立签名。
+
+每次运行会按上述顺序提交三个签名请求。正式签名需要在 SignPath 中逐个审批，每个请求最多等待 60 分钟，整个 Windows job 最多 240 分钟。请求链接由官方 Action 输出，并在可用时写入运行摘要。
+
+## 启动正式证书测试
+
+在 GitHub → Actions → Build and Release → Run workflow 中选择测试分支：
+
+- `sign_windows_release`: true
+- `sign_windows_test`: false
+- `windows_only`: true
+
+也可在分支推送后运行：
+
+```sh
+gh workflow run build.yml --ref signpath-release-signing \
+  -f sign_windows_release=true -f sign_windows_test=false -f windows_only=true
+```
+
+正式验证要求 Authenticode 状态为 `Valid`、存在时间戳，并且 `signtool verify /pa /all /v` 返回成功。测试证书允许 `NotTrusted`，但拒绝无签名、哈希不匹配等状态。任一签名或验证失败均停止后续发布；不会回退到未签名发布。
+
+原始签名输入保留为中间 Actions 工件。手动测试成功后，下载名为 `crossdesk-win-x64-...` 和 `crossdesk-win-x64-portable-...` 的最终工件，不要使用 `installer-binaries.zip`、`portable-binaries.zip` 等原始签名输入。
+
+## 本地校验
+
+```sh
+pwsh -NoProfile -File apps/desktop/tests/windows_signing_test.ps1
+actionlint .github/workflows/build.yml
+```
+
+PowerShell 测试使用模拟证书状态检查归档范围、还原顺序及失败行为，不能替代 Windows 上的真实 Authenticode 验证。
+
+参考：[SignPath GitHub 集成](https://docs.signpath.io/trusted-build-systems/github)、[Artifact Configuration](https://docs.signpath.io/artifact-configuration/examples)、[SignTool 验证](https://learn.microsoft.com/en-us/windows/win32/seccrypto/using-signtool-to-verify-a-file-signature)。
@@ -0,0 +1,48 @@
+# Windows 更新与安全软件兼容性
+
+Windows 的更新按钮在后台下载发布信息中指定版本的安装包，完成校验及
+Windows 附件安全检查后打开安装向导。客户端使用 WinHTTP，保留系统的
+HTTPS 证书检查和代理配置，并用 `CrossDesk/<version> WindowsUpdater`
+标识请求。
+
+安装包保存在 `%LOCALAPPDATA%\CrossDesk\Updates` 下的独立目录中。
+下载过程写入 `.part` 文件；HTTP 响应、文件长度、Windows 可执行文件头
+均通过检查后才生成最终安装包。
+
+客户端通过 Windows Attachment Services 的 `Save` 记录下载来源并请求
+系统安全检查，再通过 `Execute` 打开安装包。这些 API 会按 Windows 策略
+调用扫描、信任检查和必要的提示。安装程序由自身的管理员权限清单请求
+UAC 授权。安全检查失败时停止流程，不回退到直接启动，也不删除来源标记。
+
+## 发行版签名
+
+应使用受信任的正式代码签名证书签署发布的主程序、服务、辅助程序、DLL
+和最终安装包。只签安装包不能建立已安装主程序的发布者身份。
+SignPath 的 `test-signing` 用于测试，不能代替公开发行所需的受信任签名。
+当前流水线中的测试签名配置仍保持为可选项；正式策略需在取得证书及
+SignPath 授权后配置。
+
+检查实际分发文件的签名：
+
+```powershell
+Get-AuthenticodeSignature .\crossdesk.exe
+Get-AuthenticodeSignature .\crossdesk-win-x64-<version>.exe
+```
+
+## 网络防护告警的处理
+
+2026-09-09 的天擎日志记录了在域名解析阶段对
+`downloads.crossdesk.cn` 和 `101.132.143.203` 的阻断。
+该记录不能单独证明 HTTP 库、提权方式或文件内容是命中原因。
+切换到标准 Windows API 也不能保证域名/IP 信誉告警消失。
+
+出现同类告警时，保留告警时间、策略名称、域名/IP、程序版本及签名状态，
+由安全管理员向厂商核查命中原因，同时检查服务器是否存在异常活动。
+确认误报后按厂商流程纠正信誉或企业策略。应在策略允许的测试环境中
+验证下载、取消、不完整文件、安全检查失败及安装向导启动流程。
+
+相关 API：
+
+- [WinHttpOpen](https://learn.microsoft.com/windows/win32/api/winhttp/nf-winhttp-winhttpopen)
+- [IAttachmentExecute::Save](https://learn.microsoft.com/windows/win32/api/shobjidl_core/nf-shobjidl_core-iattachmentexecute-save)
+- [IAttachmentExecute::Execute](https://learn.microsoft.com/windows/win32/api/shobjidl_core/nf-shobjidl_core-iattachmentexecute-execute)
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
dijunkun	2c76caa918	[feat] add SignPath release signing and manual Windows tests [skip ci]	2026-09-09 22:57:49 +08:00
dijunkun	211d4de241	[fix] use WinHTTP and Windows security checks for installer updates	2026-09-09 22:07:42 +08:00
dijunkun	c2c74913e3	[feat] add in-app Windows updates with automatic download and setup launch	2026-09-09 18:13:21 +08:00