[docs] improve README structure and signing policy

.dockerignore

@@ -0,0 +1,20 @@
+**
+
+!.dockerignore
+!docker/
+!docker/linux-build/
+!docker/linux-build/**
+
+# Dependency manifests and local xmake package recipes are the only project
+# files needed while pre-warming the build image.
+!xmake.lua
+!xmake/
+!xmake/**
+!thirdparty/
+!thirdparty/**
+!submodules/
+!submodules/xmake.lua
+!submodules/minirtc/
+!submodules/minirtc/xmake.lua
+!submodules/minirtc/thirdparty/
+!submodules/minirtc/thirdparty/**

.github/workflows/build-linux-image.yml

@@ -0,0 +1,157 @@
+name: Build Linux Build Image
+
+on:
+  push:
+    branches:
+      - ci/linux-build-image
+    paths:
+      - .dockerignore
+      - .gitmodules
+      - .github/workflows/build-linux-image.yml
+      - docker/linux-build/**
+      - xmake.lua
+      - xmake/**
+      - thirdparty/**
+      - submodules/xmake.lua
+      - submodules/minirtc
+      - submodules/minirtc/xmake.lua
+      - submodules/minirtc/thirdparty/**
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: linux-build-image-${{ github.ref }}
+  cancel-in-progress: true
+
+env:
+  IMAGE_NAME: crossdesk/ubuntu20.04
+  STACK_TAG: buildenv-cuda12.6.3-gcc10-cmake3.31.6-pipewire0.3.48-xmake3.0.9-rust1.92.0
+  CMAKE_VERSION: 3.31.6
+  XMAKE_VERSION: 3.0.9
+  RUST_VERSION: 1.92.0
+  RUSTUP_VERSION: 1.28.2
+
+jobs:
+  build:
+    name: Build candidate (${{ matrix.arch }})
+    runs-on: ${{ matrix.runner }}
+    timeout-minutes: 180
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - arch: amd64
+            platform: linux/amd64
+            runner: ubuntu-24.04
+            base_image: nvidia/cuda:12.6.3-devel-ubuntu20.04
+          - arch: arm64
+            platform: linux/arm64
+            runner: ubuntu-24.04-arm
+            base_image: ubuntu:20.04
+    steps:
+      - name: Set candidate tag
+        id: image
+        run: |
+          CANDIDATE_TAG="${IMAGE_NAME}:${STACK_TAG}-${GITHUB_SHA}-${{ matrix.arch }}"
+          echo "CANDIDATE_TAG=${CANDIDATE_TAG}" >> "${GITHUB_ENV}"
+          echo "candidate=${CANDIDATE_TAG}" >> "${GITHUB_OUTPUT}"
+
+      - name: Checkout source
+        uses: actions/checkout@v5
+        with:
+          submodules: recursive
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v4
+
+      - name: Log in to Docker Hub
+        uses: docker/login-action@v4
+        with:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+
+      - name: Build and push candidate
+        uses: docker/build-push-action@v7
+        with:
+          context: .
+          file: docker/linux-build/Dockerfile
+          platforms: ${{ matrix.platform }}
+          push: true
+          pull: true
+          tags: ${{ steps.image.outputs.candidate }}
+          cache-from: type=registry,ref=${{ env.IMAGE_NAME }}:${{ env.STACK_TAG }}
+          cache-to: type=inline
+          provenance: false
+          sbom: false
+          build-args: |
+            BASE_IMAGE=${{ matrix.base_image }}
+            CMAKE_VERSION=${{ env.CMAKE_VERSION }}
+            XMAKE_VERSION=${{ env.XMAKE_VERSION }}
+            RUST_VERSION=${{ env.RUST_VERSION }}
+            RUSTUP_VERSION=${{ env.RUSTUP_VERSION }}
+
+  verify:
+    name: Verify candidate (${{ matrix.arch }})
+    needs: build
+    runs-on: ${{ matrix.runner }}
+    timeout-minutes: 30
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - arch: amd64
+            runner: ubuntu-24.04
+          - arch: arm64
+            runner: ubuntu-24.04-arm
+    steps:
+      - name: Set candidate tag
+        run: |
+          CANDIDATE_TAG="${IMAGE_NAME}:${STACK_TAG}-${GITHUB_SHA}-${{ matrix.arch }}"
+          echo "CANDIDATE_TAG=${CANDIDATE_TAG}" >> "${GITHUB_ENV}"
+
+      - name: Log in to Docker Hub
+        uses: docker/login-action@v4
+        with:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+
+      - name: Verify tools, architecture, and Ubuntu baseline
+        run: |
+          docker pull "${CANDIDATE_TAG}"
+          docker run --rm \
+            --env EXPECTED_ARCH="${{ matrix.arch }}" \
+            "${CANDIDATE_TAG}" \
+            verify-crossdesk-build-image
+
+  publish:
+    name: Publish multi-arch image
+    needs: verify
+    runs-on: ubuntu-24.04
+    timeout-minutes: 20
+    steps:
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v4
+
+      - name: Log in to Docker Hub
+        uses: docker/login-action@v4
+        with:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+
+      - name: Promote verified candidates
+        run: |
+          AMD64_IMAGE="${IMAGE_NAME}:${STACK_TAG}-${GITHUB_SHA}-amd64"
+          ARM64_IMAGE="${IMAGE_NAME}:${STACK_TAG}-${GITHUB_SHA}-arm64"
+
+          docker buildx imagetools create \
+            --tag "${IMAGE_NAME}:${STACK_TAG}" \
+            --tag "${IMAGE_NAME}:sha-${GITHUB_SHA}" \
+            --tag "${IMAGE_NAME}:latest" \
+            "${AMD64_IMAGE}" \
+            "${ARM64_IMAGE}"
+
+      - name: Inspect published manifest
+        run: |
+          docker buildx imagetools inspect "${IMAGE_NAME}:${STACK_TAG}"

.github/workflows/build.yml

@@ -4,6 +4,7 @@ on:
   push:
     branches:
       - "**"
+      - "!ci/linux-build-image"
     tags:
       - "*"
   workflow_dispatch:
@@ -12,8 +13,14 @@ on:
         description: "Hotfix patch number, for example 1 or 2. Use 0 for a normal build."
         required: false
         default: "0"
+      sign_windows_test:
+        description: "Submit the Windows installer to SignPath using test-signing."
+        required: false
+        type: boolean
+        default: false
 
 permissions:
+  actions: read
   contents: write
 
 env:
@@ -27,13 +34,13 @@ jobs:
       matrix:
         include:
           - arch: amd64
-            runner: ubuntu-22.04
+            runner: ubuntu-24.04
-            image: crossdesk/ubuntu20.04:latest
+            image: crossdesk/ubuntu20.04:buildenv-cuda12.6.3-gcc10-cmake3.31.6-pipewire0.3.48-xmake3.0.9-rust1.92.0
             package_script: ./scripts/linux/pkg_amd64.sh
 
           - arch: arm64
-            runner: ubuntu-22.04-arm
+            runner: ubuntu-24.04-arm
-            image: crossdesk/ubuntu20.04-arm64v8:latest
+            image: crossdesk/ubuntu20.04:buildenv-cuda12.6.3-gcc10-cmake3.31.6-pipewire0.3.48-xmake3.0.9-rust1.92.0
             package_script: ./scripts/linux/pkg_arm64.sh
 
     container:
@@ -99,13 +106,36 @@ jobs:
         with:
           submodules: recursive
 
+      - name: Verify Linux build image
+        run: verify-crossdesk-build-image
+
+      - name: Ensure Wayland build dependencies
+        shell: bash
+        run: |
+          if pkg-config --exists dbus-1 libdrm && \
+             test -f /opt/crossdesk-pipewire-sdk/include/pipewire-0.3/pipewire/pipewire.h && \
+             test -f /opt/crossdesk-pipewire-sdk/include/spa-0.2/spa/param/video/format-utils.h; then
+            exit 0
+          fi
+
+          apt-get update
+          apt-get install -y --no-install-recommends \
+            libdbus-1-dev \
+            libdrm-dev
+          rm -rf /var/lib/apt/lists/*
+
+          install-crossdesk-pipewire-sdk
+          pkg-config --exists dbus-1 libdrm
+          test -f /opt/crossdesk-pipewire-sdk/include/pipewire-0.3/pipewire/pipewire.h
+          test -f /opt/crossdesk-pipewire-sdk/include/spa-0.2/spa/param/video/format-utils.h
+
       - name: Build CrossDesk
         env:
           CUDA_PATH: /usr/local/cuda
           XMAKE_GLOBALDIR: /data
         run: |
-          apt install -y libxft-dev
+          xmake f --CROSSDESK_VERSION=${LEGAL_VERSION} --USE_CUDA=true --USE_WAYLAND=true \
-          xmake f --CROSSDESK_VERSION=${LEGAL_VERSION} --USE_CUDA=true --root -y
+            --cc=gcc-10 --cxx=g++-10 --root -y
           xmake b -vy --root crossdesk
 
       - name: Package
@@ -113,6 +143,20 @@ jobs:
           chmod +x ${{ matrix.package_script }}
           ${{ matrix.package_script }} ${LEGAL_VERSION}
 
+      - name: Verify Ubuntu 20.04 package dependency resolution
+        run: |
+          PACKAGE_FILE="${GITHUB_WORKSPACE}/crossdesk-linux-${{ matrix.arch }}-${LEGAL_VERSION}.deb"
+          apt-get update
+          apt-get install --simulate "${PACKAGE_FILE}"
+
+      - name: Verify packaged Ubuntu 20.04 glibc baseline
+        run: |
+          PACKAGE_FILE="${GITHUB_WORKSPACE}/crossdesk-linux-${{ matrix.arch }}-${LEGAL_VERSION}.deb"
+          VERIFY_DIR="${RUNNER_TEMP}/crossdesk-glibc-${{ matrix.arch }}"
+          install -d "${VERIFY_DIR}"
+          dpkg-deb --extract "${PACKAGE_FILE}" "${VERIFY_DIR}"
+          verify-crossdesk-glibc-baseline "${VERIFY_DIR}" 2.31
+
       - name: Upload artifact
         uses: actions/upload-artifact@v6
         with:
@@ -123,17 +167,22 @@ jobs:
   build-macos:
     name: Build on macOS
     runs-on: ${{ matrix.runner }}
+    env:
+      MACOSX_DEPLOYMENT_TARGET: "14.0"
+      EXPECTED_MACOS_SDK: "26.5"
     strategy:
       matrix:
         include:
           - arch: x64
-            runner: macos-15-intel
+            binary_arch: x86_64
-            cache-key: intel
+            runner: macos-26-intel
+            cache-key: intel-macos26-xcode26.6-min14
             out-dir: ./build/macosx/x86_64/release/crossdesk
             package_script: ./scripts/macosx/pkg_x64.sh
           - arch: arm64
-            runner: macos-14
+            binary_arch: arm64
-            cache-key: arm
+            runner: macos-26
+            cache-key: arm-macos26-xcode26.6-min14
             out-dir: ./build/macosx/arm64/release/crossdesk
             package_script: ./scripts/macosx/pkg_arm64.sh
 
@@ -178,6 +227,17 @@ jobs:
           echo "BUILD_DATE=${BUILD_DATE}" >> $GITHUB_ENV
           echo "PATCH_NUMBER=${PATCH_NUMBER}" >> $GITHUB_ENV
 
+      - name: Select Xcode 26.6
+        shell: bash
+        run: |
+          sudo xcode-select -s /Applications/Xcode_26.6.app/Contents/Developer
+          xcodebuild -version
+          SDK_VERSION="$(xcrun --sdk macosx --show-sdk-version)"
+          if [[ "${SDK_VERSION}" != "${EXPECTED_MACOS_SDK}" ]]; then
+            echo "Unexpected macOS SDK: expected ${EXPECTED_MACOS_SDK}, got ${SDK_VERSION}" >&2
+            exit 1
+          fi
+
       - name: Cache xmake dependencies
         uses: actions/cache@v5
         with:
@@ -189,6 +249,9 @@ jobs:
       - name: Install xmake
         run: brew install xmake
 
+      - name: Update xmake repositories
+        run: xmake repo -u
+
       - name: Checkout code
         uses: actions/checkout@v5
 
@@ -197,7 +260,7 @@ jobs:
 
       - name: Build CrossDesk
         run: |
-          xmake f --CROSSDESK_VERSION=${VERSION_NUM} --USE_CUDA=true -y
+          xmake f --target_minver=${MACOSX_DEPLOYMENT_TARGET} --CROSSDESK_VERSION=${VERSION_NUM} --USE_CUDA=true -y
           xmake b -vy crossdesk
 
       - name: Package CrossDesk app
@@ -205,6 +268,22 @@ jobs:
           chmod +x ${{ matrix.package_script }}
           ${{ matrix.package_script }} ${VERSION_NUM}
 
+      - name: Verify packaged app
+        shell: bash
+        run: |
+          PACKAGE_FILE="${GITHUB_WORKSPACE}/crossdesk-macos-${{ matrix.arch }}-${VERSION_NUM}.pkg"
+          VERIFY_DIR="$(mktemp -d "${RUNNER_TEMP}/crossdesk-macos-pkg.XXXXXX")"
+          trap 'rm -rf "${VERIFY_DIR}"' EXIT
+
+          pkgutil --expand-full "${PACKAGE_FILE}" "${VERIFY_DIR}/expanded"
+          APP_PATH="$(find "${VERIFY_DIR}/expanded" -type d -name 'CrossDesk.app' -print -quit)"
+          if [[ -z "${APP_PATH}" ]]; then
+            echo "CrossDesk.app is missing from ${PACKAGE_FILE}" >&2
+            exit 1
+          fi
+
+          ./scripts/macosx/verify_app.sh "${APP_PATH}" "${{ matrix.binary_arch }}" "${EXPECTED_MACOS_SDK}"
+
       - name: Upload build artifacts
         uses: actions/upload-artifact@v6
         with:
@@ -275,6 +354,7 @@ jobs:
         run: |
           Invoke-Expression (Invoke-Webrequest 'https://raw.githubusercontent.com/tboox/xmake/master/scripts/get.ps1' -UseBasicParsing).Content
           echo "C:\Users\runneradmin\xmake" | Out-File -FilePath $env:GITHUB_PATH -Encoding utf8 -Append
+          xmake repo -u
           xmake create cuda
           Set-Location cuda
           xmake g --theme=plain
@@ -336,6 +416,52 @@ jobs:
         run: |
           & "${{ github.workspace }}\scripts\windows\pkg_x64.ps1" $env:VERSION_NUM
 
+      - name: Upload unsigned Windows installer for test signing
+        if: github.event_name == 'workflow_dispatch' && inputs.sign_windows_test
+        id: upload-unsigned-windows-installer
+        uses: actions/upload-artifact@v7
+        with:
+          path: ${{ github.workspace }}/scripts/windows/crossdesk-win-x64-${{ env.VERSION_NUM }}.exe
+          archive: false
+          if-no-files-found: error
+          retention-days: 1
+
+      - name: Sign Windows installer with SignPath test certificate
+        if: github.event_name == 'workflow_dispatch' && inputs.sign_windows_test
+        uses: signpath/github-action-submit-signing-request@v2
+        with:
+          api-token: ${{ secrets.SIGNPATH_API_TOKEN }}
+          organization-id: ${{ vars.SIGNPATH_ORGANIZATION_ID }}
+          project-slug: crossdesk
+          signing-policy-slug: test-signing
+          github-artifact-id: ${{ steps.upload-unsigned-windows-installer.outputs.artifact-id }}
+          wait-for-completion: true
+          output-artifact-directory: ${{ github.workspace }}\signpath\signed-installer
+          skip-decompress: true
+          parameters: |
+            version: ${{ toJSON(env.VERSION_NUM) }}
+
+      - name: Verify and use test-signed Windows installer
+        if: github.event_name == 'workflow_dispatch' && inputs.sign_windows_test
+        shell: pwsh
+        run: |
+          $installerName = "crossdesk-win-x64-${{ env.VERSION_NUM }}.exe"
+          $signedInstaller = Join-Path "${{ github.workspace }}\signpath\signed-installer" $installerName
+          $destination = Join-Path "${{ github.workspace }}\scripts\windows" $installerName
+
+          if (!(Test-Path $signedInstaller)) {
+            throw "SignPath did not return the signed installer: $signedInstaller"
+          }
+
+          $signature = Get-AuthenticodeSignature $signedInstaller
+          if (!$signature.SignerCertificate -or $signature.Status -eq "NotSigned") {
+            throw "SignPath returned an installer without an Authenticode signature."
+          }
+
+          Write-Host "Signer: $($signature.SignerCertificate.Subject)"
+          Write-Host "Signature status: $($signature.Status)"
+          Copy-Item $signedInstaller $destination -Force
+
       - name: Build Portable CrossDesk
         run: |
           xmake f --CROSSDESK_VERSION=${{ env.VERSION_NUM }} --USE_CUDA=true --CROSSDESK_PORTABLE=true -y
@@ -389,8 +515,7 @@ jobs:
   release:
     name: Publish Release
     if: startsWith(github.ref, 'refs/tags/v')
-    needs:
+    needs: [build-linux, build-macos, build-windows-x64]
-      [build-linux, build-macos, build-windows-x64]
     runs-on: ubuntu-latest
 
     steps:
@@ -471,6 +596,10 @@ jobs:
           body: |
             Binary release only. Source code is not included.
 
+            ## Code signing policy
+
+            Free code signing provided by [SignPath.io](https://signpath.io/), certificate by [SignPath Foundation](https://signpath.org/).
+
       - name: Create or update 'latest' tag
         run: |
           git config user.name "github-actions[bot]"
@@ -487,6 +616,12 @@ jobs:
           prerelease: false
           files: release/*
           generate_release_notes: false
+          body: |
+            Binary release only. Source code is not included.
+
+            ## Code signing policy
+
+            Free code signing provided by [SignPath.io](https://signpath.io/), certificate by [SignPath Foundation](https://signpath.org/).
 
       - name: Upload artifacts to server
         uses: burnett01/rsync-deployments@5.2

LICENSE

@@ -1,165 +1,674 @@
-                   GNU LESSER GENERAL PUBLIC LICENSE
+                    GNU GENERAL PUBLIC LICENSE
                        Version 3, 29 June 2007
 
- Copyright (C) 2007 Free Software Foundation, Inc. <http://fsf.org/>
+ Copyright (C) 2007 Free Software Foundation, Inc. <https://fsf.org/>
  Everyone is permitted to copy and distribute verbatim copies
  of this license document, but changing it is not allowed.
 
+                            Preamble
 
-  This version of the GNU Lesser General Public License incorporates
+  The GNU General Public License is a free, copyleft license for
-the terms and conditions of version 3 of the GNU General Public
+software and other kinds of works.
-License, supplemented by the additional permissions listed below.
 
-  0. Additional Definitions.
+  The licenses for most software and other practical works are designed
+to take away your freedom to share and change the works.  By contrast,
+the GNU General Public License is intended to guarantee your freedom to
+share and change all versions of a program--to make sure it remains free
+software for all its users.  We, the Free Software Foundation, use the
+GNU General Public License for most of our software; it applies also to
+any other work released this way by its authors.  You can apply it to
+your programs, too.
 
-  As used herein, "this License" refers to version 3 of the GNU Lesser
+  When we speak of free software, we are referring to freedom, not
-General Public License, and the "GNU GPL" refers to version 3 of the GNU
+price.  Our General Public Licenses are designed to make sure that you
-General Public License.
+have the freedom to distribute copies of free software (and charge for
+them if you wish), that you receive source code or can get it if you
+want it, that you can change the software or use pieces of it in new
+free programs, and that you know you can do these things.
 
-  "The Library" refers to a covered work governed by this License,
+  To protect your rights, we need to prevent others from denying you
-other than an Application or a Combined Work as defined below.
+these rights or asking you to surrender the rights.  Therefore, you have
+certain responsibilities if you distribute copies of the software, or if
+you modify it: responsibilities to respect the freedom of others.
 
-  An "Application" is any work that makes use of an interface provided
+  For example, if you distribute copies of such a program, whether
-by the Library, but which is not otherwise based on the Library.
+gratis or for a fee, you must pass on to the recipients the same
-Defining a subclass of a class defined by the Library is deemed a mode
+freedoms that you received.  You must make sure that they, too, receive
-of using an interface provided by the Library.
+or can get the source code.  And you must show them these terms so they
+know their rights.
 
-  A "Combined Work" is a work produced by combining or linking an
+  Developers that use the GNU GPL protect your rights with two steps:
-Application with the Library.  The particular version of the Library
+(1) assert copyright on the software, and (2) offer you this License
-with which the Combined Work was made is also called the "Linked
+giving you legal permission to copy, distribute and/or modify it.
-Version".
 
-  The "Minimal Corresponding Source" for a Combined Work means the
+  For the developers' and authors' protection, the GPL clearly explains
-Corresponding Source for the Combined Work, excluding any source code
+that there is no warranty for this free software.  For both users' and
-for portions of the Combined Work that, considered in isolation, are
+authors' sake, the GPL requires that modified versions be marked as
-based on the Application, and not on the Linked Version.
+changed, so that their problems will not be attributed erroneously to
+authors of previous versions.
 
-  The "Corresponding Application Code" for a Combined Work means the
+  Some devices are designed to deny users access to install or run
-object code and/or source code for the Application, including any data
+modified versions of the software inside them, although the manufacturer
-and utility programs needed for reproducing the Combined Work from the
+can do so.  This is fundamentally incompatible with the aim of
-Application, but excluding the System Libraries of the Combined Work.
+protecting users' freedom to change the software.  The systematic
+pattern of such abuse occurs in the area of products for individuals to
+use, which is precisely where it is most unacceptable.  Therefore, we
+have designed this version of the GPL to prohibit the practice for those
+products.  If such problems arise substantially in other domains, we
+stand ready to extend this provision to those domains in future versions
+of the GPL, as needed to protect the freedom of users.
 
-  1. Exception to Section 3 of the GNU GPL.
+  Finally, every program is threatened constantly by software patents.
+States should not allow patents to restrict development and use of
+software on general-purpose computers, but in those that do, we wish to
+avoid the special danger that patents applied to a free program could
+make it effectively proprietary.  To prevent this, the GPL assures that
+patents cannot be used to render the program non-free.
 
-  You may convey a covered work under sections 3 and 4 of this License
+  The precise terms and conditions for copying, distribution and
-without being bound by section 3 of the GNU GPL.
+modification follow.
 
-  2. Conveying Modified Versions.
+                       TERMS AND CONDITIONS
 
-  If you modify a copy of the Library, and, in your modifications, a
+  0. Definitions.
-facility refers to a function or data to be supplied by an Application
-that uses the facility (other than as an argument passed when the
-facility is invoked), then you may convey a copy of the modified
-version:
 
-   a) under this License, provided that you make a good faith effort to
+  "This License" refers to version 3 of the GNU General Public License.
-   ensure that, in the event an Application does not supply the
-   function or data, the facility still operates, and performs
-   whatever part of its purpose remains meaningful, or
 
-   b) under the GNU GPL, with none of the additional permissions of
+  "Copyright" also means copyright-like laws that apply to other kinds of
-   this License applicable to that copy.
+works, such as semiconductor masks.
 
-  3. Object Code Incorporating Material from Library Header Files.
+  "The Program" refers to any copyrightable work licensed under this
+License.  Each licensee is addressed as "you".  "Licensees" and
+"recipients" may be individuals or organizations.
 
-  The object code form of an Application may incorporate material from
+  To "modify" a work means to copy from or adapt all or part of the work
-a header file that is part of the Library.  You may convey such object
+in a fashion requiring copyright permission, other than the making of an
-code under terms of your choice, provided that, if the incorporated
+exact copy.  The resulting work is called a "modified version" of the
-material is not limited to numerical parameters, data structure
+earlier work or a work "based on" the earlier work.
-layouts and accessors, or small macros, inline functions and templates
-(ten or fewer lines in length), you do both of the following:
 
-   a) Give prominent notice with each copy of the object code that the
+  A "covered work" means either the unmodified Program or a work based
-   Library is used in it and that the Library and its use are
+on the Program.
-   covered by this License.
 
-   b) Accompany the object code with a copy of the GNU GPL and this license
+  To "propagate" a work means to do anything with it that, without
-   document.
+permission, would make you directly or secondarily liable for
+infringement under applicable copyright law, except executing it on a
+computer or modifying a private copy.  Propagation includes copying,
+distribution (with or without modification), making available to the
+public, and in some countries other activities as well.
 
-  4. Combined Works.
+  To "convey" a work means any kind of propagation that enables other
+parties to make or receive copies.  Mere interaction with a user through
+a computer network, with no transfer of a copy, is not conveying.
 
-  You may convey a Combined Work under terms of your choice that,
+  An interactive user interface displays "Appropriate Legal Notices"
-taken together, effectively do not restrict modification of the
+to the extent that it includes a convenient and prominently visible
-portions of the Library contained in the Combined Work and reverse
+feature that (1) displays an appropriate copyright notice, and (2)
-engineering for debugging such modifications, if you also do each of
+tells the user that there is no warranty for the work (except to the
-the following:
+extent that warranties are provided), that licensees may convey the
+work under this License, and how to view a copy of this License.  If
+the interface presents a list of user commands or options, such as a
+menu, a prominent item in the list meets this criterion.
 
-   a) Give prominent notice with each copy of the Combined Work that
+  1. Source Code.
-   the Library is used in it and that the Library and its use are
-   covered by this License.
 
-   b) Accompany the Combined Work with a copy of the GNU GPL and this license
+  The "source code" for a work means the preferred form of the work
-   document.
+for making modifications to it.  "Object code" means any non-source
+form of a work.
 
-   c) For a Combined Work that displays copyright notices during
+  A "Standard Interface" means an interface that either is an official
-   execution, include the copyright notice for the Library among
+standard defined by a recognized standards body, or, in the case of
-   these notices, as well as a reference directing the user to the
+interfaces specified for a particular programming language, one that
-   copies of the GNU GPL and this license document.
+is widely used among developers working in that language.
 
-   d) Do one of the following:
+  The "System Libraries" of an executable work include anything, other
+than the work as a whole, that (a) is included in the normal form of
+packaging a Major Component, but which is not part of that Major
+Component, and (b) serves only to enable use of the work with that
+Major Component, or to implement a Standard Interface for which an
+implementation is available to the public in source code form.  A
+"Major Component", in this context, means a major essential component
+(kernel, window system, and so on) of the specific operating system
+(if any) on which the executable work runs, or a compiler used to
+produce the work, or an object code interpreter used to run it.
 
-       0) Convey the Minimal Corresponding Source under the terms of this
+  The "Corresponding Source" for a work in object code form means all
-       License, and the Corresponding Application Code in a form
+the source code needed to generate, install, and (for an executable
-       suitable for, and under terms that permit, the user to
+work) run the object code and to modify the work, including scripts to
-       recombine or relink the Application with a modified version of
+control those activities.  However, it does not include the work's
-       the Linked Version to produce a modified Combined Work, in the
+System Libraries, or general-purpose tools or generally available free
-       manner specified by section 6 of the GNU GPL for conveying
+programs which are used unmodified in performing those activities but
-       Corresponding Source.
+which are not part of the work.  For example, Corresponding Source
+includes interface definition files associated with source files for
+the work, and the source code for shared libraries and dynamically
+linked subprograms that the work is specifically designed to require,
+such as by intimate data communication or control flow between those
+subprograms and other parts of the work.
 
-       1) Use a suitable shared library mechanism for linking with the
+  The Corresponding Source need not include anything that users
-       Library.  A suitable mechanism is one that (a) uses at run time
+can regenerate automatically from other parts of the Corresponding
-       a copy of the Library already present on the user's computer
+Source.
-       system, and (b) will operate properly with a modified version
-       of the Library that is interface-compatible with the Linked
-       Version.
 
-   e) Provide Installation Information, but only if you would otherwise
+  The Corresponding Source for a work in source code form is that
-   be required to provide such information under section 6 of the
+same work.
-   GNU GPL, and only to the extent that such information is
-   necessary to install and execute a modified version of the
-   Combined Work produced by recombining or relinking the
-   Application with a modified version of the Linked Version. (If
-   you use option 4d0, the Installation Information must accompany
-   the Minimal Corresponding Source and Corresponding Application
-   Code. If you use option 4d1, you must provide the Installation
-   Information in the manner specified by section 6 of the GNU GPL
-   for conveying Corresponding Source.)
 
-  5. Combined Libraries.
+  2. Basic Permissions.
 
-  You may place library facilities that are a work based on the
+  All rights granted under this License are granted for the term of
-Library side by side in a single library together with other library
+copyright on the Program, and are irrevocable provided the stated
-facilities that are not Applications and are not covered by this
+conditions are met.  This License explicitly affirms your unlimited
-License, and convey such a combined library under terms of your
+permission to run the unmodified Program.  The output from running a
-choice, if you do both of the following:
+covered work is covered by this License only if the output, given its
+content, constitutes a covered work.  This License acknowledges your
+rights of fair use or other equivalent, as provided by copyright law.
 
-   a) Accompany the combined library with a copy of the same work based
+  You may make, run and propagate covered works that you do not
-   on the Library, uncombined with any other library facilities,
+convey, without conditions so long as your license otherwise remains
-   conveyed under the terms of this License.
+in force.  You may convey covered works to others for the sole purpose
+of having them make modifications exclusively for you, or provide you
+with facilities for running those works, provided that you comply with
+the terms of this License in conveying all material for which you do
+not control copyright.  Those thus making or running the covered works
+for you must do so exclusively on your behalf, under your direction
+and control, on terms that prohibit them from making any copies of
+your copyrighted material outside their relationship with you.
 
-   b) Give prominent notice with the combined library that part of it
+  Conveying under any other circumstances is permitted solely under
-   is a work based on the Library, and explaining where to find the
+the conditions stated below.  Sublicensing is not allowed; section 10
-   accompanying uncombined form of the same work.
+makes it unnecessary.
 
-  6. Revised Versions of the GNU Lesser General Public License.
+  3. Protecting Users' Legal Rights From Anti-Circumvention Law.
 
-  The Free Software Foundation may publish revised and/or new versions
+  No covered work shall be deemed part of an effective technological
-of the GNU Lesser General Public License from time to time. Such new
+measure under any applicable law fulfilling obligations under article
-versions will be similar in spirit to the present version, but may
+11 of the WIPO copyright treaty adopted on 20 December 1996, or
-differ in detail to address new problems or concerns.
+similar laws prohibiting or restricting circumvention of such
+measures.
+
+  When you convey a covered work, you waive any legal power to forbid
+circumvention of technological measures to the extent such circumvention
+is effected by exercising rights under this License with respect to
+the covered work, and you disclaim any intention to limit operation or
+modification of the work as a means of enforcing, against the work's
+users, your or third parties' legal rights to forbid circumvention of
+technological measures.
+
+  4. Conveying Verbatim Copies.
+
+  You may convey verbatim copies of the Program's source code as you
+receive it, in any medium, provided that you conspicuously and
+appropriately publish on each copy an appropriate copyright notice;
+keep intact all notices stating that this License and any
+non-permissive terms added in accord with section 7 apply to the code;
+keep intact all notices of the absence of any warranty; and give all
+recipients a copy of this License along with the Program.
+
+  You may charge any price or no price for each copy that you convey,
+and you may offer support or warranty protection for a fee.
+
+  5. Conveying Modified Source Versions.
+
+  You may convey a work based on the Program, or the modifications to
+produce it from the Program, in the form of source code under the
+terms of section 4, provided that you also meet all of these conditions:
+
+    a) The work must carry prominent notices stating that you modified
+    it, and giving a relevant date.
+
+    b) The work must carry prominent notices stating that it is
+    released under this License and any conditions added under section
+    7.  This requirement modifies the requirement in section 4 to
+    "keep intact all notices".
+
+    c) You must license the entire work, as a whole, under this
+    License to anyone who comes into possession of a copy.  This
+    License will therefore apply, along with any applicable section 7
+    additional terms, to the whole of the work, and all its parts,
+    regardless of how they are packaged.  This License gives no
+    permission to license the work in any other way, but it does not
+    invalidate such permission if you have separately received it.
+
+    d) If the work has interactive user interfaces, each must display
+    Appropriate Legal Notices; however, if the Program has interactive
+    interfaces that do not display Appropriate Legal Notices, your
+    work need not make them do so.
+
+  A compilation of a covered work with other separate and independent
+works, which are not by their nature extensions of the covered work,
+and which are not combined with it such as to form a larger program,
+in or on a volume of a storage or distribution medium, is called an
+"aggregate" if the compilation and its resulting copyright are not
+used to limit the access or legal rights of the compilation's users
+beyond what the individual works permit.  Inclusion of a covered work
+in an aggregate does not cause this License to apply to the other
+parts of the aggregate.
+
+  6. Conveying Non-Source Forms.
+
+  You may convey a covered work in object code form under the terms
+of sections 4 and 5, provided that you also convey the
+machine-readable Corresponding Source under the terms of this License,
+in one of these ways:
+
+    a) Convey the object code in, or embodied in, a physical product
+    (including a physical distribution medium), accompanied by the
+    Corresponding Source fixed on a durable physical medium
+    customarily used for software interchange.
+
+    b) Convey the object code in, or embodied in, a physical product
+    (including a physical distribution medium), accompanied by a
+    written offer, valid for at least three years and valid for as
+    long as you offer spare parts or customer support for that product
+    model, to give anyone who possesses the object code either (1) a
+    copy of the Corresponding Source for all the software in the
+    product that is covered by this License, on a durable physical
+    medium customarily used for software interchange, for a price no
+    more than your reasonable cost of physically performing this
+    conveying of source, or (2) access to copy the
+    Corresponding Source from a network server at no charge.
+
+    c) Convey individual copies of the object code with a copy of the
+    written offer to provide the Corresponding Source.  This
+    alternative is allowed only occasionally and noncommercially, and
+    only if you received the object code with such an offer, in accord
+    with subsection 6b.
+
+    d) Convey the object code by offering access from a designated
+    place (gratis or for a charge), and offer equivalent access to the
+    Corresponding Source in the same way through the same place at no
+    further charge.  You need not require recipients to copy the
+    Corresponding Source along with the object code.  If the place to
+    copy the object code is a network server, the Corresponding Source
+    may be on a different server (operated by you or a third party)
+    that supports equivalent copying facilities, provided you maintain
+    clear directions next to the object code saying where to find the
+    Corresponding Source.  Regardless of what server hosts the
+    Corresponding Source, you remain obligated to ensure that it is
+    available for as long as needed to satisfy these requirements.
+
+    e) Convey the object code using peer-to-peer transmission, provided
+    you inform other peers where the object code and Corresponding
+    Source of the work are being offered to the general public at no
+    charge under subsection 6d.
+
+  A separable portion of the object code, whose source code is excluded
+from the Corresponding Source as a System Library, need not be
+included in conveying the object code work.
+
+  A "User Product" is either (1) a "consumer product", which means any
+tangible personal property which is normally used for personal, family,
+or household purposes, or (2) anything designed or sold for incorporation
+into a dwelling.  In determining whether a product is a consumer product,
+doubtful cases shall be resolved in favor of coverage.  For a particular
+product received by a particular user, "normally used" refers to a
+typical or common use of that class of product, regardless of the status
+of the particular user or of the way in which the particular user
+actually uses, or expects or is expected to use, the product.  A product
+is a consumer product regardless of whether the product has substantial
+commercial, industrial or non-consumer uses, unless such uses represent
+the only significant mode of use of the product.
+
+  "Installation Information" for a User Product means any methods,
+procedures, authorization keys, or other information required to install
+and execute modified versions of a covered work in that User Product from
+a modified version of its Corresponding Source.  The information must
+suffice to ensure that the continued functioning of the modified object
+code is in no case prevented or interfered with solely because
+modification has been made.
+
+  If you convey an object code work under this section in, or with, or
+specifically for use in, a User Product, and the conveying occurs as
+part of a transaction in which the right of possession and use of the
+User Product is transferred to the recipient in perpetuity or for a
+fixed term (regardless of how the transaction is characterized), the
+Corresponding Source conveyed under this section must be accompanied
+by the Installation Information.  But this requirement does not apply
+if neither you nor any third party retains the ability to install
+modified object code on the User Product (for example, the work has
+been installed in ROM).
+
+  The requirement to provide Installation Information does not include a
+requirement to continue to provide support service, warranty, or updates
+for a work that has been modified or installed by the recipient, or for
+the User Product in which it has been modified or installed.  Access to a
+network may be denied when the modification itself materially and
+adversely affects the operation of the network or violates the rules and
+protocols for communication across the network.
+
+  Corresponding Source conveyed, and Installation Information provided,
+in accord with this section must be in a format that is publicly
+documented (and with an implementation available to the public in
+source code form), and must require no special password or key for
+unpacking, reading or copying.
+
+  7. Additional Terms.
+
+  "Additional permissions" are terms that supplement the terms of this
+License by making exceptions from one or more of its conditions.
+Additional permissions that are applicable to the entire Program shall
+be treated as though they were included in this License, to the extent
+that they are valid under applicable law.  If additional permissions
+apply only to part of the Program, that part may be used separately
+under those permissions, but the entire Program remains governed by
+this License without regard to the additional permissions.
+
+  When you convey a copy of a covered work, you may at your option
+remove any additional permissions from that copy, or from any part of
+it.  (Additional permissions may be written to require their own
+removal in certain cases when you modify the work.)  You may place
+additional permissions on material, added by you to a covered work,
+for which you have or can give appropriate copyright permission.
+
+  Notwithstanding any other provision of this License, for material you
+add to a covered work, you may (if authorized by the copyright holders of
+that material) supplement the terms of this License with terms:
+
+    a) Disclaiming warranty or limiting liability differently from the
+    terms of sections 15 and 16 of this License; or
+
+    b) Requiring preservation of specified reasonable legal notices or
+    author attributions in that material or in the Appropriate Legal
+    Notices displayed by works containing it; or
+
+    c) Prohibiting misrepresentation of the origin of that material, or
+    requiring that modified versions of such material be marked in
+    reasonable ways as different from the original version; or
+
+    d) Limiting the use for publicity purposes of names of licensors or
+    authors of the material; or
+
+    e) Declining to grant rights under trademark law for use of some
+    trade names, trademarks, or service marks; or
+
+    f) Requiring indemnification of licensors and authors of that
+    material by anyone who conveys the material (or modified versions of
+    it) with contractual assumptions of liability to the recipient, for
+    any liability that these contractual assumptions directly impose on
+    those licensors and authors.
+
+  All other non-permissive additional terms are considered "further
+restrictions" within the meaning of section 10.  If the Program as you
+received it, or any part of it, contains a notice stating that it is
+governed by this License along with a term that is a further
+restriction, you may remove that term.  If a license document contains
+a further restriction but permits relicensing or conveying under this
+License, you may add to a covered work material governed by the terms
+of that license document, provided that the further restriction does
+not survive such relicensing or conveying.
+
+  If you add terms to a covered work in accord with this section, you
+must place, in the relevant source files, a statement of the
+additional terms that apply to those files, or a notice indicating
+where to find the applicable terms.
+
+  Additional terms, permissive or non-permissive, may be stated in the
+form of a separately written license, or stated as exceptions;
+the above requirements apply either way.
+
+  8. Termination.
+
+  You may not propagate or modify a covered work except as expressly
+provided under this License.  Any attempt otherwise to propagate or
+modify it is void, and will automatically terminate your rights under
+this License (including any patent licenses granted under the third
+paragraph of section 11).
+
+  However, if you cease all violation of this License, then your
+license from a particular copyright holder is reinstated (a)
+provisionally, unless and until the copyright holder explicitly and
+finally terminates your license, and (b) permanently, if the copyright
+holder fails to notify you of the violation by some reasonable means
+prior to 60 days after the cessation.
+
+  Moreover, your license from a particular copyright holder is
+reinstated permanently if the copyright holder notifies you of the
+violation by some reasonable means, this is the first time you have
+received notice of violation of this License (for any work) from that
+copyright holder, and you cure the violation prior to 30 days after
+your receipt of the notice.
+
+  Termination of your rights under this section does not terminate the
+licenses of parties who have received copies or rights from you under
+this License.  If your rights have been terminated and not permanently
+reinstated, you do not qualify to receive new licenses for the same
+material under section 10.
+
+  9. Acceptance Not Required for Having Copies.
+
+  You are not required to accept this License in order to receive or
+run a copy of the Program.  Ancillary propagation of a covered work
+occurring solely as a consequence of using peer-to-peer transmission
+to receive a copy likewise does not require acceptance.  However,
+nothing other than this License grants you permission to propagate or
+modify any covered work.  These actions infringe copyright if you do
+not accept this License.  Therefore, by modifying or propagating a
+covered work, you indicate your acceptance of this License to do so.
+
+  10. Automatic Licensing of Downstream Recipients.
+
+  Each time you convey a covered work, the recipient automatically
+receives a license from the original licensors, to run, modify and
+propagate that work, subject to this License.  You are not responsible
+for enforcing compliance by third parties with this License.
+
+  An "entity transaction" is a transaction transferring control of an
+organization, or substantially all assets of one, or subdividing an
+organization, or merging organizations.  If propagation of a covered
+work results from an entity transaction, each party to that
+transaction who receives a copy of the work also receives whatever
+licenses to the work the party's predecessor in interest had or could
+give under the previous paragraph, plus a right to possession of the
+Corresponding Source of the work from the predecessor in interest, if
+the predecessor has it or can get it with reasonable efforts.
+
+  You may not impose any further restrictions on the exercise of the
+rights granted or affirmed under this License.  For example, you may
+not impose a license fee, royalty, or other charge for exercise of
+rights granted under this License, and you may not initiate litigation
+(including a cross-claim or counterclaim in a lawsuit) alleging that
+any patent claim is infringed by making, using, selling, offering for
+sale, or importing the Program or any portion of it.
+
+  11. Patents.
+
+  A "contributor" is a copyright holder who authorizes use under this
+License of the Program or a work on which the Program is based.  The
+work thus licensed is called the contributor's "contributor version".
+
+  A contributor's "essential patent claims" are all patent claims
+owned or controlled by the contributor, whether already acquired or
+hereafter acquired, that would be infringed by some manner, permitted
+by this License, of making, using, or selling its contributor version,
+but do not include claims that would be infringed only as a
+consequence of further modification of the contributor version.  For
+purposes of this definition, "control" includes the right to grant
+patent sublicenses in a manner consistent with the requirements of
+this License.
+
+  Each contributor grants you a non-exclusive, worldwide, royalty-free
+patent license under the contributor's essential patent claims, to
+make, use, sell, offer for sale, import and otherwise run, modify and
+propagate the contents of its contributor version.
+
+  In the following three paragraphs, a "patent license" is any express
+agreement or commitment, however denominated, not to enforce a patent
+(such as an express permission to practice a patent or covenant not to
+sue for patent infringement).  To "grant" such a patent license to a
+party means to make such an agreement or commitment not to enforce a
+patent against the party.
+
+  If you convey a covered work, knowingly relying on a patent license,
+and the Corresponding Source of the work is not available for anyone
+to copy, free of charge and under the terms of this License, through a
+publicly available network server or other readily accessible means,
+then you must either (1) cause the Corresponding Source to be so
+available, or (2) arrange to deprive yourself of the benefit of the
+patent license for this particular work, or (3) arrange, in a manner
+consistent with the requirements of this License, to extend the patent
+license to downstream recipients.  "Knowingly relying" means you have
+actual knowledge that, but for the patent license, your conveying the
+covered work in a country, or your recipient's use of the covered work
+in a country, would infringe one or more identifiable patents in that
+country that you have reason to believe are valid.
+
+  If, pursuant to or in connection with a single transaction or
+arrangement, you convey, or propagate by procuring conveyance of, a
+covered work, and grant a patent license to some of the parties
+receiving the covered work authorizing them to use, propagate, modify
+or convey a specific copy of the covered work, then the patent license
+you grant is automatically extended to all recipients of the covered
+work and works based on it.
+
+  A patent license is "discriminatory" if it does not include within
+the scope of its coverage, prohibits the exercise of, or is
+conditioned on the non-exercise of one or more of the rights that are
+specifically granted under this License.  You may not convey a covered
+work if you are a party to an arrangement with a third party that is
+in the business of distributing software, under which you make payment
+to the third party based on the extent of your activity of conveying
+the work, and under which the third party grants, to any of the
+parties who would receive the covered work from you, a discriminatory
+patent license (a) in connection with copies of the covered work
+conveyed by you (or copies made from those copies), or (b) primarily
+for and in connection with specific products or compilations that
+contain the covered work, unless you entered into that arrangement,
+or that patent license was granted, prior to 28 March 2007.
+
+  Nothing in this License shall be construed as excluding or limiting
+any implied license or other defenses to infringement that may
+otherwise be available to you under applicable patent law.
+
+  12. No Surrender of Others' Freedom.
+
+  If conditions are imposed on you (whether by court order, agreement or
+otherwise) that contradict the conditions of this License, they do not
+excuse you from the conditions of this License.  If you cannot convey a
+covered work so as to satisfy simultaneously your obligations under this
+License and any other pertinent obligations, then as a consequence you may
+not convey it at all.  For example, if you agree to terms that obligate you
+to collect a royalty for further conveying from those to whom you convey
+the Program, the only way you could satisfy both those terms and this
+License would be to refrain entirely from conveying the Program.
+
+  13. Use with the GNU Affero General Public License.
+
+  Notwithstanding any other provision of this License, you have
+permission to link or combine any covered work with a work licensed
+under version 3 of the GNU Affero General Public License into a single
+combined work, and to convey the resulting work.  The terms of this
+License will continue to apply to the part which is the covered work,
+but the special requirements of the GNU Affero General Public License,
+section 13, concerning interaction through a network will apply to the
+combination as such.
+
+  14. Revised Versions of this License.
+
+  The Free Software Foundation may publish revised and/or new versions of
+the GNU General Public License from time to time.  Such new versions will
+be similar in spirit to the present version, but may differ in detail to
+address new problems or concerns.
 
   Each version is given a distinguishing version number.  If the
-Library as you received it specifies that a certain numbered version
+Program specifies that a certain numbered version of the GNU General
-of the GNU Lesser General Public License "or any later version"
+Public License "or any later version" applies to it, you have the
-applies to it, you have the option of following the terms and
+option of following the terms and conditions either of that numbered
-conditions either of that published version or of any later version
+version or of any later version published by the Free Software
-published by the Free Software Foundation. If the Library as you
+Foundation.  If the Program does not specify a version number of the
-received it does not specify a version number of the GNU Lesser
+GNU General Public License, you may choose any version ever published
-General Public License, you may choose any version of the GNU Lesser
+by the Free Software Foundation.
-General Public License ever published by the Free Software Foundation.
 
-  If the Library as you received it specifies that a proxy can decide
+  If the Program specifies that a proxy can decide which future
-whether future versions of the GNU Lesser General Public License shall
+versions of the GNU General Public License can be used, that proxy's
-apply, that proxy's public statement of acceptance of any version is
+public statement of acceptance of a version permanently authorizes you
-permanent authorization for you to choose that version for the
+to choose that version for the Program.
-Library.
+
+  Later license versions may give you additional or different
+permissions.  However, no additional obligations are imposed on any
+author or copyright holder as a result of your choosing to follow a
+later version.
+
+  15. Disclaimer of Warranty.
+
+  THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY
+APPLICABLE LAW.  EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT
+HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY
+OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO,
+THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+PURPOSE.  THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM
+IS WITH YOU.  SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF
+ALL NECESSARY SERVICING, REPAIR OR CORRECTION.
+
+  16. Limitation of Liability.
+
+  IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
+WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR CONVEYS
+THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY
+GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE
+USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF
+DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD
+PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS),
+EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF
+SUCH DAMAGES.
+
+  17. Interpretation of Sections 15 and 16.
+
+  If the disclaimer of warranty and limitation of liability provided
+above cannot be given local legal effect according to their terms,
+reviewing courts shall apply local law that most closely approximates
+an absolute waiver of all civil liability in connection with the
+Program, unless a warranty or assumption of liability accompanies a
+copy of the Program in return for a fee.
+
+                     END OF TERMS AND CONDITIONS
+
+            How to Apply These Terms to Your New Programs
+
+  If you develop a new program, and you want it to be of the greatest
+possible use to the public, the best way to achieve this is to make it
+free software which everyone can redistribute and change under these terms.
+
+  To do so, attach the following notices to the program.  It is safest
+to attach them to the start of each source file to most effectively
+state the exclusion of warranty; and each file should have at least
+the "copyright" line and a pointer to where the full notice is found.
+
+    <one line to give the program's name and a brief idea of what it does.>
+    Copyright (C) <year>  <name of author>
+
+    This program is free software: you can redistribute it and/or modify
+    it under the terms of the GNU General Public License as published by
+    the Free Software Foundation, either version 3 of the License, or
+    (at your option) any later version.
+
+    This program is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+    GNU General Public License for more details.
+
+    You should have received a copy of the GNU General Public License
+    along with this program.  If not, see <https://www.gnu.org/licenses/>.
+
+Also add information on how to contact you by electronic and paper mail.
+
+  If the program does terminal interaction, make it output a short
+notice like this when it starts in an interactive mode:
+
+    <program>  Copyright (C) <year>  <name of author>
+    This program comes with ABSOLUTELY NO WARRANTY; for details type `show w'.
+    This is free software, and you are welcome to redistribute it
+    under certain conditions; type `show c' for details.
+
+The hypothetical commands `show w' and `show c' should show the appropriate
+parts of the General Public License.  Of course, your program's commands
+might be different; for a GUI interface, you would use an "about box".
+
+  You should also get your employer (if you work as a programmer) or school,
+if any, to sign a "copyright disclaimer" for the program, if necessary.
+For more information on this, and how to apply and follow the GNU GPL, see
+<https://www.gnu.org/licenses/>.
+
+  The GNU General Public License does not permit incorporating your program
+into proprietary programs.  If your program is a subroutine library, you
+may consider it more useful to permit linking proprietary applications with
+the library.  If this is what you want to do, use the GNU Lesser General
+Public License instead of this License.  But first, please read
+<https://www.gnu.org/licenses/why-not-lgpl.html>.

README.md

@@ -1,38 +1,51 @@
 # CrossDesk
 
 <a href="https://hellogithub.com/repository/kunkundi/crossdesk" target="_blank"><img src="https://api.hellogithub.com/v1/widgets/recommend.svg?rid=55d41367570345f1838e02fd12be7961&claim_uid=cb0OpZRrBuGVAfL&theme=small" alt="Featured｜HelloGitHub" /></a>
-[![Platform](https://img.shields.io/badge/platform-Windows%20%7C%20Linux%20%7C%20macOS-brightgreen.svg)]()
+
-[![License: LGPL v3](https://img.shields.io/badge/License-LGPL%20v3-blue.svg)](https://www.gnu.org/licenses/lgpl-3.0)
+[![Platform](https://img.shields.io/badge/platform-Windows%20%7C%20Linux%20%7C%20macOS-brightgreen.svg)](https://www.crossdesk.cn/)
+[![License: GPL v3](https://img.shields.io/badge/License-GPL%20v3-blue.svg)](https://www.gnu.org/licenses/gpl-3.0)
 [![GitHub last commit](https://img.shields.io/github/last-commit/kunkundi/crossdesk)](https://github.com/kunkundi/crossdesk/commits/web-client)
 [![Build Status](https://github.com/kunkundi/crossdesk/actions/workflows/build.yml/badge.svg)](https://github.com/kunkundi/crossdesk/actions)  
 [![Docker Pulls](https://img.shields.io/docker/pulls/crossdesk/crossdesk-server)](https://hub.docker.com/r/crossdesk/crossdesk-server/tags)
-[![GitHub issues](https://img.shields.io/github/issues/kunkundi/crossdesk.svg)]()
+[![GitHub issues](https://img.shields.io/github/issues/kunkundi/crossdesk.svg)](https://github.com/kunkundi/crossdesk/issues)
-[![GitHub stars](https://img.shields.io/github/stars/kunkundi/crossdesk.svg?style=social)]()
+[![GitHub stars](https://img.shields.io/github/stars/kunkundi/crossdesk.svg?style=social)](https://github.com/kunkundi/crossdesk/stargazers)
-[![GitHub forks](https://img.shields.io/github/forks/kunkundi/crossdesk.svg?style=social)]()
+[![GitHub forks](https://img.shields.io/github/forks/kunkundi/crossdesk.svg?style=social)](https://github.com/kunkundi/crossdesk/forks)
 
 [ [English](README_EN.md) / 中文 ]
 
-PC 客户端
+---
+
+## 界面预览
+
+### PC 客户端
+
 ![sup_example](https://github.com/user-attachments/assets/eeb64fbe-1f07-4626-be1c-b77396beb905)
 
-Web 客户端
+### Web 客户端
+
 <p align="center">
   <img width="850" height="550" alt="6bddcbed47ffd4b9988a4037c7f4f524" src="https://github.com/user-attachments/assets/e44f73f9-24ac-46a3-a189-b7f8b6669881" />
 </p>
 
+---
+
 ## 简介
 
 CrossDesk 是一个轻量级的跨平台远程桌面软件，支持 Web 端控制远程设备。
 
 CrossDesk 是 [MiniRTC](https://github.com/kunkundi/minirtc.git) 实时音视频传输库的实验性应用。MiniRTC 是一个轻量级的跨平台实时音视频传输库。它具有网络透传（[RFC5245](https://datatracker.ietf.org/doc/html/rfc5245)），视频软硬编解码（H264/AV1），音频编解码（[Opus](https://github.com/xiph/opus)），信令交互，网络拥塞控制，传输加密（[SRTP](https://tools.ietf.org/html/rfc3711)）等基础能力。
 
+---
+
 ## 系统要求
 
 | 平台 | 最低版本 |
-|----------------|---------------------------|
+| --- | --- |
 | **Windows** | Windows 10 及以上 (64 位) |
 | **macOS** | macOS Intel 15.0 及以上 ( 大于 14.0 小于 15.0 的版本可自行编译实现兼容 )<br> macOS Apple Silicon 14.0 及以上 |
-| **Linux** | Ubuntu 22.04 及以上 ( 低版本可自行编译实现兼容 ) |
+| **Linux** | Ubuntu 20.04 及以上 |
+
+---
 
 ## 使用
 
@@ -47,14 +60,17 @@ CrossDesk 是 [MiniRTC](https://github.com/kunkundi/minirtc.git) 实时音视频
 发起连接前，可在设置中自定义配置项，如语言、视频编码格式等。
 ![settings](https://github.com/user-attachments/assets/8bc5468d-7bbb-4e30-95bd-da1f352ac08c)
 
-### Web 客户端
+### 使用 Web 客户端
+
 浏览器访问 [CrossDesk Web Client](https://web.crossdesk.cn/)。
 输入 **远程设备 ID** 与 **密码**，点击连接即可接入远程设备。如图，**iOS Safari 远程控制 Win11**：
 
 <img width="645" height="300" alt="_cgi-bin_mmwebwx-bin_webwxgetmsgimg__ MsgID=932911462648581698 skey=@crypt_1f5153b1_b550ca7462b5009ce03c991cca2a92a7 mmweb_appid=wx_webfilehelper" src="https://github.com/user-attachments/assets/a5109e6f-752c-4654-9f4e-7e161bddf43e" />
 
 ### Windows 服务（CrossDesk Service）
+
 CrossDesk 在 Windows 平台提供本地辅助服务 **CrossDesk Service**，服务名为 `CrossDeskService`。该服务用于锁屏、登录界面和安全桌面等受保护场景下的远程控制增强能力，包括：
+
 - 上报远端当前是否处于锁屏、登录、凭据输入或安全桌面状态；
 - 支持从控制端发送 `Ctrl+Alt+Del`（SAS）；
 - 在锁屏、登录和安全桌面阶段转发键盘、鼠标输入。
@@ -62,13 +78,15 @@ CrossDesk 在 Windows 平台提供本地辅助服务 **CrossDesk Service**，服
 Windows 安装包会自动打包 `crossdesk_service.exe` 和 `crossdesk_session_helper.exe`，并在安装时注册为按需启动的 Windows 服务。CrossDesk 客户端启动时会尝试启动已安装的服务；当本机没有 CrossDesk 客户端进程运行时，服务会自动退出。卸载客户端时会同步停止并移除该服务。
 
 如果是手动编译或手动部署 Windows 版本，请确保 `CrossDesk.exe`、`crossdesk_service.exe` 和 `crossdesk_session_helper.exe` 位于同一目录。安装或卸载服务需要使用管理员权限打开 PowerShell：
-```
+
+```powershell
 # 安装
 .\CrossDesk.exe --service-install
 # 启动
 .\CrossDesk.exe --service-start
 # 查看状态
 .\CrossDesk.exe --service-status
+# 停止
 .\CrossDesk.exe --service-stop
 # 卸载
 .\CrossDesk.exe --service-uninstall
@@ -76,49 +94,118 @@ Windows 安装包会自动打包 `crossdesk_service.exe` 和 `crossdesk_session_
 
 如果远端 Windows 服务未安装、未启动或暂时不可用，基础远程桌面连接仍可使用，但锁屏、登录界面和安全桌面阶段的控制能力会受限，客户端会提示“远端Windows服务不可用”。
 
+---
+
 ## 如何编译
 
-依赖：
+### 构建依赖
+
 - [xmake](https://xmake.io/#/guide/installation)
-- [cmake](https://cmake.org/download/)
+- [cmake](https://cmake.org/download/) 3.21 及以上（系统版本过低时由 xmake 自动安装）
 
-Linux环境下需安装以下包：
+### Linux
 
-```
+Linux 构建支持 Ubuntu 20.04 及以上版本的 amd64 和 arm64。发布安装包以
-sudo apt-get install -y software-properties-common git curl unzip build-essential libx11-dev libxrandr-dev libxinerama-dev libxcursor-dev libxi-dev libxcb-randr0-dev libxcb-xtest0-dev libxcb-xinerama0-dev libxcb-shape0-dev libxcb-xkb-dev libxcb-xfixes0-dev libxfixes-dev libxv-dev libxtst-dev libasound2-dev libsndio-dev libxcb-shm0-dev libasound2-dev libpulse-dev
+Ubuntu 20.04/glibc 2.31 为兼容基线。先安装基础编译依赖：
+
+```bash
+sudo apt-get update
+sudo apt-get install -y \
+  git curl unzip build-essential gcc-10 g++-10 python3-pip \
+  pkg-config binutils dpkg-dev \
+  libx11-dev libxext-dev libxrender-dev libxft-dev libxrandr-dev \
+  libxinerama-dev libxcursor-dev libxi-dev libxfixes-dev libxv-dev \
+  libxtst-dev libxcb-randr0-dev libxcb-xtest0-dev libxcb-xinerama0-dev \
+  libxcb-shape0-dev libxcb-xkb-dev libxcb-xfixes0-dev libxcb-shm0-dev \
+  libasound2-dev libsndio-dev libpulse-dev
 ```
 
-编译
+Ubuntu 20.04 自带的 CMake 3.16 不满足要求时，xmake 会自动下载并使用
-```
+CMake 3.21 或更高版本，无需手动替换系统 CMake。
-git clone https://github.com/kunkundi/crossdesk.git
 
+Ubuntu 20.04 默认的 GCC 9 缺少 Slint C++ API 所需的部分 C++20 标准库，
+因此上述命令同时安装并在后续配置中指定 GCC 10。
+
+需要启用 Wayland 捕获或 DRM 捕获时，再安装对应依赖：
+
+```bash
+sudo apt-get install -y libdbus-1-dev libdrm-dev
+
+# Ubuntu 22.04 及以上也可以直接安装系统开发包
+# sudo apt-get install -y libpipewire-0.3-dev libspa-0.2-dev
+```
+
+下载子模块并编译 Release 版本：
+
+```bash
+git clone --recurse-submodules https://github.com/kunkundi/crossdesk.git
 cd crossdesk
 
-git submodule init 
+# 已经克隆过仓库时执行这一行
+git submodule update --init --recursive
 
-git submodule update
+# Ubuntu 20.04 没有 PipeWire 0.3 开发包，安装仅用于编译的头文件 SDK。
+# 已安装发行版 PipeWire 0.3 开发包时可跳过此步骤。
+sudo ./docker/linux-build/install-pipewire-sdk.sh
 
+xmake f -c -m release --USE_CUDA=false --toolchain=gcc-10 -y
 xmake b -vy crossdesk
 ```
-编译选项
+
+这里应使用 `--toolchain=gcc-10`，以确保 CrossDesk 及 xmake 在配置阶段构建的
+libyuv 等第三方包都使用 GCC 10。只指定 `--cc`/`--cxx` 时，依赖安装可能仍回退到
+系统默认的 `/bin/cc` 和 `/bin/c++`。`-c` 会清除旧配置，切换编译器时必须保留。
+
+amd64 构建结果位于 `build/linux/x86_64/release/crossdesk`，arm64 构建结果位于 `build/linux/arm64/release/crossdesk`。
+
+启用 Wayland 和 DRM 的配置示例：
+
+```bash
+xmake f -c -m release --USE_WAYLAND=true --USE_DRM=true --USE_CUDA=false \
+  --toolchain=gcc-10 -y
+xmake b -vy crossdesk
 ```
+
+生成 Debian 安装包（必须在对应架构上先完成 Release 编译）：
+
+```bash
+# amd64
+./scripts/linux/pkg_amd64.sh 1.0.0
+
+# arm64
+./scripts/linux/pkg_arm64.sh 1.0.0
+```
+
+打包脚本会将 Slint 共享运行库安装到软件包私有目录 `/usr/lib/crossdesk`，无需用户另外安装 `libslint_cpp.so`。
+PipeWire 不属于强制运行时依赖：程序在运行时检测宿主系统的 PipeWire 0.3，
+没有该运行库时仍可使用 X11（以及构建时启用的 DRM）捕获。
+
+### 通用编译选项
+
+```text
 --USE_CUDA=true/false: 启用 CUDA 硬件编解码，默认不启用
+--USE_WAYLAND=true/false: 在 Linux 上启用 Wayland/PipeWire 捕获，默认不启用
+--USE_DRM=true/false: 在 Linux 上启用 DRM 捕获，默认不启用
+--CROSSDESK_PORTABLE=true/false: 构建便携版本，默认不启用
 --CROSSDESK_VERSION=xxx: 指定 CrossDesk 的版本
 
 # 示例
 xmake f --CROSSDESK_VERSION=1.0.0 --USE_CUDA=true
 ```
-运行
+
-```
+运行：
+
+```bash
 xmake r crossdesk
 ```
 
 ### 无 CUDA 环境下的开发支持
 
-对于**未安装 CUDA 环境的 Linux 开发者，如果希望编译后的成果物拥有硬件编解码能力**，这里提供了预配置的 [Ubuntu 22.04 Docker 镜像](https://hub.docker.com/r/crossdesk/ubuntu22.04)。该镜像内置必要的构建依赖，可在容器中开箱即用，无需额外配置即可直接编译项目。
+对于**未安装 CUDA 环境的 Linux 开发者，如果希望编译后的成果物拥有硬件编解码能力**，这里提供了预配置的 [Ubuntu 20.04 兼容构建镜像](https://hub.docker.com/r/crossdesk/ubuntu20.04)。该镜像内置必要的构建依赖，可生成兼容 glibc 2.31 的单一 Linux 安装包。
 
 进入容器，下载工程后执行：
-```
+
+```bash
 export CUDA_PATH=/usr/local/cuda
 export XMAKE_GLOBALDIR=/data
 
@@ -127,50 +214,65 @@ xmake b --root -vy crossdesk
 ```
 
 对于**未安装 CUDA 环境的 Windows 开发者**，执行下面的命令安装 CUDA 编译环境：
-```
+
+```powershell
 xmake require -vy "cuda 12.6.3"
 ```
+
 安装完成后执行:
-```
+
+```powershell
 xmake require --info "cuda 12.6.3"
 ```
+
 输出如下:
 
 <img width="860" height="226" alt="Image" src="https://github.com/user-attachments/assets/999ac365-581a-4b9a-806e-05eb3e4cf44d" />
 
 根据上述输出获取到 CUDA 的安装目录，即 installdir 指向的位置。将 CUDA_PATH 加入系统环境变量，或在终端中输入：
-```
+
+```powershell
 set CUDA_PATH=path_to_cuda_installdir
 ```
+
 重新执行：
-```
+
+```powershell
 xmake f --USE_CUDA=true
 xmake b -vy crossdesk
 ```
 
 #### 注意
+
 运行时如果客户端状态栏显示 **未连接服务器**，请先在 [CrossDesk 官方网站](https://www.crossdesk.cn/) 安装客户端，以便在环境中安装所需的证书文件。
 
 <img width="256" height="120" alt="image" src="https://github.com/user-attachments/assets/1812f7d6-516b-4b4f-8a3d-98bee505cc5a" />
 
-## 关于 Xmake
+### 关于 Xmake
 
 #### 安装 Xmake
+
 使用 curl：
-```
+
+```bash
 curl -fsSL https://xmake.io/shget.text | bash
 ```
+
 使用 wget：
-```
+
+```bash
 wget https://xmake.io/shget.text -O - | bash
 ```
+
 使用 powershell：
-```
+
+```powershell
 irm https://xmake.io/psget.text | iex
 ```
 
 #### 编译选项
-```
+
+```text
 # 切换编译模式
 xmake f -m debug/release
 
@@ -184,14 +286,22 @@ xmake b -vy crossdesk
 ```
 
 #### 运行选项
-```
+
+```bash
 # 使用调试模式运行
 xmake r -d crossdesk
 ```
+
 更多使用方法可参考 [Xmake 官方文档](https://xmake.io/guide/quick-start.html)。
 
+---
+
 ## 自托管服务器
+
+### 服务端
+
 推荐使用 Docker 部署 CrossDesk Server。
+
 ```bash
 sudo docker run -d \
   --name crossdesk_server \
@@ -209,7 +319,8 @@ sudo docker run -d \
 
 上述命令中，用户需注意的参数如下：
 
-**参数**
+#### 配置参数
+
 - EXTERNAL_IP：服务器公网 IP , 对应 CrossDesk 客户端**自托管服务器配置**中填写的**服务器地址**
 - INTERNAL_IP：服务器内网 IP
 - CROSSDESK_SERVER_PORT：自托管服务使用的端口，对应 CrossDesk 客户端**自托管服务器配置**中填写的**服务器端口**
@@ -218,7 +329,8 @@ sudo docker run -d \
 - `-v /var/lib/crossdesk:/var/lib/crossdesk`：持久化数据库和证书文件到宿主机
 - `-v /var/log/crossdesk:/var/log/crossdesk`：持久化日志文件到宿主机
 
-**示例**：
+#### 部署示例
+
 ```bash
 sudo docker run -d \
   --name crossdesk_server \
@@ -234,26 +346,31 @@ sudo docker run -d \
   crossdesk/crossdesk-server:v1.1.6
 ```
 
-**注意**：
+#### 注意事项
+
 - **服务器需开放端口：COTURN_PORT/udp，COTURN_PORT/tcp，MIN_PORT-MAX_PORT/udp，CROSSDESK_SERVER_PORT/tcp。**
 - 如果不挂载 volume，容器删除后数据会丢失
 - 证书文件会在首次启动时自动生成并持久化到宿主机的 `/var/lib/crossdesk/certs` 路径下。由于默认使用的是自签证书，无法保障安全性，建议在云服务商申请正式证书放到该目录下并重启服务。
 - 数据库文件会自动创建并持久化到宿主机的 `/var/lib/crossdesk/db/crossdesk-server.db` 路径下
 - 日志文件会自动创建并持久化到宿主机的 `/var/log/crossdesk/` 路径下
 
-**权限注意**：如果 Docker 自动创建的目录权限不足（属于 root），容器内用户无法写入，会导致：
+#### 目录权限
+
+如果 Docker 自动创建的目录权限不足（属于 root），容器内用户无法写入，会导致：
+
 - 证书生成失败，容器启动脚本会报错退出
 - 数据库目录创建失败，程序会抛出异常并崩溃
 - 日志目录创建失败，日志文件无法写入（但程序可能继续运行）
 
-**解决方案**：在启动容器前手动设置权限：
+在启动容器前手动设置权限：
+
 ```bash
 sudo mkdir -p /var/lib/crossdesk /var/log/crossdesk
 sudo chown -R $(id -u):$(id -g) /var/lib/crossdesk /var/log/crossdesk
 ```
 
-
 ### 客户端
+
 1. 点击右上角设置进入设置页面。<br><br>
 <img width="600" height="210" alt="image" src="https://github.com/user-attachments/assets/6431131d-b32a-4726-8783-6788f47baa3b" /><br>
 
@@ -266,27 +383,51 @@ sudo chown -R $(id -u):$(id -g) /var/lib/crossdesk /var/log/crossdesk
 
 5. 如果使用默认证书（正式证书忽略此步骤），则需要将服务端`/var/lib/crossdesk/certs/`目录下的`api.crossdesk.cn_root.crt`自签根证书下载到运行客户端的机器，并执行下述命令安装证书：
 
-Windows 平台使用**管理员权限**打开 PowerShell 执行
+**Windows：** 使用管理员权限打开 PowerShell 执行：
-```
+
+```powershell
 certutil -addstore "Root" "C:\path\to\api.crossdesk.cn_root.crt"
 ```
-Linux
+
-```
+**Linux：**
+
+```bash
 sudo cp /path/to/api.crossdesk.cn_root.crt /usr/local/share/ca-certificates/api.crossdesk.cn_root.crt
 sudo update-ca-certificates
 ```
-macOS
+
-```
+**macOS：**
+
+```bash
 sudo security add-trusted-cert -d -r trustRoot -k /Library/Keychains/System.keychain path/to/api.crossdesk.cn_root.crt
 ```
 
-### Web 客户端
+### 自托管 Web 客户端
+
 详情见项目 [CrossDesk Web Client](https://github.com/kunkundi/crossdesk-web-client)。
 
-# 常见问题
+---
+
+## 常见问题
+
 见 [常见问题](https://github.com/kunkundi/crossdesk/blob/self-hosted-server/docs/FAQ.md)。
 
-# 致谢
+---
+
+## 致谢
+
 - 感谢 [HelloGitHub](https://hellogithub.com/) 的推荐与关注。
 - 感谢 [阮一峰的科技爱好者周刊](https://github.com/ruanyf/weekly) 的收录与推荐。
 - 感谢 [LinuxDo](https://linux.do) 社区的关注、交流与支持，为 CrossDesk 项目的完善提供了帮助。
+
+---
+
+## Code signing policy
+
+CrossDesk 使用 SignPath.io 为本仓库构建的官方 Windows 发布包提供代码签名。
+
+**Free code signing provided by [SignPath.io](https://signpath.io/), certificate by [SignPath Foundation](https://signpath.org/).**
+
+- **Committers and reviewers（代码提交与审核）：** [kunkundi](https://github.com/kunkundi)
+- **Approvers（签名审批）：** [kunkundi](https://github.com/kunkundi)
+- **Privacy policy（隐私政策）：** 除非用户或安装、运行 CrossDesk 的人员明确要求，否则 CrossDesk 不会向其他联网系统传输任何信息。

README_EN.md

@@ -1,39 +1,51 @@
 # CrossDesk
 
 <a href="https://hellogithub.com/repository/kunkundi/crossdesk" target="_blank"><img src="https://api.hellogithub.com/v1/widgets/recommend.svg?rid=55d41367570345f1838e02fd12be7961&claim_uid=cb0OpZRrBuGVAfL&theme=small" alt="Featured｜HelloGitHub" /></a>
-[![Platform](https://img.shields.io/badge/platform-Windows%20%7C%20Linux%20%7C%20macOS-brightgreen.svg)]()
+
-[![License: LGPL v3](https://img.shields.io/badge/License-LGPL%20v3-blue.svg)](https://www.gnu.org/licenses/lgpl-3.0)
+[![Platform](https://img.shields.io/badge/platform-Windows%20%7C%20Linux%20%7C%20macOS-brightgreen.svg)](https://www.crossdesk.cn/)
+[![License: GPL v3](https://img.shields.io/badge/License-GPL%20v3-blue.svg)](https://www.gnu.org/licenses/gpl-3.0)
 [![GitHub last commit](https://img.shields.io/github/last-commit/kunkundi/crossdesk)](https://github.com/kunkundi/crossdesk/commits/web-client)
 [![Build Status](https://github.com/kunkundi/crossdesk/actions/workflows/build.yml/badge.svg)](https://github.com/kunkundi/crossdesk/actions)  
 [![Docker Pulls](https://img.shields.io/docker/pulls/crossdesk/crossdesk-server)](https://hub.docker.com/r/crossdesk/crossdesk-server/tags)
-[![GitHub issues](https://img.shields.io/github/issues/kunkundi/crossdesk.svg)]()
+[![GitHub issues](https://img.shields.io/github/issues/kunkundi/crossdesk.svg)](https://github.com/kunkundi/crossdesk/issues)
-[![GitHub stars](https://img.shields.io/github/stars/kunkundi/crossdesk.svg?style=social)]()
+[![GitHub stars](https://img.shields.io/github/stars/kunkundi/crossdesk.svg?style=social)](https://github.com/kunkundi/crossdesk/stargazers)
-[![GitHub forks](https://img.shields.io/github/forks/kunkundi/crossdesk.svg?style=social)]()
+[![GitHub forks](https://img.shields.io/github/forks/kunkundi/crossdesk.svg?style=social)](https://github.com/kunkundi/crossdesk/forks)
 
 [ [中文](README.md) / English ]
 
-PC Client
+---
+
+## Preview
+
+### PC Client
+
 ![sup_example](https://github.com/user-attachments/assets/3f17d8f3-7c4a-4b63-bae4-903363628687)
 
-Web Client
+### Web Client
+
 <p align="center">
   <img width="850" height="550" alt="6bddcbed47ffd4b9988a4037c7f4f524" src="https://github.com/user-attachments/assets/e44f73f9-24ac-46a3-a189-b7f8b6669881" />
 </p>
 
-# Intro
+---
+
+## Introduction
 
 CrossDesk is a lightweight cross-platform remote desktop software.
 
 CrossDesk is an experimental application of [MiniRTC](https://github.com/kunkundi/minirtc.git), a lightweight cross-platform real-time audio and video transmission library. MiniRTC provides fundamental capabilities including network traversal ([RFC5245](https://datatracker.ietf.org/doc/html/rfc5245)), video software/hardware encoding and decoding (H264/AV1), audio encoding/decoding ([Opus](https://github.com/xiph/opus)), signaling interaction, network congestion control, and transmission encryption ([SRTP](https://tools.ietf.org/html/rfc3711)).
 
+---
+
 ## System Requirements
 
 | Platform | Minimum Version |
-|-----------|-----------------|
+| --- | --- |
 | **Windows** | Windows 10 or later (64-bit) |
 | **macOS** | macOS Intel 15.0 or later *(versions between 14.0 and 15.0 can be built manually for compatibility)*<br>macOS Apple Silicon 14.0 or later |
-| **Linux** | Ubuntu 22.04 or later *(older versions can be built manually for compatibility)* |
+| **Linux** | Ubuntu 20.04 or later |
 
+---
 
 ## Usage
 
@@ -49,7 +61,7 @@ Before connecting, you can customize configuration options in the settings, such
 
 ![settings](https://github.com/user-attachments/assets/8bc5468d-7bbb-4e30-95bd-da1f352ac08c)
 
-### Web Client
+### Using the Web Client
 
 Visit [CrossDesk Web Client](https://web.crossdesk.cn/).
 Enter the **Remote Device ID** and **Password**, then click Connect to access the remote device. As shown, **iOS Safari remotely controlling Windows 11**:
@@ -57,7 +69,9 @@ Enter the **Remote Device ID** and **Password**, then click Connect to access th
 <img width="645" height="300" alt="_cgi-bin_mmwebwx-bin_webwxgetmsgimg__ MsgID=932911462648581698 skey=@crypt_1f5153b1_b550ca7462b5009ce03c991cca2a92a7 mmweb_appid=wx_webfilehelper" src="https://github.com/user-attachments/assets/a5109e6f-752c-4654-9f4e-7e161bddf43e" />
 
 ### Windows Service (CrossDesk Service)
+
 CrossDesk provides a local helper service on Windows named **CrossDesk Service**. Its service name is `CrossDeskService`. The service improves remote control in protected Windows states such as the lock screen, sign-in UI, credential UI, and secure desktop. It provides:
+
 - Remote status reporting for lock screen, sign-in, credential, and secure desktop states.
 - Remote `Ctrl+Alt+Del` (SAS) delivery.
 - Keyboard and mouse input forwarding while the remote Windows device is on the lock screen, sign-in UI, or secure desktop.
@@ -65,7 +79,8 @@ CrossDesk provides a local helper service on Windows named **CrossDesk Service**
 The Windows installer bundles `crossdesk_service.exe` and `crossdesk_session_helper.exe`, then registers the service as an on-demand Windows service during installation. When the CrossDesk client starts, it tries to start the installed service automatically. When no CrossDesk client process is running on the machine, the service exits automatically. Uninstalling the client also stops and removes the service.
 
 For manual Windows builds or deployments, make sure `CrossDesk.exe`, `crossdesk_service.exe`, and `crossdesk_session_helper.exe` are placed in the same directory. Open PowerShell with administrator privileges to install or uninstall the service:
-```
+
+```powershell
 # install
 .\CrossDesk.exe --service-install
 # start
@@ -81,50 +96,126 @@ For manual Windows builds or deployments, make sure `CrossDesk.exe`, `crossdesk_
 
 If the remote Windows service is not installed, not running, or temporarily unavailable, the basic remote desktop connection still works, but remote control on the lock screen, sign-in UI, and secure desktop is limited. The client will show “Remote Windows service unavailable”.
 
+---
+
 ## How to build
 
-Requirements:
+### Build requirements
+
 - [xmake](https://xmake.io/#/guide/installation)
-- [cmake](https://cmake.org/download/)
+- [cmake](https://cmake.org/download/) 3.21 or later (installed automatically by xmake when the system version is too old)
 
-Following packages need to be installed on Linux:
+### Linux
 
-```
+Linux builds support Ubuntu 20.04 or later on amd64 and arm64. Release packages
-sudo apt-get install -y software-properties-common git curl unzip build-essential libx11-dev libxrandr-dev libxinerama-dev libxcursor-dev libxi-dev libxcb-randr0-dev libxcb-xtest0-dev libxcb-xinerama0-dev libxcb-shape0-dev libxcb-xkb-dev libxcb-xfixes0-dev libxfixes-dev libxv-dev libxtst-dev libasound2-dev libsndio-dev libxcb-shm0-dev libasound2-dev libpulse-dev
+use Ubuntu 20.04/glibc 2.31 as their compatibility baseline. Install the base
+build dependencies first:
+
+```bash
+sudo apt-get update
+sudo apt-get install -y \
+  git curl unzip build-essential gcc-10 g++-10 python3-pip \
+  pkg-config binutils dpkg-dev \
+  libx11-dev libxext-dev libxrender-dev libxft-dev libxrandr-dev \
+  libxinerama-dev libxcursor-dev libxi-dev libxfixes-dev libxv-dev \
+  libxtst-dev libxcb-randr0-dev libxcb-xtest0-dev libxcb-xinerama0-dev \
+  libxcb-shape0-dev libxcb-xkb-dev libxcb-xfixes0-dev libxcb-shm0-dev \
+  libasound2-dev libsndio-dev libpulse-dev
 ```
 
-Build:
+When Ubuntu 20.04's bundled CMake 3.16 is too old, xmake automatically
-```
+downloads and uses CMake 3.21 or later; replacing the system CMake manually is
-git clone https://github.com/kunkundi/crossdesk.git
+not required.
 
+Ubuntu 20.04's default GCC 9 lacks parts of the C++20 standard library needed
+by Slint's C++ API, so the commands above install GCC 10 and the configuration
+below selects it explicitly.
+
+Install the optional dependencies when Wayland capture or DRM capture is enabled:
+
+```bash
+sudo apt-get install -y libdbus-1-dev libdrm-dev
+
+# Ubuntu 22.04 and later can alternatively use the distribution packages.
+# sudo apt-get install -y libpipewire-0.3-dev libspa-0.2-dev
+```
+
+Clone the submodules and build a release binary:
+
+```bash
+git clone --recurse-submodules https://github.com/kunkundi/crossdesk.git
 cd crossdesk
 
-git submodule init 
+# Run this when the repository has already been cloned
+git submodule update --init --recursive
 
-git submodule update
+# Ubuntu 20.04 has no PipeWire 0.3 development package. Install the
+# header-only SDK used during compilation. Skip this when the distribution's
+# PipeWire 0.3 development packages are already installed.
+sudo ./docker/linux-build/install-pipewire-sdk.sh
 
+xmake f -c -m release --USE_CUDA=false --toolchain=gcc-10 -y
 xmake b -vy crossdesk
 ```
-Build options:
-```
---USE_CUDA=true/false: enable CUDA acceleration codec, default: false
---CROSSDESK_VERSION=xxx: set the version number
 
-# example:
+Use `--toolchain=gcc-10` so that both CrossDesk and third-party packages such
+as libyuv, which xmake builds during configuration, use GCC 10. Specifying only
+`--cc`/`--cxx` may still let dependency builds fall back to the system
+`/bin/cc` and `/bin/c++`. Keep `-c` when switching compilers to clear the old
+configuration.
+
+The amd64 binary is written to `build/linux/x86_64/release/crossdesk`; the arm64 binary is written to `build/linux/arm64/release/crossdesk`.
+
+Example configuration with Wayland and DRM capture enabled:
+
+```bash
+xmake f -c -m release --USE_WAYLAND=true --USE_DRM=true --USE_CUDA=false \
+  --toolchain=gcc-10 -y
+xmake b -vy crossdesk
+```
+
+Build a Debian package after compiling a release binary on the matching architecture:
+
+```bash
+# amd64
+./scripts/linux/pkg_amd64.sh 1.0.0
+
+# arm64
+./scripts/linux/pkg_arm64.sh 1.0.0
+```
+
+The package scripts install the shared Slint runtime in the private `/usr/lib/crossdesk` directory, so users do not need to install `libslint_cpp.so` separately.
+PipeWire is not a mandatory runtime dependency. CrossDesk detects the host's
+PipeWire 0.3 runtime dynamically and can still use X11 capture (and DRM when
+enabled at build time) when it is unavailable.
+
+### Common build options
+
+```text
+--USE_CUDA=true/false: Enable CUDA hardware codec acceleration, disabled by default
+--USE_WAYLAND=true/false: Enable Wayland/PipeWire capture on Linux, disabled by default
+--USE_DRM=true/false: Enable DRM capture on Linux, disabled by default
+--CROSSDESK_PORTABLE=true/false: Build the portable variant, disabled by default
+--CROSSDESK_VERSION=xxx: Set the CrossDesk version
+
+# Example
 xmake f --CROSSDESK_VERSION=1.0.0 --USE_CUDA=true
 ```
+
 Run:
-```
+
+```bash
 xmake r crossdesk
 ```
 
-#### Development Without CUDA Environment
+### Development Without CUDA Environment
 
-For **Linux developers who do not have a CUDA environment installed and want to enable hardware codec feature**, a preconfigured [Ubuntu 22.04 Docker image](https://hub.docker.com/r/crossdesk/ubuntu22.04) is provided.  
+For **Linux developers who do not have a CUDA environment installed and want to enable hardware codec feature**, a preconfigured [Ubuntu 20.04 compatibility build image](https://hub.docker.com/r/crossdesk/ubuntu20.04) is provided.
-This image comes with all required build dependencies and allows you to build the project directly inside the container without any additional setup.
+This image contains the required build dependencies and produces a single Linux package compatible with the glibc 2.31 baseline.
 
 After entering the container, download the project and run:
-```
+
+```bash
 export CUDA_PATH=/usr/local/cuda
 export XMAKE_GLOBALDIR=/data
 
@@ -133,53 +224,68 @@ xmake b --root -vy crossdesk
 ```
 
 For **Windows developers without a CUDA environment** installed, run the following command to install the CUDA build environment:
-```
+
+```powershell
 xmake require -vy "cuda 12.6.3"
 ```
+
 After the installation is complete, execute:
-```
+
+```powershell
 xmake require --info "cuda 12.6.3"
 ```
+
 The output will look like this:
 
 <img width="860" height="226" alt="Image" src="https://github.com/user-attachments/assets/999ac365-581a-4b9a-806e-05eb3e4cf44d" />
 
 From the output above, locate the CUDA installation directory — this is the path pointed to by installdir.
 Add this path to your system environment variable CUDA_PATH, or set it in the terminal using:
+
+```powershell
+set CUDA_PATH=path_to_cuda_installdir
 ```
-set CUDA_PATH=path_to_cuda_installdir:
+
-```
 Then re-run:
-```
+
+```powershell
 xmake f --USE_CUDA=true
 xmake b -vy crossdesk
 ```
 
 #### Notice
+
 If the client status bar shows **Disconnected** during runtime, please first install the client from the [CrossDesk official website](https://www.crossdesk.cn/) to ensure the required certificate files are available in the environment.
 
 <img width="256" height="120" alt="image" src="https://github.com/user-attachments/assets/1812f7d6-516b-4b4f-8a3d-98bee505cc5a" />
 
-## About Xmake
+### About Xmake
+
 #### Installing Xmake
 
 You can install Xmake using one of the following methods:
 
 Using curl:
-```
+
+```bash
 curl -fsSL https://xmake.io/shget.text | bash
 ```
+
 Using wget:
-```
+
+```bash
 wget https://xmake.io/shget.text -O - | bash
 ```
+
 Using powershell:
-```
+
+```powershell
 irm https://xmake.io/psget.text | iex
 ```
 
 #### Build Options
-```
+
+```text
 # Switch build mode
 xmake f -m debug/release
 
@@ -193,16 +299,23 @@ xmake b -vy crossdesk
 ```
 
 #### Run Options
-```
+
+```bash
 # Run in debug mode
 xmake r -d crossdesk
 ```
 
 For more information, please refer to the [official Xmake documentation](https://xmake.io/guide/quick-start.html).
 
+---
+
 ## Self-Hosted Server
+
+### Server
+
 It is recommended to deploy CrossDesk Server using Docker.
-```
+
+```bash
 sudo docker run -d \
   --name crossdesk_server \
   --network host \
@@ -219,7 +332,8 @@ sudo docker run -d \
 
 The parameters you need to pay attention to are as follows:
 
-**Parameters**
+#### Parameters
+
 - **EXTERNAL_IP**: The server’s public IP. This corresponds to **Server Address** in the CrossDesk client’s **Self-Hosted Server Configuration**.
 - **INTERNAL_IP**: The server’s internal IP.
 - **CROSSDESK_SERVER_PORT**: The port used by the self-hosted service. This corresponds to **Server Port** in the CrossDesk client’s **Self-Hosted Server Configuration**.
@@ -228,7 +342,8 @@ The parameters you need to pay attention to are as follows:
 - `-v /var/lib/crossdesk:/var/lib/crossdesk`: Persists database and certificate files on the host machine.
 - `-v /var/log/crossdesk:/var/log/crossdesk`: Persists log files on the host machine.
 
-**Example**:
+#### Example
+
 ```bash
 sudo docker run -d \
   --name crossdesk_server \
@@ -244,29 +359,35 @@ sudo docker run -d \
   crossdesk/crossdesk-server:v1.1.6
 ```
 
-**Notes**
+#### Notes
+
 - **The server must open the following ports: COTURN_PORT/udp, COTURN_PORT/tcp, MIN_PORT–MAX_PORT/udp, and CROSSDESK_SERVER_PORT/tcp.**
 - If you don’t mount volumes, all data will be lost when the container is removed.
 - Certificate files will be automatically generated on first startup and persisted to the host at `/var/lib/crossdesk/certs`. As the default certificates are self-signed and cannot guarantee security, it is strongly recommended to apply for a trusted certificate from a cloud provider, deploy it to this directory, and restart the service.
 - The database file will be automatically created and stored at `/var/lib/crossdesk/db/crossdesk-server.db`.
 - Log files will be created and stored at `/var/log/crossdesk/`.
 
-**Permission Notice**
+#### Directory permissions
+
 If the directories automatically created by Docker belong to root and have insufficient write permissions, the container user may not be able to write to them. This can cause:
+
 - Certificate generation failure, leading to startup script errors and container exit.
 - Database directory creation failure, causing the program to throw exceptions and crash.
 - Log directory creation failure, preventing logs from being written (though the program may continue running).
 
-**Solution:** Manually set permissions before starting the container:
+Manually set permissions before starting the container:
+
 ```bash
 sudo mkdir -p /var/lib/crossdesk /var/log/crossdesk
 sudo chown -R $(id -u):$(id -g) /var/lib/crossdesk /var/log/crossdesk
 ```
 
-### Server Side
+#### TLS certificate
+
 Place **crossdesk.cn.key** and **crossdesk.cn_bundle.crt** into the **/path/to/your/certs** directory.
 
-### Client Side
+### Client
+
 1. Click the settings icon in the top-right corner to enter the settings page.<br><br>
 <img width="600" height="210" alt="image" src="https://github.com/user-attachments/assets/6431131d-b32a-4726-8783-6788f47baa3b" /><br>
 
@@ -279,28 +400,51 @@ Place **crossdesk.cn.key** and **crossdesk.cn_bundle.crt** into the **/path/to/y
 
 5. If the default certificate is used (skip this step if an official certificate is used), download the self-signed root certificate `api.crossdesk.cn_root.crt` from the server directory /var/lib/crossdesk/certs/ to the machine running the client, and install the certificate by executing the following command:
 
-On Windows, open PowerShell with **administrator privileges** and execute:
+**Windows:** Open PowerShell with administrator privileges and execute:
-```
+
+```powershell
 certutil -addstore "Root" "C:\path\to\api.crossdesk.cn_root.crt"
 ```
-Linux
+
-```
+**Linux:**
+
+```bash
 sudo cp /path/to/api.crossdesk.cn_root.crt /usr/local/share/ca-certificates/api.crossdesk.cn_root.crt
 sudo update-ca-certificates
 ```
-macOS
+
-```
+**macOS:**
+
+```bash
 sudo security add-trusted-cert -d -r trustRoot -k /Library/Keychains/System.keychain path/to/api.crossdesk.cn_root.crt
 ```
 
+### Self-Hosted Web Client
 
-### Web Client
+See [CrossDesk Web Client](https://github.com/kunkundi/crossdesk-web-client).
-See [CrossDesk Web Client](https://github.com/kunkundi/crossdesk-web-client)。
 
-# FAQ
+---
-See [FAQ](https://github.com/kunkundi/crosssesk/blob/self-hosted-server/docs/FAQ.md) .
+
+## FAQ
+
+See [FAQ](https://github.com/kunkundi/crossdesk/blob/self-hosted-server/docs/FAQ.md).
+
+---
+
+## Acknowledgements
 
-# Acknowledgements
 - Thanks to [HelloGitHub](https://hellogithub.com/) for the recommendation and exposure.
 - Thanks to [Ruanyf Weekly](https://github.com/ruanyf/weekly) for featuring CrossDesk.
 - Thanks to the [LinuxDo](https://linux.do) community for the attention, discussions, and support that helped improve CrossDesk.
+
+---
+
+## Code signing policy
+
+CrossDesk uses SignPath.io to code-sign official Windows releases built from this repository.
+
+**Free code signing provided by [SignPath.io](https://signpath.io/), certificate by [SignPath Foundation](https://signpath.org/).**
+
+- **Committers and reviewers:** [kunkundi](https://github.com/kunkundi)
+- **Approvers:** [kunkundi](https://github.com/kunkundi)
+- **Privacy policy:** CrossDesk will not transfer any information to other networked systems unless specifically requested by the user or the person installing or operating it.

docker/linux-build/Dockerfile

@@ -0,0 +1,174 @@
+# syntax=docker/dockerfile:1.7
+
+ARG BASE_IMAGE=nvidia/cuda:12.6.3-devel-ubuntu20.04
+FROM ${BASE_IMAGE}
+
+ARG TARGETARCH
+ARG CMAKE_VERSION=3.31.6
+ARG XMAKE_VERSION=3.0.9
+ARG RUST_VERSION=1.92.0
+ARG RUSTUP_VERSION=1.28.2
+
+LABEL org.opencontainers.image.title="CrossDesk Linux build environment" \
+      org.opencontainers.image.description="Ubuntu 20.04 compatibility build environment for CrossDesk" \
+      org.opencontainers.image.source="https://github.com/kunkundi/crossdesk" \
+      org.opencontainers.image.licenses="GPL-3.0-only"
+
+ENV DEBIAN_FRONTEND=noninteractive \
+    TZ=Etc/UTC \
+    LANG=C.UTF-8 \
+    LC_ALL=C.UTF-8 \
+    RUSTUP_HOME=/opt/rustup \
+    CARGO_HOME=/opt/cargo \
+    XMAKE_GLOBALDIR=/data \
+    XMAKE_ROOT=y \
+    CUDA_PATH=/usr/local/cuda \
+    CC=/usr/bin/gcc-10 \
+    CXX=/usr/bin/g++-10 \
+    PATH=/root/.local/bin:/opt/cargo/bin:/usr/local/bin:${PATH}
+
+SHELL ["/bin/bash", "-o", "pipefail", "-c"]
+
+RUN apt-get update \
+    && apt-get install -y --no-install-recommends \
+        autoconf \
+        automake \
+        binutils \
+        bison \
+        build-essential \
+        ca-certificates \
+        ccache \
+        curl \
+        dbus \
+        dpkg-dev \
+        file \
+        flex \
+        gettext \
+        gcc-10 \
+        g++-10 \
+        git \
+        libasound2-dev \
+        libdbus-1-dev \
+        libdrm-dev \
+        libegl1-mesa-dev \
+        libffi-dev \
+        libfontconfig1-dev \
+        libfreetype6-dev \
+        libgl1-mesa-dev \
+        libmount-dev \
+        libpulse-dev \
+        libreadline-dev \
+        libsndio-dev \
+        libssl-dev \
+        libtool \
+        libx11-dev \
+        libxcb-xfixes0-dev \
+        libxcb-randr0-dev \
+        libxcb-shape0-dev \
+        libxcb-shm0-dev \
+        libxcb-xinerama0-dev \
+        libxcb-xkb-dev \
+        libxcb-xtest0-dev \
+        libxcursor-dev \
+        libxext-dev \
+        libxfixes-dev \
+        libxft-dev \
+        libxi-dev \
+        libxinerama-dev \
+        libxkbcommon-dev \
+        libxrandr-dev \
+        libxrender-dev \
+        libxtst-dev \
+        libxv-dev \
+        make \
+        nasm \
+        ninja-build \
+        patch \
+        patchelf \
+        perl \
+        pkg-config \
+        python3 \
+        python3-pip \
+        unzip \
+        xutils-dev \
+        xz-utils \
+        yasm \
+        zip \
+        zlib1g-dev \
+    && rm -rf /var/lib/apt/lists/*
+
+# Slint 1.17 requires CMake 3.21 or newer, while Ubuntu 20.04 provides 3.16.
+# PyPI publishes pinned manylinux2014 wheels for both amd64 and arm64.
+RUN python3 -m pip install --no-cache-dir "cmake==${CMAKE_VERSION}" \
+    && cmake --version | grep -F "cmake version ${CMAKE_VERSION}"
+
+# Ubuntu 20.04 only ships PipeWire 0.2. Install the Ubuntu 22.04-era 0.3.48
+# headers as a build-only SDK. CrossDesk loads the host's PipeWire 0.3 runtime
+# with dlopen(), so no PipeWire shared library is copied into release packages.
+COPY docker/linux-build/install-pipewire-sdk.sh \
+    /usr/local/bin/install-crossdesk-pipewire-sdk
+
+RUN chmod 0755 /usr/local/bin/install-crossdesk-pipewire-sdk \
+    && install-crossdesk-pipewire-sdk \
+    && grep -F "#define PW_MICRO 48" \
+        /opt/crossdesk-pipewire-sdk/include/pipewire-0.3/pipewire/version.h
+
+RUN export GITHUB_ACTIONS=true \
+    && curl -fsSL https://xmake.io/shget.text \
+        | bash -s -- "v${XMAKE_VERSION}" \
+    && source ~/.xmake/profile \
+    && xmake --version | grep -F "v${XMAKE_VERSION}"
+
+RUN case "${TARGETARCH}" in \
+        amd64) \
+            rustup_arch="x86_64-unknown-linux-gnu"; \
+            rustup_sha256="20a06e644b0d9bd2fbdbfd52d42540bdde820ea7df86e92e533c073da0cdd43c" \
+            ;; \
+        arm64) \
+            rustup_arch="aarch64-unknown-linux-gnu"; \
+            rustup_sha256="e3853c5a252fca15252d07cb23a1bdd9377a8c6f3efa01531109281ae47f841c" \
+            ;; \
+        *) echo "Unsupported architecture: ${TARGETARCH}" >&2; exit 1 ;; \
+    esac \
+    && curl --proto '=https' --tlsv1.2 --fail --show-error --location \
+        "https://static.rust-lang.org/rustup/archive/${RUSTUP_VERSION}/${rustup_arch}/rustup-init" \
+        -o /tmp/rustup-init \
+    && echo "${rustup_sha256}  /tmp/rustup-init" | sha256sum --check - \
+    && chmod 0755 /tmp/rustup-init \
+    && /tmp/rustup-init -y --no-modify-path --profile minimal \
+        --default-toolchain "${RUST_VERSION}" \
+    && rm -f /tmp/rustup-init \
+    && rustc --version \
+    && cargo --version
+
+WORKDIR /tmp/crossdesk-dependencies
+
+COPY xmake.lua ./xmake.lua
+COPY xmake ./xmake
+COPY thirdparty ./thirdparty
+COPY submodules/xmake.lua ./submodules/xmake.lua
+COPY submodules/minirtc/xmake.lua ./submodules/minirtc/xmake.lua
+COPY submodules/minirtc/thirdparty ./submodules/minirtc/thirdparty
+
+# Configure the real project manifests so the image cache stays aligned with
+# CrossDesk's exact dependency graph. Source files are intentionally excluded
+# from the Docker context; source-only changes therefore reuse this layer.
+RUN xmake repo -u --root \
+    && xmake f -m release --USE_CUDA=true --USE_WAYLAND=true \
+        --cc=gcc-10 --cxx=g++-10 --root -y \
+    && rm -rf /data/.xmake/cache /tmp/crossdesk-dependencies \
+    && mkdir -p /workspace
+
+WORKDIR /workspace
+
+COPY docker/linux-build/verify-build-image.sh \
+    /usr/local/bin/verify-crossdesk-build-image
+COPY docker/linux-build/verify-glibc-baseline.sh \
+    /usr/local/bin/verify-crossdesk-glibc-baseline
+
+RUN chmod 0755 \
+        /usr/local/bin/verify-crossdesk-build-image \
+        /usr/local/bin/verify-crossdesk-glibc-baseline \
+    && verify-crossdesk-build-image
+
+CMD ["bash"]

docker/linux-build/README.md

@@ -0,0 +1,48 @@
+# CrossDesk Linux 构建镜像
+
+这个目录维护 CrossDesk 专用的 Ubuntu 20.04 兼容构建环境。镜像包含 GCC 10、
+CMake 3.31、xmake、Rust、Linux 开发库（包括 D-Bus、DRM，以及仅用于编译的
+PipeWire 0.3/SPA 头文件 SDK）以及根据项目
+`xmake.lua` 提前编译好的依赖。
+
+## 发布方式
+
+推送影响镜像的文件到 `ci/linux-build-image` 分支时，
+`build-linux-image.yml` 会在 GitHub 原生 amd64/arm64 runner 上分别构建和验证，
+全部通过后再合并为同一个 multi-arch 镜像：
+
+```text
+crossdesk/ubuntu20.04:buildenv-cuda12.6.3-gcc10-cmake3.31.6-pipewire0.3.48-xmake3.0.9-rust1.92.0
+```
+
+Docker 会根据运行机器自动选择正确架构。amd64 变体以
+`nvidia/cuda:12.6.3-devel-ubuntu20.04` 为基础；arm64 变体不包含当前构建
+用不到的 CUDA SDK。两个变体都使用 Ubuntu 20.04/glibc 2.31，因此生成的
+单一 Linux 安装包可运行在 Ubuntu 20.04 及更高版本。
+
+Ubuntu 20.04 仓库只提供 PipeWire 0.2。镜像通过
+`install-pipewire-sdk.sh` 安装固定版本的 PipeWire 0.3.48/SPA 头文件，但不
+安装或打包 PipeWire 动态库。CrossDesk 在运行时通过 `dlopen()` 使用宿主系统
+提供的 PipeWire 0.3：Ubuntu 20.04 没有该运行库时仍可使用 X11（以及构建时
+启用的 DRM），Ubuntu 22.04 及更高版本则可使用 Wayland 捕获。
+
+每次成功发布还会生成 `sha-<完整提交 SHA>`，用于精确回滚；`latest` 和上面的
+工具链版本 tag 只会在两个架构都验证成功后更新。
+
+## GitHub 配置
+
+在仓库的 Actions secrets 中配置：
+
+- `DOCKERHUB_USERNAME`：有权推送 `crossdesk/ubuntu20.04` 的 Docker Hub 用户名
+- `DOCKERHUB_TOKEN`：该用户的 Docker Hub access token
+
+工作流文件进入默认分支后，也可以从 Actions 页面手动运行。为了避免首次发布
+新 tag 时应用构建先于镜像完成，常规 `build.yml` 不响应
+`ci/linux-build-image` 分支的 push。第一次启用时，应先推送该分支并等待镜像
+发布成功，再把应用构建工作流的修改合并到 `main`。
+
+## 更新依赖
+
+修改 Dockerfile、xmake 清单、本地包配方或子模块中的包配方后，推送该分支即可。
+升级工具链时应同时修改 Dockerfile 的版本参数、工作流中的 `STACK_TAG`，以及
+常规构建工作流引用的镜像 tag。

docker/linux-build/install-pipewire-sdk.sh

@@ -0,0 +1,55 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+PIPEWIRE_VERSION="0.3.48"
+PIPEWIRE_ARCHIVE_SHA256="0d218be86b3d2b548c06259c47ad8d110ee1c09f071e17c4393eeef5c880fa6f"
+INSTALL_PREFIX="${1:-/opt/crossdesk-pipewire-sdk}"
+IFS='.' read -r PIPEWIRE_VERSION_MAJOR PIPEWIRE_VERSION_MINOR \
+    PIPEWIRE_VERSION_MICRO <<< "${PIPEWIRE_VERSION}"
+
+if [[ "${INSTALL_PREFIX}" != /* ]]; then
+    echo "Install prefix must be an absolute path: ${INSTALL_PREFIX}" >&2
+    exit 2
+fi
+
+WORK_DIR="$(mktemp -d "${TMPDIR:-/tmp}/crossdesk-pipewire-sdk.XXXXXX")"
+trap 'rm -rf "${WORK_DIR}"' EXIT
+
+ARCHIVE_PATH="${WORK_DIR}/pipewire-${PIPEWIRE_VERSION}.tar.gz"
+SOURCE_DIR="${WORK_DIR}/pipewire-${PIPEWIRE_VERSION}"
+ARCHIVE_URL="https://gitlab.freedesktop.org/pipewire/pipewire/-/archive/${PIPEWIRE_VERSION}/pipewire-${PIPEWIRE_VERSION}.tar.gz"
+
+curl --proto '=https' --tlsv1.2 --fail --silent --show-error --location \
+    --retry 3 "${ARCHIVE_URL}" -o "${ARCHIVE_PATH}"
+echo "${PIPEWIRE_ARCHIVE_SHA256}  ${ARCHIVE_PATH}" | sha256sum --check -
+tar -xzf "${ARCHIVE_PATH}" -C "${WORK_DIR}"
+
+PIPEWIRE_INCLUDE_DIR="${INSTALL_PREFIX}/include/pipewire-0.3/pipewire"
+SPA_INCLUDE_DIR="${INSTALL_PREFIX}/include/spa-0.2/spa"
+
+while IFS= read -r -d '' header_path; do
+    relative_path="${header_path#${SOURCE_DIR}/src/pipewire/}"
+    install -D -m 0644 "${header_path}" \
+        "${PIPEWIRE_INCLUDE_DIR}/${relative_path}"
+done < <(find "${SOURCE_DIR}/src/pipewire" -type f -name '*.h' -print0)
+
+while IFS= read -r -d '' header_path; do
+    relative_path="${header_path#${SOURCE_DIR}/spa/include/spa/}"
+    install -D -m 0644 "${header_path}" \
+        "${SPA_INCLUDE_DIR}/${relative_path}"
+done < <(find "${SOURCE_DIR}/spa/include/spa" -type f -name '*.h' -print0)
+
+sed \
+    -e "s/@PIPEWIRE_VERSION_MAJOR@/${PIPEWIRE_VERSION_MAJOR}/g" \
+    -e "s/@PIPEWIRE_VERSION_MINOR@/${PIPEWIRE_VERSION_MINOR}/g" \
+    -e "s/@PIPEWIRE_VERSION_MICRO@/${PIPEWIRE_VERSION_MICRO}/g" \
+    -e 's/@PIPEWIRE_API_VERSION@/"0.3"/g' \
+    "${SOURCE_DIR}/src/pipewire/version.h.in" \
+    > "${PIPEWIRE_INCLUDE_DIR}/version.h"
+chmod 0644 "${PIPEWIRE_INCLUDE_DIR}/version.h"
+
+test -f "${PIPEWIRE_INCLUDE_DIR}/pipewire.h"
+test -f "${PIPEWIRE_INCLUDE_DIR}/version.h"
+test -f "${SPA_INCLUDE_DIR}/param/video/format-utils.h"
+
+echo "Installed PipeWire ${PIPEWIRE_VERSION} header SDK under ${INSTALL_PREFIX}"

docker/linux-build/verify-build-image.sh

@@ -0,0 +1,99 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+EXPECTED_ARCH="${EXPECTED_ARCH:-}"
+EXPECTED_CMAKE_VERSION="${EXPECTED_CMAKE_VERSION:-3.31.6}"
+EXPECTED_XMAKE_VERSION="${EXPECTED_XMAKE_VERSION:-3.0.9}"
+EXPECTED_RUST_VERSION="${EXPECTED_RUST_VERSION:-1.92.0}"
+BUILD_CC="${CC:-/usr/bin/gcc-10}"
+BUILD_CXX="${CXX:-/usr/bin/g++-10}"
+
+# shellcheck disable=SC1091
+source /etc/os-release
+if [[ "${ID}" != "ubuntu" || "${VERSION_ID}" != "20.04" ]]; then
+    echo "Expected Ubuntu 20.04, found ${ID:-unknown} ${VERSION_ID:-unknown}" >&2
+    exit 1
+fi
+
+GLIBC_VERSION="$(getconf GNU_LIBC_VERSION | awk '{print $2}')"
+if [[ "${GLIBC_VERSION}" != "2.31" ]]; then
+    echo "Expected glibc 2.31, found ${GLIBC_VERSION}" >&2
+    exit 1
+fi
+
+ACTUAL_ARCH="$(dpkg --print-architecture)"
+if [[ -n "${EXPECTED_ARCH}" && "${ACTUAL_ARCH}" != "${EXPECTED_ARCH}" ]]; then
+    echo "Expected architecture ${EXPECTED_ARCH}, found ${ACTUAL_ARCH}" >&2
+    exit 1
+fi
+
+XMAKE_VERSION_OUTPUT="$(xmake --version 2>&1)"
+grep -F "v${EXPECTED_XMAKE_VERSION}" <<<"${XMAKE_VERSION_OUTPUT}" >/dev/null
+rustc --version | grep -F "rustc ${EXPECTED_RUST_VERSION}" >/dev/null
+cargo --version >/dev/null
+cmake --version | grep -F "cmake version ${EXPECTED_CMAKE_VERSION}" >/dev/null
+"${BUILD_CC}" --version | grep -F 'gcc-10' >/dev/null
+"${BUILD_CXX}" --version | grep -F 'g++-10' >/dev/null
+printf '%s\n' \
+    '#include <concepts>' \
+    '#include <span>' \
+    'template <typename T> concept TestConcept = true;' \
+    'int main() {' \
+    '    int value = 0;' \
+    '    std::span<int> values(&value, 1);' \
+    '    static_assert(TestConcept<int>);' \
+    '    return values.empty();' \
+    '}' \
+    | "${BUILD_CXX}" -std=c++20 -fsyntax-only -x c++ -
+for pkg_config_package in \
+    dbus-1 \
+    libdrm \
+    xft; do
+    if ! pkg-config --exists "${pkg_config_package}"; then
+        echo "Required pkg-config package is missing: ${pkg_config_package}" >&2
+        exit 1
+    fi
+done
+
+for sdk_header in \
+    /opt/crossdesk-pipewire-sdk/include/pipewire-0.3/pipewire/pipewire.h \
+    /opt/crossdesk-pipewire-sdk/include/pipewire-0.3/pipewire/version.h \
+    /opt/crossdesk-pipewire-sdk/include/spa-0.2/spa/param/video/format-utils.h; do
+    if [[ ! -f "${sdk_header}" ]]; then
+        echo "Required PipeWire build SDK header is missing: ${sdk_header}" >&2
+        exit 1
+    fi
+done
+
+printf '%s\n' \
+    '#include <pipewire/pipewire.h>' \
+    '#include <spa/param/video/format-utils.h>' \
+    'static_assert(PW_CHECK_VERSION(0, 3, 48));' \
+    'int main() { return 0; }' \
+    | "${BUILD_CXX}" -std=c++17 -fsyntax-only -x c++ \
+        -I/opt/crossdesk-pipewire-sdk/include/pipewire-0.3 \
+        -I/opt/crossdesk-pipewire-sdk/include/spa-0.2 -
+
+for package_path in \
+    "s/slint" \
+    "l/libdatachannel" \
+    "o/openssl3" \
+    "s/spdlog"; do
+    if [[ ! -d "${XMAKE_GLOBALDIR}/.xmake/packages/${package_path}" ]]; then
+        echo "Prebuilt xmake package is missing: ${package_path}" >&2
+        exit 1
+    fi
+done
+
+if ! find "${XMAKE_GLOBALDIR}/.xmake/packages/s/slint" \
+    -type f -name 'slint-compiler*' -print -quit | grep -q .; then
+    echo "The prebuilt Slint compiler is missing" >&2
+    exit 1
+fi
+
+if [[ "${ACTUAL_ARCH}" == "amd64" && ! -f "${CUDA_PATH}/include/cuda.h" ]]; then
+    echo "The amd64 image is missing CUDA headers under ${CUDA_PATH}" >&2
+    exit 1
+fi
+
+echo "Verified CrossDesk build image: Ubuntu ${VERSION_ID}, ${ACTUAL_ARCH}, glibc ${GLIBC_VERSION}"

docker/linux-build/verify-glibc-baseline.sh

@@ -0,0 +1,64 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+if [[ $# -lt 1 || $# -gt 2 ]]; then
+    echo "Usage: $0 <ELF-file-or-directory> [maximum-glibc-version]" >&2
+    exit 2
+fi
+
+INPUT_PATH="$1"
+MAXIMUM_VERSION="${2:-2.31}"
+
+verify_elf() {
+    local elf_file="$1"
+    local version=""
+    local highest_version="none"
+    local -a required_versions=()
+
+    mapfile -t required_versions < <(
+        readelf --version-info "${elf_file}" \
+            | grep -oE 'GLIBC_[0-9]+(\.[0-9]+)+' \
+            | sed 's/^GLIBC_//' \
+            | sort -Vu \
+            || true
+    )
+
+    for version in "${required_versions[@]}"; do
+        if dpkg --compare-versions "${version}" gt "${MAXIMUM_VERSION}"; then
+            echo "${elf_file} requires GLIBC_${version}; maximum allowed is GLIBC_${MAXIMUM_VERSION}" >&2
+            return 1
+        fi
+    done
+
+    if [[ ${#required_versions[@]} -gt 0 ]]; then
+        highest_version="${required_versions[-1]}"
+    fi
+    echo "Verified ${elf_file}: highest required glibc version is ${highest_version}"
+}
+
+if [[ -f "${INPUT_PATH}" ]]; then
+    if ! readelf -h "${INPUT_PATH}" >/dev/null 2>&1; then
+        echo "Not an ELF file: ${INPUT_PATH}" >&2
+        exit 1
+    fi
+    verify_elf "${INPUT_PATH}"
+    exit 0
+fi
+
+if [[ ! -d "${INPUT_PATH}" ]]; then
+    echo "File or directory does not exist: ${INPUT_PATH}" >&2
+    exit 1
+fi
+
+ELF_COUNT=0
+while IFS= read -r -d '' candidate; do
+    if readelf -h "${candidate}" >/dev/null 2>&1; then
+        verify_elf "${candidate}"
+        ELF_COUNT=$((ELF_COUNT + 1))
+    fi
+done < <(find "${INPUT_PATH}" -type f -print0)
+
+if [[ ${ELF_COUNT} -eq 0 ]]; then
+    echo "No ELF files found under ${INPUT_PATH}" >&2
+    exit 1
+fi

scripts/linux/package_deb.sh

@@ -0,0 +1,192 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+if [[ $# -lt 3 || $# -gt 4 ]]; then
+    echo "Usage: $0 <debian-arch> <xmake-arch> <version> [extra-recommendation]" >&2
+    exit 2
+fi
+
+DEBIAN_ARCH="$1"
+XMAKE_ARCH="$2"
+INPUT_VERSION="$3"
+EXTRA_RECOMMENDATION="${4:-}"
+
+PKG_NAME="crossdesk"
+APP_NAME="CrossDesk"
+MAINTAINER="Junkun Di <junkun.di@hotmail.com>"
+DESCRIPTION="A simple cross-platform remote desktop client."
+ALSA_RUNTIME_DEP="libasound2 | libasound2t64"
+PORTAL_RUNTIME_RECOMMENDS="xdg-desktop-portal, xdg-desktop-portal-gtk | xdg-desktop-portal-kde | xdg-desktop-portal-wlr"
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+PROJECT_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
+
+normalize_app_version() {
+    local input="$1"
+    local prefix=""
+    local body="$input"
+
+    if [[ "$body" == v* ]]; then
+        prefix="v"
+        body="${body#v}"
+    fi
+
+    if [[ "$body" =~ ^([0-9]+(\.[0-9]+){1,3})-([0-9]{8})-([0-9]+)$ ]]; then
+        echo "${prefix}${BASH_REMATCH[1]}-${BASH_REMATCH[4]}-${BASH_REMATCH[3]}"
+    else
+        echo "$input"
+    fi
+}
+
+find_slint_runtime() {
+    local needed="$1"
+    local resolved=""
+
+    resolved="$(ldd "$BUILD_BINARY" 2>/dev/null | awk -v needed="$needed" \
+        '$1 == needed && $2 == "=>" && $3 ~ /^\// { print $3; exit }')"
+    if [[ -n "$resolved" && -f "$resolved" ]]; then
+        echo "$resolved"
+        return 0
+    fi
+
+    local package_roots=()
+    if [[ -n "${XMAKE_GLOBALDIR:-}" ]]; then
+        package_roots+=("$XMAKE_GLOBALDIR/.xmake/packages")
+    fi
+    package_roots+=("$HOME/.xmake/packages" "/data/.xmake/packages")
+
+    local package_root=""
+    local candidate=""
+    for package_root in "${package_roots[@]}"; do
+        [[ -d "$package_root/s/slint" ]] || continue
+        candidate="$(find "$package_root/s/slint" -path "*/lib/$needed" -print -quit 2>/dev/null || true)"
+        if [[ -n "$candidate" ]]; then
+            echo "$candidate"
+            return 0
+        fi
+    done
+
+    return 1
+}
+
+APP_VERSION="$(normalize_app_version "$INPUT_VERSION")"
+DEB_VERSION="${APP_VERSION#v}"
+if [[ ! "$DEB_VERSION" =~ ^[0-9][0-9A-Za-z.+:~_-]*$ ]]; then
+    echo "Invalid Debian version: $DEB_VERSION" >&2
+    exit 2
+fi
+
+BUILD_BINARY="$PROJECT_ROOT/build/linux/$XMAKE_ARCH/release/crossdesk"
+if [[ ! -x "$BUILD_BINARY" ]]; then
+    echo "Missing release binary: $BUILD_BINARY" >&2
+    echo "Build it first with: xmake f -m release -y && xmake b -vy crossdesk" >&2
+    exit 1
+fi
+
+for command_name in readelf ldd dpkg-deb; do
+    if ! command -v "$command_name" >/dev/null 2>&1; then
+        echo "Required packaging command is missing: $command_name" >&2
+        exit 1
+    fi
+done
+
+WORK_DIR="$(mktemp -d "${TMPDIR:-/tmp}/crossdesk-deb.XXXXXX")"
+trap 'rm -rf "$WORK_DIR"' EXIT
+
+DEB_DIR="$WORK_DIR/${PKG_NAME}-${DEB_VERSION}"
+DEBIAN_DIR="$DEB_DIR/DEBIAN"
+BIN_DIR="$DEB_DIR/usr/bin"
+PRIVATE_DIR="$DEB_DIR/usr/lib/$PKG_NAME"
+ICON_BASE_DIR="$DEB_DIR/usr/share/icons/hicolor"
+DESKTOP_DIR="$DEB_DIR/usr/share/applications"
+OUTPUT_FILE="$PROJECT_ROOT/${PKG_NAME}-linux-${DEBIAN_ARCH}-${APP_VERSION}.deb"
+
+install -d "$DEBIAN_DIR" "$BIN_DIR" "$PRIVATE_DIR" "$DESKTOP_DIR"
+install -m 0755 "$BUILD_BINARY" "$PRIVATE_DIR/crossdesk-bin"
+
+# PipeWire is deliberately optional. The Wayland capturer resolves PipeWire
+# 0.3 with dlopen() so the same package can run on Ubuntu 20.04 without the
+# runtime while using the host runtime on newer Ubuntu releases.
+if readelf -d "$BUILD_BINARY" \
+    | grep -qE 'Shared library: \[libpipewire-0\.3\.so'; then
+    echo "CrossDesk must not link directly to the optional PipeWire runtime" >&2
+    exit 1
+fi
+
+# Slint is intentionally built as a shared library. Keep that runtime private
+# to CrossDesk instead of relying on a non-existent distribution package.
+SLINT_NEEDED="$(readelf -d "$BUILD_BINARY" | sed -n \
+    's/.*Shared library: \[\(libslint_cpp[^]]*\)\].*/\1/p' | head -n 1)"
+if [[ -n "$SLINT_NEEDED" ]]; then
+    SLINT_LIBRARY="$(find_slint_runtime "$SLINT_NEEDED" || true)"
+    if [[ -z "$SLINT_LIBRARY" ]]; then
+        echo "Unable to locate the required Slint runtime: $SLINT_NEEDED" >&2
+        exit 1
+    fi
+    install -m 0755 "$SLINT_LIBRARY" "$PRIVATE_DIR/$SLINT_NEEDED"
+fi
+
+cat > "$BIN_DIR/$PKG_NAME" <<'EOF'
+#!/bin/sh
+private_lib_dir="/usr/lib/crossdesk"
+if [ -n "${LD_LIBRARY_PATH:-}" ]; then
+    export LD_LIBRARY_PATH="$private_lib_dir:$LD_LIBRARY_PATH"
+else
+    export LD_LIBRARY_PATH="$private_lib_dir"
+fi
+exec /usr/lib/crossdesk/crossdesk-bin "$@"
+EOF
+chmod 0755 "$BIN_DIR/$PKG_NAME"
+ln -s "$PKG_NAME" "$BIN_DIR/$APP_NAME"
+
+for size in 16 24 32 48 64 96 128 256; do
+    install -d "$ICON_BASE_DIR/${size}x${size}/apps"
+    install -m 0644 "$PROJECT_ROOT/icons/linux/crossdesk_${size}x${size}.png" \
+        "$ICON_BASE_DIR/${size}x${size}/apps/${PKG_NAME}.png"
+done
+
+RECOMMENDS="$PORTAL_RUNTIME_RECOMMENDS"
+if [[ -n "$EXTRA_RECOMMENDATION" ]]; then
+    RECOMMENDS="$RECOMMENDS, $EXTRA_RECOMMENDATION"
+fi
+
+cat > "$DEBIAN_DIR/control" <<EOF
+Package: $PKG_NAME
+Version: $DEB_VERSION
+Architecture: $DEBIAN_ARCH
+Maintainer: $MAINTAINER
+Description: $DESCRIPTION
+Depends: libc6 (>= 2.31), libstdc++6 (>= 10), libx11-6, libxext6,
+ libxrender1, libxft2, libxrandr2, libxfixes3, libxcb1, libxcb-randr0,
+ libxcb-xtest0, libxcb-xinerama0, libxcb-shape0, libxcb-xkb1,
+ libxcb-xfixes0, libxv1, libxtst6, $ALSA_RUNTIME_DEP, libsndio7.0,
+ libxcb-shm0, libpulse0, libdrm2, libdbus-1-3
+Recommends: $RECOMMENDS
+Priority: optional
+Section: utils
+EOF
+
+cat > "$DESKTOP_DIR/$PKG_NAME.desktop" <<EOF
+[Desktop Entry]
+Version=$DEB_VERSION
+Name=$APP_NAME
+Comment=$DESCRIPTION
+Exec=/usr/bin/$PKG_NAME
+Icon=$PKG_NAME
+Terminal=false
+Type=Application
+Categories=Utility;
+EOF
+
+rm -f "$OUTPUT_FILE"
+dpkg-deb --root-owner-group --build "$DEB_DIR" "$OUTPUT_FILE"
+dpkg-deb --info "$OUTPUT_FILE" >/dev/null
+dpkg-deb --contents "$OUTPUT_FILE" > "$WORK_DIR/package-contents.txt"
+
+if [[ -n "$SLINT_NEEDED" ]] && \
+   ! grep -q "usr/lib/$PKG_NAME/$SLINT_NEEDED" "$WORK_DIR/package-contents.txt"; then
+    echo "Packaged artifact is missing $SLINT_NEEDED" >&2
+    exit 1
+fi
+
+echo "Deb package created: $OUTPUT_FILE"

scripts/linux/pkg_amd64.sh

@@ -1,116 +1,11 @@
-#!/bin/bash
+#!/usr/bin/env bash
-set -e
+set -euo pipefail
 
-PKG_NAME="crossdesk"
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-APP_NAME="CrossDesk"
 
-ARCHITECTURE="amd64"
+if [[ $# -ne 1 ]]; then
-MAINTAINER="Junkun Di <junkun.di@hotmail.com>"
+    echo "Usage: $0 <version>" >&2
-DESCRIPTION="A simple cross-platform remote desktop client."
+    exit 2
-ALSA_RUNTIME_DEP="libasound2 | libasound2t64"
-PORTAL_RUNTIME_RECOMMENDS="xdg-desktop-portal, xdg-desktop-portal-gtk | xdg-desktop-portal-kde | xdg-desktop-portal-wlr"
-
-normalize_app_version() {
-    local input="$1"
-    local prefix=""
-    local body="$input"
-
-    if [[ "$body" == v* ]]; then
-        prefix="v"
-        body="${body#v}"
 fi
 
-    if [[ "$body" =~ ^([0-9]+(\.[0-9]+){1,3})-([0-9]{8})-([0-9]+)$ ]]; then
+exec bash "$SCRIPT_DIR/package_deb.sh" amd64 x86_64 "$1" nvidia-cuda-toolkit
-        echo "${prefix}${BASH_REMATCH[1]}-${BASH_REMATCH[4]}-${BASH_REMATCH[3]}"
-    else
-        echo "$input"
-    fi
-}
-
-APP_VERSION="$(normalize_app_version "$1")"
-
-# Remove 'v' prefix from version for Debian package (Debian version must start with digit)
-DEB_VERSION="${APP_VERSION#v}"
-
-DEB_DIR="${PKG_NAME}-${DEB_VERSION}"
-DEBIAN_DIR="$DEB_DIR/DEBIAN"
-BIN_DIR="$DEB_DIR/usr/bin"
-ICON_BASE_DIR="$DEB_DIR/usr/share/icons/hicolor"
-DESKTOP_DIR="$DEB_DIR/usr/share/applications"
-
-rm -rf "$DEB_DIR"
-
-mkdir -p "$DEBIAN_DIR" "$BIN_DIR" "$DESKTOP_DIR"
-
-cp build/linux/x86_64/release/crossdesk "$BIN_DIR/$PKG_NAME"
-chmod +x "$BIN_DIR/$PKG_NAME"
-
-ln -s "$PKG_NAME" "$BIN_DIR/$APP_NAME"
-
-for size in 16 24 32 48 64 96 128 256; do
-    mkdir -p "$ICON_BASE_DIR/${size}x${size}/apps"
-    cp "icons/linux/crossdesk_${size}x${size}.png" \
-       "$ICON_BASE_DIR/${size}x${size}/apps/${PKG_NAME}.png"
-done
-
-cat > "$DEBIAN_DIR/control" << EOF
-Package: $PKG_NAME
-Version: $DEB_VERSION
-Architecture: $ARCHITECTURE
-Maintainer: $MAINTAINER
-Description: $DESCRIPTION
-Depends: libc6 (>= 2.29), libstdc++6 (>= 9), libx11-6, libxcb1,
- libxcb-randr0, libxcb-xtest0, libxcb-xinerama0, libxcb-shape0,
- libxcb-xkb1, libxcb-xfixes0, libxv1, libxtst6, $ALSA_RUNTIME_DEP,
- libsndio7.0, libxcb-shm0, libpulse0, libdrm2, libdbus-1-3
-Recommends: $PORTAL_RUNTIME_RECOMMENDS, nvidia-cuda-toolkit
-Priority: optional
-Section: utils
-EOF
-
-cat > "$DESKTOP_DIR/$PKG_NAME.desktop" << EOF
-[Desktop Entry]
-Version=$DEB_VERSION
-Name=$APP_NAME
-Comment=$DESCRIPTION
-Exec=/usr/bin/$PKG_NAME
-Icon=$PKG_NAME
-Terminal=false
-Type=Application
-Categories=Utility;
-EOF
-
-cat > "$DEBIAN_DIR/postrm" << EOF
-#!/bin/bash
-set -e
-
-if [ "\$1" = "remove" ] || [ "\$1" = "purge" ]; then
-    rm -f /usr/bin/$PKG_NAME || true
-    rm -f /usr/bin/$APP_NAME || true
-    rm -f /usr/share/applications/$PKG_NAME.desktop || true
-    for size in 16 24 32 48 64 96 128 256; do
-        rm -f /usr/share/icons/hicolor/\${size}x\${size}/apps/$PKG_NAME.png || true
-    done
-fi
-
-exit 0
-EOF
-chmod +x "$DEBIAN_DIR/postrm"
-
-cat > "$DEBIAN_DIR/postinst" << 'EOF'
-#!/bin/bash
-set -e
-
-exit 0
-EOF
-
-chmod +x "$DEBIAN_DIR/postinst"
-
-dpkg-deb --build "$DEB_DIR"
-
-OUTPUT_FILE="${PKG_NAME}-linux-${ARCHITECTURE}-${APP_VERSION}.deb"
-mv "$DEB_DIR.deb" "$OUTPUT_FILE"
-
-rm -rf "$DEB_DIR"
-
-echo "✅ Deb package created: $OUTPUT_FILE"

scripts/linux/pkg_arm64.sh

@@ -1,116 +1,11 @@
-#!/bin/bash
+#!/usr/bin/env bash
-set -e
+set -euo pipefail
 
-PKG_NAME="crossdesk"
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-APP_NAME="CrossDesk"
 
-ARCHITECTURE="arm64"
+if [[ $# -ne 1 ]]; then
-MAINTAINER="Junkun Di <junkun.di@hotmail.com>"
+    echo "Usage: $0 <version>" >&2
-DESCRIPTION="A simple cross-platform remote desktop client."
+    exit 2
-ALSA_RUNTIME_DEP="libasound2 | libasound2t64"
-PORTAL_RUNTIME_RECOMMENDS="xdg-desktop-portal, xdg-desktop-portal-gtk | xdg-desktop-portal-kde | xdg-desktop-portal-wlr"
-
-normalize_app_version() {
-    local input="$1"
-    local prefix=""
-    local body="$input"
-
-    if [[ "$body" == v* ]]; then
-        prefix="v"
-        body="${body#v}"
 fi
 
-    if [[ "$body" =~ ^([0-9]+(\.[0-9]+){1,3})-([0-9]{8})-([0-9]+)$ ]]; then
+exec bash "$SCRIPT_DIR/package_deb.sh" arm64 arm64 "$1"
-        echo "${prefix}${BASH_REMATCH[1]}-${BASH_REMATCH[4]}-${BASH_REMATCH[3]}"
-    else
-        echo "$input"
-    fi
-}
-
-APP_VERSION="$(normalize_app_version "$1")"
-
-# Remove 'v' prefix from version for Debian package (Debian version must start with digit)
-DEB_VERSION="${APP_VERSION#v}"
-
-DEB_DIR="${PKG_NAME}-${DEB_VERSION}"
-DEBIAN_DIR="$DEB_DIR/DEBIAN"
-BIN_DIR="$DEB_DIR/usr/bin"
-ICON_BASE_DIR="$DEB_DIR/usr/share/icons/hicolor"
-DESKTOP_DIR="$DEB_DIR/usr/share/applications"
-
-rm -rf "$DEB_DIR"
-
-mkdir -p "$DEBIAN_DIR" "$BIN_DIR" "$DESKTOP_DIR"
-
-cp build/linux/arm64/release/crossdesk "$BIN_DIR"
-chmod +x "$BIN_DIR/$PKG_NAME"
-
-ln -s "$PKG_NAME" "$BIN_DIR/$APP_NAME"
-
-for size in 16 24 32 48 64 96 128 256; do
-    mkdir -p "$ICON_BASE_DIR/${size}x${size}/apps"
-    cp "icons/linux/crossdesk_${size}x${size}.png" \
-       "$ICON_BASE_DIR/${size}x${size}/apps/${PKG_NAME}.png"
-done
-
-cat > "$DEBIAN_DIR/control" << EOF
-Package: $PKG_NAME
-Version: $DEB_VERSION
-Architecture: $ARCHITECTURE
-Maintainer: $MAINTAINER
-Description: $DESCRIPTION
-Depends: libc6 (>= 2.29), libstdc++6 (>= 9), libx11-6, libxcb1,
- libxcb-randr0, libxcb-xtest0, libxcb-xinerama0, libxcb-shape0,
- libxcb-xkb1, libxcb-xfixes0, libxv1, libxtst6, $ALSA_RUNTIME_DEP,
- libsndio7.0, libxcb-shm0, libpulse0, libdrm2, libdbus-1-3
-Recommends: $PORTAL_RUNTIME_RECOMMENDS
-Priority: optional
-Section: utils
-EOF
-
-cat > "$DESKTOP_DIR/$PKG_NAME.desktop" << EOF
-[Desktop Entry]
-Version=$DEB_VERSION
-Name=$APP_NAME
-Comment=$DESCRIPTION
-Exec=/usr/bin/$PKG_NAME
-Icon=$PKG_NAME
-Terminal=false
-Type=Application
-Categories=Utility;
-EOF
-
-cat > "$DEBIAN_DIR/postrm" << EOF
-#!/bin/bash
-set -e
-
-if [ "\$1" = "remove" ] || [ "\$1" = "purge" ]; then
-    rm -f /usr/bin/$PKG_NAME || true
-    rm -f /usr/bin/$APP_NAME || true
-    rm -f /usr/share/applications/$PKG_NAME.desktop || true
-    for size in 16 24 32 48 64 96 128 256; do
-        rm -f /usr/share/icons/hicolor/\${size}x\${size}/apps/$PKG_NAME.png || true
-    done
-fi
-
-exit 0
-EOF
-chmod +x "$DEBIAN_DIR/postrm"
-
-cat > "$DEBIAN_DIR/postinst" << 'EOF'
-#!/bin/bash
-set -e
-
-exit 0
-EOF
-
-chmod +x "$DEBIAN_DIR/postinst"
-
-dpkg-deb --build "$DEB_DIR"
-
-OUTPUT_FILE="crossdesk-linux-arm64-$APP_VERSION.deb"
-mv "$DEB_DIR.deb" "$OUTPUT_FILE"
-
-rm -rf "$DEB_DIR"
-
-echo "✅ Deb package created: $OUTPUT_FILE"

scripts/macosx/bundle_app.sh

@@ -0,0 +1,131 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+if [[ $# -ne 2 ]]; then
+    echo "Usage: $0 <app-bundle> <expected-architecture>" >&2
+    exit 2
+fi
+
+APP_BUNDLE="$1"
+EXPECTED_ARCH="$2"
+APP_EXECUTABLE="$APP_BUNDLE/Contents/MacOS/CrossDesk"
+FRAMEWORKS_DIR="$APP_BUNDLE/Contents/Frameworks"
+
+for command_name in codesign install_name_tool lipo otool; do
+    if ! command -v "$command_name" >/dev/null 2>&1; then
+        echo "Required bundling command is missing: $command_name" >&2
+        exit 1
+    fi
+done
+
+if [[ ! -x "$APP_EXECUTABLE" ]]; then
+    echo "Missing app executable: $APP_EXECUTABLE" >&2
+    exit 1
+fi
+
+if ! lipo "$APP_EXECUTABLE" -verify_arch "$EXPECTED_ARCH" >/dev/null 2>&1; then
+    echo "App executable does not contain the expected architecture: $EXPECTED_ARCH" >&2
+    lipo -archs "$APP_EXECUTABLE" >&2 || true
+    exit 1
+fi
+
+SLINT_REFERENCE="$(otool -L "$APP_EXECUTABLE" | awk \
+    '$1 ~ /(^|\/)libslint_cpp[^\/[:space:]]*\.dylib$/ { print $1; exit }')"
+if [[ -z "$SLINT_REFERENCE" ]]; then
+    echo "The app executable does not reference the Slint runtime" >&2
+    exit 1
+fi
+
+SLINT_NAME="${SLINT_REFERENCE##*/}"
+SLINT_CURRENT_VERSION="$(otool -L "$APP_EXECUTABLE" | awk -v dependency="$SLINT_REFERENCE" '
+    $1 == dependency {
+        for (i = 1; i <= NF; ++i) {
+            if ($i == "current") {
+                version = $(i + 2)
+                gsub(/[),]/, "", version)
+                print version
+                exit
+            }
+        }
+    }')"
+
+slint_runtime_version() {
+    local library="$1"
+    otool -L "$library" | awk -v name="$SLINT_NAME" '
+        index($1, "/" name) || $1 == "@rpath/" name {
+            for (i = 1; i <= NF; ++i) {
+                if ($i == "current") {
+                    version = $(i + 2)
+                    gsub(/[),]/, "", version)
+                    print version
+                    exit
+                }
+            }
+        }'
+}
+
+find_slint_runtime() {
+    local candidate=""
+    local candidate_version=""
+    local package_root=""
+    local package_roots=()
+
+    if [[ "$SLINT_REFERENCE" == /* && -f "$SLINT_REFERENCE" ]]; then
+        if lipo "$SLINT_REFERENCE" -verify_arch "$EXPECTED_ARCH" >/dev/null 2>&1; then
+            echo "$SLINT_REFERENCE"
+            return 0
+        fi
+    fi
+
+    if [[ -n "${XMAKE_GLOBALDIR:-}" ]]; then
+        package_roots+=("$XMAKE_GLOBALDIR/.xmake/packages")
+    fi
+    package_roots+=("$HOME/.xmake/packages" "/data/.xmake/packages")
+
+    for package_root in "${package_roots[@]}"; do
+        [[ -d "$package_root/s/slint" ]] || continue
+        while IFS= read -r candidate; do
+            if ! lipo "$candidate" -verify_arch "$EXPECTED_ARCH" >/dev/null 2>&1; then
+                continue
+            fi
+
+            candidate_version="$(slint_runtime_version "$candidate")"
+            if [[ -n "$SLINT_CURRENT_VERSION" && "$candidate_version" != "$SLINT_CURRENT_VERSION" ]]; then
+                continue
+            fi
+
+            echo "$candidate"
+            return 0
+        done < <(find "$package_root/s/slint" -type f -path "*/lib/$SLINT_NAME" -print 2>/dev/null)
+    done
+
+    return 1
+}
+
+SLINT_LIBRARY="$(find_slint_runtime || true)"
+if [[ -z "$SLINT_LIBRARY" ]]; then
+    echo "Unable to locate $SLINT_NAME for $EXPECTED_ARCH (current version $SLINT_CURRENT_VERSION)" >&2
+    exit 1
+fi
+
+install -d "$FRAMEWORKS_DIR"
+install -m 0755 "$SLINT_LIBRARY" "$FRAMEWORKS_DIR/$SLINT_NAME"
+
+install_name_tool -id "@rpath/$SLINT_NAME" "$FRAMEWORKS_DIR/$SLINT_NAME"
+if [[ "$SLINT_REFERENCE" != "@rpath/$SLINT_NAME" ]]; then
+    install_name_tool -change "$SLINT_REFERENCE" "@rpath/$SLINT_NAME" "$APP_EXECUTABLE"
+fi
+
+if ! otool -l "$APP_EXECUTABLE" | awk '
+    $1 == "cmd" { in_rpath = ($2 == "LC_RPATH"); next }
+    in_rpath && $1 == "path" && $2 == "@executable_path/../Frameworks" { found = 1 }
+    END { exit(found ? 0 : 1) }'; then
+    install_name_tool -add_rpath "@executable_path/../Frameworks" "$APP_EXECUTABLE"
+fi
+
+# install_name_tool invalidates the linker's ad-hoc signature. Sign nested code
+# first, then seal the complete app bundle so local packages remain launchable.
+codesign --force --sign - "$FRAMEWORKS_DIR/$SLINT_NAME"
+codesign --force --deep --sign - "$APP_BUNDLE"
+
+echo "Bundled Slint runtime: $SLINT_LIBRARY"

scripts/macosx/pkg_arm64.sh

@@ -1,14 +1,16 @@
-#!/bin/bash
+#!/usr/bin/env bash
-set -e
+set -euo pipefail
 
 APP_NAME="crossdesk"
 APP_NAME_UPPER="CrossDesk"
 EXECUTABLE_PATH="./build/macosx/arm64/release/crossdesk"
 PLATFORM="macos"
 ARCH="arm64"
+BINARY_ARCH="arm64"
 IDENTIFIER="cn.crossdesk.app"
 ICON_PATH="icons/macos/crossdesk.icns"
-MACOS_MIN_VERSION="10.12"
+MACOS_MIN_VERSION="14.0"
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 
 normalize_app_version() {
     local input="$1"
@@ -95,6 +97,9 @@ EOF
 xattr -cr "${APP_BUNDLE}" 2>/dev/null || true
 find "${APP_BUNDLE}" -name '._*' -delete
 
+"${SCRIPT_DIR}/bundle_app.sh" "${APP_BUNDLE}" "${BINARY_ARCH}"
+"${SCRIPT_DIR}/verify_app.sh" "${APP_BUNDLE}" "${BINARY_ARCH}"
+
 echo ".app created successfully."
 
 mkdir -p build_pkg_scripts

scripts/macosx/pkg_x64.sh

@@ -1,14 +1,16 @@
-#!/bin/bash
+#!/usr/bin/env bash
-set -e
+set -euo pipefail
 
 APP_NAME="crossdesk"
 APP_NAME_UPPER="CrossDesk"
 EXECUTABLE_PATH="build/macosx/x86_64/release/crossdesk"
 PLATFORM="macos"
 ARCH="x64"
+BINARY_ARCH="x86_64"
 IDENTIFIER="cn.crossdesk.app"
 ICON_PATH="icons/macos/crossdesk.icns"
-MACOS_MIN_VERSION="10.12"
+MACOS_MIN_VERSION="14.0"
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 
 normalize_app_version() {
     local input="$1"
@@ -95,6 +97,9 @@ EOF
 xattr -cr "${APP_BUNDLE}" 2>/dev/null || true
 find "${APP_BUNDLE}" -name '._*' -delete
 
+"${SCRIPT_DIR}/bundle_app.sh" "${APP_BUNDLE}" "${BINARY_ARCH}"
+"${SCRIPT_DIR}/verify_app.sh" "${APP_BUNDLE}" "${BINARY_ARCH}"
+
 echo ".app created successfully."
 
 mkdir -p build_pkg_scripts

scripts/macosx/verify_app.sh

@@ -0,0 +1,117 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+if [[ $# -lt 2 || $# -gt 3 ]]; then
+    echo "Usage: $0 <app-bundle> <expected-architecture> [expected-sdk-version]" >&2
+    exit 2
+fi
+
+APP_BUNDLE="$1"
+EXPECTED_ARCH="$2"
+EXPECTED_SDK_VERSION="${3:-}"
+APP_EXECUTABLE="$APP_BUNDLE/Contents/MacOS/CrossDesk"
+FRAMEWORKS_DIR="$APP_BUNDLE/Contents/Frameworks"
+INFO_PLIST="$APP_BUNDLE/Contents/Info.plist"
+
+if [[ ! -x "$APP_EXECUTABLE" ]]; then
+    echo "Missing app executable: $APP_EXECUTABLE" >&2
+    exit 1
+fi
+
+if ! lipo "$APP_EXECUTABLE" -verify_arch "$EXPECTED_ARCH" >/dev/null 2>&1; then
+    echo "Unexpected app architecture; expected $EXPECTED_ARCH" >&2
+    lipo -archs "$APP_EXECUTABLE" >&2 || true
+    exit 1
+fi
+
+if ! otool -l "$APP_EXECUTABLE" | awk '
+    $1 == "cmd" { in_rpath = ($2 == "LC_RPATH"); next }
+    in_rpath && $1 == "path" && $2 == "@executable_path/../Frameworks" { found = 1 }
+    END { exit(found ? 0 : 1) }'; then
+    echo "Missing app rpath: @executable_path/../Frameworks" >&2
+    exit 1
+fi
+
+verify_dependencies() {
+    local macho="$1"
+    local dependency=""
+    local relative_path=""
+
+    while IFS= read -r dependency; do
+        case "$dependency" in
+            /System/Library/*|/usr/lib/*)
+                ;;
+            @rpath/*)
+                relative_path="${dependency#@rpath/}"
+                if [[ ! -f "$FRAMEWORKS_DIR/$relative_path" ]]; then
+                    echo "Unbundled dependency in $macho: $dependency" >&2
+                    return 1
+                fi
+                ;;
+            @executable_path/../Frameworks/*)
+                relative_path="${dependency#@executable_path/../Frameworks/}"
+                if [[ ! -f "$FRAMEWORKS_DIR/$relative_path" ]]; then
+                    echo "Unbundled dependency in $macho: $dependency" >&2
+                    return 1
+                fi
+                ;;
+            @loader_path/*)
+                relative_path="${dependency#@loader_path/}"
+                if [[ ! -f "$(dirname "$macho")/$relative_path" ]]; then
+                    echo "Unbundled dependency in $macho: $dependency" >&2
+                    return 1
+                fi
+                ;;
+            *)
+                echo "External non-system dependency in $macho: $dependency" >&2
+                return 1
+                ;;
+        esac
+    done < <(otool -L "$macho" | tail -n +2 | awk '{ print $1 }')
+}
+
+verify_dependencies "$APP_EXECUTABLE"
+
+SLINT_LIBRARY="$(find "$FRAMEWORKS_DIR" -maxdepth 1 -type f -name 'libslint_cpp*.dylib' -print -quit 2>/dev/null || true)"
+if [[ -z "$SLINT_LIBRARY" ]]; then
+    echo "The packaged app does not contain libslint_cpp.dylib" >&2
+    exit 1
+fi
+
+if ! lipo "$SLINT_LIBRARY" -verify_arch "$EXPECTED_ARCH" >/dev/null 2>&1; then
+    echo "Unexpected Slint runtime architecture; expected $EXPECTED_ARCH" >&2
+    lipo -archs "$SLINT_LIBRARY" >&2 || true
+    exit 1
+fi
+verify_dependencies "$SLINT_LIBRARY"
+
+PLIST_MIN_VERSION="$(/usr/libexec/PlistBuddy -c 'Print :LSMinimumSystemVersion' "$INFO_PLIST")"
+BINARY_MIN_VERSION="$(otool -l "$APP_EXECUTABLE" | awk '
+    $1 == "cmd" { build_version = ($2 == "LC_BUILD_VERSION"); version_min = ($2 == "LC_VERSION_MIN_MACOSX"); next }
+    build_version && $1 == "minos" { print $2; exit }
+    version_min && $1 == "version" { print $2; exit }')"
+if [[ -z "$BINARY_MIN_VERSION" || "$PLIST_MIN_VERSION" != "$BINARY_MIN_VERSION" ]]; then
+    echo "Minimum macOS version mismatch: plist=$PLIST_MIN_VERSION binary=${BINARY_MIN_VERSION:-unknown}" >&2
+    exit 1
+fi
+
+if [[ -n "$EXPECTED_SDK_VERSION" ]]; then
+    verify_sdk_version() {
+        local macho="$1"
+        local actual_sdk=""
+        actual_sdk="$(otool -l "$macho" | awk '
+            $1 == "cmd" { build_version = ($2 == "LC_BUILD_VERSION"); next }
+            build_version && $1 == "sdk" { print $2; exit }')"
+        if [[ "$actual_sdk" != "$EXPECTED_SDK_VERSION" ]]; then
+            echo "Unexpected macOS SDK in $macho: expected $EXPECTED_SDK_VERSION, got ${actual_sdk:-unknown}" >&2
+            return 1
+        fi
+    }
+
+    verify_sdk_version "$APP_EXECUTABLE"
+    verify_sdk_version "$SLINT_LIBRARY"
+fi
+
+codesign --verify --deep --strict --verbose=2 "$APP_BUNDLE"
+
+echo "Verified $APP_BUNDLE ($EXPECTED_ARCH, macOS $BINARY_MIN_VERSION+)"

scripts/windows/crossdesk.rc

@@ -9,3 +9,8 @@ CREATEPROCESS_MANIFEST_RESOURCE_ID RT_MANIFEST "crossdesk_debug.manifest"
 #else
 CREATEPROCESS_MANIFEST_RESOURCE_ID RT_MANIFEST "crossdesk.manifest"
 #endif
+
+#define CROSSDESK_FILE_DESCRIPTION "CrossDesk"
+#define CROSSDESK_ORIGINAL_FILENAME "CrossDesk.exe"
+
+#include "version_info.rcinc"

scripts/windows/crossdesk_portable.rc

@@ -6,3 +6,8 @@ IDI_ICON1 ICON "..\\..\\icons\\windows\\crossdesk.ico"
 #define RT_MANIFEST 24
 
 CREATEPROCESS_MANIFEST_RESOURCE_ID RT_MANIFEST "crossdesk_portable.manifest"
+
+#define CROSSDESK_FILE_DESCRIPTION "CrossDesk Portable"
+#define CROSSDESK_ORIGINAL_FILENAME "CrossDesk.exe"
+
+#include "version_info.rcinc"

scripts/windows/crossdesk_service.rc

@@ -0,0 +1,4 @@
+#define CROSSDESK_FILE_DESCRIPTION "CrossDesk Service"
+#define CROSSDESK_ORIGINAL_FILENAME "crossdesk_service.exe"
+
+#include "version_info.rcinc"

scripts/windows/crossdesk_session_helper.rc

@@ -0,0 +1,18 @@
+// Session helper icon and manifest resources.
+IDI_ICON1 ICON "..\\..\\icons\\windows\\crossdesk.ico"
+
+#define CREATEPROCESS_MANIFEST_RESOURCE_ID 1
+#define RT_MANIFEST 24
+
+#ifdef CROSSDESK_PORTABLE
+CREATEPROCESS_MANIFEST_RESOURCE_ID RT_MANIFEST "crossdesk_portable.manifest"
+#elif defined(CROSSDESK_DEBUG)
+CREATEPROCESS_MANIFEST_RESOURCE_ID RT_MANIFEST "crossdesk_debug.manifest"
+#else
+CREATEPROCESS_MANIFEST_RESOURCE_ID RT_MANIFEST "crossdesk.manifest"
+#endif
+
+#define CROSSDESK_FILE_DESCRIPTION "CrossDesk Session Helper"
+#define CROSSDESK_ORIGINAL_FILENAME "crossdesk_session_helper.exe"
+
+#include "version_info.rcinc"

scripts/windows/nsis_script.nsi

@@ -4,6 +4,7 @@
 ; Installer initial constants
 !define PRODUCT_NAME "CrossDesk"
 !define PRODUCT_VERSION "${VERSION}"
+!define PRODUCT_VERSION_NUMERIC "${VERSION_NUMERIC}"
 !define PRODUCT_PUBLISHER "CrossDesk"
 !define PRODUCT_WEB_SITE "https://www.crossdesk.cn/"
 !define APP_NAME "CrossDesk"
@@ -41,6 +42,14 @@ RequestExecutionLevel admin
 
 Name "${PRODUCT_NAME} ${PRODUCT_VERSION}"
 OutFile "crossdesk-win-x64-${PRODUCT_VERSION}.exe"
+VIProductVersion "${PRODUCT_VERSION_NUMERIC}"
+VIAddVersionKey /LANG=2052 "CompanyName" "CrossDesk"
+VIAddVersionKey /LANG=2052 "FileDescription" "CrossDesk Installer"
+VIAddVersionKey /LANG=2052 "FileVersion" "${PRODUCT_VERSION}"
+VIAddVersionKey /LANG=2052 "LegalCopyright" "Copyright (C) CrossDesk contributors"
+VIAddVersionKey /LANG=2052 "OriginalFilename" "crossdesk-win-x64-${PRODUCT_VERSION}.exe"
+VIAddVersionKey /LANG=2052 "ProductName" "${PRODUCT_NAME}"
+VIAddVersionKey /LANG=2052 "ProductVersion" "${PRODUCT_VERSION}"
 InstallDir "$PROGRAMFILES\CrossDesk"
 InstallDirRegKey HKCU "Software\${PRODUCT_NAME}" "InstallDir"
 ShowInstDetails show

scripts/windows/pkg_x64.ps1

@@ -26,12 +26,40 @@ function Normalize-AppVersion {
   return $InputVersion
 }
 
+function Convert-To-WindowsVersion {
+  param(
+    [Parameter(Mandatory = $true)]
+    [string]$InputVersion
+  )
+
+  $body = $InputVersion -replace '^v', ''
+  $baseMatch = [regex]::Match($body, '^[0-9]+(?:\.[0-9]+){0,3}')
+  if (!$baseMatch.Success) {
+    return "0.0.0.0"
+  }
+
+  $parts = [System.Collections.Generic.List[int]]::new()
+  foreach ($part in $baseMatch.Value.Split('.')) {
+    $value = [int]$part
+    if ($value -gt 65535) {
+      $value = 0
+    }
+    $parts.Add($value)
+  }
+  while ($parts.Count -lt 4) {
+    $parts.Add(0)
+  }
+
+  return ($parts -join '.')
+}
+
 $normalizedVersion = Normalize-AppVersion -InputVersion $Version
+$windowsVersion = Convert-To-WindowsVersion -InputVersion $normalizedVersion
 $scriptDir = Split-Path -Parent $MyInvocation.MyCommand.Path
 
 Push-Location $scriptDir
 try {
-  & makensis "/DVERSION=$normalizedVersion" "nsis_script.nsi"
+  & makensis "/DVERSION=$normalizedVersion" "/DVERSION_NUMERIC=$windowsVersion" "nsis_script.nsi"
   if ($LASTEXITCODE -ne 0) {
     exit $LASTEXITCODE
   }

scripts/windows/signpath-installer.xml

@@ -0,0 +1,15 @@
+<?xml version="1.0" encoding="utf-8"?>
+<artifact-configuration xmlns="http://signpath.io/artifact-configuration/v1">
+  <parameters>
+    <parameter name="version" required="true" />
+  </parameters>
+  <pe-file path="crossdesk-win-x64-${version}.exe"
+           product-name="CrossDesk"
+           product-version="${version}"
+           file-version="${version}"
+           company-name="CrossDesk"
+           copyright="Copyright (C) CrossDesk contributors"
+           original-filename="crossdesk-win-x64-${version}.exe">
+    <authenticode-sign />
+  </pe-file>
+</artifact-configuration>

scripts/windows/version_info.rcinc

@@ -0,0 +1,54 @@
+#include <winver.h>
+
+#ifndef CROSSDESK_VERSION_STRING
+#define CROSSDESK_VERSION_STRING "0.0.0"
+#endif
+
+#ifndef CROSSDESK_VERSION_NUMERIC
+#define CROSSDESK_VERSION_NUMERIC 0,0,0,0
+#endif
+
+#ifndef CROSSDESK_FILE_DESCRIPTION
+#define CROSSDESK_FILE_DESCRIPTION "CrossDesk"
+#endif
+
+#ifndef CROSSDESK_ORIGINAL_FILENAME
+#define CROSSDESK_ORIGINAL_FILENAME "CrossDesk.exe"
+#endif
+
+#ifndef CROSSDESK_FILE_TYPE
+#define CROSSDESK_FILE_TYPE VFT_APP
+#endif
+
+VS_VERSION_INFO VERSIONINFO
+ FILEVERSION CROSSDESK_VERSION_NUMERIC
+ PRODUCTVERSION CROSSDESK_VERSION_NUMERIC
+ FILEFLAGSMASK VS_FFI_FILEFLAGSMASK
+#ifdef CROSSDESK_DEBUG
+ FILEFLAGS VS_FF_DEBUG
+#else
+ FILEFLAGS 0x0L
+#endif
+ FILEOS VOS_NT_WINDOWS32
+ FILETYPE CROSSDESK_FILE_TYPE
+ FILESUBTYPE VFT2_UNKNOWN
+BEGIN
+    BLOCK "StringFileInfo"
+    BEGIN
+        BLOCK "040904B0"
+        BEGIN
+            VALUE "CompanyName", "CrossDesk\0"
+            VALUE "FileDescription", CROSSDESK_FILE_DESCRIPTION "\0"
+            VALUE "FileVersion", CROSSDESK_VERSION_STRING "\0"
+            VALUE "InternalName", CROSSDESK_ORIGINAL_FILENAME "\0"
+            VALUE "LegalCopyright", "Copyright (C) CrossDesk contributors\0"
+            VALUE "OriginalFilename", CROSSDESK_ORIGINAL_FILENAME "\0"
+            VALUE "ProductName", "CrossDesk\0"
+            VALUE "ProductVersion", CROSSDESK_VERSION_STRING "\0"
+        END
+    END
+    BLOCK "VarFileInfo"
+    BEGIN
+        VALUE "Translation", 0x0409, 1200
+    END
+END

scripts/windows/wgc_plugin.rc

@@ -0,0 +1,5 @@
+#define CROSSDESK_FILE_DESCRIPTION "CrossDesk Windows Graphics Capture Plugin"
+#define CROSSDESK_ORIGINAL_FILENAME "wgc_plugin.dll"
+#define CROSSDESK_FILE_TYPE VFT_DLL
+
+#include "version_info.rcinc"

src/common/filesystem_utf8.h

@@ -0,0 +1,21 @@
+#ifndef CROSSDESK_COMMON_FILESYSTEM_UTF8_H_
+#define CROSSDESK_COMMON_FILESYSTEM_UTF8_H_
+
+#include <filesystem>
+#include <string>
+#include <string_view>
+
+namespace crossdesk {
+
+inline std::filesystem::path PathFromUtf8(std::string_view value) {
+#if defined(__cpp_char8_t)
+  const auto *begin = reinterpret_cast<const char8_t *>(value.data());
+  return std::filesystem::path(std::u8string(begin, begin + value.size()));
+#else
+  return std::filesystem::u8path(value.begin(), value.end());
+#endif
+}
+
+} // namespace crossdesk
+
+#endif // CROSSDESK_COMMON_FILESYSTEM_UTF8_H_

src/common/windows_input_marker.h

@@ -0,0 +1,15 @@
+#ifndef CROSSDESK_COMMON_WINDOWS_INPUT_MARKER_H_
+#define CROSSDESK_COMMON_WINDOWS_INPUT_MARKER_H_
+
+#include <cstdint>
+
+namespace crossdesk {
+
+// SendInput copies dwExtraInfo into KBDLLHOOKSTRUCT. Tag CrossDesk-generated
+// keyboard input so the controller hook can ignore only its own injections
+// while still accepting input from accessibility tools or remote sessions.
+inline constexpr std::uintptr_t kInjectedKeyboardInputMarker = 0x4353444B;
+
+}  // namespace crossdesk
+
+#endif  // CROSSDESK_COMMON_WINDOWS_INPUT_MARKER_H_

src/device_controller/keyboard/linux/keyboard_capturer.cpp

@@ -1,9 +1,14 @@
 #include "keyboard_capturer.h"
 
+#include <X11/Xlib.h>
+#include <X11/extensions/XTest.h>
+#include <X11/keysym.h>
+
 #include <errno.h>
 #include <poll.h>
 
 #include "keyboard_converter.h"
+#include "linux_evdev_keycode.h"
 #include "platform.h"
 #include "rd_log.h"
 #include "windows_key_metadata.h"
@@ -13,6 +18,40 @@ namespace crossdesk {
 static OnKeyAction g_on_key_action = nullptr;
 static void* g_user_ptr = nullptr;
 
+static KeyCode ResolveX11Keycode(Display* display, int key_code,
+                                 uint32_t scan_code, bool extended) {
+  if (!display) {
+    return 0;
+  }
+
+  const auto key_it = vkCodeToX11KeySym.find(key_code);
+  if (key_it != vkCodeToX11KeySym.end()) {
+    const KeyCode x11_keycode =
+        XKeysymToKeycode(display, static_cast<KeySym>(key_it->second));
+    if (x11_keycode != 0) {
+      return x11_keycode;
+    }
+  }
+
+  // Some controllers can preserve the physical Windows scan code even when
+  // they cannot resolve a Windows virtual-key value. Xorg's evdev keycodes use
+  // the Linux input code plus the protocol-reserved offset of 8.
+  const int evdev_keycode =
+      ResolveLinuxEvdevKeycodeFromWindowsKey(key_code, scan_code, extended);
+  if (evdev_keycode < 0) {
+    return 0;
+  }
+
+  int min_keycode = 0;
+  int max_keycode = 0;
+  XDisplayKeycodes(display, &min_keycode, &max_keycode);
+  const int x11_keycode = evdev_keycode + 8;
+  if (x11_keycode < min_keycode || x11_keycode > max_keycode) {
+    return 0;
+  }
+  return static_cast<KeyCode>(x11_keycode);
+}
+
 static KeySym NormalizeKeySym(KeySym key_sym) {
   if (key_sym >= XK_a && key_sym <= XK_z) {
     return key_sym - XK_a + XK_A;
@@ -58,7 +97,16 @@ KeyboardCapturer::KeyboardCapturer()
   display_ = XOpenDisplay(nullptr);
   if (!display_) {
     LOG_ERROR("Failed to open X display.");
+    return;
   }
+
+  int event_base = 0;
+  int error_base = 0;
+  int major_version = 0;
+  int minor_version = 0;
+  x11_xtest_available_ =
+      XTestQueryExtension(display_, &event_base, &error_base, &major_version,
+                          &minor_version) != 0;
 }
 
 KeyboardCapturer::~KeyboardCapturer() {
@@ -66,8 +114,10 @@ KeyboardCapturer::~KeyboardCapturer() {
   CleanupWaylandPortal();
 
   if (display_) {
+    std::lock_guard<std::mutex> lock(x11_injection_mutex_);
     XCloseDisplay(display_);
     display_ = nullptr;
+    x11_xtest_available_ = false;
   }
 }
 
@@ -152,8 +202,6 @@ int KeyboardCapturer::Unhook() {
 
 int KeyboardCapturer::SendKeyboardCommand(int key_code, bool is_down,
                                           uint32_t scan_code, bool extended) {
-  (void)scan_code;
-  (void)extended;
   if (IsWaylandSession()) {
     if (!use_wayland_portal_ && !wayland_init_attempted_) {
       wayland_init_attempted_ = true;
@@ -177,12 +225,33 @@ int KeyboardCapturer::SendKeyboardCommand(int key_code, bool is_down,
     return -1;
   }
 
-  if (vkCodeToX11KeySym.find(key_code) != vkCodeToX11KeySym.end()) {
+  std::lock_guard<std::mutex> lock(x11_injection_mutex_);
-    int x11_key_code = vkCodeToX11KeySym[key_code];
+  if (!x11_xtest_available_) {
-    KeyCode keycode = XKeysymToKeycode(display_, x11_key_code);
+    LOG_ERROR("XTest extension not available for keyboard injection");
-    XTestFakeKeyEvent(display_, keycode, is_down, CurrentTime);
+    return -2;
-    XFlush(display_);
   }
+
+  const KeyCode x11_keycode =
+      ResolveX11Keycode(display_, key_code, scan_code, extended);
+  if (x11_keycode == 0) {
+    LOG_WARN(
+        "Cannot map remote keyboard event to X11 keycode, vk_code={}, "
+        "scan_code={}, extended={}",
+        key_code, scan_code, extended);
+    return -3;
+  }
+
+  if (!XTestFakeKeyEvent(display_, x11_keycode, is_down, CurrentTime)) {
+    LOG_ERROR(
+        "XTest keyboard injection failed, vk_code={}, scan_code={}, "
+        "extended={}, x11_keycode={}, is_down={}",
+        key_code, scan_code, extended, static_cast<int>(x11_keycode), is_down);
+    return -4;
+  }
+
+  // Complete the request before reporting success to the keyboard-state
+  // reconciler. This also makes X11 protocol errors observable immediately.
+  XSync(display_, False);
   return 0;
 }
 }  // namespace crossdesk

src/device_controller/keyboard/linux/keyboard_capturer.h

@@ -7,13 +7,10 @@
 #ifndef _KEYBOARD_CAPTURER_H_
 #define _KEYBOARD_CAPTURER_H_
 
-#include <X11/Xlib.h>
-#include <X11/extensions/XTest.h>
-#include <X11/keysym.h>
-
 #include <atomic>
 #include <cstdint>
 #include <functional>
+#include <mutex>
 #include <string>
 #include <thread>
 
@@ -21,6 +18,7 @@
 
 struct DBusConnection;
 struct DBusMessageIter;
+struct _XDisplay;
 
 namespace crossdesk {
 
@@ -48,10 +46,12 @@ class KeyboardCapturer : public DeviceController {
                                      append_args);
 
  private:
-  Display* display_;
+  _XDisplay* display_;
-  Window root_;
+  unsigned long root_;
   std::atomic<bool> running_;
   std::thread event_thread_;
+  std::mutex x11_injection_mutex_;
+  bool x11_xtest_available_ = false;
   bool use_wayland_portal_ = false;
   bool wayland_init_attempted_ = false;
   DBusConnection* dbus_connection_ = nullptr;

src/device_controller/keyboard/linux/keyboard_capturer_wayland.cpp

@@ -5,6 +5,9 @@
 #include <map>
 
 #if defined(CROSSDESK_HAS_WAYLAND_CAPTURER) && CROSSDESK_HAS_WAYLAND_CAPTURER
+#include <X11/Xlib.h>
+#include <X11/keysym.h>
+
 #include <dbus/dbus.h>
 #endif
 
@@ -608,6 +611,7 @@ int KeyboardCapturer::SendWaylandKeyboardCommand(int key_code, bool is_down,
   // Prefer keycode injection to preserve physical-key semantics and avoid
   // implicit Shift interpretation for uppercase keysyms.
   if (display_) {
+    std::lock_guard<std::mutex> lock(x11_injection_mutex_);
     const int keysym = key_it->second;
     const KeyCode x11_keycode =
         XKeysymToKeycode(display_, static_cast<KeySym>(keysym));

src/device_controller/keyboard/mac/keyboard_capturer.cpp

@@ -1,5 +1,6 @@
 #include "keyboard_capturer.h"
 
+#include <cstdint>
 #include <unordered_map>
 
 #include "keyboard_converter.h"
@@ -10,6 +11,7 @@ namespace crossdesk {
 static OnKeyAction g_on_key_action = nullptr;
 static void* g_user_ptr = nullptr;
 static std::unordered_map<int, int> g_unmapped_keycode_to_vk;
+constexpr int64_t kCrossDeskInjectedKeyboardEvent = 0x43524f5353444553;
 
 static int VkCodeFromUnicode(UniChar ch) {
   if (ch >= 'a' && ch <= 'z') {
@@ -103,6 +105,10 @@ static int ResolveVkCodeFromMacEvent(CGEventRef event, CGKeyCode key_code,
 CGEventRef eventCallback(CGEventTapProxy proxy, CGEventType type,
                          CGEventRef event, void* userInfo) {
   (void)proxy;
+  if (CGEventGetIntegerValueField(event, kCGEventSourceUserData) ==
+      kCrossDeskInjectedKeyboardEvent) {
+    return event;
+  }
   if (!g_on_key_action) {
     return event;
   }
@@ -302,6 +308,8 @@ int KeyboardCapturer::SendKeyboardCommand(int key_code, bool is_down,
     }
 
     CGEventSetFlags(event, ToCGEventFlags(injected_flags));
+    CGEventSetIntegerValueField(event, kCGEventSourceUserData,
+                               kCrossDeskInjectedKeyboardEvent);
     CGEventPost(kCGHIDEventTap, event);
     CFRelease(event);
 
@@ -314,6 +322,8 @@ int KeyboardCapturer::SendKeyboardCommand(int key_code, bool is_down,
         LOG_ERROR("CGEventCreateKeyboardEvent failed for fn release");
         return -1;
       }
+      CGEventSetIntegerValueField(fn_release_event, kCGEventSourceUserData,
+                                 kCrossDeskInjectedKeyboardEvent);
       CGEventPost(kCGHIDEventTap, fn_release_event);
       CFRelease(fn_release_event);
     }

src/device_controller/keyboard/windows/keyboard_capturer.cpp

@@ -1,36 +1,17 @@
 #include "keyboard_capturer.h"
 
+#include <hidusage.h>
+
 #include "rd_log.h"
+#include "windows_input_marker.h"
 
 namespace crossdesk {
+namespace {
 
-static OnKeyAction g_on_key_action = nullptr;
+constexpr wchar_t kRawInputWindowClassName[] =
-static void* g_user_ptr = nullptr;
+    L"CrossDeskKeyboardRawInputWindow";
 
-static int NormalizeModifierVkCode(const KBDLLHOOKSTRUCT* kb_data) {
+bool PreferSideSpecificVkInjection(int key_code) {
-  if (kb_data == nullptr) {
-    return -1;
-  }
-
-  if (kb_data->vkCode != VK_SHIFT && kb_data->vkCode != VK_CONTROL &&
-      kb_data->vkCode != VK_MENU) {
-    return static_cast<int>(kb_data->vkCode);
-  }
-
-  UINT scan_code = static_cast<UINT>(kb_data->scanCode & 0xFF);
-  if ((kb_data->flags & LLKHF_EXTENDED) != 0) {
-    scan_code |= 0xE000;
-  }
-
-  const UINT normalized_vk = MapVirtualKeyW(scan_code, MAPVK_VSC_TO_VK_EX);
-  if (normalized_vk != 0) {
-    return static_cast<int>(normalized_vk);
-  }
-
-  return static_cast<int>(kb_data->vkCode);
-}
-
-static bool PreferSideSpecificVkInjection(int key_code) {
   switch (key_code) {
     case VK_LSHIFT:
     case VK_RSHIFT:
@@ -46,55 +27,247 @@ static bool PreferSideSpecificVkInjection(int key_code) {
   }
 }
 
-LRESULT CALLBACK KeyboardProc(int nCode, WPARAM wParam, LPARAM lParam) {
+}  // namespace
-  if (nCode == HC_ACTION && g_on_key_action) {
-    KBDLLHOOKSTRUCT* kbData = reinterpret_cast<KBDLLHOOKSTRUCT*>(lParam);
-    const int key_code = NormalizeModifierVkCode(kbData);
-
-    if (wParam == WM_KEYDOWN || wParam == WM_SYSKEYDOWN) {
-      g_on_key_action(key_code, true, kbData->scanCode,
-                      (kbData->flags & LLKHF_EXTENDED) != 0, g_user_ptr);
-    } else if (wParam == WM_KEYUP || wParam == WM_SYSKEYUP) {
-      g_on_key_action(key_code, false, kbData->scanCode,
-                      (kbData->flags & LLKHF_EXTENDED) != 0, g_user_ptr);
-    }
-    return 1;
-  }
-
-  return CallNextHookEx(NULL, nCode, wParam, lParam);
-}
 
 KeyboardCapturer::KeyboardCapturer() {}
 
-KeyboardCapturer::~KeyboardCapturer() {}
+KeyboardCapturer::~KeyboardCapturer() { Unhook(); }
 
 int KeyboardCapturer::Hook(OnKeyAction on_key_action, void* user_ptr) {
-  g_on_key_action = on_key_action;
+  if (capture_thread_.joinable()) {
-  g_user_ptr = user_ptr;
+    return 0;
+  }
 
-  keyboard_hook_ = SetWindowsHookEx(WH_KEYBOARD_LL, KeyboardProc, NULL, 0);
+  on_key_action_ = on_key_action;
-  if (!keyboard_hook_) {
+  user_ptr_ = user_ptr;
-    LOG_ERROR("Failed to install keyboard hook");
+  {
+    std::lock_guard<std::mutex> lock(capture_state_mutex_);
+    capture_thread_id_ = 0;
+    capture_start_complete_ = false;
+    capture_start_succeeded_ = false;
+  }
+
+  capture_thread_ = std::thread(&KeyboardCapturer::RawInputThreadMain, this);
+
+  std::unique_lock<std::mutex> lock(capture_state_mutex_);
+  capture_start_condition_.wait(
+      lock, [this] { return capture_start_complete_; });
+  const bool capture_started = capture_start_succeeded_;
+  lock.unlock();
+
+  if (!capture_started) {
+    if (capture_thread_.joinable()) {
+      capture_thread_.join();
+    }
+    on_key_action_ = nullptr;
+    user_ptr_ = nullptr;
     return -1;
   }
   return 0;
 }
 
 int KeyboardCapturer::Unhook() {
-  if (keyboard_hook_) {
+  DWORD capture_thread_id = 0;
-    g_on_key_action = nullptr;
+  {
-    g_user_ptr = nullptr;
+    std::lock_guard<std::mutex> lock(capture_state_mutex_);
-    UnhookWindowsHookEx(keyboard_hook_);
+    capture_thread_id = capture_thread_id_;
-    keyboard_hook_ = nullptr;
   }
+  if (capture_thread_id != 0 &&
+      !PostThreadMessageW(capture_thread_id, WM_QUIT, 0, 0)) {
+    LOG_WARN("Failed to stop keyboard raw input thread, thread_id={}, error={}",
+             capture_thread_id, GetLastError());
+  }
+  if (capture_thread_.joinable()) {
+    capture_thread_.join();
+  }
+
+  on_key_action_ = nullptr;
+  user_ptr_ = nullptr;
   return 0;
 }
 
-// apply remote keyboard commands to the local machine
+void KeyboardCapturer::RawInputThreadMain() {
+  const DWORD thread_id = GetCurrentThreadId();
+
+  MSG message{};
+  PeekMessageW(&message, nullptr, WM_USER, WM_USER, PM_NOREMOVE);
+  const bool capture_started = CreateRawInputWindow();
+  {
+    std::lock_guard<std::mutex> lock(capture_state_mutex_);
+    capture_thread_id_ = thread_id;
+    capture_start_succeeded_ = capture_started;
+    capture_start_complete_ = true;
+  }
+  capture_start_condition_.notify_one();
+
+  if (!capture_started) {
+    std::lock_guard<std::mutex> lock(capture_state_mutex_);
+    capture_thread_id_ = 0;
+    return;
+  }
+
+  LOG_INFO("Keyboard raw input capture started, thread_id={}", thread_id);
+  while (true) {
+    const BOOL get_message_result = GetMessageW(&message, nullptr, 0, 0);
+    if (get_message_result <= 0) {
+      if (get_message_result < 0) {
+        LOG_WARN("Keyboard raw input message loop failed, thread_id={}, "
+                 "error={}",
+                 thread_id, GetLastError());
+      }
+      break;
+    }
+    TranslateMessage(&message);
+    DispatchMessageW(&message);
+  }
+
+  DestroyRawInputWindow();
+  {
+    std::lock_guard<std::mutex> lock(capture_state_mutex_);
+    capture_thread_id_ = 0;
+  }
+  LOG_INFO("Keyboard raw input capture stopped, thread_id={}", thread_id);
+}
+
+bool KeyboardCapturer::CreateRawInputWindow() {
+  const HINSTANCE instance = GetModuleHandleW(nullptr);
+  WNDCLASSEXW window_class{};
+  window_class.cbSize = sizeof(window_class);
+  window_class.lpfnWndProc = &KeyboardCapturer::RawInputWindowProc;
+  window_class.hInstance = instance;
+  window_class.lpszClassName = kRawInputWindowClassName;
+
+  if (RegisterClassExW(&window_class) == 0) {
+    const DWORD error = GetLastError();
+    if (error != ERROR_CLASS_ALREADY_EXISTS) {
+      LOG_WARN("Failed to register keyboard raw input window class, error={}",
+               error);
+      return false;
+    }
+  }
+
+  raw_input_window_ = CreateWindowExW(
+      0, kRawInputWindowClassName, L"", 0, 0, 0, 0, 0, HWND_MESSAGE, nullptr,
+      instance, this);
+  if (!raw_input_window_) {
+    LOG_WARN("Failed to create keyboard raw input window, error={}",
+             GetLastError());
+    return false;
+  }
+
+  RAWINPUTDEVICE keyboard_device{};
+  keyboard_device.usUsagePage = HID_USAGE_PAGE_GENERIC;
+  keyboard_device.usUsage = HID_USAGE_GENERIC_KEYBOARD;
+  keyboard_device.dwFlags = RIDEV_DEVNOTIFY | RIDEV_INPUTSINK;
+  keyboard_device.hwndTarget = raw_input_window_;
+  if (!RegisterRawInputDevices(&keyboard_device, 1,
+                               sizeof(keyboard_device))) {
+    LOG_WARN("Failed to register keyboard raw input, error={}", GetLastError());
+    DestroyWindow(raw_input_window_);
+    raw_input_window_ = nullptr;
+    return false;
+  }
+
+  raw_input_registered_ = true;
+  return true;
+}
+
+void KeyboardCapturer::DestroyRawInputWindow() {
+  if (raw_input_registered_) {
+    RAWINPUTDEVICE keyboard_device{};
+    keyboard_device.usUsagePage = HID_USAGE_PAGE_GENERIC;
+    keyboard_device.usUsage = HID_USAGE_GENERIC_KEYBOARD;
+    keyboard_device.dwFlags = RIDEV_REMOVE;
+    keyboard_device.hwndTarget = nullptr;
+    if (!RegisterRawInputDevices(&keyboard_device, 1,
+                                 sizeof(keyboard_device))) {
+      LOG_WARN("Failed to unregister keyboard raw input, error={}",
+               GetLastError());
+    }
+    raw_input_registered_ = false;
+  }
+  if (raw_input_window_) {
+    DestroyWindow(raw_input_window_);
+    raw_input_window_ = nullptr;
+  }
+}
+
+LRESULT CALLBACK KeyboardCapturer::RawInputWindowProc(
+    HWND window, UINT message, WPARAM w_param, LPARAM l_param) {
+  KeyboardCapturer* capturer = reinterpret_cast<KeyboardCapturer*>(
+      GetWindowLongPtrW(window, GWLP_USERDATA));
+  if (message == WM_NCCREATE) {
+    auto* create = reinterpret_cast<CREATESTRUCTW*>(l_param);
+    capturer = static_cast<KeyboardCapturer*>(create->lpCreateParams);
+    SetWindowLongPtrW(window, GWLP_USERDATA,
+                      reinterpret_cast<LONG_PTR>(capturer));
+  } else if (message == WM_INPUT && capturer) {
+    capturer->HandleRawInput(reinterpret_cast<HRAWINPUT>(l_param));
+  } else if (message == WM_NCDESTROY) {
+    SetWindowLongPtrW(window, GWLP_USERDATA, 0);
+  }
+  return DefWindowProcW(window, message, w_param, l_param);
+}
+
+void KeyboardCapturer::HandleRawInput(HRAWINPUT raw_input_handle) {
+  RAWINPUT input{};
+  UINT input_size = sizeof(input);
+  const UINT bytes_read =
+      GetRawInputData(raw_input_handle, RID_INPUT, &input, &input_size,
+                      sizeof(RAWINPUTHEADER));
+  if (bytes_read == static_cast<UINT>(-1) ||
+      bytes_read < sizeof(RAWINPUTHEADER) ||
+      input.header.dwType != RIM_TYPEKEYBOARD) {
+    return;
+  }
+
+  const RAWKEYBOARD& keyboard = input.data.keyboard;
+  if (keyboard.VKey == 0xFF ||
+      keyboard.ExtraInformation ==
+          static_cast<ULONG>(kInjectedKeyboardInputMarker)) {
+    return;
+  }
+
+  bool is_down = false;
+  if (keyboard.Message == WM_KEYDOWN || keyboard.Message == WM_SYSKEYDOWN) {
+    is_down = true;
+  } else if (keyboard.Message != WM_KEYUP &&
+             keyboard.Message != WM_SYSKEYUP) {
+    return;
+  }
+
+  const bool extended = (keyboard.Flags & (RI_KEY_E0 | RI_KEY_E1)) != 0;
+  UINT mapped_scan_code = keyboard.MakeCode;
+  if ((keyboard.Flags & RI_KEY_E0) != 0) {
+    mapped_scan_code |= 0xE000;
+  } else if ((keyboard.Flags & RI_KEY_E1) != 0) {
+    mapped_scan_code |= 0xE100;
+  }
+  if (mapped_scan_code == 0xE11D || mapped_scan_code == 0xE02A) {
+    return;
+  }
+
+  int key_code = static_cast<int>(keyboard.VKey);
+  if (key_code == VK_SHIFT || key_code == VK_CONTROL || key_code == VK_MENU) {
+    const UINT normalized =
+        MapVirtualKeyW(mapped_scan_code, MAPVK_VSC_TO_VK_EX);
+    if (normalized != 0) {
+      key_code = static_cast<int>(normalized);
+    }
+  }
+
+  if (on_key_action_) {
+    on_key_action_(key_code, is_down, keyboard.MakeCode, extended, user_ptr_);
+  }
+}
+
+// Apply remote keyboard commands to the local machine.
 int KeyboardCapturer::SendKeyboardCommand(int key_code, bool is_down,
                                           uint32_t scan_code, bool extended) {
   INPUT input = {0};
   input.type = INPUT_KEYBOARD;
+  input.ki.dwExtraInfo =
+      static_cast<ULONG_PTR>(kInjectedKeyboardInputMarker);
 
   const bool prefer_vk = PreferSideSpecificVkInjection(key_code);
   const UINT resolved_scan_code =
@@ -110,7 +283,7 @@ int KeyboardCapturer::SendKeyboardCommand(int key_code, bool is_down,
       input.ki.dwFlags |= KEYEVENTF_EXTENDEDKEY;
     }
   } else {
-    input.ki.wVk = (WORD)key_code;
+    input.ki.wVk = static_cast<WORD>(key_code);
 
     if (prefer_vk && resolved_scan_code != 0) {
       input.ki.wScan = static_cast<WORD>(resolved_scan_code & 0xFF);
@@ -131,7 +304,7 @@ int KeyboardCapturer::SendKeyboardCommand(int key_code, bool is_down,
     input.ki.dwFlags |= KEYEVENTF_KEYUP;
   }
 
-  UINT sent = SendInput(1, &input, sizeof(INPUT));
+  const UINT sent = SendInput(1, &input, sizeof(INPUT));
   if (sent != 1) {
     LOG_WARN("SendInput failed for key_code={}, is_down={}, err={}", key_code,
              is_down, GetLastError());

src/device_controller/keyboard/windows/keyboard_capturer.h

@@ -9,6 +9,10 @@
 
 #include <Windows.h>
 
+#include <condition_variable>
+#include <mutex>
+#include <thread>
+
 #include "device_controller.h"
 
 namespace crossdesk {
@@ -26,7 +30,24 @@ class KeyboardCapturer : public DeviceController {
                                   bool extended = false);
 
  private:
-  HHOOK keyboard_hook_ = nullptr;
+  static LRESULT CALLBACK RawInputWindowProc(HWND window, UINT message,
+                                             WPARAM w_param, LPARAM l_param);
+
+  void RawInputThreadMain();
+  bool CreateRawInputWindow();
+  void DestroyRawInputWindow();
+  void HandleRawInput(HRAWINPUT raw_input_handle);
+
+  OnKeyAction on_key_action_ = nullptr;
+  void* user_ptr_ = nullptr;
+  HWND raw_input_window_ = nullptr;
+  bool raw_input_registered_ = false;
+  std::thread capture_thread_;
+  DWORD capture_thread_id_ = 0;
+  bool capture_start_complete_ = false;
+  bool capture_start_succeeded_ = false;
+  std::mutex capture_state_mutex_;
+  std::condition_variable capture_start_condition_;
 };
 }  // namespace crossdesk
 

src/device_controller/mouse/linux/mouse_controller.cpp

@@ -1,6 +1,9 @@
 #include "mouse_controller.h"
 
+#include <X11/Xlib.h>
+#include <X11/Xutil.h>
 #include <X11/extensions/XTest.h>
+#include <unistd.h>
 
 #include "platform.h"
 #include "rd_log.h"

src/device_controller/mouse/linux/mouse_controller.h

@@ -7,10 +7,6 @@
 #ifndef _MOUSE_CONTROLLER_H_
 #define _MOUSE_CONTROLLER_H_
 
-#include <X11/Xlib.h>
-#include <X11/Xutil.h>
-#include <unistd.h>
-
 #include <cstdint>
 #include <functional>
 #include <string>
@@ -20,6 +16,7 @@
 
 struct DBusConnection;
 struct DBusMessageIter;
+struct _XDisplay;
 
 namespace crossdesk {
 
@@ -53,8 +50,8 @@ class MouseController : public DeviceController {
 
   enum class WaylandAbsoluteMode { kUnknown, kPixels, kNormalized, kDisabled };
 
-  Display* display_ = nullptr;
+  _XDisplay* display_ = nullptr;
-  Window root_ = 0;
+  unsigned long root_ = 0;
   std::vector<DisplayInfo> display_info_list_;
   int screen_width_ = 0;
   int screen_height_ = 0;

src/gui/application/application_state.h

@@ -1,24 +1,13 @@
 #ifndef CROSSDESK_GUI_APPLICATION_STATE_H_
 #define CROSSDESK_GUI_APPLICATION_STATE_H_
 
-#include <SDL3/SDL.h>
+#include <atomic>
-
 #include <chrono>
 #include <cstdint>
 #include <memory>
 #include <nlohmann/json.hpp>
 #include <string>
 
-#include "imgui.h"
-
-#if _WIN32
-#include "platform/tray/win_tray.h"
-#elif defined(__APPLE__)
-#include "platform/tray/mac_tray.h"
-#elif defined(__linux__)
-#include "platform/tray/linux_tray.h"
-#endif
-
 namespace crossdesk::gui_detail {
 
 struct MainWindowState {
@@ -27,25 +16,10 @@ struct MainWindowState {
   float title_bar_button_width_ = 30;
   float title_bar_button_height_ = 30;
 
-  SDL_Window *main_window_ = nullptr;
-  SDL_Renderer *main_renderer_ = nullptr;
-  ImGuiContext *main_ctx_ = nullptr;
-  ImFont *main_windows_system_chinese_font_ = nullptr;
-  ImFont *stream_windows_system_chinese_font_ = nullptr;
-  ImFont *server_windows_system_chinese_font_ = nullptr;
   bool exit_ = false;
   const int sdl_refresh_ms_ = 16;
-#if _WIN32
-  std::unique_ptr<WinTray> tray_;
-#elif defined(__APPLE__)
-  std::unique_ptr<MacTray> tray_;
-#elif defined(__linux__)
-  std::unique_ptr<LinuxTray> tray_;
-#endif
 
   bool main_window_minimized_ = false;
-  uint32_t last_main_minimize_request_tick_ = 0;
-  uint32_t last_stream_minimize_request_tick_ = 0;
   int main_window_width_real_ = 720;
   int main_window_height_real_ = 540;
   float main_window_dpi_scaling_w_ = 1.0f;
@@ -77,8 +51,6 @@ struct MainWindowState {
   float about_window_height_ = 170;
   float update_notification_window_width_ = 400;
   float update_notification_window_height_ = 320;
-  uint32_t STREAM_REFRESH_EVENT = 0;
-  uint32_t APP_EXIT_EVENT = 0;
 };
 
 // Application-global interaction flags that coordinate SDL events with media
@@ -93,7 +65,7 @@ struct InteractionState {
   bool start_keyboard_capturer_ = false;
   bool show_cursor_ = false;
   bool keyboard_capturer_is_started_ = false;
-  bool keyboard_capturer_uses_sdl_events_ = false;
+  bool keyboard_capturer_uses_window_events_ = false;
   bool foucs_on_main_window_ = false;
   bool focus_on_stream_window_ = false;
   bool audio_capture_ = false;
@@ -116,14 +88,15 @@ struct InteractionState {
   std::string controlled_remote_id_;
   std::string focused_remote_id_;
   std::string remote_client_id_;
-  SDL_Event last_mouse_event{};
 };
 
 struct UpdateState {
   nlohmann::json latest_version_info_ = nlohmann::json{};
   bool update_available_ = false;
   std::string latest_version_;
+  std::string release_name_;
   std::string release_notes_;
+  std::string release_date_;
   bool show_new_version_icon_ = false;
   bool show_new_version_icon_in_menu_ = true;
   double new_version_icon_last_trigger_time_ = 0.0;
@@ -131,20 +104,15 @@ struct UpdateState {
 };
 
 struct StreamWindowState {
-  SDL_Window *stream_window_ = nullptr;
-  SDL_Renderer *stream_renderer_ = nullptr;
-  ImGuiContext *stream_ctx_ = nullptr;
   bool need_to_create_stream_window_ = false;
   bool stream_window_created_ = false;
   bool stream_window_inited_ = false;
   bool window_maximized_ = false;
-  bool stream_window_grabbed_ = false;
   bool control_mouse_ = false;
   int stream_window_width_default_ = 1280;
   int stream_window_height_default_ = 720;
   float stream_window_width_ = 1280;
   float stream_window_height_ = 720;
-  SDL_PixelFormat stream_pixformat_ = SDL_PIXELFORMAT_NV12;
   int stream_window_width_real_ = 1280;
   int stream_window_height_real_ = 720;
   float stream_window_dpi_scaling_w_ = 1.0f;
@@ -152,11 +120,11 @@ struct StreamWindowState {
 };
 
 struct ServerWindowState {
-  SDL_Window *server_window_ = nullptr;
+  // Transport callbacks run outside the UI thread. Keep the two lifecycle
-  SDL_Renderer *server_renderer_ = nullptr;
+  // requests atomic so a disconnect cannot be lost while the Slint timer is
-  ImGuiContext *server_ctx_ = nullptr;
+  // deciding whether to create or destroy the controlled-side window.
-  bool need_to_create_server_window_ = false;
+  std::atomic<bool> need_to_create_server_window_{false};
-  bool need_to_destroy_server_window_ = false;
+  std::atomic<bool> need_to_destroy_server_window_{false};
   bool server_window_created_ = false;
   bool server_window_inited_ = false;
   int server_window_width_default_ = 250;
@@ -164,7 +132,6 @@ struct ServerWindowState {
   float server_window_width_ = 250;
   float server_window_height_ = 150;
   float server_window_title_bar_height_ = 30.0f;
-  SDL_PixelFormat server_pixformat_ = SDL_PIXELFORMAT_NV12;
   int server_window_normal_width_ = 250;
   int server_window_normal_height_ = 150;
   float server_window_dpi_scaling_w_ = 1.0f;

src/gui/application/gui_application.h

@@ -1,20 +1,15 @@
 #ifndef CROSSDESK_GUI_APPLICATION_H_
 #define CROSSDESK_GUI_APPLICATION_H_
 
-#include <filesystem>
+#include <memory>
 #include <string>
-#include <vector>
 
-#include "IconsFontAwesome6.h"
-#include "imgui_impl_sdl3.h"
-#include "imgui_impl_sdlrenderer3.h"
-#include "imgui_internal.h"
 #include "runtime/gui_runtime.h"
 
 namespace crossdesk {
 
-// SDL/ImGui application shell. Feature state and protocol behavior live in
+// Slint application shell. GuiRuntime remains the owner of transport, media,
-// GuiRuntime and its composed controllers.
+// device, clipboard, transfer and settings behavior.
 class GuiApplication final : private GuiRuntime {
 public:
   GuiApplication();
@@ -23,87 +18,55 @@ public:
   int Run();
 
 private:
-  // Native window integration.
+  struct SlintUi;
-  static SDL_HitTestResult HitTestCallback(SDL_Window *window,
-                                           const SDL_Point *area, void *data);
 
-  // Application lifecycle.
   void InitializeLogger();
   void InitializeSettings();
-  void InitializeSDL();
+  bool InitializeSDL();
   void InitializeModules();
-  void InitializeMainWindow();
+  void InitializeUi();
-  void MainLoop();
+  void InitializeSystemTray();
-  void HandleStreamWindow();
-  void HandleServerWindow();
-  void Cleanup();
-
-  // Window lifecycle and rendering.
-  int CreateMainWindow();
-  int DestroyMainWindow();
-  int CreateStreamWindow();
-  int DestroyStreamWindow();
-  int CreateServerWindow();
-  int DestroyServerWindow();
-  int SetupFontAndStyle(ImFont **system_chinese_font_out);
-  int DestroyMainWindowContext();
-  int DestroyStreamWindowContext();
-  int DestroyServerWindowContext();
-  int DrawMainWindow();
-  int DrawStreamWindow();
-  int DrawServerWindow();
-
-  // Views and dialogs.
-  int TitleBar(bool main_window);
-  int MainWindow();
-  int UpdateNotificationWindow();
-  int StreamWindow();
-  int ServerWindow();
-  int RemoteClientInfoWindow();
-  int LocalWindow();
-  int RemoteWindow();
-  int RecentConnectionsWindow();
-  int SettingWindow();
-  int SelfHostedServerWindow();
-  int ControlWindow(std::shared_ptr<RemoteSession> &props);
-  int ControlBar(std::shared_ptr<RemoteSession> &props);
-  int AboutWindow();
-  int StatusBar();
-  bool
-  ConnectionStatusWindow(std::shared_ptr<RemoteSession> &props);
-  int ShowRecentConnections();
-  int ConfirmDeleteConnection();
-  int EditRecentConnectionAliasWindow();
-  int OfflineWarningWindow();
-  int NetTrafficStats(std::shared_ptr<RemoteSession> &props);
-  int FileTransferWindow(std::shared_ptr<RemoteSession> &props);
-  void
-  DrawConnectionStatusText(std::shared_ptr<RemoteSession> &props);
-  void
-  DrawReceivingScreenText(std::shared_ptr<RemoteSession> &props);
-  bool OpenUrl(const std::string &url);
-  void Hyperlink(const std::string &label, const std::string &url,
-                 float window_width);
-  std::string OpenFileDialog(std::string title);
   bool MinimizeMainWindowToTray();
-
+  void BindMainCallbacks();
-  // SDL event dispatch and input translation.
+  void BindStreamCallbacks();
-  void UpdateRenderRect();
+  void BindServerCallbacks();
-  void ProcessSdlEvent(const SDL_Event &event);
+  void Tick();
-  int ProcessKeyboardEvent(const SDL_Event &event);
+  void SyncMainWindow();
-  int ProcessMouseEvent(const SDL_Event &event);
+  void SyncConnectionDialog();
-  void CloseTab(decltype(remote_sessions_)::iterator &it);
+  void SyncPlatformDialogs();
-
+  void SyncStreamWindow();
+  void SyncStreamKeyboardFocus();
+  void SetStreamKeyboardFocus(bool focused);
+  void SyncServerWindow();
+#if defined(__linux__) && !defined(__APPLE__)
+  void SyncXWaylandWindowActivation();
+#endif
+  void UpdateLocalization();
+  void ResetSettingsUi();
+  void SaveSettingsFromUi();
 #if _WIN32 && CROSSDESK_PORTABLE
   void CheckPortableWindowsService();
-  int PortableServiceInstallWindow();
   void StartPortableWindowsServiceInstall();
   void JoinPortableWindowsServiceInstallThread();
 #endif
+  void ConnectFromUi(const std::string &remote_id);
+  void SelectStreamTab(int index);
+  void ReorderStreamTab(int from, float drop_x, float tab_width);
+  void CloseStreamTab(const std::string &remote_id);
+  void SendPointerInput(int button, int kind, float x, float y);
+  void SendScrollInput(float delta_x, float delta_y, float x, float y);
+  void SendKeyInput(const std::string &text, bool pressed, bool control,
+                    bool alt, bool shift, bool meta);
+  void Cleanup();
 
-#ifdef __APPLE__
+  std::shared_ptr<RemoteSession> SelectedSession();
-  int RequestPermissionWindow();
+  std::string OpenFileDialog(const std::string &title);
-  bool DrawToggleSwitch(const char *id, bool active, bool enabled);
+  bool OpenUrl(const std::string &url);
+
+  std::unique_ptr<SlintUi> ui_;
+#if defined(__linux__) && !defined(__APPLE__)
+  bool use_xwayland_gui_ = false;
+  bool use_x11_custom_titlebar_ = false;
 #endif
 };
 

src/gui/application/portable_service_integration.cpp

@@ -0,0 +1,144 @@
+#include "application/gui_application.h"
+
+#if _WIN32 && CROSSDESK_PORTABLE
+
+#include <Windows.h>
+#include <shellapi.h>
+
+#include <filesystem>
+#include <vector>
+
+#include "rd_log.h"
+#include "service_host.h"
+
+namespace crossdesk {
+namespace {
+
+std::filesystem::path GetCurrentExecutablePath() {
+  std::vector<wchar_t> buffer(MAX_PATH);
+  while (true) {
+    const DWORD length = GetModuleFileNameW(
+        nullptr, buffer.data(), static_cast<DWORD>(buffer.size()));
+    if (length == 0) {
+      return {};
+    }
+    if (length < buffer.size()) {
+      return std::filesystem::path(buffer.data(), buffer.data() + length);
+    }
+    if (buffer.size() >= 32768) {
+      return {};
+    }
+    buffer.resize(buffer.size() * 2);
+  }
+}
+
+bool InstallServiceWithElevation() {
+  const std::filesystem::path executable_path = GetCurrentExecutablePath();
+  if (executable_path.empty()) {
+    LOG_ERROR("Portable service install failed: current executable not found");
+    return false;
+  }
+
+  const std::filesystem::path service_path =
+      executable_path.parent_path() / L"crossdesk_service.exe";
+  const std::filesystem::path helper_path =
+      executable_path.parent_path() / L"crossdesk_session_helper.exe";
+  if (!std::filesystem::exists(service_path) ||
+      !std::filesystem::exists(helper_path)) {
+    LOG_ERROR("Portable service install failed: service binaries missing, "
+              "service={}, helper={}",
+              service_path.string(), helper_path.string());
+    return false;
+  }
+
+  const std::wstring executable = executable_path.wstring();
+  const std::wstring working_dir = executable_path.parent_path().wstring();
+  constexpr wchar_t parameters[] = L"--service-install";
+
+  SHELLEXECUTEINFOW execute_info{};
+  execute_info.cbSize = sizeof(execute_info);
+  execute_info.fMask = SEE_MASK_NOCLOSEPROCESS;
+  execute_info.lpVerb = L"runas";
+  execute_info.lpFile = executable.c_str();
+  execute_info.lpParameters = parameters;
+  execute_info.lpDirectory = working_dir.c_str();
+  execute_info.nShow = SW_HIDE;
+
+  if (!ShellExecuteExW(&execute_info)) {
+    LOG_ERROR("Portable service install failed: ShellExecuteExW error={}",
+              GetLastError());
+    return false;
+  }
+
+  const DWORD wait_result =
+      WaitForSingleObject(execute_info.hProcess, INFINITE);
+  DWORD exit_code = 1;
+  if (wait_result == WAIT_OBJECT_0) {
+    GetExitCodeProcess(execute_info.hProcess, &exit_code);
+  } else {
+    LOG_ERROR("Portable service install wait failed, result={}", wait_result);
+  }
+  CloseHandle(execute_info.hProcess);
+
+  if (exit_code != 0) {
+    LOG_ERROR("Portable service install command failed, exit_code={}",
+              exit_code);
+    return false;
+  }
+
+  const bool started = StartCrossDeskService();
+  if (!started) {
+    LOG_WARN("Portable service installed but start failed");
+  }
+  return IsCrossDeskServiceInstalled() && started;
+}
+
+} // namespace
+
+void GuiApplication::CheckPortableWindowsService() {
+  if (portable_service_prompt_checked_) {
+    return;
+  }
+  portable_service_prompt_checked_ = true;
+  portable_service_installed_ = IsCrossDeskServiceInstalled();
+  if (portable_service_installed_ || portable_service_prompt_suppressed_) {
+    return;
+  }
+
+  portable_service_install_state_.store(PortableServiceInstallState::idle,
+                                        std::memory_order_relaxed);
+  show_portable_service_install_window_ = true;
+}
+
+void GuiApplication::StartPortableWindowsServiceInstall() {
+  portable_service_do_not_remind_ = false;
+  PortableServiceInstallState expected = PortableServiceInstallState::idle;
+  if (!portable_service_install_state_.compare_exchange_strong(
+          expected, PortableServiceInstallState::installing,
+          std::memory_order_acq_rel)) {
+    if (expected != PortableServiceInstallState::failed) {
+      return;
+    }
+    portable_service_install_state_.store(
+        PortableServiceInstallState::installing, std::memory_order_release);
+  }
+
+  JoinPortableWindowsServiceInstallThread();
+  portable_service_install_thread_ = std::thread([this]() {
+    const bool installed = InstallServiceWithElevation();
+    portable_service_install_state_.store(
+        installed ? PortableServiceInstallState::succeeded
+                  : PortableServiceInstallState::failed,
+        std::memory_order_release);
+  });
+}
+
+void GuiApplication::JoinPortableWindowsServiceInstallThread() {
+  if (portable_service_install_thread_.joinable()) {
+    portable_service_install_thread_.join();
+  }
+}
+
+} // namespace crossdesk
+
+#endif

src/gui/application/sdl_event_dispatch.cpp

@@ -200,7 +200,8 @@ void GuiApplication::ProcessSdlEvent(const SDL_Event &event) {
 
   case SDL_EVENT_KEY_DOWN:
   case SDL_EVENT_KEY_UP:
-    if (keyboard_capturer_is_started_ && keyboard_capturer_uses_sdl_events_ &&
+    if (keyboard_capturer_is_started_ &&
+        keyboard_capturer_uses_window_events_ &&
         focus_on_stream_window_ && stream_window_ &&
         SDL_GetWindowID(stream_window_) == event.key.windowID) {
       ProcessKeyboardEvent(event);

src/gui/application/sdl_events.cpp

@@ -220,10 +220,8 @@ int GuiApplication::ProcessKeyboardEvent(const SDL_Event &event) {
     return -1;
   }
 
-  if (event.type == SDL_EVENT_KEY_DOWN && event.key.repeat) {
+  // SDL represents key auto-repeat as additional key-down events. Forward
-    return 0;
+  // them so the fallback path has the same long-press behavior as native hooks.
-  }
-
   const int key_code = TranslateSdlKeyboardEventToVk(event.key);
   if (key_code < 0) {
     return 0;

src/gui/assets/localization/localization.h

@@ -58,7 +58,7 @@ using TranslationTable =
 inline std::unordered_map<std::string, std::string> MakeLocalizedValues(
     const TranslationRow& row) {
   return {{"zh-CN", reinterpret_cast<const char*>(row.zh)},
-          {"en-US", row.en},
+          {"en-US", reinterpret_cast<const char*>(row.en)},
           {"ru-RU", reinterpret_cast<const char*>(row.ru)}};
 }
 

src/gui/assets/localization/localization_data.h

@@ -13,9 +13,9 @@ namespace detail {
 
 struct TranslationRow {
   const char* key;
-  const char* zh;
+  const void* zh;
-  const char* en;
+  const void* en;
-  const char* ru;
+  const void* ru;
 };
 
 // Single source of truth for all UI strings.
@@ -179,6 +179,7 @@ struct TranslationRow {
   X(notification, u8"通知", "Notification", u8"Уведомление")                   \
   X(new_version_available, u8"新版本可用", "New Version Available",            \
     u8"Доступна новая версия")                                                 \
+  X(release_notes, u8"更新内容", "Release Notes", u8"Содержание обновления") \
   X(version, u8"版本", "Version", u8"Версия")                                  \
   X(release_date, u8"发布日期: ", "Release Date: ", u8"Дата релиза: ")         \
   X(access_website, u8"访问官网: ",                                            \

src/gui/features/clipboard/clipboard_controller.cpp

@@ -33,11 +33,6 @@ void ClipboardController::Initialize() {
     SDL_free(clipboard_text);
   }
 
-  if (event_type_ == 0) {
-    LOG_ERROR("Clipboard synchronization disabled: SDL event is unavailable");
-    return;
-  }
-
   events_enabled_.store(true, std::memory_order_release);
 }
 
@@ -75,7 +70,7 @@ void ClipboardController::QueueRemoteText(const char *data, size_t size) {
 
   SDL_Event event{};
   event.type = event_type_;
-  if (!SDL_PushEvent(&event)) {
+  if (event_type_ != 0 && !SDL_PushEvent(&event)) {
     // MainLoop also drains the pending value after its wait timeout.
     LOG_WARN("Failed to wake SDL loop for remote clipboard text: {}",
              SDL_GetError());

src/gui/features/devices/session_device_manager.cpp

@@ -11,6 +11,7 @@ namespace crossdesk {
 namespace {
 
 constexpr uint64_t kCaptureResumeKeyFrameGapMs = 500;
+constexpr size_t kMaxCapturedKeyboardInputs = 512;
 
 } // namespace
 
@@ -228,27 +229,27 @@ int SessionDeviceManager::StopMouseController() {
 }
 
 int SessionDeviceManager::StartKeyboardCapturer() {
-  owner_.keyboard_capturer_uses_sdl_events_ = false;
+  owner_.keyboard_capturer_uses_window_events_ = false;
 
 #ifdef __APPLE__
   if (!owner_.EnsureMacAccessibilityPermission()) {
-    owner_.keyboard_capturer_uses_sdl_events_ = true;
+    owner_.keyboard_capturer_uses_window_events_ = true;
     return 0;
   }
 #endif
 
 #if defined(__linux__) && !defined(__APPLE__)
   if (IsWaylandSession()) {
-    owner_.keyboard_capturer_uses_sdl_events_ = true;
+    owner_.keyboard_capturer_uses_window_events_ = true;
-    LOG_INFO("Start keyboard capturer with SDL Wayland backend");
+    LOG_INFO("Start keyboard capturer with Slint Wayland backend");
     return 0;
   }
 #endif
 
   if (!keyboard_capturer_) {
-    owner_.keyboard_capturer_uses_sdl_events_ = true;
+    owner_.keyboard_capturer_uses_window_events_ = true;
     LOG_WARN(
-        "keyboard capturer is nullptr, falling back to SDL keyboard events");
+        "keyboard capturer is nullptr, falling back to Slint keyboard events");
     return 0;
   }
 
@@ -256,31 +257,32 @@ int SessionDeviceManager::StartKeyboardCapturer() {
       [](int key_code, bool is_down, uint32_t scan_code, bool extended,
          void *user_ptr) {
         if (user_ptr) {
-          auto *runtime = static_cast<GuiRuntime *>(user_ptr);
+          auto *devices = static_cast<SessionDeviceManager *>(user_ptr);
-          runtime->keyboard_.SendKeyCommand(key_code, is_down, scan_code,
+          devices->QueueCapturedKeyboardInput(key_code, is_down, scan_code,
                                               extended);
         }
       },
-      &owner_);
+      this);
   if (hook_ret != 0) {
-    owner_.keyboard_capturer_uses_sdl_events_ = true;
+    owner_.keyboard_capturer_uses_window_events_ = true;
     LOG_WARN(
-        "Start keyboard capturer failed, falling back to SDL keyboard events");
+        "Start keyboard capturer failed, falling back to Slint keyboard events");
   } else {
-    LOG_INFO("Start keyboard capturer with native hook");
+    LOG_INFO("Start keyboard capturer with native input");
   }
   return 0;
 }
 
 int SessionDeviceManager::StopKeyboardCapturer() {
-  if (owner_.keyboard_capturer_uses_sdl_events_) {
+  if (owner_.keyboard_capturer_uses_window_events_) {
-    owner_.keyboard_capturer_uses_sdl_events_ = false;
+    owner_.keyboard_capturer_uses_window_events_ = false;
-    LOG_INFO("Stop keyboard capturer with SDL keyboard backend");
+    LOG_INFO("Stop keyboard capturer with Slint keyboard backend");
     return 0;
   }
 
   if (keyboard_capturer_) {
     keyboard_capturer_->Unhook();
+    ClearCapturedKeyboardInput();
     LOG_INFO("Stop keyboard capturer");
   }
   return 0;
@@ -410,6 +412,7 @@ void SessionDeviceManager::UpdateInteractions() {
       owner_.keyboard_capturer_is_started_ = true;
     }
     if (owner_.keyboard_capturer_is_started_) {
+      DrainCapturedKeyboardInput();
       owner_.keyboard_.SendHeartbeat(false);
     }
   } else if (owner_.keyboard_capturer_is_started_) {
@@ -421,6 +424,36 @@ void SessionDeviceManager::UpdateInteractions() {
   owner_.keyboard_.CheckRemoteTimeouts();
 }
 
+void SessionDeviceManager::QueueCapturedKeyboardInput(int key_code,
+                                                       bool is_down,
+                                                       uint32_t scan_code,
+                                                       bool extended) {
+  std::lock_guard<std::mutex> lock(captured_keyboard_inputs_mutex_);
+  if (captured_keyboard_inputs_.size() >= kMaxCapturedKeyboardInputs) {
+    captured_keyboard_inputs_.pop_front();
+    LOG_WARN("Captured keyboard input queue overflow, dropping oldest event");
+  }
+  captured_keyboard_inputs_.push_back(
+      CapturedKeyboardInput{key_code, is_down, scan_code, extended});
+}
+
+void SessionDeviceManager::DrainCapturedKeyboardInput() {
+  std::deque<CapturedKeyboardInput> inputs;
+  {
+    std::lock_guard<std::mutex> lock(captured_keyboard_inputs_mutex_);
+    inputs.swap(captured_keyboard_inputs_);
+  }
+  for (const CapturedKeyboardInput &input : inputs) {
+    owner_.keyboard_.SendKeyCommand(input.key_code, input.is_down,
+                                    input.scan_code, input.extended);
+  }
+}
+
+void SessionDeviceManager::ClearCapturedKeyboardInput() {
+  std::lock_guard<std::mutex> lock(captured_keyboard_inputs_mutex_);
+  captured_keyboard_inputs_.clear();
+}
+
 bool SessionDeviceManager::SendKeyboardCommand(int key_code, bool is_down,
                                                uint32_t scan_code,
                                                bool extended) {

src/gui/features/devices/session_device_manager.h

@@ -5,6 +5,8 @@
 
 #include <cstddef>
 #include <cstdint>
+#include <deque>
+#include <mutex>
 #include <string>
 #include <vector>
 
@@ -53,6 +55,18 @@ public:
   const std::vector<DisplayInfo> &display_info_list() const;
 
 private:
+  struct CapturedKeyboardInput {
+    int key_code = 0;
+    bool is_down = false;
+    uint32_t scan_code = 0;
+    bool extended = false;
+  };
+
+  void QueueCapturedKeyboardInput(int key_code, bool is_down,
+                                  uint32_t scan_code, bool extended);
+  void DrainCapturedKeyboardInput();
+  void ClearCapturedKeyboardInput();
+
   GuiRuntime &owner_;
   SDL_AudioStream *output_stream_ = nullptr;
   ScreenCapturerFactory *screen_capturer_factory_ = nullptr;
@@ -63,6 +77,8 @@ private:
   MouseController *mouse_controller_ = nullptr;
   KeyboardCapturer *keyboard_capturer_ = nullptr;
   std::vector<DisplayInfo> display_info_list_;
+  std::deque<CapturedKeyboardInput> captured_keyboard_inputs_;
+  std::mutex captured_keyboard_inputs_mutex_;
   uint64_t last_frame_time_ = 0;
   std::string last_video_frame_stream_id_;
 };

src/gui/features/file_transfer/file_transfer_manager.cpp

@@ -13,6 +13,7 @@
 #include <utility>
 
 #include "file_transfer.h"
+#include "filesystem_utf8.h"
 #include "rd_log.h"
 #include "runtime/gui_runtime.h"
 
@@ -40,7 +41,7 @@ void FileTransferManager::ProcessSelectedFile(
   FileTransferState &state = state_for(props);
   LOG_INFO("Selected file: {}", path.c_str());
 
-  const std::filesystem::path file_path = std::filesystem::u8path(path);
+  const std::filesystem::path file_path = PathFromUtf8(path);
   std::error_code ec;
   if (!std::filesystem::is_regular_file(file_path, ec)) {
     LOG_ERROR("Selected path is not a regular file: {}", path);
@@ -55,7 +56,9 @@ void FileTransferManager::ProcessSelectedFile(
   {
     std::lock_guard<std::mutex> lock(state.file_transfer_list_mutex_);
     FileTransferState::FileTransferInfo info;
-    info.file_name = file_path.filename().u8string();
+    const auto utf8_name = file_path.filename().u8string();
+    info.file_name.assign(reinterpret_cast<const char *>(utf8_name.data()),
+                          utf8_name.size());
     info.file_path = file_path;
     info.file_size = file_size;
     info.status = FileTransferState::FileTransferStatus::Queued;
@@ -341,39 +344,4 @@ void FileTransferManager::HandleAck(const char *data, size_t size) {
   ProcessQueue(props);
 }
 
-void FileTransferManager::HandleDropEvent(const SDL_Event &event) {
-  if (event.type != SDL_EVENT_DROP_FILE ||
-      !((owner_.stream_window_ &&
-         SDL_GetWindowID(owner_.stream_window_) == event.window.windowID) ||
-        (owner_.server_window_ &&
-         SDL_GetWindowID(owner_.server_window_) == event.window.windowID))) {
-    return;
-  }
-
-  if (owner_.stream_window_ &&
-      SDL_GetWindowID(owner_.stream_window_) == event.window.windowID) {
-    if (!owner_.stream_window_inited_ || !event.drop.data) {
-      return;
-    }
-    std::shared_lock lock(owner_.remote_sessions_mutex_);
-    for (const auto &[remote_id, props] : owner_.remote_sessions_) {
-      if (props && props->tab_selected_ && props->peer_) {
-        ProcessSelectedFile(static_cast<const char *>(event.drop.data), props,
-                            props->file_label_);
-        break;
-      }
-    }
-    return;
-  }
-
-  if (owner_.server_window_inited_ && event.drop.data) {
-    const auto file_path = std::filesystem::u8path(event.drop.data);
-    std::error_code ec;
-    if (std::filesystem::is_regular_file(file_path, ec)) {
-      LOG_INFO("Drop file [{}] on server window (size: {} bytes)",
-               event.drop.data, std::filesystem::file_size(file_path, ec));
-    }
-  }
-}
-
 } // namespace crossdesk

src/gui/features/file_transfer/file_transfer_manager.h

@@ -1,8 +1,6 @@
 #ifndef CROSSDESK_GUI_FILE_TRANSFER_MANAGER_H_
 #define CROSSDESK_GUI_FILE_TRANSFER_MANAGER_H_
 
-#include <SDL3/SDL.h>
-
 #include <cstddef>
 #include <cstdint>
 #include <filesystem>
@@ -33,7 +31,6 @@ public:
                       const std::shared_ptr<RemoteSession> &props,
                       const std::string &file_label,
                       const std::string &remote_id = "");
-  void HandleDropEvent(const SDL_Event &event);
   void HandleAck(const char *data, size_t size);
 
 private:

src/gui/features/input/keyboard_controller.cpp

@@ -1,14 +1,14 @@
 #include "features/input/keyboard_controller.h"
 
+#include <SDL3/SDL.h>
+
 #include <cstdint>
 #include <mutex>
+#include <nlohmann/json.hpp>
 #include <string>
 #include <unordered_map>
 #include <vector>
 
-#include <SDL3/SDL.h>
-#include <nlohmann/json.hpp>
-
 #include "minirtc.h"
 #include "rd_log.h"
 #include "runtime/gui_runtime.h"
@@ -223,7 +223,8 @@ bool KeyboardController::InjectRemoteKey(int key_code, bool is_down,
       action.k.flag = is_down ? KeyFlag::key_down : KeyFlag::key_up;
       if (!json.is_discarded() &&
           IsTransientSecureDesktopInputFailure(json, action)) {
-        LOG_INFO("Secure desktop keyboard injection transient failure, "
+        LOG_INFO(
+            "Secure desktop keyboard injection transient failure, "
             "key_code={}, is_down={}, response={}",
             key_code, is_down, response);
         return true;

src/gui/platform/tray/linux_tray.cpp

@@ -190,6 +190,18 @@ struct LinuxTrayImpl {
         menu_label(GetMenuLabel(language_index_value)),
         menu_ascii_label(IsAsciiPrintable(menu_label) ? menu_label : "Exit") {}
 
+  explicit LinuxTrayImpl(std::function<void()> show_window_callback,
+                         std::function<void()> hide_window_callback,
+                         std::function<void()> exit_callback,
+                         std::string tray_tooltip, int language_index_value)
+      : show_window(std::move(show_window_callback)),
+        hide_window(std::move(hide_window_callback)),
+        exit_app(std::move(exit_callback)),
+        tooltip(std::move(tray_tooltip)),
+        language_index(language_index_value),
+        menu_label(GetMenuLabel(language_index_value)),
+        menu_ascii_label(IsAsciiPrintable(menu_label) ? menu_label : "Exit") {}
+
   ~LinuxTrayImpl() { RemoveTrayIcon(); }
 
   bool MinimizeToTray() {
@@ -197,7 +209,9 @@ struct LinuxTrayImpl {
       return false;
     }
 
-    if (app_window) {
+    if (hide_window) {
+      hide_window();
+    } else if (app_window) {
       SDL_HideWindow(app_window);
     }
     return true;
@@ -939,16 +953,20 @@ struct LinuxTrayImpl {
   }
 
   void ShowWindow() {
-    if (!app_window) {
+    if (show_window) {
-      return;
+      show_window();
-    }
+    } else if (app_window) {
-
       SDL_ShowWindow(app_window);
       SDL_RestoreWindow(app_window);
       SDL_RaiseWindow(app_window);
     }
+  }
 
   void RequestExit() {
+    if (exit_app) {
+      exit_app();
+      return;
+    }
     SDL_Event event{};
     event.type =
         exit_event_type == 0 || exit_event_type == static_cast<uint32_t>(-1)
@@ -958,6 +976,9 @@ struct LinuxTrayImpl {
   }
 
   ::SDL_Window* app_window = nullptr;
+  std::function<void()> show_window;
+  std::function<void()> hide_window;
+  std::function<void()> exit_app;
   std::string tooltip;
   int language_index = 0;
   uint32_t exit_event_type = 0;
@@ -1005,6 +1026,14 @@ LinuxTray::LinuxTray(::SDL_Window* app_window, const std::string& tooltip,
     : impl_(std::make_unique<LinuxTrayImpl>(app_window, tooltip, language_index,
                                             exit_event_type)) {}
 
+LinuxTray::LinuxTray(std::function<void()> show_window,
+                     std::function<void()> hide_window,
+                     std::function<void()> exit_app,
+                     const std::string& tooltip, int language_index)
+    : impl_(std::make_unique<LinuxTrayImpl>(
+          std::move(show_window), std::move(hide_window), std::move(exit_app),
+          tooltip, language_index)) {}
+
 LinuxTray::~LinuxTray() = default;
 
 bool LinuxTray::MinimizeToTray() { return impl_->MinimizeToTray(); }

src/gui/platform/tray/linux_tray.h

@@ -10,6 +10,7 @@
 #if defined(__linux__) && !defined(__APPLE__)
 
 #include <cstdint>
+#include <functional>
 #include <memory>
 #include <string>
 
@@ -23,6 +24,9 @@ class LinuxTray {
  public:
   LinuxTray(::SDL_Window* app_window, const std::string& tooltip,
             int language_index, uint32_t exit_event_type);
+  LinuxTray(std::function<void()> show_window,
+            std::function<void()> hide_window, std::function<void()> exit_app,
+            const std::string& tooltip, int language_index);
   ~LinuxTray();
 
   bool MinimizeToTray();

src/gui/platform/tray/mac_tray.h

@@ -7,6 +7,7 @@
 #ifndef _MAC_TRAY_H_
 #define _MAC_TRAY_H_
 
+#include <functional>
 #include <memory>
 #include <string>
 
@@ -20,6 +21,11 @@ class MacTray {
  public:
   MacTray(::SDL_Window* app_window, const std::string& tooltip,
           int language_index);
+  MacTray(std::function<void()> show_window,
+          std::function<void()> hide_window,
+          std::function<void()> open_settings,
+          std::function<void()> exit_app,
+          const std::string& tooltip, int language_index);
   ~MacTray();
 
   void MinimizeToTray();

src/gui/platform/tray/mac_tray.mm

@@ -13,6 +13,7 @@
 @interface CrossDeskMacTrayTarget : NSObject
 - (instancetype)initWithOwner:(crossdesk::MacTrayImpl *)owner;
 - (void)statusItemClicked:(id)sender;
+- (void)openSettings:(id)sender;
 - (void)exitApplication:(id)sender;
 @end
 
@@ -24,7 +25,24 @@ struct MacTrayImpl {
       : app_window(window),
         tooltip(std::move(tray_tooltip)),
         language_index(language_index_value),
-        target([[CrossDeskMacTrayTarget alloc] initWithOwner:this]) {}
+        target([[CrossDeskMacTrayTarget alloc] initWithOwner:this]) {
+    EnsureStatusItem();
+  }
+
+  explicit MacTrayImpl(std::function<void()> show_window_callback,
+                       std::function<void()> hide_window_callback,
+                       std::function<void()> open_settings_callback,
+                       std::function<void()> exit_callback,
+                       std::string tray_tooltip, int language_index_value)
+      : show_window(std::move(show_window_callback)),
+        hide_window(std::move(hide_window_callback)),
+        open_settings(std::move(open_settings_callback)),
+        exit_app(std::move(exit_callback)),
+        tooltip(std::move(tray_tooltip)),
+        language_index(language_index_value),
+        target([[CrossDeskMacTrayTarget alloc] initWithOwner:this]) {
+    EnsureStatusItem();
+  }
 
   ~MacTrayImpl() {
     RemoveTrayIcon();
@@ -33,7 +51,9 @@ struct MacTrayImpl {
 
   void MinimizeToTray() {
     EnsureStatusItem();
-    if (app_window) {
+    if (hide_window) {
+      hide_window();
+    } else if (app_window) {
       SDL_HideWindow(app_window);
     }
   }
@@ -48,12 +68,12 @@ struct MacTrayImpl {
   }
 
   void ShowWindow() {
-    if (!app_window) {
+    if (show_window) {
-      return;
+      show_window();
-    }
+    } else if (app_window) {
-
       SDL_ShowWindow(app_window);
       SDL_RaiseWindow(app_window);
+    }
     [NSApp activateIgnoringOtherApps:YES];
   }
 
@@ -64,6 +84,18 @@ struct MacTrayImpl {
     }
 
     NSMenu *menu = [[NSMenu alloc] initWithTitle:@"CrossDesk"];
+    NSString *settings_title =
+        NSStringFromUtf8(localization::settings
+                             [localization::detail::ClampLanguageIndex(
+                                 language_index)]);
+    NSMenuItem *settings_item =
+        [[NSMenuItem alloc] initWithTitle:settings_title
+                                  action:@selector(openSettings:)
+                           keyEquivalent:@""];
+    [settings_item setTarget:target];
+    [menu addItem:settings_item];
+    [menu addItem:[NSMenuItem separatorItem]];
+
     NSString *exit_title =
         NSStringFromUtf8(localization::exit_program
                              [localization::detail::ClampLanguageIndex(
@@ -86,11 +118,25 @@ struct MacTrayImpl {
   }
 
   void RequestExit() {
+    if (exit_app) {
+      exit_app();
+      return;
+    }
     SDL_Event event;
     event.type = SDL_EVENT_QUIT;
     SDL_PushEvent(&event);
   }
 
+  void OpenSettings() {
+    if (open_settings) {
+      open_settings();
+    } else {
+      ShowWindow();
+      return;
+    }
+    [NSApp activateIgnoringOtherApps:YES];
+  }
+
  private:
   void EnsureStatusItem() {
     if (status_item) {
@@ -191,6 +237,10 @@ struct MacTrayImpl {
   }
 
   ::SDL_Window *app_window = nullptr;
+  std::function<void()> show_window;
+  std::function<void()> hide_window;
+  std::function<void()> open_settings;
+  std::function<void()> exit_app;
   std::string tooltip;
   int language_index = 0;
   NSStatusItem *status_item = nil;
@@ -202,6 +252,16 @@ MacTray::MacTray(::SDL_Window *app_window, const std::string &tooltip,
     : impl_(
           std::make_unique<MacTrayImpl>(app_window, tooltip, language_index)) {}
 
+MacTray::MacTray(std::function<void()> show_window,
+                 std::function<void()> hide_window,
+                 std::function<void()> open_settings,
+                 std::function<void()> exit_app, const std::string &tooltip,
+                 int language_index)
+    : impl_(std::make_unique<MacTrayImpl>(
+          std::move(show_window), std::move(hide_window),
+          std::move(open_settings), std::move(exit_app), tooltip,
+          language_index)) {}
+
 MacTray::~MacTray() = default;
 
 void MacTray::MinimizeToTray() { impl_->MinimizeToTray(); }
@@ -244,6 +304,13 @@ void MacTray::RemoveTrayIcon() { impl_->RemoveTrayIcon(); }
   }
 }
 
+- (void)openSettings:(id)sender {
+  (void)sender;
+  if (owner_) {
+    owner_->OpenSettings();
+  }
+}
+
 @end
 
 #endif  // __APPLE__

src/gui/platform/tray/win_tray.cpp

@@ -4,6 +4,8 @@
 
 #include "localization.h"
 
+#include <utility>
+
 namespace crossdesk {
 
 // callback for the message-only window that handles tray icon messages
@@ -60,6 +62,16 @@ WinTray::WinTray(HWND app_hwnd, HICON icon, const std::wstring& tooltip,
   wcsncpy_s(nid_.szTip, tip_.c_str(), _TRUNCATE);
 }
 
+WinTray::WinTray(std::function<void()> show_window,
+                 std::function<void()> hide_window,
+                 std::function<void()> exit_app, HICON icon,
+                 const std::wstring& tooltip, int language_index)
+    : WinTray(nullptr, icon, tooltip, language_index) {
+  show_window_ = std::move(show_window);
+  hide_window_ = std::move(hide_window);
+  exit_app_ = std::move(exit_app);
+}
+
 WinTray::~WinTray() {
   RemoveTrayIcon();
   if (hwnd_message_only_) DestroyWindow(hwnd_message_only_);
@@ -67,20 +79,31 @@ WinTray::~WinTray() {
 
 void WinTray::MinimizeToTray() {
   Shell_NotifyIcon(NIM_ADD, &nid_);
-  // hide application window
+  if (hide_window_) {
+    hide_window_();
+  } else if (app_hwnd_) {
     ShowWindow(app_hwnd_, SW_HIDE);
   }
+}
 
 void WinTray::RemoveTrayIcon() { Shell_NotifyIcon(NIM_DELETE, &nid_); }
 
+void WinTray::ShowApplicationWindow() {
+  if (show_window_) {
+    show_window_();
+  } else if (app_hwnd_) {
+    ShowWindow(app_hwnd_, SW_SHOW);
+    SetForegroundWindow(app_hwnd_);
+  }
+}
+
 bool WinTray::HandleTrayMessage(MSG* msg) {
   if (!msg || msg->message != WM_TRAY_CALLBACK) return false;
 
   switch (LOWORD(msg->lParam)) {
     case WM_LBUTTONDBLCLK:
     case WM_LBUTTONUP: {
-      ShowWindow(app_hwnd_, SW_SHOW);
+      ShowApplicationWindow();
-      SetForegroundWindow(app_hwnd_);
       break;
     }
 
@@ -99,13 +122,15 @@ bool WinTray::HandleTrayMessage(MSG* msg) {
 
       // handle menu command
       if (cmd == 1001) {
-        // exit application
+        if (exit_app_) {
+          exit_app_();
+        } else {
           SDL_Event event;
           event.type = SDL_EVENT_QUIT;
           SDL_PushEvent(&event);
+        }
       } else if (cmd == 1002) {
-        ShowWindow(app_hwnd_, SW_SHOW);  // show main window
+        ShowApplicationWindow();
-        SetForegroundWindow(app_hwnd_);
       }
       break;
     }

src/gui/platform/tray/win_tray.h

@@ -10,6 +10,7 @@
 #include <Windows.h>
 #include <shellapi.h>
 
+#include <functional>
 #include <string>
 
 #define WM_TRAY_CALLBACK (WM_USER + 1)
@@ -20,6 +21,9 @@ class WinTray {
  public:
   WinTray(HWND app_hwnd, HICON icon, const std::wstring& tooltip,
           int language_index);
+  WinTray(std::function<void()> show_window,
+          std::function<void()> hide_window, std::function<void()> exit_app,
+          HICON icon, const std::wstring& tooltip, int language_index);
   ~WinTray();
 
   void MinimizeToTray();
@@ -27,12 +31,17 @@ class WinTray {
   bool HandleTrayMessage(MSG* msg);
 
  private:
+  void ShowApplicationWindow();
+
   HWND app_hwnd_;
   HWND hwnd_message_only_;
   HICON icon_;
   std::wstring tip_;
   int language_index_;
   NOTIFYICONDATA nid_;
+  std::function<void()> show_window_;
+  std::function<void()> hide_window_;
+  std::function<void()> exit_app_;
 };
 }  // namespace crossdesk
 #endif

src/gui/platform/window_drag.h

@@ -0,0 +1,31 @@
+#pragma once
+
+#include <string>
+
+namespace crossdesk {
+
+// Starts the platform's native move loop for the window receiving the current
+// left-mouse-down event. Returns false when no suitable native event exists.
+bool StartNativeWindowDrag();
+
+// Hides the disabled native zoom button on CrossDesk's fixed-size main
+// window. Returns true once the matching AppKit window has been configured.
+bool HideDisabledMainWindowZoomButton();
+
+// Configures live resize and replaces the stream window's native Space
+// fullscreen action with an immediate, single-window fullscreen transition.
+bool ConfigureStreamWindowLiveResize();
+
+// Returns whether the configured stream window is currently the active AppKit
+// key window.
+bool IsStreamWindowActive();
+
+// Enters or leaves the stream window's animation-free fullscreen mode.
+bool SetStreamWindowFullscreen(bool fullscreen);
+bool IsStreamWindowFullscreen();
+
+// Opens an application-modal macOS file picker. The panel is made key before
+// entering its modal loop so it receives keyboard input immediately.
+std::string OpenNativeFileDialog(const std::string &title);
+
+} // namespace crossdesk

src/gui/platform/window_drag_mac.mm

@@ -0,0 +1,272 @@
+#include "platform/window_drag.h"
+
+#import <AppKit/AppKit.h>
+
+@interface CrossDeskStreamFullscreenTarget : NSObject
+- (void)toggleStreamFullscreen:(id)sender;
+@end
+
+@implementation CrossDeskStreamFullscreenTarget
+- (void)toggleStreamFullscreen:(id)sender {
+  (void)sender;
+  crossdesk::SetStreamWindowFullscreen(
+      !crossdesk::IsStreamWindowFullscreen());
+}
+@end
+
+namespace crossdesk {
+namespace {
+
+NSWindow *stream_window = nil;
+CrossDeskStreamFullscreenTarget *stream_fullscreen_target = nil;
+bool stream_fullscreen = false;
+NSRect stream_restore_frame = NSZeroRect;
+NSWindowStyleMask stream_restore_style_mask = NSWindowStyleMaskTitled;
+NSWindowTitleVisibility stream_restore_title_visibility =
+    NSWindowTitleVisible;
+BOOL stream_restore_titlebar_transparent = NO;
+BOOL stream_restore_movable = YES;
+BOOL stream_restore_close_hidden = NO;
+BOOL stream_restore_miniaturize_hidden = NO;
+BOOL stream_restore_zoom_hidden = NO;
+NSApplicationPresentationOptions stream_restore_presentation_options =
+    NSApplicationPresentationDefault;
+
+void InstallStreamFullscreenButton(NSWindow *window) {
+  if (window == nil) {
+    return;
+  }
+  if (stream_fullscreen_target == nil) {
+    stream_fullscreen_target =
+        [[CrossDeskStreamFullscreenTarget alloc] init];
+  }
+  NSButton *zoom_button =
+      [window standardWindowButton:NSWindowZoomButton];
+  zoom_button.target = stream_fullscreen_target;
+  zoom_button.action = @selector(toggleStreamFullscreen:);
+}
+
+void SetTitlebarButtonsHidden(NSWindow *window, BOOL hidden) {
+  [window standardWindowButton:NSWindowCloseButton].hidden = hidden;
+  [window standardWindowButton:NSWindowMiniaturizeButton].hidden = hidden;
+  [window standardWindowButton:NSWindowZoomButton].hidden = hidden;
+}
+
+void CenterWindowOnScreen(NSWindow *window, NSScreen *screen) {
+  if (window == nil || screen == nil) {
+    return;
+  }
+  const NSRect available_frame = screen.visibleFrame;
+  const NSRect window_frame = window.frame;
+  const NSPoint centered_origin = NSMakePoint(
+      NSMidX(available_frame) - NSWidth(window_frame) * 0.5,
+      NSMidY(available_frame) - NSHeight(window_frame) * 0.5);
+  [window setFrameOrigin:centered_origin];
+}
+
+} // namespace
+
+bool StartNativeWindowDrag() {
+  @autoreleasepool {
+    NSEvent *event = [[NSApplication sharedApplication] currentEvent];
+    if (event == nil || event.type != NSEventTypeLeftMouseDown ||
+        event.window == nil) {
+      return false;
+    }
+
+    [event.window performWindowDragWithEvent:event];
+    return true;
+  }
+}
+
+bool HideDisabledMainWindowZoomButton() {
+  @autoreleasepool {
+    for (NSWindow *window in [NSApp windows]) {
+      if (![window.title isEqualToString:@"CrossDesk"]) {
+        continue;
+      }
+
+      NSButton *zoom_button =
+          [window standardWindowButton:NSWindowZoomButton];
+      // The main window has a fixed size, so AppKit disables its zoom button.
+      // Stream windows remain resizable and must keep their native button.
+      if (zoom_button == nil || zoom_button.enabled) {
+        continue;
+      }
+
+      zoom_button.hidden = YES;
+      return true;
+    }
+    return false;
+  }
+}
+
+bool ConfigureStreamWindowLiveResize() {
+  @autoreleasepool {
+    for (NSWindow *window in [NSApp windows]) {
+      if (![window.title isEqualToString:@"CrossDesk"]) {
+        continue;
+      }
+
+      NSButton *zoom_button =
+          [window standardWindowButton:NSWindowZoomButton];
+      // The stream window is resizable and therefore keeps an enabled native
+      // zoom button. The fixed-size main window's zoom button is disabled.
+      if (zoom_button == nil || !zoom_button.enabled) {
+        continue;
+      }
+
+      NSView *content_view = window.contentView;
+      if (content_view == nil) {
+        return false;
+      }
+
+      // During an ordinary edge resize, scale one cached frame and redraw once
+      // the new window size has settled.
+      window.preservesContentDuringLiveResize = YES;
+      content_view.layerContentsRedrawPolicy =
+          NSViewLayerContentsRedrawBeforeViewResize;
+      content_view.layerContentsPlacement =
+          NSViewLayerContentsPlacementScaleProportionallyToFit;
+      stream_window = window;
+      // Native Space fullscreen cross-fades an AppKit source snapshot over a
+      // separately rendered destination window. Disable that path for the
+      // stream window and route the green button to the immediate transition.
+      window.collectionBehavior =
+          (window.collectionBehavior &
+           ~(NSWindowCollectionBehaviorFullScreenPrimary |
+             NSWindowCollectionBehaviorFullScreenAuxiliary |
+             NSWindowCollectionBehaviorFullScreenAllowsTiling)) |
+          NSWindowCollectionBehaviorFullScreenNone;
+      InstallStreamFullscreenButton(window);
+      content_view.needsDisplay = YES;
+      return true;
+    }
+    return false;
+  }
+}
+
+bool IsStreamWindowActive() {
+  @autoreleasepool {
+    return stream_window != nil && [NSApp isActive] &&
+           [stream_window isKeyWindow];
+  }
+}
+
+bool SetStreamWindowFullscreen(bool fullscreen) {
+  @autoreleasepool {
+    if (stream_window == nil || stream_fullscreen == fullscreen) {
+      return stream_window != nil;
+    }
+
+    if (fullscreen) {
+      NSScreen *screen = stream_window.screen ?: NSScreen.mainScreen;
+      if (screen == nil) {
+        return false;
+      }
+
+      stream_restore_frame = stream_window.frame;
+      stream_restore_style_mask = stream_window.styleMask;
+      stream_restore_title_visibility = stream_window.titleVisibility;
+      stream_restore_titlebar_transparent =
+          stream_window.titlebarAppearsTransparent;
+      stream_restore_movable = stream_window.movable;
+      stream_restore_close_hidden =
+          [stream_window standardWindowButton:NSWindowCloseButton].hidden;
+      stream_restore_miniaturize_hidden =
+          [stream_window standardWindowButton:NSWindowMiniaturizeButton].hidden;
+      stream_restore_zoom_hidden =
+          [stream_window standardWindowButton:NSWindowZoomButton].hidden;
+      stream_restore_presentation_options = NSApp.presentationOptions;
+
+      stream_fullscreen = true;
+      stream_window.styleMask =
+          stream_restore_style_mask | NSWindowStyleMaskFullSizeContentView;
+      stream_window.titleVisibility = NSWindowTitleHidden;
+      stream_window.titlebarAppearsTransparent = YES;
+      stream_window.movable = NO;
+      SetTitlebarButtonsHidden(stream_window, YES);
+
+      NSApplicationPresentationOptions presentation_options =
+          stream_restore_presentation_options;
+      if ((presentation_options & (NSApplicationPresentationHideDock |
+                                   NSApplicationPresentationAutoHideDock)) ==
+          0) {
+        presentation_options |= NSApplicationPresentationAutoHideDock;
+      }
+      if ((presentation_options & (NSApplicationPresentationHideMenuBar |
+                                   NSApplicationPresentationAutoHideMenuBar)) ==
+          0) {
+        presentation_options |= NSApplicationPresentationAutoHideMenuBar;
+      }
+      NSApp.presentationOptions = presentation_options;
+      [stream_window setFrame:screen.frame display:YES animate:NO];
+      [stream_window makeKeyAndOrderFront:nil];
+    } else {
+      stream_fullscreen = false;
+      NSApp.presentationOptions = stream_restore_presentation_options;
+      stream_window.styleMask = stream_restore_style_mask;
+      stream_window.titleVisibility = stream_restore_title_visibility;
+      stream_window.titlebarAppearsTransparent =
+          stream_restore_titlebar_transparent;
+      stream_window.movable = stream_restore_movable;
+      [stream_window setFrame:stream_restore_frame display:YES animate:NO];
+      [stream_window standardWindowButton:NSWindowCloseButton].hidden =
+          stream_restore_close_hidden;
+      [stream_window standardWindowButton:NSWindowMiniaturizeButton].hidden =
+          stream_restore_miniaturize_hidden;
+      [stream_window standardWindowButton:NSWindowZoomButton].hidden =
+          stream_restore_zoom_hidden;
+      InstallStreamFullscreenButton(stream_window);
+      [stream_window makeKeyAndOrderFront:nil];
+    }
+
+    stream_window.contentView.alphaValue = 1.0;
+    stream_window.contentView.needsDisplay = YES;
+    [stream_window displayIfNeeded];
+    return true;
+  }
+}
+
+bool IsStreamWindowFullscreen() {
+  return stream_fullscreen;
+}
+
+std::string OpenNativeFileDialog(const std::string &title) {
+  @autoreleasepool {
+    NSOpenPanel *panel = [NSOpenPanel openPanel];
+    panel.canChooseFiles = YES;
+    panel.canChooseDirectories = NO;
+    panel.allowsMultipleSelection = NO;
+    panel.resolvesAliases = YES;
+
+    NSString *prompt =
+        [[NSString alloc] initWithBytes:title.data()
+                                 length:title.size()
+                               encoding:NSUTF8StringEncoding];
+    if (prompt != nil && prompt.length > 0) {
+      panel.title = prompt;
+      panel.message = prompt;
+    }
+
+    // tinyfiledialogs uses an external osascript process on macOS, so its
+    // chooser can appear without becoming the active window. Keep the picker
+    // inside CrossDesk and explicitly activate both the app and panel.
+    [NSApp activateIgnoringOtherApps:YES];
+    NSWindow *owner = stream_window ?: NSApp.keyWindow ?: NSApp.mainWindow;
+    if (owner != nil) {
+      [owner makeKeyAndOrderFront:nil];
+    }
+    NSScreen *target_screen = owner.screen ?: NSScreen.mainScreen;
+    CenterWindowOnScreen(panel, target_screen);
+    [panel makeKeyAndOrderFront:nil];
+
+    if ([panel runModal] != NSModalResponseOK || panel.URL == nil) {
+      return {};
+    }
+    const char *path = panel.URL.fileSystemRepresentation;
+    return path != nullptr ? std::string(path) : std::string{};
+  }
+}
+
+} // namespace crossdesk

src/gui/runtime/connection_runtime.cpp

@@ -1,5 +1,3 @@
-#include "runtime/gui_runtime.h"
-
 #include <algorithm>
 #include <chrono>
 #include <cstring>
@@ -11,17 +9,14 @@
 #include <vector>
 
 #include "localization.h"
+#include "platform.h"
 #include "rd_log.h"
+#include "runtime/gui_runtime.h"
 
 namespace crossdesk {
 
 namespace {
 constexpr auto kPresenceProbeTimeout = std::chrono::seconds(5);
-constexpr auto kConnectionAttemptTimeout = std::chrono::seconds(20);
-bool IsConnectionAttemptPending(ConnectionStatus status) {
-  return status == ConnectionStatus::Connecting ||
-         status == ConnectionStatus::Gathering;
-}
 }  // namespace
 
 void GuiRuntime::HandleConnectionStatusChange() {
@@ -95,7 +90,7 @@ void GuiRuntime::HandlePendingPresenceProbe() {
   show_offline_warning_window_ = true;
 }
 
-void GuiRuntime::HandleConnectionTimeouts() {
+void GuiRuntime::HandlePresenceProbeTimeout() {
   const auto now = std::chrono::steady_clock::now();
 
   bool presence_probe_timed_out = false;
@@ -121,44 +116,63 @@ void GuiRuntime::HandleConnectionTimeouts() {
     show_offline_warning_window_ = true;
     LOG_WARN("Presence probe timed out for [{}]", presence_remote_id);
   }
+}
 
-  bool rejoin_state_changed = false;
+void GuiRuntime::HandleServerControllerDisconnected(
-  for (auto &[_, props] : remote_sessions_) {
+    const std::string& remote_id, const char* reason) {
-    if (!props || !props->connection_attempt_active_.load()) {
+  keyboard_.ReleaseRemotePressedKeys(remote_id, reason);
+
+  bool has_connected_controller = false;
+  bool has_web_controller = false;
+  std::string remaining_controller_id;
+  {
+    std::unique_lock lock(connection_status_mutex_);
+    connection_status_.erase(remote_id);
+    connection_host_names_.erase(remote_id);
+    for (const auto& [id, status] : connection_status_) {
+      if (status != ConnectionStatus::Connected) {
         continue;
       }
-
+      has_connected_controller = true;
-    const ConnectionStatus status = props->connection_status_.load();
+      has_web_controller =
-    if (!IsConnectionAttemptPending(status)) {
+          has_web_controller || id.find("web") != std::string::npos;
-      props->connection_attempt_active_.store(false);
+      if (remaining_controller_id.empty()) {
-      continue;
+        remaining_controller_id = id;
+      }
+    }
+  }
+  show_cursor_ = has_web_controller;
+  if (has_connected_controller) {
+    remote_client_id_ = remaining_controller_id;
+    return;
   }
 
-    if (now - props->connection_attempt_started_at_ <
+  need_to_create_server_window_.store(false, std::memory_order_release);
-        kConnectionAttemptTimeout) {
+  need_to_destroy_server_window_.store(true, std::memory_order_release);
-      continue;
+  is_server_mode_ = false;
-    }
+#if defined(__linux__) && !defined(__APPLE__)
-
+  if (IsWaylandSession()) {
-    LOG_WARN("Connection to [{}] timed out, status={}", props->remote_id_,
+    // Keep Wayland capture session warm to avoid black screen on subsequent
-             static_cast<int>(status));
+    // reconnects.
-    props->connection_attempt_active_.store(false);
+    start_screen_capturer_ = true;
-    props->connection_established_ = false;
+    LOG_INFO(
-    props->rejoin_ = false;
+        "Keeping Wayland screen capturer running after disconnect to "
-    props->connection_status_.store(ConnectionStatus::Failed);
+        "preserve reconnect stability");
-    focused_remote_id_ = props->remote_id_;
+  } else {
-    show_connection_status_window_ = true;
+    start_screen_capturer_ = false;
-    rejoin_state_changed = true;
-  }
-
-  if (rejoin_state_changed) {
-    need_to_rejoin_ = false;
-    for (const auto &[_, props] : remote_sessions_) {
-      if (props && props->rejoin_) {
-        need_to_rejoin_ = true;
-        break;
-      }
   }
+#else
+  start_screen_capturer_ = false;
+#endif
+  start_speaker_capturer_ = false;
+  start_mouse_controller_ = false;
+  start_keyboard_capturer_ = false;
+  remote_client_id_.clear();
+  if (audio_capture_) {
+    devices_.StopSpeakerCapturer();
+    audio_capture_ = false;
   }
+  devices_.ResetToInitialDisplay();
 }
 
 int GuiRuntime::RequestSingleDevicePresence(const std::string& remote_id,
@@ -200,8 +214,6 @@ int GuiRuntime::RequestSingleDevicePresence(const std::string &remote_id,
 }
 
 void GuiRuntime::CloseRemoteSession(std::shared_ptr<RemoteSession> props) {
-  SDL_FlushEvent(STREAM_REFRESH_EVENT);
-
   std::shared_ptr<std::vector<unsigned char>> frame_snapshot;
   int video_width = 0;
   int video_height = 0;
@@ -290,11 +302,6 @@ void GuiRuntime::WaitForThumbnailSaveTasks() {
 
 void GuiRuntime::ResetRemoteSessionResources(
     std::shared_ptr<RemoteSession> props) {
-  if (props->stream_texture_) {
-    SDL_DestroyTexture(props->stream_texture_);
-    props->stream_texture_ = nullptr;
-  }
-
   {
     std::lock_guard<std::mutex> lock(props->video_frame_mutex_);
     props->front_frame_.reset();
@@ -307,8 +314,7 @@ void GuiRuntime::ResetRemoteSessionResources(
   }
 }
 
-std::shared_ptr<GuiRuntime::RemoteSession>
+std::shared_ptr<GuiRuntime::RemoteSession> GuiRuntime::FindRemoteSession(
-GuiRuntime::FindRemoteSession(
     const std::string& remote_id) {
   if (remote_id.empty()) {
     return nullptr;
@@ -322,7 +328,6 @@ GuiRuntime::FindRemoteSession(
   return it->second;
 }
 
-
 int GuiRuntime::ConnectTo(const std::string& remote_id, const char* password,
                           bool remember_password, bool bypass_presence_check) {
   if (!bypass_presence_check && !device_presence_cache_.IsOnline(remote_id)) {
@@ -343,8 +348,7 @@ int GuiRuntime::ConnectTo(const std::string &remote_id, const char *password,
   focused_remote_id_ = remote_id;
 
   // std::shared_lock shared_lock(remote_sessions_mutex_);
-  bool exists =
+  bool exists = (remote_sessions_.find(remote_id) != remote_sessions_.end());
-      (remote_sessions_.find(remote_id) != remote_sessions_.end());
   // shared_lock.unlock();
 
   if (!exists) {
@@ -354,8 +358,7 @@ int GuiRuntime::ConnectTo(const std::string &remote_id, const char *password,
     {
       // std::unique_lock unique_lock(remote_sessions_mutex_);
       if (remote_sessions_.find(remote_id) == remote_sessions_.end()) {
-        remote_sessions_[remote_id] =
+        remote_sessions_[remote_id] = std::make_shared<RemoteSession>();
-            std::make_shared<RemoteSession>();
         auto props = remote_sessions_[remote_id];
         props->local_id_ = "C-" + std::string(client_id_);
         props->remote_id_ = remote_id;
@@ -409,8 +412,6 @@ int GuiRuntime::ConnectTo(const std::string &remote_id, const char *password,
   auto props = remote_sessions_[remote_id];
   if (!props->connection_established_) {
     props->connection_status_.store(ConnectionStatus::Connecting);
-    props->connection_attempt_active_.store(true);
-    props->connection_attempt_started_at_ = std::chrono::steady_clock::now();
     show_connection_status_window_ = true;
 
     props->remember_password_ = remember_password;

src/gui/runtime/gui_runtime.cpp

@@ -168,10 +168,10 @@ void GuiRuntime::UpdateLabels() {
 
 
 void GuiRuntime::HandleRecentConnections() {
-  if (reload_recent_connections_ && main_renderer_) {
+  if (reload_recent_connections_ && thumbnail_) {
     uint32_t now_time = SDL_GetTicks();
     if (now_time - recent_connection_image_save_time_ >= 50) {
-      int ret = thumbnail_->LoadThumbnail(main_renderer_, recent_connections_,
+      int ret = thumbnail_->LoadThumbnail(recent_connections_,
                                           &recent_connection_image_width_,
                                           &recent_connection_image_height_);
       if (!ret) {

src/gui/runtime/gui_runtime.h

@@ -8,9 +8,9 @@
 #include "features/devices/session_device_manager.h"
 #include "features/file_transfer/file_transfer_manager.h"
 #include "features/input/keyboard_controller.h"
+#include "features/settings/settings_manager.h"
 #include "runtime/gui_state.h"
 #include "runtime/peer_event_handler.h"
-#include "features/settings/settings_manager.h"
 
 namespace crossdesk {
 
@@ -45,22 +45,22 @@ protected:
   void HandleRecentConnections();
   void HandleConnectionStatusChange();
   void HandlePendingPresenceProbe();
-  void HandleConnectionTimeouts();
+  void HandlePresenceProbeTimeout();
+  void HandleServerControllerDisconnected(const std::string& remote_id,
+                                          const char* reason);
   void HandleWindowsServiceIntegration();
 
   void CloseRemoteSession(std::shared_ptr<RemoteSession> props);
   void CloseAllRemoteSessions();
-  void ResetRemoteSessionResources(
+  void ResetRemoteSessionResources(std::shared_ptr<RemoteSession> props);
-      std::shared_ptr<RemoteSession> props);
   void WaitForThumbnailSaveTasks();
-  std::shared_ptr<RemoteSession>
+  std::shared_ptr<RemoteSession> FindRemoteSession(
-  FindRemoteSession(const std::string &remote_id);
+      const std::string& remote_id);
 
   void ResetRemoteServiceStatus(RemoteSession& props);
   void ApplyRemoteServiceStatus(RemoteSession& props,
                                 const ServiceStatus& status);
-  RemoteUnlockState
+  RemoteUnlockState GetRemoteUnlockState(const RemoteSession& props) const;
-  GetRemoteUnlockState(const RemoteSession &props) const;
 #if _WIN32
   void ResetLocalWindowsServiceState(bool clear_pending_sas);
 #endif

src/gui/runtime/peer_data_callbacks.cpp

@@ -14,6 +14,7 @@
 #include "device_controller.h"
 #include "file_transfer.h"
 #include "localization.h"
+#include "filesystem_utf8.h"
 #include "platform.h"
 #include "rd_log.h"
 #include "runtime/gui_runtime.h"
@@ -90,7 +91,7 @@ void PeerEventHandler::OnReceiveDataBuffer(
     std::string configured_path =
         runtime->config_center_->GetFileTransferSavePath();
     if (!configured_path.empty()) {
-      receiver.SetOutputDir(std::filesystem::u8path(configured_path));
+      receiver.SetOutputDir(PathFromUtf8(configured_path));
     } else if (receiver.OutputDir().empty()) {
       receiver = FileReceiver(); // re-init with default desktop path
     }

src/gui/runtime/peer_event_handler.cpp

@@ -88,7 +88,6 @@ void PeerEventHandler::OnSignalMessage(const char *message, size_t size,
   }
 }
 
-
 void PeerEventHandler::OnSignalStatus(SignalStatus status, const char* user_id,
                                       size_t user_id_size, void* user_data) {
   auto* handler = static_cast<PeerEventHandler*>(user_data);
@@ -155,8 +154,7 @@ void PeerEventHandler::OnConnectionStatus(ConnectionStatus status,
                                           void* user_data) {
   auto* handler = static_cast<PeerEventHandler*>(user_data);
   GuiRuntime* runtime = handler ? &handler->owner_ : nullptr;
-  if (!runtime)
+  if (!runtime) return;
-    return;
 
   std::string remote_id(user_id, user_id_size);
   std::shared_ptr<GuiRuntime::RemoteSession> props;
@@ -172,10 +170,6 @@ void PeerEventHandler::OnConnectionStatus(ConnectionStatus status,
     runtime->is_client_mode_ = true;
     runtime->show_connection_status_window_ = true;
     props->connection_status_.store(status);
-    if (status != ConnectionStatus::Connecting &&
-        status != ConnectionStatus::Gathering) {
-      props->connection_attempt_active_.store(false);
-    }
 
     switch (status) {
       case ConnectionStatus::Connected: {
@@ -202,11 +196,13 @@ void PeerEventHandler::OnConnectionStatus(ConnectionStatus status,
             strncpy(remote_action.i.display_list[i],
                     runtime->devices_.display_info_list()[i].name.c_str(),
                     runtime->devices_.display_info_list()[i].name.length());
-          remote_action.i.display_list
+            remote_action.i
-              [i][runtime->devices_.display_info_list()[i].name.length()] = '\0';
+                .display_list[i][runtime->devices_.display_info_list()[i]
+                                     .name.length()] = '\0';
             remote_action.i.left[i] =
                 runtime->devices_.display_info_list()[i].left;
-          remote_action.i.top[i] = runtime->devices_.display_info_list()[i].top;
+            remote_action.i.top[i] =
+                runtime->devices_.display_info_list()[i].top;
             remote_action.i.right[i] =
                 runtime->devices_.display_info_list()[i].right;
             remote_action.i.bottom[i] =
@@ -215,7 +211,8 @@ void PeerEventHandler::OnConnectionStatus(ConnectionStatus status,
 
           std::string host_name = GetHostName();
           remote_action.type = ControlType::host_infomation;
-        memcpy(&remote_action.i.host_name, host_name.data(), host_name.size());
+          memcpy(&remote_action.i.host_name, host_name.data(),
+                 host_name.size());
           remote_action.i.host_name[host_name.size()] = '\0';
           remote_action.i.host_name_size = host_name.size();
 
@@ -230,12 +227,6 @@ void PeerEventHandler::OnConnectionStatus(ConnectionStatus status,
           runtime->need_to_create_stream_window_ = true;
         }
         props->connection_established_ = true;
-      props->stream_render_rect_ = {
-          0, (int)runtime->title_bar_height_, (int)runtime->stream_window_width_,
-          (int)(runtime->stream_window_height_ - runtime->title_bar_height_)};
-      props->stream_render_rect_f_ = {
-          0.0f, runtime->title_bar_height_, runtime->stream_window_width_,
-          runtime->stream_window_height_ - runtime->title_bar_height_};
         runtime->start_keyboard_capturer_ = true;
         break;
       }
@@ -259,11 +250,6 @@ void PeerEventHandler::OnConnectionStatus(ConnectionStatus status,
           props->stream_cleanup_pending_ = true;
         }
 
-      SDL_Event event;
-      event.type = runtime->STREAM_REFRESH_EVENT;
-      event.user.data1 = props.get();
-      SDL_PushEvent(&event);
-
         runtime->focus_on_stream_window_ = false;
 
         break;
@@ -326,11 +312,13 @@ void PeerEventHandler::OnConnectionStatus(ConnectionStatus status,
             strncpy(remote_action.i.display_list[i],
                     runtime->devices_.display_info_list()[i].name.c_str(),
                     runtime->devices_.display_info_list()[i].name.length());
-          remote_action.i.display_list
+            remote_action.i
-              [i][runtime->devices_.display_info_list()[i].name.length()] = '\0';
+                .display_list[i][runtime->devices_.display_info_list()[i]
+                                     .name.length()] = '\0';
             remote_action.i.left[i] =
                 runtime->devices_.display_info_list()[i].left;
-          remote_action.i.top[i] = runtime->devices_.display_info_list()[i].top;
+            remote_action.i.top[i] =
+                runtime->devices_.display_info_list()[i].top;
             remote_action.i.right[i] =
                 runtime->devices_.display_info_list()[i].right;
             remote_action.i.bottom[i] =
@@ -339,17 +327,22 @@ void PeerEventHandler::OnConnectionStatus(ConnectionStatus status,
 
           std::string host_name = GetHostName();
           remote_action.type = ControlType::host_infomation;
-        memcpy(&remote_action.i.host_name, host_name.data(), host_name.size());
+          memcpy(&remote_action.i.host_name, host_name.data(),
+                 host_name.size());
           remote_action.i.host_name[host_name.size()] = '\0';
           remote_action.i.host_name_size = host_name.size();
 
           std::string msg = remote_action.to_json();
-        int ret = SendReliableDataFrame(runtime->peer_, msg.data(), msg.size(),
+          int ret =
+              SendReliableDataFrame(runtime->peer_, msg.data(), msg.size(),
                                     runtime->control_data_label_.c_str());
           remote_action_codec::Free(remote_action);
         }
 
-      runtime->need_to_create_server_window_ = true;
+        runtime->need_to_destroy_server_window_.store(
+            false, std::memory_order_release);
+        runtime->need_to_create_server_window_.store(true,
+                                                     std::memory_order_release);
         runtime->is_server_mode_ = true;
         runtime->start_screen_capturer_ = true;
         runtime->start_speaker_capturer_ = true;
@@ -358,7 +351,8 @@ void PeerEventHandler::OnConnectionStatus(ConnectionStatus status,
         {
           std::shared_lock lock(runtime->connection_status_mutex_);
           if (std::all_of(runtime->connection_status_.begin(),
-                        runtime->connection_status_.end(), [](const auto &kv) {
+                          runtime->connection_status_.end(),
+                          [](const auto& kv) {
                             return kv.first.find("web") != std::string::npos;
                           })) {
             runtime->show_cursor_ = true;
@@ -370,64 +364,8 @@ void PeerEventHandler::OnConnectionStatus(ConnectionStatus status,
       case ConnectionStatus::Disconnected:
       case ConnectionStatus::Failed:
       case ConnectionStatus::Closed: {
-      runtime->keyboard_.ReleaseRemotePressedKeys(remote_id,
+        runtime->HandleServerControllerDisconnected(remote_id,
                                                     "connection_closed");
-      bool all_disconnected = false;
-      {
-        std::shared_lock lock(runtime->connection_status_mutex_);
-        all_disconnected =
-            std::all_of(runtime->connection_status_.begin(),
-                        runtime->connection_status_.end(), [](const auto &kv) {
-                          return kv.second == ConnectionStatus::Closed ||
-                                 kv.second == ConnectionStatus::Failed ||
-                                 kv.second == ConnectionStatus::Disconnected;
-                        });
-      }
-      if (all_disconnected) {
-        runtime->need_to_destroy_server_window_ = true;
-        runtime->is_server_mode_ = false;
-#if defined(__linux__) && !defined(__APPLE__)
-        if (IsWaylandSession()) {
-          // Keep Wayland capture session warm to avoid black screen on
-          // subsequent reconnects.
-          runtime->start_screen_capturer_ = true;
-          LOG_INFO("Keeping Wayland screen capturer running after "
-                   "disconnect to preserve reconnect stability");
-        } else {
-          runtime->start_screen_capturer_ = false;
-        }
-#else
-        runtime->start_screen_capturer_ = false;
-#endif
-        runtime->start_speaker_capturer_ = false;
-        runtime->start_mouse_controller_ = false;
-        runtime->start_keyboard_capturer_ = false;
-        runtime->remote_client_id_ = "";
-        if (props)
-          props->connection_established_ = false;
-        if (runtime->audio_capture_) {
-          runtime->devices_.StopSpeakerCapturer();
-          runtime->audio_capture_ = false;
-        }
-
-        {
-          std::unique_lock lock(runtime->connection_status_mutex_);
-          runtime->connection_status_.erase(remote_id);
-          runtime->connection_host_names_.erase(remote_id);
-        }
-        runtime->devices_.ResetToInitialDisplay();
-      }
-
-      {
-        std::shared_lock lock(runtime->connection_status_mutex_);
-        if (std::all_of(runtime->connection_status_.begin(),
-                        runtime->connection_status_.end(), [](const auto &kv) {
-                          return kv.first.find("web") == std::string::npos;
-                        })) {
-          runtime->show_cursor_ = false;
-        }
-      }
-
         break;
       }
       default:

src/gui/runtime/peer_media_callbacks.cpp

@@ -70,12 +70,9 @@ void PeerEventHandler::OnReceiveVideoBuffer(
       props->video_size_ = video_frame->size;
 
       props->front_frame_.swap(props->back_frame_);
+      ++props->video_frame_sequence_;
     }
 
-    SDL_Event event;
-    event.type = runtime->STREAM_REFRESH_EVENT;
-    event.user.data1 = props;
-    SDL_PushEvent(&event);
     props->streaming_ = true;
 
     if (props->net_traffic_stats_button_pressed_) {

src/gui/runtime/remote_session.h

@@ -1,8 +1,6 @@
 #ifndef CROSSDESK_GUI_REMOTE_SESSION_H_
 #define CROSSDESK_GUI_REMOTE_SESSION_H_
 
-#include <SDL3/SDL.h>
-
 #include <atomic>
 #include <chrono>
 #include <cstddef>
@@ -16,7 +14,6 @@
 #include <vector>
 
 #include "display_info.h"
-#include "imgui.h"
 #include "minirtc.h"
 
 namespace crossdesk::gui_detail {
@@ -77,8 +74,6 @@ struct RemoteSession {
   SignalStatus signal_status_ = SignalStatus::SignalClosed;
   bool connection_established_ = false;
   bool rejoin_ = false;
-  std::atomic<bool> connection_attempt_active_ = false;
-  std::chrono::steady_clock::time_point connection_attempt_started_at_;
   bool net_traffic_stats_button_pressed_ = false;
   bool enable_mouse_control_ = true;
   bool mouse_controller_is_started_ = false;
@@ -111,7 +106,7 @@ struct RemoteSession {
   double control_bar_button_pressed_time_ = 0;
   double net_traffic_stats_button_pressed_time_ = 0;
 
-  // Written by the decode callback thread and consumed by the SDL thread.
+  // Written by the decode callback thread and consumed by the UI thread.
   std::mutex video_frame_mutex_;
   std::shared_ptr<std::vector<unsigned char>> front_frame_;
   std::shared_ptr<std::vector<unsigned char>> back_frame_;
@@ -129,6 +124,7 @@ struct RemoteSession {
   int video_height_last_ = 0;
   int selected_display_ = 0;
   size_t video_size_ = 0;
+  uint64_t video_frame_sequence_ = 0;
   bool tab_selected_ = false;
   bool tab_opened_ = true;
   std::optional<float> pos_x_before_docked_;
@@ -146,15 +142,7 @@ struct RemoteSession {
   bool remote_service_available_ = false;
   std::string remote_interactive_stage_;
   std::vector<DisplayInfo> display_info_list_;
-  SDL_Texture *stream_texture_ = nullptr;
+  // Shared by minirtc callbacks, Slint rendering and SDL audio callbacks.
-  uint8_t *argb_buffer_ = nullptr;
-  int argb_buffer_size_ = 0;
-  SDL_FRect stream_render_rect_f_ = {0.0f, 0.0f, 0.0f, 0.0f};
-  SDL_Rect stream_render_rect_{};
-  SDL_Rect stream_render_rect_last_{};
-  ImVec2 control_window_pos_{};
-
-  // Shared by minirtc callbacks, SDL rendering and SDL audio callbacks.
   std::atomic<ConnectionStatus> connection_status_ = ConnectionStatus::Closed;
   TraversalMode traversal_mode_ = TraversalMode::UnknownMode;
   int fps_ = 0;

src/gui/runtime/runtime_state.h

@@ -91,6 +91,7 @@ struct PlatformIntegrationState {
   bool show_portable_service_prompt_suppressed_window_ = false;
   bool portable_service_do_not_remind_ = false;
   bool portable_service_prompt_suppressed_ = false;
+  bool portable_service_installed_ = false;
   std::atomic<PortableServiceInstallState> portable_service_install_state_{
       PortableServiceInstallState::idle};
   std::thread portable_service_install_thread_;

src/gui/ui/common.slint

@@ -0,0 +1,458 @@
+// The legacy client uses ImGui::StyleColorsLight(). Keep the structural line
+// colors in one place so the Slint renderer produces the same visual weight.
+export global ImGuiLineStyle {
+    out property <color> border: #0000004d;
+    out property <color> separator: #6363639e;
+    out property <color> divider: #0000007a;
+    out property <color> control-separator: #b2b2b2;
+}
+
+// ImGui loads a 32px font atlas and applies per-window font scales. These
+// logical sizes reproduce those visual tiers on Slint's HiDPI renderer.
+export global ImGuiFontStyle {
+    out property <length> base: 12px;
+    out property <length> section-title: 18px;
+    out property <length> panel-label: 17px;
+    out property <length> field-value: 22px;
+    out property <length> prominent: 16px;
+    out property <length> body: 11px;
+    out property <length> small: 10px;
+}
+
+// Font Awesome 6 Free Solid glyphs used by the legacy ImGui client. The font
+// data is registered for every Slint window by GuiApplication before show().
+export global FontAwesomeIcons {
+    out property <string> angle-down: "\u{f107}";
+    out property <string> angle-left: "\u{f104}";
+    out property <string> angle-right: "\u{f105}";
+    out property <string> angle-up: "\u{f106}";
+    out property <string> arrow-right-long: "\u{f178}";
+    out property <string> bars: "\u{f0c9}";
+    out property <string> check: "\u{f00c}";
+    out property <string> circle-arrow-up: "\u{f0aa}";
+    out property <string> compress: "\u{f066}";
+    out property <string> computer-mouse: "\u{f8cc}";
+    out property <string> copy: "\u{f0c5}";
+    out property <string> display: "\u{e163}";
+    out property <string> expand: "\u{f065}";
+    out property <string> eye: "\u{f06e}";
+    out property <string> eye-slash: "\u{f070}";
+    out property <string> folder-open: "\u{f07c}";
+    out property <string> keyboard: "\u{f11c}";
+    out property <string> minus: "\u{f068}";
+    out property <string> pen: "\u{f304}";
+    out property <string> signal: "\u{f012}";
+    out property <string> shield-halved: "\u{f3ed}";
+    out property <string> square-full: "\u{f45c}";
+    out property <string> trash-can: "\u{f2ed}";
+    out property <string> volume-high: "\u{f028}";
+    out property <string> volume-xmark: "\u{f6a9}";
+    out property <string> xmark: "\u{f00d}";
+}
+
+export component IconButton inherits Rectangle {
+    in property <string> icon;
+    in property <string> tooltip;
+    in property <bool> danger: false;
+    in property <length> icon-size: 16px;
+    in property <color> icon-color: #24272d;
+    in property <color> normal-background: transparent;
+    in property <color> hover-background: #edf0f5;
+    in property <color> pressed-background: #d9dde5;
+    in property <bool> slashed: false;
+    callback clicked;
+
+    width: 30px;
+    height: 30px;
+    background: touch.pressed ? (danger ? #d92d20 : root.pressed-background)
+                              : touch.has-hover ? (danger ? #f04438 : root.hover-background)
+                                                : root.normal-background;
+    border-radius: 4px;
+
+    Text {
+        text: root.icon;
+        color: touch.has-hover && root.danger ? white : root.icon-color;
+        font-family: "Font Awesome 6 Free";
+        font-weight: 900;
+        font-size: root.icon-size;
+        horizontal-alignment: center;
+        vertical-alignment: center;
+    }
+
+    if root.slashed: Text {
+        text: "／";
+        color: touch.has-hover && root.danger ? white : root.icon-color;
+        font-size: root.icon-size + 7px;
+        font-weight: 700;
+        horizontal-alignment: center;
+        vertical-alignment: center;
+    }
+
+    touch := TouchArea {
+        clicked => { root.clicked(); }
+    }
+
+    if touch.has-hover && root.tooltip != "": Rectangle {
+        x: min(root.width - self.width, 0px);
+        y: root.height + 3px;
+        width: tip.preferred-width + 12px;
+        height: 24px;
+        background: #22252be8;
+        border-radius: 4px;
+        z: 20;
+        tip := Text {
+            text: root.tooltip;
+            color: white;
+            font-size: ImGuiFontStyle.small;
+            horizontal-alignment: center;
+            vertical-alignment: center;
+        }
+    }
+}
+
+// Retained for non-font artwork. UI action icons use IconButton so the Slint
+// and ImGui clients share Font Awesome's glyph geometry.
+export component ImageButton inherits Rectangle {
+    in property <image> icon;
+    in property <string> tooltip;
+    in property <bool> danger: false;
+    in property <length> icon-width: 16px;
+    in property <length> icon-height: 16px;
+    callback clicked;
+
+    width: 30px;
+    height: 30px;
+    background: touch.pressed ? (danger ? #d92d20 : #d9dde5)
+                              : touch.has-hover ? (danger ? #f04438 : #edf0f5)
+                                                : transparent;
+    border-radius: 4px;
+
+    Image {
+        x: (parent.width - self.width) / 2;
+        y: (parent.height - self.height) / 2;
+        width: root.icon-width;
+        height: root.icon-height;
+        source: root.icon;
+        image-fit: contain;
+    }
+
+    touch := TouchArea {
+        clicked => { root.clicked(); }
+    }
+
+    if touch.has-hover && root.tooltip != "": Rectangle {
+        x: min(root.width - self.width, 0px);
+        y: root.height + 3px;
+        width: tip.preferred-width + 12px;
+        height: 24px;
+        background: #22252be8;
+        border-radius: 4px;
+        z: 20;
+        tip := Text {
+            text: root.tooltip;
+            color: white;
+            font-size: ImGuiFontStyle.small;
+            horizontal-alignment: center;
+            vertical-alignment: center;
+        }
+    }
+}
+
+export component CompactComboBox inherits Rectangle {
+    in property <[string]> model;
+    in-out property <int> current-index: 0;
+    in property <bool> enabled: true;
+    property <bool> popup-animation-enabled: false;
+    property <float> popup-progress: 0.0;
+    callback selected(int);
+
+    animate popup-progress {
+        duration: 160ms;
+        easing: ease-out;
+        enabled: root.popup-animation-enabled;
+    }
+
+    width: 73px;
+    height: 24px;
+    background: root.enabled ? white : #f1f1f1;
+    border-width: 1px;
+    border-color: #bfc2c7;
+    border-radius: 3px;
+
+    Text {
+        x: 5px;
+        width: parent.width - 24px;
+        text: root.model[root.current-index];
+        color: root.enabled ? #202124 : #8b8f95;
+        font-size: ImGuiFontStyle.body;
+        overflow: elide;
+        vertical-alignment: center;
+    }
+    Rectangle {
+        x: parent.width - 21px;
+        width: 20px;
+        height: parent.height - 2px;
+        y: 1px;
+        background: root.enabled ? #9bc9f8 : #d7d9dc;
+        Text {
+            text: FontAwesomeIcons.angle-down;
+            color: #202124;
+            font-family: "Font Awesome 6 Free";
+            font-weight: 900;
+            font-size: 10px;
+            horizontal-alignment: center;
+            vertical-alignment: center;
+            transform-rotation: combo-popup.is-open ? 180deg : 0deg;
+            animate transform-rotation {
+                duration: 140ms;
+                easing: ease-out;
+                enabled: combo-popup.is-open;
+            }
+        }
+    }
+    TouchArea {
+        enabled: root.enabled;
+        clicked => {
+            root.popup-animation-enabled = false;
+            root.popup-progress = 0.0;
+            combo-popup.show();
+            popup-open-timer.running = true;
+        }
+    }
+
+    // Start on the next frame so the native popup first renders at zero
+    // height, making the downward expansion visible on every backend.
+    popup-open-timer := Timer {
+        interval: 16ms;
+        running: false;
+        triggered => {
+            self.running = false;
+            if combo-popup.is-open {
+                root.popup-animation-enabled = true;
+                root.popup-progress = 1.0;
+            }
+        }
+    }
+
+    combo-popup := PopupWindow {
+        x: 0px;
+        y: root.height;
+        width: root.width;
+        height: root.model.length * 23px;
+        close-policy: close-on-click-outside;
+
+        Rectangle {
+            // Keep the reveal anchored to the popup's top edge while the
+            // content settles downward into its final position.
+            y: (1.0 - root.popup-progress) * -8px;
+            width: parent.width;
+            height: parent.height * root.popup-progress;
+            opacity: root.popup-progress;
+            background: white;
+            border-width: 1px;
+            border-color: #bfc2c7;
+            border-radius: 3px;
+            clip: true;
+            for choice[index] in root.model: Rectangle {
+                y: index * 23px;
+                width: parent.width;
+                height: 23px;
+                background: option-touch.has-hover ? #dbeafb : index == root.current-index ? #eef5fd : white;
+                Text { x: 5px; width: parent.width - 10px; text: choice; color: #202124; font-size: ImGuiFontStyle.body; overflow: elide; vertical-alignment: center; }
+                option-touch := TouchArea {
+                    clicked => {
+                        popup-open-timer.running = false;
+                        root.popup-animation-enabled = false;
+                        root.popup-progress = 0.0;
+                        root.current-index = index;
+                        root.selected(index);
+                        combo-popup.close();
+                    }
+                }
+            }
+            Rectangle {
+                width: parent.width;
+                height: parent.height;
+                background: transparent;
+                border-width: 1px;
+                border-color: #bfc2c7;
+                border-radius: 3px;
+                z: 2;
+            }
+        }
+    }
+}
+
+export component ImGuiCheckBox inherits Rectangle {
+    in-out property <bool> checked;
+    in property <bool> enabled: true;
+
+    width: 21px;
+    height: 21px;
+    background: root.enabled ? white : #f1f1f1;
+    border-width: 1px;
+    border-color: check-touch.has-hover && root.enabled ? #8cbef2 : #b9bdc2;
+    border-radius: 4px;
+    if root.checked: Text {
+        text: FontAwesomeIcons.check;
+        color: root.enabled ? #2e86de : #8b8f95;
+        font-family: "Font Awesome 6 Free";
+        font-weight: 900;
+        font-size: 16px;
+        horizontal-alignment: center;
+        vertical-alignment: center;
+    }
+    check-touch := TouchArea {
+        enabled: root.enabled;
+        clicked => { root.checked = !root.checked; }
+    }
+}
+
+export component MiniToggleSwitch inherits Rectangle {
+    in-out property <bool> checked;
+    in property <bool> enabled: true;
+    callback toggled(bool);
+
+    width: 29px;
+    height: 16px;
+    background: !root.enabled ? (root.checked ? #6e9ddacc : #9a9a9acc)
+              : root.checked ? #2463c7 : #9a9a9a;
+    border-radius: 8px;
+    Rectangle {
+        x: root.checked ? parent.width - self.width - 2px : 2px;
+        y: 2px;
+        width: 12px;
+        height: 12px;
+        border-radius: 6px;
+        background: white;
+    }
+    TouchArea {
+        enabled: root.enabled;
+        clicked => { root.checked = !root.checked; root.toggled(root.checked); }
+    }
+}
+
+export component CompactButton inherits Rectangle {
+    in property <string> text;
+    in property <bool> primary: false;
+    in property <bool> enabled: true;
+    callback clicked;
+
+    width: 34px;
+    height: 24px;
+    background: !root.enabled ? #eceef0
+              : button-touch.pressed ? (root.primary ? #82b8f2 : #d8dadd)
+              : button-touch.has-hover ? (root.primary ? #b8d9fb : #f0f1f2)
+              : root.primary ? #a8d0fa : #e2e4e7;
+    border-width: 1px;
+    border-color: root.primary ? #9bc3ed : #c8cbd0;
+    border-radius: 3px;
+    Text {
+        text: root.text;
+        color: root.enabled ? #24272d : #8e9298;
+        font-size: ImGuiFontStyle.body;
+        overflow: elide;
+        horizontal-alignment: center;
+        vertical-alignment: center;
+    }
+    button-touch := TouchArea { enabled: root.enabled; clicked => { root.clicked(); } }
+}
+
+export component PrimaryButton inherits Rectangle {
+    in property <string> text;
+    in property <bool> enabled: true;
+    callback clicked;
+
+    min-width: 72px;
+    height: 30px;
+    background: !root.enabled ? #b8c1d1
+              : touch.pressed ? #1849a9
+              : touch.has-hover ? #2970d6
+              : #2463c7;
+    border-radius: 5px;
+
+    Text {
+        text: root.text;
+        color: white;
+        font-size: ImGuiFontStyle.body;
+        horizontal-alignment: center;
+        vertical-alignment: center;
+    }
+
+    touch := TouchArea {
+        enabled: root.enabled;
+        clicked => { root.clicked(); }
+    }
+}
+
+export component SecondaryButton inherits Rectangle {
+    in property <string> text;
+    in property <bool> enabled: true;
+    callback clicked;
+
+    min-width: 72px;
+    height: 30px;
+    background: !root.enabled ? #f1f2f4
+              : touch.pressed ? #dfe3e9
+              : touch.has-hover ? #f3f4f6 : white;
+    border-width: 1px;
+    border-color: #c9ced7;
+    border-radius: 5px;
+    clip: true;
+
+    Text {
+        text: root.text;
+        color: root.enabled ? #24272d : #949aa5;
+        font-size: ImGuiFontStyle.body;
+        horizontal-alignment: center;
+        vertical-alignment: center;
+    }
+
+    touch := TouchArea {
+        enabled: root.enabled;
+        clicked => { root.clicked(); }
+    }
+}
+
+export component ToggleSwitch inherits Rectangle {
+    in-out property <bool> checked;
+    in property <bool> enabled: true;
+    callback toggled(bool);
+
+    width: 36px;
+    height: 20px;
+    background: !root.enabled ? #d0d5dd : root.checked ? #2463c7 : #98a2b3;
+    border-radius: self.height / 2;
+
+    Rectangle {
+        x: root.checked ? parent.width - self.width - 3px : 3px;
+        y: 3px;
+        width: 14px;
+        height: 14px;
+        border-radius: 7px;
+        background: white;
+        animate x { duration: 100ms; easing: ease-in-out; }
+    }
+
+    TouchArea {
+        enabled: root.enabled;
+        clicked => {
+            root.checked = !root.checked;
+            root.toggled(root.checked);
+        }
+    }
+}
+
+export component SectionTitle inherits Text {
+    color: #00000080;
+    font-size: ImGuiFontStyle.section-title;
+    font-weight: 500;
+    vertical-alignment: center;
+}
+
+export component DialogSurface inherits Rectangle {
+    background: white;
+    border-width: 1px;
+    border-color: ImGuiLineStyle.border;
+    border-radius: 8px;
+}

src/gui/ui/crossdesk_ui.slint

@@ -0,0 +1,5 @@
+// Single AOT entry point. Generating one header for the entire UI avoids
+// duplicate imported-component definitions when C++ uses all three windows.
+export { MainWindow, RecentConnection, UiStrings } from "main_window.slint";
+export { StreamWindow, StreamTab, FileTransferEntry, NetworkStatsRow, StreamStrings } from "stream_window.slint";
+export { ServerWindow, ControllerEntry } from "server_window.slint";

src/gui/ui/icons/arrow-right-white.svg

@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 18 18"><path d="M2 9h13m-5-5 5 5-5 5" fill="none" stroke="#fff" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"/></svg>

src/gui/ui/icons/arrow-right.svg

@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 34 22"><path d="M3 11h25M20 3l8 8-8 8" fill="none" stroke="#050505" stroke-width="3.2" stroke-linecap="round" stroke-linejoin="round"/></svg>

src/gui/ui/icons/check.svg

@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 16 16"><path d="m2 8 3.2 3.2L14 2.8" fill="none" stroke="#2389e8" stroke-width="2.3" stroke-linecap="round" stroke-linejoin="round"/></svg>

src/gui/ui/icons/chevron-down.svg

@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 10 8"><path d="M1 2l4 4 4-4" fill="none" stroke="#111" stroke-width="1.5" stroke-linecap="round" stroke-linejoin="round"/></svg>

src/gui/ui/icons/chevron-left.svg

@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 10 14"><path d="m8 1-6 6 6 6" fill="none" stroke="#202124" stroke-width="1.7" stroke-linecap="round" stroke-linejoin="round"/></svg>

src/gui/ui/icons/chevron-right.svg

@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 10 14"><path d="m2 1 6 6-6 6" fill="none" stroke="#202124" stroke-width="1.7" stroke-linecap="round" stroke-linejoin="round"/></svg>

src/gui/ui/icons/chevron-up.svg

@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 12 9"><path d="m1 7 5-5 5 5" fill="none" stroke="#202124" stroke-width="1.6" stroke-linecap="round" stroke-linejoin="round"/></svg>

src/gui/ui/icons/close-white.svg

@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 16 16"><path d="M3 3l10 10M13 3L3 13" fill="none" stroke="#fff" stroke-width="1.7"/></svg>

src/gui/ui/icons/close.svg

@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 16 16"><path d="M3 3l10 10M13 3L3 13" fill="none" stroke="#000000" stroke-width="1"/></svg>

src/gui/ui/icons/compress.svg

@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 18 18"><path d="M7 7H2m5 0V2m4 5h5m-5 0V2M7 11H2m5 0v5m4-5h5m-5 0v5" fill="none" stroke="#202124" stroke-width="1.5"/></svg>

src/gui/ui/icons/copy.svg

@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 18 18"><rect x="6" y="3" width="9" height="11" rx="1.2" fill="#111"/><rect x="3" y="6" width="9" height="10" rx="1.2" fill="#111" stroke="#eff0f2" stroke-width="1.4"/></svg>

src/gui/ui/icons/expand.svg

@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 18 18"><path d="M7 2H2v5M11 2h5v5M7 16H2v-5m9 5h5v-5" fill="none" stroke="#202124" stroke-width="1.5"/><path d="M2 2l5 5m9-5-5 5M2 16l5-5m9 5-5-5" stroke="#202124" stroke-width="1.3"/></svg>

src/gui/ui/icons/eye-slash.svg

@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 18 18"><path d="M1.5 9s2.7-4.5 7.5-4.5S16.5 9 16.5 9 13.8 13.5 9 13.5 1.5 9 1.5 9Z" fill="none" stroke="#111" stroke-width="1.6"/><path d="M2 2l14 14" stroke="#111" stroke-width="2"/></svg>

src/gui/ui/icons/eye.svg

@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 18 18"><path d="M1.5 9s2.7-4.5 7.5-4.5S16.5 9 16.5 9 13.8 13.5 9 13.5 1.5 9 1.5 9Z" fill="none" stroke="#111" stroke-width="1.8"/><circle cx="9" cy="9" r="2.4" fill="#111"/></svg>

src/gui/ui/icons/file-up.svg

@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 18 18"><path d="M4 1h7l3 3v13H4V1Z" fill="none" stroke="#202124" stroke-width="1.4"/><path d="M11 1v4h4M9 14V8m-3 3 3-3 3 3" fill="none" stroke="#202124" stroke-width="1.4"/></svg>

src/gui/ui/icons/keyboard.svg

@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 18 16"><rect x="1" y="3" width="16" height="11" rx="1.5" fill="none" stroke="#202124" stroke-width="1.4"/><path d="M4 6h1m2 0h1m2 0h1m2 0h1M4 9h1m2 0h1m2 0h1m2 0h1M5 12h8" stroke="#202124" stroke-width="1.2" stroke-linecap="round"/></svg>

src/gui/ui/icons/maximize.svg

@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 16 16"><rect x="3" y="3" width="10" height="10" fill="none" stroke="#000000" stroke-width="1"/></svg>

src/gui/ui/icons/menu.svg

@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 16 16"><path d="M2 4h12M2 8h12M2 12h12" fill="none" stroke="#000000" stroke-width="1" stroke-linecap="square"/></svg>

src/gui/ui/icons/minimize.svg

@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 16 16"><path d="M2 8h12" fill="none" stroke="#000000" stroke-width="1"/></svg>

src/gui/ui/icons/monitor.svg

@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 18 18"><rect x="2" y="3" width="14" height="10" rx="1" fill="none" stroke="#202124" stroke-width="1.5"/><path d="M6 16h6M9 13v3" stroke="#202124" stroke-width="1.5"/></svg>

src/gui/ui/icons/mouse-off.svg

@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 18 18"><rect x="4" y="1" width="10" height="16" rx="5" fill="none" stroke="#202124" stroke-width="1.4"/><path d="M2 2l14 14" stroke="#202124" stroke-width="1.7"/></svg>

src/gui/ui/icons/mouse.svg

@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 16 18"><rect x="3" y="1" width="10" height="16" rx="5" fill="none" stroke="#202124" stroke-width="1.5"/><path d="M8 2v5" stroke="#202124" stroke-width="1.5"/></svg>

src/gui/ui/icons/pen-white.svg

@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 18 18"><path d="M3 12.8 11.9 4l2.2 2.2-8.8 8.9-3.1.7.8-3Zm9.7-9.6 1-1a1.4 1.4 0 0 1 2 0l.2.2a1.4 1.4 0 0 1 0 2l-1 1-2.2-2.2Z" fill="#fff"/></svg>

src/gui/ui/icons/pen.svg

@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 18 18"><path d="M3 12.8 11.9 4l2.2 2.2-8.8 8.9-3.1.7.8-3Z" fill="#111"/><path d="m12.7 3.2 1-1a1.4 1.4 0 0 1 2 0l.2.2a1.4 1.4 0 0 1 0 2l-1 1-2.2-2.2Z" fill="#111"/></svg>

src/gui/ui/icons/stats.svg

@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 18 18"><path d="M2 16V9h3v7H2Zm5 0V5h3v11H7Zm5 0V2h3v14h-3Z" fill="#202124"/></svg>

src/gui/ui/icons/trash-white.svg

@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 18 18"><path d="M5 5h8l-.6 10H5.6L5 5Zm2-2h4l1 1H6l1-1ZM4 4h10v1H4V4Z" fill="#fff"/></svg>

src/gui/ui/icons/trash.svg

@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 18 18"><path d="M5 5h8l-.6 10H5.6L5 5Zm2-2h4l1 1H6l1-1ZM4 4h10v1H4V4Z" fill="#111"/></svg>

src/gui/ui/icons/volume-off.svg

@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 18 18"><path d="M2 7h3l4-4v12l-4-4H2V7Z" fill="#202124"/><path d="M12 6l4 6m0-6-4 6" stroke="#202124" stroke-width="1.5"/></svg>

src/gui/ui/icons/volume.svg

@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 18 18"><path d="M2 7h3l4-4v12l-4-4H2V7Z" fill="#202124"/><path d="M12 6a4 4 0 0 1 0 6m2-8a7 7 0 0 1 0 10" fill="none" stroke="#202124" stroke-width="1.4" stroke-linecap="round"/></svg>

src/gui/ui/server_window.slint

@@ -0,0 +1,149 @@
+import { CompactComboBox, FontAwesomeIcons, IconButton, SecondaryButton, ImGuiLineStyle, ImGuiFontStyle } from "common.slint";
+
+export struct ControllerEntry {
+    remote-id: string,
+    display-name: string,
+}
+
+export component ServerWindow inherits Window {
+    title: "CrossDesk";
+    preferred-width: root.language-index == 0 ? 250px : root.language-index == 1 ? 330px : 430px;
+    preferred-height: 150px;
+    min-width: root.language-index == 0 ? 250px : root.language-index == 1 ? 330px : 430px;
+    max-width: root.language-index == 0 ? 250px : root.language-index == 1 ? 330px : 430px;
+    no-frame: true;
+    always-on-top: true;
+    background: transparent;
+    default-font-size: ImGuiFontStyle.base;
+
+    in property <[ControllerEntry]> controllers;
+    in property <[string]> controller-names;
+    in property <int> language-index: 0;
+    in-out property <int> selected-controller: 0;
+    in property <string> connection-label: "Connection status";
+    in property <string> connection-status: "";
+    in property <string> controller-label: "Controller";
+    in property <string> file-transfer-label: "File transfer";
+    in property <string> select-file-label: "Select file";
+    in property <bool> sending-file: false;
+    in property <bool> file-transfer-visible: false;
+    in property <float> file-progress: 0;
+    in property <string> file-progress-text: "";
+    in property <string> current-file-name: "";
+    in property <string> file-size-text: "";
+
+    callback title-drag(int, length, length);
+    callback toggle-collapsed(bool);
+    callback controller-selected(int);
+    callback select-file;
+    callback disconnect-controller;
+
+    private property <bool> collapsed: false;
+    private property <bool> transfer-hovered: false;
+
+    Rectangle {
+        width: root.width;
+        height: root.height;
+        background: white;
+        border-width: 1px;
+        border-color: ImGuiLineStyle.border;
+        border-radius: 8px;
+        clip: true;
+
+        Rectangle {
+            x: 0px;
+            y: 0px;
+            width: parent.width;
+            height: 30px;
+            background: #f8f9fb;
+            Rectangle { y: parent.height - 1px; height: 1px; background: ImGuiLineStyle.border; }
+            IconButton {
+                x: 0px;
+                y: 0px;
+                width: 30px; height: 30px;
+                icon: root.collapsed ? FontAwesomeIcons.angle-down : FontAwesomeIcons.angle-up;
+                icon-size: 12px;
+                clicked => { root.collapsed = !root.collapsed; root.toggle-collapsed(root.collapsed); }
+            }
+            drag := TouchArea {
+                x: 30px; width: parent.width - 30px;
+                property <int> phase: self.pressed ? 1 : 0;
+                changed phase => { root.title-drag(phase, self.mouse-x, self.mouse-y); }
+                moved => { if (self.pressed) { root.title-drag(2, self.mouse-x, self.mouse-y); } }
+            }
+        }
+
+        if !root.collapsed: Rectangle {
+            x: 12px; y: 38px; width: parent.width - 52px; height: 101px;
+            background: white; border-width: 1px; border-color: ImGuiLineStyle.border; border-radius: 5px;
+            VerticalLayout {
+                padding: 8px; spacing: 3px; alignment: start;
+                HorizontalLayout {
+                    height: 24px; spacing: 5px;
+                    Text { width: root.language-index == 0 ? 69px : 110px; text: root.controller-label; color: #434953; font-size: ImGuiFontStyle.body; vertical-alignment: center; overflow: elide; }
+                    CompactComboBox {
+                        width: root.language-index == 0 ? 108px : root.language-index == 1 ? 147px : 247px;
+                        model: root.controller-names;
+                        current-index <=> root.selected-controller;
+                        selected(index) => { root.controller-selected(index); }
+                    }
+                }
+                Rectangle { height: 1px; background: ImGuiLineStyle.separator; }
+                HorizontalLayout {
+                    height: 24px; spacing: 5px;
+                    Text { width: root.language-index == 0 ? 69px : 110px; text: root.connection-label; color: #434953; font-size: ImGuiFontStyle.body; vertical-alignment: center; overflow: elide; }
+                    Text { text: root.connection-status; color: #2463c7; font-size: ImGuiFontStyle.body; horizontal-alignment: left; vertical-alignment: center; overflow: elide; }
+                }
+                Rectangle { height: 1px; background: ImGuiLineStyle.separator; }
+                Rectangle {
+                    height: 24px;
+                    HorizontalLayout {
+                        y: 0px;
+                        width: parent.width;
+                        height: 24px;
+                        spacing: 5px;
+                        Text { width: root.language-index == 0 ? 69px : 110px; text: root.file-transfer-label; color: #434953; font-size: ImGuiFontStyle.body; vertical-alignment: center; overflow: elide; }
+                        SecondaryButton { width: root.language-index == 0 ? 78px : root.language-index == 1 ? 140px : 205px; height: 24px; text: root.select-file-label; clicked => { root.select-file(); } }
+                        Rectangle {
+                            visible: root.file-transfer-visible;
+                            width: 35px;
+                            Text {
+                                text: root.sending-file ? "↑ " + round(root.file-progress * 100) + "%" : "✓";
+                                color: root.sending-file ? #2463c7 : #25874b;
+                                font-size: ImGuiFontStyle.small;
+                                horizontal-alignment: center;
+                                vertical-alignment: center;
+                            }
+                            transfer-touch := TouchArea {
+                                changed has-hover => { root.transfer-hovered = self.has-hover; }
+                            }
+                        }
+                    }
+                }
+            }
+        }
+        if !root.collapsed: IconButton {
+            x: parent.width - 34px; y: 38px; width: 24px; height: 101px;
+            icon: FontAwesomeIcons.xmark;
+            icon-size: 13px;
+            icon-color: white;
+            normal-background: #ef2b2d;
+            hover-background: #d92d20;
+            pressed-background: #b42318;
+            border-radius: 5px;
+            clicked => { root.disconnect-controller(); }
+        }
+        if root.file-transfer-visible && root.transfer-hovered: Rectangle {
+            x: 15px; y: 67px; width: root.width - 30px; height: 70px;
+            background: #22252bf2;
+            border-radius: 5px;
+            z: 20;
+            VerticalLayout {
+                padding: 8px; spacing: 3px;
+                Text { text: root.current-file-name; color: white; font-size: ImGuiFontStyle.small; overflow: elide; }
+                Text { text: root.file-size-text; color: #e1e4e8; font-size: ImGuiFontStyle.small; }
+                Text { text: round(root.file-progress * 100) + "%  " + root.file-progress-text; color: #e1e4e8; font-size: ImGuiFontStyle.small; }
+            }
+        }
+    }
+}