[fix] disable privacy screen for legacy and web clients

.github/workflows/build.yml

@@ -271,7 +271,7 @@ jobs:
 
       - name: Build CrossDesk
         run: |
-          xmake f --target_minver=${MACOSX_DEPLOYMENT_TARGET} --CROSSDESK_VERSION=${VERSION_NUM} --USE_CUDA=false -y
+          xmake f --target_minver=${MACOSX_DEPLOYMENT_TARGET} --CROSSDESK_VERSION=${VERSION_NUM} --USE_CUDA=false -vyD
           xmake b -vy crossdesk
 
       - name: Package CrossDesk app
@@ -682,7 +682,9 @@ jobs:
           $portableFiles = @(
             @("crossdesk.exe", "CrossDesk.exe"),
             @("crossdesk_service.exe", "crossdesk_service.exe"),
-            @("crossdesk_session_helper.exe", "crossdesk_session_helper.exe")
+            @("crossdesk_session_helper.exe", "crossdesk_session_helper.exe"),
+            @("crossdesk_privacy_cursor_helper.exe", "crossdesk_privacy_cursor_helper.exe"),
+            @("crossdesk_privacy_window.dll", "crossdesk_privacy_window.dll")
           )
 
           foreach ($file in $portableFiles) {

apps/desktop/resources/windows/crossdesk_privacy_window.rc

@@ -0,0 +1,13 @@
+/*
+ * @Author: DI JUNKUN
+ * @Date: 2026-09-11
+ * Copyright (c) 2026 by DI JUNKUN, All Rights Reserved.
+ */
+
+IDI_CROSSDESK_LOGO ICON "crossdesk.ico"
+
+#define CROSSDESK_FILE_DESCRIPTION "CrossDesk Privacy Window"
+#define CROSSDESK_ORIGINAL_FILENAME "crossdesk_privacy_window.dll"
+#define CROSSDESK_FILE_TYPE VFT_DLL
+
+#include "version_info.rcinc"

apps/desktop/scripts/linux/package_deb.sh

@@ -87,7 +87,7 @@ if [[ ! -x "$BUILD_BINARY" ]]; then
     exit 1
 fi
 
-for command_name in readelf ldd dpkg-deb; do
+for command_name in readelf ldd dpkg-deb strip; do
     if ! command -v "$command_name" >/dev/null 2>&1; then
         echo "Required packaging command is missing: $command_name" >&2
         exit 1
@@ -128,6 +128,9 @@ if [[ -n "$SLINT_NEEDED" ]]; then
         exit 1
     fi
     install -m 0755 "$SLINT_LIBRARY" "$PRIVATE_DIR/$SLINT_NEEDED"
+    # Keep dynamic exports/relocations while removing unneeded symbols from the
+    # staged copy. Never strip Xmake's cached runtime in place.
+    strip --strip-unneeded "$PRIVATE_DIR/$SLINT_NEEDED"
 fi
 
 cat > "$BIN_DIR/$PKG_NAME" <<'EOF'
@@ -161,7 +164,7 @@ Architecture: $DEBIAN_ARCH
 Maintainer: $MAINTAINER
 Description: $DESCRIPTION
 Depends: libc6 (>= 2.31), libstdc++6 (>= 10), libx11-6, libxext6,
- libxrender1, libxft2, libxrandr2, libxfixes3, libxcursor1, libxcb1, libxcb-randr0,
+ libxrender1, libxft2, libxrandr2, libxfixes3, libxcursor1, libxi6, libxcb1, libxcb-randr0,
  libxcb-xtest0, libxcb-xinerama0, libxcb-shape0, libxcb-xkb1,
  libxcb-xfixes0, libxv1, libxtst6, $ALSA_RUNTIME_DEP, libsndio7.0,
  libxcb-shm0, libpulse0, libdrm2, libdbus-1-3, libgl1

apps/desktop/scripts/macos/bundle_app.sh

@@ -11,7 +11,7 @@ EXPECTED_ARCH="$2"
 APP_EXECUTABLE="$APP_BUNDLE/Contents/MacOS/CrossDesk"
 FRAMEWORKS_DIR="$APP_BUNDLE/Contents/Frameworks"
 
-for command_name in codesign install_name_tool lipo otool; do
+for command_name in codesign install_name_tool lipo otool strip; do
     if ! command -v "$command_name" >/dev/null 2>&1; then
         echo "Required bundling command is missing: $command_name" >&2
         exit 1
@@ -123,7 +123,11 @@ if ! otool -l "$APP_EXECUTABLE" | awk '
     install_name_tool -add_rpath "@executable_path/../Frameworks" "$APP_EXECUTABLE"
 fi
 
-# install_name_tool invalidates the linker's ad-hoc signature. Sign nested code
+# Strip only the staged runtime, retaining exported symbols for Slint's C ABI.
+# The package cache remains intact for debugging and other consumers.
+strip -S -x "$FRAMEWORKS_DIR/$SLINT_NAME"
+
+# install_name_tool and strip invalidate the linker's ad-hoc signature. Sign nested code
 # first, then seal the complete app bundle so local packages remain launchable.
 codesign --force --sign - "$FRAMEWORKS_DIR/$SLINT_NAME"
 codesign --force --deep --sign - "$APP_BUNDLE"

apps/desktop/scripts/windows/nsis_script.nsi

@@ -88,8 +88,10 @@ installApp:
     ; Bundle service-side binaries required by the Windows service flow
     File "..\..\..\..\build\windows\x64\release\crossdesk_service.exe"
     File "..\..\..\..\build\windows\x64\release\crossdesk_session_helper.exe"
+    File "..\..\..\..\build\windows\x64\release\crossdesk_privacy_cursor_helper.exe"
+    File "..\..\..\..\build\windows\x64\release\crossdesk_privacy_window.dll"
     ; Bundle runtime DLLs from the release output directory
-    File "..\..\..\..\build\windows\x64\release\*.dll"
+    File /x crossdesk_privacy_window.dll "..\..\..\..\build\windows\x64\release\*.dll"
 
     Call RegisterInstalledService
 
@@ -145,6 +147,8 @@ uninstallApp:
     Delete "$INSTDIR\CrossDesk.exe"
     Delete "$INSTDIR\crossdesk_service.exe"
     Delete "$INSTDIR\crossdesk_session_helper.exe"
+    Delete "$INSTDIR\crossdesk_privacy_cursor_helper.exe"
+    Delete "$INSTDIR\crossdesk_privacy_window.dll"
     Delete "$INSTDIR\uninstall.exe"
 
     ; Recursively delete installation directory

apps/desktop/src/app/main.cpp

@@ -24,6 +24,10 @@
 #include "path_manager.h"
 #include "render.h"
 
+#ifdef __linux__
+#include "platform/linux/privacy/privacy_guard.h"
+#endif
+
 #ifdef _WIN32
 namespace {
 
@@ -175,6 +179,14 @@ int HandleServiceCliCommand(const std::string& command) {
 #endif
 
 int main(int argc, char* argv[]) {
+#ifdef __linux__
+  // Run before GUI, configuration, logging or daemon initialization. The
+  // guard owns native privacy resources and restores them if this app exits.
+  if (argc == 2 &&
+      std::strcmp(argv[1], crossdesk::kLinuxPrivacyGuardArgument) == 0) {
+    return crossdesk::RunLinuxPrivacyGuard();
+  }
+#endif
 #ifdef _WIN32
   if (argc == 2 &&
       std::strcmp(argv[1], crossdesk::kSlintRendererProbeArgument) == 0) {
@@ -233,4 +245,4 @@ int main(int argc, char* argv[]) {
   crossdesk::Render render;
   render.Run();
   return 0;
-}
+}

apps/desktop/src/config_center/config_center.cpp

@@ -58,6 +58,14 @@ int ConfigCenter::Load() {
   video_frame_rate_ = static_cast<VIDEO_FRAME_RATE>(ini_.GetLongValue(
       section_, "video_frame_rate", static_cast<long>(video_frame_rate_)));
 
+  const long screen_capture_method_value = ini_.GetLongValue(
+      section_, "screen_capture_method",
+      static_cast<long>(ScreenCaptureMethod::Auto));
+  screen_capture_method_ = IsValidScreenCaptureMethod(screen_capture_method_value)
+                               ? static_cast<ScreenCaptureMethod>(
+                                     screen_capture_method_value)
+                               : ScreenCaptureMethod::Auto;
+
   const long video_adaptation_policy_value = ini_.GetLongValue(
       section_, "video_adaptation_policy",
       static_cast<long>(video_adaptation_policy_));
@@ -95,7 +103,12 @@ int ConfigCenter::Load() {
     ini_.SetLongValue(section_, "turn_mode", static_cast<long>(turn_mode_));
     persist_config_migration = true;
   }
-  enable_srtp_ = ini_.GetBoolValue(section_, "enable_srtp", enable_srtp_);
+  // Migrate the former user switch. Keep true in the file for older builds,
+  // while the current application always requests encrypted native media.
+  if (!ini_.GetBoolValue(section_, "enable_srtp", false)) {
+    ini_.SetBoolValue(section_, "enable_srtp", true);
+    persist_config_migration = true;
+  }
   enable_self_hosted_ =
       ini_.GetBoolValue(section_, "enable_self_hosted", enable_self_hosted_);
 
@@ -119,6 +132,8 @@ int ConfigCenter::Load() {
   enable_autostart_ =
       ini_.GetBoolValue(section_, "enable_autostart", enable_autostart_);
   enable_daemon_ = ini_.GetBoolValue(section_, "enable_daemon", enable_daemon_);
+  enable_privacy_screen_.store(
+      ini_.GetBoolValue(section_, "enable_privacy_screen", true));
   portable_service_prompt_suppressed_ =
       ini_.GetBoolValue(section_, "portable_service_prompt_suppressed",
                         portable_service_prompt_suppressed_);
@@ -145,6 +160,8 @@ int ConfigCenter::Save() {
                     static_cast<long>(video_quality_));
   ini_.SetLongValue(section_, "video_frame_rate",
                     static_cast<long>(video_frame_rate_));
+  ini_.SetLongValue(section_, "screen_capture_method",
+                    static_cast<long>(screen_capture_method_));
   ini_.SetLongValue(section_, "video_adaptation_policy",
                     static_cast<long>(video_adaptation_policy_));
   ini_.SetLongValue(section_, "video_encode_format",
@@ -153,7 +170,7 @@ int ConfigCenter::Save() {
   ini_.SetLongValue(section_, "turn_mode", static_cast<long>(turn_mode_));
   ini_.SetBoolValue(section_, "enable_turn",
                     turn_mode_ != TURN_MODE::DISABLED);
-  ini_.SetBoolValue(section_, "enable_srtp", enable_srtp_);
+  ini_.SetBoolValue(section_, "enable_srtp", true);
   ini_.SetBoolValue(section_, "enable_self_hosted", enable_self_hosted_);
 
   // only save when self hosted
@@ -165,6 +182,8 @@ int ConfigCenter::Save() {
 
   ini_.SetBoolValue(section_, "enable_autostart", enable_autostart_);
   ini_.SetBoolValue(section_, "enable_daemon", enable_daemon_);
+  ini_.SetBoolValue(section_, "enable_privacy_screen",
+                    enable_privacy_screen_.load());
   ini_.SetBoolValue(section_, "portable_service_prompt_suppressed",
                     portable_service_prompt_suppressed_);
 
@@ -213,6 +232,20 @@ int ConfigCenter::SetVideoFrameRate(VIDEO_FRAME_RATE video_frame_rate) {
   return 0;
 }
 
+int ConfigCenter::SetScreenCaptureMethod(ScreenCaptureMethod method) {
+  if (!IsValidScreenCaptureMethod(static_cast<long>(method))) {
+    return -1;
+  }
+  ini_.SetLongValue(section_, "screen_capture_method", static_cast<long>(method));
+  if (ini_.SaveFile(config_path_.c_str()) < 0) {
+    ini_.SetLongValue(section_, "screen_capture_method",
+                      static_cast<long>(screen_capture_method_));
+    return -1;
+  }
+  screen_capture_method_ = method;
+  return 0;
+}
+
 int ConfigCenter::SetVideoAdaptationPolicy(
     VIDEO_ADAPTATION_POLICY policy) {
   video_adaptation_policy_ = policy;
@@ -273,16 +306,6 @@ int ConfigCenter::SetTurn(bool enable_turn) {
   return SetTurnMode(turn_mode_);
 }
 
-int ConfigCenter::SetSrtp(bool enable_srtp) {
-  enable_srtp_ = enable_srtp;
-  ini_.SetBoolValue(section_, "enable_srtp", enable_srtp_);
-  SI_Error rc = ini_.SaveFile(config_path_.c_str());
-  if (rc < 0) {
-    return -1;
-  }
-  return 0;
-}
-
 int ConfigCenter::SetServerHost(const std::string& signal_server_host) {
   signal_server_host_ = signal_server_host;
   ini_.SetValue(section_, "signal_server_host", signal_server_host_.c_str());
@@ -370,6 +393,21 @@ int ConfigCenter::SetDaemon(bool enable_daemon) {
   return 0;
 }
 
+int ConfigCenter::SetPrivacyScreen(bool enable_privacy_screen) {
+  const bool previous = enable_privacy_screen_.load();
+  if (previous == enable_privacy_screen) return 0;
+  ini_.SetBoolValue(section_, "enable_privacy_screen", enable_privacy_screen);
+  if (ini_.SaveFile(config_path_.c_str()) < 0) {
+    ini_.SetBoolValue(section_, "enable_privacy_screen", previous);
+    LOG_ERROR("Failed to save automatic privacy screen preference");
+    return -1;
+  }
+  // RTC callbacks read only the value committed by the settings thread.
+  enable_privacy_screen_.store(enable_privacy_screen);
+  LOG_INFO("Privacy screen on incoming connection: {}", enable_privacy_screen);
+  return 0;
+}
+
 int ConfigCenter::SetPortableServicePromptSuppressed(bool suppressed) {
   portable_service_prompt_suppressed_ = suppressed;
   ini_.SetBoolValue(section_, "portable_service_prompt_suppressed",
@@ -394,6 +432,10 @@ ConfigCenter::VIDEO_FRAME_RATE ConfigCenter::GetVideoFrameRate() const {
   return video_frame_rate_;
 }
 
+ScreenCaptureMethod ConfigCenter::GetScreenCaptureMethod() const {
+  return screen_capture_method_;
+}
+
 ConfigCenter::VIDEO_ADAPTATION_POLICY
 ConfigCenter::GetVideoAdaptationPolicy() const {
   return video_adaptation_policy_;
@@ -403,8 +445,18 @@ ConfigCenter::VIDEO_ENCODE_FORMAT ConfigCenter::GetVideoEncodeFormat() const {
   return video_encode_format_;
 }
 
+bool ConfigCenter::IsHardwareVideoCodecAvailable() {
+#if (((defined(_WIN32) || defined(__linux__)) && !defined(__aarch64__) && \
+      !defined(__arm__) && USE_CUDA) ||                                   \
+     defined(__APPLE__))
+  return true;
+#else
+  return false;
+#endif
+}
+
 bool ConfigCenter::IsHardwareVideoCodec() const {
-  return hardware_video_codec_;
+  return IsHardwareVideoCodecAvailable() && hardware_video_codec_;
 }
 
 ConfigCenter::TURN_MODE ConfigCenter::GetTurnMode() const {
@@ -415,7 +467,7 @@ bool ConfigCenter::IsEnableTurn() const {
   return turn_mode_ != TURN_MODE::DISABLED;
 }
 
-bool ConfigCenter::IsEnableSrtp() const { return enable_srtp_; }
+bool ConfigCenter::IsEnableSrtp() const { return true; }
 
 std::string ConfigCenter::GetSignalServerHost() const {
   return signal_server_host_;
@@ -437,6 +489,10 @@ bool ConfigCenter::IsEnableAutostart() const { return enable_autostart_; }
 
 bool ConfigCenter::IsEnableDaemon() const { return enable_daemon_; }
 
+bool ConfigCenter::IsEnablePrivacyScreen() const {
+  return enable_privacy_screen_.load();
+}
+
 bool ConfigCenter::IsPortableServicePromptSuppressed() const {
   return portable_service_prompt_suppressed_;
 }

apps/desktop/src/config_center/config_center.h

@@ -7,9 +7,11 @@
 #ifndef _CONFIG_CENTER_H_
 #define _CONFIG_CENTER_H_
 
+#include <atomic>
 #include <string>
 
 #include "SimpleIni.h"
+#include "screen_capturer/screen_capture_method.h"
 
 namespace crossdesk {
 
@@ -39,17 +41,18 @@ class ConfigCenter {
   int SetLanguage(LANGUAGE language);
   int SetVideoQuality(VIDEO_QUALITY video_quality);
   int SetVideoFrameRate(VIDEO_FRAME_RATE video_frame_rate);
+  int SetScreenCaptureMethod(ScreenCaptureMethod method);
   int SetVideoAdaptationPolicy(VIDEO_ADAPTATION_POLICY policy);
   int SetVideoEncodeFormat(VIDEO_ENCODE_FORMAT video_encode_format);
   int SetHardwareVideoCodec(bool hardware_video_codec);
   int SetTurnMode(TURN_MODE turn_mode);
   int SetTurn(bool enable_turn);
-  int SetSrtp(bool enable_srtp);
   int SetServerHost(const std::string& signal_server_host);
   int SetServerPort(int signal_server_port);
   int SetSelfHosted(bool enable_self_hosted);
   int SetAutostart(bool enable_autostart);
   int SetDaemon(bool enable_daemon);
+  int SetPrivacyScreen(bool enable_privacy_screen);
   int SetPortableServicePromptSuppressed(bool suppressed);
   int SetFileTransferSavePath(const std::string& path);
 
@@ -58,8 +61,11 @@ class ConfigCenter {
   LANGUAGE GetLanguage() const;
   VIDEO_QUALITY GetVideoQuality() const;
   VIDEO_FRAME_RATE GetVideoFrameRate() const;
+  ScreenCaptureMethod GetScreenCaptureMethod() const;
   VIDEO_ADAPTATION_POLICY GetVideoAdaptationPolicy() const;
   VIDEO_ENCODE_FORMAT GetVideoEncodeFormat() const;
+  // Whether this build includes a hardware video codec backend.
+  static bool IsHardwareVideoCodecAvailable();
   bool IsHardwareVideoCodec() const;
   TURN_MODE GetTurnMode() const;
   bool IsEnableTurn() const;
@@ -71,6 +77,7 @@ class ConfigCenter {
   bool IsSelfHosted() const;
   bool IsEnableAutostart() const;
   bool IsEnableDaemon() const;
+  bool IsEnablePrivacyScreen() const;
   bool IsPortableServicePromptSuppressed() const;
   std::string GetFileTransferSavePath() const;
 
@@ -85,12 +92,12 @@ class ConfigCenter {
   LANGUAGE language_ = LANGUAGE::CHINESE;
   VIDEO_QUALITY video_quality_ = VIDEO_QUALITY::HIGH;
   VIDEO_FRAME_RATE video_frame_rate_ = VIDEO_FRAME_RATE::FPS_60;
+  ScreenCaptureMethod screen_capture_method_ = ScreenCaptureMethod::Auto;
   VIDEO_ADAPTATION_POLICY video_adaptation_policy_ =
       VIDEO_ADAPTATION_POLICY::QUALITY_PRIORITY;
   VIDEO_ENCODE_FORMAT video_encode_format_ = VIDEO_ENCODE_FORMAT::H264;
   bool hardware_video_codec_ = false;
   TURN_MODE turn_mode_ = TURN_MODE::AUTO_UDP_TCP;
-  bool enable_srtp_ = false;
   std::string signal_server_host_ = "";
   std::string signal_server_host_default_ = "api.crossdesk.cn";
   int signal_server_port_ = 0;
@@ -98,6 +105,7 @@ class ConfigCenter {
   bool enable_self_hosted_ = false;
   bool enable_autostart_ = false;
   bool enable_daemon_ = false;
+  std::atomic<bool> enable_privacy_screen_{true};
   bool portable_service_prompt_suppressed_ = false;
   std::string file_transfer_save_path_ = "";
 };

apps/desktop/src/gui/application/gui_application.cpp

@@ -34,6 +34,7 @@
 #include "platform.h"
 #include "platform/video_renderer.h"
 #include "rendering/slint_video_presenter.h"
+#include "runtime/privacy_control_state.h"
 #if _WIN32
 #include <windows.h>
 
@@ -1027,6 +1028,8 @@ void GuiApplication::InitializeSettings() {
   language_button_value_ = localization_language_index_;
   localization_language_ =
       static_cast<ConfigCenter::LANGUAGE>(localization_language_index_);
+  privacy_.SetText({
+      localization::privacy_screen_unlock_hint[localization_language_index_]});
 }
 
 bool GuiApplication::InitializeSDL() {
@@ -1221,12 +1224,27 @@ void GuiApplication::ResetSettingsUi() {
   ui_->main->set_adaptation_policy_index(
       video_adaptation_policy_button_value_);
   ui_->main->set_codec_index(video_encode_format_button_value_);
-  ui_->main->set_hardware_codec_enabled(enable_hardware_video_codec_);
+  const bool hardware_codec_available =
+      ConfigCenter::IsHardwareVideoCodecAvailable();
+  ui_->main->set_hardware_codec_available(hardware_codec_available);
+  ui_->main->set_hardware_codec_enabled(hardware_codec_available &&
+                                       enable_hardware_video_codec_);
   ui_->main->set_turn_enabled(enable_turn_);
-  ui_->main->set_srtp_enabled(enable_srtp_);
   ui_->main->set_self_hosted_enabled(enable_self_hosted_);
   ui_->main->set_autostart_enabled(enable_autostart_);
   ui_->main->set_daemon_enabled(enable_daemon_);
+  ui_->main->set_privacy_on_connect_enabled(
+      config_center_->IsEnablePrivacyScreen());
+#ifdef _WIN32
+  ui_->main->set_capture_method_visible(true);
+  ui_->main->set_capture_method_index(
+      static_cast<int>(config_center_->GetScreenCaptureMethod()));
+#endif
+#if defined(_WIN32) || defined(__APPLE__) || defined(__linux__)
+  ui_->main->set_privacy_setting_available(true);
+#else
+  ui_->main->set_privacy_setting_available(false);
+#endif
   ui_->main->set_file_save_path(file_transfer_save_path_buf_);
   ui_->main->set_server_host(signal_server_ip_self_);
   ui_->main->set_server_port(signal_server_port_self_);
@@ -1587,6 +1605,36 @@ void GuiApplication::BindStreamCallbacks() {
     SendReliableDataFrame(props->peer_, message.c_str(), message.size(),
                           props->control_data_label_.c_str());
   });
+  stream->on_toggle_privacy([this] {
+    auto props = SelectedSession();
+    if (!props || !props->peer_ || !props->control_mouse_ ||
+        props->connection_status_.load() != ConnectionStatus::Connected) return;
+    RemoteAction action{};
+    action.type = ControlType::privacy_command;
+    {
+      std::lock_guard lock(props->privacy_status_mutex_);
+      const auto& status = props->privacy_status_;
+      const uint64_t now = SDL_GetTicks();
+      const auto controls = GetPrivacyControlState(
+          status, props->privacy_status_received_, props->privacy_command_pending_,
+          now - props->privacy_status_tick_, now - props->privacy_command_tick_);
+      if (!controls.can_toggle) return;
+      action.pc.flag = controls.active ? PrivacyCommandFlag::disable
+                                      : PrivacyCommandFlag::enable;
+      action.pc.block_local_input = true;
+      props->privacy_command_pending_ = true;
+      props->privacy_command_tick_ = now;
+      props->privacy_request_revision_ = status.revision;
+    }
+    const auto message = action.to_json();
+    if (SendReliableDataFrame(props->peer_, message.data(), message.size(),
+                              props->control_data_label_.c_str()) != 0) {
+      std::lock_guard lock(props->privacy_status_mutex_);
+      props->privacy_command_pending_ = false;
+      props->privacy_status_received_ = false;
+      LOG_WARN("Privacy command send failed, remote_id={}", props->remote_id_);
+    }
+  });
   stream->on_toggle_mouse_control([this] {
     auto props = SelectedSession();
     if (!props || !props->connection_established_) {
@@ -1794,6 +1842,7 @@ void GuiApplication::Tick() {
   HandleConnectionStatusChange();
   HandlePendingPresenceProbe();
   HandlePresenceProbeTimeout();
+  HandlePrivacy();
   HandleWindowsServiceIntegration();
 #if defined(__linux__) && !defined(__APPLE__)
   SyncXWaylandWindowActivation();
@@ -2104,15 +2153,7 @@ void GuiApplication::SyncMainWindow() {
   ui_->main->set_latest_version(UiText(latest_version_));
   ui_->main->set_release_name(UiText(release_name_));
   ui_->main->set_release_date(UiText(release_date_));
-  ui_->main->set_settings_session_active(stream_window_inited_);
-#if (((defined(_WIN32) || defined(__linux__)) && !defined(__aarch64__) && \
-      !defined(__arm__) && USE_CUDA) ||                                   \
-     defined(__APPLE__))
-  ui_->main->set_hardware_codec_available(true);
-#else
-  ui_->main->set_hardware_codec_available(false);
-#endif
-
+  ui_->main->set_settings_session_active(HasActiveSession());
   if (show_offline_warning_window_) {
     ui_->main->set_offline_warning(UiText(offline_warning_text_));
     show_offline_warning_window_ = false;
@@ -2377,7 +2418,6 @@ void GuiApplication::SyncStreamWindow() {
     return;
   }
   (*ui_->stream)->set_window_maximized((*ui_->stream)->window().is_maximized());
-  (*ui_->stream)->set_srtp_enabled(enable_srtp_);
 #if defined(__APPLE__)
   if (ui_->stream_live_resize_configuration_attempts > 0) {
     if (ConfigureStreamWindowLiveResize(
@@ -2507,6 +2547,29 @@ void GuiApplication::SyncStreamWindow() {
               ? localization::receiving_screen[localization_language_index_]
               : std::string{}));
   (*ui_->stream)->set_mouse_control_enabled(props->control_mouse_);
+  {
+    std::lock_guard lock(props->privacy_status_mutex_);
+    const auto& status = props->privacy_status_;
+    const uint64_t now = SDL_GetTicks();
+    const auto controls = GetPrivacyControlState(
+        status, props->privacy_status_received_, props->privacy_command_pending_,
+        now - props->privacy_status_tick_, now - props->privacy_command_tick_);
+    const bool connected =
+        props->connection_status_.load() == ConnectionStatus::Connected;
+    (*ui_->stream)->set_privacy_active(controls.active);
+    (*ui_->stream)->set_privacy_off(connected && controls.off);
+    (*ui_->stream)->set_privacy_unsupported(controls.unsupported);
+    (*ui_->stream)->set_privacy_can_toggle(
+        props->control_mouse_ && connected && controls.can_toggle);
+    const int language = localization_language_index_;
+    std::string text = !connected || !props->privacy_status_received_
+        ? localization::privacy_screen[language]
+        : controls.unsupported ? localization::privacy_unsupported[language]
+        : controls.enabled ? localization::privacy_on[language]
+        : controls.off ? localization::privacy_off[language]
+        : localization::privacy_screen[language];
+    (*ui_->stream)->set_privacy_status_text(UiText(text));
+  }
   int remote_cursor_shape =
       static_cast<int>(RemoteCursorShape::default_cursor);
   bool remote_cursor_active = false;
@@ -2750,7 +2813,19 @@ void GuiApplication::SyncServerWindow() {
                     });
   }
 
-  if (has_connected_controller && !ui_->server) {
+  // Privacy protects local display output while preserving capture.
+  // Keep the panel alive throughout privacy transitions so remote
+  // controllers can still see and operate it without resetting its UI state.
+  bool show_controller_window = has_connected_controller;
+#if !defined(_WIN32) && !defined(__APPLE__) && !defined(__linux__)
+  // Preserve the existing panel behavior on other platforms.
+  const auto privacy_status = privacy_.Snapshot();
+  const bool privacy_covering = privacy_status.overlay_active ||
+      privacy_status.state == PrivacyState::starting ||
+      privacy_status.state == PrivacyState::stopping;
+  show_controller_window = show_controller_window && !privacy_covering;
+#endif
+  if (show_controller_window && !ui_->server) {
     ui_->server.emplace(ui::ServerWindow::create());
     RegisterFontAwesome((*ui_->server)->window());
     (*ui_->server)->set_controllers(ui_->controller_model);
@@ -2774,7 +2849,7 @@ void GuiApplication::SyncServerWindow() {
     server_window_created_ = true;
     server_window_inited_ = true;
   }
-  if (!has_connected_controller && ui_->server) {
+  if (!show_controller_window && ui_->server) {
     (*ui_->server)->hide();
     ui_->server.reset();
     server_window_created_ = false;
@@ -2907,9 +2982,9 @@ void GuiApplication::SaveSettingsFromUi() {
   video_adaptation_policy_button_value_ =
       std::clamp(main->get_adaptation_policy_index(), 0, 2);
   video_encode_format_button_value_ = std::clamp(main->get_codec_index(), 0, 1);
-  enable_hardware_video_codec_ = main->get_hardware_codec_enabled();
+  enable_hardware_video_codec_ = ConfigCenter::IsHardwareVideoCodecAvailable() &&
+                                  main->get_hardware_codec_enabled();
   enable_turn_ = main->get_turn_enabled();
-  enable_srtp_ = main->get_srtp_enabled();
   enable_self_hosted_ = main->get_self_hosted_enabled();
   enable_autostart_ = main->get_autostart_enabled();
   enable_daemon_ = main->get_daemon_enabled();
@@ -2918,6 +2993,8 @@ void GuiApplication::SaveSettingsFromUi() {
       static_cast<ConfigCenter::LANGUAGE>(language_button_value_);
   localization_language_index_ = language_button_value_;
   config_center_->SetLanguage(localization_language_);
+  privacy_.SetText({
+      localization::privacy_screen_unlock_hint[localization_language_index_]});
   config_center_->SetVideoQuality(
       static_cast<ConfigCenter::VIDEO_QUALITY>(video_quality_button_value_));
   config_center_->SetVideoFrameRate(static_cast<ConfigCenter::VIDEO_FRAME_RATE>(
@@ -2930,10 +3007,27 @@ void GuiApplication::SaveSettingsFromUi() {
           video_encode_format_button_value_));
   config_center_->SetHardwareVideoCodec(enable_hardware_video_codec_);
   config_center_->SetTurn(enable_turn_);
-  config_center_->SetSrtp(enable_srtp_);
   config_center_->SetSelfHosted(enable_self_hosted_);
   config_center_->SetAutostart(enable_autostart_);
   config_center_->SetDaemon(enable_daemon_);
+#ifdef _WIN32
+  if (!HasActiveSession()) {
+    const auto capture_method = static_cast<ScreenCaptureMethod>(
+        std::clamp(main->get_capture_method_index(), 0, 3));
+    if (config_center_->SetScreenCaptureMethod(capture_method) != 0) {
+      LOG_ERROR("Failed to save screen capture method");
+    }
+  }
+  main->set_capture_method_index(
+      static_cast<int>(config_center_->GetScreenCaptureMethod()));
+#endif
+#if defined(_WIN32) || defined(__APPLE__) || defined(__linux__)
+  if (config_center_->SetPrivacyScreen(main->get_privacy_on_connect_enabled()) !=
+      0) {
+    main->set_privacy_on_connect_enabled(
+        config_center_->IsEnablePrivacyScreen());
+  }
+#endif
 
   const std::string path(main->get_file_save_path());
   std::memset(file_transfer_save_path_buf_, 0,
@@ -2958,14 +3052,13 @@ void GuiApplication::SaveSettingsFromUi() {
   video_encode_format_button_value_last_ = video_encode_format_button_value_;
   enable_hardware_video_codec_last_ = enable_hardware_video_codec_;
   enable_turn_last_ = enable_turn_;
-  enable_srtp_last_ = enable_srtp_;
   enable_self_hosted_last_ = enable_self_hosted_;
   enable_autostart_last_ = enable_autostart_;
   enable_daemon_last_ = enable_daemon_;
   file_transfer_save_path_last_ = path;
   ui_->localized_language = -1;
 
-  if (!stream_window_inited_) {
+  if (!HasActiveSession()) {
     CloseAllRemoteSessions();
     CreateConnectionPeer();
   }
@@ -3267,9 +3360,12 @@ void GuiApplication::Cleanup() {
 #if _WIN32 && CROSSDESK_PORTABLE
   JoinPortableWindowsServiceInstallThread();
 #endif
+  privacy_.Disable();
   clipboard_.Shutdown();
   keyboard_.ForceReleasePressedKeys();
+  keyboard_.ReleaseAllRemotePressedKeys("application_exit");
   devices_.DestroyDevices();
+  privacy_.Shutdown();
   devices_.DestroyFactories();
   CloseAllRemoteSessions();
   WaitForSessionCleanup();

apps/desktop/src/gui/assets/layouts/layout.h

@@ -53,8 +53,6 @@
 #define ENABLE_HARDWARE_VIDEO_CODEC_CHECKBOX_PADDING_EN 218 * dpi_scale_
 #define ENABLE_TURN_CHECKBOX_PADDING_CN 171 * dpi_scale_
 #define ENABLE_TURN_CHECKBOX_PADDING_EN 218 * dpi_scale_
-#define ENABLE_SRTP_CHECKBOX_PADDING_CN 171 * dpi_scale_
-#define ENABLE_SRTP_CHECKBOX_PADDING_EN 218 * dpi_scale_
 #define ENABLE_SELF_HOSTED_SERVER_CHECKBOX_PADDING_CN 171 * dpi_scale_
 #define ENABLE_SELF_HOSTED_SERVER_CHECKBOX_PADDING_EN 218 * dpi_scale_
 #define ENABLE_AUTOSTART_PADDING_CN 171 * dpi_scale_

apps/desktop/src/gui/assets/layouts/layout_relative.h

@@ -57,8 +57,6 @@
 #define ENABLE_HARDWARE_VIDEO_CODEC_CHECKBOX_PADDING_EN 218
 #define ENABLE_TURN_CHECKBOX_PADDING_CN 171
 #define ENABLE_TURN_CHECKBOX_PADDING_EN 218
-#define ENABLE_SRTP_CHECKBOX_PADDING_CN 171
-#define ENABLE_SRTP_CHECKBOX_PADDING_EN 218
 #define ENABLE_SELF_HOSTED_SERVER_CHECKBOX_PADDING_CN 171
 #define ENABLE_SELF_HOSTED_SERVER_CHECKBOX_PADDING_EN 218
 #define ENABLE_AUTOSTART_PADDING_CN 171

apps/desktop/src/gui/assets/localization/localization_data.h

@@ -20,6 +20,12 @@ struct TranslationRow {
 
 // Single source of truth for all UI strings.
 #define CROSSDESK_LOCALIZATION_ALL(X)                                          \
+  X(privacy_screen, u8"隐私屏", "Privacy screen", u8"Приватный экран") \
+  X(privacy_enable, u8"开启隐私屏", "Enable privacy screen", u8"Включить приватный экран") \
+  X(privacy_disable, u8"关闭隐私屏", "Disable privacy screen", u8"Выключить приватный экран") \
+  X(privacy_on, u8"隐私屏：已开启", "Privacy screen: on", u8"Приватный экран: включён") \
+  X(privacy_off, u8"隐私屏：已关闭", "Privacy screen: off", u8"Приватный экран: выключен") \
+  X(privacy_unsupported, u8"隐私屏：不可用", "Privacy screen: unavailable", u8"Приватный экран: недоступен") \
   X(local_desktop, u8"本桌面", "Local Desktop", u8"Локальный рабочий стол")    \
   X(local_id, u8"本机ID", "Local ID", u8"Локальный ID")                        \
   X(local_id_copied_to_clipboard, u8"已复制到剪贴板", "Copied to clipboard",   \
@@ -120,6 +126,9 @@ struct TranslationRow {
     u8"стола")                                                                 \
   X(settings, u8"设置", "Settings", u8"Настройки")                             \
   X(language, u8"语言:", "Language:", u8"Язык:")                               \
+  X(screen_capture_method, u8"采集方式:", "Capture Method:",                  \
+    u8"Способ захвата:")                                                      \
+  X(screen_capture_method_auto, u8"自动", "Auto", u8"Авто")                 \
   X(video_quality, u8"画面质量:", "Video Quality:", u8"Качество видео:")       \
   X(video_frame_rate, u8"画面采集帧率:",                                       \
     "Video Capture Frame Rate:", u8"Частота захвата видео:")                   \
@@ -140,7 +149,6 @@ struct TranslationRow {
     "Enable Hardware Video Codec:", u8"Использовать аппаратный кодек:")        \
   X(enable_turn, u8"启用中继服务:",                                            \
     "Enable TURN Service:", u8"Включить TURN-сервис:")                         \
-  X(enable_srtp, u8"启用SRTP:", "Enable SRTP:", u8"Включить SRTP:")            \
   X(self_hosted_server_config, u8"自托管配置", "Self-Hosted Config",           \
     u8"Конфигурация self-hosted")                                              \
   X(self_hosted_server_settings, u8"自托管设置", "Self-Hosted Settings",       \
@@ -202,6 +210,8 @@ struct TranslationRow {
     "Confirm to delete this connection", u8"Удалить это подключение?")         \
   X(enable_autostart, u8"开机自启:", "Auto Start:", u8"Автозапуск:")           \
   X(enable_daemon, u8"启用守护进程:", "Enable Daemon:", u8"Включить демон:")   \
+  X(privacy_on_connect, u8"被连接时开启隐私屏:", "Privacy screen on connect:", \
+    u8"Приватность при подключении:")                                       \
   X(takes_effect_after_restart, u8"重启后生效", "Takes effect after restart",  \
     u8"Вступит в силу после перезапуска")                                      \
   X(select_file, u8"选择文件发送", "Select File to Send",                      \
@@ -237,6 +247,9 @@ struct TranslationRow {
     u8"Для работы приложения требуются следующие разрешения:")                 \
   X(show_main_window, u8"显示主界面", "Show Main Window",                    \
     u8"Показать главное окно")                                                \
+  X(privacy_screen_unlock_hint, u8"按下快捷键，解除隐私屏",                    \
+    "To turn off the privacy screen, press",                                 \
+    u8"Чтобы отключить приватный экран, нажмите")                             \
   X(exit_program, u8"退出", "Exit", u8"Выход")
 
 inline constexpr TranslationRow kTranslationRows[] = {

apps/desktop/src/gui/features/devices/session_device_manager.cpp

@@ -10,6 +10,10 @@
 #include "rd_log.h"
 #include "runtime/gui_runtime.h"
 #include "speaker_capturer_factory.h"
+#ifdef _WIN32
+#include "platform/windows/screen_capturer/screen_capturer_win.h"
+#include "platform/windows/input/mouse/mouse_controller.h"
+#endif
 
 namespace crossdesk {
 namespace {
@@ -75,6 +79,12 @@ int SessionDeviceManager::InitializeScreenCapturer() {
     screen_capturer_ =
         static_cast<ScreenCapturer *>(screen_capturer_factory_->Create());
   }
+  screen_capturer_->SetPrivacyController(&owner_.privacy_);
+#ifdef _WIN32
+  if (auto windows = dynamic_cast<ScreenCapturerWin*>(screen_capturer_)) {
+    windows->SetCaptureMethod(owner_.config_center_->GetScreenCaptureMethod());
+  }
+#endif
 
   last_frame_time_ = {};
   next_frame_deadline_ = {};
@@ -216,6 +226,13 @@ int SessionDeviceManager::StopScreenCapturer() {
   return 0;
 }
 
+#ifdef _WIN32
+void SessionDeviceManager::ReleaseRemoteMouseButtons() {
+  if (auto mouse = dynamic_cast<PlatformMouseController*>(mouse_controller_))
+    mouse->ReleasePressedButtons();
+}
+#endif
+
 void SessionDeviceManager::StartSpeakerCapturer() {
   speaker_capture_.SetEnabled(true);
 }
@@ -488,6 +505,7 @@ void SessionDeviceManager::DrainCapturedKeyboardInput() {
     std::lock_guard<std::mutex> lock(captured_keyboard_inputs_mutex_);
     inputs.swap(captured_keyboard_inputs_);
   }
+  if (owner_.privacy_.Snapshot().input_blocked) return;
   for (const CapturedKeyboardInput &input : inputs) {
     owner_.keyboard_.SendKeyCommand(input.key_code, input.is_down,
                                     input.scan_code, input.extended);

apps/desktop/src/gui/features/devices/session_device_manager.h

@@ -46,6 +46,9 @@ public:
   int InitializeScreenCapturer();
   int StartScreenCapturer();
   int StopScreenCapturer();
+#ifdef _WIN32
+  void ReleaseRemoteMouseButtons();
+#endif
   // Requests are asynchronous; Stop drains/revokes audio delivery before
   // returning so the connection peer can be destroyed safely.
   void StartSpeakerCapturer();
@@ -102,4 +105,4 @@ private:
 
 } // namespace crossdesk
 
-#endif
+#endif

apps/desktop/src/gui/features/input/keyboard_controller.cpp

@@ -213,6 +213,9 @@ int KeyboardController::SendKeyCommand(int key_code, bool is_down,
 bool KeyboardController::InjectRemoteKey(int key_code, bool is_down,
                                          uint32_t scan_code, bool extended) {
 #if _WIN32
+  if (owner_.privacy_.Engaged() && !IsWindowsPrivacyDesktopAvailable()) {
+    owner_.privacy_.Fail("Secure desktop or locked session; privacy screen will turn off");
+  }
   if (owner_.local_service_status_received_ &&
       IsSecureDesktopInteractionRequired(owner_.local_interactive_stage_)) {
     const std::string response = SendCrossDeskSecureDesktopKeyInput(
@@ -246,6 +249,7 @@ bool KeyboardController::InjectRemoteKey(int key_code, bool is_down,
     return true;
   }
 #endif
+  // Recheck after the desktop query; key-up cleanup remains allowed while paused.
   return owner_.devices_.SendKeyboardCommand(key_code, is_down, scan_code,
                                              extended);
 }
@@ -342,11 +346,50 @@ void KeyboardController::ReleaseRemotePressedKeys(const std::string& remote_id,
              keys_to_release.size(), remote_id, reason ? reason : "unknown");
   }
   for (const PressedKey& key : keys_to_release) {
-    InjectRemoteKey(key.key_code, false, key.scan_code, key.extended);
+    if (!InjectRemoteKey(key.key_code, false, key.scan_code, key.extended)) {
+#ifdef _WIN32
+      if (owner_.privacy_.Engaged()) {
+        std::lock_guard lock(remote_states_mutex_);
+        pending_privacy_releases_[key.key_code] = key;
+      }
+#endif
+    }
   }
 }
 
+void KeyboardController::ReleaseAllRemotePressedKeys(const char* reason) {
+  std::vector<std::string> remotes;
+  {
+    std::lock_guard lock(remote_states_mutex_);
+    for (const auto& [id, state] : remote_states_) remotes.push_back(id);
+  }
+  for (const auto& id : remotes) ReleaseRemotePressedKeys(id, reason);
+  CheckRemoteTimeouts();
+}
+
 void KeyboardController::CheckRemoteTimeouts() {
+#ifdef _WIN32
+  bool pending = false;
+  {
+    std::lock_guard lock(remote_states_mutex_);
+    pending = !pending_privacy_releases_.empty();
+  }
+  // A key-up rejected on the secure desktop is retained until the ordinary
+  // desktop returns. Never route cleanup through the security UI helper.
+  if (pending && IsWindowsPrivacyDesktopAvailable()) {
+    std::unordered_map<int, PressedKey> releases;
+    {
+      std::lock_guard lock(remote_states_mutex_);
+      releases.swap(pending_privacy_releases_);
+    }
+    for (const auto& [code, key] : releases) {
+      if (!owner_.devices_.SendKeyboardCommand(code, false, key.scan_code, key.extended)) {
+        std::lock_guard lock(remote_states_mutex_);
+        pending_privacy_releases_[code] = key;
+      }
+    }
+  }
+#endif
   const uint32_t now = static_cast<uint32_t>(SDL_GetTicks());
   std::vector<std::string> timed_out_remotes;
   {

apps/desktop/src/gui/features/input/keyboard_controller.h

@@ -30,6 +30,7 @@ public:
                         const RemoteAction &remote_action);
   void ReleaseRemotePressedKeys(const std::string &remote_id,
                                 const char *reason);
+  void ReleaseAllRemotePressedKeys(const char* reason);
   void CheckRemoteTimeouts();
 
 private:
@@ -58,6 +59,9 @@ private:
   uint32_t last_heartbeat_tick_ = 0;
   std::unordered_map<std::string, RemoteState> remote_states_;
   std::mutex remote_states_mutex_;
+#ifdef _WIN32
+  std::unordered_map<int, PressedKey> pending_privacy_releases_;
+#endif
 };
 
 } // namespace crossdesk

apps/desktop/src/gui/features/settings/settings_manager.cpp

@@ -308,7 +308,6 @@ int SettingsManager::Load() {
   owner_.enable_hardware_video_codec_ =
       owner_.config_center_->IsHardwareVideoCodec();
   owner_.enable_turn_ = owner_.config_center_->IsEnableTurn();
-  owner_.enable_srtp_ = owner_.config_center_->IsEnableSrtp();
   owner_.enable_self_hosted_ = owner_.config_center_->IsSelfHosted();
   owner_.enable_autostart_ = owner_.config_center_->IsEnableAutostart();
   owner_.enable_daemon_ = owner_.config_center_->IsEnableDaemon();
@@ -335,7 +334,6 @@ int SettingsManager::Load() {
   owner_.enable_hardware_video_codec_last_ =
       owner_.enable_hardware_video_codec_;
   owner_.enable_turn_last_ = owner_.enable_turn_;
-  owner_.enable_srtp_last_ = owner_.enable_srtp_;
   owner_.enable_self_hosted_last_ = owner_.enable_self_hosted_;
   owner_.enable_autostart_last_ = owner_.enable_autostart_;
 

apps/desktop/src/gui/runtime/connection_runtime.cpp

@@ -25,6 +25,16 @@ constexpr auto kPresenceRefreshInterval = std::chrono::seconds(30);
 constexpr auto kPresenceRetryInterval = std::chrono::seconds(1);
 }  // namespace
 
+bool GuiRuntime::HasActiveSession() {
+  if (stream_window_inited_) return true;
+  std::shared_lock lock(connection_status_mutex_);
+  return std::any_of(connection_status_.begin(), connection_status_.end(),
+                     [](const auto& entry) {
+                       return entry.second == ConnectionStatus::Connecting ||
+                              entry.second == ConnectionStatus::Connected;
+                     });
+}
+
 void GuiRuntime::HandleConnectionStatusChange() {
   if (!signal_connected_ || !peer_) {
     return;
@@ -121,6 +131,9 @@ void GuiRuntime::HandlePresenceProbeTimeout() {
 void GuiRuntime::HandleServerControllerDisconnected(
     const std::string& remote_id, const char* reason) {
   keyboard_.ReleaseRemotePressedKeys(remote_id, reason);
+#ifdef _WIN32
+  devices_.ReleaseRemoteMouseButtons();
+#endif
   {
     std::lock_guard lock(remote_pointer_input_mutex_);
     last_remote_pointer_input_time_.erase(remote_id);
@@ -133,6 +146,7 @@ void GuiRuntime::HandleServerControllerDisconnected(
     std::unique_lock lock(connection_status_mutex_);
     connection_status_.erase(remote_id);
     connection_host_names_.erase(remote_id);
+    privacy_sessions_.Disconnected(remote_id);
     for (const auto& [id, status] : connection_status_) {
       if (status != ConnectionStatus::Connected) {
         continue;
@@ -151,6 +165,10 @@ void GuiRuntime::HandleServerControllerDisconnected(
     return;
   }
 
+  LOG_INFO("Last remote controller disconnected; recovering privacy, reason={}",
+           reason ? reason : "unknown");
+  privacy_.Disconnected();
+
   need_to_create_server_window_.store(false, std::memory_order_release);
   need_to_destroy_server_window_.store(true, std::memory_order_release);
   is_server_mode_ = false;

apps/desktop/src/gui/runtime/gui_runtime.h

@@ -8,6 +8,7 @@
 #define _GUI_RUNTIME_H_
 
 #include <atomic>
+#include <deque>
 #include <memory>
 #include <string>
 
@@ -16,8 +17,10 @@
 #include "features/file_transfer/file_transfer_manager.h"
 #include "features/input/keyboard_controller.h"
 #include "features/settings/settings_manager.h"
+#include "privacy_controller.h"
 #include "runtime/gui_state.h"
 #include "runtime/peer_event_handler.h"
+#include "runtime/privacy_session_policy.h"
 
 namespace crossdesk {
 
@@ -55,9 +58,14 @@ class GuiRuntime : protected gui_detail::GuiState {
   void HandleConnectionStatusChange();
   void HandlePendingPresenceProbe();
   void HandlePresenceProbeTimeout();
+  bool HasActiveSession();
   void HandleServerControllerDisconnected(const std::string& remote_id,
                                           const char* reason);
   void HandleWindowsServiceIntegration();
+  void HandlePrivacy();
+  bool IsAuthorizedController(const std::string& remote_id);
+  void SetControllerPrivacySupport(const std::string& remote_id, bool supported);
+  void QueuePrivacyCommand(const std::string& remote_id, const PrivacyCommand& command);
 
   void CloseRemoteSession(std::shared_ptr<RemoteSession> props);
   void CloseAllRemoteSessions();
@@ -87,6 +95,12 @@ class GuiRuntime : protected gui_detail::GuiState {
   bool EnsureMacAccessibilityPermission();
 #endif
 
+  PrivacyController privacy_;
+  PrivacySessionPolicy privacy_sessions_;
+  std::mutex privacy_commands_mutex_;
+  std::deque<std::pair<std::string, PrivacyCommand>> privacy_commands_;
+  uint32_t last_privacy_revision_ = 0;
+  uint64_t last_privacy_status_tick_ = 0;
   ClipboardController clipboard_;
   SessionDeviceManager devices_;
   FileTransferManager transfers_;

apps/desktop/src/gui/runtime/peer_data_callbacks.cpp

@@ -147,6 +147,46 @@ void PeerEventHandler::OnReceiveDataBuffer(
   }
 
   std::string remote_id(user_id, user_id_size);
+  if (remote_action.type == ControlType::privacy_status) {
+    if (auto props = runtime->FindRemoteSession(remote_id)) {
+      if (source_id != props->control_data_label_) return;
+      std::lock_guard lock(props->privacy_status_mutex_);
+      if (!props->privacy_status_received_ ||
+          static_cast<int32_t>(remote_action.ps.revision - props->privacy_status_.revision) >= 0) {
+        props->privacy_status_ = remote_action.ps;
+        props->privacy_status_received_ = true;
+        props->privacy_status_tick_ = SDL_GetTicks();
+        if (static_cast<int32_t>(remote_action.ps.revision - props->privacy_request_revision_) > 0 &&
+            remote_action.ps.state != PrivacyState::starting &&
+            remote_action.ps.state != PrivacyState::stopping)
+          props->privacy_command_pending_ = false;
+      }
+    }
+    return;
+  }
+  if (remote_action.type == ControlType::privacy_command) {
+    if (source_id == runtime->control_data_label_)
+      runtime->QueuePrivacyCommand(remote_id, remote_action.pc);
+    return;
+  }
+  const bool operates_host = remote_action.type == ControlType::mouse ||
+      remote_action.type == ControlType::keyboard || remote_action.type == ControlType::keyboard_state ||
+      remote_action.type == ControlType::service_command || remote_action.type == ControlType::display_id ||
+      remote_action.type == ControlType::audio_capture;
+  if (operates_host) {
+    if (!runtime->IsAuthorizedController(remote_id)) return;
+#ifdef _WIN32
+    // KeyboardController checks the desktop immediately before each native
+    // key injection, including state reconciliation and cleanup. Avoid a
+    // second synchronous session query for every received keyboard packet.
+    const bool keyboard_input = remote_action.type == ControlType::keyboard ||
+                                remote_action.type == ControlType::keyboard_state;
+    if (!keyboard_input && runtime->privacy_.Engaged() &&
+        !IsWindowsPrivacyDesktopAvailable()) {
+      runtime->privacy_.Fail("Secure desktop or lock screen; privacy screen will turn off");
+    }
+#endif
+  }
   if (remote_action.type == ControlType::service_status) {
     if (auto props = runtime->FindRemoteSession(remote_id)) {
       runtime->ApplyRemoteServiceStatus(*props, remote_action.ss);
@@ -155,6 +195,9 @@ void PeerEventHandler::OnReceiveDataBuffer(
   }
 
   if (remote_action.type == ControlType::service_command) {
+    if (runtime->privacy_.Engaged()) {
+      runtime->privacy_.Fail("Security shortcut requested; privacy screen will turn off");
+    }
 #if _WIN32
     if (remote_action.c.flag == ServiceCommandFlag::send_sas) {
       runtime->pending_windows_service_sas_.store(true,
@@ -247,6 +290,10 @@ void PeerEventHandler::OnReceiveDataBuffer(
         runtime->connection_host_names_[remote_id] = host_name;
       }
       LOG_INFO("Remote hostname: [{}]", host_name);
+      if (source_id == runtime->control_data_label_) {
+        runtime->SetControllerPrivacySupport(
+            remote_id, remote_action.i.supports_privacy_screen);
+      }
       remote_action_codec::Free(remote_action);
     }
   } else {

apps/desktop/src/gui/runtime/peer_event_handler.cpp

@@ -264,7 +264,8 @@ void PeerEventHandler::OnConnectionStatus(ConnectionStatus status,
           props->remote_cursor_state_received_ = false;
         }
         {
-          RemoteAction remote_action;
+          RemoteAction remote_action{};
+          remote_action.i.supports_privacy_screen = true;
           remote_action.i.display_num =
               runtime->devices_.display_info_list().size();
           remote_action.i.display_list =
@@ -405,6 +406,16 @@ void PeerEventHandler::OnConnectionStatus(ConnectionStatus status,
     runtime->show_connection_status_window_ = true;
     {
       std::unique_lock lock(runtime->connection_status_mutex_);
+      if (status == ConnectionStatus::Connected) {
+        // Wait for explicit desktop capability before enabling privacy or
+        // sending privacy messages. Legacy and web controllers never opt in.
+        runtime->privacy_sessions_.Connected(
+            remote_id, runtime->config_center_->IsEnablePrivacyScreen());
+        if (!runtime->privacy_sessions_.CanEnable() &&
+            runtime->privacy_.Engaged()) {
+          runtime->privacy_.Disable();
+        }
+      }
       runtime->connection_status_[remote_id] = status;
     }
 
@@ -414,7 +425,8 @@ void PeerEventHandler::OnConnectionStatus(ConnectionStatus status,
         runtime->last_windows_service_status_tick_ = 0;
 #endif
         {
-          RemoteAction remote_action;
+          RemoteAction remote_action{};
+          remote_action.i.supports_privacy_screen = true;
           remote_action.i.display_num =
               runtime->devices_.display_info_list().size();
           remote_action.i.display_list =

apps/desktop/src/gui/runtime/privacy_control_state.h

@@ -0,0 +1,53 @@
+/*
+ * @Author: DI JUNKUN
+ * @Date: 2026-09-12
+ * Copyright (c) 2026 by DI JUNKUN, All Rights Reserved.
+ */
+
+#ifndef _PRIVACY_CONTROL_STATE_H_
+#define _PRIVACY_CONTROL_STATE_H_
+
+#include <cstdint>
+
+#include "remote_action.h"
+
+namespace crossdesk {
+
+struct PrivacyControlState {
+  bool active = false;
+  bool enabled = false;
+  bool off = false;
+  bool unsupported = false;
+  bool can_toggle = false;
+};
+
+// Use the same host-confirmed state for presentation and command admission.
+// Missing confirmation or a failure makes only this toolbar control unavailable.
+inline PrivacyControlState GetPrivacyControlState(
+    const PrivacyStatus& status, bool received, bool command_pending,
+    uint64_t status_age_ms, uint64_t command_age_ms) {
+  PrivacyControlState result;
+  const bool timeout = command_pending && command_age_ms > 15000;
+  result.unsupported = timeout ||
+      (received && (status_age_ms > 5000 || !status.supported ||
+                    status.state == PrivacyState::failed));
+  if (result.unsupported) return result;
+
+  result.active = status.overlay_active || status.remote_paused ||
+                  status.state == PrivacyState::on ||
+                  status.state == PrivacyState::starting ||
+                  status.state == PrivacyState::stopping ||
+                  status.state == PrivacyState::failed;
+  // A command in flight only gates repeated clicks; it adds no display state.
+  result.enabled = received &&
+                   status.state == PrivacyState::on && status.overlay_active &&
+                   !status.remote_paused;
+  result.off = received &&
+               status.state == PrivacyState::off && !result.active;
+  result.can_toggle = !command_pending && (result.active || received);
+  return result;
+}
+
+}  // namespace crossdesk
+
+#endif

apps/desktop/src/gui/runtime/privacy_runtime.cpp

@@ -0,0 +1,114 @@
+/*
+ * @Author: DI JUNKUN
+ * @Date: 2026-09-11
+ * Copyright (c) 2026 by DI JUNKUN, All Rights Reserved.
+ */
+
+#include <cstring>
+#include <shared_mutex>
+
+#include "rd_log.h"
+#include "runtime/gui_runtime.h"
+
+namespace crossdesk {
+
+bool GuiRuntime::IsAuthorizedController(const std::string& remote_id) {
+  // Connections appear here only after the existing password/signalling/RTC
+  // admission path. Outgoing/viewer sessions live in remote_sessions_ instead.
+  std::shared_lock lock(connection_status_mutex_);
+  const auto found = connection_status_.find(remote_id);
+  return found != connection_status_.end() &&
+         found->second == ConnectionStatus::Connected;
+}
+
+void GuiRuntime::SetControllerPrivacySupport(const std::string& remote_id,
+                                           bool supported) {
+  std::unique_lock lock(connection_status_mutex_);
+  const auto found = connection_status_.find(remote_id);
+  if (found == connection_status_.end() ||
+      found->second != ConnectionStatus::Connected) return;
+
+  const bool automatic_enable =
+      privacy_sessions_.SetSupported(remote_id, supported);
+  if (!privacy_sessions_.CanEnable()) {
+    if (privacy_.Engaged()) privacy_.Disable();
+  } else if (automatic_enable && config_center_->IsEnablePrivacyScreen()) {
+    privacy_.EnableOnConnection();
+  }
+}
+
+void GuiRuntime::QueuePrivacyCommand(const std::string& remote_id,
+                                     const PrivacyCommand& command) {
+  std::shared_lock session_lock(connection_status_mutex_);
+  const auto found = connection_status_.find(remote_id);
+  if (found == connection_status_.end() ||
+      found->second != ConnectionStatus::Connected ||
+      !privacy_sessions_.Supports(remote_id)) return;
+  std::lock_guard lock(privacy_commands_mutex_);
+  if (privacy_commands_.size() < 32)
+    privacy_commands_.emplace_back(remote_id, command);
+}
+
+void GuiRuntime::HandlePrivacy() {
+  std::deque<std::pair<std::string, PrivacyCommand>> commands;
+  {
+    std::lock_guard lock(privacy_commands_mutex_);
+    commands.swap(privacy_commands_);
+  }
+  for (const auto& [remote_id, command] : commands) {
+    // Keep admission and activation under the connection lock so an unknown
+    // controller cannot join between the capability check and enabling.
+    std::shared_lock lock(connection_status_mutex_);
+    const auto found = connection_status_.find(remote_id);
+    if (found == connection_status_.end() ||
+        found->second != ConnectionStatus::Connected ||
+        !privacy_sessions_.Supports(remote_id)) continue;
+    if (command.flag == PrivacyCommandFlag::enable) {
+      if (privacy_sessions_.CanEnable())
+        privacy_.Enable(command.block_local_input);
+    } else if (command.flag == PrivacyCommandFlag::disable) {
+      privacy_.Disable();
+    }
+    last_privacy_status_tick_ = 0;
+  }
+  auto status = privacy_.Snapshot();
+  const uint64_t now = SDL_GetTicks();
+  if (!peer_ || (last_privacy_status_tick_ != 0 &&
+                 status.revision == last_privacy_revision_ &&
+                 now - last_privacy_status_tick_ < 1000))
+    return;
+  std::vector<std::string> controllers;
+  {
+    std::shared_lock lock(connection_status_mutex_);
+    for (const auto& [id, state] : connection_status_)
+      if (state == ConnectionStatus::Connected && privacy_sessions_.Supports(id))
+        controllers.push_back(id);
+    if (!privacy_sessions_.CanEnable()) {
+      status.state = PrivacyState::unsupported;
+      status.supported = false;
+      status.input_block_supported = false;
+      std::strcpy(status.reason,
+                  "A connected controller does not support privacy screen");
+    }
+  }
+  RemoteAction action{};
+  action.type = ControlType::privacy_status;
+  action.ps = status;
+  const auto message = action.to_json();
+  bool sent = true;
+  for (const auto& id : controllers) {
+    const int result = SendReliableDataFrameToPeer(
+        peer_, message.data(), message.size(), control_data_label_.c_str(),
+        id.data(), id.size());
+    if (result != 0) {
+      sent = false;
+      LOG_WARN("Privacy status send failed, peer={}, ret={}", id, result);
+    }
+  }
+  if (sent) {
+    last_privacy_revision_ = status.revision;
+    last_privacy_status_tick_ = now;
+  }
+}
+
+}  // namespace crossdesk

apps/desktop/src/gui/runtime/privacy_session_policy.h

@@ -0,0 +1,61 @@
+/*
+ * @Author: DI JUNKUN
+ * @Date: 2026-09-15
+ * Copyright (c) 2026 by DI JUNKUN, All Rights Reserved.
+ */
+
+#ifndef _PRIVACY_SESSION_POLICY_H_
+#define _PRIVACY_SESSION_POLICY_H_
+
+#include <algorithm>
+#include <string>
+#include <unordered_map>
+
+namespace crossdesk {
+
+// Guarded by GuiRuntime's connection_status_mutex_. Privacy covers the shared
+// desktop, so every connected controller must explicitly support it.
+class PrivacySessionPolicy {
+ public:
+  void Connected(const std::string& remote_id, bool automatic_privacy) {
+    const auto [entry, inserted] = controllers_.try_emplace(remote_id, false);
+    if (inserted && controllers_.size() == 1 && automatic_privacy) {
+      automatic_controller_ = remote_id;
+    }
+  }
+
+  void Disconnected(const std::string& remote_id) {
+    controllers_.erase(remote_id);
+    if (automatic_controller_ == remote_id) automatic_controller_.clear();
+  }
+
+  // Consume automatic activation once, on the first controller's host info.
+  // Repeated metadata or a later join must not undo an explicit privacy exit.
+  bool SetSupported(const std::string& remote_id, bool supported) {
+    const auto entry = controllers_.find(remote_id);
+    if (entry == controllers_.end()) return false;
+    entry->second = supported && remote_id.find("web") == std::string::npos;
+    if (automatic_controller_ != remote_id) return false;
+    automatic_controller_.clear();
+    return CanEnable();
+  }
+
+  bool Supports(const std::string& remote_id) const {
+    const auto entry = controllers_.find(remote_id);
+    return entry != controllers_.end() && entry->second;
+  }
+
+  bool CanEnable() const {
+    return !controllers_.empty() &&
+           std::all_of(controllers_.begin(), controllers_.end(),
+                       [](const auto& entry) { return entry.second; });
+  }
+
+ private:
+  std::unordered_map<std::string, bool> controllers_;
+  std::string automatic_controller_;
+};
+
+}  // namespace crossdesk
+
+#endif

apps/desktop/src/gui/runtime/remote_action_codec.cpp

@@ -55,6 +55,7 @@ bool Deserialize(const char *data, size_t size, RemoteAction &out) {
   out.type = static_cast<ControlType>(data[offset++]);
 
   if (out.type == ControlType::host_infomation) {
+    out.i.supports_privacy_screen = false;
     size_t name_len;
     if (!read(&name_len, sizeof(size_t)) ||
         name_len >= sizeof(out.i.host_name)) {

apps/desktop/src/gui/runtime/remote_session.h

@@ -157,6 +157,13 @@ struct RemoteSession {
   std::string audio_capture_button_label_ = "Audio Capture";
   std::string remote_host_name_;
   bool remote_service_status_received_ = false;
+  std::mutex privacy_status_mutex_;
+  PrivacyStatus privacy_status_{};
+  bool privacy_status_received_ = false;
+  bool privacy_command_pending_ = false;
+  uint64_t privacy_command_tick_ = 0;
+  uint32_t privacy_request_revision_ = 0;
+  uint64_t privacy_status_tick_ = 0;
   bool remote_service_available_ = false;
   std::string remote_interactive_stage_;
   std::vector<DisplayInfo> display_info_list_;
@@ -184,4 +191,4 @@ using RemoteSessionPtr = std::shared_ptr<RemoteSession>;
 
 }  // namespace crossdesk::gui_detail
 
-#endif
+#endif

apps/desktop/src/gui/runtime/runtime_state.h

@@ -136,7 +136,6 @@ struct UserSettingsState {
   int video_encode_format_button_value_ = 0;
   bool enable_hardware_video_codec_ = true;
   bool enable_turn_ = true;
-  bool enable_srtp_ = false;
   char signal_server_ip_[256] = "api.crossdesk.cn";
   char signal_server_port_[6] = "9099";
   bool enable_self_hosted_ = false;
@@ -147,7 +146,6 @@ struct UserSettingsState {
   int video_encode_format_button_value_last_ = 0;
   bool enable_hardware_video_codec_last_ = false;
   bool enable_turn_last_ = true;
-  bool enable_srtp_last_ = false;
   bool enable_self_hosted_last_ = false;
   bool enable_autostart_ = false;
   bool enable_autostart_last_ = false;

apps/desktop/src/gui/ui/common.slint

@@ -45,6 +45,7 @@ export global FontAwesomeIcons {
     out property <string> shield-halved: "\u{f3ed}";
     out property <string> square-full: "\u{f45c}";
     out property <string> trash-can: "\u{f2ed}";
+    out property <string> user-secret: "\u{f21b}";
     out property <string> volume-high: "\u{f028}";
     out property <string> volume-xmark: "\u{f6a9}";
     out property <string> xmark: "\u{f00d}";

apps/desktop/src/gui/ui/main_window.slint

@@ -39,6 +39,8 @@ export global UiStrings {
     in-out property <string> language: "Language";
     in-out property <string> video-quality: "Video quality";
     in-out property <string> frame-rate: "Frame rate";
+    in-out property <string> capture-method: "Capture method";
+    in-out property <string> capture-method-auto: "Auto";
     in-out property <string> adaptation-policy: "Video preference";
     in-out property <string> priority-frame-rate: "Frame rate";
     in-out property <string> priority-quality: "Quality";
@@ -46,10 +48,10 @@ export global UiStrings {
     in-out property <string> codec: "Video codec";
     in-out property <string> hardware-codec: "Hardware video codec";
     in-out property <string> turn-relay: "TURN relay";
-    in-out property <string> srtp: "SRTP encryption";
     in-out property <string> self-hosted: "Self-hosted server";
     in-out property <string> autostart: "Start with system";
     in-out property <string> daemon: "Run in background";
+    in-out property <string> privacy-on-connect: "Privacy screen on connect";
     in-out property <string> file-save-path: "File save path";
     in-out property <string> default-desktop: "Desktop";
     in-out property <string> server-host: "Server host";
@@ -238,14 +240,18 @@ export component MainWindow inherits Window {
     in-out property <int> language-index: 0;
     in-out property <int> video-quality-index: 2;
     in-out property <int> frame-rate-index: 1;
+    in property <bool> capture-method-visible: false;
+    in-out property <int> capture-method-index: 0;
     in-out property <int> adaptation-policy-index: 1;
     in-out property <int> codec-index: 0;
     in-out property <bool> hardware-codec-enabled: true;
     in-out property <bool> turn-enabled: true;
-    in-out property <bool> srtp-enabled: false;
     in-out property <bool> self-hosted-enabled: false;
     in-out property <bool> autostart-enabled: false;
     in-out property <bool> daemon-enabled: false;
+    // Show the preference on every platform; only adapted hosts can change it.
+    in property <bool> privacy-setting-available: false;
+    in-out property <bool> privacy-on-connect-enabled: true;
     in-out property <string> file-save-path: "";
     in-out property <string> server-host: "";
     in-out property <string> server-port: "";
@@ -1445,6 +1451,11 @@ export component MainWindow inherits Window {
                         Text { x: 8px; y: 3px; width: root.compact-language ? 94px : 162px; height: 24px; text: UiStrings.language; font-size: ImGuiFontStyle.body; overflow: elide; vertical-alignment: center; }
                         CompactComboBox { x: root.compact-language ? 106px : 174px; y: 2px; model: ["中文", "English", "Русский"]; current-index <=> root.language-index; }
                     }
+                    if root.capture-method-visible: Rectangle {
+                        height: 30px;
+                        Text { x: 8px; y: 3px; width: root.compact-language ? 94px : 162px; height: 24px; text: UiStrings.capture-method; font-size: ImGuiFontStyle.body; overflow: elide; vertical-alignment: center; }
+                        CompactComboBox { x: root.compact-language ? 106px : 174px; y: 2px; enabled: !root.settings-session-active; model: [UiStrings.capture-method-auto, "DXGI", "WGC", "GDI"]; current-index <=> root.capture-method-index; }
+                    }
                     Rectangle {
                         height: 30px;
                         Text { x: 8px; y: 3px; width: root.compact-language ? 94px : 162px; height: 24px; text: UiStrings.video-quality; font-size: ImGuiFontStyle.body; overflow: elide; vertical-alignment: center; }
@@ -1477,8 +1488,8 @@ export component MainWindow inherits Window {
                     }
                     Rectangle {
                         height: 30px;
-                        Text { x: 8px; y: 3px; width: root.compact-language ? 145px : 212px; height: 24px; text: UiStrings.srtp; font-size: ImGuiFontStyle.body; overflow: elide; vertical-alignment: center; }
-                        ImGuiCheckBox { x: root.compact-language ? 157px : 224px; y: 3px; checked <=> root.srtp-enabled; enabled: !root.settings-session-active; }
+                        Text { x: 8px; y: 3px; width: root.compact-language ? 145px : 212px; height: 24px; text: UiStrings.privacy-on-connect; color: root.privacy-setting-available ? #202124 : #8b8f95; font-size: ImGuiFontStyle.body; overflow: elide; vertical-alignment: center; }
+                        ImGuiCheckBox { x: root.compact-language ? 157px : 224px; y: 3px; checked <=> root.privacy-on-connect-enabled; enabled: root.privacy-setting-available; }
                     }
                     Rectangle {
                         height: 30px;

apps/desktop/src/gui/ui/stream_window.slint

@@ -25,6 +25,8 @@ export struct NetworkStatsRow {
 export global StreamStrings {
     in-out property <string> select-display: "Select Display";
     in-out property <string> send-shortcut: "Send Shortcut";
+    in-out property <string> privacy-enable: "Enable privacy screen";
+    in-out property <string> privacy-disable: "Turn privacy off / recover";
     in-out property <string> control-mouse: "Control Mouse";
     in-out property <string> release-mouse: "Release Mouse";
     in-out property <string> audio: "Audio Capture";
@@ -45,6 +47,11 @@ export global StreamStrings {
     in-out property <string> stats-connection-mode: "Mode";
 }
 
+struct ControlBarTooltip {
+    text: string,
+    anchor-x: length,
+}
+
 // The legacy ImGui control bar uses 24px buttons with Font Awesome rendered
 // at half of the 32px atlas size.  Keep this local to the stream window: the
 // shared IconButton is intentionally larger and is used by the other windows.
@@ -54,19 +61,27 @@ component ControlBarButton inherits Rectangle {
     in property <string> tooltip: "";
     in property <bool> selected: false;
     in property <bool> slashed: false;
+    in property <bool> action-enabled: true;
+    // Capability and temporary command availability have different visuals.
+    in property <bool> muted: false;
     in property <length> icon-size: 16px;
+    out property <bool> has-hover: touch.has-hover;
+    out property <ControlBarTooltip> tooltip-info: {
+        text: root.visible && touch.has-hover && !touch.pressed ? root.tooltip : "",
+        anchor-x: root.x + root.width / 2,
+    };
     callback clicked;
 
     width: 24px;
     height: 24px;
-    background: touch.pressed ? #0f87fa
+    background: root.muted ? #eef0f3 : touch.pressed && root.action-enabled ? #0f87fa
                               : touch.has-hover ? #4296fa
                                                 : root.selected ? #4296fa : #4296fa66;
     border-radius: 3px;
 
     Text {
         text: root.icon;
-        color: #24272d;
+        color: root.muted ? #8a8f96 : #24272d;
         font-family: "Font Awesome 6 Free";
         font-weight: 900;
         font-size: root.icon-size;
@@ -105,7 +120,8 @@ component ControlBarButton inherits Rectangle {
     }
 
     touch := TouchArea {
-        clicked => { root.clicked(); }
+        // Keep disabled controls hit-testable so clicks cannot reach the peer.
+        clicked => { if root.action-enabled { root.clicked(); } }
     }
 }
 
@@ -134,11 +150,16 @@ export component StreamWindow inherits Window {
     in property <[string]> displays;
     in-out property <int> selected-display: 0;
     in property <bool> mouse-control-enabled: true;
+    in property <bool> privacy-can-toggle: false;
+    in property <bool> privacy-active: false;
+    in property <bool> privacy-off: false;
+    in property <bool> privacy-unsupported: false;
+    // Privacy feedback stays on its toolbar button and hover tooltip.
+    in property <string> privacy-status-text: "Privacy screen";
     // Numeric values mirror crossdesk::RemoteCursorShape and Slint's MouseCursor.
     in property <bool> remote-cursor-active: false;
     in property <int> remote-cursor-shape: 0;
     in property <bool> audio-enabled: true;
-    in property <bool> srtp-enabled: false;
     in property <bool> fullscreen-enabled: false;
     in property <bool> stats-visible: false;
     in property <[NetworkStatsRow]> stats-rows;
@@ -154,6 +175,7 @@ export component StreamWindow inherits Window {
     callback switch-display(int);
     callback send-shortcut(string);
     callback toggle-mouse-control;
+    callback toggle-privacy;
     callback toggle-audio;
     callback select-file;
     callback close-file-transfer;
@@ -176,6 +198,25 @@ export component StreamWindow inherits Window {
     private property <bool> display-menu-animation-enabled: false;
     private property <float> display-menu-progress: 0.0;
     private property <bool> shortcut-menu-open: false;
+    private property <bool> control-tooltip-visible: false;
+    private property <ControlBarTooltip> hovered-control: {
+        if root.window-active && !root.control-dragging
+            && !root.display-menu-open && !root.shortcut-menu-open {
+            if collapse-button.has-hover { return collapse-button.tooltip-info; }
+            if root.control-expanded {
+                if display-button.has-hover { return display-button.tooltip-info; }
+                if shortcut-button.has-hover { return shortcut-button.tooltip-info; }
+                if mouse-button.has-hover { return mouse-button.tooltip-info; }
+                if privacy-button.has-hover { return privacy-button.tooltip-info; }
+                if audio-button.has-hover { return audio-button.tooltip-info; }
+                if file-button.has-hover { return file-button.tooltip-info; }
+                if stats-button.has-hover { return stats-button.tooltip-info; }
+                if fullscreen-button.has-hover { return fullscreen-button.tooltip-info; }
+                if close-button.has-hover { return close-button.tooltip-info; }
+            }
+        }
+        return { text: "", anchor-x: 0px };
+    }
     // A popup can remove itself from the scene in its clicked callback before
     // the video input layer observes the same pointer release. Remember that
     // the press belonged to local UI so that release cannot reach the peer.
@@ -215,6 +256,20 @@ export component StreamWindow inherits Window {
         }
     }
 
+    changed hovered-control => {
+        root.control-tooltip-visible = false;
+        control-tooltip-timer.running = root.hovered-control.text != "";
+        if root.hovered-control.text != "" { control-tooltip-timer.restart(); }
+    }
+    control-tooltip-timer := Timer {
+        interval: 450ms;
+        running: false;
+        triggered => {
+            self.running = false;
+            root.control-tooltip-visible = true;
+        }
+    }
+
     is-local-control-area(pointer-x, pointer-y) => {
         let over-control = pointer-x >= control.x
             && pointer-x <= control.x + control.width
@@ -232,7 +287,7 @@ export component StreamWindow inherits Window {
         let shortcut-menu-y = control.y + 40px;
         let over-shortcut-menu = root.shortcut-menu-open
             && pointer-x >= shortcut-menu-x
-            && pointer-x <= shortcut-menu-x + 150px
+            && pointer-x <= shortcut-menu-x + 180px
             && pointer-y >= shortcut-menu-y
             && pointer-y <= shortcut-menu-y + 68px;
         return over-control || over-display-menu || over-shortcut-menu;
@@ -450,20 +505,8 @@ export component StreamWindow inherits Window {
                         width: parent.width - 27px;
                         height: parent.height;
                         background: transparent;
-                        if root.srtp-enabled: Text {
-                            x: 0px;
-                            width: 12px;
-                            height: parent.height;
-                            text: FontAwesomeIcons.shield-halved;
-                            color: #30343b;
-                            font-family: "Font Awesome 6 Free";
-                            font-weight: 900;
-                            font-size: ImGuiFontStyle.base;
-                            horizontal-alignment: center;
-                            vertical-alignment: center;
-                        }
                         Text {
-                            x: root.srtp-enabled ? 16px : 0px;
+                            x: 0px;
                             width: parent.width - self.x;
                             height: parent.height;
                             text: tab.title;
@@ -639,7 +682,7 @@ export component StreamWindow inherits Window {
             control := Rectangle {
                 x: root.control-dragging ? root.control-drag-x : root.control-docked-left ? 0px : parent.width - self.width;
                 y: min(max(0px, root.control-pos-y), parent.height - self.height);
-                width: root.control-expanded ? min(300px, parent.width) : 20px;
+                width: root.control-expanded ? min(332px, parent.width) : 20px;
                 height: root.stats-visible && root.control-expanded ? min(180px, parent.height) : 38px;
                 background: white;
                 border-width: 1px;
@@ -657,7 +700,8 @@ export component StreamWindow inherits Window {
                     background: ImGuiLineStyle.control-separator;
                 }
 
-                if root.control-expanded: display-button := ControlBarButton {
+                display-button := ControlBarButton {
+                    visible: root.control-expanded;
                     x: root.control-docked-left ? 9px : 42px; y: 7px;
                     icon: FontAwesomeIcons.display;
                     badge: root.selected-display + 1;
@@ -673,7 +717,8 @@ export component StreamWindow inherits Window {
                         }
                     }
                 }
-                if root.control-expanded: shortcut-button := ControlBarButton {
+                shortcut-button := ControlBarButton {
+                    visible: root.control-expanded;
                     x: root.control-docked-left ? 41px : 74px; y: 7px;
                     icon: FontAwesomeIcons.keyboard; tooltip: StreamStrings.send-shortcut;
                     clicked => {
@@ -684,47 +729,53 @@ export component StreamWindow inherits Window {
                         root.display-menu-open = false;
                     }
                 }
-                if root.control-expanded: mouse-button := ControlBarButton {
+                mouse-button := ControlBarButton {
+                    visible: root.control-expanded;
                     x: root.control-docked-left ? 73px : 106px; y: 7px;
                     icon: FontAwesomeIcons.computer-mouse; slashed: !root.mouse-control-enabled;
                     tooltip: root.mouse-control-enabled ? StreamStrings.release-mouse : StreamStrings.control-mouse;
                     clicked => { root.toggle-mouse-control(); }
                 }
-                if root.control-expanded: audio-button := ControlBarButton {
-                    x: root.control-docked-left ? 105px : 138px; y: 7px;
+                audio-button := ControlBarButton {
+                    visible: root.control-expanded;
+                    x: root.control-docked-left ? 137px : 170px; y: 7px;
                     icon: FontAwesomeIcons.volume-high; slashed: !root.audio-enabled;
                     tooltip: root.audio-enabled ? StreamStrings.mute : StreamStrings.audio;
                     clicked => { root.toggle-audio(); }
                 }
-                if root.control-expanded: file-button := ControlBarButton {
-                    x: root.control-docked-left ? 137px : 170px; y: 7px;
+                file-button := ControlBarButton {
+                    visible: root.control-expanded;
+                    x: root.control-docked-left ? 169px : 202px; y: 7px;
                     icon: FontAwesomeIcons.folder-open; tooltip: StreamStrings.select-file;
                     clicked => { root.select-file(); }
                 }
-                if root.control-expanded: stats-button := ControlBarButton {
-                    x: root.control-docked-left ? 169px : 202px; y: 7px;
+                stats-button := ControlBarButton {
+                    visible: root.control-expanded;
+                    x: root.control-docked-left ? 201px : 234px; y: 7px;
                     icon: FontAwesomeIcons.signal; selected: root.stats-visible;
                     tooltip: root.stats-visible ? StreamStrings.hide-stats : StreamStrings.show-stats;
                     clicked => { root.toggle-stats(); }
                 }
-                if root.control-expanded: fullscreen-button := ControlBarButton {
-                    x: root.control-docked-left ? 201px : 234px; y: 7px;
+                fullscreen-button := ControlBarButton {
+                    visible: root.control-expanded;
+                    x: root.control-docked-left ? 233px : 266px; y: 7px;
                     icon: root.fullscreen-enabled ? FontAwesomeIcons.compress : FontAwesomeIcons.expand;
                     tooltip: root.fullscreen-enabled ? StreamStrings.exit-fullscreen : StreamStrings.fullscreen;
                     clicked => { root.toggle-fullscreen(); }
                 }
-                if root.control-expanded: close-button := ControlBarButton {
-                    x: root.control-docked-left ? 233px : 266px; y: 7px;
+                close-button := ControlBarButton {
+                    visible: root.control-expanded;
+                    x: root.control-docked-left ? 265px : 298px; y: 7px;
                     icon: FontAwesomeIcons.xmark; tooltip: StreamStrings.disconnect;
                     clicked => { root.disconnect(); }
                 }
 
                 if root.control-expanded && root.control-docked-left: Rectangle {
-                    x: 267px; y: 12px; width: 2px; height: 15px;
+                    x: 299px; y: 12px; width: 2px; height: 15px;
                     background: ImGuiLineStyle.control-separator;
                 }
                 collapse-button := ControlBarButton {
-                    x: root.control-expanded ? (root.control-docked-left ? 275px : 10px) : 2px;
+                    x: root.control-expanded ? (root.control-docked-left ? 307px : 10px) : 2px;
                     y: 7px;
                     width: 15px;
                     icon: root.control-expanded
@@ -734,6 +785,19 @@ export component StreamWindow inherits Window {
                     clicked => { root.control-expanded = !root.control-expanded; }
                 }
 
+                privacy-button := ControlBarButton {
+                    visible: root.control-expanded;
+                    x: root.control-docked-left ? 105px : 138px; y: 7px;
+                    icon: FontAwesomeIcons.user-secret;
+                    slashed: root.privacy-off && !root.privacy-unsupported;
+                    muted: root.privacy-unsupported;
+                    action-enabled: root.privacy-can-toggle;
+                    tooltip: root.privacy-status-text
+                        + (root.privacy-can-toggle ? "\n" + (root.privacy-active
+                            ? StreamStrings.privacy-disable : StreamStrings.privacy-enable) : "");
+                    clicked => { root.toggle-privacy(); }
+                }
+
                 if root.stats-visible && root.control-expanded: stats-table := Rectangle {
                     x: 14px;
                     y: 38px;
@@ -943,7 +1007,7 @@ export component StreamWindow inherits Window {
             }
 
             if root.shortcut-menu-open: Rectangle {
-                x: control.x + (root.control-docked-left ? 41px : 74px); y: control.y + 40px; width: 150px; height: 68px;
+                x: control.x + (root.control-docked-left ? 41px : 74px); y: control.y + 40px; width: 180px; height: 68px;
                 background: white; border-width: 1px; border-color: ImGuiLineStyle.border; border-radius: 5px; z: 11;
                 VerticalLayout {
                     padding: 4px; spacing: 1px;
@@ -962,6 +1026,29 @@ export component StreamWindow inherits Window {
                 }
             }
 
+            // Measure unwrapped text so short hints stay compact. Render outside
+            // the clipped control bar, capping longer hints before wrapping.
+            control-tooltip-width-probe := Text {
+                visible: false;
+                text: root.hovered-control.text;
+                font-size: ImGuiFontStyle.body;
+            }
+            if root.hovered-control.text != "" && root.control-tooltip-visible: Rectangle {
+                width: min(240px, video.width - 8px,
+                    control-tooltip-width-probe.preferred-width + 16px);
+                x: min(max(4px, control.x + root.hovered-control.anchor-x - self.width / 2),
+                    video.width - self.width - 4px);
+                height: control-tip.preferred-height + 12px;
+                y: control.y + control.height + self.height + 8px <= video.height
+                    ? control.y + control.height + 4px : max(4px, control.y - self.height - 4px);
+                background: #30343bf5; border-radius: 5px; z: 12;
+                control-tip := Text {
+                    x: 8px; y: 6px; width: parent.width - 16px;
+                    text: root.hovered-control.text;
+                    color: white; font-size: ImGuiFontStyle.body; wrap: word-wrap;
+                }
+            }
+
             // Transfer progress overlay at bottom-left.
             if root.file-transfer-visible: Rectangle {
                 x: 18px; y: parent.height - min(210px, parent.height * 0.35); width: min(430px, parent.width * 0.6); height: min(190px, parent.height * 0.32);

apps/desktop/src/gui/ui/ui_localization.h

@@ -54,6 +54,9 @@ inline int ApplyMainWindowStrings(
   strings.set_language(Text(localization::language[language]));
   strings.set_video_quality(Text(localization::video_quality[language]));
   strings.set_frame_rate(Text(localization::video_frame_rate[language]));
+  strings.set_capture_method(Text(localization::screen_capture_method[language]));
+  strings.set_capture_method_auto(
+      Text(localization::screen_capture_method_auto[language]));
   strings.set_adaptation_policy(
       Text(localization::video_adaptation_policy[language]));
   strings.set_priority_frame_rate(
@@ -66,11 +69,11 @@ inline int ApplyMainWindowStrings(
   strings.set_hardware_codec(
       Text(localization::enable_hardware_video_codec[language]));
   strings.set_turn_relay(Text(localization::enable_turn[language]));
-  strings.set_srtp(Text(localization::enable_srtp[language]));
   strings.set_self_hosted(
       Text(localization::self_hosted_server_config[language]));
   strings.set_autostart(Text(localization::enable_autostart[language]));
   strings.set_daemon(Text(localization::enable_daemon[language]));
+  strings.set_privacy_on_connect(Text(localization::privacy_on_connect[language]));
   strings.set_file_save_path(
       Text(localization::file_transfer_save_path[language]));
   strings.set_default_desktop(Text(localization::default_desktop[language]));
@@ -138,6 +141,8 @@ inline int ApplyStreamWindowStrings(
   auto& strings = window->template global<ui::StreamStrings>();
   strings.set_select_display(Text(localization::select_display[language]));
   strings.set_send_shortcut(Text(localization::send_shortcut[language]));
+  strings.set_privacy_enable(Text(localization::privacy_enable[language]));
+  strings.set_privacy_disable(Text(localization::privacy_disable[language]));
   strings.set_control_mouse(Text(localization::control_mouse[language]));
   strings.set_release_mouse(Text(localization::release_mouse[language]));
   strings.set_audio(Text(localization::audio_capture[language]));
@@ -167,4 +172,4 @@ inline int ApplyStreamWindowStrings(
 }  // namespace crossdesk::ui_localization
 
 
-#endif
+#endif

apps/desktop/src/gui/views/windows/main_settings_window.cpp

@@ -268,25 +268,6 @@ int GuiApplication::SettingWindow() {
 
       ImGui::Separator();
 
-      {
-        settings_items_offset += settings_items_padding;
-        ImGui::SetCursorPosY(settings_items_offset);
-        ImGui::AlignTextToFramePadding();
-        ImGui::Text(
-            "%s",
-            localization::enable_srtp[localization_language_index_].c_str());
-        ImGui::SameLine();
-        if (ConfigCenter::LANGUAGE::CHINESE == localization_language_) {
-          ImGui::SetCursorPosX(title_bar_button_width_ * 4.275f);
-        } else {
-          ImGui::SetCursorPosX(title_bar_button_width_ * 5.955f);
-        }
-
-        ImGui::Checkbox("##enable_srtp", &enable_srtp_);
-      }
-
-      ImGui::Separator();
-
       {
         settings_items_offset += settings_items_padding;
         ImGui::SetCursorPosY(settings_items_offset + 1);
@@ -569,14 +550,6 @@ int GuiApplication::SettingWindow() {
         }
         enable_turn_last_ = enable_turn_;
 
-        // SRTP
-        if (enable_srtp_) {
-          config_center_->SetSrtp(true);
-        } else {
-          config_center_->SetSrtp(false);
-        }
-        enable_srtp_last_ = enable_srtp_;
-
         if (enable_self_hosted_) {
           config_center_->SetSelfHosted(true);
         } else {

apps/desktop/src/gui/views/windows/stream_window.cpp

@@ -136,10 +136,7 @@ int GuiApplication::StreamWindow() {
           continue;
         }
 
-        std::string tab_label =
-            enable_srtp_
-                ? std::string(ICON_FA_SHIELD_HALVED) + " " + props->remote_id_
-                : props->remote_id_;
+        const std::string& tab_label = props->remote_id_;
         if (ImGui::BeginTabItem(tab_label.c_str(), &props->tab_opened_)) {
           props->tab_selected_ = true;
           ImGui::SetWindowFontScale(0.6f);
@@ -308,4 +305,4 @@ int GuiApplication::StreamWindow() {
 
   return 0;
 }
-} // namespace crossdesk
+} // namespace crossdesk

apps/desktop/src/platform/common/gui/service_status_runtime.cpp

@@ -3,6 +3,13 @@
 namespace crossdesk {
 
 void GuiRuntime::ResetRemoteServiceStatus(RemoteSession& props) {
+  {
+    std::lock_guard lock(props.privacy_status_mutex_);
+    props.privacy_status_ = {};
+    props.privacy_status_received_ = false;
+    props.privacy_command_pending_ = false;
+    props.privacy_status_tick_ = 0;
+  }
   props.remote_service_status_received_ = false;
   props.remote_service_available_ = false;
   props.remote_interactive_stage_.clear();

apps/desktop/src/platform/linux/privacy/privacy_backend_linux.cpp

@@ -0,0 +1,244 @@
+/*
+ * @Author: DI JUNKUN
+ * @Date: 2026-09-13
+ * Copyright (c) 2026 by DI JUNKUN, All Rights Reserved.
+ */
+
+#ifndef _PRIVACY_BACKEND_LINUX_H_
+#define _PRIVACY_BACKEND_LINUX_H_
+
+#include <poll.h>
+#include <spawn.h>
+#include <sys/eventfd.h>
+#include <sys/socket.h>
+#include <sys/wait.h>
+#include <unistd.h>
+
+#include <algorithm>
+#include <cerrno>
+#include <chrono>
+#include <cstring>
+#include <thread>
+
+#include "privacy_backend.h"
+#include "privacy_guard.h"
+
+extern char** environ;
+
+namespace crossdesk {
+namespace {
+using Clock = std::chrono::steady_clock;
+
+class LinuxPrivacyBackend final : public PrivacyBackend {
+ public:
+  LinuxPrivacyBackend() : wake_(eventfd(0, EFD_CLOEXEC | EFD_NONBLOCK)) {}
+  ~LinuxPrivacyBackend() override {
+    // EOF also recovers after a crash, SIGKILL, or a normal shutdown. Never
+    // terminate the guard: it must finish restoring the saved display ramps.
+    if (socket_ >= 0) close(socket_);
+    if (wake_ >= 0) close(wake_);
+    if (child_ > 0) {
+      const pid_t child = child_;
+      std::thread([child] {
+        while (waitpid(child, nullptr, 0) < 0 && errno == EINTR) {
+        }
+      }).detach();
+    }
+  }
+
+  PrivacyCapabilities Query() override {
+    if (wake_ < 0)
+      return {false, false, "Cannot create Linux privacy wake event"};
+    if (!StartGuard()) return {false, false, failure_};
+    if (!Send(LinuxPrivacyCommand::query)) return {false, false, failure_};
+    // The first query also serves automatic privacy on the first connection.
+    // Bound process startup so an unavailable helper cannot stall the GUI.
+    if (!discovered_) {
+      pollfd fd{socket_, POLLIN, 0};
+      poll(&fd, 1, 1000);
+    }
+    ReadReplies();
+    return {reply_.supported, reply_.input_supported,
+            reply_.capability_reason[0] ? reply_.capability_reason
+                                        : "Checking Linux privacy support"};
+  }
+
+  bool Enable(bool block_input, const PrivacyScreenText&,
+              std::string& error) override {
+    failure_.clear();
+    emergency_ = false;
+    if (!Send(block_input ? LinuxPrivacyCommand::enable_blocking
+                          : LinuxPrivacyCommand::enable)) {
+      error = failure_;
+      return false;
+    }
+    engaged_ = true;
+    ++generation_;
+    last_reply_ = Clock::now();
+    recovered_ = false;
+    reply_.active = false;
+    return true;
+  }
+
+  void Recover() override {
+    ReadReplies();
+    if (recovered_) {
+      failure_.clear();
+      return;
+    }
+    if (recovering_) return;
+    if (Send(LinuxPrivacyCommand::recover)) recovering_ = true;
+  }
+  bool IsRecovered() const override { return recovered_; }
+  bool RecoveryPending() const override { return recovering_; }
+
+  PrivacyHealth Poll() override {
+    ReadReplies();
+    if (engaged_ && Clock::now() - last_reply_ > std::chrono::seconds(1))
+      failure_ = "Linux privacy guard stopped responding";
+    if (engaged_ &&
+        Clock::now() - last_heartbeat_ >= std::chrono::milliseconds(100)) {
+      Send(LinuxPrivacyCommand::heartbeat);
+      last_heartbeat_ = Clock::now();
+    }
+    const bool emergency = emergency_;
+    emergency_ = false;
+    return {failure_, emergency, reply_.active};
+  }
+
+  void WaitForEvents(unsigned timeout_ms) override {
+    pollfd fds[] = {{wake_, POLLIN, 0}, {socket_, POLLIN, 0}};
+    poll(fds, 2, static_cast<int>(timeout_ms));
+    uint64_t value;
+    if (fds[0].revents & POLLIN) {
+      while (read(wake_, &value, sizeof(value)) == sizeof(value)) {
+      }
+    }
+  }
+  void Wake() override {
+    const uint64_t value = 1;
+    if (wake_ >= 0) {
+      const auto ignored = write(wake_, &value, sizeof(value));
+      (void)ignored;
+    }
+  }
+
+ private:
+  bool StartGuard() {
+    if (socket_ >= 0) return true;
+    if (child_ > 0) {
+      const auto result = waitpid(child_, nullptr, WNOHANG);
+      if (result == 0) return false;
+      child_ = -1;
+    }
+    int sockets[2];
+    if (socketpair(AF_UNIX, SOCK_SEQPACKET | SOCK_CLOEXEC | SOCK_NONBLOCK, 0,
+                   sockets) != 0) {
+      failure_ = "Cannot create Linux privacy guard socket";
+      return false;
+    }
+    posix_spawn_file_actions_t actions;
+    int result = posix_spawn_file_actions_init(&actions);
+    if (result == 0) {
+      // Close the parent end first: it may occupy the guard's destination fd.
+      result = posix_spawn_file_actions_addclose(&actions, sockets[0]);
+      if (result == 0)
+        result = posix_spawn_file_actions_adddup2(&actions, sockets[1],
+                                                  kLinuxPrivacyGuardSocket);
+      if (result == 0 && sockets[1] != kLinuxPrivacyGuardSocket)
+        result = posix_spawn_file_actions_addclose(&actions, sockets[1]);
+      if (result == 0) {
+        char executable[] = "/proc/self/exe";
+        char* args[] = {executable,
+                        const_cast<char*>(kLinuxPrivacyGuardArgument), nullptr};
+        result =
+            posix_spawn(&child_, executable, &actions, nullptr, args, environ);
+      }
+      posix_spawn_file_actions_destroy(&actions);
+    }
+    close(sockets[1]);
+    if (result != 0) {
+      close(sockets[0]);
+      child_ = -1;
+      failure_ = std::string("Cannot start Linux privacy guard: ") +
+                 std::strerror(result);
+      return false;
+    }
+    socket_ = sockets[0];
+    reply_ = {};
+    discovered_ = false;
+    generation_ = 0;
+    failure_.clear();
+    return true;
+  }
+
+  void LostGuard() {
+    if (socket_ >= 0) close(socket_);
+    socket_ = -1;
+    reply_ = {};
+    recovering_ = false;
+    failure_ =
+        "Linux privacy guard disconnected; local protection is unavailable";
+    // Do not claim successful recovery after an unexpected guard failure.
+    // A normal guard reports restoration before closing its socket.
+  }
+  bool Send(LinuxPrivacyCommand command) {
+    if (socket_ < 0) return false;
+    if (send(socket_, &command, sizeof(command), MSG_NOSIGNAL) ==
+        sizeof(command))
+      return true;
+    if (errno != EAGAIN && errno != EWOULDBLOCK && errno != EINTR) LostGuard();
+    return false;
+  }
+  void ReadReplies() {
+    if (socket_ < 0) return;
+    for (;;) {
+      LinuxPrivacyReply next;
+      const auto bytes = recv(socket_, &next, sizeof(next), 0);
+      if (bytes < 0 &&
+          (errno == EAGAIN || errno == EWOULDBLOCK || errno == EINTR))
+        return;
+      if (bytes != sizeof(next)) {
+        LostGuard();
+        return;
+      }
+      next.capability_reason[sizeof(next.capability_reason) - 1] = '\0';
+      next.failure[sizeof(next.failure) - 1] = '\0';
+      discovered_ = true;
+      // Ignore queued capability/heartbeat replies from before this enable.
+      // A matching generation can also acknowledge watchdog-driven recovery.
+      if (next.generation != generation_) continue;
+      reply_ = next;
+      last_reply_ = Clock::now();
+      emergency_ = emergency_ || next.emergency;
+      if (next.failure[0]) failure_ = next.failure;
+      recovered_ = next.recovered;
+      if (next.recovered) {
+        recovering_ = false;
+        engaged_ = false;
+      }
+    }
+  }
+
+  int wake_ = -1;
+  int socket_ = -1;
+  pid_t child_ = -1;
+  LinuxPrivacyReply reply_;
+  uint64_t generation_ = 0;
+  bool engaged_ = false;
+  bool discovered_ = false;
+  bool recovering_ = false;
+  bool recovered_ = true;
+  bool emergency_ = false;
+  std::string failure_;
+  Clock::time_point last_heartbeat_{};
+  Clock::time_point last_reply_{};
+};
+}  // namespace
+
+std::unique_ptr<PrivacyBackend> CreateLinuxPrivacyBackend() {
+  return std::make_unique<LinuxPrivacyBackend>();
+}
+}  // namespace crossdesk
+
+#endif

apps/desktop/src/platform/linux/privacy/privacy_guard.cpp

@@ -0,0 +1,721 @@
+/* Copyright (c) 2026 by DI JUNKUN, All Rights Reserved. */
+#include "privacy_guard.h"
+
+#include <X11/XKBlib.h>
+#include <X11/Xatom.h>
+#include <X11/extensions/XInput.h>
+#include <X11/extensions/XInput2.h>
+#include <X11/extensions/XTest.h>
+#include <X11/extensions/Xfixes.h>
+#include <X11/extensions/Xrandr.h>
+#include <X11/keysym.h>
+#include <fcntl.h>
+#include <poll.h>
+#include <sys/socket.h>
+#include <unistd.h>
+
+#include <algorithm>
+#include <array>
+#include <cerrno>
+#include <chrono>
+#include <csignal>
+#include <cstdlib>
+#include <cstring>
+#include <map>
+#include <memory>
+#include <string>
+#include <tuple>
+#include <vector>
+
+namespace crossdesk {
+namespace {
+using Clock = std::chrono::steady_clock;
+using Gamma = std::unique_ptr<XRRCrtcGamma, decltype(&XRRFreeGamma)>;
+using Resources =
+    std::unique_ptr<XRRScreenResources, decltype(&XRRFreeScreenResources)>;
+using CrtcInfo = std::unique_ptr<XRRCrtcInfo, decltype(&XRRFreeCrtcInfo)>;
+volatile std::sig_atomic_t stopping = 0;
+int x_error = 0;
+
+void StopGuard(int) { stopping = 1; }
+int OnXError(Display*, XErrorEvent* event) {
+  x_error = event->error_code;
+  return 0;
+}
+
+template <size_t N>
+void SetText(char (&dest)[N], const std::string& text) {
+  std::strncpy(dest, text.c_str(), N - 1);
+  dest[N - 1] = '\0';
+}
+
+struct Output {
+  Window root = 0;
+  RRCrtc crtc = 0;
+  RRMode mode = 0;
+  int x = 0, y = 0;
+  unsigned width = 0, height = 0;
+  Rotation rotation = 0;
+  std::vector<RROutput> connectors;
+  Gamma saved{nullptr, XRRFreeGamma};
+
+  bool SameLayout(const Output& other) const {
+    return std::tie(root, crtc, mode, x, y, width, height, rotation,
+                    connectors) == std::tie(other.root, other.crtc, other.mode,
+                                            other.x, other.y, other.width,
+                                            other.height, other.rotation,
+                                            other.connectors);
+  }
+};
+
+struct Device {
+  int id = 0, use = 0, attachment = 0;
+  bool keyboard = false, touch = false;
+  std::string name;
+
+  bool operator==(const Device& other) const {
+    return std::tie(id, use, attachment, keyboard, touch, name) ==
+           std::tie(other.id, other.use, other.attachment, other.keyboard,
+                    other.touch, other.name);
+  }
+};
+
+bool IsBlack(const XRRCrtcGamma* gamma) {
+  if (!gamma || gamma->size <= 0) return false;
+  for (int i = 0; i < gamma->size; ++i)
+    if (gamma->red[i] || gamma->green[i] || gamma->blue[i]) return false;
+  return true;
+}
+
+// This class lives only in the exec'd guard process. Its Xlib error handler is
+// isolated from the GUI and capture threads' process-global error handlers.
+class NativePrivacy {
+ public:
+  ~NativePrivacy() {
+    Recover();
+    if (display_) XCloseDisplay(display_);
+  }
+
+  void Query() {
+    reply_.supported = reply_.input_supported = false;
+    std::string error;
+    if (!Initialize(error)) {
+      SetText(reply_.capability_reason, error);
+      return;
+    }
+    std::vector<Output> outputs;
+    std::vector<Device> devices;
+    if (!ReadOutputs(outputs, true, error) || !ReadDevices(devices, error)) {
+      SetText(reply_.capability_reason, error);
+      return;
+    }
+    const bool keyboard = std::any_of(devices.begin(), devices.end(),
+                                      [](const auto& d) { return d.keyboard; });
+    if (!keyboard) {
+      SetText(reply_.capability_reason,
+              "No local keyboard available for privacy recovery");
+      return;
+    }
+    reply_.supported = true;
+    // XIGrabDevice does not suppress XI 2.2 touch delivery. Do not advertise
+    // input protection for touchscreens without a separate touch grab.
+    reply_.input_supported = std::none_of(
+        devices.begin(), devices.end(), [](const auto& d) { return d.touch; });
+    SetText(reply_.capability_reason,
+            reply_.input_supported
+                ? "X11 privacy black screen available; local recovery: "
+                  "Ctrl+Alt+Shift+F12"
+                : "X11 privacy black screen available; touchscreen input "
+                  "blocking is unavailable");
+  }
+
+  void Enable(bool block_input) {
+    ++reply_.generation;
+    reply_.failure[0] = '\0';
+    reply_.emergency = false;
+    if (!reply_.recovered) {
+      Fail("Linux privacy resources are still in use");
+      return;
+    }
+    Query();
+    if (!reply_.supported || (block_input && !reply_.input_supported)) {
+      Fail(reply_.capability_reason);
+      return;
+    }
+    std::string error;
+    keys_.clear();
+    if (!Acquire(error) || !ReadOutputs(outputs_, true, error) ||
+        !ReadDevices(devices_, error) || !ProtectInput(block_input, error)) {
+      Fail(error);
+      return;
+    }
+    // No display ramp is changed until every original ramp has been saved.
+    // Gamma is applied at scanout, after XGetImage/DRM framebuffer capture.
+    // There is deliberately no cover window to contaminate remote frames.
+    x_error = 0;
+    for (const auto& output : outputs_) {
+      Gamma black(XRRAllocGamma(output.saved->size), XRRFreeGamma);
+      if (!black) {
+        Fail("Cannot allocate Linux privacy display ramp");
+        return;
+      }
+      std::fill_n(black->red, black->size, 0);
+      std::fill_n(black->green, black->size, 0);
+      std::fill_n(black->blue, black->size, 0);
+      XRRSetCrtcGamma(display_, output.crtc, black.get());
+    }
+    for (int i = 0; i < ScreenCount(display_); ++i) {
+      XFixesHideCursor(display_, RootWindow(display_, i));
+      hidden_roots_.push_back(RootWindow(display_, i));
+    }
+    XSync(display_, False);
+    if (x_error) {
+      Fail("Cannot blank Linux displays or hide the local cursor");
+      return;
+    }
+    // Active slave grabs temporarily detach devices. Snapshot after grabbing,
+    // and monitor subsequent hardware/hierarchy changes during protection.
+    if (!ReadDevices(devices_, error)) {
+      Fail(error);
+      return;
+    }
+    reply_.active = true;
+    Check();
+  }
+
+  void Recover() {
+    reply_.active = false;
+    if (!display_) {
+      reply_.recovered = true;
+      return;
+    }
+    for (int id : grabbed_) XIUngrabDevice(display_, id, CurrentTime);
+    grabbed_.clear();
+    for (Window root : hidden_roots_) XFixesShowCursor(display_, root);
+    hidden_roots_.clear();
+    // Keep failed restorations for retry. Removed CRTCs no longer own a local
+    // output; all still-present CRTCs must acknowledge the original ramp.
+    for (auto it = outputs_.begin(); it != outputs_.end();) {
+      x_error = 0;
+      Resources resources(XRRGetScreenResourcesCurrent(display_, it->root),
+                          XRRFreeScreenResources);
+      if (!resources) {
+        ++it;
+        continue;
+      }
+      const bool exists =
+          std::find(resources->crtcs, resources->crtcs + resources->ncrtc,
+                    it->crtc) != resources->crtcs + resources->ncrtc;
+      if (exists && it->saved) {
+        XRRSetCrtcGamma(display_, it->crtc, it->saved.get());
+        XSync(display_, False);
+        if (x_error) {
+          ++it;
+          continue;
+        }
+      }
+      it = outputs_.erase(it);
+    }
+    keys_.clear();
+    if (outputs_.empty() && owner_) {
+      XDestroyWindow(display_, owner_);
+      owner_ = 0;
+    }
+    XSync(display_, False);
+    reply_.recovered = outputs_.empty() && !owner_;
+  }
+
+  void Fail(const std::string& reason) {
+    SetText(reply_.failure, reason);
+    Recover();
+  }
+
+  void Poll() {
+    if (!display_) return;
+    while (XPending(display_)) {
+      XEvent event{};
+      XNextEvent(display_, &event);
+      if (event.type != GenericEvent || event.xcookie.extension != xi_opcode_ ||
+          !XGetEventData(display_, &event.xcookie))
+        continue;
+      if (reply_.active) {
+        const int type = event.xcookie.evtype;
+        if (type == XI_KeyPress || type == XI_KeyRelease) {
+          const auto* key = static_cast<XIDeviceEvent*>(event.xcookie.data);
+          Key(key->sourceid, key->detail, type == XI_KeyPress);
+        } else if (!blocking_ &&
+                   (type == XI_RawKeyPress || type == XI_RawKeyRelease)) {
+          const auto* key = static_cast<XIRawEvent*>(event.xcookie.data);
+          Key(key->sourceid, key->detail, type == XI_RawKeyPress);
+        }
+      }
+      XFreeEventData(display_, &event.xcookie);
+    }
+    if (reply_.active &&
+        Clock::now() - checked_ >= std::chrono::milliseconds(100))
+      Check();
+    if (!reply_.active && !reply_.recovered) Recover();
+  }
+
+  const LinuxPrivacyReply& Reply() const { return reply_; }
+  int Connection() const { return display_ ? ConnectionNumber(display_) : -1; }
+  void AcknowledgeEmergency() { reply_.emergency = false; }
+
+ private:
+  bool Initialize(std::string& error) {
+    if (initialized_) return true;
+    const char* session = std::getenv("XDG_SESSION_TYPE");
+    const char* wayland = std::getenv("WAYLAND_DISPLAY");
+    if ((session && std::strcmp(session, "wayland") == 0) ||
+        (wayland && *wayland)) {
+      error =
+          "Linux privacy screen requires an X11 session; Wayland is "
+          "unsupported";
+      return false;
+    }
+    const char* address = std::getenv("DISPLAY");
+    if (!address ||
+        (*address != ':' && std::strncmp(address, "unix:", 5) != 0)) {
+      error = "Linux privacy screen requires a local X11 display";
+      return false;
+    }
+    if (!display_) display_ = XOpenDisplay(nullptr);
+    if (!display_) {
+      error = "Cannot open the local X11 display";
+      return false;
+    }
+    int event = 0, code = 0, opcode = 0;
+    int major = 1, minor = 3;
+    if (XQueryExtension(display_, "XWAYLAND", &opcode, &event, &code)) {
+      error = "XWayland cannot protect native Wayland displays";
+      return false;
+    }
+    if (!XRRQueryExtension(display_, &event, &code) ||
+        !XRRQueryVersion(display_, &major, &minor) || major < 1 ||
+        (major == 1 && minor < 3)) {
+      error = "Linux privacy screen requires RandR 1.3 display gamma control";
+      return false;
+    }
+    major = 4;
+    minor = 0;
+    if (!XFixesQueryExtension(display_, &event, &code) ||
+        !XFixesQueryVersion(display_, &major, &minor) || major < 4) {
+      error = "Linux privacy screen requires XFixes 4 cursor hiding";
+      return false;
+    }
+    major = 2;
+    minor = 2;
+    if (!XQueryExtension(display_, "XInputExtension", &xi_opcode_, &event,
+                         &code) ||
+        XIQueryVersion(display_, &major, &minor) != Success || major < 2) {
+      error = "Linux privacy screen requires XInput 2 local input monitoring";
+      return false;
+    }
+    xtest_property_ = XInternAtom(display_, "XTEST Device", True);
+    if (!xtest_property_ ||
+        !XTestQueryExtension(display_, &event, &code, &major, &minor)) {
+      error = "Cannot identify X11 remote input devices";
+      return false;
+    }
+    selection_ = XInternAtom(display_, "_CROSSDESK_PRIVACY_GUARD", False);
+    std::array<unsigned char, XIMaskLen(XI_LASTEVENT)> bits{};
+    XISetMask(bits.data(), XI_RawKeyPress);
+    XISetMask(bits.data(), XI_RawKeyRelease);
+    XIEventMask mask{XIAllDevices, static_cast<int>(bits.size()), bits.data()};
+    x_error = 0;
+    for (int i = 0; i < ScreenCount(display_); ++i)
+      XISelectEvents(display_, RootWindow(display_, i), &mask, 1);
+    XSync(display_, False);
+    if (x_error) {
+      error = "Cannot monitor the local privacy recovery shortcut";
+      return false;
+    }
+    initialized_ = true;
+    return true;
+  }
+
+  bool ReadOutputs(std::vector<Output>& outputs, bool save,
+                   std::string& error) {
+    outputs.clear();
+    x_error = 0;
+    for (int screen = 0; screen < ScreenCount(display_); ++screen) {
+      const Window root = RootWindow(display_, screen);
+      Resources resources(XRRGetScreenResourcesCurrent(display_, root),
+                          XRRFreeScreenResources);
+      if (!resources) {
+        error = "Cannot enumerate Linux display outputs";
+        return false;
+      }
+      for (int i = 0; i < resources->ncrtc; ++i) {
+        CrtcInfo info(
+            XRRGetCrtcInfo(display_, resources.get(), resources->crtcs[i]),
+            XRRFreeCrtcInfo);
+        if (!info) {
+          error = "Cannot inspect Linux display controller";
+          return false;
+        }
+        if (!info->mode || !info->noutput) continue;
+        Output output;
+        output.root = root;
+        output.crtc = resources->crtcs[i];
+        output.mode = info->mode;
+        output.x = info->x;
+        output.y = info->y;
+        output.width = info->width;
+        output.height = info->height;
+        output.rotation = info->rotation;
+        output.connectors.assign(info->outputs, info->outputs + info->noutput);
+        std::sort(output.connectors.begin(), output.connectors.end());
+        if (save) {
+          output.saved.reset(XRRGetCrtcGamma(display_, output.crtc));
+          if (!output.saved || output.saved->size <= 0 ||
+              IsBlack(output.saved.get())) {
+            error =
+                "Display gamma control is unavailable or the display is "
+                "already blank";
+            return false;
+          }
+        }
+        outputs.push_back(std::move(output));
+      }
+    }
+    XSync(display_, False);
+    if (x_error || outputs.empty()) {
+      error = "No controllable Linux display outputs";
+      return false;
+    }
+    return true;
+  }
+
+  bool ReadDevices(std::vector<Device>& devices, std::string& error) {
+    devices.clear();
+    x_error = 0;
+    int count = 0;
+    XIDeviceInfo* info = XIQueryDevice(display_, XIAllDevices, &count);
+    if (!info) {
+      error = "Cannot enumerate local X11 input devices";
+      return false;
+    }
+    for (int i = 0; i < count; ++i) {
+      const auto& d = info[i];
+      if (!d.enabled || d.use == XIMasterPointer || d.use == XIMasterKeyboard)
+        continue;
+      Atom type = None;
+      int format = 0;
+      unsigned long items = 0, remaining = 0;
+      unsigned char* value = nullptr;
+      const int result =
+          XIGetProperty(display_, d.deviceid, xtest_property_, 0, 1, False,
+                        XA_INTEGER, &type, &format, &items, &remaining, &value);
+      const bool injected = result == Success && type == XA_INTEGER &&
+                            format == 8 && items == 1 && value && value[0] == 1;
+      if (value) XFree(value);
+      if (injected) continue;
+      Device device;
+      device.id = d.deviceid;
+      device.use = d.use;
+      device.attachment = d.attachment;
+      device.name = d.name ? d.name : "";
+      for (int c = 0; c < d.num_classes; ++c) {
+        device.keyboard |= d.classes[c]->type == XIKeyClass;
+        device.touch |= d.classes[c]->type == XITouchClass;
+      }
+      devices.push_back(std::move(device));
+    }
+    XIFreeDeviceInfo(info);
+    XSync(display_, False);
+    if (x_error) {
+      error = "Cannot verify local X11 input devices";
+      return false;
+    }
+    return true;
+  }
+
+  bool Acquire(std::string& error) {
+    // A second instance must not save the first instance's black ramps as its
+    // originals. Selection ownership and creation are atomic on this server.
+    XGrabServer(display_);
+    if (XGetSelectionOwner(display_, selection_) == None) {
+      owner_ = XCreateSimpleWindow(display_, DefaultRootWindow(display_), 0, 0,
+                                   1, 1, 0, 0, 0);
+      XSetSelectionOwner(display_, selection_, owner_, CurrentTime);
+    }
+    XUngrabServer(display_);
+    XSync(display_, False);
+    if (!owner_ || XGetSelectionOwner(display_, selection_) != owner_) {
+      error = "Another CrossDesk instance owns Linux privacy protection";
+      return false;
+    }
+    reply_.recovered = false;
+    return true;
+  }
+
+  bool ProtectInput(bool block_input, std::string& error) {
+    blocking_ = block_input;
+    if (!block_input) return true;
+    for (const auto& device : devices_) {
+      if (device.touch) {
+        error = "Touchscreen privacy input blocking is unavailable";
+        return false;
+      }
+      if (device.keyboard) {
+        // Preserve held local modifiers for the emergency chord independently
+        // of the releases sent to the master keyboard below.
+        XDevice* keyboard = XOpenDevice(display_, device.id);
+        XDeviceState* state =
+            keyboard ? XQueryDeviceState(display_, keyboard) : nullptr;
+        if (!state) {
+          if (keyboard) XCloseDevice(display_, keyboard);
+          error = "Cannot inspect held local keyboard input";
+          return false;
+        }
+        XInputClass* input = state->data;
+        for (int i = 0; i < state->num_classes; ++i) {
+          if (input->c_class == KeyClass) {
+            const auto* keys = reinterpret_cast<XKeyState*>(input);
+            for (int key = 0; key < 256; ++key)
+              keys_[device.id][key] = keys->keys[key / 8] & (1 << (key % 8));
+          }
+          input = reinterpret_cast<XInputClass*>(
+              reinterpret_cast<char*>(input) + input->length);
+        }
+        XFreeDeviceState(state);
+        XCloseDevice(display_, keyboard);
+      }
+      std::array<unsigned char, XIMaskLen(XI_LASTEVENT)> bits{};
+      for (int type : {XI_KeyPress, XI_KeyRelease, XI_ButtonPress,
+                       XI_ButtonRelease, XI_Motion})
+        XISetMask(bits.data(), type);
+      XIEventMask mask{device.id, static_cast<int>(bits.size()), bits.data()};
+      const int result = XIGrabDevice(
+          display_, device.id, DefaultRootWindow(display_), CurrentTime, None,
+          GrabModeAsync, GrabModeAsync, False, &mask);
+      if (result != GrabSuccess) {
+        error = "Cannot grab every local X11 input device";
+        return false;
+      }
+      grabbed_.push_back(device.id);
+    }
+    return ReleaseHeldInput(error);
+  }
+
+  bool ReleaseHeldInput(std::string& error) {
+    // Slave grabs float physical devices, but their previous presses can
+    // remain on the master. Release them after all grabs are installed so a
+    // held local Ctrl/button cannot alter the remote controller's next input.
+    int original_pointer = 0, count = 0;
+    XIGetClientPointer(display_, None, &original_pointer);
+    XIDeviceInfo* masters = XIQueryDevice(display_, XIAllMasterDevices, &count);
+    if (!masters) {
+      error = "Cannot inspect held X11 input";
+      return false;
+    }
+    x_error = 0;
+    bool ok = true;
+    for (int i = 0; i < count; ++i) {
+      if (masters[i].use != XIMasterPointer || !masters[i].enabled) continue;
+      XISetClientPointer(display_, None, masters[i].deviceid);
+      char keys[32]{};
+      XQueryKeymap(display_, keys);
+      for (int key = 8; key < 256; ++key)
+        if (keys[key / 8] & (1 << (key % 8)))
+          ok &= XTestFakeKeyEvent(display_, key, False, CurrentTime) != 0;
+      Window root = None, child = None;
+      double root_x = 0, root_y = 0, win_x = 0, win_y = 0;
+      XIButtonState buttons{};
+      XIModifierState modifiers{};
+      XIGroupState group{};
+      XIQueryPointer(display_, masters[i].deviceid, DefaultRootWindow(display_),
+                     &root, &child, &root_x, &root_y, &win_x, &win_y, &buttons,
+                     &modifiers, &group);
+      for (int button = 1; button < buttons.mask_len * 8; ++button)
+        if (XIMaskIsSet(buttons.mask, button))
+          ok &= XTestFakeButtonEvent(display_, button, False, CurrentTime) != 0;
+      if (buttons.mask) XFree(buttons.mask);
+      XSync(display_, False);
+      XQueryKeymap(display_, keys);
+      for (char pressed : keys) ok &= pressed == 0;
+      buttons = {};
+      XIQueryPointer(display_, masters[i].deviceid, DefaultRootWindow(display_),
+                     &root, &child, &root_x, &root_y, &win_x, &win_y, &buttons,
+                     &modifiers, &group);
+      for (int byte = 0; byte < buttons.mask_len; ++byte)
+        ok &= buttons.mask[byte] == 0;
+      if (buttons.mask) XFree(buttons.mask);
+    }
+    XIFreeDeviceInfo(masters);
+    if (original_pointer) XISetClientPointer(display_, None, original_pointer);
+    XSync(display_, False);
+    if (!ok || x_error) {
+      error = "Cannot release held X11 input for privacy";
+      return false;
+    }
+    return true;
+  }
+
+  void Key(int source, int keycode, bool down) {
+    if (keycode < 0 || keycode >= 256 ||
+        std::none_of(devices_.begin(), devices_.end(), [source](const auto& d) {
+          return d.id == source && d.keyboard;
+        }))
+      return;
+    keys_[source][keycode] = down;
+    bool ctrl = false, alt = false, shift = false;
+    for (const auto& [id, keys] : keys_) {
+      for (int code = 0; code < 256; ++code) {
+        if (!keys[code]) continue;
+        const KeySym symbol = XkbKeycodeToKeysym(display_, code, 0, 0);
+        ctrl |= symbol == XK_Control_L || symbol == XK_Control_R;
+        alt |= symbol == XK_Alt_L || symbol == XK_Alt_R;
+        shift |= symbol == XK_Shift_L || symbol == XK_Shift_R;
+      }
+    }
+    if (down && ctrl && alt && shift &&
+        XkbKeycodeToKeysym(display_, keycode, 0, 0) == XK_F12) {
+      reply_.emergency = true;
+      Recover();
+    }
+  }
+
+  void Check() {
+    checked_ = Clock::now();
+    std::string error;
+    std::vector<Output> current;
+    std::vector<Device> devices;
+    if (!ReadOutputs(current, false, error) || !ReadDevices(devices, error)) {
+      Fail(error);
+      return;
+    }
+    if (current.size() != outputs_.size() ||
+        !std::equal(
+            current.begin(), current.end(), outputs_.begin(),
+            [](const auto& a, const auto& b) { return a.SameLayout(b); })) {
+      Fail("Display topology changed; Linux privacy has been turned off");
+      return;
+    }
+    if (devices != devices_) {
+      Fail("Local input devices changed; Linux privacy has been turned off");
+      return;
+    }
+    x_error = 0;
+    for (const auto& output : outputs_) {
+      Gamma ramp(XRRGetCrtcGamma(display_, output.crtc), XRRFreeGamma);
+      if (!IsBlack(ramp.get())) {
+        Fail(
+            "Display gamma protection was changed; Linux privacy is "
+            "unavailable");
+        return;
+      }
+    }
+    XSync(display_, False);
+    if (x_error || XGetSelectionOwner(display_, selection_) != owner_)
+      Fail("Cannot verify Linux privacy protection");
+  }
+
+  Display* display_ = nullptr;
+  bool initialized_ = false;
+  bool blocking_ = false;
+  int xi_opcode_ = 0;
+  Atom xtest_property_ = None, selection_ = None;
+  Window owner_ = 0;
+  std::vector<Output> outputs_;
+  std::vector<Device> devices_;
+  std::vector<int> grabbed_;
+  std::vector<Window> hidden_roots_;
+  std::map<int, std::array<bool, 256>> keys_;
+  LinuxPrivacyReply reply_;
+  Clock::time_point checked_{};
+};
+}  // namespace
+
+int RunLinuxPrivacyGuard() {
+  const int socket = kLinuxPrivacyGuardSocket;
+  int type = 0;
+  socklen_t length = sizeof(type);
+  if (getsockopt(socket, SOL_SOCKET, SO_TYPE, &type, &length) != 0 ||
+      type != SOCK_SEQPACKET)
+    return 1;
+  fcntl(socket, F_SETFD, FD_CLOEXEC);
+  fcntl(socket, F_SETFL, O_NONBLOCK);
+  struct sigaction action {};
+  action.sa_handler = StopGuard;
+  sigemptyset(&action.sa_mask);
+  sigaction(SIGTERM, &action, nullptr);
+  sigaction(SIGINT, &action, nullptr);
+  sigaction(SIGHUP, &action, nullptr);
+  XSetErrorHandler(OnXError);
+  NativePrivacy privacy;
+  auto heartbeat = Clock::now();
+  bool connected = true;
+  bool dirty = false;
+  while (connected && !stopping) {
+    pollfd fds[] = {{socket, POLLIN, 0}, {privacy.Connection(), POLLIN, 0}};
+    poll(fds, 2, privacy.Reply().active ? 25 : 250);
+    if (fds[0].revents & (POLLERR | POLLHUP | POLLNVAL)) break;
+    for (int i = 0; i < 64; ++i) {
+      LinuxPrivacyCommand command;
+      const auto bytes = recv(socket, &command, sizeof(command), 0);
+      if (bytes < 0 &&
+          (errno == EAGAIN || errno == EWOULDBLOCK || errno == EINTR))
+        break;
+      if (bytes != sizeof(command)) {
+        connected = false;
+        break;
+      }
+      heartbeat = Clock::now();
+      switch (command) {
+        case LinuxPrivacyCommand::query:
+          if (!privacy.Reply().active) privacy.Query();
+          break;
+        case LinuxPrivacyCommand::enable:
+          privacy.Enable(false);
+          break;
+        case LinuxPrivacyCommand::enable_blocking:
+          privacy.Enable(true);
+          break;
+        case LinuxPrivacyCommand::recover:
+          privacy.Recover();
+          break;
+        case LinuxPrivacyCommand::heartbeat:
+          break;
+        default:
+          connected = false;
+          break;
+      }
+      dirty = true;
+    }
+    if (!connected || stopping) break;
+    const auto before = privacy.Reply();
+    privacy.Poll();
+    if (privacy.Reply().active &&
+        Clock::now() - heartbeat > std::chrono::seconds(3))
+      privacy.Fail(
+          "Privacy controller stopped responding; local desktop and input "
+          "restored");
+    const auto& after = privacy.Reply();
+    dirty |= before.active != after.active ||
+             before.recovered != after.recovered ||
+             before.emergency != after.emergency ||
+             std::strcmp(before.failure, after.failure) != 0;
+    if (dirty) {
+      const auto& reply = privacy.Reply();
+      if (send(socket, &reply, sizeof(reply), MSG_NOSIGNAL) == sizeof(reply)) {
+        dirty = false;
+        privacy.AcknowledgeEmergency();
+      } else if (errno != EAGAIN && errno != EWOULDBLOCK && errno != EINTR)
+        break;
+    }
+  }
+  // Keep trying if the X server temporarily rejected restoration, even after
+  // the parent exited. Disconnecting releases XI grabs and cursor hiding too.
+  do {
+    privacy.Recover();
+    if (!privacy.Reply().recovered) poll(nullptr, 0, 250);
+  } while (!privacy.Reply().recovered);
+  const auto& reply = privacy.Reply();
+  const auto ignored = send(socket, &reply, sizeof(reply), MSG_NOSIGNAL);
+  (void)ignored;
+  close(socket);
+  return 0;
+}
+}  // namespace crossdesk

apps/desktop/src/platform/linux/privacy/privacy_guard.h

@@ -0,0 +1,42 @@
+/*
+ * @Author: DI JUNKUN
+ * @Date: 2026-09-13
+ * Copyright (c) 2026 by DI JUNKUN, All Rights Reserved.
+ */
+
+#ifndef _PRIVACY_GUARD_H_
+#define _PRIVACY_GUARD_H_
+
+#include <cstdint>
+
+namespace crossdesk {
+
+inline constexpr char kLinuxPrivacyGuardArgument[] = "--linux-privacy-guard";
+inline constexpr int kLinuxPrivacyGuardSocket = 3;
+
+// Private protocol over an inherited SOCK_SEQPACKET socket. No listening
+// socket, shell, elevated privileges or separately installed helper is needed.
+enum class LinuxPrivacyCommand : uint8_t {
+  query,
+  enable,
+  enable_blocking,
+  recover,
+  heartbeat,
+};
+
+struct LinuxPrivacyReply {
+  uint64_t generation = 0;
+  bool supported = false;
+  bool input_supported = false;
+  bool active = false;
+  bool recovered = true;
+  bool emergency = false;
+  char capability_reason[256]{};
+  char failure[256]{};
+};
+
+int RunLinuxPrivacyGuard();
+
+}  // namespace crossdesk
+
+#endif

apps/desktop/src/platform/linux/screen_capturer/screen_capturer_linux.cpp

@@ -8,6 +8,7 @@
 
 #include <display_stream_id.h>
 #include "platform.h"
+#include "privacy_controller.h"
 #include "rd_log.h"
 #if defined(CROSSDESK_HAS_DRM) && CROSSDESK_HAS_DRM
 #include "screen_capturer_drm.h"
@@ -64,6 +65,13 @@ int ScreenCapturerLinux::Init(const int fps, cb_desktop_data cb) {
       return;
     }
     invalid_stream_id_logged_.store(false, std::memory_order_relaxed);
+    {
+      std::lock_guard lock(privacy_mutex_);
+      if (privacy_ && !capture_paused_ && !capture_announced_) {
+        capture_announced_ = true;
+        privacy_->CaptureChanged(true);
+      }
+    }
     if (callback_orig_) {
       callback_orig_(data, size, width, height, mapped_stream_id.c_str(),
                      native_frame);
@@ -145,6 +153,7 @@ int ScreenCapturerLinux::Init(const int fps, cb_desktop_data cb) {
 }
 
 int ScreenCapturerLinux::Destroy() {
+  Stop();
   if (impl_) {
     impl_->Destroy();
     impl_.reset();
@@ -169,6 +178,11 @@ int ScreenCapturerLinux::Start(bool show_cursor) {
     return -1;
   }
 
+  {
+    std::lock_guard lock(privacy_mutex_);
+    capture_paused_ = false;
+  }
+
   // X11 output names, DRM connectors and Wayland stream handles may all change
   // after an HDMI hotplug, so rebuild the current backend before each session.
   const int refresh_ret = RefreshCurrentBackend();
@@ -226,6 +240,11 @@ int ScreenCapturerLinux::Stop() {
     return 0;
   }
   const int ret = impl_->Stop();
+  {
+    std::lock_guard lock(privacy_mutex_);
+    capture_announced_ = false;
+    if (privacy_) privacy_->CaptureChanged(false);
+  }
   UpdateAliasesFromBackend(impl_.get());
   return ret;
 }
@@ -234,13 +253,25 @@ int ScreenCapturerLinux::Pause(int monitor_index) {
   if (!impl_) {
     return -1;
   }
-  return impl_->Pause(monitor_index);
+  const int ret = impl_->Pause(monitor_index);
+  {
+    // An in-flight frame must not announce running again after a pause.
+    std::lock_guard lock(privacy_mutex_);
+    capture_paused_ = true;
+    capture_announced_ = false;
+    if (privacy_) privacy_->CaptureChanged(false);
+  }
+  return ret;
 }
 
 int ScreenCapturerLinux::Resume(int monitor_index) {
   if (!impl_) {
     return -1;
   }
+  {
+    std::lock_guard lock(privacy_mutex_);
+    capture_paused_ = false;
+  }
   return impl_->Resume(monitor_index);
 }
 

apps/desktop/src/platform/linux/screen_capturer/screen_capturer_linux.h

@@ -25,6 +25,7 @@ class ScreenCapturerLinux : public ScreenCapturer {
 
  public:
   int Init(const int fps, cb_desktop_data cb) override;
+  void SetPrivacyController(PrivacyController* privacy) override { privacy_ = privacy; }
   int Destroy() override;
   int Start(bool show_cursor) override;
   int Stop() override;
@@ -53,6 +54,10 @@ class ScreenCapturerLinux : public ScreenCapturer {
 
  private:
   std::unique_ptr<ScreenCapturer> impl_;
+  PrivacyController* privacy_ = nullptr;
+  std::mutex privacy_mutex_;
+  bool capture_announced_ = false;
+  bool capture_paused_ = false;
   BackendType backend_ = BackendType::kNone;
   int fps_ = 60;
   cb_desktop_data callback_;

apps/desktop/src/platform/macos/gui/runtime/cursor_state_provider_mac.mm

@@ -11,6 +11,7 @@
 #include <vector>
 
 #include "runtime/cursor_position.h"
+#include "../../privacy/privacy_cursor_mac.h"
 
 namespace crossdesk {
 namespace {
@@ -161,7 +162,9 @@ bool CursorStateProvider::Sample(const std::vector<DisplayInfo>& displays,
 #pragma clang diagnostic push
 #pragma clang diagnostic ignored "-Wdeprecated-declarations"
   NSCursor* cursor = NSCursor.currentSystemCursor;
-  const bool visible = CGCursorIsVisible();
+  const bool privacy_hidden = IsMacPrivacyCursorHidden();
+  const bool visible = CGCursorIsVisible() || privacy_hidden;
+  if (!cursor && privacy_hidden) cursor = NSCursor.arrowCursor;
 #pragma clang diagnostic pop
 
   state->seq = 0;

apps/desktop/src/platform/macos/input/keyboard/keyboard_capturer.cpp

@@ -4,6 +4,7 @@
 #include <unordered_map>
 
 #include "keyboard_converter.h"
+#include "../mac_injected_event.h"
 #include "rd_log.h"
 
 namespace crossdesk {
@@ -11,7 +12,6 @@ namespace crossdesk {
 static OnKeyAction g_on_key_action = nullptr;
 static void* g_user_ptr = nullptr;
 static std::unordered_map<int, int> g_unmapped_keycode_to_vk;
-constexpr int64_t kCrossDeskInjectedKeyboardEvent = 0x43524f5353444553;
 
 static int VkCodeFromUnicode(UniChar ch) {
   if (ch >= 'a' && ch <= 'z') {
@@ -106,7 +106,7 @@ CGEventRef eventCallback(CGEventTapProxy proxy, CGEventType type,
                          CGEventRef event, void* userInfo) {
   (void)proxy;
   if (CGEventGetIntegerValueField(event, kCGEventSourceUserData) ==
-      kCrossDeskInjectedKeyboardEvent) {
+      kCrossDeskInjectedEvent) {
     return event;
   }
   if (!g_on_key_action) {
@@ -309,7 +309,7 @@ int PlatformKeyboardCapturer::SendKeyboardCommand(int key_code, bool is_down,
 
     CGEventSetFlags(event, ToCGEventFlags(injected_flags));
     CGEventSetIntegerValueField(event, kCGEventSourceUserData,
-                               kCrossDeskInjectedKeyboardEvent);
+                               kCrossDeskInjectedEvent);
     CGEventPost(kCGHIDEventTap, event);
     CFRelease(event);
 
@@ -323,7 +323,7 @@ int PlatformKeyboardCapturer::SendKeyboardCommand(int key_code, bool is_down,
         return -1;
       }
       CGEventSetIntegerValueField(fn_release_event, kCGEventSourceUserData,
-                                 kCrossDeskInjectedKeyboardEvent);
+                                 kCrossDeskInjectedEvent);
       CGEventPost(kCGHIDEventTap, fn_release_event);
       CFRelease(fn_release_event);
     }

apps/desktop/src/platform/macos/input/mac_injected_event.h

@@ -0,0 +1,17 @@
+/*
+ * @Author: DI JUNKUN
+ * @Date: 2026-09-13
+ * Copyright (c) 2026 by DI JUNKUN, All Rights Reserved.
+ */
+
+#ifndef _MAC_INJECTED_EVENT_H_
+#define _MAC_INJECTED_EVENT_H_
+
+#include <cstdint>
+
+namespace crossdesk {
+// Shared by the keyboard/mouse injectors and the privacy input tap.
+inline constexpr int64_t kCrossDeskInjectedEvent = 0x43524f5353444553;
+}
+
+#endif

apps/desktop/src/platform/macos/input/mouse/mouse_controller.cpp

@@ -1,4 +1,5 @@
 #include "mouse_controller.h"
+#include "../mac_injected_event.h"
 
 #include <remote_action.h>
 
@@ -210,6 +211,8 @@ int PlatformMouseController::SendMouseCommand(RemoteAction remote_action,
   }
 
   if (mouse_event) {
+    CGEventSetIntegerValueField(mouse_event, kCGEventSourceUserData,
+                                kCrossDeskInjectedEvent);
     CGEventPost(kCGHIDEventTap, mouse_event);
     CFRelease(mouse_event);
   }

apps/desktop/src/platform/macos/privacy/privacy_backend_mac.mm

@@ -0,0 +1,400 @@
+/* Copyright (c) 2026 by DI JUNKUN, All Rights Reserved. */
+
+#import <AppKit/AppKit.h>
+#import <ApplicationServices/ApplicationServices.h>
+
+#include <algorithm>
+#include <chrono>
+#include <deque>
+#include <functional>
+#include <cstdlib>
+#include <libproc.h>
+#include <mutex>
+#include <utility>
+#include <unistd.h>
+
+#include "privacy_backend.h"
+#include "privacy_capture_state.h"
+#include "privacy_cover_view.h"
+#include "privacy_cursor_mac.h"
+#include "rd_log.h"
+#include "../input/mac_injected_event.h"
+
+// These windows never take keyboard focus. Remote clicks pass through them;
+// physical input is intercepted independently on the controller's run loop.
+@interface CrossDeskPrivacyPanel : NSPanel
+@end
+@implementation CrossDeskPrivacyPanel
+- (BOOL)canBecomeKeyWindow { return NO; }
+- (BOOL)canBecomeMainWindow { return NO; }
+@end
+
+namespace crossdesk {
+namespace {
+using Clock = std::chrono::steady_clock;
+std::mutex tasks_mutex;
+std::deque<std::function<void()>> tasks;
+std::mutex capture_mutex;
+MacPrivacyCaptureState capture_state;
+
+void OnMain(std::function<void()> task) {
+  {
+    std::lock_guard lock(tasks_mutex);
+    tasks.push_back(std::move(task));
+  }
+  dispatch_async(dispatch_get_main_queue(), ^{ FlushMacPrivacyTasks(); });
+}
+
+void PublishCovers(std::vector<uint32_t> windows, uint32_t cursor_window = 0) {
+  {
+    std::lock_guard lock(capture_mutex);
+    capture_state.excluded_windows = std::move(windows);
+    capture_state.cursor_window = cursor_window;
+    ++capture_state.revision;
+  }
+  dispatch_async(dispatch_get_main_queue(), ^{
+    [NSNotificationCenter.defaultCenter postNotificationName:@"CrossDeskPrivacyCoversChanged"
+                                                     object:nil];
+  });
+}
+
+struct Monitor {
+  CGDirectDisplayID id = 0;
+  CGRect bounds{};  // CoreGraphics desktop coordinates (points).
+  NSRect frame{};   // AppKit desktop coordinates (bottom left).
+  CrossDeskPrivacyPanel* __strong cover = nil;
+};
+struct WindowState {
+  std::mutex mutex;
+  std::vector<Monitor> monitors;
+  bool recovered = true;
+  bool recovering = false;
+  bool covers_shown = false;
+  bool check_queued = false;
+  MacPrivacyCursor cursor;
+  std::string failure;
+  Clock::time_point checked = Clock::now();
+};
+
+CrossDeskPrivacyPanel* MakePanel(NSRect frame, NSInteger level) {
+  auto* panel = [[CrossDeskPrivacyPanel alloc]
+      initWithContentRect:frame
+                styleMask:NSWindowStyleMaskBorderless | NSWindowStyleMaskNonactivatingPanel
+                  backing:NSBackingStoreBuffered defer:NO];
+  panel.releasedWhenClosed = NO;
+  panel.hidesOnDeactivate = NO;
+  panel.opaque = YES;
+  panel.backgroundColor = NSColor.blackColor;
+  panel.hasShadow = NO;
+  panel.ignoresMouseEvents = YES;
+  panel.level = level;
+  panel.animationBehavior = NSWindowAnimationBehaviorNone;
+  panel.collectionBehavior = NSWindowCollectionBehaviorCanJoinAllSpaces |
+      NSWindowCollectionBehaviorFullScreenAuxiliary |
+      NSWindowCollectionBehaviorStationary |
+      NSWindowCollectionBehaviorIgnoresCycle;
+  // Exclusion is explicit in ScreenCaptureKit. SharingNone alone does not
+  // exclude windows on recent macOS releases, and can hide them from discovery.
+  panel.sharingType = NSWindowSharingReadOnly;
+  return panel;
+}
+
+bool IsSystemCursorPlane(NSDictionary* info, CGRect bounds) {
+  const auto layer = [info[(__bridge NSString*)kCGWindowLayer] intValue];
+  // WindowServer's cursor plane also carries small recording indicators.
+  // Validate both its geometry and executable identity before ignoring it.
+  if (layer != CGWindowLevelForKey(kCGCursorWindowLevelKey) ||
+      bounds.size.width <= 0 || bounds.size.height <= 0 ||
+      bounds.size.width > 512 || bounds.size.height > 512)
+    return false;
+  char executable[PROC_PIDPATHINFO_MAXSIZE]{};
+  const auto pid = [info[(__bridge NSString*)kCGWindowOwnerPID] intValue];
+  static const std::string system_executable = [] {
+    char resolved[PROC_PIDPATHINFO_MAXSIZE]{};
+    return realpath("/System/Library/PrivateFrameworks/SkyLight.framework/Resources/WindowServer",
+                    resolved) ? std::string(resolved) : std::string();
+  }();
+  return proc_pidpath(pid, executable, sizeof(executable)) > 0 &&
+      !system_executable.empty() && system_executable == executable;
+}
+
+std::string CoverageFailure(const std::vector<Monitor>& monitors) {
+  uint32_t count = 0;
+  if (CGGetActiveDisplayList(0, nullptr, &count) != kCGErrorSuccess || !count)
+    return "No active macOS desktop; privacy screen unavailable";
+  std::vector<CGDirectDisplayID> displays(count);
+  if (CGGetActiveDisplayList(count, displays.data(), &count) != kCGErrorSuccess ||
+      count != monitors.size())
+    return "Display topology changed; turn privacy off to recover";
+  for (const auto& m : monitors) {
+    if (std::find(displays.begin(), displays.end(), m.id) == displays.end() ||
+        !CGRectEqualToRect(CGDisplayBounds(m.id), m.bounds) ||
+        !m.cover.visible || !m.cover.isOnActiveSpace ||
+        !NSEqualRects(m.cover.frame, m.frame) || m.cover.alphaValue != 1.0)
+      return "Privacy cover or display geometry changed; privacy screen unavailable";
+  }
+  NSDictionary* session = CFBridgingRelease(CGSessionCopyCurrentDictionary());
+  if (!session || ![session[(__bridge NSString*)kCGSessionOnConsoleKey] boolValue])
+    return "macOS session is not on console; privacy screen unavailable";
+
+  NSArray* windows = CFBridgingRelease(CGWindowListCopyWindowInfo(
+      kCGWindowListOptionOnScreenOnly | kCGWindowListExcludeDesktopElements,
+      kCGNullWindowID));
+  if (!windows) return "Unable to verify macOS privacy window order";
+  for (const auto& m : monitors) {
+    bool found = false;
+    for (NSDictionary* info in windows) {
+      const auto window = [info[(__bridge NSString*)kCGWindowNumber] unsignedIntValue];
+      if (window == m.cover.windowNumber) { found = true; break; }
+      if ([info[(__bridge NSString*)kCGWindowAlpha] doubleValue] <= 0) continue;
+      CGRect bounds{};
+      if (!CGRectMakeWithDictionaryRepresentation(
+              (__bridge CFDictionaryRef)info[(__bridge NSString*)kCGWindowBounds], &bounds))
+        return "Unable to verify a window above the privacy cover";
+      if (CGRectIntersectsRect(bounds, m.bounds)) {
+        if (IsSystemCursorPlane(info, bounds)) continue;
+        LOG_WARN("macOS privacy overlap: window={}, pid={}, layer={}, alpha={}, "
+                 "bounds=({}, {}, {}, {}), cover={}, cover_level={}",
+                 window,
+                 [info[(__bridge NSString*)kCGWindowOwnerPID] intValue],
+                 [info[(__bridge NSString*)kCGWindowLayer] intValue],
+                 [info[(__bridge NSString*)kCGWindowAlpha] doubleValue],
+                 bounds.origin.x, bounds.origin.y, bounds.size.width, bounds.size.height,
+                 m.cover.windowNumber, m.cover.level);
+        return "A system or application window overlaps the privacy cover; privacy screen unavailable";
+      }
+    }
+    if (!found) return "Privacy cover disappeared; privacy screen unavailable";
+  }
+  return {};
+}
+
+class MacPrivacyBackend final : public PrivacyBackend {
+ public:
+  MacPrivacyBackend() : state_(std::make_shared<WindowState>()) {
+    loop_ = CFRunLoopGetCurrent();
+    CFRetain(loop_);
+    CFRunLoopSourceContext context{};
+    wake_source_ = CFRunLoopSourceCreate(nullptr, 0, &context);
+    CFRunLoopAddSource(loop_, wake_source_, kCFRunLoopDefaultMode);
+  }
+  ~MacPrivacyBackend() override {
+    Recover();
+    CFRunLoopRemoveSource(loop_, wake_source_, kCFRunLoopDefaultMode);
+    CFRelease(wake_source_);
+    CFRelease(loop_);
+  }
+  PrivacyCapabilities Query() override {
+    if (@available(macOS 14.0, *)) {
+      if (!CGPreflightScreenCaptureAccess())
+        return {false, false, "Grant Screen Recording permission to use privacy screen"};
+      if (!AXIsProcessTrusted())
+        return {false, false, "Grant Accessibility permission to protect local input and enable local recovery"};
+      if (!MacPrivacyCursor::Supported())
+        return {false, false, "Background cursor control unavailable on this macOS version"};
+      return {true, true, "macOS privacy screen available (ScreenCaptureKit)"};
+    }
+    return {false, false, "Privacy screen requires macOS 14 or newer"};
+  }
+  bool Enable(bool block_input, const PrivacyScreenText& text, std::string& error) override {
+    const auto caps = Query();
+    if (!caps.overlay) { error = caps.reason; return false; }
+    block_input_ = block_input;
+    emergency_ = false;
+    tap_failed_ = false;
+    CGEventMask mask = CGEventMaskBit(kCGEventKeyDown) | CGEventMaskBit(kCGEventKeyUp) |
+        CGEventMaskBit(kCGEventFlagsChanged) | CGEventMaskBit(kCGEventLeftMouseDown) |
+        CGEventMaskBit(kCGEventLeftMouseUp) | CGEventMaskBit(kCGEventRightMouseDown) |
+        CGEventMaskBit(kCGEventRightMouseUp) | CGEventMaskBit(kCGEventMouseMoved) |
+        CGEventMaskBit(kCGEventLeftMouseDragged) | CGEventMaskBit(kCGEventRightMouseDragged) |
+        CGEventMaskBit(kCGEventOtherMouseDown) | CGEventMaskBit(kCGEventOtherMouseUp) |
+        CGEventMaskBit(kCGEventOtherMouseDragged) | CGEventMaskBit(kCGEventScrollWheel) |
+        CGEventMaskBit(14); // NX_SYSDEFINED: media/brightness keys.
+    tap_ = CGEventTapCreate(kCGHIDEventTap, kCGHeadInsertEventTap,
+                           kCGEventTapOptionDefault, mask, Input, this);
+    if (!tap_) { error = "Cannot install macOS privacy input tap"; return false; }
+    tap_source_ = CFMachPortCreateRunLoopSource(nullptr, tap_, 0);
+    if (!tap_source_) { error = "Cannot create macOS privacy input run loop"; return false; }
+    CFRunLoopAddSource(loop_, tap_source_, kCFRunLoopDefaultMode);
+    CGEventTapEnable(tap_, true);
+    {
+      std::lock_guard lock(state_->mutex);
+      state_->recovered = false;
+      state_->failure.clear();
+      state_->checked = Clock::now();
+    }
+    auto state = state_;
+    OnMain([state, text] {
+      @autoreleasepool {
+        std::lock_guard lock(state->mutex);
+        if (!state->cursor.Prepare()) {
+          state->failure = "Cannot prepare the privacy cursor";
+          return;
+        }
+        std::vector<uint32_t> covers;
+        for (NSScreen* screen in NSScreen.screens) {
+          Monitor m;
+          m.id = [screen.deviceDescription[@"NSScreenNumber"] unsignedIntValue];
+          m.bounds = CGDisplayBounds(m.id);
+          m.frame = screen.frame;
+          NSView* content = CreateMacPrivacyCoverView(
+              NSMakeRect(0, 0, m.frame.size.width, m.frame.size.height),
+              [NSString stringWithUTF8String:text.unlock_hint.c_str()]);
+          if (!content) {
+            state->failure = "Could not load the CrossDesk privacy screen logo";
+            break;
+          }
+          m.cover = MakePanel(m.frame, CGWindowLevelForKey(kCGScreenSaverWindowLevelKey) + 1);
+          m.cover.contentView = content;
+          // Register transparent windows first. Make them opaque only after
+          // SCK has acknowledged exclusion, avoiding a black remote frame.
+          m.cover.alphaValue = 0;
+          [m.cover orderFrontRegardless];
+          covers.push_back(static_cast<uint32_t>(m.cover.windowNumber));
+          state->monitors.push_back(std::move(m));
+        }
+        PublishCovers(std::move(covers), state->cursor.WindowId());
+        if (state->monitors.empty()) state->failure = "No active macOS desktop";
+        state->checked = Clock::now();
+      }
+    });
+    return true;
+  }
+  void Recover() override {
+    if (tap_) { CGEventTapEnable(tap_, false); CFMachPortInvalidate(tap_); }
+    if (tap_source_) {
+      CFRunLoopRemoveSource(loop_, tap_source_, kCFRunLoopDefaultMode);
+      CFRelease(tap_source_); tap_source_ = nullptr;
+    }
+    if (tap_) { CFRelease(tap_); tap_ = nullptr; }
+    {
+      std::lock_guard lock(state_->mutex);
+      if (state_->recovered || state_->recovering) return;
+      state_->recovering = true;
+    }
+    auto state = state_;
+    OnMain([state] {
+      std::lock_guard lock(state->mutex);
+      for (auto& m : state->monitors) {
+        [m.cover orderOut:nil]; [m.cover close]; m.cover = nil;
+      }
+      state->monitors.clear();
+      state->covers_shown = false;
+      state->cursor.Restore();
+      PublishCovers({});
+      state->failure.clear();
+      state->recovering = false;
+      state->recovered = true;
+    });
+  }
+  bool IsRecovered() const override {
+    std::lock_guard lock(state_->mutex);
+    return state_->recovered && !tap_;
+  }
+  bool RecoveryPending() const override {
+    std::lock_guard lock(state_->mutex);
+    return state_->recovering;
+  }
+  PrivacyHealth Poll() override {
+    if (emergency_) { emergency_ = false; return {{}, true}; }
+    if (tap_ && (tap_failed_ || !CGEventTapIsEnabled(tap_) || !AXIsProcessTrusted()))
+      return {"Local input protection interrupted; privacy screen unavailable", false};
+    auto state = state_;
+    std::lock_guard lock(state->mutex);
+    if (state->recovered || state->recovering) return {};
+    if (!state->failure.empty()) return {state->failure, false};
+    const auto age = Clock::now() - state->checked;
+    if (age > std::chrono::seconds(1))
+      return {"macOS privacy window checks stopped responding; privacy screen unavailable", false};
+    if (!state->check_queued && age > std::chrono::milliseconds(100)) {
+      state->check_queued = true;
+      OnMain([state] {
+        std::lock_guard lock(state->mutex);
+        if (!state->recovered && !state->recovering && state->failure.empty()) {
+          const auto capture = GetMacPrivacyCaptureState();
+          if (!state->covers_shown && !state->monitors.empty() &&
+              capture.revision == capture.applied_revision) {
+            if (!state->cursor.Hide()) {
+              state->failure = "Cannot hide the local privacy cursor";
+              state->checked = Clock::now();
+              state->check_queued = false;
+              return;
+            }
+            for (auto& m : state->monitors) {
+              m.cover.alphaValue = 1;
+              [m.cover displayIfNeeded];
+              [m.cover orderFrontRegardless];
+            }
+            state->covers_shown = true;
+          }
+          if (state->covers_shown) {
+            state->failure = state->cursor.Healthy() ? CoverageFailure(state->monitors)
+                : "Cannot keep the local privacy cursor hidden";
+          }
+        }
+        state->checked = Clock::now();
+        state->check_queued = false;
+      });
+    }
+    const auto capture = GetMacPrivacyCaptureState();
+    return {{}, false, state->covers_shown &&
+                       capture.revision == capture.applied_revision};
+  }
+  void WaitForEvents(unsigned timeout_ms) override {
+    @autoreleasepool {
+      CFRunLoopRunInMode(kCFRunLoopDefaultMode, timeout_ms / 1000.0, true);
+    }
+  }
+  void Wake() override { CFRunLoopSourceSignal(wake_source_); CFRunLoopWakeUp(loop_); }
+ private:
+  static CGEventRef Input(CGEventTapProxy, CGEventType type, CGEventRef event, void* context) {
+    auto* self = static_cast<MacPrivacyBackend*>(context);
+    if (type == kCGEventTapDisabledByTimeout || type == kCGEventTapDisabledByUserInput) {
+      self->tap_failed_ = true;
+      CGEventTapEnable(self->tap_, true); // Keep the local recovery chord usable.
+      return event;
+    }
+    if (!event) return event;
+    if (CGEventGetIntegerValueField(event, kCGEventSourceUserData) == kCrossDeskInjectedEvent &&
+        CGEventGetIntegerValueField(event, kCGEventSourceUnixProcessID) == getpid()) return event;
+    const auto flags = CGEventGetFlags(event);
+    const auto chord = kCGEventFlagMaskControl | kCGEventFlagMaskAlternate | kCGEventFlagMaskShift;
+    if (type == kCGEventKeyDown && (flags & chord) == chord &&
+        CGEventGetIntegerValueField(event, kCGKeyboardEventKeycode) == 53) {
+      self->emergency_ = true;
+      return nullptr;
+    }
+    return self->block_input_ ? nullptr : event;
+  }
+  std::shared_ptr<WindowState> state_;
+  CFRunLoopRef loop_ = nullptr;
+  CFRunLoopSourceRef wake_source_ = nullptr;
+  CFMachPortRef tap_ = nullptr;
+  CFRunLoopSourceRef tap_source_ = nullptr;
+  bool block_input_ = false;
+  bool emergency_ = false;
+  bool tap_failed_ = false;
+};
+}  // namespace
+
+void FlushMacPrivacyTasks() {
+  if (![NSThread isMainThread]) return;
+  std::deque<std::function<void()>> pending;
+  {
+    std::lock_guard lock(tasks_mutex);
+    pending.swap(tasks);
+  }
+  @autoreleasepool { for (auto& task : pending) task(); }
+}
+MacPrivacyCaptureState GetMacPrivacyCaptureState() {
+  std::lock_guard lock(capture_mutex);
+  return capture_state;
+}
+void AcknowledgeMacPrivacyCapture(uint64_t revision) {
+  std::lock_guard lock(capture_mutex);
+  if (revision == capture_state.revision) capture_state.applied_revision = revision;
+}
+std::unique_ptr<PrivacyBackend> CreateMacPrivacyBackend() {
+  return std::make_unique<MacPrivacyBackend>();
+}
+}  // namespace crossdesk

apps/desktop/src/platform/macos/privacy/privacy_capture_state.h

@@ -0,0 +1,23 @@
+/*
+ * @Author: DI JUNKUN
+ * @Date: 2026-09-13
+ * Copyright (c) 2026 by DI JUNKUN, All Rights Reserved.
+ */
+#ifndef _PRIVACY_CAPTURE_STATE_H_
+#define _PRIVACY_CAPTURE_STATE_H_
+
+#include <cstdint>
+#include <vector>
+
+namespace crossdesk {
+struct MacPrivacyCaptureState {
+  uint64_t revision = 0;
+  uint64_t applied_revision = 0;
+  std::vector<uint32_t> excluded_windows;
+  uint32_t cursor_window = 0;
+};
+MacPrivacyCaptureState GetMacPrivacyCaptureState();
+void AcknowledgeMacPrivacyCapture(uint64_t revision);
+}
+
+#endif

apps/desktop/src/platform/macos/privacy/privacy_cover_view.h

@@ -0,0 +1,17 @@
+/*
+ * @Author: DI JUNKUN
+ * @Date: 2026-09-13
+ * Copyright (c) 2026 by DI JUNKUN, All Rights Reserved.
+ */
+
+#ifndef _PRIVACY_COVER_VIEW_H_
+#define _PRIVACY_COVER_VIEW_H_
+
+#import <AppKit/AppKit.h>
+
+namespace crossdesk {
+// Returns nil if the CrossDesk icon resource cannot be loaded.
+NSView* CreateMacPrivacyCoverView(NSRect frame, NSString* unlock_hint);
+}
+
+#endif

apps/desktop/src/platform/macos/privacy/privacy_cover_view.mm

@@ -0,0 +1,106 @@
+/* Copyright (c) 2026 by DI JUNKUN, All Rights Reserved. */
+
+#include "privacy_cover_view.h"
+
+#include <algorithm>
+#include <cmath>
+
+namespace {
+NSImage* LoadPrivacyLogo() {
+  // The macOS installer currently packages the icon as "crossedesk.icns".
+  for (NSString* name in @[@"crossdesk", @"crossedesk"]) {
+    NSString* path = [NSBundle.mainBundle pathForResource:name ofType:@"icns"];
+    if (path) {
+      NSImage* image = [[NSImage alloc] initWithContentsOfFile:path];
+      if (image.valid) return image;
+    }
+  }
+  // Support unbundled development builds, including launches from outside
+  // the repository. No source-tree path is embedded in the executable.
+  NSString* resource = @"apps/desktop/resources/macos/crossdesk.icns";
+  NSString* directory = NSBundle.mainBundle.executablePath.stringByDeletingLastPathComponent;
+  NSMutableArray<NSString*>* paths = [NSMutableArray arrayWithObject:
+      [NSFileManager.defaultManager.currentDirectoryPath stringByAppendingPathComponent:resource]];
+  for (int depth = 0; directory.length && depth <= 4; ++depth) {
+    [paths addObject:[directory stringByAppendingPathComponent:resource]];
+    directory = directory.stringByDeletingLastPathComponent;
+  }
+  for (NSString* path in paths) {
+    NSImage* image = [[NSImage alloc] initWithContentsOfFile:path.stringByStandardizingPath];
+    if (image.valid) return image;
+  }
+  return nil;
+}
+
+NSAttributedString* Text(NSString* value, CGFloat size, NSFontWeight weight, NSColor* color) {
+  NSMutableParagraphStyle* paragraph = [[NSMutableParagraphStyle alloc] init];
+  paragraph.lineBreakMode = NSLineBreakByWordWrapping;
+  return [[NSAttributedString alloc] initWithString:value attributes:@{
+      NSFontAttributeName: [NSFont systemFontOfSize:size weight:weight],
+      NSForegroundColorAttributeName: color,
+      NSParagraphStyleAttributeName: paragraph}];
+}
+constexpr NSStringDrawingOptions kTextOptions =
+    NSStringDrawingUsesLineFragmentOrigin | NSStringDrawingUsesFontLeading;
+
+CGFloat TextHeight(NSAttributedString* text, CGFloat width) {
+  return std::ceil([text boundingRectWithSize:NSMakeSize(width, CGFLOAT_MAX)
+                                    options:kTextOptions].size.height);
+}
+}
+
+@interface CrossDeskPrivacyCoverView : NSView
+@property(nonatomic, strong) NSImage* logo;
+@property(nonatomic, copy) NSString* unlockHint;
+@end
+
+@implementation CrossDeskPrivacyCoverView
+- (BOOL)isOpaque { return YES; }
+- (BOOL)isFlipped { return YES; }
+- (void)drawRect:(NSRect)dirtyRect {
+  [NSColor.blackColor setFill];
+  NSRectFill(self.bounds);
+  const CGFloat width = NSWidth(self.bounds), height = NSHeight(self.bounds);
+  if (width <= 0 || height <= 0) return;
+  // Match the Windows cover's sizes, colors and bottom-left alignment.
+  // AppKit coordinates are points; Retina backing scale is applied by AppKit.
+  const CGFloat scale = std::min({CGFloat(1), width / 640, height / 200});
+  const CGFloat margin = 32 * scale, text_width = 398 * scale;
+  NSColor* foreground = [NSColor colorWithSRGBRed:245.0 / 255 green:247.0 / 255
+                                           blue:250.0 / 255 alpha:1];
+  NSColor* muted = [NSColor colorWithSRGBRed:181.0 / 255 green:190.0 / 255
+                                      blue:204.0 / 255 alpha:1];
+  NSAttributedString* brand = Text(@"CrossDesk", 14 * scale, NSFontWeightSemibold, foreground);
+  NSAttributedString* hint = Text(self.unlockHint, 16 * scale, NSFontWeightRegular, muted);
+  NSAttributedString* shortcut = Text(@"Control + Option + Shift + Esc", 24 * scale,
+                                      NSFontWeightSemibold, foreground);
+  const CGFloat logo_size = std::ceil(brand.size.width);
+  const CGFloat brand_height = TextHeight(brand, logo_size);
+  const CGFloat hint_height = TextHeight(hint, text_width);
+  const CGFloat shortcut_height = TextHeight(shortcut, text_width);
+  const CGFloat bottom = height - margin;
+  const CGFloat logo_top = bottom - brand_height - 6 * scale - logo_size;
+  [self.logo drawInRect:NSMakeRect(margin, logo_top, logo_size, logo_size)
+              fromRect:NSZeroRect operation:NSCompositingOperationSourceOver
+              fraction:1 respectFlipped:YES hints:@{NSImageHintInterpolation: @(NSImageInterpolationHigh)}];
+  [brand drawWithRect:NSMakeRect(margin, bottom - brand_height, logo_size, brand_height)
+             options:kTextOptions];
+  const CGFloat text_left = margin + logo_size + 24 * scale;
+  [hint drawWithRect:NSMakeRect(text_left, bottom - shortcut_height - 12 * scale - hint_height,
+                               text_width, hint_height) options:kTextOptions];
+  [shortcut drawWithRect:NSMakeRect(text_left, bottom - shortcut_height,
+                                   text_width, shortcut_height) options:kTextOptions];
+}
+@end
+
+namespace crossdesk {
+NSView* CreateMacPrivacyCoverView(NSRect frame, NSString* unlock_hint) {
+  NSImage* logo = LoadPrivacyLogo();
+  if (!logo) return nil;
+  auto* view = [[CrossDeskPrivacyCoverView alloc] initWithFrame:frame];
+  view.logo = logo;
+  view.unlockHint = unlock_hint ?: @"To turn off the privacy screen, press";
+  view.autoresizingMask = NSViewWidthSizable | NSViewHeightSizable;
+  return view;
+}
+}

apps/desktop/src/platform/macos/privacy/privacy_cursor_mac.h

@@ -0,0 +1,35 @@
+/*
+ * @Author: DI JUNKUN
+ * @Date: 2026-09-13
+ * Copyright (c) 2026 by DI JUNKUN, All Rights Reserved.
+ */
+
+#ifndef _PRIVACY_CURSOR_MAC_H_
+#define _PRIVACY_CURSOR_MAC_H_
+
+#include <memory>
+#include <cstdint>
+
+namespace crossdesk {
+// Main-thread resource. Hides only for the lifetime of a local privacy cover;
+// does not take focus, move the pointer, or suppress remote input.
+class MacPrivacyCursor {
+ public:
+  MacPrivacyCursor();
+  ~MacPrivacyCursor();
+  static bool Supported();
+  bool Prepare();
+  bool Hide();
+  bool Healthy() const;
+  uint32_t WindowId() const;
+  void Restore();
+ private:
+  struct Impl;
+  std::unique_ptr<Impl> impl_;
+};
+
+// Local hiding must not be reported as an invisible cursor to controllers.
+bool IsMacPrivacyCursorHidden();
+}
+
+#endif

apps/desktop/src/platform/macos/privacy/privacy_cursor_mac.mm

@@ -0,0 +1,157 @@
+/* Copyright (c) 2026 by DI JUNKUN, All Rights Reserved. */
+#include "privacy_cursor_mac.h"
+
+#import <AppKit/AppKit.h>
+#import <ApplicationServices/ApplicationServices.h>
+#include <atomic>
+#include <dlfcn.h>
+
+@interface CrossDeskPrivacyCursorPanel : NSPanel
+@end
+@implementation CrossDeskPrivacyCursorPanel
+- (BOOL)canBecomeKeyWindow { return NO; }
+- (BOOL)canBecomeMainWindow { return NO; }
+@end
+
+namespace crossdesk {
+namespace {
+std::atomic<bool> hidden_by_privacy{false};
+struct CursorApi {
+  using Connection = int (*)();
+  using Copy = CGError (*)(int, int, CFStringRef, CFTypeRef*);
+  using Set = CGError (*)(int, int, CFStringRef, CFTypeRef);
+  Connection connection = reinterpret_cast<Connection>(dlsym(RTLD_DEFAULT, "CGSMainConnectionID"));
+  Copy copy = reinterpret_cast<Copy>(dlsym(RTLD_DEFAULT, "CGSCopyConnectionProperty"));
+  Set set = reinterpret_cast<Set>(dlsym(RTLD_DEFAULT, "CGSSetConnectionProperty"));
+};
+const CursorApi& Api() { static const CursorApi api; return api; }
+CFStringRef const kBackgroundCursor = CFSTR("SetsCursorInBackground");
+}
+
+struct MacPrivacyCursor::Impl {
+  int connection = 0;
+  bool previous_background = false;
+  bool background_changed = false;
+  unsigned hide_count = 0;
+  unsigned visible_ticks = 0;
+  bool healthy = true;
+  NSTimer* __strong timer = nil;
+  CrossDeskPrivacyCursorPanel* __strong panel = nil;
+  NSImageView* __strong view = nil;
+
+  void UpdateImage() {
+#pragma clang diagnostic push
+#pragma clang diagnostic ignored "-Wdeprecated-declarations"
+    NSCursor* cursor = NSCursor.currentSystemCursor ?: NSCursor.arrowCursor;
+#pragma clang diagnostic pop
+    NSImage* image = cursor.image;
+    if (!image || image.size.width <= 0 || image.size.height <= 0) return;
+    const NSPoint point = NSEvent.mouseLocation;
+    const NSSize size = image.size;
+    [panel setFrame:NSMakeRect(point.x - cursor.hotSpot.x,
+        point.y - size.height + cursor.hotSpot.y, size.width, size.height) display:NO];
+    view.image = image;
+    [panel displayIfNeeded];
+  }
+
+  bool KeepHidden() {
+#pragma clang diagnostic push
+#pragma clang diagnostic ignored "-Wdeprecated-declarations"
+    if (hide_count && !CGCursorIsVisible()) { visible_ticks = 0; return true; }
+#pragma clang diagnostic pop
+    if (++visible_ticks > 6 ||
+        CGDisplayHideCursor(kCGDirectMainDisplay) != kCGErrorSuccess) return false;
+    ++hide_count;
+    return true;
+  }
+};
+
+MacPrivacyCursor::MacPrivacyCursor() : impl_(std::make_unique<Impl>()) {}
+MacPrivacyCursor::~MacPrivacyCursor() { Restore(); }
+bool MacPrivacyCursor::Supported() {
+  return Api().connection && Api().copy && Api().set;
+}
+bool MacPrivacyCursor::Prepare() {
+  if (impl_->panel) return true;
+  if (!Supported()) return false;
+  // A cursor sprite below the local cover is captured only for clients that
+  // request an embedded cursor. Desktop clients exclude it and use metadata.
+  impl_->panel = [[CrossDeskPrivacyCursorPanel alloc] initWithContentRect:NSMakeRect(0, 0, 32, 32)
+      styleMask:NSWindowStyleMaskBorderless | NSWindowStyleMaskNonactivatingPanel
+      backing:NSBackingStoreBuffered defer:NO];
+  auto* panel = impl_->panel;
+  panel.releasedWhenClosed = NO;
+  panel.hidesOnDeactivate = NO;
+  panel.opaque = NO;
+  panel.backgroundColor = NSColor.clearColor;
+  panel.hasShadow = NO;
+  panel.ignoresMouseEvents = YES;
+  panel.level = CGWindowLevelForKey(kCGScreenSaverWindowLevelKey);
+  panel.animationBehavior = NSWindowAnimationBehaviorNone;
+  panel.collectionBehavior = NSWindowCollectionBehaviorCanJoinAllSpaces |
+      NSWindowCollectionBehaviorFullScreenAuxiliary | NSWindowCollectionBehaviorStationary |
+      NSWindowCollectionBehaviorIgnoresCycle;
+  panel.sharingType = NSWindowSharingReadOnly;
+  impl_->view = [[NSImageView alloc] initWithFrame:panel.contentView.bounds];
+  impl_->view.imageScaling = NSImageScaleNone;
+  impl_->view.autoresizingMask = NSViewWidthSizable | NSViewHeightSizable;
+  panel.contentView = impl_->view;
+  panel.alphaValue = 0;
+  impl_->UpdateImage();
+  [panel orderFrontRegardless];
+  return panel != nil && panel.windowNumber > 0;
+}
+bool MacPrivacyCursor::Hide() {
+  if (impl_->timer) return true;
+  if (!Prepare()) return false;
+  impl_->connection = Api().connection();
+  impl_->previous_background = false;
+  CFTypeRef previous = nullptr;
+  if (Api().copy(impl_->connection, impl_->connection, kBackgroundCursor, &previous) == kCGErrorSuccess && previous)
+    impl_->previous_background = CFEqual(previous, kCFBooleanTrue);
+  if (previous) CFRelease(previous);
+  // This connection-scoped WindowServer property is also used by Deskflow.
+  // Resolve it dynamically: an unavailable API disables optional privacy only.
+  if (Api().set(impl_->connection, impl_->connection, kBackgroundCursor, kCFBooleanTrue) != kCGErrorSuccess)
+    return false;
+  impl_->background_changed = true;
+  impl_->healthy = true;
+  impl_->visible_ticks = 0;
+  hidden_by_privacy = true;
+  if (!impl_->KeepHidden()) { Restore(); return false; }
+  impl_->UpdateImage();
+  impl_->panel.alphaValue = 1;
+  auto* state = impl_.get();
+  impl_->timer = [NSTimer timerWithTimeInterval:1.0 / 60 repeats:YES block:^(NSTimer*) {
+    if (state->healthy) state->healthy = state->KeepHidden();
+    state->UpdateImage();
+  }];
+  [[NSRunLoop mainRunLoop] addTimer:impl_->timer forMode:NSRunLoopCommonModes];
+  return true;
+}
+bool MacPrivacyCursor::Healthy() const { return impl_->timer && impl_->healthy; }
+uint32_t MacPrivacyCursor::WindowId() const {
+  return impl_->panel ? static_cast<uint32_t>(impl_->panel.windowNumber) : 0;
+}
+void MacPrivacyCursor::Restore() {
+  [impl_->timer invalidate];
+  impl_->timer = nil;
+  [impl_->panel orderOut:nil];
+  [impl_->panel close];
+  impl_->panel = nil;
+  impl_->view = nil;
+  // Balance only our own successful hide calls, including re-hides after
+  // WindowServer changes cursor ownership when a remote click activates an app.
+  while (impl_->hide_count) {
+    CGDisplayShowCursor(kCGDirectMainDisplay);
+    --impl_->hide_count;
+  }
+  hidden_by_privacy = false;
+  if (impl_->background_changed) {
+    Api().set(impl_->connection, impl_->connection, kBackgroundCursor,
+              impl_->previous_background ? kCFBooleanTrue : kCFBooleanFalse);
+    impl_->background_changed = false;
+  }
+}
+bool IsMacPrivacyCursorHidden() { return hidden_by_privacy.load(); }
+}

apps/desktop/src/platform/macos/screen_capturer/screen_capturer_sck.cpp

@@ -7,6 +7,12 @@ namespace crossdesk {
 ScreenCapturerSck::ScreenCapturerSck() {}
 ScreenCapturerSck::~ScreenCapturerSck() {}
 
+void ScreenCapturerSck::SetPrivacyController(PrivacyController* privacy) {
+  privacy_ = privacy;
+  if (screen_capturer_sck_impl_)
+    screen_capturer_sck_impl_->SetPrivacyController(privacy);
+}
+
 int ScreenCapturerSck::Init(const int fps, cb_desktop_data cb) {
   if (cb) {
     on_data_ = cb;
@@ -16,6 +22,7 @@ int ScreenCapturerSck::Init(const int fps, cb_desktop_data cb) {
   }
 
   screen_capturer_sck_impl_ = CreateScreenCapturerSck();
+  screen_capturer_sck_impl_->SetPrivacyController(privacy_);
   const int ret = screen_capturer_sck_impl_->Init(fps, on_data_);
   if (ret != 0) {
     screen_capturer_sck_impl_.reset();

apps/desktop/src/platform/macos/screen_capturer/screen_capturer_sck.h

@@ -25,6 +25,7 @@ class ScreenCapturerSck : public ScreenCapturer {
 
  public:
   int Init(const int fps, cb_desktop_data cb) override;
+  void SetPrivacyController(PrivacyController* privacy) override;
   int Destroy() override;
   int Start(bool show_cursor) override;
   int Stop() override;
@@ -57,6 +58,7 @@ class ScreenCapturerSck : public ScreenCapturer {
 
  private:
   std::unique_ptr<ScreenCapturer> screen_capturer_sck_impl_;
+  PrivacyController* privacy_ = nullptr;
 };
 }  // namespace crossdesk
-#endif
+#endif

apps/desktop/src/platform/macos/screen_capturer/screen_capturer_sck_impl.mm

@@ -26,6 +26,9 @@
 #include "display_info.h"
 #include <display_stream_id.h>
 #include "rd_log.h"
+#include "privacy_controller.h"
+#include "../privacy/privacy_capture_state.h"
+#include <algorithm>
 
 using namespace crossdesk;
 
@@ -110,13 +113,18 @@ API_AVAILABLE(macos(14.0))
 
 - (instancetype)initWithCapturer:(ScreenCapturerSckImpl *)capturer;
 
-- (void)onShareableContentCreated:(SCShareableContent *)content;
+- (void)onShareableContentCreated:(SCShareableContent *)content generation:(uint64_t)generation
+                       revision:(uint64_t)revision;
 
 // Called just before the capturer is destroyed. This avoids a dangling pointer,
 // and prevents any new calls into a deleted capturer. If any method-call on the
 // capturer is currently running on a different thread, this blocks until it
 // completes.
 - (void)releaseCapturer;
+- (void)privacyCoversChanged:(NSNotification*)notification;
+- (void)configurationFinished:(SCStream*)stream generation:(uint64_t)generation
+                     revision:(uint64_t)revision complete:(BOOL)complete
+                configuration:(SCStreamConfiguration*)configuration error:(NSError*)error;
 @end
 
 class API_AVAILABLE(macos(14.0)) ScreenCapturerSckImpl : public ScreenCapturer {
@@ -129,6 +137,7 @@ class API_AVAILABLE(macos(14.0)) ScreenCapturerSckImpl : public ScreenCapturer {
 
  public:
   int Init(const int fps, cb_desktop_data cb) override;
+  void SetPrivacyController(PrivacyController* privacy) override { privacy_ = privacy; }
 
   int Start(bool show_cursor) override;
 
@@ -156,11 +165,30 @@ class API_AVAILABLE(macos(14.0)) ScreenCapturerSckImpl : public ScreenCapturer {
   bool capture_requested_ = false;
   bool invalid_stream_id_logged_ = false;
   bool native_output_logged_ = false;
+  PrivacyController* privacy_ = nullptr;
+  uint64_t configuration_generation_ = 0;
+  bool configuration_in_flight_ = false;
+  bool reconfigure_pending_ = false;
+  SCStreamConfiguration* __strong applied_configuration_ = nil;
 
  public:
   // Called by SckHelper when shareable content is returned by ScreenCaptureKit. `content` will be
   // nil if an error occurred. May run on an arbitrary thread.
-  void OnShareableContentCreated(SCShareableContent *content);
+  void OnShareableContentCreated(SCShareableContent *content, uint64_t generation,
+                                uint64_t revision);
+  void ConfigurationFinished(SCStream* source, uint64_t generation, uint64_t revision,
+                             bool complete, SCStreamConfiguration* configuration,
+                             NSError* error);
+  void RetryPrivacyFilter();
+  void PrivacyCoversChanged() { StartOrReconfigureCapturer(); }
+  void CaptureStopped(SCStream* source, NSError* error) {
+    {
+      std::lock_guard lock(lock_);
+      if (!capture_requested_ || source != stream_) return;
+    }
+    LOG_ERROR("ScreenCaptureKit stream stopped: {}", NSErrorToString(error));
+    if (privacy_) privacy_->Fail("ScreenCaptureKit stream stopped");
+  }
   // Called by SckHelper to notify of a newly captured frame. May run on an arbitrary thread.
   // void OnNewIOSurface(IOSurfaceRef io_surface, CFDictionaryRef attachment);
   void OnNewCVPixelBuffer(CVPixelBufferRef pixelBuffer, CFDictionaryRef attachment);
@@ -389,6 +417,7 @@ int ScreenCapturerSckImpl::Start(bool show_cursor) {
     capture_requested_ = true;
     invalid_stream_id_logged_ = false;
   }
+  if (privacy_) privacy_->CaptureChanged(true);
   StartOrReconfigureCapturer();
   return 0;
 }
@@ -446,6 +475,7 @@ int ScreenCapturerSckImpl::ResetToInitialMonitor() {
 }
 
 int ScreenCapturerSckImpl::Destroy() {
+  if (privacy_) privacy_->CaptureChanged(false);
   SckHelper *helper_to_release = nil;
   {
     std::lock_guard<std::mutex> lock(lock_);
@@ -455,6 +485,9 @@ int ScreenCapturerSckImpl::Destroy() {
       stream_ = nil;
     }
     capture_requested_ = false;
+    configuration_in_flight_ = reconfigure_pending_ = false;
+    applied_configuration_ = nil;
+    ++configuration_generation_;
     current_display_ = 0;
     current_stream_id_.clear();
     permanent_error_ = false;
@@ -469,8 +502,12 @@ int ScreenCapturerSckImpl::Destroy() {
 }
 
 int ScreenCapturerSckImpl::Stop() {
+  if (privacy_) privacy_->CaptureChanged(false);
   std::lock_guard<std::mutex> lock(lock_);
   capture_requested_ = false;
+  configuration_in_flight_ = reconfigure_pending_ = false;
+  applied_configuration_ = nil;
+  ++configuration_generation_;
   if (stream_) {
     LOG_INFO("Stopping stream");
     [stream_ stopCaptureWithCompletionHandler:nil];
@@ -481,24 +518,36 @@ int ScreenCapturerSckImpl::Stop() {
   return 0;
 }
 
-void ScreenCapturerSckImpl::OnShareableContentCreated(SCShareableContent *content) {
+void ScreenCapturerSckImpl::OnShareableContentCreated(SCShareableContent *content,
+                                                     uint64_t generation, uint64_t revision) {
   {
     std::lock_guard<std::mutex> lock(lock_);
-    if (!capture_requested_) {
+    if (!capture_requested_ || generation != configuration_generation_) {
       LOG_INFO("Ignoring stale ScreenCaptureKit display refresh after stop");
       return;
     }
   }
 
+  // The window list belongs to the privacy revision present when the request
+  // was issued. A newer cover must be enumerated by a new request.
+  if (GetMacPrivacyCaptureState().revision != revision) {
+    StartOrReconfigureCapturer();
+    return;
+  }
+
   if (!content) {
     LOG_ERROR("getShareableContent failed");
-    permanent_error_ = true;
+    if (privacy_) privacy_->Fail("Could not refresh ScreenCaptureKit privacy content");
+    std::lock_guard lock(lock_);
+    if (!stream_) permanent_error_ = true;
     return;
   }
 
   if (!content.displays || content.displays.count == 0) {
     LOG_ERROR("getShareableContent returned no displays");
-    permanent_error_ = true;
+    if (privacy_) privacy_->Fail("No shareable displays available for privacy");
+    std::lock_guard lock(lock_);
+    if (!stream_) permanent_error_ = true;
     return;
   }
 
@@ -506,7 +555,7 @@ void ScreenCapturerSckImpl::OnShareableContentCreated(SCShareableContent *conten
   bool show_cursor = false;
   {
     std::lock_guard<std::mutex> lock(lock_);
-    if (!capture_requested_) return;
+    if (!capture_requested_ || generation != configuration_generation_) return;
 
     int logical_index = current_monitor_index_;
     if (logical_index < 0 ||
@@ -576,8 +625,40 @@ void ScreenCapturerSckImpl::OnShareableContentCreated(SCShareableContent *conten
     return;
   }
 
+  const auto privacy_capture = GetMacPrivacyCaptureState();
+  // The cursor sprite is included only when this stream embeds the cursor.
+  // Other controllers receive the unchanged cursor metadata separately.
+  auto excluded_ids = privacy_capture.excluded_windows;
+  if (!show_cursor && privacy_capture.cursor_window)
+    excluded_ids.push_back(privacy_capture.cursor_window);
+  NSMutableArray<SCWindow*>* excluded = [NSMutableArray array];
+  for (SCWindow* window in content.windows) {
+    if (std::find(excluded_ids.begin(), excluded_ids.end(), window.windowID) != excluded_ids.end())
+      [excluded addObject:window];
+  }
+  // Newly registered transparent covers may need another enumeration. Never
+  // acknowledge a partial exclusion or remove an active cover's filter.
+  const bool privacy_filter_complete = excluded.count == excluded_ids.size();
+  LOG_INFO("macOS privacy filter: generation={}, revision={}, requested={}, excluded={}",
+           generation, privacy_capture.revision, excluded_ids.size(),
+           excluded.count);
+  if (!privacy_filter_complete) {
+    bool have_stream;
+    { std::lock_guard lock(lock_); have_stream = stream_ != nil; }
+    if (privacy_capture.applied_revision == privacy_capture.revision) {
+      if (privacy_) privacy_->Fail("ScreenCaptureKit could not enumerate every privacy cover");
+      return; // Preserve the existing exclusion until recovery removes covers.
+    }
+    if (have_stream) {
+      RetryPrivacyFilter();
+      return; // Transparent covers are still being registered by WindowServer.
+    }
+    // Start ordinary capture even if a newly created, still-transparent cover
+    // is not enumerable yet. Retry exclusion after start; never acknowledge it.
+    [excluded removeAllObjects];
+  }
   SCContentFilter *filter = [[SCContentFilter alloc] initWithDisplay:captured_display
-                                                    excludingWindows:@[]];
+                                                    excludingWindows:excluded];
   if (!filter) {
     LOG_ERROR("Failed to create SCContentFilter");
     permanent_error_ = true;
@@ -598,13 +679,39 @@ void ScreenCapturerSckImpl::OnShareableContentCreated(SCShareableContent *conten
   config.captureResolution = SCCaptureResolutionAutomatic;
   config.minimumFrameInterval = CMTimeMake(1, fps_);
 
-  std::lock_guard<std::mutex> lock(lock_);
-  if (!capture_requested_) return;
+  std::unique_lock<std::mutex> lock(lock_);
+  if (!capture_requested_ || generation != configuration_generation_) return;
+  if (configuration_in_flight_) { reconfigure_pending_ = true; return; }
+  if (GetMacPrivacyCaptureState().revision != revision) {
+    lock.unlock();
+    RetryPrivacyFilter();
+    return;
+  }
+  configuration_in_flight_ = true;
 
   if (stream_) {
-    LOG_INFO("Updating stream configuration");
-    [stream_ updateContentFilter:filter completionHandler:nil];
-    [stream_ updateConfiguration:config completionHandler:nil];
+    SckHelper* helper = helper_;
+    SCStream* source = stream_;
+    auto finished = ^(NSError* error) {
+      [helper configurationFinished:source generation:generation revision:revision
+                            complete:privacy_filter_complete configuration:config error:error];
+    };
+    // Apply configuration before its filter and acknowledge the final update.
+    // Privacy-only toggles do not need a configuration change.
+    const bool same_config = applied_configuration_ &&
+        applied_configuration_.width == config.width &&
+        applied_configuration_.height == config.height &&
+        applied_configuration_.showsCursor == config.showsCursor &&
+        applied_configuration_.pixelFormat == config.pixelFormat &&
+        CMTimeCompare(applied_configuration_.minimumFrameInterval, config.minimumFrameInterval) == 0;
+    if (same_config) {
+      [source updateContentFilter:filter completionHandler:finished];
+    } else {
+      [source updateConfiguration:config completionHandler:^(NSError* error) {
+        if (error) finished(error);
+        else [source updateContentFilter:filter completionHandler:finished];
+      }];
+    }
   } else {
     stream_ = [[SCStream alloc] initWithFilter:filter configuration:config delegate:helper_];
 
@@ -618,28 +725,62 @@ void ScreenCapturerSckImpl::OnShareableContentCreated(SCShareableContent *conten
                                                        error:&add_stream_output_error];
 
     if (!add_stream_output_result) {
+      configuration_in_flight_ = false;
       stream_ = nil;
       LOG_ERROR("addStreamOutput failed: {}", NSErrorToString(add_stream_output_error));
       permanent_error_ = true;
       return;
     }
 
+    SckHelper* helper = helper_;
+    SCStream* source = stream_;
     auto handler = ^(NSError *error) {
-      if (error) {
-        // It should be safe to access `this` here, because the C++ destructor
-        // calls stopCaptureWithCompletionHandler on the stream, which cancels
-        // this handler.
-        permanent_error_ = true;
-        LOG_ERROR("startCaptureWithCompletionHandler failed: {}", NSErrorToString(error));
-      } else {
-        LOG_INFO("Capture started");
-      }
+      [helper configurationFinished:source generation:generation revision:revision
+                            complete:privacy_filter_complete configuration:config error:error];
     };
 
     [stream_ startCaptureWithCompletionHandler:handler];
   }
 }
 
+void ScreenCapturerSckImpl::RetryPrivacyFilter() {
+  SckHelper* helper;
+  {
+    std::lock_guard lock(lock_);
+    if (!capture_requested_) return;
+    helper = helper_;
+  }
+  // The retained helper safely ignores this callback after Destroy().
+  dispatch_after(dispatch_time(DISPATCH_TIME_NOW, 50 * NSEC_PER_MSEC),
+                 dispatch_get_main_queue(), ^{ [helper privacyCoversChanged:nil]; });
+}
+
+void ScreenCapturerSckImpl::ConfigurationFinished(SCStream* source, uint64_t generation,
+                                                  uint64_t revision, bool complete,
+                                                  SCStreamConfiguration* configuration,
+                                                  NSError* error) {
+  bool refresh = false;
+  {
+    std::lock_guard lock(lock_);
+    if (!capture_requested_ || source != stream_) return;
+    configuration_in_flight_ = false;
+    const auto current = GetMacPrivacyCaptureState();
+    refresh = reconfigure_pending_ || current.revision != revision;
+    reconfigure_pending_ = false;
+    if (!error) {
+      applied_configuration_ = configuration;
+      if (complete && !refresh && generation == configuration_generation_)
+        AcknowledgeMacPrivacyCapture(revision);
+      refresh = refresh || !complete;
+    }
+    LOG_INFO("macOS privacy filter completed: generation={}, revision={}, complete={}, refresh={}, error={}",
+             generation, revision, complete, refresh, NSErrorToString(error));
+  }
+  if (error && privacy_)
+    privacy_->Fail("ScreenCaptureKit privacy filter: " + NSErrorToString(error));
+  if (refresh) RetryPrivacyFilter();
+}
+
 void ScreenCapturerSckImpl::OnNewCVPixelBuffer(CVPixelBufferRef pixelBuffer,
                                                CFDictionaryRef attachment) {
   (void)attachment;
@@ -727,7 +868,18 @@ void ScreenCapturerSckImpl::StartOrReconfigureCapturer() {
     }
   }
 
-  SckHelper *local_helper = helper_;
+  SckHelper *local_helper;
+  uint64_t generation;
+  uint64_t revision;
+  {
+    std::lock_guard lock(lock_);
+    if (!capture_requested_) return;
+    if (configuration_in_flight_) { reconfigure_pending_ = true; return; }
+    reconfigure_pending_ = false;
+    local_helper = helper_;
+    generation = ++configuration_generation_;
+    revision = GetMacPrivacyCaptureState().revision;
+  }
   if (!local_helper) {
     LOG_ERROR("Cannot reconfigure capturer: helper is null");
     return;
@@ -736,12 +888,14 @@ void ScreenCapturerSckImpl::StartOrReconfigureCapturer() {
   auto handler = ^(SCShareableContent *content, NSError *error) {
     if (error) {
       LOG_ERROR("getShareableContent failed: {}", NSErrorToString(error));
-      [local_helper onShareableContentCreated:nil];
+      [local_helper onShareableContentCreated:nil generation:generation revision:revision];
       return;
     }
-    [local_helper onShareableContentCreated:content];
+    [local_helper onShareableContentCreated:content generation:generation revision:revision];
   };
-  [SCShareableContent getShareableContentWithCompletionHandler:handler];
+  [SCShareableContent getShareableContentExcludingDesktopWindows:NO
+                                           onScreenWindowsOnly:NO
+                                             completionHandler:handler];
 }
 
 @implementation SckHelper {
@@ -755,14 +909,28 @@ void ScreenCapturerSckImpl::StartOrReconfigureCapturer() {
   self = [super init];
   if (self) {
     _capturer = capturer;
+    [NSNotificationCenter.defaultCenter addObserver:self selector:@selector(privacyCoversChanged:)
+        name:@"CrossDeskPrivacyCoversChanged" object:nil];
   }
   return self;
 }
 
-- (void)onShareableContentCreated:(SCShareableContent *)content {
+- (void)privacyCoversChanged:(NSNotification*)notification {
+  std::lock_guard<std::mutex> lock(_capturer_lock);
+  if (_capturer) _capturer->PrivacyCoversChanged();
+}
+- (void)configurationFinished:(SCStream*)stream generation:(uint64_t)generation
+                     revision:(uint64_t)revision complete:(BOOL)complete
+                configuration:(SCStreamConfiguration*)configuration error:(NSError*)error {
+  std::lock_guard<std::mutex> lock(_capturer_lock);
+  if (_capturer)
+    _capturer->ConfigurationFinished(stream, generation, revision, complete, configuration, error);
+}
+- (void)onShareableContentCreated:(SCShareableContent *)content generation:(uint64_t)generation
+                       revision:(uint64_t)revision {
   std::lock_guard<std::mutex> lock(_capturer_lock);
   if (_capturer) {
-    _capturer->OnShareableContentCreated(content);
+    _capturer->OnShareableContentCreated(content, generation, revision);
   } else {
     LOG_ERROR("Invalid capturer");
   }
@@ -797,10 +965,16 @@ void ScreenCapturerSckImpl::StartOrReconfigureCapturer() {
 }
 
 - (void)releaseCapturer {
+  [NSNotificationCenter.defaultCenter removeObserver:self];
   std::lock_guard<std::mutex> lock(_capturer_lock);
   _capturer = nullptr;
 }
 
+- (void)stream:(SCStream*)stream didStopWithError:(NSError*)error {
+  std::lock_guard<std::mutex> lock(_capturer_lock);
+  if (_capturer) _capturer->CaptureStopped(stream, error);
+}
+
 @end
 
 std::unique_ptr<ScreenCapturer> ScreenCapturerSck::CreateScreenCapturerSck() {

apps/desktop/src/platform/windows/gui/runtime/windows_service_runtime.cpp

@@ -114,6 +114,9 @@ void GuiRuntime::HandleWindowsServiceIntegration() {
 
   bool force_broadcast = false;
   if (pending_windows_service_sas_.exchange(false, std::memory_order_relaxed)) {
+    if (privacy_.Engaged()) {
+      privacy_.Fail("Security shortcut requested; privacy screen will turn off");
+    }
     const std::string response =
         QueryCrossDeskService("sas", kWindowsServiceSasTimeoutMs);
     auto json = nlohmann::json::parse(response, nullptr, false);

apps/desktop/src/platform/windows/input/mouse/mouse_controller.cpp

@@ -1,16 +1,20 @@
 #include "mouse_controller.h"
 
+#include <Windows.h>
 #include <remote_action.h>
 
-#include <Windows.h>
+#include <algorithm>
+#include <cmath>
 
+#include "../../windows_thread_dpi.h"
 #include "rd_log.h"
+#include "windows_input_marker.h"
 
 namespace crossdesk {
 
 PlatformMouseController::PlatformMouseController() {}
 
-PlatformMouseController::~PlatformMouseController() {}
+PlatformMouseController::~PlatformMouseController() { Destroy(); }
 
 int PlatformMouseController::Init(std::vector<DisplayInfo> display_info_list) {
   display_info_list_ = display_info_list;
@@ -18,10 +22,27 @@ int PlatformMouseController::Init(std::vector<DisplayInfo> display_info_list) {
   return 0;
 }
 
-int PlatformMouseController::Destroy() { return 0; }
+int PlatformMouseController::Destroy() { return ReleasePressedButtons(); }
+
+int PlatformMouseController::ReleasePressedButtons() {
+  const unsigned pressed = pressed_buttons_.load();
+  if (!pressed) return 0;
+  INPUT input{};
+  input.type = INPUT_MOUSE;
+  input.mi.dwExtraInfo = kInjectedMouseInputMarker;
+  if (pressed & 1) input.mi.dwFlags |= MOUSEEVENTF_LEFTUP;
+  if (pressed & 2) input.mi.dwFlags |= MOUSEEVENTF_RIGHTUP;
+  if (pressed & 4) input.mi.dwFlags |= MOUSEEVENTF_MIDDLEUP;
+  if (SendInput(1, &input, sizeof(INPUT)) != 1) {
+    LOG_WARN("Release remote mouse buttons failed, error={}", GetLastError());
+    return -1;
+  }
+  pressed_buttons_.fetch_and(~pressed);
+  return 0;
+}
 
 int PlatformMouseController::SendMouseCommand(RemoteAction remote_action,
-                                      int display_index) {
+                                              int display_index) {
   if (display_index < 0 ||
       display_index >= static_cast<int>(display_info_list_.size())) {
     LOG_WARN("Mouse command skipped, invalid display_index={}, displays={}",
@@ -30,69 +51,83 @@ int PlatformMouseController::SendMouseCommand(RemoteAction remote_action,
   }
 
   INPUT ip = {0};
+  ScopedWindowsPhysicalCoordinates physical_coordinates;
 
-  if (remote_action.type == ControlType::mouse) {
-    ip.type = INPUT_MOUSE;
-    ip.mi.dx =
-        (LONG)(remote_action.m.x * display_info_list_[display_index].width) +
-        display_info_list_[display_index].left;
-    ip.mi.dy =
-        (LONG)(remote_action.m.y * display_info_list_[display_index].height) +
-        display_info_list_[display_index].top;
+  if (remote_action.type != ControlType::mouse) return 0;
+  if (!std::isfinite(remote_action.m.x) || !std::isfinite(remote_action.m.y))
+    return -1;
+  ip.type = INPUT_MOUSE;
+  ip.mi.dx = (LONG)(std::clamp(remote_action.m.x, 0.0f, 1.0f) *
+                    (display_info_list_[display_index].width - 1)) +
+             display_info_list_[display_index].left;
+  ip.mi.dy = (LONG)(std::clamp(remote_action.m.y, 0.0f, 1.0f) *
+                    (display_info_list_[display_index].height - 1)) +
+             display_info_list_[display_index].top;
 
-    switch (remote_action.m.flag) {
-      case MouseFlag::left_down:
-        ip.mi.dwFlags = MOUSEEVENTF_LEFTDOWN | MOUSEEVENTF_ABSOLUTE;
-        break;
-      case MouseFlag::left_up:
-        ip.mi.dwFlags = MOUSEEVENTF_LEFTUP | MOUSEEVENTF_ABSOLUTE;
-        break;
-      case MouseFlag::right_down:
-        ip.mi.dwFlags = MOUSEEVENTF_RIGHTDOWN | MOUSEEVENTF_ABSOLUTE;
-        break;
-      case MouseFlag::right_up:
-        ip.mi.dwFlags = MOUSEEVENTF_RIGHTUP | MOUSEEVENTF_ABSOLUTE;
-        break;
-      case MouseFlag::middle_down:
-        ip.mi.dwFlags = MOUSEEVENTF_MIDDLEDOWN | MOUSEEVENTF_ABSOLUTE;
-        break;
-      case MouseFlag::middle_up:
-        ip.mi.dwFlags = MOUSEEVENTF_MIDDLEUP | MOUSEEVENTF_ABSOLUTE;
-        break;
-      case MouseFlag::wheel_vertical:
-        ip.mi.dwFlags = MOUSEEVENTF_WHEEL;
-        ip.mi.mouseData = remote_action.m.s * 120;
-        break;
-      case MouseFlag::wheel_horizontal:
-        ip.mi.dwFlags = MOUSEEVENTF_HWHEEL;
-        ip.mi.mouseData = remote_action.m.s * 120;
-        break;
-      default:
-        ip.mi.dwFlags = MOUSEEVENTF_MOVE;
-        break;
-    }
-
-    ip.mi.time = 0;
-
-    if (!SetCursorPos(ip.mi.dx, ip.mi.dy)) {
-      LOG_WARN("SetCursorPos failed for mouse x={}, y={}, flag={}, err={}",
-               ip.mi.dx, ip.mi.dy, static_cast<int>(remote_action.m.flag),
-               GetLastError());
-      return -1;
-    }
-
-    if (ip.mi.dwFlags != MOUSEEVENTF_MOVE) {
-      UINT sent = SendInput(1, &ip, sizeof(INPUT));
-      if (sent != 1) {
-        LOG_WARN(
-            "SendInput failed for mouse x={}, y={}, wheel={}, flag={}, err={}",
-            ip.mi.dx, ip.mi.dy, remote_action.m.s,
-            static_cast<int>(remote_action.m.flag), GetLastError());
-        return -1;
-      }
-    }
+  switch (remote_action.m.flag) {
+    case MouseFlag::left_down:
+      ip.mi.dwFlags = MOUSEEVENTF_LEFTDOWN;
+      break;
+    case MouseFlag::left_up:
+      ip.mi.dwFlags = MOUSEEVENTF_LEFTUP;
+      break;
+    case MouseFlag::right_down:
+      ip.mi.dwFlags = MOUSEEVENTF_RIGHTDOWN;
+      break;
+    case MouseFlag::right_up:
+      ip.mi.dwFlags = MOUSEEVENTF_RIGHTUP;
+      break;
+    case MouseFlag::middle_down:
+      ip.mi.dwFlags = MOUSEEVENTF_MIDDLEDOWN;
+      break;
+    case MouseFlag::middle_up:
+      ip.mi.dwFlags = MOUSEEVENTF_MIDDLEUP;
+      break;
+    case MouseFlag::wheel_vertical:
+      ip.mi.dwFlags = MOUSEEVENTF_WHEEL;
+      ip.mi.mouseData = remote_action.m.s * 120;
+      break;
+    case MouseFlag::wheel_horizontal:
+      ip.mi.dwFlags = MOUSEEVENTF_HWHEEL;
+      ip.mi.mouseData = remote_action.m.s * 120;
+      break;
+    default:
+      break;
   }
 
+  const int virtual_left = GetSystemMetrics(SM_XVIRTUALSCREEN);
+  const int virtual_top = GetSystemMetrics(SM_YVIRTUALSCREEN);
+  const int virtual_width = GetSystemMetrics(SM_CXVIRTUALSCREEN);
+  const int virtual_height = GetSystemMetrics(SM_CYVIRTUALSCREEN);
+  if (virtual_width <= 0 || virtual_height <= 0) {
+    LOG_WARN("Remote mouse skipped: invalid virtual desktop geometry");
+    return -1;
+  }
+  // Pixel centres in the virtual desktop, including negative monitor origins.
+  // SetCursorPos cannot carry dwExtraInfo through the privacy mouse hook.
+  ip.mi.dx = static_cast<LONG>(
+      (static_cast<int64_t>(ip.mi.dx - virtual_left) * 65536 + 32768) /
+      virtual_width);
+  ip.mi.dy = static_cast<LONG>(
+      (static_cast<int64_t>(ip.mi.dy - virtual_top) * 65536 + 32768) /
+      virtual_height);
+  ip.mi.dwFlags |=
+      MOUSEEVENTF_MOVE | MOUSEEVENTF_ABSOLUTE | MOUSEEVENTF_VIRTUALDESK;
+  ip.mi.dwExtraInfo = kInjectedMouseInputMarker;
+  const UINT sent = SendInput(1, &ip, sizeof(INPUT));
+  if (sent != 1) {
+    LOG_WARN("SendInput failed for mouse x={}, y={}, wheel={}, flag={}, err={}",
+             ip.mi.dx, ip.mi.dy, remote_action.m.s,
+             static_cast<int>(remote_action.m.flag), GetLastError());
+    return -1;
+  }
+  if (ip.mi.dwFlags & MOUSEEVENTF_LEFTDOWN) pressed_buttons_.fetch_or(1);
+  if (ip.mi.dwFlags & MOUSEEVENTF_RIGHTDOWN) pressed_buttons_.fetch_or(2);
+  if (ip.mi.dwFlags & MOUSEEVENTF_MIDDLEDOWN) pressed_buttons_.fetch_or(4);
+  if (ip.mi.dwFlags & MOUSEEVENTF_LEFTUP) pressed_buttons_.fetch_and(~1u);
+  if (ip.mi.dwFlags & MOUSEEVENTF_RIGHTUP) pressed_buttons_.fetch_and(~2u);
+  if (ip.mi.dwFlags & MOUSEEVENTF_MIDDLEUP) pressed_buttons_.fetch_and(~4u);
+
   return 0;
 }
 }  // namespace crossdesk

apps/desktop/src/platform/windows/input/mouse/mouse_controller.h

@@ -8,6 +8,7 @@
 #define _MOUSE_CONTROLLER_H_
 
 #include <vector>
+#include <atomic>
 
 #include <remote_action.h>
 
@@ -25,9 +26,11 @@ class PlatformMouseController final : public MouseController {
   virtual int Init(std::vector<DisplayInfo> display_info_list);
   virtual int Destroy();
   virtual int SendMouseCommand(RemoteAction remote_action, int display_index);
+  int ReleasePressedButtons();
 
  private:
   std::vector<DisplayInfo> display_info_list_;
+  std::atomic<unsigned> pressed_buttons_{0};
 };
 }  // namespace crossdesk
 #endif

apps/desktop/src/platform/windows/input/windows_input_marker.h

@@ -9,6 +9,7 @@ namespace crossdesk {
 // keyboard input so the controller hook can ignore only its own injections
 // while still accepting input from accessibility tools or remote sessions.
 inline constexpr std::uintptr_t kInjectedKeyboardInputMarker = 0x4353444B;
+inline constexpr std::uintptr_t kInjectedMouseInputMarker = 0x4353444D;
 
 }  // namespace crossdesk
 

apps/desktop/src/platform/windows/privacy/band_module/main.cpp

@@ -0,0 +1,293 @@
+/*
+ * @Author: DI JUNKUN
+ * @Date: 2026-09-10
+ * Copyright (c) 2026 by DI JUNKUN, All Rights Reserved.
+ */
+
+#include <Windows.h>
+#include <dwmapi.h>
+
+#include <algorithm>
+#include <array>
+#include <cwchar>
+#include <vector>
+
+#include "../../windows_thread_dpi.h"
+#include "../privacy_band_ipc.h"
+#include "privacy_cover_renderer.h"
+
+namespace {
+using namespace crossdesk;
+constexpr wchar_t kWindowClass[] = L"CrossDesk.HighBandPrivacy";
+constexpr DWORD kCoverStyles = WS_EX_TOPMOST | WS_EX_NOACTIVATE |
+                               WS_EX_TOOLWINDOW | WS_EX_LAYERED |
+                               WS_EX_TRANSPARENT;
+HMODULE module = nullptr;
+
+bool SameRect(const RECT& a, const RECT& b) {
+  return a.left == b.left && a.top == b.top && a.right == b.right &&
+         a.bottom == b.bottom;
+}
+
+class Windows {
+ public:
+  explicit Windows(PrivacyBandShared* shared) : shared_(shared) {}
+  ~Windows() {
+    for (const auto& window : windows_)
+      DestroyWindow(reinterpret_cast<HWND>(window.hwnd));
+    if (atom_) UnregisterClassW(kWindowClass, module);
+  }
+  bool Fail(const wchar_t* operation, DWORD code = GetLastError()) {
+    wcsncpy_s(shared_->operation, operation, _TRUNCATE);
+    InterlockedExchange(&shared_->error, code ? code : ERROR_GEN_FAILURE);
+    return false;
+  }
+  bool Initialize() {
+    const HMODULE user = GetModuleHandleW(L"user32.dll");
+    create_ = reinterpret_cast<CreatePrivacyWindowInBand>(
+        GetProcAddress(user, "CreateWindowInBand"));
+    get_band_ = reinterpret_cast<GetPrivacyWindowBand>(
+        GetProcAddress(user, "GetWindowBand"));
+    if (!create_ || !get_band_)
+      return Fail(L"Resolve high-band APIs", ERROR_PROC_NOT_FOUND);
+    WNDCLASSEXW cls{sizeof(cls)};
+    cls.hInstance = module;
+    cls.lpfnWndProc = WindowProc;
+    cls.lpszClassName = kWindowClass;
+    cls.hbrBackground = static_cast<HBRUSH>(GetStockObject(BLACK_BRUSH));
+    atom_ = RegisterClassExW(&cls);
+    return atom_ ? Reconcile() : Fail(L"Register high-band window class");
+  }
+  bool Reconcile() {
+    std::vector<RECT> monitors;
+    if (!EnumDisplayMonitors(
+            nullptr, nullptr,
+            [](HMONITOR, HDC, LPRECT rect, LPARAM data) -> BOOL {
+              auto& result = *reinterpret_cast<std::vector<RECT>*>(data);
+              if (result.size() >= kPrivacyMaxMonitors) return FALSE;
+              result.push_back(*rect);
+              return TRUE;
+            },
+            reinterpret_cast<LPARAM>(&monitors)) ||
+        monitors.empty())
+      return Fail(L"Enumerate high-band displays");
+    bool changed = monitors.size() != windows_.size();
+    for (const auto& rect : monitors) {
+      const auto found =
+          std::find_if(windows_.begin(), windows_.end(),
+                       [&](const auto& w) { return SameRect(w.rect, rect); });
+      if (found != windows_.end()) continue;
+      changed = true;
+      HWND hwnd = create_(kCoverStyles, atom_, L"CrossDesk Privacy", WS_POPUP,
+                          rect.left, rect.top, rect.right - rect.left,
+                          rect.bottom - rect.top, nullptr, nullptr, module,
+                          this, kPrivacyWindowBand);
+      if (!hwnd) return Fail(L"CreateWindowInBand ZBID_ABOVELOCK_UX");
+      windows_.push_back({reinterpret_cast<uint64_t>(hwnd), rect});
+      if (!SetLayeredWindowAttributes(hwnd, 0, 255, LWA_ALPHA))
+        return Fail(L"Make high-band cover opaque");
+      if (!SetWindowDisplayAffinity(hwnd, 0x11))
+        return Fail(L"Exclude high-band cover from capture");
+      const BOOL yes = TRUE;
+      const HRESULT peek = DwmSetWindowAttribute(hwnd, DWMWA_EXCLUDED_FROM_PEEK,
+                                                 &yes, sizeof(yes));
+      if (FAILED(peek)) return Fail(L"Exclude high-band cover from Peek", peek);
+      if (!SetWindowPos(hwnd, nullptr, rect.left, rect.top,
+                        rect.right - rect.left, rect.bottom - rect.top,
+                        SWP_NOZORDER | SWP_NOACTIVATE | SWP_SHOWWINDOW) ||
+          !RedrawWindow(hwnd, nullptr, nullptr, RDW_INVALIDATE | RDW_UPDATENOW))
+        return Fail(L"Present high-band cover");
+    }
+    if (changed) {
+      const HRESULT result = DwmFlush();
+      if (FAILED(result))
+        return Fail(L"Flush high-band cover presentation", result);
+      // New areas are covered before old windows are removed.
+      for (auto it = windows_.begin(); it != windows_.end();) {
+        if (std::none_of(
+                monitors.begin(), monitors.end(),
+                [&](const auto& rect) { return SameRect(rect, it->rect); })) {
+          if (!DestroyWindow(reinterpret_cast<HWND>(it->hwnd)))
+            return Fail(L"Destroy obsolete high-band cover");
+          it = windows_.erase(it);
+        } else
+          ++it;
+      }
+    }
+    if (!Validate()) return false;
+    if (changed) {
+      InterlockedIncrement(&shared_->sequence);
+      shared_->count = static_cast<uint32_t>(windows_.size());
+      std::copy(windows_.begin(), windows_.end(), shared_->windows);
+      InterlockedIncrement(&shared_->sequence);
+    }
+    return true;
+  }
+  bool Validate() {
+    if (paint_failed_) return false;
+    for (const auto& w : windows_) {
+      HWND hwnd = reinterpret_cast<HWND>(w.hwnd);
+      DWORD band = 0, affinity = 0, flags = 0, cloaked = 0;
+      BYTE alpha = 0;
+      RECT rect{};
+      if ((GetWindowLongPtrW(hwnd, GWL_EXSTYLE) & kCoverStyles) !=
+              kCoverStyles ||
+          !get_band_(hwnd, &band) || band != kPrivacyWindowBand ||
+          !GetWindowDisplayAffinity(hwnd, &affinity) || affinity != 0x11 ||
+          !GetLayeredWindowAttributes(hwnd, nullptr, &alpha, &flags) ||
+          alpha != 255 || flags != LWA_ALPHA || !IsWindowVisible(hwnd) ||
+          !GetWindowRect(hwnd, &rect) || !SameRect(rect, w.rect) ||
+          FAILED(DwmGetWindowAttribute(hwnd, DWMWA_CLOAKED, &cloaked,
+                                       sizeof(cloaked))) ||
+          cloaked)
+        return Fail(L"High-band cover lost style/band/affinity/visibility",
+                    ERROR_INVALID_STATE);
+    }
+    return true;
+  }
+  bool changed = false;
+
+ private:
+  static LRESULT CALLBACK WindowProc(HWND hwnd, UINT message, WPARAM wp,
+                                     LPARAM lp) {
+    if (message == WM_NCCREATE) {
+      auto create = reinterpret_cast<CREATESTRUCTW*>(lp);
+      SetWindowLongPtrW(hwnd, GWLP_USERDATA,
+                        reinterpret_cast<LONG_PTR>(create->lpCreateParams));
+    }
+    auto self =
+        reinterpret_cast<Windows*>(GetWindowLongPtrW(hwnd, GWLP_USERDATA));
+    if (message == WM_MOUSEACTIVATE) return MA_NOACTIVATE;
+    if (message == WM_NCHITTEST) return HTTRANSPARENT;
+    if (message == WM_SETCURSOR) {
+      SetCursor(nullptr);
+      return TRUE;
+    }
+    if (message == WM_CLOSE) return 0;
+    if ((message == WM_DISPLAYCHANGE || message == WM_DPICHANGED) && self) {
+      self->changed = true;
+      InvalidateRect(hwnd, nullptr, TRUE);
+      return 0;
+    }
+    if (message == WM_PAINT) {
+      PAINTSTRUCT paint{};
+      HDC dc = BeginPaint(hwnd, &paint);
+      RECT rect{};
+      GetClientRect(hwnd, &rect);
+      if (self && !DrawPrivacyCover(dc, rect, PrivacyWindowDpi(hwnd), module,
+                                    self->shared_->unlock_hint)) {
+        self->paint_failed_ = true;
+        self->Fail(L"Paint privacy logo and unlock instructions");
+      }
+      EndPaint(hwnd, &paint);
+      return 0;
+    }
+    return DefWindowProcW(hwnd, message, wp, lp);
+  }
+  PrivacyBandShared* shared_;
+  bool paint_failed_ = false;
+  std::vector<PrivacyBandWindow> windows_;
+  ATOM atom_ = 0;
+  CreatePrivacyWindowInBand create_ = nullptr;
+  GetPrivacyWindowBand get_band_ = nullptr;
+};
+
+DWORD WINAPI Run(void*) {
+  wchar_t bootstrap[256]{};
+  if (!GetEnvironmentVariableW(kPrivacyBandBootstrap, bootstrap, 256))
+    return ERROR_INVALID_PARAMETER;
+  SetEnvironmentVariableW(kPrivacyBandBootstrap, nullptr);
+  std::array<HANDLE, 4> handles{};
+  wchar_t* item = bootstrap;
+  for (size_t i = 0; i < handles.size(); ++i) {
+    wchar_t* end = nullptr;
+    const auto value = wcstoull(item, &end, 10);
+    if (!value || end == item ||
+        (i + 1 == handles.size() ? *end != 0 : *end != L','))
+      return ERROR_INVALID_PARAMETER;
+    handles[i] = reinterpret_cast<HANDLE>(value);
+    item = end + 1;
+  }
+  HANDLE parent = handles[0], stop = handles[1], ready = handles[2],
+         mapping = handles[3];
+  auto shared = static_cast<PrivacyBandShared*>(MapViewOfFile(
+      mapping, FILE_MAP_ALL_ACCESS, 0, 0, sizeof(PrivacyBandShared)));
+  if (!shared) return GetLastError();
+  if (shared->magic != kPrivacyBandMagic ||
+      shared->version != kPrivacyBandVersion ||
+      shared->size != sizeof(PrivacyBandShared) ||
+      shared->broker_pid != GetCurrentProcessId() ||
+      shared->parent_pid != GetProcessId(parent) ||
+      WaitForSingleObject(parent, 0) != WAIT_TIMEOUT) {
+    UnmapViewOfFile(shared);
+    return ERROR_INVALID_DATA;
+  }
+  DWORD exit_code = ERROR_SUCCESS;
+  {
+    ScopedWindowsPhysicalCoordinates dpi;
+    Windows windows(shared);
+    try {
+      bool healthy = dpi.active() && windows.Initialize();
+      const bool initialized = healthy;
+      if (!dpi.active()) windows.Fail(L"Set high-band thread DPI context");
+      InterlockedExchange64(&shared->heartbeat, GetTickCount64());
+      if (healthy) {
+        InterlockedExchange(&shared->error, ERROR_SUCCESS);
+        InterlockedExchange(&shared->active, 1);
+      }
+      SetEvent(ready);
+      auto last_check = GetTickCount64();
+      HANDLE watched[] = {parent, stop};
+      // Once enabled, retain surviving covers on a validation/layout fault.
+      // The parent pauses the session after reading the latched error. Only
+      // an explicit stop or parent death tears the remaining windows down.
+      while (initialized) {
+        const DWORD wait = MsgWaitForMultipleObjectsEx(
+            2, watched, 100, QS_ALLINPUT, MWMO_INPUTAVAILABLE);
+        if (wait == WAIT_OBJECT_0 || wait == WAIT_OBJECT_0 + 1) break;
+        if (wait == WAIT_FAILED) {
+          windows.Fail(L"Wait for high-band lifecycle");
+          break;
+        }
+        MSG message{};
+        while (PeekMessageW(&message, nullptr, 0, 0, PM_REMOVE)) {
+          if (message.message == WM_QUIT) healthy = false;
+          TranslateMessage(&message);
+          DispatchMessageW(&message);
+        }
+        const auto now = GetTickCount64();
+        if (healthy && (windows.changed || now - last_check >= 250)) {
+          windows.changed = false;
+          last_check = now;
+          healthy = windows.Reconcile();
+        }
+        InterlockedExchange64(&shared->heartbeat, now);
+      }
+    } catch (...) {
+      windows.Fail(L"High-band window thread exception",
+                   ERROR_UNHANDLED_EXCEPTION);
+      SetEvent(ready);
+    }
+    exit_code = InterlockedCompareExchange(&shared->error, 0, 0);
+    InterlockedExchange(&shared->active, 0);
+  }
+  UnmapViewOfFile(shared);
+  for (HANDLE handle : handles) CloseHandle(handle);
+  // This module runs only in the dedicated process created for this session.
+  // Exit outside DllMain/loader lock, after HWND destruction on their UI
+  // thread.
+  ExitProcess(exit_code);
+  return exit_code;
+}
+}  // namespace
+
+BOOL WINAPI DllMain(HINSTANCE instance, DWORD reason, LPVOID) {
+  if (reason == DLL_PROCESS_ATTACH) {
+    module = instance;
+    // Keep thread notifications enabled: this module uses the static CRT.
+    HANDLE thread = CreateThread(nullptr, 0, Run, nullptr, 0, nullptr);
+    if (!thread) return FALSE;
+    CloseHandle(thread);
+  }
+  return TRUE;
+}

apps/desktop/src/platform/windows/privacy/band_module/privacy_cover_renderer.cpp

@@ -0,0 +1,123 @@
+/*
+ * @Author: DI JUNKUN
+ * @Date: 2026-09-11
+ * Copyright (c) 2026 by DI JUNKUN, All Rights Reserved.
+ */
+
+#include "privacy_cover_renderer.h"
+
+#include <algorithm>
+#include <array>
+
+namespace crossdesk {
+namespace {
+
+constexpr size_t kInstructionLines = 2;
+constexpr size_t kBrandLine = kInstructionLines;
+
+struct PaintResources {
+  HDC dc;
+  int saved;
+  HICON logo = nullptr;
+  std::array<HFONT, kInstructionLines + 1> fonts{};
+  ~PaintResources() {
+    // Deselect every owned GDI object before releasing it.
+    if (saved) RestoreDC(dc, saved);
+    for (auto font : fonts)
+      if (font) DeleteObject(font);
+    if (logo) DestroyIcon(logo);
+  }
+};
+
+bool Select(HDC dc, HGDIOBJ object) {
+  const auto previous = SelectObject(dc, object);
+  return previous && previous != HGDI_ERROR;
+}
+
+}  // namespace
+
+bool DrawPrivacyCover(HDC dc, const RECT& rect, UINT dpi, HINSTANCE module,
+                      const wchar_t* unlock_hint) {
+  if (!FillRect(dc, &rect, static_cast<HBRUSH>(GetStockObject(BLACK_BRUSH))))
+    return false;
+  const int width = rect.right - rect.left;
+  const int height = rect.bottom - rect.top;
+  if (width <= 0 || height <= 0) return false;
+  // Scale with the monitor DPI, shrinking the whole group on small displays.
+  // All coordinates remain in the owning window's physical-pixel context.
+  const double scale = (std::min)({dpi / 96.0, width / 640.0, height / 200.0});
+  const auto px = [scale](int value) {
+    return (std::max)(1, static_cast<int>(value * scale + 0.5));
+  };
+  const int margin = px(32);
+  const int text_width = px(398);
+  PaintResources resources{dc, SaveDC(dc)};
+  if (!resources.saved || !SetBkMode(dc, TRANSPARENT)) return false;
+
+  struct Line {
+    const wchar_t* text;
+    int size;
+    int weight;
+    COLORREF color;
+    RECT bounds{};
+  };
+  std::array<Line, kInstructionLines + 1> lines{{
+      {unlock_hint, 16, FW_NORMAL, RGB(181, 190, 204)},
+      {L"Ctrl + Alt + Shift + F12", 24, FW_SEMIBOLD, RGB(245, 247, 250)},
+      {L"CrossDesk", 14, FW_SEMIBOLD, RGB(245, 247, 250)},
+  }};
+  constexpr UINT flags = DT_LEFT | DT_WORDBREAK | DT_NOPREFIX;
+  for (size_t i = 0; i < lines.size(); ++i) {
+    auto& line = lines[i];
+    resources.fonts[i] =
+        CreateFontW(-px(line.size), 0, 0, 0, line.weight, FALSE, FALSE, FALSE,
+                    DEFAULT_CHARSET, OUT_DEFAULT_PRECIS, CLIP_DEFAULT_PRECIS,
+                    ANTIALIASED_QUALITY, DEFAULT_PITCH, L"Microsoft YaHei UI");
+    if (!resources.fonts[i] || !Select(dc, resources.fonts[i])) return false;
+    line.bounds = {0, 0, text_width, 0};
+    if (!DrawTextW(dc, line.text, -1, &line.bounds, flags | DT_CALCRECT) ||
+        line.bounds.right > text_width)
+      return false;
+  }
+  const int content_height =
+      static_cast<int>(lines[0].bounds.bottom + lines[1].bounds.bottom) +
+      px(12);
+  // Match the icon width to the name; each side keeps its own height.
+  const int brand_gap = px(6);
+  const int brand_width = static_cast<int>(lines[kBrandLine].bounds.right);
+  const int logo_size = brand_width;
+  const int brand_height =
+      logo_size + brand_gap + static_cast<int>(lines[kBrandLine].bounds.bottom);
+  if (logo_size <= 0 ||
+      (std::max)(brand_height, content_height) + 2 * margin > height ||
+      brand_width + px(24) + text_width + 2 * margin > width)
+    return false;
+  resources.logo = static_cast<HICON>(LoadImageW(
+      module, L"IDI_CROSSDESK_LOGO", IMAGE_ICON, logo_size, logo_size, 0));
+  if (!resources.logo) return false;
+  const int brand_left = rect.left + margin;
+  const int left = brand_left + brand_width + px(24);
+  const int brand_top = rect.bottom - margin - brand_height;
+  int top = rect.bottom - margin - content_height;
+  if (!DrawIconEx(dc, brand_left, brand_top, resources.logo, logo_size,
+                  logo_size, 0, nullptr, DI_NORMAL))
+    return false;
+  if (!Select(dc, resources.fonts[kBrandLine])) return false;
+  RECT brand_bounds{brand_left, brand_top + logo_size + brand_gap,
+                    brand_left + brand_width, rect.bottom - margin};
+  SetTextColor(dc, lines[kBrandLine].color);
+  if (!DrawTextW(dc, lines[kBrandLine].text, -1, &brand_bounds,
+                 DT_CENTER | DT_SINGLELINE | DT_NOPREFIX))
+    return false;
+  for (size_t i = 0; i < kInstructionLines; ++i) {
+    const auto& line = lines[i];
+    if (!Select(dc, resources.fonts[i])) return false;
+    RECT bounds{left, top, left + text_width, top + line.bounds.bottom};
+    SetTextColor(dc, line.color);
+    if (!DrawTextW(dc, line.text, -1, &bounds, flags)) return false;
+    top += line.bounds.bottom + px(12);
+  }
+  return true;
+}
+
+}  // namespace crossdesk

apps/desktop/src/platform/windows/privacy/band_module/privacy_cover_renderer.h

@@ -0,0 +1,20 @@
+/*
+ * @Author: DI JUNKUN
+ * @Date: 2026-09-11
+ * Copyright (c) 2026 by DI JUNKUN, All Rights Reserved.
+ */
+
+#ifndef _PRIVACY_COVER_RENDERER_H_
+#define _PRIVACY_COVER_RENDERER_H_
+
+#include <Windows.h>
+
+namespace crossdesk {
+
+// Paints the local, opaque cover. The caller owns the HWND and its DPI context.
+bool DrawPrivacyCover(HDC dc, const RECT& rect, UINT dpi, HINSTANCE module,
+                      const wchar_t* unlock_hint);
+
+}  // namespace crossdesk
+
+#endif  // _PRIVACY_COVER_RENDERER_H_

apps/desktop/src/platform/windows/privacy/cursor_helper/main.cpp

@@ -0,0 +1,83 @@
+/*
+ * @Author: DI JUNKUN
+ * @Date: 2026-09-11
+ * Copyright (c) 2026 by DI JUNKUN, All Rights Reserved.
+ */
+
+#include <Windows.h>
+
+#include <cerrno>
+#include <cstdint>
+#include <cwchar>
+#include <limits>
+
+#include "../privacy_cursor_api.h"
+
+namespace {
+HANDLE ParseHandle(const wchar_t* text) {
+  wchar_t* end = nullptr;
+  errno = 0;
+  const auto value = std::wcstoull(text, &end, 10);
+  if (errno || !text[0] || *end || text[0] == L'-' || value == 0 ||
+      value > (std::numeric_limits<uintptr_t>::max)())
+    return nullptr;
+  return reinterpret_cast<HANDLE>(static_cast<uintptr_t>(value));
+}
+DWORD FailureCode() {
+  const DWORD code = GetLastError();
+  return code ? code : ERROR_GEN_FAILURE;
+}
+}  // namespace
+
+int wmain(int argc, wchar_t** argv) {
+  if (argc != 5) return ERROR_INVALID_PARAMETER;
+  HANDLE parent = ParseHandle(argv[1]);
+  HANDLE stop = ParseHandle(argv[2]);
+  HANDLE ready = ParseHandle(argv[3]);
+  HANDLE mapping = ParseHandle(argv[4]);
+  // Observe the inherited process OBJECT, never a reused PID or a process name.
+  if (!parent || !stop || !ready || !mapping ||
+      WaitForSingleObject(parent, 0) != WAIT_TIMEOUT ||
+      WaitForSingleObject(stop, 0) != WAIT_TIMEOUT)
+    return ERROR_INVALID_HANDLE;
+  auto shared = static_cast<crossdesk::PrivacyCursorReady*>(MapViewOfFile(
+      mapping, FILE_MAP_WRITE, 0, 0, sizeof(crossdesk::PrivacyCursorReady)));
+  if (!shared) return static_cast<int>(FailureCode());
+
+  crossdesk::PrivacyCursorApi cursor;
+  DWORD error = ERROR_SUCCESS;
+  if (!cursor.Initialize() || !cursor.Hide()) error = FailureCode();
+  InterlockedExchange(&shared->error, static_cast<LONG>(error));
+  if (!SetEvent(ready)) error = FailureCode();
+  if (!error) {
+    HANDLE watched[] = {parent, stop};
+    for (;;) {
+      const DWORD result =
+          MsgWaitForMultipleObjects(2, watched, FALSE, 250, QS_ALLINPUT);
+      if (result == WAIT_OBJECT_0 || result == WAIT_OBJECT_0 + 1) break;
+      if (result == WAIT_OBJECT_0 + 2) {
+        MSG message{};
+        while (PeekMessageW(&message, nullptr, 0, 0, PM_REMOVE)) {
+          TranslateMessage(&message);
+          DispatchMessageW(&message);
+        }
+      } else if (result != WAIT_TIMEOUT) {
+        error = FailureCode();
+        break;
+      }
+      if (!cursor.Hide()) {
+        error = FailureCode();
+        break;
+      }
+    }
+  }
+  // Also runs when the parent is force-terminated or crashes. The helper does
+  // not own any input hooks or privacy HWNDs and never changes magnification.
+  if (!cursor.RestoreAndClose()) error = FailureCode();
+  UnmapViewOfFile(shared);
+  CloseHandle(mapping);
+  CloseHandle(ready);
+  CloseHandle(stop);
+  CloseHandle(parent);
+  return static_cast<int>(error);
+}

apps/desktop/src/platform/windows/privacy/privacy_backend_win.cpp

@@ -0,0 +1,573 @@
+/*
+ * @Author: DI JUNKUN
+ * @Date: 2026-09-11
+ * Copyright (c) 2026 by DI JUNKUN, All Rights Reserved.
+ */
+
+#include <ShlObj.h>
+#include <Windows.h>
+#include <dwmapi.h>
+#include <winternl.h>
+#include <wtsapi32.h>
+
+#include <algorithm>
+#include <vector>
+
+#include "../windows_thread_dpi.h"
+#include "privacy_backend.h"
+#include "privacy_band_guard.h"
+#include "privacy_cursor_guard.h"
+#include "privacy_input_guard.h"
+#include "privacy_window_visibility.h"
+#include "rd_log.h"
+
+#ifndef WDA_EXCLUDEFROMCAPTURE
+#define WDA_EXCLUDEFROMCAPTURE 0x00000011
+#endif
+
+namespace crossdesk {
+namespace {
+
+constexpr wchar_t kClassName[] = L"CrossDesk.PrivacyWindow";
+constexpr UINT kEmergency = WM_APP + 71;
+constexpr int kHotkeyId = 0x4353;
+
+std::string Error(const char* operation, DWORD code = GetLastError()) {
+  const std::string result = std::string(operation) +
+                             " failed (Windows error " + std::to_string(code) +
+                             ")";
+  LOG_ERROR("Privacy: {}", result);
+  return result;
+}
+
+bool DesktopName(HDESK desktop, wchar_t (&name)[256]) {
+  DWORD needed = 0;
+  return desktop && GetUserObjectInformationW(desktop, UOI_NAME, name,
+                                              sizeof(name), &needed);
+}
+
+bool SameRect(const RECT& a, const RECT& b) {
+  return a.left == b.left && a.top == b.top && a.right == b.right &&
+         a.bottom == b.bottom;
+}
+
+struct MonitorEnumeration {
+  std::vector<RECT> rects;
+  bool ok = true;
+};
+
+BOOL CALLBACK EnumMonitor(HMONITOR monitor, HDC, LPRECT, LPARAM data) {
+  auto& result = *reinterpret_cast<MonitorEnumeration*>(data);
+  MONITORINFO info{sizeof(info)};
+  if (!GetMonitorInfoW(monitor, &info)) {
+    Error("GetMonitorInfoW");
+    result.ok = false;
+    return FALSE;
+  }
+  result.rects.push_back(info.rcMonitor);
+  return TRUE;
+}
+
+class WindowsPrivacyBackend final : public PrivacyBackend {
+ public:
+  WindowsPrivacyBackend() {
+    wake_event_ = CreateEventW(nullptr, FALSE, FALSE, nullptr);
+    if (!wake_event_) wake_error_ = Error("CreateEventW privacy commands");
+  }
+
+  ~WindowsPrivacyBackend() override {
+    Recover();
+    if (sink_) DestroyWindow(sink_);
+    if (registered_) UnregisterClassW(kClassName, GetModuleHandleW(nullptr));
+    if (wake_event_) CloseHandle(wake_event_);
+  }
+
+  PrivacyCapabilities Query() override {
+    if (!wake_event_) return {false, false, wake_error_};
+    using RtlGetVersionFn = LONG(WINAPI*)(PRTL_OSVERSIONINFOW);
+    const auto rtl = reinterpret_cast<RtlGetVersionFn>(
+        GetProcAddress(GetModuleHandleW(L"ntdll.dll"), "RtlGetVersion"));
+    RTL_OSVERSIONINFOW version{};
+    version.dwOSVersionInfoSize = sizeof(version);
+    if (!rtl || rtl(&version) != 0 || version.dwMajorVersion < 10 ||
+        version.dwBuildNumber < 19041) {
+      return {false, false, "Requires Windows 10 2004 (build 19041) or later"};
+    }
+    BOOL composed = FALSE;
+    if (FAILED(DwmIsCompositionEnabled(&composed)) || !composed) {
+      return {false, false, "Desktop composition is unavailable"};
+    }
+    if (GetSystemMetrics(SM_REMOTESESSION)) {
+      return {false, false, "Privacy screen requires a local console session"};
+    }
+    if (!IsWindowsPrivacyDesktopAvailable()) {
+      return {false, false,
+              "Privacy screen requires the unlocked Default desktop"};
+    }
+    QUERY_USER_NOTIFICATION_STATE shell_state{};
+    if (FAILED(SHQueryUserNotificationState(&shell_state)) ||
+        shell_state == QUNS_RUNNING_D3D_FULL_SCREEN) {
+      return {false, false,
+              "Exclusive fullscreen or unknown display presentation cannot "
+              "guarantee privacy coverage"};
+    }
+    std::string high_band_error;
+    if (!PrivacyBandGuard::Available(high_band_error))
+      return {false, false, high_band_error};
+    return {true, true,
+            "High-band privacy screen available"};
+  }
+
+  bool Enable(bool block_input, const PrivacyScreenText& text,
+              std::string& error) override {
+    const auto caps = Query();
+    if (!caps.overlay) {
+      error = caps.reason;
+      return false;
+    }
+    if (!Initialize(error)) return false;
+    emergency_ = false;
+    health_error_.clear();
+    if (!RegisterHotKey(sink_, kHotkeyId,
+                        MOD_CONTROL | MOD_ALT | MOD_SHIFT | MOD_NOREPEAT,
+                        VK_F12)) {
+      error = Error("RegisterHotKey Ctrl+Alt+Shift+F12");
+      return false;
+    }
+    hotkey_ = true;
+    if (!cursor_guard_.Start(error)) return false;
+    block_input_ = block_input;
+    if (block_input && !input_guard_.Start(sink_, kEmergency, error))
+      return false;
+    if (!band_guard_.Start(text, error)) return false;
+    if (!ReconcileMonitors(error)) return false;
+    event_owner_ = this;
+    for (DWORD event : {EVENT_OBJECT_SHOW, EVENT_OBJECT_REORDER,
+                        EVENT_OBJECT_LOCATIONCHANGE}) {
+      auto hook = SetWinEventHook(event, event, nullptr, WindowEvent, 0, 0,
+                                  WINEVENT_OUTOFCONTEXT);
+      if (!hook) {
+        error = Error("Watch privacy window coverage changes");
+        return false;
+      }
+      window_events_.push_back(hook);
+    }
+    return true;
+  }
+
+  void Recover() override {
+    for (auto& hook : window_events_) {
+      if (UnhookWinEvent(hook))
+        hook = nullptr;
+      else
+        Error("Unhook privacy window events");
+    }
+    window_events_.erase(
+        std::remove(window_events_.begin(), window_events_.end(), nullptr),
+        window_events_.end());
+    if (window_events_.empty()) event_owner_ = nullptr;
+    std::string band_error;
+    band_guard_.Stop(band_error);
+    if (band_guard_.stopped()) windows_.clear();
+    input_guard_.Stop();
+    block_input_ = false;
+    if (hotkey_) {
+      if (UnregisterHotKey(sink_, kHotkeyId) ||
+          GetLastError() == ERROR_HOTKEY_NOT_REGISTERED)
+        hotkey_ = false;
+      else
+        Error("UnregisterHotKey");
+    }
+    // The sink lives across sessions. Do not let an already-posted emergency
+    // command from a closed session cancel a subsequent connection.
+    if (sink_) {
+      MSG discarded{};
+      while (PeekMessageW(&discarded, sink_, WM_HOTKEY, WM_HOTKEY, PM_REMOVE)) {
+      }
+      while (
+          PeekMessageW(&discarded, sink_, kEmergency, kEmergency, PM_REMOVE)) {
+      }
+    }
+    last_check_ = 0;
+    last_health_ = {};
+    last_obstruction_ = nullptr;
+    last_obstruction_log_ = 0;
+    layout_changed_ = false;
+    coverage_dirty_ = false;
+    emergency_ = false;
+    health_error_.clear();
+    std::string cursor_error;
+    cursor_guard_.Stop(cursor_error);
+  }
+
+  bool IsRecovered() const override {
+    return band_guard_.stopped() && windows_.empty() &&
+           window_events_.empty() && input_guard_.stopped() && !hotkey_ &&
+           cursor_guard_.stopped();
+  }
+
+  void Wake() override {
+    if (wake_event_) SetEvent(wake_event_);
+  }
+
+  void WaitForEvents(unsigned timeout_ms) override {
+    const DWORD result = MsgWaitForMultipleObjectsEx(
+        wake_event_ ? 1 : 0, wake_event_ ? &wake_event_ : nullptr, timeout_ms,
+        QS_ALLINPUT, MWMO_INPUTAVAILABLE);
+    if (result == WAIT_FAILED)
+      health_error_ = Error("MsgWaitForMultipleObjectsEx privacy thread");
+  }
+
+  PrivacyHealth Poll() override {
+    MSG message{};
+    while (PeekMessageW(&message, nullptr, 0, 0, PM_REMOVE)) {
+      if (message.message == WM_QUIT)
+        health_error_ =
+            "Privacy message thread is exiting";
+      TranslateMessage(&message);
+      DispatchMessageW(&message);
+    }
+    if (emergency_) {
+      emergency_ = false;
+      return {{}, true};
+    }
+    if (block_input_) {
+      std::string error;
+      if (!input_guard_.Healthy(error)) return {error, false};
+    }
+    if (windows_.empty()) return {health_error_, false};
+    // Input messages wake the thread immediately; expensive health queries
+    // must retain their own cadence instead of running once per input event.
+    if (!layout_changed_ &&
+        GetTickCount64() - last_check_ < 100) {
+      if (coverage_dirty_ && last_health_.failure.empty()) {
+        coverage_dirty_ = false;
+        last_health_ = CheckCoverage();
+      }
+      return last_health_;
+    }
+    coverage_dirty_ = false;
+    last_check_ = GetTickCount64();
+    last_health_ = CheckHealth();
+    return last_health_;
+  }
+
+ private:
+  PrivacyHealth CheckHealth() {
+    if (!health_error_.empty()) return {health_error_, false};
+    if (!band_guard_.Healthy(health_error_)) return {health_error_, false};
+    if (!IsWindowsPrivacyDesktopAvailable()) {
+      std::string cursor_error;
+      cursor_guard_.Stop(cursor_error);
+      return {
+          "Secure desktop, lock screen or unavailable input desktop; "
+          "privacy screen will turn off",
+          false};
+    }
+    std::string cursor_error;
+    if (!cursor_guard_.Healthy(cursor_error)) return {cursor_error, false};
+    QUERY_USER_NOTIFICATION_STATE shell_state{};
+    if (FAILED(SHQueryUserNotificationState(&shell_state)) ||
+        shell_state == QUNS_RUNNING_D3D_FULL_SCREEN) {
+      return {
+          "Exclusive fullscreen or unknown display presentation",
+          false};
+    }
+    MonitorEnumeration monitors;
+    if (!EnumDisplayMonitors(nullptr, nullptr, EnumMonitor,
+                             reinterpret_cast<LPARAM>(&monitors)) ||
+        !monitors.ok) {
+      return {Error("EnumDisplayMonitors"), false};
+    }
+    const bool changed =
+        monitors.rects.size() != windows_.size() ||
+        std::any_of(monitors.rects.begin(), monitors.rects.end(),
+                    [this](const RECT& rect) {
+                      return std::none_of(windows_.begin(), windows_.end(),
+                                          [&](const auto& w) {
+                                            return SameRect(w.rect, rect);
+                                          });
+                    });
+    if (changed || layout_changed_) {
+      layout_changed_ = false;
+      // Retain old covers until the monitor check completes, then release
+      // privacy so capture can refresh its display mapping independently.
+      std::string error;
+      if (!ReconcileMonitors(error))
+        health_error_ = error;
+      else
+        health_error_ =
+            "Display layout/DPI changed; privacy screen will turn off";
+    }
+    if (!health_error_.empty()) return {health_error_, false};
+    BOOL composed = FALSE;
+    if (FAILED(DwmIsCompositionEnabled(&composed)) || !composed) {
+      return {
+          "Desktop composition stopped; privacy coverage cannot be guaranteed",
+          false};
+    }
+    return CheckCoverage();
+  }
+
+  PrivacyHealth CheckCoverage() {
+    const auto get_band = reinterpret_cast<GetPrivacyWindowBand>(
+        GetProcAddress(GetModuleHandleW(L"user32.dll"), "GetWindowBand"));
+    if (!get_band) return {"High-band window API became unavailable", false};
+    for (const auto& w : windows_) {
+      DWORD band = 0;
+      DWORD affinity = 0;
+      BYTE alpha = 0;
+      DWORD layered_flags = 0;
+      RECT rect{};
+      DWORD cloaked = 0;
+      if (!get_band(w.cover, &band) || band != kPrivacyWindowBand ||
+          !IsWindowVisible(w.cover) || !GetWindowRect(w.cover, &rect) ||
+          !SameRect(rect, w.rect) ||
+          !(GetWindowLongPtrW(w.cover, GWL_EXSTYLE) & WS_EX_TOPMOST) ||
+          !GetLayeredWindowAttributes(w.cover, nullptr, &alpha,
+                                      &layered_flags) ||
+          alpha != 255 || layered_flags != LWA_ALPHA ||
+          !GetWindowDisplayAffinity(w.cover, &affinity) ||
+          affinity != WDA_EXCLUDEFROMCAPTURE ||
+          FAILED(DwmGetWindowAttribute(w.cover, DWMWA_CLOAKED, &cloaked,
+                                       sizeof(cloaked))) ||
+          cloaked) {
+        return {
+            "Privacy window visibility, geometry or capture affinity was lost",
+            false};
+      }
+    }
+    for (const auto& w : windows_) {
+      // Detect windows in special bands above the cover. A high-band window
+      // still cannot cover another desktop or guarantee exclusive fullscreen.
+      for (HWND above = GetWindow(w.cover, GW_HWNDPREV); above;
+           above = GetWindow(above, GW_HWNDPREV)) {
+        if (!IsWindowVisible(above) || IsIconic(above)) continue;
+        DWORD above_band = 0;
+        if (!get_band(above, &above_band))
+          return {"Could not inspect a window above the high-band cover",
+                  false};
+        // HWND list order alone does not express compositor band order.
+        // Only skip the two known ordinary desktop bands, never unknown bands.
+        if (above_band == 0 || above_band == 1) continue;
+        if (std::any_of(windows_.begin(), windows_.end(),
+                        [above](const auto& own) {
+                          return above == own.cover;
+                        }))
+          continue;
+        RECT bounds{}, intersection{};
+        DWORD hidden = 0;
+        if (SUCCEEDED(DwmGetWindowAttribute(above, DWMWA_CLOAKED, &hidden,
+                                            sizeof(hidden))) &&
+            hidden)
+          continue;
+        if (GetWindowRect(above, &bounds) &&
+            IntersectRect(&intersection, &bounds, &w.rect)) {
+          if (IsNonObstructingPrivacyWindow(above, bounds)) continue;
+          char window_class[128]{};
+          DWORD process_id = 0;
+          GetClassNameA(above, window_class, sizeof(window_class));
+          GetWindowThreadProcessId(above, &process_id);
+          const auto now = GetTickCount64();
+          if (above != last_obstruction_ ||
+              now - last_obstruction_log_ >= 1000) {
+            LOG_WARN(
+                "Potential privacy cover overlap: class={}, process={}, "
+                "band={}, bounds=({}, {})-({}, {}), exstyle=0x{:x}",
+                window_class, process_id, above_band, bounds.left, bounds.top,
+                bounds.right, bounds.bottom,
+                GetWindowLongPtrW(above, GWL_EXSTYLE));
+            last_obstruction_ = above;
+            last_obstruction_log_ = now;
+          }
+          // HWND order cannot prove compositor order, but this window may
+          // display content. Report failure so optional privacy is released.
+          return {
+              "A visible window may overlap privacy coverage",
+              false};
+        }
+      }
+    }
+    return {health_error_, false};
+  }
+
+  struct Window {
+    RECT rect{};
+    HWND cover = nullptr;
+  };
+
+  bool Initialize(std::string& error) {
+    if (sink_) return true;
+    // This dedicated thread owns no existing application windows. Never alter
+    // process-wide or Slint/SDL DPI awareness.
+    if (!dpi_scope_ || !dpi_scope_->active()) {
+      dpi_scope_.reset();
+      dpi_scope_ = std::make_unique<ScopedWindowsPhysicalCoordinates>();
+    }
+    if (!dpi_scope_->active()) {
+      error = Error("SetThreadDpiAwarenessContext");
+      return false;
+    }
+    WNDCLASSEXW cls{sizeof(cls)};
+    cls.lpfnWndProc = WindowProc;
+    cls.hInstance = GetModuleHandleW(nullptr);
+    cls.lpszClassName = kClassName;
+    cls.hCursor = nullptr;
+    cls.hbrBackground = static_cast<HBRUSH>(GetStockObject(BLACK_BRUSH));
+    if (!registered_ && !RegisterClassExW(&cls)) {
+      error = Error("RegisterClassExW");
+      return false;
+    }
+    registered_ = true;
+    sink_ = CreateWindowExW(WS_EX_TOOLWINDOW | WS_EX_NOACTIVATE, kClassName,
+                            L"", WS_POPUP, 0, 0, 0, 0, nullptr, nullptr,
+                            cls.hInstance, this);
+    if (!sink_) {
+      error = Error("CreateWindowExW message sink");
+      return false;
+    }
+    return true;
+  }
+
+  bool ReconcileMonitors(std::string& error) {
+    MonitorEnumeration monitors;
+    if (!EnumDisplayMonitors(nullptr, nullptr, EnumMonitor,
+                             reinterpret_cast<LPARAM>(&monitors)) ||
+        !monitors.ok || monitors.rects.empty()) {
+      error = Error("EnumDisplayMonitors");
+      return false;
+    }
+    std::vector<PrivacyBandWindow> covers;
+    if (!band_guard_.Windows(covers, error)) return false;
+    for (const RECT& rect : monitors.rects) {
+      auto existing =
+          std::find_if(windows_.begin(), windows_.end(),
+                       [&](const auto& w) { return SameRect(w.rect, rect); });
+      if (existing != windows_.end()) continue;
+      const auto cover = std::find_if(covers.begin(), covers.end(),
+                                      [&](const auto& candidate) {
+                                        return SameRect(candidate.rect, rect);
+                                      });
+      if (cover == covers.end()) {
+        error = "High-band broker has not covered every physical monitor";
+        return false;
+      }
+      windows_.push_back({rect, reinterpret_cast<HWND>(cover->hwnd)});
+      LOG_INFO(
+          "Privacy high-band cover ready: bounds=({}, {})-({}, {}), "
+          "affinity=0x11, alpha=255",
+          rect.left, rect.top, rect.right, rect.bottom);
+    }
+    // Cover windows are owned and released by the broker.
+    windows_.erase(std::remove_if(windows_.begin(), windows_.end(),
+        [&](const auto& window) {
+          return std::none_of(monitors.rects.begin(), monitors.rects.end(),
+              [&](const RECT& rect) { return SameRect(window.rect, rect); });
+        }), windows_.end());
+    return true;
+  }
+
+  static LRESULT CALLBACK WindowProc(HWND hwnd, UINT msg, WPARAM wp,
+                                     LPARAM lp) {
+    if (msg == WM_NCCREATE) {
+      const auto create = reinterpret_cast<CREATESTRUCTW*>(lp);
+      SetWindowLongPtrW(hwnd, GWLP_USERDATA,
+                        reinterpret_cast<LONG_PTR>(create->lpCreateParams));
+    }
+    auto self = reinterpret_cast<WindowsPrivacyBackend*>(
+        GetWindowLongPtrW(hwnd, GWLP_USERDATA));
+    if (msg == WM_HOTKEY || msg == kEmergency) {
+      if (self && hwnd == self->sink_) self->emergency_ = true;
+      return 0;
+    }
+    if (msg == WM_MOUSEACTIVATE) return MA_NOACTIVATE;
+    if (msg == WM_SETCURSOR) {
+      SetCursor(nullptr);
+      return TRUE;
+    }
+    if (msg == WM_NCHITTEST) return HTTRANSPARENT;
+    if (msg == WM_CLOSE) return 0;
+    if ((msg == WM_DISPLAYCHANGE || msg == WM_DPICHANGED) && self) {
+      self->layout_changed_ = true;
+      return 0;
+    }
+    return DefWindowProcW(hwnd, msg, wp, lp);
+  }
+
+  static void CALLBACK WindowEvent(HWINEVENTHOOK, DWORD, HWND hwnd, LONG object,
+                                   LONG child, DWORD, DWORD) {
+    auto self = event_owner_;
+    if (!self || !hwnd || object != OBJID_WINDOW || child != CHILDID_SELF ||
+        hwnd == self->sink_ || GetAncestor(hwnd, GA_ROOT) != hwnd)
+      return;
+    for (const auto& w : self->windows_)
+      if (hwnd == w.cover) return;
+    // OUTOFCONTEXT delivers on this window thread. Only mark work here;
+    // monitor/session queries and Z-order changes remain in the control loop.
+    const auto get_band = reinterpret_cast<GetPrivacyWindowBand>(
+        GetProcAddress(GetModuleHandleW(L"user32.dll"), "GetWindowBand"));
+    DWORD band = 0;
+    if (get_band && get_band(hwnd, &band) && (band == 0 || band == 1)) return;
+    self->coverage_dirty_ = true;
+  }
+
+  inline static thread_local WindowsPrivacyBackend* event_owner_ = nullptr;
+  std::vector<HWINEVENTHOOK> window_events_;
+  std::vector<Window> windows_;
+  HWND sink_ = nullptr;
+  HANDLE wake_event_ = nullptr;
+  std::string wake_error_;
+  PrivacyInputGuard input_guard_;
+  bool block_input_ = false;
+  PrivacyCursorGuard cursor_guard_;
+  PrivacyBandGuard band_guard_;
+  std::unique_ptr<ScopedWindowsPhysicalCoordinates> dpi_scope_;
+  bool registered_ = false;
+  bool hotkey_ = false;
+  bool emergency_ = false;
+  bool layout_changed_ = false;
+  bool coverage_dirty_ = false;
+  uint64_t last_check_ = 0;
+  PrivacyHealth last_health_;
+  HWND last_obstruction_ = nullptr;
+  uint64_t last_obstruction_log_ = 0;
+  std::string health_error_;
+};
+
+}  // namespace
+
+bool IsWindowsPrivacyDesktopAvailable() {
+  // LockApp can display the lock screen while OpenInputDesktop still reports
+  // Default. Desktop-name checks alone are NOT a session-unlocked check.
+  DWORD session = 0;
+  if (!ProcessIdToSessionId(GetCurrentProcessId(), &session) ||
+      session != WTSGetActiveConsoleSessionId())
+    return false;
+  LPWSTR buffer = nullptr;
+  DWORD bytes = 0;
+  if (!WTSQuerySessionInformationW(WTS_CURRENT_SERVER_HANDLE, session,
+                                   WTSSessionInfoEx, &buffer, &bytes))
+    return false;
+  const auto info = reinterpret_cast<WTSINFOEXW*>(buffer);
+  const bool unlocked =
+      bytes >= sizeof(WTSINFOEXW) && info->Level == 1 &&
+      info->Data.WTSInfoExLevel1.SessionFlags == WTS_SESSIONSTATE_UNLOCK;
+  WTSFreeMemory(buffer);
+  if (!unlocked) return false;
+  HDESK input = OpenInputDesktop(0, FALSE, DESKTOP_READOBJECTS);
+  if (!input) return false;
+  wchar_t input_name[256]{}, thread_name[256]{};
+  const bool ok =
+      DesktopName(input, input_name) &&
+      DesktopName(GetThreadDesktop(GetCurrentThreadId()), thread_name) &&
+      _wcsicmp(input_name, L"Default") == 0 &&
+      _wcsicmp(input_name, thread_name) == 0;
+  CloseDesktop(input);
+  return ok;
+}
+
+std::unique_ptr<PrivacyBackend> CreateWindowsPrivacyBackend() {
+  return std::make_unique<WindowsPrivacyBackend>();
+}
+
+}  // namespace crossdesk

apps/desktop/src/platform/windows/privacy/privacy_band_guard.cpp

@@ -0,0 +1,323 @@
+/*
+ * @Author: DI JUNKUN
+ * @Date: 2026-09-10
+ * Copyright (c) 2026 by DI JUNKUN, All Rights Reserved.
+ */
+
+#include "privacy_band_guard.h"
+
+#include <objbase.h>
+
+#include <algorithm>
+#include <iterator>
+#include <new>
+
+#include "privacy_backend.h"
+#include "rd_log.h"
+
+namespace crossdesk {
+namespace {
+struct ScopedHandle {
+  HANDLE value = nullptr;
+  ~ScopedHandle() {
+    if (value && value != INVALID_HANDLE_VALUE) CloseHandle(value);
+  }
+};
+bool Failed(const char* operation, std::string& error,
+            DWORD code = GetLastError()) {
+  error =
+      std::string(operation) + " (Windows error " + std::to_string(code) + ")";
+  LOG_ERROR("Privacy high-band: {}", error);
+  return false;
+}
+
+std::filesystem::path ModuleDirectory() {
+  std::vector<wchar_t> path(32768);
+  const DWORD length = GetModuleFileNameW(nullptr, path.data(), path.size());
+  if (!length || length >= path.size()) return {};
+  return std::filesystem::path(path.data()).parent_path();
+}
+
+std::vector<wchar_t> ChildEnvironment(const std::wstring& bootstrap) {
+  std::vector<std::wstring> entries;
+  LPWCH environment = GetEnvironmentStringsW();
+  if (!environment) return {};
+  const std::wstring prefix = std::wstring(kPrivacyBandBootstrap) + L"=";
+  for (const wchar_t* item = environment; *item; item += wcslen(item) + 1) {
+    if (_wcsnicmp(item, prefix.c_str(), prefix.size()) != 0)
+      entries.emplace_back(item);
+  }
+  FreeEnvironmentStringsW(environment);
+  entries.push_back(prefix + bootstrap);
+  std::sort(entries.begin(), entries.end(), [](const auto& a, const auto& b) {
+    return _wcsicmp(a.c_str(), b.c_str()) < 0;
+  });
+  std::vector<wchar_t> result;
+  for (const auto& entry : entries) {
+    result.insert(result.end(), entry.begin(), entry.end());
+    result.push_back(0);
+  }
+  result.push_back(0);
+  return result;
+}
+}  // namespace
+
+PrivacyBandGuard::~PrivacyBandGuard() {
+  std::string error;
+  if (!Stop(error)) {
+    // Last-resort teardown still targets only this object's dedicated job.
+    if (job_) CloseHandle(job_);
+    job_ = nullptr;
+    Stop(error);
+  }
+}
+
+bool PrivacyBandGuard::Available(std::string& error) {
+#if !defined(_M_X64) && !defined(__x86_64__)
+  error = "High-band privacy currently requires an x64 Windows process";
+  return false;
+#else
+  const HMODULE user = GetModuleHandleW(L"user32.dll");
+  if (!GetProcAddress(user, "CreateWindowInBand") ||
+      !GetProcAddress(user, "GetWindowBand")) {
+    error = "Windows high-band window APIs are unavailable";
+    return false;
+  }
+  const auto directory = ModuleDirectory();
+  if (directory.empty())
+    return Failed("Resolve privacy module directory", error);
+  const auto dll = directory / kPrivacyBandDll;
+  if (GetFileAttributesW(dll.c_str()) == INVALID_FILE_ATTRIBUTES)
+    return Failed("Missing crossdesk_privacy_window.dll", error);
+  return true;
+#endif
+}
+
+bool PrivacyBandGuard::Start(const PrivacyScreenText& text,
+                             std::string& error) {
+  if (process_)
+    return Failed("High-band broker is already running", error, ERROR_BUSY);
+  if (!Available(error)) return false;
+  const auto directory = ModuleDirectory();
+  if (directory.empty())
+    return Failed("Resolve privacy module directory", error);
+  const auto dll = directory / kPrivacyBandDll;
+  wchar_t system[MAX_PATH]{}, temporary[MAX_PATH]{}, guid_text[40]{};
+  GUID guid{};
+  if (!GetSystemDirectoryW(system, MAX_PATH) ||
+      !GetTempPathW(MAX_PATH, temporary) || FAILED(CoCreateGuid(&guid)) ||
+      !StringFromGUID2(guid, guid_text, 40))
+    return Failed("Resolve high-band broker paths", error);
+  broker_directory_ = std::filesystem::path(temporary) /
+                      (std::wstring(L"CrossDesk-privacy-") + guid_text);
+  if (!CreateDirectoryW(broker_directory_.c_str(), nullptr))
+    return Failed("Create private broker directory", error);
+  broker_path_ = broker_directory_ / L"RuntimeBroker_crossdesk.exe";
+  if (!CopyFileW((std::filesystem::path(system) / L"RuntimeBroker.exe").c_str(),
+                 broker_path_.c_str(), TRUE))
+    return Failed("Copy system RuntimeBroker for this session", error);
+  // Keep both images immutable throughout creation/injection and the session.
+  image_lock_ = CreateFileW(broker_path_.c_str(), GENERIC_READ, FILE_SHARE_READ,
+                            nullptr, OPEN_EXISTING, 0, nullptr);
+  dll_lock_ = CreateFileW(dll.c_str(), GENERIC_READ, FILE_SHARE_READ, nullptr,
+                          OPEN_EXISTING, 0, nullptr);
+  if (image_lock_ == INVALID_HANDLE_VALUE || dll_lock_ == INVALID_HANDLE_VALUE)
+    return Failed("Lock privacy broker images", error);
+
+  SECURITY_ATTRIBUTES inherit{sizeof(inherit), nullptr, TRUE};
+  ScopedHandle parent;
+  if (!DuplicateHandle(GetCurrentProcess(), GetCurrentProcess(),
+                       GetCurrentProcess(), &parent.value,
+                       SYNCHRONIZE | PROCESS_QUERY_LIMITED_INFORMATION, TRUE,
+                       0))
+    return Failed("Duplicate privacy parent process handle", error);
+  stop_ = CreateEventW(&inherit, TRUE, FALSE, nullptr);
+  ready_ = CreateEventW(&inherit, TRUE, FALSE, nullptr);
+  mapping_ = CreateFileMappingW(INVALID_HANDLE_VALUE, &inherit, PAGE_READWRITE,
+                                0, sizeof(PrivacyBandShared), nullptr);
+  if (!stop_ || !ready_ || !mapping_) {
+    const auto code = GetLastError();
+    return Failed("Create high-band broker IPC", error, code);
+  }
+  shared_ = static_cast<PrivacyBandShared*>(MapViewOfFile(
+      mapping_, FILE_MAP_ALL_ACCESS, 0, 0, sizeof(PrivacyBandShared)));
+  if (!shared_) {
+    return Failed("Map high-band broker IPC", error);
+  }
+  new (shared_) PrivacyBandShared{};
+  // Immutable after process startup; no cross-process string objects or
+  // concurrent writes while the window thread paints.
+  if (!MultiByteToWideChar(CP_UTF8, MB_ERR_INVALID_CHARS,
+                           text.unlock_hint.c_str(), -1, shared_->unlock_hint,
+                           static_cast<int>(std::size(shared_->unlock_hint))))
+    return Failed("Encode privacy screen text", error);
+  shared_->parent_pid = GetCurrentProcessId();
+  HANDLE handles[] = {parent.value, stop_, ready_, mapping_};
+  std::wstring bootstrap;
+  for (HANDLE handle : handles) {
+    if (!bootstrap.empty()) bootstrap += L",";
+    bootstrap += std::to_wstring(reinterpret_cast<uintptr_t>(handle));
+  }
+  auto environment = ChildEnvironment(bootstrap);
+  if (environment.empty()) {
+    return Failed("Build broker environment", error);
+  }
+
+  job_ = CreateJobObjectW(nullptr, nullptr);
+  JOBOBJECT_EXTENDED_LIMIT_INFORMATION limits{};
+  limits.BasicLimitInformation.LimitFlags = JOB_OBJECT_LIMIT_KILL_ON_JOB_CLOSE;
+  if (!job_ || !SetInformationJobObject(job_, JobObjectExtendedLimitInformation,
+                                        &limits, sizeof(limits))) {
+    return Failed("Bind high-band broker lifetime", error);
+  }
+  SIZE_T bytes = 0;
+  InitializeProcThreadAttributeList(nullptr, 1, 0, &bytes);
+  std::vector<unsigned char> attributes(bytes);
+  STARTUPINFOEXW startup{};
+  startup.StartupInfo.cb = sizeof(startup);
+  startup.lpAttributeList =
+      reinterpret_cast<LPPROC_THREAD_ATTRIBUTE_LIST>(attributes.data());
+  if (!InitializeProcThreadAttributeList(startup.lpAttributeList, 1, 0,
+                                         &bytes)) {
+    return Failed("Initialize broker handle list", error);
+  }
+  bool ok = UpdateProcThreadAttribute(
+                startup.lpAttributeList, 0, PROC_THREAD_ATTRIBUTE_HANDLE_LIST,
+                handles, sizeof(handles), nullptr, nullptr) != FALSE;
+  PROCESS_INFORMATION child{};
+  std::wstring command = L"\"" + broker_path_.wstring() + L"\"";
+  if (ok) {
+    ok = CreateProcessW(
+             broker_path_.c_str(), command.data(), nullptr, nullptr, TRUE,
+             CREATE_SUSPENDED | CREATE_NO_WINDOW | CREATE_UNICODE_ENVIRONMENT |
+                 EXTENDED_STARTUPINFO_PRESENT,
+             environment.data(), broker_directory_.c_str(),
+             &startup.StartupInfo, &child) != FALSE;
+  }
+  const DWORD create_error = GetLastError();
+  DeleteProcThreadAttributeList(startup.lpAttributeList);
+  if (!ok)
+    return Failed("Create owned RuntimeBroker process", error, create_error);
+  process_ = child.hProcess;
+  shared_->broker_pid = child.dwProcessId;
+  if (!AssignProcessToJobObject(job_, process_)) {
+    const DWORD code = GetLastError();
+    TerminateProcess(process_, code);
+    CloseHandle(child.hThread);
+    return Failed("Assign owned RuntimeBroker to privacy job", error, code);
+  }
+  const auto path = dll.wstring();
+  const auto size = (path.size() + 1) * sizeof(wchar_t);
+  void* remote_path = VirtualAllocEx(process_, nullptr, size,
+                                     MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE);
+  SIZE_T written = 0;
+  const auto loader =
+      GetProcAddress(GetModuleHandleW(L"kernel32.dll"), "LoadLibraryW");
+  ok =
+      remote_path && loader &&
+      WriteProcessMemory(process_, remote_path, path.c_str(), size, &written) &&
+      written == size &&
+      QueueUserAPC(reinterpret_cast<PAPCFUNC>(loader), child.hThread,
+                   reinterpret_cast<ULONG_PTR>(remote_path));
+  DWORD injection_error = GetLastError();
+  if (ok && ResumeThread(child.hThread) == DWORD(-1)) {
+    ok = false;
+    injection_error = GetLastError();
+  }
+  CloseHandle(child.hThread);
+  if (!ok)
+    return Failed("Load high-band window module into owned broker", error,
+                  injection_error);
+  HANDLE startup_events[] = {ready_, process_};
+  const DWORD result = WaitForMultipleObjects(2, startup_events, FALSE, 5000);
+  if (result != WAIT_OBJECT_0) {
+    DWORD code = ERROR_TIMEOUT;
+    if (result == WAIT_OBJECT_0 + 1) GetExitCodeProcess(process_, &code);
+    return Failed("High-band broker did not become ready", error, code);
+  }
+  std::vector<PrivacyBandWindow> windows;
+  if (!Windows(windows, error)) return false;
+  LOG_INFO("Privacy high-band broker ready: process={}, band={}, monitors={}",
+           process_id(), kPrivacyWindowBand, windows.size());
+  return true;
+}
+
+bool PrivacyBandGuard::Healthy(std::string& error) {
+  if (!process_ || !shared_)
+    return Failed("High-band broker is not initialized", error,
+                  ERROR_INVALID_HANDLE);
+  const LONG code = InterlockedCompareExchange(&shared_->error, 0, 0);
+  if (code != ERROR_SUCCESS) {
+    char operation[256]{};
+    WideCharToMultiByte(CP_UTF8, 0, shared_->operation, -1, operation,
+                        sizeof(operation), nullptr, nullptr);
+    return Failed(operation[0] ? operation : "High-band window startup failed",
+                  error, code);
+  }
+  if (WaitForSingleObject(process_, 0) != WAIT_TIMEOUT) {
+    DWORD exit_code = ERROR_PROCESS_ABORTED;
+    GetExitCodeProcess(process_, &exit_code);
+    return Failed("High-band window process exited", error, exit_code);
+  }
+  if (!InterlockedCompareExchange(&shared_->active, 0, 0) ||
+      GetTickCount64() - static_cast<ULONGLONG>(InterlockedCompareExchange64(
+                             &shared_->heartbeat, 0, 0)) >
+          1500)
+    return Failed("High-band window thread stopped responding", error,
+                  ERROR_TIMEOUT);
+  return true;
+}
+
+bool PrivacyBandGuard::Windows(std::vector<PrivacyBandWindow>& windows,
+                               std::string& error) {
+  if (!Healthy(error)) return false;
+  for (int attempt = 0; attempt < 4; ++attempt) {
+    const LONG before = InterlockedCompareExchange(&shared_->sequence, 0, 0);
+    if (before & 1) continue;
+    const auto count = shared_->count;
+    if (count == 0 || count > kPrivacyMaxMonitors) break;
+    windows.assign(shared_->windows, shared_->windows + count);
+    if (before == InterlockedCompareExchange(&shared_->sequence, 0, 0)) {
+      for (const auto& window : windows) {
+        DWORD pid = 0;
+        GetWindowThreadProcessId(reinterpret_cast<HWND>(window.hwnd), &pid);
+        if (pid != process_id())
+          return Failed("Invalid high-band window owner", error,
+                        ERROR_INVALID_HANDLE);
+      }
+      return true;
+    }
+  }
+  return Failed("High-band monitor snapshot is changing or invalid", error,
+                ERROR_RETRY);
+}
+
+bool PrivacyBandGuard::Stop(std::string& error) {
+  bool ok = true;
+  if (process_) {
+    if (stop_) SetEvent(stop_);
+    if (WaitForSingleObject(process_, 1500) != WAIT_OBJECT_0) {
+      // This handle came only from our CreateProcessW call, never discovery.
+      if (!TerminateProcess(process_, ERROR_CANCELLED) ||
+          WaitForSingleObject(process_, 1500) != WAIT_OBJECT_0)
+        ok = Failed("Stop owned high-band broker", error);
+    }
+    if (!ok) return false;
+    CloseHandle(process_);
+    process_ = nullptr;
+  }
+  if (job_) CloseHandle(job_);
+  job_ = nullptr;
+  if (shared_) UnmapViewOfFile(shared_);
+  shared_ = nullptr;
+  for (HANDLE handle : {stop_, ready_, mapping_, image_lock_, dll_lock_})
+    if (handle && handle != INVALID_HANDLE_VALUE) CloseHandle(handle);
+  stop_ = ready_ = mapping_ = image_lock_ = dll_lock_ = nullptr;
+  if (!broker_path_.empty()) DeleteFileW(broker_path_.c_str());
+  if (!broker_directory_.empty()) RemoveDirectoryW(broker_directory_.c_str());
+  broker_path_.clear();
+  broker_directory_.clear();
+  return true;
+}
+
+}  // namespace crossdesk

apps/desktop/src/platform/windows/privacy/privacy_band_guard.h

@@ -0,0 +1,51 @@
+/*
+ * @Author: DI JUNKUN
+ * @Date: 2026-09-10
+ * Copyright (c) 2026 by DI JUNKUN, All Rights Reserved.
+ */
+
+#ifndef _PRIVACY_BAND_GUARD_H_
+#define _PRIVACY_BAND_GUARD_H_
+
+#include <Windows.h>
+
+#include <filesystem>
+#include <string>
+#include <vector>
+
+#include "privacy_band_ipc.h"
+
+namespace crossdesk {
+
+struct PrivacyScreenText;
+
+// Lifecycle and snapshots are owned by the privacy control thread. The broker
+// owns all high-band HWND operations. This class never injects an existing
+// process and never terminates a process found by name or PID.
+class PrivacyBandGuard {
+ public:
+  ~PrivacyBandGuard();
+  static bool Available(std::string& error);
+  bool Start(const PrivacyScreenText& text, std::string& error);
+  bool Stop(std::string& error);
+  bool Healthy(std::string& error);
+  bool Windows(std::vector<PrivacyBandWindow>& windows, std::string& error);
+  bool stopped() const { return !process_; }
+  DWORD process_id() const { return process_ ? GetProcessId(process_) : 0; }
+
+ private:
+  HANDLE process_ = nullptr;
+  HANDLE job_ = nullptr;
+  HANDLE stop_ = nullptr;
+  HANDLE ready_ = nullptr;
+  HANDLE mapping_ = nullptr;
+  HANDLE image_lock_ = nullptr;
+  HANDLE dll_lock_ = nullptr;
+  PrivacyBandShared* shared_ = nullptr;
+  std::filesystem::path broker_path_;
+  std::filesystem::path broker_directory_;
+};
+
+}  // namespace crossdesk
+
+#endif  // _PRIVACY_BAND_GUARD_H_

apps/desktop/src/platform/windows/privacy/privacy_band_ipc.h

@@ -0,0 +1,53 @@
+/*
+ * @Author: DI JUNKUN
+ * @Date: 2026-09-10
+ * Copyright (c) 2026 by DI JUNKUN, All Rights Reserved.
+ */
+
+#ifndef _PRIVACY_BAND_IPC_H_
+#define _PRIVACY_BAND_IPC_H_
+
+#include <Windows.h>
+
+#include <cstdint>
+
+namespace crossdesk {
+
+constexpr uint32_t kPrivacyBandMagic = 0x43534231;
+constexpr uint32_t kPrivacyBandVersion = 2;
+constexpr DWORD kPrivacyWindowBand = 18;  // ZBID_ABOVELOCK_UX, current desktop.
+constexpr size_t kPrivacyMaxMonitors = 64;
+constexpr wchar_t kPrivacyBandBootstrap[] = L"CROSSDESK_PRIVACY_BAND_BOOTSTRAP";
+constexpr wchar_t kPrivacyBandDll[] = L"crossdesk_privacy_window.dll";
+
+struct PrivacyBandWindow {
+  uint64_t hwnd = 0;
+  RECT rect{};
+};
+
+// Unnamed mapping and synchronization/process handles are inherited only by
+// the newly created broker. No global window-name/PID discovery or named IPC.
+struct PrivacyBandShared {
+  uint32_t magic = kPrivacyBandMagic;
+  uint32_t version = kPrivacyBandVersion;
+  uint32_t size = sizeof(PrivacyBandShared);
+  DWORD parent_pid = 0;
+  DWORD broker_pid = 0;
+  volatile LONG sequence = 0;
+  volatile LONG error = ERROR_IO_PENDING;
+  volatile LONG active = 0;
+  alignas(8) volatile LONG64 heartbeat = 0;
+  wchar_t operation[128]{};
+  wchar_t unlock_hint[128]{};
+  uint32_t count = 0;
+  PrivacyBandWindow windows[kPrivacyMaxMonitors]{};
+};
+
+using CreatePrivacyWindowInBand = HWND(WINAPI*)(DWORD, ATOM, LPCWSTR, DWORD,
+                                                int, int, int, int, HWND, HMENU,
+                                                HINSTANCE, LPVOID, DWORD);
+using GetPrivacyWindowBand = BOOL(WINAPI*)(HWND, DWORD*);
+
+}  // namespace crossdesk
+
+#endif  // _PRIVACY_BAND_IPC_H_

apps/desktop/src/platform/windows/privacy/privacy_cursor_api.h

@@ -0,0 +1,70 @@
+/*
+ * @Author: DI JUNKUN
+ * @Date: 2026-09-10
+ * Copyright (c) 2026 by DI JUNKUN, All Rights Reserved.
+ */
+
+#ifndef _PRIVACY_CURSOR_API_H_
+#define _PRIVACY_CURSOR_API_H_
+
+#include <Windows.h>
+
+namespace crossdesk {
+
+// A separate cursor plane can remain visible above a capture-excluded HWND.
+// Magnification's documented cursor API hides that plane across input queues;
+// it does not change cursor schemes, shapes, positions, focus or DPI awareness.
+class PrivacyCursorApi {
+ public:
+  PrivacyCursorApi() = default;
+  PrivacyCursorApi(const PrivacyCursorApi&) = delete;
+  PrivacyCursorApi& operator=(const PrivacyCursorApi&) = delete;
+  ~PrivacyCursorApi() { RestoreAndClose(); }
+  bool Initialize() {
+    module_ = LoadLibraryExW(L"Magnification.dll", nullptr,
+                             LOAD_LIBRARY_SEARCH_SYSTEM32);
+    if (!module_) return false;
+    const auto initialize = reinterpret_cast<InitializeFn>(
+        GetProcAddress(module_, "MagInitialize"));
+    uninitialize_ = reinterpret_cast<InitializeFn>(
+        GetProcAddress(module_, "MagUninitialize"));
+    show_ = reinterpret_cast<ShowFn>(
+        GetProcAddress(module_, "MagShowSystemCursor"));
+    if (!initialize || !uninitialize_ || !show_) {
+      SetLastError(ERROR_PROC_NOT_FOUND);
+      return false;
+    }
+    initialized_ = initialize() != FALSE;
+    return initialized_;
+  }
+  bool Hide() { return initialized_ && show_(FALSE); }
+  bool RestoreAndClose() {
+    bool ok = true;
+    if (initialized_) {
+      ok = show_(TRUE) != FALSE;
+      ok = (uninitialize_() != FALSE) && ok;
+      initialized_ = false;
+    }
+    if (module_) {
+      FreeLibrary(module_);
+      module_ = nullptr;
+    }
+    return ok;
+  }
+
+ private:
+  using InitializeFn = BOOL(WINAPI*)();
+  using ShowFn = BOOL(WINAPI*)(BOOL);
+  HMODULE module_ = nullptr;
+  InitializeFn uninitialize_ = nullptr;
+  ShowFn show_ = nullptr;
+  bool initialized_ = false;
+};
+
+struct PrivacyCursorReady {
+  volatile LONG error;
+};
+
+}  // namespace crossdesk
+
+#endif  // _PRIVACY_CURSOR_API_H_

apps/desktop/src/platform/windows/privacy/privacy_cursor_guard.cpp

@@ -0,0 +1,158 @@
+/*
+ * @Author: DI JUNKUN
+ * @Date: 2026-09-11
+ * Copyright (c) 2026 by DI JUNKUN, All Rights Reserved.
+ */
+
+#include "privacy_cursor_guard.h"
+
+#include <filesystem>
+#include <vector>
+
+#include "privacy_cursor_api.h"
+#include "rd_log.h"
+
+namespace crossdesk {
+namespace {
+struct Handle {
+  HANDLE value = nullptr;
+  ~Handle() {
+    if (value) CloseHandle(value);
+  }
+};
+bool Failed(const char* operation, std::string& error,
+            DWORD code = GetLastError()) {
+  error = std::string(operation) + " failed (Windows error " +
+          std::to_string(code) + ")";
+  LOG_ERROR("Privacy cursor: {}", error);
+  return false;
+}
+}  // namespace
+
+PrivacyCursorGuard::~PrivacyCursorGuard() {
+  std::string error;
+  Stop(error);
+  // The inherited parent handle still lets a slow helper restore on exit.
+  if (process_) CloseHandle(process_);
+  if (stop_event_) CloseHandle(stop_event_);
+}
+
+bool PrivacyCursorGuard::Start(std::string& error) {
+  if (process_ || restore_pending_)
+    return Failed("Cursor guard already active", error, ERROR_BUSY);
+  helper_failure_reported_ = false;
+  std::vector<wchar_t> module(32768);
+  const DWORD count = GetModuleFileNameW(nullptr, module.data(),
+                                         static_cast<DWORD>(module.size()));
+  if (!count || count >= module.size())
+    return Failed("GetModuleFileNameW", error);
+  const auto helper = std::filesystem::path(module.data()).parent_path() /
+                      L"crossdesk_privacy_cursor_helper.exe";
+  SECURITY_ATTRIBUTES security{sizeof(security), nullptr, TRUE};
+  Handle parent;
+  if (!DuplicateHandle(GetCurrentProcess(), GetCurrentProcess(),
+                       GetCurrentProcess(), &parent.value, SYNCHRONIZE, TRUE,
+                       0))
+    return Failed("Duplicate parent process handle", error);
+  Handle stop{CreateEventW(&security, TRUE, FALSE, nullptr)};
+  Handle ready{CreateEventW(&security, TRUE, FALSE, nullptr)};
+  Handle mapping{CreateFileMappingW(INVALID_HANDLE_VALUE, &security,
+                                    PAGE_READWRITE, 0,
+                                    sizeof(PrivacyCursorReady), nullptr)};
+  if (!stop.value || !ready.value || !mapping.value)
+    return Failed("Create cursor guard IPC", error);
+  auto shared = static_cast<PrivacyCursorReady*>(MapViewOfFile(
+      mapping.value, FILE_MAP_ALL_ACCESS, 0, 0, sizeof(PrivacyCursorReady)));
+  if (!shared) return Failed("Map cursor guard readiness", error);
+  InterlockedExchange(&shared->error, ERROR_IO_PENDING);
+
+  SIZE_T bytes = 0;
+  InitializeProcThreadAttributeList(nullptr, 1, 0, &bytes);
+  std::vector<unsigned char> attributes(bytes);
+  STARTUPINFOEXW startup{};
+  startup.StartupInfo.cb = sizeof(startup);
+  startup.lpAttributeList =
+      reinterpret_cast<LPPROC_THREAD_ATTRIBUTE_LIST>(attributes.data());
+  if (!InitializeProcThreadAttributeList(startup.lpAttributeList, 1, 0,
+                                         &bytes)) {
+    const DWORD code = GetLastError();
+    UnmapViewOfFile(shared);
+    return Failed("Initialize cursor guard handle list", error, code);
+  }
+  HANDLE inherited[] = {parent.value, stop.value, ready.value, mapping.value};
+  bool ok = UpdateProcThreadAttribute(
+                startup.lpAttributeList, 0, PROC_THREAD_ATTRIBUTE_HANDLE_LIST,
+                inherited, sizeof(inherited), nullptr, nullptr) != FALSE;
+  PROCESS_INFORMATION child{};
+  if (ok) {
+    std::wstring command = L"\"" + helper.wstring() + L"\"";
+    for (HANDLE handle : inherited)
+      command += L" " + std::to_wstring(reinterpret_cast<uintptr_t>(handle));
+    ok =
+        CreateProcessW(helper.c_str(), command.data(), nullptr, nullptr, TRUE,
+                       CREATE_NO_WINDOW | EXTENDED_STARTUPINFO_PRESENT |
+                           CREATE_BREAKAWAY_FROM_JOB,
+                       nullptr, nullptr, &startup.StartupInfo, &child) != FALSE;
+  }
+  const DWORD start_error = GetLastError();
+  DeleteProcThreadAttributeList(startup.lpAttributeList);
+  if (!ok) {
+    UnmapViewOfFile(shared);
+    return Failed("Start crossdesk_privacy_cursor_helper.exe", error,
+                  start_error);
+  }
+  CloseHandle(child.hThread);
+  process_ = child.hProcess;
+  stop_event_ = stop.value;
+  stop.value = nullptr;
+  HANDLE startup_events[] = {ready.value, process_};
+  const DWORD result = WaitForMultipleObjects(2, startup_events, FALSE, 2000);
+  const DWORD ready_error =
+      static_cast<DWORD>(InterlockedCompareExchange(&shared->error, 0, 0));
+  UnmapViewOfFile(shared);
+  if (result != WAIT_OBJECT_0 || ready_error != ERROR_SUCCESS) {
+    std::string cleanup;
+    Stop(cleanup);
+    return Failed(
+        "Hide system cursor", error,
+        ready_error == ERROR_IO_PENDING ? ERROR_TIMEOUT : ready_error);
+  }
+  return true;
+}
+
+bool PrivacyCursorGuard::RestoreAfterFailure(std::string& error) {
+  PrivacyCursorApi cursor;
+  if (!cursor.Initialize() || !cursor.RestoreAndClose()) {
+    restore_pending_ = true;
+    return Failed("Restore system cursor after helper failure", error);
+  }
+  restore_pending_ = false;
+  return true;
+}
+
+bool PrivacyCursorGuard::Healthy(std::string& error) {
+  if (process_ && WaitForSingleObject(process_, 0) == WAIT_TIMEOUT) return true;
+  if (restore_pending_ || (process_ && !helper_failure_reported_))
+    RestoreAfterFailure(error);
+  helper_failure_reported_ = true;
+  error = "System cursor helper exited; privacy screen will turn off";
+  return false;
+}
+
+bool PrivacyCursorGuard::Stop(std::string& error) {
+  if (!process_) return !restore_pending_ || RestoreAfterFailure(error);
+  if (!SetEvent(stop_event_)) return Failed("Stop cursor helper", error);
+  if (WaitForSingleObject(process_, 2000) != WAIT_OBJECT_0) {
+    return Failed("Wait for cursor helper restoration", error, ERROR_TIMEOUT);
+  }
+  DWORD code = ERROR_GEN_FAILURE;
+  GetExitCodeProcess(process_, &code);
+  CloseHandle(process_);
+  process_ = nullptr;
+  CloseHandle(stop_event_);
+  stop_event_ = nullptr;
+  if (code != ERROR_SUCCESS) return RestoreAfterFailure(error);
+  return true;
+}
+
+}  // namespace crossdesk

apps/desktop/src/platform/windows/privacy/privacy_cursor_guard.h

@@ -0,0 +1,39 @@
+/*
+ * @Author: DI JUNKUN
+ * @Date: 2026-09-10
+ * Copyright (c) 2026 by DI JUNKUN, All Rights Reserved.
+ */
+
+#ifndef _PRIVACY_CURSOR_GUARD_H_
+#define _PRIVACY_CURSOR_GUARD_H_
+
+#include <Windows.h>
+
+#include <string>
+
+namespace crossdesk {
+
+// Called only on the privacy message thread. The child owns cursor suppression
+// and restores it when either this guard stops it or its parent process exits.
+class PrivacyCursorGuard {
+ public:
+  PrivacyCursorGuard() = default;
+  PrivacyCursorGuard(const PrivacyCursorGuard&) = delete;
+  PrivacyCursorGuard& operator=(const PrivacyCursorGuard&) = delete;
+  ~PrivacyCursorGuard();
+  bool Start(std::string& error);
+  bool Healthy(std::string& error);
+  bool Stop(std::string& error);
+  bool stopped() const { return !process_ && !restore_pending_; }
+
+ private:
+  bool RestoreAfterFailure(std::string& error);
+  HANDLE process_ = nullptr;
+  HANDLE stop_event_ = nullptr;
+  bool restore_pending_ = false;
+  bool helper_failure_reported_ = false;
+};
+
+}  // namespace crossdesk
+
+#endif  // _PRIVACY_CURSOR_GUARD_H_

apps/desktop/src/platform/windows/privacy/privacy_input_guard.cpp

@@ -0,0 +1,304 @@
+/*
+ * @Author: DI JUNKUN
+ * @Date: 2026-09-10
+ * Copyright (c) 2026 by DI JUNKUN, All Rights Reserved.
+ */
+
+#include "privacy_input_guard.h"
+
+#include "rd_log.h"
+#include "windows_input_marker.h"
+
+namespace crossdesk {
+
+PrivacyInputGuard::~PrivacyInputGuard() { Stop(); }
+
+void PrivacyInputGuard::Fault(const std::string& operation, DWORD code) {
+  {
+    std::lock_guard lock(error_mutex_);
+    error_ = operation + " (Windows error " + std::to_string(code) + ")";
+    LOG_ERROR("Privacy input: {}", error_);
+  }
+  healthy_.store(false);
+  // Wake the owner's message loop; recovery is never performed in a hook.
+  PostMessageW(owner_, WM_NULL, 0, 0);
+}
+
+bool PrivacyInputGuard::Start(HWND owner, UINT exit_message,
+                              std::string& error) {
+  if (thread_.joinable()) {
+    error = "Privacy input thread is already running";
+    return false;
+  }
+  owner_ = owner;
+  exit_message_ = exit_message;
+  healthy_.store(false);
+  {
+    std::lock_guard lock(error_mutex_);
+    error_.clear();
+  }
+  stop_ = CreateEventW(nullptr, TRUE, FALSE, nullptr);
+  ready_ = CreateEventW(nullptr, TRUE, FALSE, nullptr);
+  if (!stop_ || !ready_) {
+    Fault("Create privacy input events failed", GetLastError());
+    Healthy(error);
+    Stop();
+    return false;
+  }
+  try {
+    thread_ = std::thread([this] { Run(); });
+  } catch (const std::exception& e) {
+    error = std::string("Start privacy input thread failed: ") + e.what();
+    Stop();
+    return false;
+  }
+  if (WaitForSingleObject(ready_, 2000) != WAIT_OBJECT_0) {
+    error = "Privacy input thread startup timed out";
+    Stop();
+    return false;
+  }
+  if (!Healthy(error)) {
+    Stop();
+    return false;
+  }
+  return true;
+}
+
+void PrivacyInputGuard::Stop() {
+  if (stop_) SetEvent(stop_);
+  if (thread_.joinable()) thread_.join();
+  if (stop_) CloseHandle(stop_);
+  if (ready_) CloseHandle(ready_);
+  stop_ = ready_ = nullptr;
+  owner_ = nullptr;
+}
+
+bool PrivacyInputGuard::Healthy(std::string& error) const {
+  if (healthy_.load() && running_.load() &&
+      GetTickCount64() - last_pump_.load() < 1500)
+    return true;
+  std::lock_guard lock(error_mutex_);
+  error = error_.empty() ? "Privacy input message thread stopped responding"
+                         : error_;
+  return false;
+}
+
+bool PrivacyInputGuard::Renew(HHOOK& hook, int kind, HOOKPROC procedure) {
+  HHOOK replacement =
+      SetWindowsHookExW(kind, procedure, GetModuleHandleW(nullptr), 0);
+  if (!replacement) {
+    Fault("Renew privacy input hook failed", GetLastError());
+    return false;
+  }
+  HHOOK previous = hook;
+  hook = replacement;
+  if (UnhookWindowsHookEx(previous)) return true;
+  const DWORD code = GetLastError();
+  if (code != ERROR_INVALID_HOOK_HANDLE) retired_.push_back(previous);
+  Fault("Privacy input hook was lost or could not be retired", code);
+  return false;
+}
+
+bool PrivacyInputGuard::PumpMessages() {
+  MSG message{};
+  while (PeekMessageW(&message, nullptr, 0, 0, PM_REMOVE)) {
+    if (message.message == WM_QUIT) return false;
+    TranslateMessage(&message);
+    DispatchMessageW(&message);
+  }
+  last_pump_.store(GetTickCount64());
+  return WaitForSingleObject(stop_, 0) == WAIT_TIMEOUT;
+}
+
+bool PrivacyInputGuard::ReleasePressedInputs() {
+  // Both hooks must already be installed: otherwise a new local press can
+  // slip between this snapshot and the transition to blocked input.
+  std::array<bool, 256> pressed{};
+  for (int key = 1; key < 256; ++key)
+    pressed[key] = (GetAsyncKeyState(key) & 0x8000) != 0;
+  // Keep held modifiers available to the physical emergency-exit chord.
+  // Our injected releases intentionally do not clear this hook-side state.
+  physical_keys_ = pressed;
+
+  std::vector<INPUT> releases;
+  for (int key = 1; key < 256; ++key) {
+    if (!pressed[key]) continue;
+    // Generic modifier VKs alias their left/right variants. Release each
+    // side once; use the generic VK only if Windows reports no specific side.
+    if ((key == VK_SHIFT && (pressed[VK_LSHIFT] || pressed[VK_RSHIFT])) ||
+        (key == VK_CONTROL && (pressed[VK_LCONTROL] || pressed[VK_RCONTROL])) ||
+        (key == VK_MENU && (pressed[VK_LMENU] || pressed[VK_RMENU])))
+      continue;
+    INPUT input{};
+    input.type = INPUT_MOUSE;
+    input.mi.dwExtraInfo = kInjectedMouseInputMarker;
+    switch (key) {
+      // GetAsyncKeyState reports physical mouse buttons, as do these flags,
+      // including when Windows swaps the primary and secondary buttons.
+      case VK_LBUTTON:
+        input.mi.dwFlags = MOUSEEVENTF_LEFTUP;
+        break;
+      case VK_RBUTTON:
+        input.mi.dwFlags = MOUSEEVENTF_RIGHTUP;
+        break;
+      case VK_MBUTTON:
+        input.mi.dwFlags = MOUSEEVENTF_MIDDLEUP;
+        break;
+      case VK_XBUTTON1:
+      case VK_XBUTTON2:
+        input.mi.dwFlags = MOUSEEVENTF_XUP;
+        input.mi.mouseData = key == VK_XBUTTON1 ? XBUTTON1 : XBUTTON2;
+        break;
+      default: {
+        input = {};
+        input.type = INPUT_KEYBOARD;
+        input.ki.wVk = static_cast<WORD>(key);
+        const UINT scan = MapVirtualKeyW(key, MAPVK_VK_TO_VSC_EX);
+        input.ki.wScan = static_cast<WORD>(scan & 0xff);
+        input.ki.dwFlags = KEYEVENTF_KEYUP;
+        if ((scan & 0xff00) == 0xe000)
+          input.ki.dwFlags |= KEYEVENTF_EXTENDEDKEY;
+        input.ki.dwExtraInfo = kInjectedKeyboardInputMarker;
+        break;
+      }
+    }
+    LOG_INFO("Privacy input handoff: releasing held input vk=0x{:02X}", key);
+    releases.push_back(input);
+  }
+  if (!releases.empty()) {
+    const UINT count = static_cast<UINT>(releases.size());
+    SetLastError(ERROR_SUCCESS);
+    const UINT sent = SendInput(count, releases.data(), sizeof(INPUT));
+    if (sent != count) {
+      Fault("Release held privacy inputs failed (sent " + std::to_string(sent) +
+                "/" + std::to_string(count) + ")",
+            GetLastError());
+      return false;
+    }
+  }
+
+  // SendInput acknowledges insertion, not delivery. Pump this hook thread
+  // until the tagged releases have passed through and Windows reports no
+  // pressed inputs. The caller cannot publish input_blocked/ready earlier.
+  const auto deadline = GetTickCount64() + 1000;
+  for (;;) {
+    if (!PumpMessages()) {
+      Fault("Privacy input handoff cancelled", ERROR_CANCELLED);
+      return false;
+    }
+    int held = 0;
+    for (int key = 1; key < 256; ++key) {
+      if (GetAsyncKeyState(key) & 0x8000) {
+        held = key;
+        break;
+      }
+    }
+    if (!held) {
+      LOG_INFO("Privacy input handoff complete: released {} held inputs",
+               releases.size());
+      return true;
+    }
+    if (GetTickCount64() >= deadline) {
+      Fault("Privacy input release timed out, still pressed vk=" +
+                std::to_string(held),
+            ERROR_TIMEOUT);
+      return false;
+    }
+    if (MsgWaitForMultipleObjectsEx(1, &stop_, 10, QS_ALLINPUT,
+                                    MWMO_INPUTAVAILABLE) == WAIT_FAILED) {
+      Fault("Wait for privacy input releases failed", GetLastError());
+      return false;
+    }
+  }
+}
+
+void PrivacyInputGuard::Run() {
+  current_ = this;
+  running_.store(true);
+  try {
+    keyboard_ = SetWindowsHookExW(WH_KEYBOARD_LL, KeyboardHook,
+                              GetModuleHandleW(nullptr), 0);
+    if (!keyboard_)
+      Fault("Install privacy keyboard hook failed", GetLastError());
+    if (keyboard_) {
+      mouse_ =
+          SetWindowsHookExW(WH_MOUSE_LL, MouseHook, GetModuleHandleW(nullptr), 0);
+      if (!mouse_) Fault("Install privacy mouse hook failed", GetLastError());
+    }
+    healthy_.store(keyboard_ && mouse_ && ReleasePressedInputs());
+    last_pump_.store(GetTickCount64());
+    SetEvent(ready_);
+    auto last_refresh = GetTickCount64();
+    LOG_INFO("Privacy input message thread started: thread={}",
+             GetCurrentThreadId());
+    while (keyboard_ && mouse_ &&
+           WaitForSingleObject(stop_, 0) == WAIT_TIMEOUT) {
+      if (!PumpMessages()) break;
+      const auto now = GetTickCount64();
+      if (healthy_.load() && now - last_refresh >= 1000) {
+        last_refresh = now;
+        // Install replacements before retiring old hooks, with no input gap.
+        if (Renew(keyboard_, WH_KEYBOARD_LL, KeyboardHook))
+          Renew(mouse_, WH_MOUSE_LL, MouseHook);
+      }
+      if (MsgWaitForMultipleObjectsEx(1, &stop_, 100, QS_ALLINPUT,
+                                      MWMO_INPUTAVAILABLE) == WAIT_FAILED) {
+        Fault("Wait for privacy input messages failed", GetLastError());
+        break;
+      }
+    }
+  } catch (const std::exception& e) {
+    Fault(std::string("Privacy input thread failed: ") + e.what(),
+          ERROR_GEN_FAILURE);
+    SetEvent(ready_);
+  }
+  healthy_.store(false);
+  auto unhook = [this](HHOOK hook) {
+    if (hook && !UnhookWindowsHookEx(hook) &&
+        GetLastError() != ERROR_INVALID_HOOK_HANDLE)
+      Fault("Release privacy input hook failed", GetLastError());
+  };
+  unhook(keyboard_);
+  unhook(mouse_);
+  for (auto hook : retired_) unhook(hook);
+  keyboard_ = mouse_ = nullptr;
+  retired_.clear();
+  physical_keys_.fill(false);
+  current_ = nullptr;
+  running_.store(false);
+  PostMessageW(owner_, WM_NULL, 0, 0);
+  // Windows also removes hooks installed by a thread when that thread exits.
+  LOG_INFO("Privacy input message thread stopped");
+}
+
+LRESULT CALLBACK PrivacyInputGuard::KeyboardHook(int code, WPARAM wp,
+                                                 LPARAM lp) {
+  auto self = current_;
+  if (code < 0 || !self) return CallNextHookEx(nullptr, code, wp, lp);
+  const auto& key = *reinterpret_cast<KBDLLHOOKSTRUCT*>(lp);
+  if ((key.flags & LLKHF_INJECTED) &&
+      key.dwExtraInfo == kInjectedKeyboardInputMarker)
+    return CallNextHookEx(nullptr, code, wp, lp);
+  if (!(key.flags & LLKHF_INJECTED) && key.vkCode < 256) {
+    self->physical_keys_[key.vkCode] = !(key.flags & LLKHF_UP);
+    const auto& keys = self->physical_keys_;
+    if (key.vkCode == VK_F12 && !(key.flags & LLKHF_UP) &&
+        (keys[VK_LCONTROL] || keys[VK_RCONTROL]) &&
+        (keys[VK_LMENU] || keys[VK_RMENU]) &&
+        (keys[VK_LSHIFT] || keys[VK_RSHIFT]))
+      PostMessageW(self->owner_, self->exit_message_, 0, 0);
+  }
+  return 1;
+}
+
+LRESULT CALLBACK PrivacyInputGuard::MouseHook(int code, WPARAM wp, LPARAM lp) {
+  auto self = current_;
+  if (code < 0 || !self) return CallNextHookEx(nullptr, code, wp, lp);
+  const auto& mouse = *reinterpret_cast<MSLLHOOKSTRUCT*>(lp);
+  if ((mouse.flags & LLMHF_INJECTED) &&
+      mouse.dwExtraInfo == kInjectedMouseInputMarker)
+    return CallNextHookEx(nullptr, code, wp, lp);
+  return 1;
+}
+
+}  // namespace crossdesk

apps/desktop/src/platform/windows/privacy/privacy_input_guard.h

@@ -0,0 +1,59 @@
+/*
+ * @Author: DI JUNKUN
+ * @Date: 2026-09-10
+ * Copyright (c) 2026 by DI JUNKUN, All Rights Reserved.
+ */
+
+#ifndef _PRIVACY_INPUT_GUARD_H_
+#define _PRIVACY_INPUT_GUARD_H_
+
+#include <Windows.h>
+
+#include <array>
+#include <atomic>
+#include <mutex>
+#include <string>
+#include <thread>
+#include <vector>
+
+namespace crossdesk {
+
+// The owner controls lifecycle; the dedicated message thread owns LL hooks.
+// Rendering and session queries never run on this thread.
+class PrivacyInputGuard {
+ public:
+  ~PrivacyInputGuard();
+  bool Start(HWND owner, UINT exit_message, std::string& error);
+  void Stop();
+  bool Healthy(std::string& error) const;
+  bool stopped() const { return !thread_.joinable(); }
+
+ private:
+  void Run();
+  bool ReleasePressedInputs();
+  bool PumpMessages();
+  void Fault(const std::string& operation, DWORD code);
+  bool Renew(HHOOK& hook, int kind, HOOKPROC procedure);
+  static LRESULT CALLBACK KeyboardHook(int code, WPARAM wp, LPARAM lp);
+  static LRESULT CALLBACK MouseHook(int code, WPARAM wp, LPARAM lp);
+
+  std::thread thread_;
+  HANDLE stop_ = nullptr;
+  HANDLE ready_ = nullptr;
+  HWND owner_ = nullptr;
+  UINT exit_message_ = 0;
+  std::atomic<bool> healthy_{false};
+  std::atomic<bool> running_{false};
+  std::atomic<ULONGLONG> last_pump_{0};
+  mutable std::mutex error_mutex_;
+  std::string error_;
+  HHOOK keyboard_ = nullptr;
+  HHOOK mouse_ = nullptr;
+  std::vector<HHOOK> retired_;
+  std::array<bool, 256> physical_keys_{};
+  inline static thread_local PrivacyInputGuard* current_ = nullptr;
+};
+
+}  // namespace crossdesk
+
+#endif  // _PRIVACY_INPUT_GUARD_H_

apps/desktop/src/platform/windows/privacy/privacy_window_visibility.h

@@ -0,0 +1,42 @@
+/*
+ * @Author: DI JUNKUN
+ * @Date: 2026-09-11
+ * Copyright (c) 2026 by DI JUNKUN, All Rights Reserved.
+ */
+
+#ifndef _PRIVACY_WINDOW_VISIBILITY_H_
+#define _PRIVACY_WINDOW_VISIBILITY_H_
+
+#include <Windows.h>
+
+#include <cstdint>
+
+namespace crossdesk {
+
+// Called for a visible foreign window whose full bounds intersect a cover.
+// Inspect it on every check: an OSD helper can grow into a content window.
+inline bool IsNonObstructingPrivacyWindow(HWND window, const RECT& bounds) {
+  const auto styles = GetWindowLongPtrW(window, GWL_EXSTYLE);
+  if (!(styles & WS_EX_LAYERED)) return false;
+
+  BYTE alpha = 0;
+  DWORD flags = 0;
+  // WS_EX_TRANSPARENT alone does not imply invisible pixels. Likewise,
+  // UpdateLayeredWindow windows can reject this query; failure proves nothing.
+  if (GetLayeredWindowAttributes(window, nullptr, &alpha, &flags) &&
+      (flags & LWA_ALPHA) && alpha == 0)
+    return true;
+
+  constexpr LONG_PTR helper_styles =
+      WS_EX_TOOLWINDOW | WS_EX_NOACTIVATE | WS_EX_TRANSPARENT;
+  const auto width = static_cast<int64_t>(bounds.right) - bounds.left;
+  const auto height = static_cast<int64_t>(bounds.bottom) - bounds.top;
+  // Single-pixel, nonactivating OSD placeholders cannot display meaningful
+  // desktop content. Use the whole window, never its clipped intersection;
+  // larger OSDs and windows with unknown opacity still require coverage checks.
+  return (styles & helper_styles) == helper_styles && width == 1 && height == 1;
+}
+
+}  // namespace crossdesk
+
+#endif  // _PRIVACY_WINDOW_VISIBILITY_H_

apps/desktop/src/platform/windows/screen_capturer/screen_capturer_dxgi.cpp

@@ -1,11 +1,12 @@
 #include "screen_capturer_dxgi.h"
 
+#include <display_stream_id.h>
+
 #include <algorithm>
 #include <chrono>
 #include <string>
 #include <vector>
 
-#include <display_stream_id.h>
 #include "libyuv.h"
 #include "rd_log.h"
 
@@ -218,11 +219,13 @@ void ScreenCapturerDxgi::EnumerateDisplays() {
                          mi.rcMonitor.left, mi.rcMonitor.top,
                          mi.rcMonitor.right, mi.rcMonitor.bottom);
         // primary first
-        if (is_primary)
+        if (is_primary) {
           display_info_list_.insert(display_info_list_.begin(), info);
-        else
+          outputs_.insert(outputs_.begin(), output);
+        } else {
           display_info_list_.push_back(info);
-        outputs_.push_back(output);
+          outputs_.push_back(output);
+        }
       }
     }
   }
@@ -246,6 +249,11 @@ bool ScreenCapturerDxgi::CreateDuplicationForMonitor(int monitor_index) {
   }
 
   staging_.Reset();
+  DXGI_OUTDUPL_DESC desc{};
+  duplication_->GetDesc(&desc);
+  rotation_ = desc.Rotation;
+  LOG_INFO("DXGI: duplication ready, monitor={}, rotation={}", monitor_index,
+           static_cast<int>(rotation_));
   return true;
 }
 
@@ -276,6 +284,7 @@ bool ScreenCapturerDxgi::RecreateDuplicationForCurrentMonitor() {
 }
 
 void ScreenCapturerDxgi::ReleaseDuplication() {
+  ++duplication_generation_;
   staging_.Reset();
   if (duplication_) {
     duplication_->ReleaseFrame();
@@ -284,16 +293,27 @@ void ScreenCapturerDxgi::ReleaseDuplication() {
 }
 
 void ScreenCapturerDxgi::CaptureLoop() {
-  const int timeout_ms = 33;
+  const int timeout_ms = (std::max)(1, 1000 / (std::max)(1, fps_));
+  bool cached_frame_valid = false;
+  int cached_monitor = -1;
+  uint64_t cached_generation = 0;
+  std::vector<uint8_t> rotated_frame;
   auto last_duplication_retry =
       std::chrono::steady_clock::now() - std::chrono::milliseconds(1000);
   while (running_) {
     if (paused_) {
+      cached_frame_valid = false;
       std::this_thread::sleep_for(std::chrono::milliseconds(10));
       continue;
     }
 
+    // Duplication/staging textures belong to one monitor. Do not release or
+    // replace them in SwitchTo while AcquireNextFrame/Map is using them.
+    std::unique_lock capture_lock(switch_mutex_);
+    if (paused_ || !running_) continue;
     if (!duplication_) {
+      cached_frame_valid = false;
+      capture_lock.unlock();
       const auto now = std::chrono::steady_clock::now();
       if (now - last_duplication_retry >= std::chrono::milliseconds(500)) {
         last_duplication_retry = now;
@@ -303,15 +323,31 @@ void ScreenCapturerDxgi::CaptureLoop() {
       continue;
     }
 
+    const int frame_monitor = monitor_index_.load();
     DXGI_OUTDUPL_FRAME_INFO frame_info{};
     Microsoft::WRL::ComPtr<IDXGIResource> desktop_resource;
     HRESULT hr = duplication_->AcquireNextFrame(
         timeout_ms, &frame_info, desktop_resource.GetAddressOf());
     if (hr == DXGI_ERROR_WAIT_TIMEOUT) {
+      // DXGI explicitly reports an unchanged desktop. Re-emit only a frame
+      // successfully acquired for this monitor to keep delivering static frames.
+      if (cached_frame_valid && cached_generation == duplication_generation_ &&
+          cached_monitor == monitor_index_.load() && callback_ && nv12_frame_) {
+        const auto stream_id = MakeDisplayStreamId(cached_monitor);
+        capture_lock.unlock();
+        callback_(nv12_frame_, nv12_width_ * nv12_height_ * 3 / 2, nv12_width_,
+                  nv12_height_, stream_id.c_str(), nullptr);
+      }
       continue;
     }
+    // Never replay a cached image after an acquisition/conversion failure or
+    // a backend rebuild. Normal error/reset handling releases optional privacy.
+    cached_frame_valid = false;
     if (FAILED(hr)) {
       LOG_ERROR("DXGI: AcquireNextFrame failed, hr={}", (int)hr);
+      capture_lock.unlock();
+      if (callback_)
+        callback_(nullptr, ScreenCapturer::kBackendReset, 0, 0, "", nullptr);
       RecreateDuplicationForCurrentMonitor();
       continue;
     }
@@ -356,9 +392,42 @@ void ScreenCapturerDxgi::CaptureLoop() {
       continue;
     }
 
+    auto pixels = static_cast<const uint8_t*>(mapped.pData);
+    int stride = static_cast<int>(mapped.RowPitch);
     int logical_width = static_cast<int>(src_desc.Width);
+    int logical_height = static_cast<int>(src_desc.Height);
+    libyuv::RotationMode rotation = libyuv::kRotate0;
+    switch (rotation_) {
+      case DXGI_MODE_ROTATION_ROTATE90:
+        rotation = libyuv::kRotate90;
+        break;
+      case DXGI_MODE_ROTATION_ROTATE180:
+        rotation = libyuv::kRotate180;
+        break;
+      case DXGI_MODE_ROTATION_ROTATE270:
+        rotation = libyuv::kRotate270;
+        break;
+      default:
+        break;
+    }
+    if (rotation != libyuv::kRotate0) {
+      const bool swap_axes = rotation != libyuv::kRotate180;
+      const int rotated_width = swap_axes ? logical_height : logical_width;
+      rotated_frame.resize(static_cast<size_t>(logical_width) * logical_height *
+                           4);
+      if (libyuv::ARGBRotate(pixels, stride, rotated_frame.data(),
+                             rotated_width * 4, logical_width, logical_height,
+                             rotation) != 0) {
+        d3d_context_->Unmap(staging_.Get(), 0);
+        duplication_->ReleaseFrame();
+        continue;
+      }
+      pixels = rotated_frame.data();
+      stride = rotated_width * 4;
+      if (swap_axes) std::swap(logical_width, logical_height);
+    }
     int even_width = logical_width & ~1;
-    int even_height = static_cast<int>(src_desc.Height) & ~1;
+    int even_height = logical_height & ~1;
     if (even_width <= 0 || even_height <= 0) {
       d3d_context_->Unmap(staging_.Get(), 0);
       duplication_->ReleaseFrame();
@@ -374,25 +443,29 @@ void ScreenCapturerDxgi::CaptureLoop() {
       nv12_height_ = even_height;
     }
 
-    libyuv::ARGBToNV12(static_cast<const uint8_t*>(mapped.pData),
-                       static_cast<int>(mapped.RowPitch), nv12_frame_,
-                       even_width, nv12_frame_ + even_width * even_height,
-                       even_width, even_width, even_height);
+    const int converted =
+        libyuv::ARGBToNV12(pixels, stride, nv12_frame_, even_width,
+                           nv12_frame_ + even_width * even_height, even_width,
+                           even_width, even_height);
 
-    if (callback_) {
-      int idx = monitor_index_.load();
+    cached_generation = duplication_generation_;
+    d3d_context_->Unmap(staging_.Get(), 0);
+    duplication_->ReleaseFrame();
+    capture_lock.unlock();
+
+    if (converted == 0 && frame_monitor == monitor_index_.load() && callback_) {
+      int idx = frame_monitor;
       if (idx >= 0 && idx < static_cast<int>(display_info_list_.size())) {
         const std::string stream_id = MakeDisplayStreamId(idx);
         callback_(nv12_frame_, nv12_size, even_width, even_height,
                   stream_id.c_str(), nullptr);
+        cached_monitor = idx;
+        cached_frame_valid = true;
       } else {
         LOG_ERROR("DXGI: CaptureLoop invalid monitor_index {} (list size {})",
                   idx, display_info_list_.size());
       }
     }
-
-    d3d_context_->Unmap(staging_.Get(), 0);
-    duplication_->ReleaseFrame();
   }
 }
 

apps/desktop/src/platform/windows/screen_capturer/screen_capturer_dxgi.h

@@ -63,6 +63,8 @@ class ScreenCapturerDxgi : public ScreenCapturer {
   Microsoft::WRL::ComPtr<ID3D11DeviceContext> d3d_context_;
   Microsoft::WRL::ComPtr<IDXGIOutputDuplication> duplication_;
   Microsoft::WRL::ComPtr<ID3D11Texture2D> staging_;
+  DXGI_MODE_ROTATION rotation_ = DXGI_MODE_ROTATION_IDENTITY;
+  uint64_t duplication_generation_ = 0;
 
   std::atomic<bool> running_{false};
   std::atomic<bool> paused_{false};

apps/desktop/src/platform/windows/screen_capturer/screen_capturer_wgc.cpp

@@ -351,6 +351,10 @@ int ScreenCapturerWgc::ResetToInitialMonitor() {
 }
 void ScreenCapturerWgc::OnFrame(const WgcSession::wgc_session_frame& frame,
                                 int id) {
+  if (!frame.data && frame.width == 0 && frame.height == 0) {
+    if (on_data_) on_data_(nullptr, ScreenCapturer::kBackendReset, 0, 0, "", nullptr);
+    return;
+  }
   if (!running_ || !on_data_) {
     return;
   }

apps/desktop/src/platform/windows/screen_capturer/screen_capturer_win.cpp

@@ -127,6 +127,13 @@ class WgcPluginCapturer final : public ScreenCapturer {
   DestroyFn destroy_fn_ = nullptr;
 };
 
+const char* CaptureBackendName(const ScreenCapturer* capturer) {
+  if (dynamic_cast<const ScreenCapturerDxgi*>(capturer)) return "DXGI";
+  if (dynamic_cast<const WgcPluginCapturer*>(capturer)) return "WGC";
+  if (dynamic_cast<const ScreenCapturerGdi*>(capturer)) return "GDI";
+  return "unavailable";
+}
+
 std::string BuildSecureCaptureCommand(int left, int top, int width, int height,
                                       bool show_cursor,
                                       const std::string& stage,
@@ -330,7 +337,13 @@ bool QuerySecureDesktopHelperFrame(
 ScreenCapturerWin::ScreenCapturerWin() {}
 ScreenCapturerWin::~ScreenCapturerWin() { Destroy(); }
 
+void ScreenCapturerWin::NotifyPrivacyCapture(bool running) {
+  if (privacy_)
+    privacy_->CaptureChanged(running);
+}
+
 int ScreenCapturerWin::Init(const int fps, cb_desktop_data cb) {
+  NotifyPrivacyCapture(false);
   fps_ = fps;
   cb_orig_ = cb;
   native_output_logged_.store(false, std::memory_order_relaxed);
@@ -344,6 +357,10 @@ int ScreenCapturerWin::Init(const int fps, cb_desktop_data cb) {
   cb_ = [this](unsigned char* data, int size, int w, int h,
                const char* reported_stream_id,
                const MiniRtcNativeVideoFrame* native_frame) {
+    if (size == ScreenCapturer::kBackendReset) {
+      if (privacy_) privacy_->Fail("Capture restarted; privacy screen will turn off");
+      return;
+    }
     if (secure_desktop_capture_active_.load(std::memory_order_relaxed)) {
       return;
     }
@@ -364,6 +381,9 @@ int ScreenCapturerWin::Init(const int fps, cb_desktop_data cb) {
           mapped_stream_id.c_str(), canonical_displays_.size(),
           monitor_index_.load(std::memory_order_relaxed));
     }
+    if (privacy_ && privacy_->Engaged() && !IsWindowsPrivacyDesktopAvailable()) {
+      privacy_->Fail("Secure or unavailable desktop; privacy screen will turn off");
+    }
     if (mapped_stream_id.empty()) {
       if (!invalid_stream_id_logged_.exchange(true,
                                               std::memory_order_relaxed)) {
@@ -393,50 +413,34 @@ int ScreenCapturerWin::Init(const int fps, cb_desktop_data cb) {
                       native_frame);
   };
 
+  impl_.reset();
   int ret = -1;
-
-  impl_ = WgcPluginCapturer::Create();
-  impl_is_wgc_plugin_ = (impl_ != nullptr);
-  ret = impl_ ? impl_->Init(fps_, cb_) : -1;
-  if (ret == 0) {
-    LOG_INFO("Windows capturer: using WGC plugin");
+  auto try_init = [&](std::unique_ptr<ScreenCapturer> candidate) {
+    ret = candidate ? candidate->Init(fps_, cb_) : -1;
+    if (ret != 0) {
+      LOG_WARN("Windows capturer: {} init failed (ret={})",
+               CaptureBackendName(candidate.get()), ret);
+      return false;
+    }
+    impl_ = std::move(candidate);
+    return true;
+  };
+  // Short-circuiting also keeps the unused WGC plugin unloaded.
+  if ((IsBackendEnabled(ScreenCaptureMethod::Dxgi) &&
+       try_init(std::make_unique<ScreenCapturerDxgi>())) ||
+      (IsBackendEnabled(ScreenCaptureMethod::Wgc) &&
+       try_init(WgcPluginCapturer::Create())) ||
+      (IsBackendEnabled(ScreenCaptureMethod::Gdi) &&
+       try_init(std::make_unique<ScreenCapturerGdi>()))) {
+    LOG_INFO("Windows capturer: using {}", CaptureBackendName(impl_.get()));
     BuildCanonicalFromImpl();
     monitor_index_.store(0, std::memory_order_relaxed);
     initial_monitor_index_ = 0;
     return 0;
   }
 
-  LOG_WARN("Windows capturer: WGC plugin init failed (ret={}), try DXGI", ret);
-  impl_.reset();
-  impl_is_wgc_plugin_ = false;
-
-  impl_ = std::make_unique<ScreenCapturerDxgi>();
-  impl_is_wgc_plugin_ = false;
-  ret = impl_->Init(fps_, cb_);
-  if (ret == 0) {
-    LOG_INFO("Windows capturer: using DXGI Desktop Duplication");
-    BuildCanonicalFromImpl();
-    monitor_index_.store(0, std::memory_order_relaxed);
-    initial_monitor_index_ = 0;
-    return 0;
-  }
-
-  LOG_WARN("Windows capturer: DXGI init failed (ret={}), fallback to GDI", ret);
-  impl_.reset();
-
-  impl_ = std::make_unique<ScreenCapturerGdi>();
-  impl_is_wgc_plugin_ = false;
-  ret = impl_->Init(fps_, cb_);
-  if (ret == 0) {
-    LOG_INFO("Windows capturer: using GDI BitBlt");
-    BuildCanonicalFromImpl();
-    monitor_index_.store(0, std::memory_order_relaxed);
-    initial_monitor_index_ = 0;
-    return 0;
-  }
-
-  LOG_ERROR("Windows capturer: all implementations failed, ret={}", ret);
-  impl_.reset();
+  LOG_ERROR("Windows capturer: selected capture method {} failed, ret={}",
+            static_cast<int>(capture_method_), ret);
   return -1;
 }
 
@@ -446,7 +450,6 @@ int ScreenCapturerWin::Destroy() {
   if (impl_) {
     impl_->Destroy();
     impl_.reset();
-    impl_is_wgc_plugin_ = false;
   }
   {
     std::lock_guard<std::mutex> lock(alias_mutex_);
@@ -459,7 +462,13 @@ int ScreenCapturerWin::Destroy() {
 
 void ScreenCapturerWin::EmitCapturedFrame(
     unsigned char* data, int size, int width, int height,
-    const char* stream_id, const MiniRtcNativeVideoFrame* native_frame) {
+    const char* stream_id, const MiniRtcNativeVideoFrame* native_frame,
+    bool from_secure_desktop) {
+  // Secure-desktop capture takes priority; remove privacy without dropping
+  // the helper frame or delaying the remote session.
+  if (from_secure_desktop && privacy_ && privacy_->Engaged()) {
+    privacy_->Fail("Secure desktop helper frame arrived; privacy screen will turn off");
+  }
   if (!cb_orig_) {
     return;
   }
@@ -499,11 +508,43 @@ void ScreenCapturerWin::EmitCapturedFrame(
   owned_frame->Release();
 }
 
+void ScreenCapturerWin::RestoreMonitor(int monitor_index) {
+  RebuildAliasesFromImpl();
+  if (monitor_index > 0 && impl_->SwitchTo(monitor_index) != 0) {
+    monitor_index_.store(0, std::memory_order_relaxed);
+  }
+}
+
+bool ScreenCapturerWin::TryStartBackend(
+    std::unique_ptr<ScreenCapturer> candidate, int monitor_index) {
+  if (!candidate) {
+    LOG_WARN("Windows capturer: WGC plugin unavailable");
+    return false;
+  }
+  const char* name = CaptureBackendName(candidate.get());
+  int ret = candidate->Init(fps_, cb_);
+  if (ret == 0)
+    ret = candidate->Start(show_cursor_.load(std::memory_order_relaxed));
+  if (ret != 0) {
+    LOG_WARN("Windows capturer: {} initialization/start failed (ret={})", name,
+             ret);
+    candidate->Destroy();
+    return false;
+  }
+  // Commit only after the replacement is running. Failed candidates release
+  // their resources without replacing the current backend.
+  impl_ = std::move(candidate);
+  RestoreMonitor(monitor_index);
+  LOG_INFO("Windows capturer: started {}", name);
+  return true;
+}
+
 int ScreenCapturerWin::Start(bool show_cursor) {
   if (!impl_) return -1;
   if (running_.load(std::memory_order_relaxed)) {
     return 0;
   }
+  NotifyPrivacyCapture(false);
 
   show_cursor_.store(show_cursor, std::memory_order_relaxed);
   paused_.store(false, std::memory_order_relaxed);
@@ -525,40 +566,23 @@ int ScreenCapturerWin::Start(bool show_cursor) {
     }
   }
   if (ret != 0) {
+    if (capture_method_ != ScreenCaptureMethod::Auto) {
+      LOG_ERROR("Windows capturer: selected backend {} failed to start (ret={})",
+                CaptureBackendName(impl_.get()), ret);
+      return ret;
+    }
     LOG_WARN("Windows capturer: refresh/start failed (ret={}), trying fallback",
              ret);
 
-    auto try_init_start = [&](std::unique_ptr<ScreenCapturer> cand) -> bool {
-      int r = cand->Init(fps_, cb_);
-      if (r != 0) return false;
-      int s = cand->Start(show_cursor);
-      if (s == 0) {
-        impl_ = std::move(cand);
-        impl_is_wgc_plugin_ = false;
-        RebuildAliasesFromImpl();
-        if (requested_monitor > 0 &&
-            impl_->SwitchTo(requested_monitor) != 0) {
-          monitor_index_.store(0, std::memory_order_relaxed);
-        }
-        return true;
-      }
-      return false;
-    };
-
     bool fallback_started = false;
-    if (impl_is_wgc_plugin_) {
-      if (try_init_start(std::make_unique<ScreenCapturerDxgi>())) {
-        LOG_INFO("Windows capturer: fallback to DXGI");
-        fallback_started = true;
-      } else if (try_init_start(std::make_unique<ScreenCapturerGdi>())) {
-        LOG_INFO("Windows capturer: fallback to GDI");
-        fallback_started = true;
-      }
-    } else if (dynamic_cast<ScreenCapturerDxgi*>(impl_.get())) {
-      if (try_init_start(std::make_unique<ScreenCapturerGdi>())) {
-        LOG_INFO("Windows capturer: fallback to GDI");
-        fallback_started = true;
-      }
+    if (dynamic_cast<ScreenCapturerDxgi*>(impl_.get()) &&
+        TryStartBackend(WgcPluginCapturer::Create(), requested_monitor)) {
+      fallback_started = true;
+    }
+    if (!fallback_started && (dynamic_cast<WgcPluginCapturer*>(impl_.get()) ||
+                              dynamic_cast<ScreenCapturerDxgi*>(impl_.get()))) {
+      fallback_started = TryStartBackend(std::make_unique<ScreenCapturerGdi>(),
+                                         requested_monitor);
     }
 
     if (!fallback_started) {
@@ -568,6 +592,7 @@ int ScreenCapturerWin::Start(bool show_cursor) {
   }
 
   running_.store(true, std::memory_order_relaxed);
+  NotifyPrivacyCapture(true);
   secure_desktop_capture_active_.store(false, std::memory_order_relaxed);
   post_secure_desktop_waiting_for_frame_.store(false,
                                                std::memory_order_relaxed);
@@ -581,6 +606,7 @@ int ScreenCapturerWin::Start(bool show_cursor) {
 }
 
 int ScreenCapturerWin::Stop() {
+  NotifyPrivacyCapture(false);
   running_.store(false, std::memory_order_relaxed);
   secure_desktop_capture_active_.store(false, std::memory_order_relaxed);
   post_secure_desktop_waiting_for_frame_.store(false,
@@ -613,6 +639,8 @@ int ScreenCapturerWin::SwitchTo(int monitor_index) {
   const int ret = impl_->SwitchTo(monitor_index);
   if (ret == 0) {
     monitor_index_.store(monitor_index, std::memory_order_relaxed);
+  } else if (privacy_) {
+    privacy_->Fail("Display switch failed; privacy screen will turn off");
   }
   return ret;
 }
@@ -735,53 +763,19 @@ void ScreenCapturerWin::StopSecureCaptureThread() {
 }
 
 bool ScreenCapturerWin::RestartCaptureBackendAfterSecureDesktop() {
+  NotifyPrivacyCapture(false);
   if (!impl_ || !running_.load(std::memory_order_relaxed)) {
     return false;
   }
 
   const bool show_cursor = show_cursor_.load(std::memory_order_relaxed);
   const int current_monitor = monitor_index_.load(std::memory_order_relaxed);
-  auto restore_monitor = [&]() {
-    RebuildAliasesFromImpl();
-    if (current_monitor > 0 && impl_->SwitchTo(current_monitor) != 0) {
-      monitor_index_.store(0, std::memory_order_relaxed);
-    }
-  };
-  auto try_started_backend = [&](std::unique_ptr<ScreenCapturer> cand,
-                                 const char* name,
-                                 bool is_wgc_plugin) -> bool {
-    if (!cand) {
-      return false;
-    }
-    const int init_ret = cand->Init(fps_, cb_);
-    if (init_ret != 0) {
-      LOG_WARN("Windows capturer: {} init after secure desktop failed (ret={})",
-               name, init_ret);
-      return false;
-    }
-    const int start_ret = cand->Start(show_cursor);
-    if (start_ret != 0) {
-      LOG_WARN(
-          "Windows capturer: {} start after secure desktop failed (ret={})",
-          name, start_ret);
-      cand->Destroy();
-      return false;
-    }
-    if (impl_) {
-      impl_->Destroy();
-    }
-    impl_ = std::move(cand);
-    impl_is_wgc_plugin_ = is_wgc_plugin;
-    restore_monitor();
-    LOG_INFO("Windows capturer: restarted {} after secure desktop", name);
-    return true;
-  };
 
   LOG_INFO("Windows capturer: restarting capture backend after secure desktop");
   impl_->Stop();
   int ret = impl_->Start(show_cursor);
   if (ret == 0) {
-    restore_monitor();
+    RestoreMonitor(current_monitor);
     return true;
   }
 
@@ -795,20 +789,16 @@ bool ScreenCapturerWin::RestartCaptureBackendAfterSecureDesktop() {
     ret = impl_->Start(show_cursor);
   }
   if (ret == 0) {
-    restore_monitor();
+    RestoreMonitor(current_monitor);
     return true;
   }
 
-  if (impl_is_wgc_plugin_ &&
-      try_started_backend(WgcPluginCapturer::Create(), "WGC plugin", true)) {
-    return true;
-  }
-  if (try_started_backend(std::make_unique<ScreenCapturerDxgi>(), "DXGI",
-                          false)) {
-    return true;
-  }
-  if (try_started_backend(std::make_unique<ScreenCapturerGdi>(), "GDI",
-                          false)) {
+  if ((IsBackendEnabled(ScreenCaptureMethod::Dxgi) &&
+       TryStartBackend(std::make_unique<ScreenCapturerDxgi>(), current_monitor)) ||
+      (IsBackendEnabled(ScreenCaptureMethod::Wgc) &&
+       TryStartBackend(WgcPluginCapturer::Create(), current_monitor)) ||
+      (IsBackendEnabled(ScreenCaptureMethod::Gdi) &&
+       TryStartBackend(std::make_unique<ScreenCapturerGdi>(), current_monitor))) {
     return true;
   }
 
@@ -1123,6 +1113,12 @@ void ScreenCapturerWin::SecureDesktopCaptureLoop() {
   std::vector<uint8_t> secure_frame;
 
   while (running_.load(std::memory_order_relaxed)) {
+    // Privacy covers belong to the ordinary desktop. Drop privacy on a
+    // secure desktop, while continuing the normal helper capture path.
+    if (privacy_ && privacy_->Engaged()) {
+      if (!IsWindowsPrivacyDesktopAvailable())
+        privacy_->Fail("Secure desktop or lock screen; privacy screen will turn off. Privacy cannot cover Windows security UI.");
+    }
     if (paused_.load(std::memory_order_relaxed)) {
       std::this_thread::sleep_for(std::chrono::milliseconds(10));
       continue;
@@ -1295,7 +1291,7 @@ void ScreenCapturerWin::SecureDesktopCaptureLoop() {
     if (frame_delivered && !secure_frame.empty()) {
       EmitCapturedFrame(secure_frame.data(),
                         static_cast<int>(secure_frame.size()), captured_width,
-                        captured_height, display_name.c_str());
+                        captured_height, display_name.c_str(), nullptr, true);
     }
 
     if (!frame_delivered && !frame_pending) {

apps/desktop/src/platform/windows/screen_capturer/screen_capturer_win.h

@@ -20,6 +20,8 @@
 #include <vector>
 
 #include "screen_capturer.h"
+#include "screen_capture_method.h"
+#include "privacy_controller.h"
 
 namespace crossdesk {
 
@@ -43,10 +45,19 @@ class ScreenCapturerWin : public ScreenCapturer {
   int ResetToInitialMonitor() override;
 
   std::vector<DisplayInfo> GetDisplayInfoList() override;
+  void SetPrivacyController(PrivacyController* privacy) override { privacy_ = privacy; }
+  // Set before Init(), while capture is stopped.
+  void SetCaptureMethod(ScreenCaptureMethod method) { capture_method_ = method; }
 
  private:
   std::unique_ptr<ScreenCapturer> impl_;
-  bool impl_is_wgc_plugin_ = false;
+  ScreenCaptureMethod capture_method_ = ScreenCaptureMethod::Auto;
+  bool IsBackendEnabled(ScreenCaptureMethod method) const {
+    return capture_method_ == ScreenCaptureMethod::Auto ||
+           capture_method_ == method;
+  }
+  PrivacyController* privacy_ = nullptr;
+  void NotifyPrivacyCapture(bool running);
   int fps_ = 60;
   cb_desktop_data cb_;
   cb_desktop_data cb_orig_;
@@ -86,9 +97,13 @@ class ScreenCapturerWin : public ScreenCapturer {
 
   void BuildCanonicalFromImpl();
   void RebuildAliasesFromImpl();
+  void RestoreMonitor(int monitor_index);
+  bool TryStartBackend(std::unique_ptr<ScreenCapturer> candidate,
+                       int monitor_index);
   void EmitCapturedFrame(unsigned char* data, int size, int width, int height,
                          const char* stream_id,
-                         const MiniRtcNativeVideoFrame* native_frame = nullptr);
+                         const MiniRtcNativeVideoFrame* native_frame = nullptr,
+                         bool from_secure_desktop = false);
   void StopSecureCaptureThread();
   bool RestartCaptureBackendAfterSecureDesktop();
   void SecureDesktopCaptureLoop();

apps/desktop/src/platform/windows/screen_capturer/wgc_session_impl.cpp

@@ -339,6 +339,7 @@ void WgcSessionImpl::OnClosed(
     winrt::Windows::Graphics::Capture::GraphicsCaptureItem const&,
     winrt::Windows::Foundation::IInspectable const&) {
   std::lock_guard locker(lock_);
+  if (observer_) observer_->OnFrame({}, id_);
   const bool was_running = is_running_;
   const bool was_paused = is_paused_;
   try {

apps/desktop/src/platform/windows/windows_thread_dpi.h

@@ -0,0 +1,53 @@
+/*
+ * @Author: DI JUNKUN
+ * @Date: 2026-09-10
+ * Copyright (c) 2026 by DI JUNKUN, All Rights Reserved.
+ */
+
+#ifndef _WINDOWS_THREAD_DPI_H_
+#define _WINDOWS_THREAD_DPI_H_
+
+#include <Windows.h>
+
+namespace crossdesk {
+
+// Keep newer DPI entry points out of the import table: privacy capability
+// checks must still be able to report unsupported on pre-2004 Windows.
+class ScopedWindowsPhysicalCoordinates {
+ public:
+  using SetContext = DPI_AWARENESS_CONTEXT(WINAPI*)(DPI_AWARENESS_CONTEXT);
+  ScopedWindowsPhysicalCoordinates() {
+    setter_ = reinterpret_cast<SetContext>(GetProcAddress(
+        GetModuleHandleW(L"user32.dll"), "SetThreadDpiAwarenessContext"));
+    if (setter_) {
+      previous_ = setter_(DPI_AWARENESS_CONTEXT_PER_MONITOR_AWARE_V2);
+      // Ordinary remote input retains compatibility with Windows 10 1607.
+      // The privacy backend itself requires build 19041 before using this.
+      if (!previous_)
+        previous_ = setter_(DPI_AWARENESS_CONTEXT_PER_MONITOR_AWARE);
+    }
+  }
+  ~ScopedWindowsPhysicalCoordinates() {
+    if (setter_ && previous_) setter_(previous_);
+  }
+  ScopedWindowsPhysicalCoordinates(const ScopedWindowsPhysicalCoordinates&) =
+      delete;
+  ScopedWindowsPhysicalCoordinates& operator=(
+      const ScopedWindowsPhysicalCoordinates&) = delete;
+  bool active() const { return previous_ != nullptr; }
+
+ private:
+  SetContext setter_ = nullptr;
+  DPI_AWARENESS_CONTEXT previous_ = nullptr;
+};
+
+inline UINT PrivacyWindowDpi(HWND hwnd) {
+  using GetDpi = UINT(WINAPI*)(HWND);
+  static const auto get_dpi = reinterpret_cast<GetDpi>(
+      GetProcAddress(GetModuleHandleW(L"user32.dll"), "GetDpiForWindow"));
+  return get_dpi ? get_dpi(hwnd) : 96;
+}
+
+}  // namespace crossdesk
+
+#endif  // _WINDOWS_THREAD_DPI_H_

apps/desktop/src/privacy/privacy_backend.h

@@ -0,0 +1,66 @@
+/*
+ * @Author: DI JUNKUN
+ * @Date: 2026-09-10
+ * Copyright (c) 2026 by DI JUNKUN, All Rights Reserved.
+ */
+
+#ifndef _PRIVACY_BACKEND_H_
+#define _PRIVACY_BACKEND_H_
+
+#include <memory>
+#include <string>
+
+namespace crossdesk {
+
+struct PrivacyScreenText {
+  std::string unlock_hint = "To turn off the privacy screen, press";
+};
+
+struct PrivacyCapabilities {
+  bool overlay = false;
+  bool block_input = false;
+  std::string reason;
+};
+
+struct PrivacyHealth {
+  std::string failure;
+  bool emergency_exit = false;
+  bool ready = true;
+};
+
+// Lifecycle, message pumping and native resource operations run on the
+// controller's message thread. Const metadata queries are serialized with
+// those operations by the controller mutex and must not call native UI APIs.
+// AppKit work is queued to the main thread without waiting under this mutex.
+class PrivacyBackend {
+ public:
+  virtual ~PrivacyBackend() = default;
+  virtual PrivacyCapabilities Query() = 0;
+  virtual bool Enable(bool block_input, const PrivacyScreenText& text,
+                      std::string& error) = 0;
+  virtual void Recover() = 0;
+  virtual bool IsRecovered() const = 0;
+  virtual bool RecoveryPending() const { return false; }
+  virtual PrivacyHealth Poll() = 0;
+  // Wait on both native window messages and controller commands.
+  // Wake is the only backend operation callable from another thread.
+  virtual void WaitForEvents(unsigned timeout_ms) = 0;
+  virtual void Wake() = 0;
+};
+
+#ifdef _WIN32
+std::unique_ptr<PrivacyBackend> CreateWindowsPrivacyBackend();
+bool IsWindowsPrivacyDesktopAvailable();
+#endif
+#ifdef __APPLE__
+std::unique_ptr<PrivacyBackend> CreateMacPrivacyBackend();
+// Flush queued AppKit cleanup after joining the controller at app shutdown.
+void FlushMacPrivacyTasks();
+#endif
+#ifdef __linux__
+std::unique_ptr<PrivacyBackend> CreateLinuxPrivacyBackend();
+#endif
+
+}  // namespace crossdesk
+
+#endif  // _PRIVACY_BACKEND_H_

apps/desktop/src/privacy/privacy_controller.cpp

@@ -0,0 +1,210 @@
+/* Copyright (c) 2026 by DI JUNKUN, All Rights Reserved. */
+#include "privacy_controller.h"
+#include <chrono>
+#include <cstring>
+#include "rd_log.h"
+
+namespace crossdesk {
+uint64_t PrivacyController::Now() {
+  return std::chrono::duration_cast<std::chrono::milliseconds>(
+      std::chrono::steady_clock::now().time_since_epoch()).count();
+}
+PrivacyController::PrivacyController(Factory factory) {
+  status_.state = PrivacyState::unsupported;
+  std::strcpy(status_.reason, "Privacy screen is not available on this platform");
+#ifdef _WIN32
+  if (!factory) factory = CreateWindowsPrivacyBackend;
+#elif defined(__APPLE__)
+  if (!factory) factory = CreateMacPrivacyBackend;
+#elif defined(__linux__)
+  if (!factory) factory = CreateLinuxPrivacyBackend;
+#endif
+  thread_ = std::thread([this, factory] { Run(factory); });
+}
+PrivacyController::~PrivacyController() { Shutdown(); }
+void PrivacyController::WakeLocked() {
+  if (backend_) backend_->Wake();
+  wake_.notify_all();
+}
+void PrivacyController::Shutdown() {
+  {
+    std::lock_guard lock(mutex_);
+    quit_ = true;
+    WakeLocked();
+  }
+  if (thread_.joinable()) thread_.join();
+#ifdef __APPLE__
+  FlushMacPrivacyTasks();
+#endif
+}
+PrivacyStatus PrivacyController::Snapshot() const {
+  std::lock_guard lock(mutex_);
+  return status_;
+}
+void PrivacyController::SetText(const PrivacyScreenText& text) {
+  std::lock_guard lock(mutex_);
+  text_ = text;
+}
+void PrivacyController::SetState(PrivacyState state, const std::string& reason) {
+  status_.state = state;
+  status_.remote_paused = false; // Wire compatibility; privacy never pauses a session.
+  ++status_.revision;
+  std::strncpy(status_.reason, reason.c_str(), sizeof(status_.reason) - 1);
+  status_.reason[sizeof(status_.reason) - 1] = '\0';
+  LOG_INFO("Privacy: state={}, overlay={}, input_blocked={}, reason={}",
+           static_cast<int>(state), status_.overlay_active, status_.input_blocked, reason);
+}
+void PrivacyController::Enable(bool block_input) {
+  std::lock_guard lock(mutex_);
+  if (quit_ || engaged_.load() || disable_pending_) return;
+  if (!status_.supported || (block_input && !status_.input_block_supported)) {
+    SetState(PrivacyState::unsupported, "Privacy screen is unavailable");
+    return;
+  }
+  engaged_.store(true);
+  block_requested_ = block_input;
+  automatic_enable_ = false;
+  enable_pending_ = true;
+  failure_.clear();
+  started_ = Now();
+  SetState(PrivacyState::starting, "Enabling privacy screen");
+  WakeLocked();
+}
+void PrivacyController::EnableOnConnection() {
+  std::lock_guard lock(mutex_);
+  if (quit_ || (engaged_.load() && !disable_pending_)) return;
+  // A reconnect may arrive before asynchronous AppKit recovery has completed.
+  engaged_.store(true);
+  block_requested_ = true;
+  automatic_enable_ = true;
+  enable_pending_ = true;
+  failure_.clear();
+  started_ = Now();
+  SetState(PrivacyState::starting, "Enabling privacy on connection");
+  WakeLocked();
+}
+void PrivacyController::Disable() {
+  std::lock_guard lock(mutex_);
+  if (quit_) return;
+  enable_pending_ = false;
+  failure_.clear();
+  disable_pending_ = true;
+  SetState(PrivacyState::stopping, "Restoring local desktop and input");
+  WakeLocked();
+}
+void PrivacyController::Disconnected() { Disable(); }
+void PrivacyController::FailLocked(const std::string& reason) {
+  if (!engaged_.load() || disable_pending_) return;
+  failure_ = reason;
+  enable_pending_ = false;
+  disable_pending_ = true;
+  SetState(PrivacyState::failed, reason);
+  WakeLocked();
+}
+void PrivacyController::Fail(const std::string& reason) {
+  std::lock_guard lock(mutex_);
+  FailLocked(reason);
+}
+void PrivacyController::CaptureChanged(bool running) {
+  std::lock_guard lock(mutex_);
+  // Windows announces a stopped capture while preparing the first session.
+  // Keep automatic privacy pending until capture starts, within its deadline.
+  // Once capture was running or backend enable began, a stop remains a fault.
+  const bool waiting_for_initial_capture =
+      automatic_enable_ && enable_pending_ && !capture_running_;
+  capture_running_ = running;
+  if (!running && !waiting_for_initial_capture)
+    FailLocked("Capture changed; privacy screen is being turned off");
+  WakeLocked();
+}
+void PrivacyController::Run(Factory factory) {
+  std::unique_lock lock(mutex_);
+  try {
+    if (factory) backend_ = factory();
+    while (!quit_) {
+      if (last_capability_check_ == 0 ||
+          (!engaged_.load() && Now() - last_capability_check_ >= 2000)) {
+        last_capability_check_ = Now();
+        const auto caps = backend_ ? backend_->Query() : PrivacyCapabilities{};
+        const bool changed = status_.supported != caps.overlay ||
+                             status_.input_block_supported != caps.block_input;
+        status_.supported = caps.overlay;
+        status_.input_block_supported = caps.block_input;
+        if (!engaged_.load() && (changed || status_.revision == 0))
+          SetState(caps.overlay ? PrivacyState::off : PrivacyState::unsupported, caps.reason);
+      }
+      if (disable_pending_) {
+        if (backend_) backend_->Recover();
+        if (backend_ && backend_->RecoveryPending()) {
+          lock.unlock();
+          backend_->WaitForEvents(25);
+          lock.lock();
+          continue;
+        }
+        disable_pending_ = false;
+        if (backend_ && !backend_->IsRecovered()) {
+          enable_pending_ = false;
+          disable_pending_ = true; // Retry native cleanup without affecting the session.
+          SetState(PrivacyState::failed, "Could not release every privacy resource");
+        } else {
+          status_.overlay_active = status_.input_blocked = false;
+          if (!enable_pending_) {
+            engaged_.store(false);
+            SetState(failure_.empty() ? PrivacyState::off : PrivacyState::failed,
+                     failure_.empty() ? "Privacy screen is off" : failure_);
+          }
+        }
+      }
+      if (enable_pending_) {
+        const auto caps = backend_ ? backend_->Query() : PrivacyCapabilities{};
+        status_.supported = caps.overlay;
+        status_.input_block_supported = caps.block_input;
+        if (!caps.overlay || (block_requested_ && !caps.block_input)) {
+          FailLocked("Privacy screen unavailable: " + caps.reason);
+        } else if (!capture_running_) {
+          if (!automatic_enable_ || Now() - started_ > 10000)
+            FailLocked("No desktop capture available for privacy screen");
+        } else {
+          enable_pending_ = false;
+          std::string error;
+          if (!backend_->Enable(block_requested_, text_, error)) {
+            FailLocked(error);
+          } else {
+            status_.overlay_active = true;
+            status_.input_blocked = block_requested_;
+            started_ = Now();
+          }
+        }
+      }
+      const auto health = backend_ ? backend_->Poll() : PrivacyHealth{};
+      if (engaged_.load() && !disable_pending_) {
+        if (health.emergency_exit) {
+          failure_.clear();
+          enable_pending_ = false;
+          disable_pending_ = true;
+          SetState(PrivacyState::stopping, "Local shortcut: restoring desktop and input");
+        } else if (!health.failure.empty()) {
+          FailLocked(health.failure);
+        } else if (!enable_pending_ && status_.state == PrivacyState::starting) {
+          if (health.ready)
+            SetState(PrivacyState::on, "Privacy screen is on");
+          else if (Now() - started_ > 3000)
+            FailLocked("Privacy screen did not become ready");
+        }
+      }
+      if (backend_) {
+        const unsigned timeout = engaged_.load() || disable_pending_ ? 25 : 2000;
+        lock.unlock();
+        backend_->WaitForEvents(timeout);
+        lock.lock();
+      } else {
+        wake_.wait(lock, [this] { return quit_ || enable_pending_ || disable_pending_; });
+      }
+    }
+  } catch (const std::exception& e) {
+    if (!lock.owns_lock()) lock.lock();
+    SetState(PrivacyState::failed, std::string("Privacy component failed: ") + e.what());
+  }
+  if (backend_) { backend_->Recover(); backend_.reset(); }
+}
+}  // namespace crossdesk

apps/desktop/src/privacy/privacy_controller.h

@@ -0,0 +1,59 @@
+/* Copyright (c) 2026 by DI JUNKUN, All Rights Reserved. */
+#ifndef _PRIVACY_CONTROLLER_H_
+#define _PRIVACY_CONTROLLER_H_
+
+#include <remote_action.h>
+#include <atomic>
+#include <condition_variable>
+#include <functional>
+#include <mutex>
+#include <thread>
+#include "privacy_backend.h"
+
+namespace crossdesk {
+
+// Privacy is optional: it must never gate desktop video, audio or remote input.
+// A failed backend is recovered automatically while the session keeps running.
+class PrivacyController {
+ public:
+  using Factory = std::function<std::unique_ptr<PrivacyBackend>()>;
+  explicit PrivacyController(Factory factory = {});
+  ~PrivacyController();
+  PrivacyController(const PrivacyController&) = delete;
+  PrivacyController& operator=(const PrivacyController&) = delete;
+  PrivacyStatus Snapshot() const;
+  void SetText(const PrivacyScreenText& text);
+  void Enable(bool block_input);
+  void EnableOnConnection();
+  void Disable();
+  void Disconnected();
+  void Shutdown();
+  void Fail(const std::string& reason);
+  bool Engaged() const { return engaged_.load(); }
+  void CaptureChanged(bool running);
+
+ private:
+  void Run(Factory factory);
+  void WakeLocked();
+  void SetState(PrivacyState state, const std::string& reason);
+  void FailLocked(const std::string& reason);
+  static uint64_t Now();
+  mutable std::mutex mutex_;
+  std::condition_variable wake_;
+  std::thread thread_;
+  std::unique_ptr<PrivacyBackend> backend_;
+  PrivacyStatus status_{};
+  PrivacyScreenText text_;
+  std::atomic<bool> engaged_{false};
+  bool quit_ = false;
+  bool enable_pending_ = false;
+  bool disable_pending_ = false;
+  bool block_requested_ = false;
+  bool automatic_enable_ = false;
+  bool capture_running_ = false;
+  std::string failure_;
+  uint64_t started_ = 0;
+  uint64_t last_capability_check_ = 0;
+};
+}  // namespace crossdesk
+#endif

apps/desktop/src/screen_capturer/screen_capture_method.h

@@ -0,0 +1,22 @@
+/*
+ * @Author: DI JUNKUN
+ * @Date: 2026-09-11
+ * Copyright (c) 2026 by DI JUNKUN, All Rights Reserved.
+ */
+
+#ifndef _SCREEN_CAPTURE_METHOD_H_
+#define _SCREEN_CAPTURE_METHOD_H_
+
+namespace crossdesk {
+
+// Persisted values; keep these in the same order as the settings choices.
+enum class ScreenCaptureMethod { Auto = 0, Dxgi = 1, Wgc = 2, Gdi = 3 };
+
+inline bool IsValidScreenCaptureMethod(long value) {
+  return value >= static_cast<long>(ScreenCaptureMethod::Auto) &&
+         value <= static_cast<long>(ScreenCaptureMethod::Gdi);
+}
+
+}  // namespace crossdesk
+
+#endif

apps/desktop/src/screen_capturer/screen_capturer.h

@@ -14,8 +14,13 @@
 
 namespace crossdesk {
 
+class PrivacyController;
+
 class ScreenCapturer {
  public:
+  // Windows backends emit a control-only callback BEFORE automatic recovery.
+  // No video buffer accompanies this notification; wrappers must consume it.
+  static constexpr int kBackendReset = -1;
   // |stream_id| is a logical MiniRTC stream ID (DisplayN), not a platform
   // display name or physical handle. |native_frame| is borrowed for the
   // duration of the callback; retain its owner before using it asynchronously.
@@ -29,6 +34,7 @@ class ScreenCapturer {
 
  public:
   virtual int Init(const int fps, cb_desktop_data cb) = 0;
+  virtual void SetPrivacyController(PrivacyController*) {}
   virtual int Destroy() = 0;
   virtual int Start(bool show_cursor) = 0;
   virtual int Stop() = 0;

apps/desktop/tests/build_define_scope_test.lua

@@ -0,0 +1,78 @@
+-- Run from the repository root: xmake lua apps/desktop/tests/build_define_scope_test.lua windows true
+-- Inspect the real Xmake target graph without configuring/downloading packages.
+function main(plat, portable)
+    import("core.project.config")
+    import("core.project.project")
+    config.load()
+    config.set("plat", plat or "windows", {force = true})
+    config.set("arch", plat == "macosx" and "arm64" or "x64", {force = true})
+    config.set("CROSSDESK_PORTABLE", portable == "true", {force = true})
+    config.set("CROSSDESK_VERSION", "v1.5.3-2-20260913", {force = true})
+    local targets = project.targets()
+    local function flatten(values)
+        local result = {}
+        local function append(value)
+            if type(value) == "table" then
+                for _, entry in ipairs(value) do append(entry) end
+            elseif value ~= nil then
+                table.insert(result, value)
+            end
+        end
+        append(values)
+        return result
+    end
+    local function contains(values, expected)
+        return table.contains(flatten(values), expected)
+    end
+    local function effective_defines(target)
+        return table.join(table.wrap(target:get("defines")),
+            flatten(target:get_from("defines", "dep::*")))
+    end
+
+    for _, name in ipairs({"minirtc", "media", "common", "crossdesk_wire", "rd_log"}) do
+        for _, define in ipairs(effective_defines(targets[name])) do
+            assert(not define:startswith("CROSSDESK_VERSION"), name .. " inherits version macros")
+            assert(not define:startswith("CROSSDESK_PORTABLE"), name .. " inherits portable macros")
+        end
+    end
+    for _, name in ipairs({"gui", "crossdesk", "path_manager"}) do
+        assert(contains(effective_defines(targets[name]), "CROSSDESK_PORTABLE=1") ==
+            (portable == "true"), name .. " has inconsistent portable layout/configuration")
+    end
+
+    local gui = targets.gui
+    local version_files = {
+        ["apps/desktop/src/gui/application/gui_application.cpp"] = true,
+        ["apps/desktop/src/gui/runtime/peer_event_handler.cpp"] = true
+    }
+    local seen = {}
+    for _, file in ipairs(gui:sourcefiles()) do
+        assert(not seen[file], "duplicate GUI source: " .. file)
+        seen[file] = true
+        local defines = (gui:fileconfig(file) or {}).defines
+        assert(contains(defines, 'CROSSDESK_VERSION="v1.5.3-2-20260913"') ==
+            (version_files[file] == true), "unexpected version scope: " .. file)
+    end
+    for file in pairs(version_files) do
+        assert(seen[file], "missing version consumer: " .. file)
+    end
+
+    if plat == "windows" then
+        local resources = {
+            crossdesk = portable == "true" and "crossdesk_portable" or "crossdesk",
+            crossdesk_service = "crossdesk_service",
+            crossdesk_session_helper = "crossdesk_session_helper",
+            crossdesk_privacy_window = "crossdesk_privacy_window",
+            wgc_plugin = "wgc_plugin"
+        }
+        for name, resource in pairs(resources) do
+            local defines = targets[name]:fileconfig(
+                "apps/desktop/resources/windows/" .. resource .. ".rc").defines
+            assert(contains(defines, 'CROSSDESK_VERSION_STRING="v1.5.3-2-20260913"'))
+            assert(contains(defines, "CROSSDESK_VERSION_NUMERIC=1,5,3,0"))
+            assert(contains(defines, "CROSSDESK_PORTABLE=1") ==
+                (name == "crossdesk_session_helper" and portable == "true"))
+        end
+    end
+    print("Build define scopes passed: %s portable=%s", plat, portable)
+end

apps/desktop/tests/windows_mouse_controller_safety_test.cpp

@@ -56,8 +56,6 @@ int main() {
   bool ok = true;
   ok &= ExpectContains("mouse_controller.cpp", mouse_controller,
                        "INPUT ip = {0};");
-  ok &= ExpectContains("mouse_controller.cpp", mouse_controller,
-                       "SetCursorPos failed");
   ok &= ExpectContains("mouse_controller.cpp", mouse_controller,
                        "SendInput failed for mouse");
   return ok ? 0 : 1;

apps/desktop/xmake/options.lua

@@ -29,30 +29,6 @@ function setup_options_and_dependencies()
         set_description("Build CrossDesk as a portable package that stores data beside the executable")
     option_end()
 
-    -- Preserve the existing codebase/toolchain contract. Slint targets opt in to
-    -- C++20 locally because its generated C++ API requires it.
-    local crossdesk_version = get_config("CROSSDESK_VERSION") or "0.0.0"
-    local version_base = crossdesk_version:gsub("^v", ""):match("^(%d[%d%.]*)") or "0.0.0"
-    local version_parts = {}
-    for part in version_base:gmatch("%d+") do
-        local value = tonumber(part) or 0
-        if value > 65535 then
-            value = 0
-        end
-        table.insert(version_parts, value)
-        if #version_parts == 4 then
-            break
-        end
-    end
-    while #version_parts < 4 do
-        table.insert(version_parts, 0)
-    end
-
-    add_defines("CROSSDESK_VERSION_STRING=\"" .. crossdesk_version .. "\"")
-    if is_os("windows") then
-        add_defines("CROSSDESK_VERSION_NUMERIC=" .. table.concat(version_parts, ","))
-    end
-
     -- set_policy("build.warning", true)
     -- set_warnings("all", "extra")
     -- add_cxxflags("/W4", "/WX")
@@ -61,10 +37,6 @@ function setup_options_and_dependencies()
     add_defines("USE_CUDA=" .. (is_config("USE_CUDA", true) and "1" or "0"))
     add_defines("USE_WAYLAND=" .. (is_config("USE_WAYLAND", true) and "1" or "0"))
     add_defines("USE_DRM=" .. (is_config("USE_DRM", true) and "1" or "0"))
-    if is_config("CROSSDESK_PORTABLE", true) then
-        add_defines("CROSSDESK_PORTABLE=1")
-    end
-
     if is_mode("debug") then
         add_defines("CROSSDESK_DEBUG")
     end

apps/desktop/xmake/targets.lua

@@ -3,6 +3,30 @@ function setup_targets()
 
     includes("deps/submodules", "deps/thirdparty")
 
+    local crossdesk_version = get_config("CROSSDESK_VERSION") or "0.0.0"
+    local version_define = "CROSSDESK_VERSION=\"" .. crossdesk_version .. "\""
+    local windows_resource_defines = {
+        "CROSSDESK_VERSION_STRING=\"" .. crossdesk_version .. "\""
+    }
+    local version_base = crossdesk_version:gsub("^v", ""):match("^(%d[%d%.]*)") or "0.0.0"
+    local version_parts = {}
+    for part in version_base:gmatch("%d+") do
+        local value = tonumber(part) or 0
+        table.insert(version_parts, value <= 65535 and value or 0)
+        if #version_parts == 4 then
+            break
+        end
+    end
+    while #version_parts < 4 do
+        table.insert(version_parts, 0)
+    end
+    table.insert(windows_resource_defines,
+        "CROSSDESK_VERSION_NUMERIC=" .. table.concat(version_parts, ","))
+    local windows_helper_resource_defines = table.join(windows_resource_defines)
+    if is_config("CROSSDESK_PORTABLE", true) then
+        table.insert(windows_helper_resource_defines, "CROSSDESK_PORTABLE=1")
+    end
+
     local function copy_slint_runtime(target)
         if not target:is_plat("windows") then
             return
@@ -50,6 +74,9 @@ function setup_targets()
 
     target("path_manager")
         set_kind("object")
+        if is_config("CROSSDESK_PORTABLE", true) then
+            add_defines("CROSSDESK_PORTABLE=1")
+        end
         add_deps("rd_log")
         add_files("apps/desktop/src/path_manager/*.cpp")
         if is_os("windows") then
@@ -156,12 +183,48 @@ function setup_targets()
             add_frameworks("Security", "CoreFoundation")
         end
 
+    target("privacy")
+        set_kind("object")
+        add_deps("rd_log", "crossdesk_wire")
+        add_files("apps/desktop/src/privacy/privacy_controller.cpp")
+        add_includedirs("apps/desktop/src/privacy", {public = true})
+        if is_os("windows") then
+            add_files("apps/desktop/src/platform/windows/privacy/*.cpp")
+            add_deps("crossdesk_privacy_cursor_helper")
+            add_deps("crossdesk_privacy_window", {inherit = false})
+            add_includedirs("apps/desktop/src/platform/windows/input")
+            add_syslinks("Wtsapi32", "Ole32", {public = true})
+        elseif is_os("macosx") then
+            add_files("apps/desktop/src/platform/macos/privacy/*.mm")
+            add_mxxflags("-fobjc-arc")
+            add_frameworks("AppKit", "ApplicationServices", {public = true})
+        elseif is_os("linux") then
+            add_files("apps/desktop/src/platform/linux/privacy/*.cpp")
+            add_syslinks("Xi", {public = true})
+        end
+
+    if is_os("windows") then
+        target("crossdesk_privacy_window")
+            set_kind("shared")
+            set_runtimes("MT")
+            add_files("apps/desktop/src/platform/windows/privacy/band_module/main.cpp")
+            add_files("apps/desktop/src/platform/windows/privacy/band_module/privacy_cover_renderer.cpp")
+            add_files("apps/desktop/resources/windows/crossdesk_privacy_window.rc",
+                {defines = windows_resource_defines})
+            add_syslinks("user32", "gdi32", "dwmapi")
+
+        target("crossdesk_privacy_cursor_helper")
+            set_kind("binary")
+            add_files("apps/desktop/src/platform/windows/privacy/cursor_helper/main.cpp")
+    end
+
     target("screen_capturer")
         set_kind("object")
         add_deps("rd_log", "common", "crossdesk_wire")
         add_includedirs("apps/desktop/src/screen_capturer", {public = true})
         add_includedirs("deps/submodules/minirtc/src/api", {public = true})
         if is_os("windows") then
+            add_deps("privacy")
             add_packages("libyuv")
             add_files("apps/desktop/src/screen_capturer/captured_nv12_frame.cpp")
             add_files("apps/desktop/src/platform/windows/screen_capturer/screen_capturer_dxgi.cpp",
@@ -171,10 +234,13 @@ function setup_targets()
             add_includedirs("apps/desktop/src/platform/windows/screen_capturer",
                 "apps/desktop/src/platform/windows/service")
         elseif is_os("macosx") then
+            add_deps("privacy")
+            add_mxxflags("-fobjc-arc")
             add_files("apps/desktop/src/platform/macos/screen_capturer/*.cpp",
                 "apps/desktop/src/platform/macos/screen_capturer/*.mm")
             add_includedirs("apps/desktop/src/platform/macos/screen_capturer")
         elseif is_os("linux") then
+            add_deps("privacy")
             add_packages("libyuv")
             add_files("apps/desktop/src/platform/linux/screen_capturer/screen_capturer_linux.cpp")
             add_files("apps/desktop/src/platform/linux/screen_capturer/screen_capturer_x11.cpp")
@@ -270,7 +336,8 @@ function setup_targets()
         set_kind("object")
         add_deps("rd_log", "autostart")
         add_files("apps/desktop/src/config_center/*.cpp")
-        add_includedirs("apps/desktop/src/config_center", {public = true})
+        add_includedirs("apps/desktop/src", "apps/desktop/src/config_center",
+            {public = true})
 
     target("assets")
         set_kind("headeronly")
@@ -282,7 +349,6 @@ function setup_targets()
     target("version_checker")
         set_kind("object")
         add_packages("cpp-httplib")
-        add_defines("CROSSDESK_VERSION=\"" .. (get_config("CROSSDESK_VERSION") or "Unknown") .. "\"")
         add_deps("rd_log")
         add_files("apps/desktop/src/version_checker/*.cpp")
         add_includedirs("apps/desktop/src/version_checker", {public = true})
@@ -314,11 +380,15 @@ function setup_targets()
         add_packages("slint", {public = true})
         add_packages("libyuv", "tinyfiledialogs")
         add_rules("slint")
-        add_defines("CROSSDESK_VERSION=\"" .. (get_config("CROSSDESK_VERSION") or "Unknown") .. "\"")
+        if is_config("CROSSDESK_PORTABLE", true) then
+            -- RuntimeState changes layout in portable builds. Consumers of GUI
+            -- headers must see the same definition, without affecting its deps.
+            add_defines("CROSSDESK_PORTABLE=1", {public = true})
+        end
         add_deps("rd_log", "common", "assets", "config_center", "minirtc",
             "path_manager", "screen_capturer", "speaker_capturer",
             "device_controller", "thumbnail", "version_checker", "tools",
-            "crossdesk_wire")
+            "crossdesk_wire", "privacy")
         add_files("apps/desktop/src/gui/render.cpp", "apps/desktop/src/gui/application/gui_application.cpp",
             "apps/desktop/src/gui/rendering/*.cpp",
             "apps/desktop/src/gui/runtime/*.cpp",
@@ -326,6 +396,11 @@ function setup_targets()
             "apps/desktop/src/gui/features/devices/*.cpp", "apps/desktop/src/gui/features/input/*.cpp",
             "apps/desktop/src/gui/features/clipboard/*.cpp", "apps/desktop/src/gui/features/file_transfer/*.cpp",
             "apps/desktop/src/gui/features/settings/*.cpp", "apps/desktop/src/gui/ui/crossdesk_ui.slint")
+        -- Only these translation units consume the application version. Keep
+        -- version changes out of the flags for media and the rest of the GUI.
+        add_files("apps/desktop/src/gui/application/gui_application.cpp",
+            "apps/desktop/src/gui/runtime/peer_event_handler.cpp",
+            {defines = version_define})
         add_includedirs("apps/desktop/src", "apps/desktop/src/gui", {public = true})
         add_includedirs("apps/desktop/src/platform/common/input")
         if is_os("windows") then
@@ -377,7 +452,8 @@ function setup_targets()
             add_files("apps/desktop/src/platform/windows/screen_capturer/screen_capturer_wgc.cpp",
                 "apps/desktop/src/platform/windows/screen_capturer/wgc_session_impl.cpp",
                 "apps/desktop/src/platform/windows/screen_capturer/wgc_plugin_entry.cpp")
-            add_files("apps/desktop/resources/windows/wgc_plugin.rc")
+            add_files("apps/desktop/resources/windows/wgc_plugin.rc",
+                {defines = windows_resource_defines})
             add_includedirs("apps/desktop/src/common", "apps/desktop/src/screen_capturer",
                 "apps/desktop/src/platform/windows/screen_capturer",
                 "deps/submodules/minirtc/src/api")
@@ -388,7 +464,8 @@ function setup_targets()
             add_links("Advapi32", "Wtsapi32", "Ole32", "Userenv")
             add_files("apps/desktop/src/platform/windows/service/main.cpp",
                 "apps/desktop/src/platform/windows/service/service_host.cpp")
-            add_files("apps/desktop/resources/windows/crossdesk_service.rc")
+            add_files("apps/desktop/resources/windows/crossdesk_service.rc",
+                {defines = windows_resource_defines})
             add_includedirs("apps/desktop/src/platform/windows/service")
 
         target("crossdesk_session_helper")
@@ -397,7 +474,8 @@ function setup_targets()
             add_deps("rd_log", "path_manager")
             add_links("Advapi32", "User32", "Wtsapi32", "Gdi32")
             add_files("apps/desktop/src/platform/windows/service/session_helper_main.cpp")
-            add_files("apps/desktop/resources/windows/crossdesk_session_helper.rc")
+            add_files("apps/desktop/resources/windows/crossdesk_session_helper.rc",
+                {defines = windows_helper_resource_defines})
             add_includedirs("apps/desktop/src/common",
                 "apps/desktop/src/platform/windows/service")
             add_includedirs("apps/desktop/src/platform/windows/input")
@@ -414,7 +492,7 @@ function setup_targets()
             add_includedirs("apps/desktop/src/platform/windows/service")
             add_links("Advapi32", "Wtsapi32", "Ole32", "Userenv")
             add_deps("wgc_plugin", "crossdesk_service", "crossdesk_session_helper")
-            add_files(crossdesk_windows_resource)
+            add_files(crossdesk_windows_resource, {defines = windows_resource_defines})
         elseif is_os("macosx") then
             add_files("apps/desktop/src/platform/common/posix_daemon_backend.cpp",
                 "apps/desktop/src/platform/macos/daemon_backend.cpp")

apps/ios/CrossDeskMobile/Bridge/CrossDeskRTCBridge.h

@@ -99,8 +99,7 @@ typedef NS_ENUM(NSInteger, CrossDeskVideoAdaptationPolicy) {
 @property(nonatomic, weak, nullable) id<CrossDeskRTCBridgeDelegate> delegate;
 
 - (void)configureWithSignalHost:(NSString *)host
-                     signalPort:(NSInteger)signalPort
-                     enableSRTP:(BOOL)enableSRTP;
+                     signalPort:(NSInteger)signalPort;
 - (void)setHardwareAccelerationEnabled:(BOOL)enabled;
 - (void)setVideoAdaptationPolicy:(CrossDeskVideoAdaptationPolicy)policy;
 - (void)requestPresenceForRemoteIDs:(NSArray<NSString *> *)remoteIDs

apps/ios/CrossDeskMobile/Bridge/CrossDeskRTCBridge.mm

@@ -75,7 +75,6 @@ struct RTCState {
   CallbackContext controller_context;
   std::string signal_host;
   int signal_port = 0;
-  bool enable_srtp = false;
   bool hardware_acceleration = true;
   VideoDegradationPreference video_adaptation_policy =
       VideoDegradationPreference::MaintainResolution;
@@ -86,6 +85,7 @@ struct RTCState {
   std::string identity_base;
   std::string controller_login;
   std::string pending_remote_id;
+  uint64_t pending_controller_generation = 0;
   std::string pending_password;
   std::string transmission_id;
   std::string log_path;
@@ -336,7 +336,7 @@ Params MakeParams(const RTCState &state, const std::string &user_id,
   params.native_video_output = true;
   params.av1_encoding = false;
   params.turn_mode = TurnMode::TurnAutoUdpTcp;
-  params.enable_srtp = state.enable_srtp;
+  params.enable_srtp = true;
   params.video_content_type = VideoContentType::ScreenContent;
   params.video_quality = VideoQuality::QualityHigh;
   params.video_frame_rate = 60;
@@ -432,8 +432,7 @@ Params MakeParams(const RTCState &state, const std::string &user_id,
 }
 
 - (void)configureWithSignalHost:(NSString *)host
-                     signalPort:(NSInteger)signalPort
-                     enableSRTP:(BOOL)enableSRTP {
+                     signalPort:(NSInteger)signalPort {
   NSString *trimmed = [host stringByTrimmingCharactersInSet:
                                 NSCharacterSet.whitespaceAndNewlineCharacterSet];
   const char *host_c_string = trimmed.UTF8String;
@@ -455,7 +454,6 @@ Params MakeParams(const RTCState &state, const std::string &user_id,
   dispatch_async(_rtcQueue, ^{
     const bool unchanged = self->_state->signal_host == host_value &&
                            self->_state->signal_port == signalPort &&
-                           self->_state->enable_srtp == enableSRTP &&
                            self->_state->identity_peer != nullptr;
     if (unchanged) return;
 
@@ -463,7 +461,6 @@ Params MakeParams(const RTCState &state, const std::string &user_id,
     [self destroyIdentityPeer];
     self->_state->signal_host = host_value;
     self->_state->signal_port = static_cast<int>(signalPort);
-    self->_state->enable_srtp = enableSRTP;
     self->_state->log_path = log_path;
     self->_state->identity_ready = false;
     self->_state->identity_recovery_attempted = false;
@@ -583,8 +580,14 @@ Params MakeParams(const RTCState &state, const std::string &user_id,
       password_c_string ? password_c_string : "";
   if (identifier.empty()) return;
 
+  // Invalidate queued callbacks immediately, before asynchronous teardown. A
+  // canceled attempt for the same remote must not close a newly started one.
+  const uint64_t generation = _controllerGenerationCounter.fetch_add(1) + 1;
+  _activeControllerGeneration.store(0);
   dispatch_async(_rtcQueue, ^{
+    if (generation != self->_controllerGenerationCounter.load()) return;
     self->_state->pending_remote_id = identifier;
+    self->_state->pending_controller_generation = generation;
     self->_state->pending_password = password_value;
     [self destroyControllerPeer];
     if (self->_state->identity_ready &&
@@ -595,6 +598,8 @@ Params MakeParams(const RTCState &state, const std::string &user_id,
 }
 
 - (void)disconnect {
+  _controllerGenerationCounter.fetch_add(1);
+  _activeControllerGeneration.store(0);
   dispatch_async(_rtcQueue, ^{
     self->_state->pending_remote_id.clear();
     self->_state->pending_password.clear();
@@ -868,7 +873,8 @@ Params MakeParams(const RTCState &state, const std::string &user_id,
       _state->identity_base.empty()) {
     return;
   }
-  const uint64_t generation = _controllerGenerationCounter.fetch_add(1) + 1;
+  const uint64_t generation = _state->pending_controller_generation;
+  if (generation == 0 || generation != _controllerGenerationCounter.load()) return;
   _state->controller_context.generation = generation;
   _activeControllerGeneration.store(generation);
   _state->controller_login = "C-" + _state->identity_base;
@@ -1112,6 +1118,8 @@ Params MakeParams(const RTCState &state, const std::string &user_id,
                       remoteID:(const std::string &)remoteID
                     generation:(uint64_t)generation {
   if (![self isControllerGenerationCurrent:generation]) return;
+  if (state != CrossDeskConnectionStateFailed &&
+      ![self isControllerGenerationActive:generation]) return;
   const std::string remote_copy = remoteID;
   if (state == CrossDeskConnectionStateConnected) {
     dispatch_async(_rtcQueue, ^{
@@ -1149,7 +1157,7 @@ Params MakeParams(const RTCState &state, const std::string &user_id,
   }
   DispatchMain(^{
     if (![self isControllerGenerationCurrent:generation]) return;
-    if (state == CrossDeskConnectionStateConnected &&
+    if (state != CrossDeskConnectionStateFailed &&
         ![self isControllerGenerationActive:generation]) {
       return;
     }
@@ -1164,6 +1172,7 @@ Params MakeParams(const RTCState &state, const std::string &user_id,
 
 - (BOOL)isControllerGenerationActive:(uint64_t)generation {
   return generation != 0 &&
+         _controllerGenerationCounter.load() == generation &&
          _activeControllerGeneration.load() == generation;
 }
 

apps/ios/CrossDeskMobile/ContentView.swift

@@ -17,6 +17,14 @@ struct ContentView: View {
         }
         .animation(.easeInOut(duration: 0.2), value: session.sessionVisible)
         .preferredColorScheme(session.sessionVisible ? .dark : .light)
+        .alert("连接提示", isPresented: Binding(
+            get: { session.connectionFailureMessage != nil },
+            set: { if !$0 { session.dismissConnectionFailure() } }
+        )) {
+            Button("确定", role: .cancel) { session.dismissConnectionFailure() }
+        } message: {
+            Text(session.connectionFailureMessage ?? "")
+        }
         .onAppear {
             if !session.sessionVisible {
                 AppOrientation.update(to: .portrait)
@@ -710,17 +718,14 @@ private struct ServerSettingsView: View {
                         .font(.caption)
                         .foregroundStyle(.tertiary)
                 }
-                Section("服务器") {
+                Section {
                     TextField("信令服务器", text: $session.signalHost)
                         .textInputAutocapitalization(.never)
                         .autocorrectionDisabled()
                     TextField("信令端口", text: $session.signalPort)
                         .keyboardType(.numberPad)
-                }
-                Section {
-                    Toggle("启用 SRTP", isOn: $session.enableSRTP)
                 } header: {
-                    Text("传输")
+                    Text("服务器")
                 } footer: {
                     Text(session.localIdentity.isEmpty
                          ? "正在获取本机 ID…"

apps/ios/CrossDeskMobile/RemoteSessionModel.swift

@@ -358,7 +358,6 @@ private final class RemoteAudioPlayer {
 final class RemoteSessionModel: NSObject, ObservableObject, CrossDeskRTCBridgeDelegate {
     @Published var signalHost = "api.crossdesk.cn"
     @Published var signalPort = "9099"
-    @Published var enableSRTP = false
     @Published var mouseControlMode = MouseControlMode.saved {
         didSet { mouseControlMode.save() }
     }
@@ -398,6 +397,7 @@ final class RemoteSessionModel: NSObject, ObservableObject, CrossDeskRTCBridgeDe
     @Published private(set) var recentConnections = RecentConnectionStore.load()
     @Published private(set) var recentConnectionPresence: [String: Bool] = [:]
     @Published private(set) var deviceOfflineAlertVisible = false
+    @Published private(set) var connectionFailureMessage: String?
 
     let bridge = CrossDeskRTCBridge()
     private let audioPlayer = RemoteAudioPlayer()
@@ -424,7 +424,6 @@ final class RemoteSessionModel: NSObject, ObservableObject, CrossDeskRTCBridgeDe
     private struct BridgeConfiguration: Equatable {
         let host: String
         let signalPort: Int
-        let enableSRTP: Bool
     }
     private var bridgeConfiguration: BridgeConfiguration?
 
@@ -457,8 +456,7 @@ final class RemoteSessionModel: NSObject, ObservableObject, CrossDeskRTCBridgeDe
             signalStatus = "服务器配置无效"
             return false
         }
-        let configuration = BridgeConfiguration(host: host, signalPort: signal,
-                                                enableSRTP: enableSRTP)
+        let configuration = BridgeConfiguration(host: host, signalPort: signal)
         if bridgeConfiguration != configuration {
             bridgeConfiguration = configuration
             signalConnected = false
@@ -472,8 +470,7 @@ final class RemoteSessionModel: NSObject, ObservableObject, CrossDeskRTCBridgeDe
         bridge.setHardwareAccelerationEnabled(videoCodecMode == .hardware)
         bridge.setVideoAdaptationPolicy(videoAdaptationPolicy.bridgeValue)
         bridge.configure(withSignalHost: host,
-                         signalPort: signal,
-                         enableSRTP: enableSRTP)
+                         signalPort: signal)
         return true
     }
 
@@ -484,6 +481,7 @@ final class RemoteSessionModel: NSObject, ObservableObject, CrossDeskRTCBridgeDe
     }
 
     func connect() {
+        connectionFailureMessage = nil
         let identifier = remoteID.trimmingCharacters(in: .whitespacesAndNewlines)
         guard !identifier.isEmpty else {
             connectionStatus = "请输入远程设备 ID"
@@ -576,7 +574,25 @@ final class RemoteSessionModel: NSObject, ObservableObject, CrossDeskRTCBridgeDe
         deviceOfflineAlertVisible = false
     }
 
+    func dismissConnectionFailure() {
+        guard connectionFailureMessage != nil else { return }
+        connectionFailureMessage = nil
+    }
+
+    private func finishConnection(withError message: String) {
+        // Cleanup may emit Closed. Preserve the terminal reason independently
+        // of the progress view and invalidate those callbacks in the bridge.
+        resetConnection()
+        connectionStatus = message
+        connectionFailureMessage = message
+    }
+
     func disconnect() {
+        resetConnection()
+    }
+
+    private func resetConnection() {
+        connectionFailureMessage = nil
         cancelVideoRecovery()
         let wasCheckingPresence = pendingPresenceRemoteID != nil
         cancelPresenceProbe()
@@ -882,6 +898,10 @@ final class RemoteSessionModel: NSObject, ObservableObject, CrossDeskRTCBridgeDe
     func rtcBridge(_ bridge: CrossDeskRTCBridge,
                    didChange state: CrossDeskConnectionState,
                    remoteID: String) {
+        guard isConnecting || isConnected || sessionVisible,
+              remoteID.isEmpty || remoteID == activeRemoteID else {
+            return
+        }
         isConnected = state.rawValue == 1
         if !isConnected {
             cancelVideoRecovery()
@@ -897,35 +917,25 @@ final class RemoteSessionModel: NSObject, ObservableObject, CrossDeskRTCBridgeDe
             bridge.setAudioEnabled(audioEnabled)
             AppOrientation.update(to: .allButUpsideDown)
         case 2: connectionStatus = "正在收集 ICE 候选"
-        case 3: connectionStatus = "网络连接已中断"
+        case 3: finishConnection(withError: "网络连接已中断，请重新连接。")
         case 4:
-            connectionStatus = "P2P/TURN 建链失败"
-            sessionVisible = false
-            AppOrientation.update(to: .portrait)
+            finishConnection(withError: "P2P/TURN 建链失败，请检查网络后重试。")
         case 5:
-            connectionStatus = "未连接"
-            sessionVisible = false
-            AppOrientation.update(to: .portrait)
+            finishConnection(withError: "远程连接已结束。")
         case 6:
-            connectionStatus = "访问密码错误"
-            sessionVisible = false
-            AppOrientation.update(to: .portrait)
+            finishConnection(withError: "访问密码错误，请重新输入。")
         case 7:
-            connectionStatus = "远程设备 ID 不存在"
             if !remoteID.isEmpty {
                 recentConnectionPresence[remoteID] = false
                 presenceUpdatedAt.removeValue(forKey: remoteID)
             }
-            sessionVisible = false
-            AppOrientation.update(to: .portrait)
+            finishConnection(withError: "远程设备 ID 不存在，请检查设备 ID。")
         case 8:
-            connectionStatus = "远程设备当前不可用"
             if !remoteID.isEmpty {
                 recentConnectionPresence[remoteID] = false
                 presenceUpdatedAt.removeValue(forKey: remoteID)
             }
-            sessionVisible = false
-            AppOrientation.update(to: .portrait)
+            finishConnection(withError: "远程设备当前不可用，请稍后重试。")
         default: connectionStatus = "未知连接状态"
         }
     }

apps/ios/README.md

@@ -56,12 +56,17 @@ the desktop-compatible `DisplayN`, `control_audio`, `mouse`, `keyboard`,
 
 ## Video codecs
 
-Every iOS build includes VideoToolbox, OpenH264, dav1d, libaom, and SVT-AV1. H.264 uses
+Every iOS build includes VideoToolbox, OpenH264, dav1d, and SVT-AV1. H.264 uses
 VideoToolbox by default; choose software processing under **设置 → 视频编解码 →
 处理方式** (Settings → Video codec → Processing mode) to use OpenH264 for H.264.
 The change takes effect on the next connection. AV1 encoding uses SVT-AV1 and AV1 decoding
 uses dav1d; VideoToolbox AV1 hardware decoding is currently unsupported.
 
+The unused libaom backends are excluded by default. To include them for development,
+set the `MINIRTC_ENABLE_AOM` environment variable (or Xcode user-defined build setting)
+to `true`. This includes libaom in the merged native archive without changing the
+AV1 factories' choice of SVT-AV1 and dav1d.
+
 ## Physical-device test checklist
 
 Run the app from Xcode on a physical device and connect to a current desktop

apps/ios/scripts/build_minirtc_ios.sh

@@ -8,6 +8,11 @@ REPO_DIR="${IOS_DIR:h:h}"
 MINIRTC_DIR="${REPO_DIR}/deps/submodules/minirtc"
 CONFIG_NAME="${CONFIGURATION:-Debug}"
 MODE="${CONFIG_NAME:l}"
+MINIRTC_ENABLE_AOM="${MINIRTC_ENABLE_AOM:-false}"
+if [[ "${MINIRTC_ENABLE_AOM}" != "true" && "${MINIRTC_ENABLE_AOM}" != "false" ]]; then
+  print -u2 "MINIRTC_ENABLE_AOM must be true or false."
+  exit 64
+fi
 
 # Keep iOS dependencies isolated from desktop Xmake packages. Besides avoiding
 # cross-project cache collisions, this guarantees every archive is compiled
@@ -77,17 +82,43 @@ WIRE_MANIFEST_FILE="${WIRE_WORK_DIR}/xmake.lua"
 WIRE_LIBRARY="${WIRE_BUILD_DIR}/iphoneos/arm64/${MODE}/libcrossdesk_wire.a"
 
 mkdir -p "${OUTPUT_DIR}" "${WIRE_WORK_DIR}"
-cp "${REPO_DIR}/xmake.lua" "${WIRE_MANIFEST_FILE}"
+if ! cmp -s "${REPO_DIR}/xmake.lua" "${WIRE_MANIFEST_FILE}"; then
+  cp "${REPO_DIR}/xmake.lua" "${WIRE_MANIFEST_FILE}"
+fi
+
+# Reuse Xmake's compiler/dependency probes unless the build environment changes.
+# Still configure on every invocation: Xmake must see manifest edits and restore
+# the iOS configuration if MiniRTC was built standalone for another platform.
+CONFIG_SIGNATURE="$(print -r -- "${XMAKE_BIN}" "${XMAKE_DEVELOPER_DIR}" \
+  "${MODE}" "${ARCH_NAME}" "16.0" "${XMAKE_PKG_INSTALLDIR}" "${MINIRTC_ENABLE_AOM}"
+  run_xmake --version | sed -n '1p'
+  DEVELOPER_DIR="${XMAKE_DEVELOPER_DIR}" xcodebuild -version
+  DEVELOPER_DIR="${XMAKE_DEVELOPER_DIR}" xcrun --sdk iphoneos --show-sdk-path
+  DEVELOPER_DIR="${XMAKE_DEVELOPER_DIR}" xcrun --sdk iphoneos --show-sdk-version)"
+
+configure_xmake() {
+  local project_dir="$1"
+  local build_dir="$2"
+  shift 2
+  local stamp="${build_dir}/ios-config-signature"
+  local clean_flags=()
+  if [[ ! -f "${stamp}" || "$(<"${stamp}")" != "${CONFIG_SIGNATURE}" ]]; then
+    clean_flags=(-c)
+  fi
+  run_xmake f -P "${project_dir}" "${clean_flags[@]}" -o "${build_dir}" \
+    -p iphoneos -a arm64 -m "${MODE}" --target_minver=16.0 -y "$@"
+  mkdir -p "${build_dir}"
+  print -r -- "${CONFIG_SIGNATURE}" > "${stamp}"
+}
 
 # Xmake stores the configured build directory relative to the process working
 # directory. Xcode does not guarantee that directory for build phases, so keep
 # configuration, compilation and inspection anchored to the MiniRTC project.
 (
   cd "${MINIRTC_DIR}"
-  run_xmake f -P "${MINIRTC_DIR}" -c -o "${MINIRTC_BUILD_DIR}" \
-    -p iphoneos -a arm64 -m "${MODE}" \
-    --as="${XMAKE_TOOLCHAIN_BIN}/clang" \
-    --target_minver=16.0 --USE_CUDA=false -y
+  configure_xmake "${MINIRTC_DIR}" "${MINIRTC_BUILD_DIR}" \
+    --as="${XMAKE_TOOLCHAIN_BIN}/clang" --USE_CUDA=false \
+    --MINIRTC_ENABLE_AOM="${MINIRTC_ENABLE_AOM}"
   run_xmake b -P "${MINIRTC_DIR}" minirtc
 )
 
@@ -101,9 +132,7 @@ fi
 # no second project definition to maintain.
 (
   cd "${WIRE_WORK_DIR}"
-  run_xmake f -P "${WIRE_WORK_DIR}" -c -o "${WIRE_BUILD_DIR}" \
-    -p iphoneos -a arm64 -m "${MODE}" \
-    --target_minver=16.0 -y
+  configure_xmake "${WIRE_WORK_DIR}" "${WIRE_BUILD_DIR}"
   run_xmake b -P "${WIRE_WORK_DIR}" crossdesk_wire
 )
 
@@ -123,8 +152,11 @@ REQUIRED_LINKS=(
   nice glib-2.0 gobject-2.0 gmodule-2.0 gio-2.0 gthread-2.0 intl
   gupnp-igd-1.6 gupnp-1.6 gssdp-1.6 soup-3.0 nghttp2 sqlite3 psl xml2
   ffi pcre2-8 pcre2-posix z ssl crypto srtp2 openfec opus yuv kcp
-  datachannel usrsctp openh264 dav1d aom SvtAv1Enc
+  datachannel usrsctp openh264 dav1d SvtAv1Enc
 )
+if [[ "${MINIRTC_ENABLE_AOM}" == "true" ]]; then
+  REQUIRED_LINKS+=(aom)
+fi
 DEPENDENCY_ARCHIVES=()
 
 for link_name in "${REQUIRED_LINKS[@]}"; do
@@ -144,10 +176,24 @@ for link_name in "${REQUIRED_LINKS[@]}"; do
 done
 
 TEMP_LIBRARY="${OUTPUT_LIBRARY}.tmp"
-rm -f "${TEMP_LIBRARY}"
+MERGE_MANIFEST="${OUTPUT_LIBRARY}.inputs.sha256"
+TEMP_MANIFEST="${MERGE_MANIFEST}.tmp"
+trap 'rm -f "${TEMP_LIBRARY}" "${TEMP_MANIFEST}"' EXIT
+
+# Hash contents as well as paths so same-size archives replaced within the same
+# timestamp tick cannot leave a stale merged library. Preserve the output mtime
+# on no-op builds to avoid relinking the Xcode app.
+shasum -a 256 "${SCRIPT_DIR}/build_minirtc_ios.sh" "${MINIRTC_LIBRARY}" \
+  "${DEPENDENCY_ARCHIVES[@]}" "${WIRE_LIBRARY}" > "${TEMP_MANIFEST}"
+if [[ -f "${OUTPUT_LIBRARY}" ]] && cmp -s "${TEMP_MANIFEST}" "${MERGE_MANIFEST}"; then
+  print "Up to date: ${OUTPUT_LIBRARY}"
+  exit 0
+fi
+
 /usr/bin/libtool -static -o "${TEMP_LIBRARY}" \
   "${MINIRTC_LIBRARY}" "${DEPENDENCY_ARCHIVES[@]}" \
   "${WIRE_LIBRARY}"
 mv -f "${TEMP_LIBRARY}" "${OUTPUT_LIBRARY}"
+mv -f "${TEMP_MANIFEST}" "${MERGE_MANIFEST}"
 
 print "Created ${OUTPUT_LIBRARY}"

apps/ios/tests/build_minirtc_ios_test.py

@@ -0,0 +1,154 @@
+"""Exercise the native build phase with fake Xmake and real Apple archives."""
+
+import os
+from pathlib import Path
+import re
+import shutil
+import subprocess
+import sys
+import tempfile
+import unittest
+
+
+@unittest.skipUnless(sys.platform == "darwin", "requires Apple libtool and zsh")
+class NativeBuildTest(unittest.TestCase):
+    def setUp(self):
+        self.temp = tempfile.TemporaryDirectory(prefix="crossdesk-ios-build-")
+        self.addCleanup(self.temp.cleanup)
+        self.root = Path(self.temp.name)
+        self.ios = self.root / "apps/ios"
+        scripts = self.ios / "scripts"
+        scripts.mkdir(parents=True)
+        source = Path(__file__).resolve().parents[1] / "scripts/build_minirtc_ios.sh"
+        self.script = scripts / source.name
+        shutil.copy2(source, self.script)
+        (self.root / "xmake.lua").write_text('-- fixture\n')
+        (self.root / "deps/submodules/minirtc").mkdir(parents=True)
+        self.bin = self.root / "bin"
+        self.bin.mkdir()
+        self.library_dir = self.root / "packages/lib"
+        self.library_dir.mkdir(parents=True)
+        obj = self.root / "fixture.o"
+        subprocess.run(["xcrun", "clang", "-x", "c", "-c", "-", "-o", str(obj)],
+                       input="int fixture(void) { return 1; }", text=True, check=True)
+        self.archive = self.root / "fixture.a"
+        subprocess.run(["/usr/bin/libtool", "-static", "-o", str(self.archive), str(obj)],
+                       check=True, capture_output=True)
+        links = re.search(r"REQUIRED_LINKS=\((.*?)\)", source.read_text(), re.S)[1].split()
+        for name in links:
+            shutil.copy2(self.archive, self.library_dir / f"lib{name}.a")
+        self.write_tool("xcodebuild", '#!/bin/sh\ncat "$(dirname "$0")/../xcode-version"\n')
+        self.write_tool("xcrun", '#!/bin/sh\necho fixture-iphoneos-sdk\n')
+        (self.root / "xcode-version").write_text("Xcode fixture-1\n")
+        self.write_tool("xmake", f"#!{sys.executable}\n" + r'''
+import json, pathlib, shutil, sys
+root = pathlib.Path(__file__).resolve().parents[1]
+args = sys.argv[1:]
+with (root / "calls.jsonl").open("a") as log:
+    log.write(json.dumps(args) + "\n")
+if args[0] == "--version":
+    print("xmake fixture")
+elif args[0] == "f":
+    if (root / "fail-config").exists():
+        sys.exit(1)
+    project = pathlib.Path(args[args.index("-P") + 1])
+    (project / "config.json").write_text(json.dumps(args))
+elif args[0] == "b":
+    project = pathlib.Path(args[args.index("-P") + 1])
+    config = json.loads((project / "config.json").read_text())
+    output = pathlib.Path(config[config.index("-o") + 1])
+    output /= "iphoneos/arm64/" + config[config.index("-m") + 1]
+    output.mkdir(parents=True, exist_ok=True)
+    library = output / ("lib" + args[-1] + ".a")
+    if not library.exists():
+        shutil.copy2(root / "fixture.a", library)
+elif args[0] == "show":
+    print("    -> " + str(root / "packages/lib") + " -> package fixture")
+''')
+        self.env = dict(os.environ, PATH=f"{self.bin}:{os.environ['PATH']}",
+                        XMAKE_BIN=str(self.bin / "xmake"), CONFIGURATION="Release",
+                        MINIRTC_ENABLE_AOM="false",
+                        CURRENT_ARCH="arm64", DEVELOPER_DIR=subprocess.check_output(
+                            ["xcode-select", "-p"], text=True).strip())
+        self.output = self.ios / "Vendor/iphoneos/Release/libCrossDeskMiniRTC.a"
+
+    def write_tool(self, name, contents):
+        path = self.bin / name
+        path.write_text(contents)
+        path.chmod(0o755)
+
+    def run_build(self, success=True):
+        result = subprocess.run(["/bin/zsh", str(self.script)], env=self.env,
+                                text=True, capture_output=True)
+        if success:
+            self.assertEqual(result.returncode, 0, result.stdout + result.stderr)
+        else:
+            self.assertNotEqual(result.returncode, 0)
+        return result
+
+    def config_calls(self):
+        import json
+        return [args for line in (self.root / "calls.jsonl").read_text().splitlines()
+                if (args := json.loads(line))[0] == "f"]
+
+    def test_noop_preserves_archives_and_manifest(self):
+        self.run_build()
+        manifest = self.ios / ".xmake/wire-work/xmake.lua"
+        old_times = (self.output.stat().st_mtime_ns, manifest.stat().st_mtime_ns)
+        self.run_build()
+        self.assertEqual(old_times, (self.output.stat().st_mtime_ns, manifest.stat().st_mtime_ns))
+        self.assertEqual(["-c" in args for args in self.config_calls()], [True, True, False, False])
+
+    def test_archive_content_change_with_same_size_and_mtime_is_merged(self):
+        self.run_build()
+        original = self.output.read_bytes()
+        library = self.library_dir / "libopus.a"
+        stat = library.stat()
+        data = library.read_bytes()
+        # Rename an archive member without changing the archive layout or size.
+        self.assertIn(b"fixture.o", data)
+        library.write_bytes(data.replace(b"fixture.o", b"changed.o"))
+        os.utime(library, ns=(stat.st_atime_ns, stat.st_mtime_ns))
+        self.run_build()
+        self.assertNotEqual(original, self.output.read_bytes())
+
+    def test_toolchain_and_mode_changes_clear_probes(self):
+        self.run_build()
+        (self.root / "xcode-version").write_text("Xcode fixture-2\n")
+        self.run_build()
+        self.env["CONFIGURATION"] = "Debug"
+        self.run_build()
+        self.assertEqual(["-c" in args for args in self.config_calls()], [True] * 6)
+        self.assertTrue((self.ios / "Vendor/iphoneos/Debug/libCrossDeskMiniRTC.a").exists())
+
+    def test_failed_configuration_does_not_commit_signature(self):
+        self.run_build()
+        stamp = self.ios / ".xmake/minirtc-build/ios-config-signature"
+        original = stamp.read_bytes()
+        (self.root / "xcode-version").write_text("Xcode fixture-2\n")
+        (self.root / "fail-config").touch()
+        self.run_build(success=False)
+        self.assertEqual(stamp.read_bytes(), original)
+        (self.root / "fail-config").unlink()
+        self.run_build()
+        self.assertTrue(all("-c" in args for args in self.config_calls()))
+
+    def test_aom_is_only_required_and_merged_when_enabled(self):
+        self.run_build()
+        manifest = Path(str(self.output) + ".inputs.sha256")
+        self.assertNotIn("libaom.a", manifest.read_text())
+        original = self.output.read_bytes()
+        self.env["MINIRTC_ENABLE_AOM"] = "true"
+        result = self.run_build(success=False)
+        self.assertIn("Unable to resolve static dependency libaom.a", result.stderr)
+        self.assertEqual(self.output.read_bytes(), original)
+        shutil.copy2(self.archive, self.library_dir / "libaom.a")
+        self.run_build()
+        self.assertIn("libaom.a", manifest.read_text())
+        self.env["MINIRTC_ENABLE_AOM"] = "false"
+        self.run_build()
+        self.assertNotIn("libaom.a", manifest.read_text())
+
+
+if __name__ == "__main__":
+    unittest.main()

docs/BUILD.md

@@ -11,7 +11,7 @@
 
 ## Windows
 
-安装 Visual Studio 2022 的“使用 C++ 的桌面开发”工作负载及 Windows SDK，并安装 Xmake。在开发者 PowerShell 中执行：
+安装 Visual Studio 2022 的“使用 C++ 的桌面开发”工作负载、Windows SDK 和“适用于 Windows 的 C++ Clang 编译器”组件，并安装 Xmake。Windows x64 的 libyuv 使用 clang-cl 编译，以启用 SIMD 图像转换和缩放；主程序仍使用 MSVC。在开发者 PowerShell 中执行：
 
 ```powershell
 git clone --recurse-submodules https://github.com/kunkundi/crossdesk.git
@@ -21,6 +21,8 @@ xmake b -vy crossdesk
 xmake r crossdesk
 ```
 
+性能复测应使用 `release`；`debug` 保留调试信息并关闭主程序编译优化。
+
 安装包还使用 NSIS，需将仓库中的 [nsProcess.dll](../apps/desktop/scripts/windows/nsProcess.dll) 放入 NSIS 的 `Plugins/x86-unicode` 目录，并确保 `makensis` 在 `PATH` 中。完成 Release 编译后运行：
 
 ```powershell
@@ -129,6 +131,7 @@ PipeWire 不属于强制运行时依赖：程序在运行时检测宿主系统
 --USE_DRM=true/false: 在 Linux 上启用 DRM 捕获，默认不启用
 --CROSSDESK_PORTABLE=true/false: 构建便携版本，默认不启用
 --CROSSDESK_VERSION=xxx: 指定 CrossDesk 的版本
+--MINIRTC_ENABLE_AOM=true/false: 编译可选 libaom 后端，默认不启用；AV1 仍使用 SVT-AV1 / dav1d
 
 # 示例
 xmake f --CROSSDESK_VERSION=1.4.3 --USE_CUDA=true

docs/BUILD_EN.md

@@ -11,7 +11,7 @@ After cloning, run build and packaging commands from the repository root. The [X
 
 ## Windows
 
-Install Visual Studio 2022 with the **Desktop development with C++** workload and Windows SDK, plus Xmake. In a developer PowerShell, run:
+Install Visual Studio 2022 with the **Desktop development with C++** workload, Windows SDK, and **C++ Clang Compiler for Windows** component, plus Xmake. Windows x64 builds use clang-cl for libyuv to enable SIMD conversion and scaling; the application still uses MSVC. In a developer PowerShell, run:
 
 ```powershell
 git clone --recurse-submodules https://github.com/kunkundi/crossdesk.git
@@ -21,6 +21,8 @@ xmake b -vy crossdesk
 xmake r crossdesk
 ```
 
+Use `release` for performance measurements; `debug` keeps symbols and disables application compiler optimizations.
+
 Installer packaging also uses NSIS. Copy the repository's [nsProcess.dll](../apps/desktop/scripts/windows/nsProcess.dll) into NSIS's `Plugins/x86-unicode` directory and ensure `makensis` is on `PATH`. After building Release, run:
 
 ```powershell

libs/wire/include/remote_action.h

@@ -26,6 +26,8 @@ enum ControlType {
   service_command = 6,
   keyboard_state = 7,
   cursor_state = 8,
+  privacy_command = 9,
+  privacy_status = 10,
 };
 
 enum MouseFlag {
@@ -98,6 +100,8 @@ struct HostInfo {
   int* top;
   int* right;
   int* bottom;
+  // Optional capability; absent in legacy desktop and web host information.
+  bool supports_privacy_screen;
 };
 
 struct ServiceStatus {
@@ -109,6 +113,23 @@ struct ServiceCommand {
   ServiceCommandFlag flag;
 };
 
+enum class PrivacyState { unsupported, off, starting, on, stopping, failed };
+enum class PrivacyCommandFlag { query, enable, disable };
+struct PrivacyCommand {
+  PrivacyCommandFlag flag;
+  bool block_local_input;
+};
+struct PrivacyStatus {
+  PrivacyState state;
+  bool supported;
+  bool input_block_supported;
+  bool overlay_active;
+  bool input_blocked;
+  bool remote_paused;
+  uint32_t revision;
+  char reason[256];
+};
+
 struct RemoteAction {
   ControlType type = ControlType::invalid;
   union {
@@ -121,6 +142,8 @@ struct RemoteAction {
     int d;
     ServiceStatus ss;
     ServiceCommand c;
+    PrivacyCommand pc;
+    PrivacyStatus ps;
   };
 
   std::string to_json() const;
@@ -136,4 +159,4 @@ void FreeRemoteAction(RemoteAction& action);
 
 }  // namespace crossdesk
 
-#endif
+#endif

libs/wire/src/remote_action.cpp

@@ -22,6 +22,7 @@ void ResetHostInfo(HostInfo& info) {
   info.top = nullptr;
   info.right = nullptr;
   info.bottom = nullptr;
+  info.supports_privacy_screen = false;
 }
 
 bool AllocateHostDisplays(HostInfo& info, std::size_t count) {
@@ -106,6 +107,19 @@ std::string RemoteAction::ToJson(const RemoteAction& action) {
     case ControlType::service_command:
       object["service_command"] = {{"flag", action.c.flag}};
       break;
+    case ControlType::privacy_command:
+      object["privacy_command"] = {{"flag", action.pc.flag},
+                                   {"block_local_input", action.pc.block_local_input}};
+      break;
+    case ControlType::privacy_status:
+      object["privacy_status"] = {{"state", action.ps.state},
+          {"supported", action.ps.supported},
+          {"input_block_supported", action.ps.input_block_supported},
+          {"overlay_active", action.ps.overlay_active},
+          {"input_blocked", action.ps.input_blocked},
+          {"remote_paused", action.ps.remote_paused},
+          {"revision", action.ps.revision}, {"reason", action.ps.reason}};
+      break;
     case ControlType::host_infomation: {
       json displays = json::array();
       for (std::size_t index = 0; index < action.i.display_num; ++index) {
@@ -119,7 +133,9 @@ std::string RemoteAction::ToJson(const RemoteAction& action) {
       }
       object["host_info"] = {{"host_name", action.i.host_name},
                              {"display_num", action.i.display_num},
-                             {"displays", displays}};
+                             {"displays", displays},
+                             {"supports_privacy_screen",
+                              action.i.supports_privacy_screen}};
       break;
     }
     case ControlType::invalid:
@@ -228,10 +244,42 @@ bool RemoteAction::FromJson(const std::string& json_string,
         output.c.flag = static_cast<ServiceCommandFlag>(
             object.at("service_command").at("flag").get<int>());
         break;
+      case ControlType::privacy_command: {
+        const auto& command = object.at("privacy_command");
+        const int flag = command.at("flag").get<int>();
+        if (flag < 0 || flag > 2) return false;
+        output.pc.flag = static_cast<PrivacyCommandFlag>(flag);
+        output.pc.block_local_input = command.at("block_local_input").get<bool>();
+        break;
+      }
+      case ControlType::privacy_status: {
+        const auto& status = object.at("privacy_status");
+        const int state = status.at("state").get<int>();
+        const auto reason = status.at("reason").get<std::string>();
+        if (state < 0 || state > 5 || reason.size() >= sizeof(output.ps.reason) ||
+            reason.find('\0') != std::string::npos) return false;
+        output.ps.state = static_cast<PrivacyState>(state);
+        output.ps.supported = status.at("supported").get<bool>();
+        output.ps.input_block_supported = status.at("input_block_supported").get<bool>();
+        output.ps.overlay_active = status.at("overlay_active").get<bool>();
+        output.ps.input_blocked = status.at("input_blocked").get<bool>();
+        output.ps.remote_paused = status.at("remote_paused").get<bool>();
+        output.ps.revision = status.at("revision").get<uint32_t>();
+        std::memcpy(output.ps.reason, reason.c_str(), reason.size() + 1);
+        // Never render a contradictory success from a malformed peer.
+        if (output.ps.state == PrivacyState::on &&
+            (!output.ps.supported || !output.ps.overlay_active || output.ps.remote_paused)) return false;
+        break;
+      }
       case ControlType::host_infomation: {
         ResetHostInfo(output.i);
         owns_host_info = true;
         const auto& host_info_object = object.at("host_info");
+        const auto privacy_support =
+            host_info_object.find("supports_privacy_screen");
+        output.i.supports_privacy_screen =
+            privacy_support != host_info_object.end() &&
+            privacy_support->is_boolean() && privacy_support->get<bool>();
         const std::string host_name =
             host_info_object.at("host_name").get<std::string>();
         std::strncpy(output.i.host_name, host_name.c_str(),