[fix] add missing colon to remote preview setting label

.dockerignore

@@ -0,0 +1,22 @@
+**
+
+!.dockerignore
+!docker/
+!docker/linux-build/
+!docker/linux-build/**
+
+# Dependency manifests and local xmake package recipes are the only project
+# files needed while pre-warming the build image.
+!xmake.lua
+!apps/
+!apps/desktop/
+!apps/desktop/xmake/
+!apps/desktop/xmake/**
+!deps/thirdparty/
+!deps/thirdparty/**
+!deps/submodules/
+!deps/submodules/xmake.lua
+!deps/submodules/minirtc/
+!deps/submodules/minirtc/xmake.lua
+!deps/submodules/minirtc/thirdparty/
+!deps/submodules/minirtc/thirdparty/**

.github/workflows/build-linux-image.yml

@@ -0,0 +1,157 @@
+name: Build Linux Build Image
+
+on:
+  push:
+    branches:
+      - ci/linux-build-image
+    paths:
+      - .dockerignore
+      - .gitmodules
+      - .github/workflows/build-linux-image.yml
+      - docker/linux-build/**
+      - xmake.lua
+      - xmake/**
+      - deps/thirdparty/**
+      - deps/submodules/xmake.lua
+      - deps/submodules/minirtc
+      - deps/submodules/minirtc/xmake.lua
+      - deps/submodules/minirtc/thirdparty/**
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: linux-build-image-${{ github.ref }}
+  cancel-in-progress: true
+
+env:
+  IMAGE_NAME: crossdesk/ubuntu20.04
+  STACK_TAG: buildenv-cuda12.6.3-gcc10-cmake3.31.6-pipewire0.3.48-xmake3.0.9-rust1.92.0
+  CMAKE_VERSION: 3.31.6
+  XMAKE_VERSION: 3.0.9
+  RUST_VERSION: 1.92.0
+  RUSTUP_VERSION: 1.28.2
+
+jobs:
+  build:
+    name: Build candidate (${{ matrix.arch }})
+    runs-on: ${{ matrix.runner }}
+    timeout-minutes: 180
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - arch: amd64
+            platform: linux/amd64
+            runner: ubuntu-24.04
+            base_image: nvidia/cuda:12.6.3-devel-ubuntu20.04
+          - arch: arm64
+            platform: linux/arm64
+            runner: ubuntu-24.04-arm
+            base_image: ubuntu:20.04
+    steps:
+      - name: Set candidate tag
+        id: image
+        run: |
+          CANDIDATE_TAG="${IMAGE_NAME}:${STACK_TAG}-${GITHUB_SHA}-${{ matrix.arch }}"
+          echo "CANDIDATE_TAG=${CANDIDATE_TAG}" >> "${GITHUB_ENV}"
+          echo "candidate=${CANDIDATE_TAG}" >> "${GITHUB_OUTPUT}"
+
+      - name: Checkout source
+        uses: actions/checkout@v5
+        with:
+          submodules: recursive
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v4
+
+      - name: Log in to Docker Hub
+        uses: docker/login-action@v4
+        with:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+
+      - name: Build and push candidate
+        uses: docker/build-push-action@v7
+        with:
+          context: .
+          file: docker/linux-build/Dockerfile
+          platforms: ${{ matrix.platform }}
+          push: true
+          pull: true
+          tags: ${{ steps.image.outputs.candidate }}
+          cache-from: type=registry,ref=${{ env.IMAGE_NAME }}:${{ env.STACK_TAG }}
+          cache-to: type=inline
+          provenance: false
+          sbom: false
+          build-args: |
+            BASE_IMAGE=${{ matrix.base_image }}
+            CMAKE_VERSION=${{ env.CMAKE_VERSION }}
+            XMAKE_VERSION=${{ env.XMAKE_VERSION }}
+            RUST_VERSION=${{ env.RUST_VERSION }}
+            RUSTUP_VERSION=${{ env.RUSTUP_VERSION }}
+
+  verify:
+    name: Verify candidate (${{ matrix.arch }})
+    needs: build
+    runs-on: ${{ matrix.runner }}
+    timeout-minutes: 30
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - arch: amd64
+            runner: ubuntu-24.04
+          - arch: arm64
+            runner: ubuntu-24.04-arm
+    steps:
+      - name: Set candidate tag
+        run: |
+          CANDIDATE_TAG="${IMAGE_NAME}:${STACK_TAG}-${GITHUB_SHA}-${{ matrix.arch }}"
+          echo "CANDIDATE_TAG=${CANDIDATE_TAG}" >> "${GITHUB_ENV}"
+
+      - name: Log in to Docker Hub
+        uses: docker/login-action@v4
+        with:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+
+      - name: Verify tools, architecture, and Ubuntu baseline
+        run: |
+          docker pull "${CANDIDATE_TAG}"
+          docker run --rm \
+            --env EXPECTED_ARCH="${{ matrix.arch }}" \
+            "${CANDIDATE_TAG}" \
+            verify-crossdesk-build-image
+
+  publish:
+    name: Publish multi-arch image
+    needs: verify
+    runs-on: ubuntu-24.04
+    timeout-minutes: 20
+    steps:
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v4
+
+      - name: Log in to Docker Hub
+        uses: docker/login-action@v4
+        with:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+
+      - name: Promote verified candidates
+        run: |
+          AMD64_IMAGE="${IMAGE_NAME}:${STACK_TAG}-${GITHUB_SHA}-amd64"
+          ARM64_IMAGE="${IMAGE_NAME}:${STACK_TAG}-${GITHUB_SHA}-arm64"
+
+          docker buildx imagetools create \
+            --tag "${IMAGE_NAME}:${STACK_TAG}" \
+            --tag "${IMAGE_NAME}:sha-${GITHUB_SHA}" \
+            --tag "${IMAGE_NAME}:latest" \
+            "${AMD64_IMAGE}" \
+            "${ARM64_IMAGE}"
+
+      - name: Inspect published manifest
+        run: |
+          docker buildx imagetools inspect "${IMAGE_NAME}:${STACK_TAG}"

.github/workflows/build.yml

@@ -4,11 +4,23 @@ on:
   push:
     branches:
       - "**"
+      - "!ci/linux-build-image"
     tags:
       - "*"
   workflow_dispatch:
+    inputs:
+      patch:
+        description: "Hotfix patch number, for example 1 or 2. Use 0 for a normal build."
+        required: false
+        default: "0"
+      sign_windows_test:
+        description: "Submit the Windows installer to SignPath using test-signing."
+        required: false
+        type: boolean
+        default: false
 
 permissions:
+  actions: read
   contents: write
 
 env:
@@ -22,14 +34,14 @@ jobs:
       matrix:
         include:
           - arch: amd64
-            runner: ubuntu-22.04
-            image: crossdesk/ubuntu20.04:latest
-            package_script: ./scripts/linux/pkg_amd64.sh
+            runner: ubuntu-24.04
+            image: crossdesk/ubuntu20.04:buildenv-cuda12.6.3-gcc10-cmake3.31.6-pipewire0.3.48-xmake3.0.9-rust1.92.0
+            package_script: ./apps/desktop/scripts/linux/pkg_amd64.sh
 
           - arch: arm64
-            runner: ubuntu-22.04-arm
-            image: crossdesk/ubuntu20.04-arm64v8:latest
-            package_script: ./scripts/linux/pkg_arm64.sh
+            runner: ubuntu-24.04-arm
+            image: crossdesk/ubuntu20.04:buildenv-cuda12.6.3-gcc10-cmake3.31.6-pipewire0.3.48-xmake3.0.9-rust1.92.0
+            package_script: ./apps/desktop/scripts/linux/pkg_arm64.sh
 
     container:
       image: ${{ matrix.image }}
@@ -37,46 +49,132 @@ jobs:
 
     steps:
       - name: Extract version number
+        shell: bash
         run: |
-          VERSION="${GITHUB_REF##*/}"
-          VERSION_NUM="${VERSION#v}"
-          echo "VERSION_NUM=${VERSION_NUM}" >> $GITHUB_ENV
+          VERSION_REF="${GITHUB_REF##*/}"
+          VERSION_BASE="${VERSION_REF#v}"
+          PATCH_NUMBER="${{ github.event.inputs.patch }}"
+          BUILD_DATE_OVERRIDE=""
+
+          if [[ ! "${PATCH_NUMBER}" =~ ^[0-9]+$ ]]; then
+            PATCH_NUMBER=0
+          fi
+
+          if [[ "${VERSION_BASE}" =~ ^([0-9]+(\.[0-9]+){1,3})-([0-9]+)-([0-9]{8})$ ]]; then
+            VERSION_BASE="${BASH_REMATCH[1]}"
+            PATCH_NUMBER="${BASH_REMATCH[3]}"
+            BUILD_DATE_OVERRIDE="${BASH_REMATCH[4]}"
+          elif [[ "${VERSION_BASE}" =~ ^([0-9]+(\.[0-9]+){1,3})-([0-9]{8})-([0-9]+)$ ]]; then
+            VERSION_BASE="${BASH_REMATCH[1]}"
+            BUILD_DATE_OVERRIDE="${BASH_REMATCH[3]}"
+            PATCH_NUMBER="${BASH_REMATCH[4]}"
+          elif [[ "${VERSION_BASE}" =~ ^([0-9]+(\.[0-9]+){1,3})-([0-9]{8})$ ]]; then
+            VERSION_BASE="${BASH_REMATCH[1]}"
+            BUILD_DATE_OVERRIDE="${BASH_REMATCH[3]}"
+          elif [[ "${VERSION_BASE}" =~ ^([0-9]+(\.[0-9]+){1,3})-([0-9]+)$ && "${PATCH_NUMBER}" == "0" ]]; then
+            VERSION_BASE="${BASH_REMATCH[1]}"
+            PATCH_NUMBER="${BASH_REMATCH[3]}"
+          fi
+
+          echo "VERSION_BASE=${VERSION_BASE}" >> $GITHUB_ENV
+          echo "PATCH_NUMBER=${PATCH_NUMBER}" >> $GITHUB_ENV
+          echo "BUILD_DATE_OVERRIDE=${BUILD_DATE_OVERRIDE}" >> $GITHUB_ENV
 
       - name: Set legal Debian version
         shell: bash
         run: |
-          SHORT_SHA=$(echo "${GITHUB_SHA}" | cut -c1-7)
-          BUILD_DATE=$(TZ=Asia/Shanghai date +%Y%m%d)
+          BUILD_DATE="${BUILD_DATE_OVERRIDE}"
+          if [[ -z "${BUILD_DATE}" ]]; then
+            BUILD_DATE=$(TZ=Asia/Shanghai date +%Y%m%d)
+          fi
 
-          if [[ ! "${VERSION_NUM}" =~ ^[0-9] ]]; then
-            LEGAL_VERSION="v0.0.0-${VERSION_NUM}-${BUILD_DATE}-${SHORT_SHA}"
+          if [[ ! "${VERSION_BASE}" =~ ^[0-9] ]]; then
+            VERSION_BASE="0.0.0-${VERSION_BASE}"
+          fi
+
+          if [[ "${PATCH_NUMBER}" != "0" ]]; then
+            LEGAL_VERSION="v${VERSION_BASE}-${PATCH_NUMBER}-${BUILD_DATE}"
           else
-            LEGAL_VERSION="v${VERSION_NUM}-${BUILD_DATE}-${SHORT_SHA}"
+            LEGAL_VERSION="v${VERSION_BASE}-${BUILD_DATE}"
           fi
 
           echo "LEGAL_VERSION=${LEGAL_VERSION}" >> $GITHUB_ENV
           echo "BUILD_DATE=${BUILD_DATE}" >> $GITHUB_ENV
 
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
         with:
           submodules: recursive
 
+      - name: Verify Linux build image
+        run: verify-crossdesk-build-image
+
+      - name: Ensure Wayland build dependencies
+        shell: bash
+        run: |
+          if pkg-config --exists dbus-1 libdrm && \
+             test -f /opt/crossdesk-pipewire-sdk/include/pipewire-0.3/pipewire/pipewire.h && \
+             test -f /opt/crossdesk-pipewire-sdk/include/spa-0.2/spa/param/video/format-utils.h; then
+            exit 0
+          fi
+
+          apt-get update
+          apt-get install -y --no-install-recommends \
+            libdbus-1-dev \
+            libdrm-dev
+          rm -rf /var/lib/apt/lists/*
+
+          install-crossdesk-pipewire-sdk
+          pkg-config --exists dbus-1 libdrm
+          test -f /opt/crossdesk-pipewire-sdk/include/pipewire-0.3/pipewire/pipewire.h
+          test -f /opt/crossdesk-pipewire-sdk/include/spa-0.2/spa/param/video/format-utils.h
+
       - name: Build CrossDesk
         env:
           CUDA_PATH: /usr/local/cuda
           XMAKE_GLOBALDIR: /data
         run: |
-          xmake f --CROSSDESK_VERSION=${LEGAL_VERSION} --USE_CUDA=true --root -y
+          xmake f --CROSSDESK_VERSION=${LEGAL_VERSION} --USE_CUDA=true --USE_WAYLAND=true \
+            --cc=gcc-10 --cxx=g++-10 --root -y
           xmake b -vy --root crossdesk
 
+      - name: Verify repository and wire boundaries
+        env:
+          XMAKE_GLOBALDIR: /data
+        run: |
+          xmake b -vy --root repository_structure_test
+          xmake b -vy --root crossdesk_wire_test
+          xmake b -vy --root keyboard_state_wire_test
+          xmake run --root repository_structure_test
+          xmake run --root crossdesk_wire_test
+          xmake run --root keyboard_state_wire_test
+
+      - name: Install Linux headless runtime dependencies
+        run: |
+          apt-get update
+          apt-get install -y --no-install-recommends xvfb xfce4 dbus
+
       - name: Package
         run: |
           chmod +x ${{ matrix.package_script }}
           ${{ matrix.package_script }} ${LEGAL_VERSION}
 
+      - name: Verify Ubuntu 20.04 package dependency resolution
+        run: |
+          PACKAGE_FILE="${GITHUB_WORKSPACE}/crossdesk-linux-${{ matrix.arch }}-${LEGAL_VERSION}.deb"
+          apt-get update
+          apt-get install --simulate "${PACKAGE_FILE}"
+
+      - name: Verify packaged Ubuntu 20.04 glibc baseline
+        run: |
+          PACKAGE_FILE="${GITHUB_WORKSPACE}/crossdesk-linux-${{ matrix.arch }}-${LEGAL_VERSION}.deb"
+          VERIFY_DIR="${RUNNER_TEMP}/crossdesk-glibc-${{ matrix.arch }}"
+          install -d "${VERIFY_DIR}"
+          dpkg-deb --extract "${PACKAGE_FILE}" "${VERIFY_DIR}"
+          verify-crossdesk-glibc-baseline "${VERIFY_DIR}" 2.31
+
       - name: Upload artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v6
         with:
           name: crossdesk-linux-${{ matrix.arch }}-${{ env.LEGAL_VERSION }}
           path: ${{ github.workspace }}/crossdesk-linux-${{ matrix.arch }}-${{ env.LEGAL_VERSION }}.deb
@@ -85,52 +183,100 @@ jobs:
   build-macos:
     name: Build on macOS
     runs-on: ${{ matrix.runner }}
+    env:
+      MACOSX_DEPLOYMENT_TARGET: "14.0"
+      EXPECTED_MACOS_SDK: "26.5"
     strategy:
       matrix:
         include:
           - arch: x64
-            runner: macos-15-intel
-            cache-key: intel
+            binary_arch: x86_64
+            runner: macos-26-intel
+            cache-key: intel-macos26-xcode26.6-min14
             out-dir: ./build/macosx/x86_64/release/crossdesk
-            package_script: ./scripts/macosx/pkg_x64.sh
+            package_script: ./apps/desktop/scripts/macos/pkg_x64.sh
           - arch: arm64
-            runner: macos-14
-            cache-key: arm
+            binary_arch: arm64
+            runner: macos-26
+            cache-key: arm-macos26-xcode26.6-min14
             out-dir: ./build/macosx/arm64/release/crossdesk
-            package_script: ./scripts/macosx/pkg_arm64.sh
+            package_script: ./apps/desktop/scripts/macos/pkg_arm64.sh
 
     steps:
       - name: Extract version number
         id: version
+        shell: bash
         run: |
-          VERSION="${GITHUB_REF##*/}"
-          SHORT_SHA=$(echo "${GITHUB_SHA}" | cut -c1-7)
+          VERSION_REF="${GITHUB_REF##*/}"
+          VERSION_BASE="${VERSION_REF#v}"
           BUILD_DATE=$(TZ=Asia/Shanghai date +%Y%m%d)
-          VERSION_NUM="v${VERSION#v}-${BUILD_DATE}-${SHORT_SHA}"
+          PATCH_NUMBER="${{ github.event.inputs.patch }}"
+
+          if [[ ! "${PATCH_NUMBER}" =~ ^[0-9]+$ ]]; then
+            PATCH_NUMBER=0
+          fi
+
+          if [[ "${VERSION_BASE}" =~ ^([0-9]+(\.[0-9]+){1,3})-([0-9]+)-([0-9]{8})$ ]]; then
+            VERSION_BASE="${BASH_REMATCH[1]}"
+            PATCH_NUMBER="${BASH_REMATCH[3]}"
+            BUILD_DATE="${BASH_REMATCH[4]}"
+          elif [[ "${VERSION_BASE}" =~ ^([0-9]+(\.[0-9]+){1,3})-([0-9]{8})-([0-9]+)$ ]]; then
+            VERSION_BASE="${BASH_REMATCH[1]}"
+            BUILD_DATE="${BASH_REMATCH[3]}"
+            PATCH_NUMBER="${BASH_REMATCH[4]}"
+          elif [[ "${VERSION_BASE}" =~ ^([0-9]+(\.[0-9]+){1,3})-([0-9]{8})$ ]]; then
+            VERSION_BASE="${BASH_REMATCH[1]}"
+            BUILD_DATE="${BASH_REMATCH[3]}"
+          elif [[ "${VERSION_BASE}" =~ ^([0-9]+(\.[0-9]+){1,3})-([0-9]+)$ && "${PATCH_NUMBER}" == "0" ]]; then
+            VERSION_BASE="${BASH_REMATCH[1]}"
+            PATCH_NUMBER="${BASH_REMATCH[3]}"
+          fi
+
+          if [[ "${PATCH_NUMBER}" != "0" ]]; then
+            VERSION_NUM="v${VERSION_BASE}-${PATCH_NUMBER}-${BUILD_DATE}"
+          else
+            VERSION_NUM="v${VERSION_BASE}-${BUILD_DATE}"
+          fi
+
           echo "VERSION_NUM=${VERSION_NUM}" >> $GITHUB_ENV
           echo "VERSION_NUM=${VERSION_NUM}"
           echo "BUILD_DATE=${BUILD_DATE}" >> $GITHUB_ENV
+          echo "PATCH_NUMBER=${PATCH_NUMBER}" >> $GITHUB_ENV
+
+      - name: Select Xcode 26.6
+        shell: bash
+        run: |
+          sudo xcode-select -s /Applications/Xcode_26.6.app/Contents/Developer
+          xcodebuild -version
+          SDK_VERSION="$(xcrun --sdk macosx --show-sdk-version)"
+          if [[ "${SDK_VERSION}" != "${EXPECTED_MACOS_SDK}" ]]; then
+            echo "Unexpected macOS SDK: expected ${EXPECTED_MACOS_SDK}, got ${SDK_VERSION}" >&2
+            exit 1
+          fi
 
       - name: Cache xmake dependencies
-        uses: actions/cache@v4
+        uses: actions/cache@v5
         with:
           path: ~/.xmake/packages
-          key: ${{ runner.os }}-xmake-deps-${{ matrix.cache-key }}-${{ github.sha }}
+          key: "${{ runner.os }}-xmake-deps-${{ matrix.cache-key }}-${{ github.run_id }}"
           restore-keys: |
             ${{ runner.os }}-xmake-deps-${{ matrix.cache-key }}-
 
       - name: Install xmake
         run: brew install xmake
 
+      - name: Update xmake repositories
+        run: xmake repo -u
+
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
 
       - name: Initialize submodules
         run: git submodule update --init --recursive
 
       - name: Build CrossDesk
         run: |
-          xmake f --CROSSDESK_VERSION=${VERSION_NUM} --USE_CUDA=true -y
+          xmake f --target_minver=${MACOSX_DEPLOYMENT_TARGET} --CROSSDESK_VERSION=${VERSION_NUM} --USE_CUDA=false -vyD
           xmake b -vy crossdesk
 
       - name: Package CrossDesk app
@@ -138,8 +284,24 @@ jobs:
           chmod +x ${{ matrix.package_script }}
           ${{ matrix.package_script }} ${VERSION_NUM}
 
+      - name: Verify packaged app
+        shell: bash
+        run: |
+          PACKAGE_FILE="${GITHUB_WORKSPACE}/crossdesk-macos-${{ matrix.arch }}-${VERSION_NUM}.pkg"
+          VERIFY_DIR="$(mktemp -d "${RUNNER_TEMP}/crossdesk-macos-pkg.XXXXXX")"
+          trap 'rm -rf "${VERIFY_DIR}"' EXIT
+
+          pkgutil --expand-full "${PACKAGE_FILE}" "${VERIFY_DIR}/expanded"
+          APP_PATH="$(find "${VERIFY_DIR}/expanded" -type d -name 'CrossDesk.app' -print -quit)"
+          if [[ -z "${APP_PATH}" ]]; then
+            echo "CrossDesk.app is missing from ${PACKAGE_FILE}" >&2
+            exit 1
+          fi
+
+          ./apps/desktop/scripts/macos/verify_app.sh "${APP_PATH}" "${{ matrix.binary_arch }}" "${EXPECTED_MACOS_SDK}"
+
       - name: Upload build artifacts
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v6
         with:
           name: crossdesk-macos-${{ matrix.arch }}-${{ env.VERSION_NUM }}
           path: crossdesk-macos-${{ matrix.arch }}-${{ env.VERSION_NUM }}.pkg
@@ -149,6 +311,226 @@ jobs:
           mkdir -p release
           cp crossdesk-macos-${{ matrix.arch }}-${{ env.VERSION_NUM }}.pkg release/
 
+  # iOS
+  build-ios:
+    name: Build on iOS (arm64)
+    runs-on: macos-26
+    timeout-minutes: 120
+    outputs:
+      version: ${{ steps.ios_version.outputs.version }}
+    env:
+      IOS_DEPLOYMENT_TARGET: "16.0"
+      EXPECTED_IOS_SDK: "26.5"
+      XMAKE_VERSION: "3.1.1"
+      XMAKE_REPO_REVISION: "121109352da272cd1a3d4ed52f2dcda34f839955"
+
+    steps:
+      - name: Extract version number
+        shell: bash
+        run: |
+          VERSION_REF="${GITHUB_REF##*/}"
+          VERSION_BASE="${VERSION_REF#v}"
+          BUILD_DATE=$(TZ=Asia/Shanghai date +%Y%m%d)
+          PATCH_NUMBER="${{ github.event.inputs.patch }}"
+
+          if [[ ! "${PATCH_NUMBER}" =~ ^[0-9]+$ ]]; then
+            PATCH_NUMBER=0
+          fi
+
+          if [[ "${VERSION_BASE}" =~ ^([0-9]+(\.[0-9]+){1,3})-([0-9]+)-([0-9]{8})$ ]]; then
+            VERSION_BASE="${BASH_REMATCH[1]}"
+            PATCH_NUMBER="${BASH_REMATCH[3]}"
+            BUILD_DATE="${BASH_REMATCH[4]}"
+          elif [[ "${VERSION_BASE}" =~ ^([0-9]+(\.[0-9]+){1,3})-([0-9]{8})-([0-9]+)$ ]]; then
+            VERSION_BASE="${BASH_REMATCH[1]}"
+            BUILD_DATE="${BASH_REMATCH[3]}"
+            PATCH_NUMBER="${BASH_REMATCH[4]}"
+          elif [[ "${VERSION_BASE}" =~ ^([0-9]+(\.[0-9]+){1,3})-([0-9]{8})$ ]]; then
+            VERSION_BASE="${BASH_REMATCH[1]}"
+            BUILD_DATE="${BASH_REMATCH[3]}"
+          elif [[ "${VERSION_BASE}" =~ ^([0-9]+(\.[0-9]+){1,3})-([0-9]+)$ && "${PATCH_NUMBER}" == "0" ]]; then
+            VERSION_BASE="${BASH_REMATCH[1]}"
+            PATCH_NUMBER="${BASH_REMATCH[3]}"
+          fi
+
+          if [[ "${PATCH_NUMBER}" != "0" ]]; then
+            VERSION_NUM="v${VERSION_BASE}-${PATCH_NUMBER}-${BUILD_DATE}"
+          else
+            VERSION_NUM="v${VERSION_BASE}-${BUILD_DATE}"
+          fi
+
+          echo "VERSION_NUM=${VERSION_NUM}" >> "${GITHUB_ENV}"
+          echo "VERSION_NUM=${VERSION_NUM}"
+
+      - name: Select Xcode 26.6
+        shell: bash
+        run: |
+          sudo xcode-select -s /Applications/Xcode_26.6.app/Contents/Developer
+          xcodebuild -version
+          SDK_VERSION="$(xcrun --sdk iphoneos --show-sdk-version)"
+          if [[ "${SDK_VERSION}" != "${EXPECTED_IOS_SDK}" ]]; then
+            echo "Unexpected iOS SDK: expected ${EXPECTED_IOS_SDK}, got ${SDK_VERSION}" >&2
+            exit 1
+          fi
+
+      - name: Checkout code
+        uses: actions/checkout@v5
+        with:
+          fetch-depth: 0
+
+      - name: Select corresponding source tag
+        shell: bash
+        run: |
+          if [[ "${GITHUB_REF_TYPE}" == "tag" ]]; then
+            echo "CROSSDESK_SOURCE_TAG=${GITHUB_REF_NAME}" >> "${GITHUB_ENV}"
+            echo "CROSSDESK_RELEASE_BUILD=YES" >> "${GITHUB_ENV}"
+          fi
+
+      - name: Read independent iOS version
+        id: ios_version
+        shell: bash
+        run: |
+          IOS_VERSION_BASE="$(xcodebuild \
+            -project apps/ios/CrossDeskMobile.xcodeproj \
+            -scheme CrossDeskMobile \
+            -configuration Release \
+            -destination 'generic/platform=iOS' \
+            -showBuildSettings CODE_SIGNING_ALLOWED=NO | \
+            awk '$1 == "MARKETING_VERSION" && $2 == "=" { print $3 }')"
+          if [[ ! "${IOS_VERSION_BASE}" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
+            echo "Invalid iOS marketing version: ${IOS_VERSION_BASE}" >&2
+            exit 1
+          fi
+          VERSION_NUM="v${IOS_VERSION_BASE}-${VERSION_NUM##*-}"
+          echo "IOS_VERSION_BASE=${IOS_VERSION_BASE}" >> "${GITHUB_ENV}"
+          echo "VERSION_NUM=${VERSION_NUM}" >> "${GITHUB_ENV}"
+          echo "version=${VERSION_NUM}" >> "${GITHUB_OUTPUT}"
+
+      - name: Initialize submodules
+        run: git submodule update --init --recursive
+
+      - name: Cache xmake dependencies
+        uses: actions/cache@v5
+        with:
+          path: apps/ios/.xmake/packages
+          key: "${{ runner.os }}-xmake${{ env.XMAKE_VERSION }}-deps-ios-arm64-source-v1-xcode26.6-xrepo1211093-min16-${{ github.run_id }}"
+          restore-keys: |
+            ${{ runner.os }}-xmake${{ env.XMAKE_VERSION }}-deps-ios-arm64-source-v1-xcode26.6-xrepo1211093-min16-
+
+      - name: Set up Python
+        uses: actions/setup-python@v6
+        with:
+          python-version: "3.13"
+
+      - name: Verify iOS license catalog
+        run: |
+          python3 -B -m unittest discover -s apps/ios/tests -p 'third_party_licenses_test.py' -v
+          python3 -B apps/ios/scripts/generate_third_party_licenses.py
+
+      - name: Verify iOS privacy controls
+        run: python3 -B -m unittest discover -s apps/ios/tests -p 'privacy_controls_test.py' -v
+
+      - name: Install xmake
+        uses: xmake-io/github-action-setup-xmake@v1
+        with:
+          xmake-version: "${{ env.XMAKE_VERSION }}"
+
+      - name: Verify xmake version
+        shell: bash
+        run: |
+          XMAKE_VERSION_OUTPUT="$(xmake --version)"
+          echo "${XMAKE_VERSION_OUTPUT}"
+          if [[ "${XMAKE_VERSION_OUTPUT}" != *"xmake v${XMAKE_VERSION}"* ]]; then
+            echo "Unexpected xmake version: expected ${XMAKE_VERSION}" >&2
+            exit 1
+          fi
+
+      - name: Pin xmake package repository
+        shell: bash
+        run: |
+          xmake repo -u
+          XMAKE_REPO_DIR="${HOME}/.xmake/repositories/xmake-repo"
+          git -C "${XMAKE_REPO_DIR}" fetch --depth=1 origin "${XMAKE_REPO_REVISION}"
+          git -C "${XMAKE_REPO_DIR}" checkout --detach "${XMAKE_REPO_REVISION}"
+          test "$(git -C "${XMAKE_REPO_DIR}" rev-parse HEAD)" = "${XMAKE_REPO_REVISION}"
+
+      - name: Build CrossDesk Mobile
+        shell: bash
+        run: |
+          DERIVED_DATA="${RUNNER_TEMP}/CrossDeskMobileDerivedData"
+          echo "DERIVED_DATA=${DERIVED_DATA}" >> "${GITHUB_ENV}"
+          xcodebuild \
+            -project apps/ios/CrossDeskMobile.xcodeproj \
+            -scheme CrossDeskMobile \
+            -configuration Release \
+            -destination 'generic/platform=iOS' \
+            -derivedDataPath "${DERIVED_DATA}" \
+            CODE_SIGNING_ALLOWED=NO \
+            CODE_SIGNING_REQUIRED=NO \
+            COMPILER_INDEX_STORE_ENABLE=NO \
+            IPHONEOS_DEPLOYMENT_TARGET="${IOS_DEPLOYMENT_TARGET}" \
+            build
+
+      - name: Verify CrossDesk Mobile
+        shell: bash
+        run: |
+          APP_PATH="${DERIVED_DATA}/Build/Products/Release-iphoneos/CrossDeskMobile.app"
+          EXECUTABLE_PATH="${APP_PATH}/CrossDeskMobile"
+          INFO_PLIST="${APP_PATH}/Info.plist"
+
+          if [[ ! -x "${EXECUTABLE_PATH}" ]]; then
+            echo "CrossDeskMobile executable is missing from ${APP_PATH}" >&2
+            exit 1
+          fi
+
+          xcrun lipo "${EXECUTABLE_PATH}" -verify_arch arm64
+          APP_VERSION=$(/usr/libexec/PlistBuddy -c 'Print :CFBundleShortVersionString' "${INFO_PLIST}")
+          if [[ "${APP_VERSION}" != "${IOS_VERSION_BASE}" ]]; then
+            echo "Unexpected iOS app version: expected ${IOS_VERSION_BASE}, got ${APP_VERSION}" >&2
+            exit 1
+          fi
+          MINIMUM_OS=$(/usr/libexec/PlistBuddy -c 'Print :MinimumOSVersion' "${INFO_PLIST}")
+          if [[ "${MINIMUM_OS}" != "${IOS_DEPLOYMENT_TARGET}" ]]; then
+            echo "Unexpected minimum iOS version: expected ${IOS_DEPLOYMENT_TARGET}, got ${MINIMUM_OS}" >&2
+            exit 1
+          fi
+
+          VERIFY_FLAGS=()
+          if [[ "${CROSSDESK_RELEASE_BUILD:-NO}" == "YES" ]]; then
+            VERIFY_FLAGS+=(--require-release)
+          fi
+          python3 apps/ios/scripts/verify_app_bundle.py "${APP_PATH}" "${VERIFY_FLAGS[@]}"
+          xcrun lipo -info "${EXECUTABLE_PATH}"
+          echo "Minimum iOS version: ${MINIMUM_OS}"
+
+      - name: Package CrossDesk Mobile
+        shell: bash
+        run: |
+          APP_PATH="${DERIVED_DATA}/Build/Products/Release-iphoneos/CrossDeskMobile.app"
+          PACKAGE_DIR="${RUNNER_TEMP}/crossdesk-ios-arm64-unsigned-${VERSION_NUM}"
+          PACKAGE_FILE="${GITHUB_WORKSPACE}/crossdesk-ios-arm64-unsigned-${VERSION_NUM}.zip"
+
+          mkdir -p "${PACKAGE_DIR}"
+          cp -R "${APP_PATH}" "${PACKAGE_DIR}/"
+          cp apps/ios/licenses/sources.json "${PACKAGE_DIR}/ThirdPartySources.json"
+          cp apps/ios/licenses/OPEN_SOURCE_NOTICE.txt "${PACKAGE_DIR}/OPEN_SOURCE_NOTICE.txt"
+          cp "${APP_PATH}/SourceMetadata.json" "${PACKAGE_DIR}/SourceMetadata.json"
+
+          DSYM_PATH="${DERIVED_DATA}/Build/Products/Release-iphoneos/CrossDeskMobile.app.dSYM"
+          if [[ -d "${DSYM_PATH}" ]]; then
+            cp -R "${DSYM_PATH}" "${PACKAGE_DIR}/"
+          fi
+
+          ditto -c -k --sequesterRsrc --keepParent "${PACKAGE_DIR}" "${PACKAGE_FILE}"
+          echo "PACKAGE_FILE=${PACKAGE_FILE}" >> "${GITHUB_ENV}"
+
+      - name: Upload build artifact
+        uses: actions/upload-artifact@v6
+        with:
+          name: crossdesk-ios-arm64-unsigned-${{ env.VERSION_NUM }}
+          path: ${{ env.PACKAGE_FILE }}
+          if-no-files-found: error
+
   # Windows
   build-windows-x64:
     name: Build on Windows x64
@@ -163,16 +545,44 @@ jobs:
           $version = $ref -replace '^refs/(tags|heads)/', ''
           $version = $version -replace '^v', ''
           $version = $version -replace '/', '-'
-          $SHORT_SHA = $env:GITHUB_SHA.Substring(0,7)
           $BUILD_DATE = ([System.TimeZoneInfo]::ConvertTimeBySystemTimeZoneId((Get-Date), "China Standard Time")).ToString("yyyyMMdd")
-          echo "VERSION_NUM=v$version-$BUILD_DATE-$SHORT_SHA" >> $env:GITHUB_ENV
+          $PATCH_NUMBER = "${{ github.event.inputs.patch }}"
+
+          if ($PATCH_NUMBER -notmatch '^[0-9]+$') {
+            $PATCH_NUMBER = "0"
+          }
+
+          if ($version -match '^([0-9]+(\.[0-9]+){1,3})-([0-9]+)-([0-9]{8})$') {
+            $version = $Matches[1]
+            $PATCH_NUMBER = $Matches[3]
+            $BUILD_DATE = $Matches[4]
+          } elseif ($version -match '^([0-9]+(\.[0-9]+){1,3})-([0-9]{8})-([0-9]+)$') {
+            $version = $Matches[1]
+            $BUILD_DATE = $Matches[3]
+            $PATCH_NUMBER = $Matches[4]
+          } elseif ($version -match '^([0-9]+(\.[0-9]+){1,3})-([0-9]{8})$') {
+            $version = $Matches[1]
+            $BUILD_DATE = $Matches[3]
+          } elseif ($version -match '^([0-9]+(\.[0-9]+){1,3})-([0-9]+)$' -and $PATCH_NUMBER -eq "0") {
+            $version = $Matches[1]
+            $PATCH_NUMBER = $Matches[3]
+          }
+
+          if ($PATCH_NUMBER -ne "0") {
+            $VERSION_NUM = "v$version-$PATCH_NUMBER-$BUILD_DATE"
+          } else {
+            $VERSION_NUM = "v$version-$BUILD_DATE"
+          }
+
+          echo "VERSION_NUM=$VERSION_NUM" >> $env:GITHUB_ENV
           echo "BUILD_DATE=$BUILD_DATE" >> $env:GITHUB_ENV
+          echo "PATCH_NUMBER=$PATCH_NUMBER" >> $env:GITHUB_ENV
 
       - name: Cache xmake dependencies
-        uses: actions/cache@v4
+        uses: actions/cache@v5
         with:
           path: D:\xmake_global\.xmake\packages
-          key: ${{ runner.os }}-xmake-deps-intel-${{ github.sha }}
+          key: "${{ runner.os }}-xmake-deps-intel-${{ github.run_id }}"
           restore-keys: |
             ${{ runner.os }}-xmake-deps-intel-
 
@@ -180,6 +590,7 @@ jobs:
         run: |
           Invoke-Expression (Invoke-Webrequest 'https://raw.githubusercontent.com/tboox/xmake/master/scripts/get.ps1' -UseBasicParsing).Content
           echo "C:\Users\runneradmin\xmake" | Out-File -FilePath $env:GITHUB_PATH -Encoding utf8 -Append
+          xmake repo -u
           xmake create cuda
           Set-Location cuda
           xmake g --theme=plain
@@ -221,7 +632,7 @@ jobs:
           Copy-Item $source $target -Force
 
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
 
       - name: Initialize submodules
         run: git submodule update --init --recursive
@@ -229,7 +640,7 @@ jobs:
       - name: Copy nsProcess plugin to NSIS folder
         run: |
           $nsisPluginDir = "C:\Program Files (x86)\NSIS\Plugins\x86-unicode"
-          copy "${{ github.workspace }}\scripts\windows\nsProcess.dll" $nsisPluginDir
+          copy "${{ github.workspace }}\apps\desktop\scripts\windows\nsProcess.dll" $nsisPluginDir
 
       - name: Build CrossDesk
         run: |
@@ -239,25 +650,110 @@ jobs:
       - name: Package
         shell: pwsh
         run: |
-          cd "${{ github.workspace }}\scripts\windows"
-          makensis /DVERSION=$env:VERSION_NUM nsis_script.nsi
+          & "${{ github.workspace }}\apps\desktop\scripts\windows\pkg_x64.ps1" $env:VERSION_NUM
+
+      - name: Upload unsigned Windows installer for test signing
+        if: github.event_name == 'workflow_dispatch' && inputs.sign_windows_test
+        id: upload-unsigned-windows-installer
+        uses: actions/upload-artifact@v7
+        with:
+          path: ${{ github.workspace }}/apps/desktop/scripts/windows/crossdesk-win-x64-${{ env.VERSION_NUM }}.exe
+          archive: false
+          if-no-files-found: error
+          retention-days: 1
+
+      - name: Sign Windows installer with SignPath test certificate
+        if: github.event_name == 'workflow_dispatch' && inputs.sign_windows_test
+        uses: signpath/github-action-submit-signing-request@v2
+        with:
+          api-token: ${{ secrets.SIGNPATH_API_TOKEN }}
+          organization-id: ${{ vars.SIGNPATH_ORGANIZATION_ID }}
+          project-slug: crossdesk
+          signing-policy-slug: test-signing
+          github-artifact-id: ${{ steps.upload-unsigned-windows-installer.outputs.artifact-id }}
+          wait-for-completion: true
+          output-artifact-directory: ${{ github.workspace }}\signpath\signed-installer
+          skip-decompress: true
+          parameters: |
+            version: ${{ toJSON(env.VERSION_NUM) }}
+
+      - name: Verify and use test-signed Windows installer
+        if: github.event_name == 'workflow_dispatch' && inputs.sign_windows_test
+        shell: pwsh
+        run: |
+          $installerName = "crossdesk-win-x64-${{ env.VERSION_NUM }}.exe"
+          $signedInstaller = Join-Path "${{ github.workspace }}\signpath\signed-installer" $installerName
+          $destination = Join-Path "${{ github.workspace }}\apps\desktop\scripts\windows" $installerName
+
+          if (!(Test-Path $signedInstaller)) {
+            throw "SignPath did not return the signed installer: $signedInstaller"
+          }
+
+          $signature = Get-AuthenticodeSignature $signedInstaller
+          if (!$signature.SignerCertificate -or $signature.Status -eq "NotSigned") {
+            throw "SignPath returned an installer without an Authenticode signature."
+          }
+
+          Write-Host "Signer: $($signature.SignerCertificate.Subject)"
+          Write-Host "Signature status: $($signature.Status)"
+          Copy-Item $signedInstaller $destination -Force
+
+      - name: Build Portable CrossDesk
+        run: |
+          xmake f --CROSSDESK_VERSION=${{ env.VERSION_NUM }} --USE_CUDA=true --CROSSDESK_PORTABLE=true -y
+          xmake b -vy crossdesk
 
       - name: Package Portable
         shell: pwsh
         run: |
+          $buildDir = "${{ github.workspace }}\build\windows\x64\release"
           $portableDir = "${{ github.workspace }}\portable"
           New-Item -ItemType Directory -Force -Path $portableDir
-          Copy-Item "${{ github.workspace }}\build\windows\x64\release\crossdesk.exe" "$portableDir\CrossDesk.exe"
+
+          $portableFiles = @(
+            @("crossdesk.exe", "CrossDesk.exe"),
+            @("crossdesk_service.exe", "crossdesk_service.exe"),
+            @("crossdesk_session_helper.exe", "crossdesk_session_helper.exe"),
+            @("crossdesk_privacy_cursor_helper.exe", "crossdesk_privacy_cursor_helper.exe"),
+            @("crossdesk_privacy_window.dll", "crossdesk_privacy_window.dll"),
+            @("slint_cpp.dll", "slint_cpp.dll")
+          )
+
+          foreach ($file in $portableFiles) {
+            $source = Join-Path $buildDir $file[0]
+            $destination = Join-Path $portableDir $file[1]
+            if (!(Test-Path $source)) {
+              throw "Missing portable package file: $source"
+            }
+            Copy-Item $source $destination -Force
+          }
+
+          Copy-Item (Join-Path $buildDir "*.dll") $portableDir -Force
+
+          # Bundled Amyuni usbmmidd_v2 virtual display driver (headless hosts)
+          $driverDir = Join-Path $buildDir "usbmmidd_v2"
+          if (!(Test-Path (Join-Path $driverDir "deviceinstaller64.exe"))) {
+            throw "Missing bundled usbmmidd_v2 driver package: $driverDir"
+          }
+          Copy-Item $driverDir (Join-Path $portableDir "usbmmidd_v2") -Recurse -Force
+
+          foreach ($file in $portableFiles) {
+            $packagedFile = Join-Path $portableDir $file[1]
+            if (!(Test-Path $packagedFile)) {
+              throw "Portable package is missing: $packagedFile"
+            }
+          }
+
           Compress-Archive -Path "$portableDir\*" -DestinationPath "${{ github.workspace }}\crossdesk-win-x64-portable-${{ env.VERSION_NUM }}.zip"
 
       - name: Upload artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v6
         with:
           name: crossdesk-win-x64-${{ env.VERSION_NUM }}
-          path: ${{ github.workspace }}/scripts/windows/crossdesk-win-x64-${{ env.VERSION_NUM }}.exe
+          path: ${{ github.workspace }}/apps/desktop/scripts/windows/crossdesk-win-x64-${{ env.VERSION_NUM }}.exe
 
       - name: Upload portable artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v6
         with:
           name: crossdesk-win-x64-portable-${{ env.VERSION_NUM }}
           path: ${{ github.workspace }}/crossdesk-win-x64-portable-${{ env.VERSION_NUM }}.zip
@@ -265,34 +761,76 @@ jobs:
   release:
     name: Publish Release
     if: startsWith(github.ref, 'refs/tags/v')
-    needs:
-      [build-linux, build-macos, build-windows-x64]
+    needs: [build-linux, build-macos, build-ios, build-windows-x64]
     runs-on: ubuntu-latest
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
 
       - name: Download all artifacts
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v8
         with:
           path: artifacts
 
       - name: Extract version number
         id: version
+        shell: bash
         run: |
-          VERSION="${GITHUB_REF##*/}"
-          SHORT_SHA=$(echo "${GITHUB_SHA}" | cut -c1-7)
+          VERSION_REF="${GITHUB_REF##*/}"
+          VERSION_BASE="${VERSION_REF#v}"
           BUILD_DATE=$(TZ=Asia/Shanghai date +%Y%m%d)
-          BUILD_DATE_ISO=$(TZ=Asia/Shanghai date +%Y-%m-%d)
-          VERSION_NUM="${VERSION#v}-${BUILD_DATE}-${SHORT_SHA}"
+          PATCH_NUMBER="${{ github.event.inputs.patch }}"
+
+          if [[ ! "${PATCH_NUMBER}" =~ ^[0-9]+$ ]]; then
+            PATCH_NUMBER=0
+          fi
+
+          if [[ "${VERSION_BASE}" =~ ^([0-9]+(\.[0-9]+){1,3})-([0-9]+)-([0-9]{8})$ ]]; then
+            VERSION_BASE="${BASH_REMATCH[1]}"
+            PATCH_NUMBER="${BASH_REMATCH[3]}"
+            BUILD_DATE="${BASH_REMATCH[4]}"
+          elif [[ "${VERSION_BASE}" =~ ^([0-9]+(\.[0-9]+){1,3})-([0-9]{8})-([0-9]+)$ ]]; then
+            VERSION_BASE="${BASH_REMATCH[1]}"
+            BUILD_DATE="${BASH_REMATCH[3]}"
+            PATCH_NUMBER="${BASH_REMATCH[4]}"
+          elif [[ "${VERSION_BASE}" =~ ^([0-9]+(\.[0-9]+){1,3})-([0-9]{8})$ ]]; then
+            VERSION_BASE="${BASH_REMATCH[1]}"
+            BUILD_DATE="${BASH_REMATCH[3]}"
+          elif [[ "${VERSION_BASE}" =~ ^([0-9]+(\.[0-9]+){1,3})-([0-9]+)$ && "${PATCH_NUMBER}" == "0" ]]; then
+            VERSION_BASE="${BASH_REMATCH[1]}"
+            PATCH_NUMBER="${BASH_REMATCH[3]}"
+          fi
+
+          BUILD_DATE_ISO="${BUILD_DATE:0:4}-${BUILD_DATE:4:2}-${BUILD_DATE:6:2}"
+          if [[ "${PATCH_NUMBER}" != "0" ]]; then
+            VERSION_NUM="${VERSION_BASE}-${PATCH_NUMBER}-${BUILD_DATE}"
+          else
+            VERSION_NUM="${VERSION_BASE}-${BUILD_DATE}"
+          fi
+
           VERSION_WITH_V="v${VERSION_NUM}"
-          VERSION_ONLY="${VERSION#v}"
           echo "VERSION_NUM=${VERSION_NUM}" >> $GITHUB_OUTPUT
           echo "VERSION_WITH_V=${VERSION_WITH_V}" >> $GITHUB_OUTPUT
-          echo "VERSION_ONLY=${VERSION_ONLY}" >> $GITHUB_OUTPUT
+          echo "VERSION_BASE=${VERSION_BASE}" >> $GITHUB_OUTPUT
           echo "BUILD_DATE=${BUILD_DATE}" >> $GITHUB_OUTPUT
           echo "BUILD_DATE_ISO=${BUILD_DATE_ISO}" >> $GITHUB_OUTPUT
+          echo "PATCH_NUMBER=${PATCH_NUMBER}" >> $GITHUB_OUTPUT
+
+      - name: Prepare release notes
+        run: |
+          cat > "$RUNNER_TEMP/release-notes.md" << EOF
+          ## Corresponding source
+
+          Source for these binaries: [${GITHUB_REF_NAME}](https://github.com/${GITHUB_REPOSITORY}/tree/${GITHUB_SHA}).
+          Clone that version with recursive submodules. The repository includes the build scripts and dependency patches.
+          [iOS source, modification and rebuild instructions](https://github.com/${GITHUB_REPOSITORY}/blob/${GITHUB_SHA}/apps/ios/README.md).
+          The iOS archive also contains the exact source revision and third-party source catalog with archive checksums.
+
+          ## Code signing policy
+
+          Free code signing provided by [SignPath.io](https://signpath.io/), certificate by [SignPath Foundation](https://signpath.org/).
+          EOF
 
       - name: Rename artifacts
         run: |
@@ -301,6 +839,7 @@ jobs:
           cp artifacts/crossdesk-macos-arm64-${{ steps.version.outputs.VERSION_WITH_V }}/* release/crossdesk-macos-arm64-${{ steps.version.outputs.VERSION_WITH_V }}.pkg
           cp artifacts/crossdesk-linux-amd64-${{ steps.version.outputs.VERSION_WITH_V }}/* release/crossdesk-linux-amd64-${{ steps.version.outputs.VERSION_WITH_V }}.deb
           cp artifacts/crossdesk-linux-arm64-${{ steps.version.outputs.VERSION_WITH_V }}/* release/crossdesk-linux-arm64-${{ steps.version.outputs.VERSION_WITH_V }}.deb
+          cp artifacts/crossdesk-ios-arm64-unsigned-${{ needs.build-ios.outputs.version }}/* release/crossdesk-ios-arm64-unsigned-${{ needs.build-ios.outputs.version }}.zip
           cp artifacts/crossdesk-win-x64-${{ steps.version.outputs.VERSION_WITH_V }}/* release/crossdesk-win-x64-${{ steps.version.outputs.VERSION_WITH_V }}.exe
           cp artifacts/crossdesk-win-x64-portable-${{ steps.version.outputs.VERSION_WITH_V }}/* release/crossdesk-win-x64-portable-${{ steps.version.outputs.VERSION_WITH_V }}.zip
 
@@ -311,13 +850,13 @@ jobs:
         uses: softprops/action-gh-release@v2
         with:
           tag_name: ${{ steps.version.outputs.VERSION_WITH_V }}
+          target_commitish: ${{ github.sha }}
           name: Release ${{ steps.version.outputs.VERSION_WITH_V }}
           draft: false
           prerelease: false
           files: release/*
           generate_release_notes: false
-          body: |
-            Binary release only. Source code is not included.
+          body_path: ${{ runner.temp }}/release-notes.md
 
       - name: Create or update 'latest' tag
         run: |
@@ -335,6 +874,7 @@ jobs:
           prerelease: false
           files: release/*
           generate_release_notes: false
+          body_path: ${{ runner.temp }}/release-notes.md
 
       - name: Upload artifacts to server
         uses: burnett01/rsync-deployments@5.2
@@ -350,8 +890,10 @@ jobs:
         run: |
           cat > version.json << EOF
           {
-            "version": "${{ steps.version.outputs.VERSION_ONLY }}",
+            "latest_version": "${{ steps.version.outputs.VERSION_NUM }}",
+            "version": "${{ steps.version.outputs.VERSION_NUM }}",
             "releaseDate": "${{ steps.version.outputs.BUILD_DATE_ISO }}",
+            "patch": ${{ steps.version.outputs.PATCH_NUMBER }},
             "releaseName": "",
             "releaseNotes": "",
             "tagName": "${{ steps.version.outputs.VERSION_WITH_V }}",
@@ -383,6 +925,11 @@ jobs:
             }
           }
           EOF
+          jq --arg release_name "Release ${{ steps.version.outputs.VERSION_WITH_V }}" \
+            --rawfile release_notes "$RUNNER_TEMP/release-notes.md" \
+            '.releaseName = $release_name | .releaseNotes = $release_notes' \
+            version.json > version-with-notes.json
+          mv version-with-notes.json version.json
           cat version.json
 
       - name: Upload version.json to server

.github/workflows/close-issue.yml

@@ -4,6 +4,7 @@ on:
   schedule:
     # run every day at midnight
     - cron: "0 0 * * *"
+  workflow_dispatch:
 
 permissions:
   issues: write
@@ -15,19 +16,21 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Check inactive issues and close them
-        uses: actions/github-script@v6
+        uses: actions/github-script@v7
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         with:
           script: |
-            const { data: issues } = await github.rest.issues.listForRepo({
+            const inactivePeriod = 7 * 24 * 60 * 60 * 1000; // 7 days
+            const now = Date.now();
+
+            // paginate through all open issues (listForRepo also returns PRs)
+            const issues = await github.paginate(github.rest.issues.listForRepo, {
               owner: context.repo.owner,
               repo: context.repo.repo,
               state: 'open',
-              per_page: 100,
             });
 
-            const now = new Date().getTime();
-            const inactivePeriod = 7 * 24 * 60 * 60 * 1000; // 7 days
-
             for (const issue of issues) {
               // skip pull requests (they are also returned by listForRepo)
               if (issue.pull_request) continue;
@@ -38,26 +41,14 @@ jobs:
                 continue;
               }
 
-              // fetch comments for this issue
-              const { data: comments } = await github.rest.issues.listComments({
-                owner: context.repo.owner,
-                repo: context.repo.repo,
-                issue_number: issue.number,
-                per_page: 100,
-              });
-
-              // determine the "last activity" time
-              let lastActivityTime;
-              if (comments.length > 0) {
-                const lastComment = comments[comments.length - 1];
-                lastActivityTime = new Date(lastComment.updated_at).getTime();
-              } else {
-                lastActivityTime = new Date(issue.created_at).getTime();
-              }
+              // last activity time = the issue's own updated_at, which is
+              // refreshed on comments, labels, etc. This avoids relying on
+              // fetching comments and is accurate even when comments are edited.
+              const lastActivityTime = new Date(issue.updated_at).getTime();
 
               // check inactivity
               if (now - lastActivityTime > inactivePeriod) {
-                console.log(`Closing inactive issue: #${issue.number} (No recent replies for 7 days)`);
+                console.log(`Closing inactive issue: #${issue.number} (No activity for 7 days)`);
 
                 await github.rest.issues.createComment({
                   owner: context.repo.owner,
@@ -76,5 +67,3 @@ jobs:
                 console.log(`Skipping issue #${issue.number} (Active within 7 days).`);
               }
             }
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/update-version-json.yml

@@ -20,21 +20,39 @@ jobs:
 
       - name: Extract version from tag
         id: version
+        shell: bash
         run: |
           TAG_NAME="${{ github.event.release.tag_name }}"
-          VERSION_ONLY="${TAG_NAME#v}"
-          echo "TAG_NAME=${TAG_NAME}" >> $GITHUB_OUTPUT
-          echo "VERSION_ONLY=${VERSION_ONLY}" >> $GITHUB_OUTPUT
+          TAG_VERSION="${TAG_NAME#v}"
+          VERSION_FULL="${TAG_VERSION}"
+          VERSION_BASE="${TAG_VERSION}"
+          PATCH_NUMBER=0
 
-          # Extract date from tag if available (format: v1.2.3-20251113-abc)
-          if [[ "${TAG_NAME}" =~ -([0-9]{8})- ]]; then
-            DATE_STR="${BASH_REMATCH[1]}"
+          # Extract date and patch from tags such as v1.2.3-1-20251113.
+          if [[ "${TAG_VERSION}" =~ ^([0-9]+(\.[0-9]+){1,3})-([0-9]+)-([0-9]{8})$ ]]; then
+            VERSION_BASE="${BASH_REMATCH[1]}"
+            PATCH_NUMBER="${BASH_REMATCH[3]}"
+            DATE_STR="${BASH_REMATCH[4]}"
+            BUILD_DATE_ISO="${DATE_STR:0:4}-${DATE_STR:4:2}-${DATE_STR:6:2}"
+          elif [[ "${TAG_VERSION}" =~ ^([0-9]+(\.[0-9]+){1,3})-([0-9]{8})-([0-9]+)$ ]]; then
+            VERSION_BASE="${BASH_REMATCH[1]}"
+            DATE_STR="${BASH_REMATCH[3]}"
+            PATCH_NUMBER="${BASH_REMATCH[4]}"
+            BUILD_DATE_ISO="${DATE_STR:0:4}-${DATE_STR:4:2}-${DATE_STR:6:2}"
+          elif [[ "${TAG_VERSION}" =~ ^([0-9]+(\.[0-9]+){1,3})-([0-9]{8})$ ]]; then
+            VERSION_BASE="${BASH_REMATCH[1]}"
+            DATE_STR="${BASH_REMATCH[3]}"
             BUILD_DATE_ISO="${DATE_STR:0:4}-${DATE_STR:4:2}-${DATE_STR:6:2}"
           else
             # Use release published date
             BUILD_DATE_ISO=$(echo "${{ github.event.release.published_at }}" | cut -d'T' -f1)
           fi
+
+          echo "TAG_NAME=${TAG_NAME}" >> $GITHUB_OUTPUT
+          echo "VERSION_FULL=${VERSION_FULL}" >> $GITHUB_OUTPUT
+          echo "VERSION_BASE=${VERSION_BASE}" >> $GITHUB_OUTPUT
           echo "BUILD_DATE_ISO=${BUILD_DATE_ISO}" >> $GITHUB_OUTPUT
+          echo "PATCH_NUMBER=${PATCH_NUMBER}" >> $GITHUB_OUTPUT
 
       - name: Install jq
         run: sudo apt-get update && sudo apt-get install -y jq
@@ -122,8 +140,10 @@ jobs:
           # Generate version.json using cat and heredoc
           cat > version.json << EOF
           {
-            "version": "${{ steps.version.outputs.VERSION_ONLY }}",
+            "latest_version": "${{ steps.version.outputs.VERSION_FULL }}",
+            "version": "${{ steps.version.outputs.VERSION_FULL }}",
             "releaseDate": "${{ steps.version.outputs.BUILD_DATE_ISO }}",
+            "patch": ${{ steps.version.outputs.PATCH_NUMBER }},
             "releaseName": ${{ steps.release_info.outputs.RELEASE_NAME }},
             "releaseNotes": ${{ steps.release_info.outputs.RELEASE_BODY }},
             "tagName": "${{ steps.version.outputs.TAG_NAME }}",

.gitignore

@@ -1,9 +1,14 @@
 # Xmake cache
 .xmake/
 build/
+apps/ios/Vendor/
+apps/ios/DerivedData*/
+apps/ios/.xmake/
+xcuserdata/
+*.xcuserstate
 
 # MacOS Cache
 .DS_Store
 
 # VSCode cache
-.vscode
+.vscode

.gitmodules

@@ -1,3 +1,3 @@
-[submodule "submodules/minirtc"]
-	path = submodules/minirtc
+[submodule "deps/submodules/minirtc"]
+	path = deps/submodules/minirtc
 	url = https://github.com/kunkundi/minirtc.git

LICENSE

@@ -1,165 +1,674 @@
-                   GNU LESSER GENERAL PUBLIC LICENSE
+                    GNU GENERAL PUBLIC LICENSE
                        Version 3, 29 June 2007
 
- Copyright (C) 2007 Free Software Foundation, Inc. <http://fsf.org/>
+ Copyright (C) 2007 Free Software Foundation, Inc. <https://fsf.org/>
  Everyone is permitted to copy and distribute verbatim copies
  of this license document, but changing it is not allowed.
 
+                            Preamble
 
-  This version of the GNU Lesser General Public License incorporates
-the terms and conditions of version 3 of the GNU General Public
-License, supplemented by the additional permissions listed below.
+  The GNU General Public License is a free, copyleft license for
+software and other kinds of works.
 
-  0. Additional Definitions.
+  The licenses for most software and other practical works are designed
+to take away your freedom to share and change the works.  By contrast,
+the GNU General Public License is intended to guarantee your freedom to
+share and change all versions of a program--to make sure it remains free
+software for all its users.  We, the Free Software Foundation, use the
+GNU General Public License for most of our software; it applies also to
+any other work released this way by its authors.  You can apply it to
+your programs, too.
 
-  As used herein, "this License" refers to version 3 of the GNU Lesser
-General Public License, and the "GNU GPL" refers to version 3 of the GNU
-General Public License.
+  When we speak of free software, we are referring to freedom, not
+price.  Our General Public Licenses are designed to make sure that you
+have the freedom to distribute copies of free software (and charge for
+them if you wish), that you receive source code or can get it if you
+want it, that you can change the software or use pieces of it in new
+free programs, and that you know you can do these things.
 
-  "The Library" refers to a covered work governed by this License,
-other than an Application or a Combined Work as defined below.
+  To protect your rights, we need to prevent others from denying you
+these rights or asking you to surrender the rights.  Therefore, you have
+certain responsibilities if you distribute copies of the software, or if
+you modify it: responsibilities to respect the freedom of others.
 
-  An "Application" is any work that makes use of an interface provided
-by the Library, but which is not otherwise based on the Library.
-Defining a subclass of a class defined by the Library is deemed a mode
-of using an interface provided by the Library.
+  For example, if you distribute copies of such a program, whether
+gratis or for a fee, you must pass on to the recipients the same
+freedoms that you received.  You must make sure that they, too, receive
+or can get the source code.  And you must show them these terms so they
+know their rights.
 
-  A "Combined Work" is a work produced by combining or linking an
-Application with the Library.  The particular version of the Library
-with which the Combined Work was made is also called the "Linked
-Version".
+  Developers that use the GNU GPL protect your rights with two steps:
+(1) assert copyright on the software, and (2) offer you this License
+giving you legal permission to copy, distribute and/or modify it.
 
-  The "Minimal Corresponding Source" for a Combined Work means the
-Corresponding Source for the Combined Work, excluding any source code
-for portions of the Combined Work that, considered in isolation, are
-based on the Application, and not on the Linked Version.
+  For the developers' and authors' protection, the GPL clearly explains
+that there is no warranty for this free software.  For both users' and
+authors' sake, the GPL requires that modified versions be marked as
+changed, so that their problems will not be attributed erroneously to
+authors of previous versions.
 
-  The "Corresponding Application Code" for a Combined Work means the
-object code and/or source code for the Application, including any data
-and utility programs needed for reproducing the Combined Work from the
-Application, but excluding the System Libraries of the Combined Work.
+  Some devices are designed to deny users access to install or run
+modified versions of the software inside them, although the manufacturer
+can do so.  This is fundamentally incompatible with the aim of
+protecting users' freedom to change the software.  The systematic
+pattern of such abuse occurs in the area of products for individuals to
+use, which is precisely where it is most unacceptable.  Therefore, we
+have designed this version of the GPL to prohibit the practice for those
+products.  If such problems arise substantially in other domains, we
+stand ready to extend this provision to those domains in future versions
+of the GPL, as needed to protect the freedom of users.
 
-  1. Exception to Section 3 of the GNU GPL.
+  Finally, every program is threatened constantly by software patents.
+States should not allow patents to restrict development and use of
+software on general-purpose computers, but in those that do, we wish to
+avoid the special danger that patents applied to a free program could
+make it effectively proprietary.  To prevent this, the GPL assures that
+patents cannot be used to render the program non-free.
 
-  You may convey a covered work under sections 3 and 4 of this License
-without being bound by section 3 of the GNU GPL.
+  The precise terms and conditions for copying, distribution and
+modification follow.
 
-  2. Conveying Modified Versions.
+                       TERMS AND CONDITIONS
 
-  If you modify a copy of the Library, and, in your modifications, a
-facility refers to a function or data to be supplied by an Application
-that uses the facility (other than as an argument passed when the
-facility is invoked), then you may convey a copy of the modified
-version:
+  0. Definitions.
 
-   a) under this License, provided that you make a good faith effort to
-   ensure that, in the event an Application does not supply the
-   function or data, the facility still operates, and performs
-   whatever part of its purpose remains meaningful, or
+  "This License" refers to version 3 of the GNU General Public License.
 
-   b) under the GNU GPL, with none of the additional permissions of
-   this License applicable to that copy.
+  "Copyright" also means copyright-like laws that apply to other kinds of
+works, such as semiconductor masks.
 
-  3. Object Code Incorporating Material from Library Header Files.
+  "The Program" refers to any copyrightable work licensed under this
+License.  Each licensee is addressed as "you".  "Licensees" and
+"recipients" may be individuals or organizations.
 
-  The object code form of an Application may incorporate material from
-a header file that is part of the Library.  You may convey such object
-code under terms of your choice, provided that, if the incorporated
-material is not limited to numerical parameters, data structure
-layouts and accessors, or small macros, inline functions and templates
-(ten or fewer lines in length), you do both of the following:
+  To "modify" a work means to copy from or adapt all or part of the work
+in a fashion requiring copyright permission, other than the making of an
+exact copy.  The resulting work is called a "modified version" of the
+earlier work or a work "based on" the earlier work.
 
-   a) Give prominent notice with each copy of the object code that the
-   Library is used in it and that the Library and its use are
-   covered by this License.
+  A "covered work" means either the unmodified Program or a work based
+on the Program.
 
-   b) Accompany the object code with a copy of the GNU GPL and this license
-   document.
+  To "propagate" a work means to do anything with it that, without
+permission, would make you directly or secondarily liable for
+infringement under applicable copyright law, except executing it on a
+computer or modifying a private copy.  Propagation includes copying,
+distribution (with or without modification), making available to the
+public, and in some countries other activities as well.
 
-  4. Combined Works.
+  To "convey" a work means any kind of propagation that enables other
+parties to make or receive copies.  Mere interaction with a user through
+a computer network, with no transfer of a copy, is not conveying.
 
-  You may convey a Combined Work under terms of your choice that,
-taken together, effectively do not restrict modification of the
-portions of the Library contained in the Combined Work and reverse
-engineering for debugging such modifications, if you also do each of
-the following:
+  An interactive user interface displays "Appropriate Legal Notices"
+to the extent that it includes a convenient and prominently visible
+feature that (1) displays an appropriate copyright notice, and (2)
+tells the user that there is no warranty for the work (except to the
+extent that warranties are provided), that licensees may convey the
+work under this License, and how to view a copy of this License.  If
+the interface presents a list of user commands or options, such as a
+menu, a prominent item in the list meets this criterion.
 
-   a) Give prominent notice with each copy of the Combined Work that
-   the Library is used in it and that the Library and its use are
-   covered by this License.
+  1. Source Code.
 
-   b) Accompany the Combined Work with a copy of the GNU GPL and this license
-   document.
+  The "source code" for a work means the preferred form of the work
+for making modifications to it.  "Object code" means any non-source
+form of a work.
 
-   c) For a Combined Work that displays copyright notices during
-   execution, include the copyright notice for the Library among
-   these notices, as well as a reference directing the user to the
-   copies of the GNU GPL and this license document.
+  A "Standard Interface" means an interface that either is an official
+standard defined by a recognized standards body, or, in the case of
+interfaces specified for a particular programming language, one that
+is widely used among developers working in that language.
 
-   d) Do one of the following:
+  The "System Libraries" of an executable work include anything, other
+than the work as a whole, that (a) is included in the normal form of
+packaging a Major Component, but which is not part of that Major
+Component, and (b) serves only to enable use of the work with that
+Major Component, or to implement a Standard Interface for which an
+implementation is available to the public in source code form.  A
+"Major Component", in this context, means a major essential component
+(kernel, window system, and so on) of the specific operating system
+(if any) on which the executable work runs, or a compiler used to
+produce the work, or an object code interpreter used to run it.
 
-       0) Convey the Minimal Corresponding Source under the terms of this
-       License, and the Corresponding Application Code in a form
-       suitable for, and under terms that permit, the user to
-       recombine or relink the Application with a modified version of
-       the Linked Version to produce a modified Combined Work, in the
-       manner specified by section 6 of the GNU GPL for conveying
-       Corresponding Source.
+  The "Corresponding Source" for a work in object code form means all
+the source code needed to generate, install, and (for an executable
+work) run the object code and to modify the work, including scripts to
+control those activities.  However, it does not include the work's
+System Libraries, or general-purpose tools or generally available free
+programs which are used unmodified in performing those activities but
+which are not part of the work.  For example, Corresponding Source
+includes interface definition files associated with source files for
+the work, and the source code for shared libraries and dynamically
+linked subprograms that the work is specifically designed to require,
+such as by intimate data communication or control flow between those
+subprograms and other parts of the work.
 
-       1) Use a suitable shared library mechanism for linking with the
-       Library.  A suitable mechanism is one that (a) uses at run time
-       a copy of the Library already present on the user's computer
-       system, and (b) will operate properly with a modified version
-       of the Library that is interface-compatible with the Linked
-       Version.
+  The Corresponding Source need not include anything that users
+can regenerate automatically from other parts of the Corresponding
+Source.
 
-   e) Provide Installation Information, but only if you would otherwise
-   be required to provide such information under section 6 of the
-   GNU GPL, and only to the extent that such information is
-   necessary to install and execute a modified version of the
-   Combined Work produced by recombining or relinking the
-   Application with a modified version of the Linked Version. (If
-   you use option 4d0, the Installation Information must accompany
-   the Minimal Corresponding Source and Corresponding Application
-   Code. If you use option 4d1, you must provide the Installation
-   Information in the manner specified by section 6 of the GNU GPL
-   for conveying Corresponding Source.)
+  The Corresponding Source for a work in source code form is that
+same work.
 
-  5. Combined Libraries.
+  2. Basic Permissions.
 
-  You may place library facilities that are a work based on the
-Library side by side in a single library together with other library
-facilities that are not Applications and are not covered by this
-License, and convey such a combined library under terms of your
-choice, if you do both of the following:
+  All rights granted under this License are granted for the term of
+copyright on the Program, and are irrevocable provided the stated
+conditions are met.  This License explicitly affirms your unlimited
+permission to run the unmodified Program.  The output from running a
+covered work is covered by this License only if the output, given its
+content, constitutes a covered work.  This License acknowledges your
+rights of fair use or other equivalent, as provided by copyright law.
 
-   a) Accompany the combined library with a copy of the same work based
-   on the Library, uncombined with any other library facilities,
-   conveyed under the terms of this License.
+  You may make, run and propagate covered works that you do not
+convey, without conditions so long as your license otherwise remains
+in force.  You may convey covered works to others for the sole purpose
+of having them make modifications exclusively for you, or provide you
+with facilities for running those works, provided that you comply with
+the terms of this License in conveying all material for which you do
+not control copyright.  Those thus making or running the covered works
+for you must do so exclusively on your behalf, under your direction
+and control, on terms that prohibit them from making any copies of
+your copyrighted material outside their relationship with you.
 
-   b) Give prominent notice with the combined library that part of it
-   is a work based on the Library, and explaining where to find the
-   accompanying uncombined form of the same work.
+  Conveying under any other circumstances is permitted solely under
+the conditions stated below.  Sublicensing is not allowed; section 10
+makes it unnecessary.
 
-  6. Revised Versions of the GNU Lesser General Public License.
+  3. Protecting Users' Legal Rights From Anti-Circumvention Law.
 
-  The Free Software Foundation may publish revised and/or new versions
-of the GNU Lesser General Public License from time to time. Such new
-versions will be similar in spirit to the present version, but may
-differ in detail to address new problems or concerns.
+  No covered work shall be deemed part of an effective technological
+measure under any applicable law fulfilling obligations under article
+11 of the WIPO copyright treaty adopted on 20 December 1996, or
+similar laws prohibiting or restricting circumvention of such
+measures.
 
-  Each version is given a distinguishing version number. If the
-Library as you received it specifies that a certain numbered version
-of the GNU Lesser General Public License "or any later version"
-applies to it, you have the option of following the terms and
-conditions either of that published version or of any later version
-published by the Free Software Foundation. If the Library as you
-received it does not specify a version number of the GNU Lesser
-General Public License, you may choose any version of the GNU Lesser
-General Public License ever published by the Free Software Foundation.
+  When you convey a covered work, you waive any legal power to forbid
+circumvention of technological measures to the extent such circumvention
+is effected by exercising rights under this License with respect to
+the covered work, and you disclaim any intention to limit operation or
+modification of the work as a means of enforcing, against the work's
+users, your or third parties' legal rights to forbid circumvention of
+technological measures.
 
-  If the Library as you received it specifies that a proxy can decide
-whether future versions of the GNU Lesser General Public License shall
-apply, that proxy's public statement of acceptance of any version is
-permanent authorization for you to choose that version for the
-Library.
+  4. Conveying Verbatim Copies.
+
+  You may convey verbatim copies of the Program's source code as you
+receive it, in any medium, provided that you conspicuously and
+appropriately publish on each copy an appropriate copyright notice;
+keep intact all notices stating that this License and any
+non-permissive terms added in accord with section 7 apply to the code;
+keep intact all notices of the absence of any warranty; and give all
+recipients a copy of this License along with the Program.
+
+  You may charge any price or no price for each copy that you convey,
+and you may offer support or warranty protection for a fee.
+
+  5. Conveying Modified Source Versions.
+
+  You may convey a work based on the Program, or the modifications to
+produce it from the Program, in the form of source code under the
+terms of section 4, provided that you also meet all of these conditions:
+
+    a) The work must carry prominent notices stating that you modified
+    it, and giving a relevant date.
+
+    b) The work must carry prominent notices stating that it is
+    released under this License and any conditions added under section
+    7.  This requirement modifies the requirement in section 4 to
+    "keep intact all notices".
+
+    c) You must license the entire work, as a whole, under this
+    License to anyone who comes into possession of a copy.  This
+    License will therefore apply, along with any applicable section 7
+    additional terms, to the whole of the work, and all its parts,
+    regardless of how they are packaged.  This License gives no
+    permission to license the work in any other way, but it does not
+    invalidate such permission if you have separately received it.
+
+    d) If the work has interactive user interfaces, each must display
+    Appropriate Legal Notices; however, if the Program has interactive
+    interfaces that do not display Appropriate Legal Notices, your
+    work need not make them do so.
+
+  A compilation of a covered work with other separate and independent
+works, which are not by their nature extensions of the covered work,
+and which are not combined with it such as to form a larger program,
+in or on a volume of a storage or distribution medium, is called an
+"aggregate" if the compilation and its resulting copyright are not
+used to limit the access or legal rights of the compilation's users
+beyond what the individual works permit.  Inclusion of a covered work
+in an aggregate does not cause this License to apply to the other
+parts of the aggregate.
+
+  6. Conveying Non-Source Forms.
+
+  You may convey a covered work in object code form under the terms
+of sections 4 and 5, provided that you also convey the
+machine-readable Corresponding Source under the terms of this License,
+in one of these ways:
+
+    a) Convey the object code in, or embodied in, a physical product
+    (including a physical distribution medium), accompanied by the
+    Corresponding Source fixed on a durable physical medium
+    customarily used for software interchange.
+
+    b) Convey the object code in, or embodied in, a physical product
+    (including a physical distribution medium), accompanied by a
+    written offer, valid for at least three years and valid for as
+    long as you offer spare parts or customer support for that product
+    model, to give anyone who possesses the object code either (1) a
+    copy of the Corresponding Source for all the software in the
+    product that is covered by this License, on a durable physical
+    medium customarily used for software interchange, for a price no
+    more than your reasonable cost of physically performing this
+    conveying of source, or (2) access to copy the
+    Corresponding Source from a network server at no charge.
+
+    c) Convey individual copies of the object code with a copy of the
+    written offer to provide the Corresponding Source.  This
+    alternative is allowed only occasionally and noncommercially, and
+    only if you received the object code with such an offer, in accord
+    with subsection 6b.
+
+    d) Convey the object code by offering access from a designated
+    place (gratis or for a charge), and offer equivalent access to the
+    Corresponding Source in the same way through the same place at no
+    further charge.  You need not require recipients to copy the
+    Corresponding Source along with the object code.  If the place to
+    copy the object code is a network server, the Corresponding Source
+    may be on a different server (operated by you or a third party)
+    that supports equivalent copying facilities, provided you maintain
+    clear directions next to the object code saying where to find the
+    Corresponding Source.  Regardless of what server hosts the
+    Corresponding Source, you remain obligated to ensure that it is
+    available for as long as needed to satisfy these requirements.
+
+    e) Convey the object code using peer-to-peer transmission, provided
+    you inform other peers where the object code and Corresponding
+    Source of the work are being offered to the general public at no
+    charge under subsection 6d.
+
+  A separable portion of the object code, whose source code is excluded
+from the Corresponding Source as a System Library, need not be
+included in conveying the object code work.
+
+  A "User Product" is either (1) a "consumer product", which means any
+tangible personal property which is normally used for personal, family,
+or household purposes, or (2) anything designed or sold for incorporation
+into a dwelling.  In determining whether a product is a consumer product,
+doubtful cases shall be resolved in favor of coverage.  For a particular
+product received by a particular user, "normally used" refers to a
+typical or common use of that class of product, regardless of the status
+of the particular user or of the way in which the particular user
+actually uses, or expects or is expected to use, the product.  A product
+is a consumer product regardless of whether the product has substantial
+commercial, industrial or non-consumer uses, unless such uses represent
+the only significant mode of use of the product.
+
+  "Installation Information" for a User Product means any methods,
+procedures, authorization keys, or other information required to install
+and execute modified versions of a covered work in that User Product from
+a modified version of its Corresponding Source.  The information must
+suffice to ensure that the continued functioning of the modified object
+code is in no case prevented or interfered with solely because
+modification has been made.
+
+  If you convey an object code work under this section in, or with, or
+specifically for use in, a User Product, and the conveying occurs as
+part of a transaction in which the right of possession and use of the
+User Product is transferred to the recipient in perpetuity or for a
+fixed term (regardless of how the transaction is characterized), the
+Corresponding Source conveyed under this section must be accompanied
+by the Installation Information.  But this requirement does not apply
+if neither you nor any third party retains the ability to install
+modified object code on the User Product (for example, the work has
+been installed in ROM).
+
+  The requirement to provide Installation Information does not include a
+requirement to continue to provide support service, warranty, or updates
+for a work that has been modified or installed by the recipient, or for
+the User Product in which it has been modified or installed.  Access to a
+network may be denied when the modification itself materially and
+adversely affects the operation of the network or violates the rules and
+protocols for communication across the network.
+
+  Corresponding Source conveyed, and Installation Information provided,
+in accord with this section must be in a format that is publicly
+documented (and with an implementation available to the public in
+source code form), and must require no special password or key for
+unpacking, reading or copying.
+
+  7. Additional Terms.
+
+  "Additional permissions" are terms that supplement the terms of this
+License by making exceptions from one or more of its conditions.
+Additional permissions that are applicable to the entire Program shall
+be treated as though they were included in this License, to the extent
+that they are valid under applicable law.  If additional permissions
+apply only to part of the Program, that part may be used separately
+under those permissions, but the entire Program remains governed by
+this License without regard to the additional permissions.
+
+  When you convey a copy of a covered work, you may at your option
+remove any additional permissions from that copy, or from any part of
+it.  (Additional permissions may be written to require their own
+removal in certain cases when you modify the work.)  You may place
+additional permissions on material, added by you to a covered work,
+for which you have or can give appropriate copyright permission.
+
+  Notwithstanding any other provision of this License, for material you
+add to a covered work, you may (if authorized by the copyright holders of
+that material) supplement the terms of this License with terms:
+
+    a) Disclaiming warranty or limiting liability differently from the
+    terms of sections 15 and 16 of this License; or
+
+    b) Requiring preservation of specified reasonable legal notices or
+    author attributions in that material or in the Appropriate Legal
+    Notices displayed by works containing it; or
+
+    c) Prohibiting misrepresentation of the origin of that material, or
+    requiring that modified versions of such material be marked in
+    reasonable ways as different from the original version; or
+
+    d) Limiting the use for publicity purposes of names of licensors or
+    authors of the material; or
+
+    e) Declining to grant rights under trademark law for use of some
+    trade names, trademarks, or service marks; or
+
+    f) Requiring indemnification of licensors and authors of that
+    material by anyone who conveys the material (or modified versions of
+    it) with contractual assumptions of liability to the recipient, for
+    any liability that these contractual assumptions directly impose on
+    those licensors and authors.
+
+  All other non-permissive additional terms are considered "further
+restrictions" within the meaning of section 10.  If the Program as you
+received it, or any part of it, contains a notice stating that it is
+governed by this License along with a term that is a further
+restriction, you may remove that term.  If a license document contains
+a further restriction but permits relicensing or conveying under this
+License, you may add to a covered work material governed by the terms
+of that license document, provided that the further restriction does
+not survive such relicensing or conveying.
+
+  If you add terms to a covered work in accord with this section, you
+must place, in the relevant source files, a statement of the
+additional terms that apply to those files, or a notice indicating
+where to find the applicable terms.
+
+  Additional terms, permissive or non-permissive, may be stated in the
+form of a separately written license, or stated as exceptions;
+the above requirements apply either way.
+
+  8. Termination.
+
+  You may not propagate or modify a covered work except as expressly
+provided under this License.  Any attempt otherwise to propagate or
+modify it is void, and will automatically terminate your rights under
+this License (including any patent licenses granted under the third
+paragraph of section 11).
+
+  However, if you cease all violation of this License, then your
+license from a particular copyright holder is reinstated (a)
+provisionally, unless and until the copyright holder explicitly and
+finally terminates your license, and (b) permanently, if the copyright
+holder fails to notify you of the violation by some reasonable means
+prior to 60 days after the cessation.
+
+  Moreover, your license from a particular copyright holder is
+reinstated permanently if the copyright holder notifies you of the
+violation by some reasonable means, this is the first time you have
+received notice of violation of this License (for any work) from that
+copyright holder, and you cure the violation prior to 30 days after
+your receipt of the notice.
+
+  Termination of your rights under this section does not terminate the
+licenses of parties who have received copies or rights from you under
+this License.  If your rights have been terminated and not permanently
+reinstated, you do not qualify to receive new licenses for the same
+material under section 10.
+
+  9. Acceptance Not Required for Having Copies.
+
+  You are not required to accept this License in order to receive or
+run a copy of the Program.  Ancillary propagation of a covered work
+occurring solely as a consequence of using peer-to-peer transmission
+to receive a copy likewise does not require acceptance.  However,
+nothing other than this License grants you permission to propagate or
+modify any covered work.  These actions infringe copyright if you do
+not accept this License.  Therefore, by modifying or propagating a
+covered work, you indicate your acceptance of this License to do so.
+
+  10. Automatic Licensing of Downstream Recipients.
+
+  Each time you convey a covered work, the recipient automatically
+receives a license from the original licensors, to run, modify and
+propagate that work, subject to this License.  You are not responsible
+for enforcing compliance by third parties with this License.
+
+  An "entity transaction" is a transaction transferring control of an
+organization, or substantially all assets of one, or subdividing an
+organization, or merging organizations.  If propagation of a covered
+work results from an entity transaction, each party to that
+transaction who receives a copy of the work also receives whatever
+licenses to the work the party's predecessor in interest had or could
+give under the previous paragraph, plus a right to possession of the
+Corresponding Source of the work from the predecessor in interest, if
+the predecessor has it or can get it with reasonable efforts.
+
+  You may not impose any further restrictions on the exercise of the
+rights granted or affirmed under this License.  For example, you may
+not impose a license fee, royalty, or other charge for exercise of
+rights granted under this License, and you may not initiate litigation
+(including a cross-claim or counterclaim in a lawsuit) alleging that
+any patent claim is infringed by making, using, selling, offering for
+sale, or importing the Program or any portion of it.
+
+  11. Patents.
+
+  A "contributor" is a copyright holder who authorizes use under this
+License of the Program or a work on which the Program is based.  The
+work thus licensed is called the contributor's "contributor version".
+
+  A contributor's "essential patent claims" are all patent claims
+owned or controlled by the contributor, whether already acquired or
+hereafter acquired, that would be infringed by some manner, permitted
+by this License, of making, using, or selling its contributor version,
+but do not include claims that would be infringed only as a
+consequence of further modification of the contributor version.  For
+purposes of this definition, "control" includes the right to grant
+patent sublicenses in a manner consistent with the requirements of
+this License.
+
+  Each contributor grants you a non-exclusive, worldwide, royalty-free
+patent license under the contributor's essential patent claims, to
+make, use, sell, offer for sale, import and otherwise run, modify and
+propagate the contents of its contributor version.
+
+  In the following three paragraphs, a "patent license" is any express
+agreement or commitment, however denominated, not to enforce a patent
+(such as an express permission to practice a patent or covenant not to
+sue for patent infringement).  To "grant" such a patent license to a
+party means to make such an agreement or commitment not to enforce a
+patent against the party.
+
+  If you convey a covered work, knowingly relying on a patent license,
+and the Corresponding Source of the work is not available for anyone
+to copy, free of charge and under the terms of this License, through a
+publicly available network server or other readily accessible means,
+then you must either (1) cause the Corresponding Source to be so
+available, or (2) arrange to deprive yourself of the benefit of the
+patent license for this particular work, or (3) arrange, in a manner
+consistent with the requirements of this License, to extend the patent
+license to downstream recipients.  "Knowingly relying" means you have
+actual knowledge that, but for the patent license, your conveying the
+covered work in a country, or your recipient's use of the covered work
+in a country, would infringe one or more identifiable patents in that
+country that you have reason to believe are valid.
+
+  If, pursuant to or in connection with a single transaction or
+arrangement, you convey, or propagate by procuring conveyance of, a
+covered work, and grant a patent license to some of the parties
+receiving the covered work authorizing them to use, propagate, modify
+or convey a specific copy of the covered work, then the patent license
+you grant is automatically extended to all recipients of the covered
+work and works based on it.
+
+  A patent license is "discriminatory" if it does not include within
+the scope of its coverage, prohibits the exercise of, or is
+conditioned on the non-exercise of one or more of the rights that are
+specifically granted under this License.  You may not convey a covered
+work if you are a party to an arrangement with a third party that is
+in the business of distributing software, under which you make payment
+to the third party based on the extent of your activity of conveying
+the work, and under which the third party grants, to any of the
+parties who would receive the covered work from you, a discriminatory
+patent license (a) in connection with copies of the covered work
+conveyed by you (or copies made from those copies), or (b) primarily
+for and in connection with specific products or compilations that
+contain the covered work, unless you entered into that arrangement,
+or that patent license was granted, prior to 28 March 2007.
+
+  Nothing in this License shall be construed as excluding or limiting
+any implied license or other defenses to infringement that may
+otherwise be available to you under applicable patent law.
+
+  12. No Surrender of Others' Freedom.
+
+  If conditions are imposed on you (whether by court order, agreement or
+otherwise) that contradict the conditions of this License, they do not
+excuse you from the conditions of this License.  If you cannot convey a
+covered work so as to satisfy simultaneously your obligations under this
+License and any other pertinent obligations, then as a consequence you may
+not convey it at all.  For example, if you agree to terms that obligate you
+to collect a royalty for further conveying from those to whom you convey
+the Program, the only way you could satisfy both those terms and this
+License would be to refrain entirely from conveying the Program.
+
+  13. Use with the GNU Affero General Public License.
+
+  Notwithstanding any other provision of this License, you have
+permission to link or combine any covered work with a work licensed
+under version 3 of the GNU Affero General Public License into a single
+combined work, and to convey the resulting work.  The terms of this
+License will continue to apply to the part which is the covered work,
+but the special requirements of the GNU Affero General Public License,
+section 13, concerning interaction through a network will apply to the
+combination as such.
+
+  14. Revised Versions of this License.
+
+  The Free Software Foundation may publish revised and/or new versions of
+the GNU General Public License from time to time.  Such new versions will
+be similar in spirit to the present version, but may differ in detail to
+address new problems or concerns.
+
+  Each version is given a distinguishing version number.  If the
+Program specifies that a certain numbered version of the GNU General
+Public License "or any later version" applies to it, you have the
+option of following the terms and conditions either of that numbered
+version or of any later version published by the Free Software
+Foundation.  If the Program does not specify a version number of the
+GNU General Public License, you may choose any version ever published
+by the Free Software Foundation.
+
+  If the Program specifies that a proxy can decide which future
+versions of the GNU General Public License can be used, that proxy's
+public statement of acceptance of a version permanently authorizes you
+to choose that version for the Program.
+
+  Later license versions may give you additional or different
+permissions.  However, no additional obligations are imposed on any
+author or copyright holder as a result of your choosing to follow a
+later version.
+
+  15. Disclaimer of Warranty.
+
+  THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY
+APPLICABLE LAW.  EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT
+HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY
+OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO,
+THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+PURPOSE.  THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM
+IS WITH YOU.  SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF
+ALL NECESSARY SERVICING, REPAIR OR CORRECTION.
+
+  16. Limitation of Liability.
+
+  IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
+WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR CONVEYS
+THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY
+GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE
+USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF
+DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD
+PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS),
+EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF
+SUCH DAMAGES.
+
+  17. Interpretation of Sections 15 and 16.
+
+  If the disclaimer of warranty and limitation of liability provided
+above cannot be given local legal effect according to their terms,
+reviewing courts shall apply local law that most closely approximates
+an absolute waiver of all civil liability in connection with the
+Program, unless a warranty or assumption of liability accompanies a
+copy of the Program in return for a fee.
+
+                     END OF TERMS AND CONDITIONS
+
+            How to Apply These Terms to Your New Programs
+
+  If you develop a new program, and you want it to be of the greatest
+possible use to the public, the best way to achieve this is to make it
+free software which everyone can redistribute and change under these terms.
+
+  To do so, attach the following notices to the program.  It is safest
+to attach them to the start of each source file to most effectively
+state the exclusion of warranty; and each file should have at least
+the "copyright" line and a pointer to where the full notice is found.
+
+    <one line to give the program's name and a brief idea of what it does.>
+    Copyright (C) <year>  <name of author>
+
+    This program is free software: you can redistribute it and/or modify
+    it under the terms of the GNU General Public License as published by
+    the Free Software Foundation, either version 3 of the License, or
+    (at your option) any later version.
+
+    This program is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+    GNU General Public License for more details.
+
+    You should have received a copy of the GNU General Public License
+    along with this program.  If not, see <https://www.gnu.org/licenses/>.
+
+Also add information on how to contact you by electronic and paper mail.
+
+  If the program does terminal interaction, make it output a short
+notice like this when it starts in an interactive mode:
+
+    <program>  Copyright (C) <year>  <name of author>
+    This program comes with ABSOLUTELY NO WARRANTY; for details type `show w'.
+    This is free software, and you are welcome to redistribute it
+    under certain conditions; type `show c' for details.
+
+The hypothetical commands `show w' and `show c' should show the appropriate
+parts of the General Public License.  Of course, your program's commands
+might be different; for a GUI interface, you would use an "about box".
+
+  You should also get your employer (if you work as a programmer) or school,
+if any, to sign a "copyright disclaimer" for the program, if necessary.
+For more information on this, and how to apply and follow the GNU GPL, see
+<https://www.gnu.org/licenses/>.
+
+  The GNU General Public License does not permit incorporating your program
+into proprietary programs.  If your program is a subroutine library, you
+may consider it more useful to permit linking proprietary applications with
+the library.  If this is what you want to do, use the GNU Lesser General
+Public License instead of this License.  But first, please read
+<https://www.gnu.org/licenses/why-not-lgpl.html>.

PRIVACY.md

@@ -0,0 +1,147 @@
+# CrossDesk Privacy Policy
+
+Last updated: September 28, 2026
+
+[中文](#中文) | [English](#english)
+
+## 中文
+
+更新日期：2026 年 9 月 28 日
+
+CrossDesk 重视您的个人信息与隐私保护。本政策说明我们在提供远程桌面服务时如何处理相关信息，以及您可以如何管理授权、保存的内容和数据请求。请在使用前阅读并了解本政策。
+
+### 一、适用范围
+
+本政策适用于 CrossDesk 桌面客户端、iOS 客户端，以及由 CrossDesk 项目维护者（以下简称“我们”）提供的默认网络服务。
+
+如果您选择自行部署或使用其他运营者提供的服务器，该服务器所处理的信息、保存期限及安全管理由相应运营者负责。请在使用前了解其隐私政策。本政策中有关客户端本地数据处理的说明仍适用。
+
+### 二、我们处理的信息及用途
+
+**设备连接与身份验证。** 为登记设备、验证连接权限、查询在线状态及建立远程连接，客户端与服务端会处理设备 ID、认证信息及在线状态。服务端还会保存设备身份及认证校验信息、在线与离线时间、客户端版本与平台、设备关联记录，并生成必要的运行和安全日志，用于维持服务、排查故障及防止滥用。
+
+**必要的网络信息。** 建立连接、网络地址转换穿透及中继转发需要处理 IP 地址、端口等网络信息。这些信息用于通信和网络诊断，不等同于读取设备的定位权限。连接服务、中继服务及网络请求可能产生相应日志。
+
+**远程会话内容。** 您发起或接受远程连接后，软件根据使用的功能在参与会话的设备之间传输画面、音频、键盘和鼠标操作、剪贴板文本及文件。会话内容可能包含个人或工作信息，请仅连接您拥有或已获授权使用的设备，并按需管理共享内容。
+
+**版本检查。** 桌面客户端启动后会获取版本信息；iOS 客户端在连接成功并收到远端版本信息后，会获取最新桌面版本信息，用于提示升级。该请求不携带设备 ID 或远端版本号，但网络服务会处理完成请求所必需的网络信息。
+
+CrossDesk 未集成广告投放、广告追踪或用户行为分析功能。客户端不会主动上传诊断日志、崩溃报告或用户行为分析数据。您主动向我们提交问题或日志时，请先移除与问题无关的个人信息及连接凭据。
+
+### 三、数据传输与相关服务
+
+我们提供设备登记、连接协商、中继转发及版本检查服务。即使您使用自托管连接服务，客户端仍会按前述条件访问我们提供的版本服务。
+
+远程会话内容优先在参与会话的设备间直接传输，必要时通过配置的中继服务器转发。中继服务用于实时转发，不提供会话录像或文件归档。客户端本地保存的画面预览和接收文件，按本政策相关说明处理。
+
+自托管服务器由您选择的运营者管理。更换连接服务器后，设备登记、连接协商及中继数据将由相应运营者处理。
+
+### 四、信息保存与安全措施
+
+**客户端本地数据。** 软件会在本机保存连接设置、用户偏好、最近连接记录及必要的运行日志，以支持后续使用和故障排查。iOS 中的本机登录凭据及您选择记住的远程连接密码保存在系统钥匙串中，不通过 iCloud 钥匙串同步；旧版偏好中的本机登录凭据在成功迁入钥匙串后删除。
+
+**远程画面预览。** iOS 默认不保存远程画面预览。只有您在“设置 → 隐私”单独开启并确认后，才会从下一次连接起，每次连接保存一张远程画面，用于最近连接预览。预览仅保存在本机，不上传，并设置为不纳入设备备份。您可以单独清除预览；关闭保存或撤回隐私授权也会清除已有预览。旧版本未经此选择保存的预览会在升级后清理。
+
+**接收的文件。** iOS 接收文件保存在本应用的文件目录中，您可通过系统“文件”应用管理或删除。清除画面预览不会删除接收文件或最近连接记录。
+
+**服务端记录。** 为支持再次连接、服务运维和安全排查，设备身份、状态、关联记录及运行日志可能在连接结束后继续保存。保存范围和期限受服务运行需要、部署规则及适用的保留要求约束。您可以通过下述联系方式查询与您设备相关的信息及保存期限，或提出删除请求。撤回隐私授权、删除本地记录或卸载客户端，不会自动删除已产生的服务端记录；日志、备份和快照需分别核查和处理。
+
+iOS 通过系统钥匙串和文件保护机制保护相应本地数据，默认信令连接进行 TLS 证书校验。请妥善保管设备和连接凭据，避免向无关人员共享访问密码。
+
+### 五、iOS 权限与授权选择
+
+**隐私授权。** 首次使用，或从未提供此选择的旧版升级时，您需阅读本政策、主动勾选并点击同意后，客户端才会登记本机身份、连接信令服务和查询设备在线状态。拒绝后仍可查看设置、离线隐私政策和本地连接记录，远程连接功能暂不可用。
+
+**撤回同意。** 您可以在“设置 → 隐私 → 隐私与授权”中查看隐私政策、授权状态或撤回授权。客户端将停止远程会话、信令连接和版本检查，关闭并清除本地画面预览。再次使用连接功能前需重新同意；重新同意不会自动开启画面预览保存。撤回不影响撤回前已经发生的信息处理，也不等同于删除服务端数据。
+
+**系统权限与会话功能。** iOS 客户端作为控制端接收远程电脑的画面与音频，不采集本机屏幕、摄像头或麦克风。局域网访问权限用于连接本地网络中的设备，您可在系统设置中管理。发送文件通过系统文件选择器选择，不要求开放整个文件库。当前 iOS 界面不读取或发送本机剪贴板文本；远端发送的剪贴板文本可在会话中写入本机剪贴板。
+
+应用及通信组件使用本地文件元数据、应用偏好和计时接口实现文件传输、设置保存及网络计时，不使用这些信息制作设备指纹或进行广告追踪。
+
+### 六、查询与删除请求
+
+您可以管理本地最近连接记录、保存的画面预览及接收文件。删除某条最近连接记录时，其预览及已保存的远程连接密码也会删除。
+
+如需查询、获取数据摘要或删除默认服务中与您设备相关的记录，请通过下述邮箱联系我们，说明设备 ID 和请求范围。为避免未经授权的披露或删除，我们会核实请求权限；请勿通过邮件发送访问密码、私钥或其他敏感凭据。
+
+删除服务端设备身份后，原身份及对应凭据将失效，再次连接可能登记为新设备。数据库记录的删除不表示日志、备份或其他设备上已接收的内容同时删除。使用自托管服务时，请向相应服务器运营者提出服务端数据请求。
+
+### 七、政策更新与联系方式
+
+本政策可能随功能及服务方式调整而更新，更新后的内容和日期将在隐私政策中公布。您可随时在应用设置中查阅当前随应用提供的政策文本。
+
+如对本政策或个人信息处理有疑问，请联系：
+
+邮箱：[junkun.di@hotmail.com](mailto:junkun.di@hotmail.com)
+
+---
+
+## English
+
+Updated: September 28, 2026
+
+CrossDesk respects your privacy. This policy explains how information is processed when we provide remote desktop services and how you can manage consent, locally saved content and data requests. Please read this policy before using the software.
+
+### 1. Scope
+
+This policy applies to the CrossDesk desktop and iOS clients and the default network services provided by the CrossDesk project maintainers ("we" or "us").
+
+If you deploy your own server or choose a server provided by another operator, that operator is responsible for its data processing, retention and security practices. Please review its privacy policy before use. The descriptions of local client data processing in this policy still apply.
+
+### 2. Information processed and its purposes
+
+**Device connections and authentication.** To register devices, verify connection permissions, query availability and establish remote connections, the clients and server process device IDs, authentication information and presence. The server also retains device identity and authentication verification records, online and offline times, client versions and platforms, and device associations. Necessary operational and security logs support service operation, troubleshooting and abuse prevention.
+
+**Necessary network information.** Connections, network address translation traversal and relay forwarding require IP addresses, ports and other network information. This supports communication and network diagnostics and does not involve reading the device's location permission. Connection services, relay services and network requests may generate related logs.
+
+**Remote-session content.** After you initiate or accept a remote connection, the software transfers content between participating devices according to the features used. This includes screens, audio, keyboard and mouse input, clipboard text and files. Such content may contain personal or work information. Connect only to devices you own or are authorized to access, and manage shared content accordingly.
+
+**Version checks.** The desktop client retrieves release information after startup. After connecting and receiving the remote host's version, the iOS client retrieves the latest desktop release information to suggest updates. These requests do not contain device IDs or the remote host's version, but the service processes network information necessary to complete the request.
+
+CrossDesk does not integrate advertising, advertising tracking or behavioral analytics. The clients do not proactively upload diagnostic logs, crash reports or behavioral analytics data. If you choose to submit an issue or logs, remove unrelated personal information and connection credentials first.
+
+### 3. Data transmission and related services
+
+We provide device registration, connection negotiation, relay forwarding and version checks. Even when you use a self-hosted connection service, the client still accesses our version service under the conditions described above.
+
+Remote-session content is transmitted directly between participating devices where possible, or through the configured relay server when needed. The relay service forwards content in real time and does not provide session recording or file archiving. Locally saved previews and received files are handled as described in this policy.
+
+Self-hosted servers are managed by the operator you choose. If you change the connection server, the corresponding operator will process device registration, connection negotiation and relay data.
+
+### 4. Storage and security measures
+
+**Local client data.** The software stores connection settings, preferences, recent connections and necessary operational logs on the device for subsequent use and troubleshooting. On iOS, local login credentials and remote connection passwords you choose to remember are stored in the system Keychain without iCloud Keychain synchronization. Legacy local login credentials in preferences are removed after successful migration to the Keychain.
+
+**Remote desktop previews.** Saving previews is off by default on iOS. Only after you separately enable and confirm it in Settings → Privacy will the app save one remote frame per connection, starting with the next connection, for recent-connection previews. Previews remain local, are not uploaded and are marked as excluded from device backups. You can clear them separately. Disabling saving or withdrawing network consent also clears them. Previews saved by older versions without this choice are cleared on upgrade.
+
+**Received files.** Received files on iOS are stored in the app's file directory and can be managed or deleted through Files. Clearing previews does not delete received files or recent-connection records.
+
+**Server records.** Device identities, presence, associations and operational logs may remain after a connection ends to support reconnection, service operation and security troubleshooting. Their scope and retention depend on operational needs, deployment rules and applicable retention requirements. You can contact us below to ask about records and retention periods related to your device or request deletion. Withdrawing network consent, deleting local records or uninstalling the client does not automatically delete existing server records. Logs, backups and snapshots require separate review and handling.
+
+On iOS, the system Keychain and file protection mechanisms protect the relevant local data, and default signaling connections validate TLS certificates. Keep your devices and connection credentials secure and avoid sharing access passwords with unrelated people.
+
+### 5. iOS permissions and consent choices
+
+**Privacy authorization.** On first use, or when upgrading from a version without this choice, you must read this policy, actively select the checkbox and agree before the client registers a local identity, connects to signaling or queries device presence. If you decline, settings, the offline policy and local connection history remain available, while remote connections are unavailable.
+
+**Withdrawal.** You can review the privacy policy and your authorization status or withdraw consent in Settings → Privacy → Privacy and Authorization. The client stops remote sessions, signaling and version checks, disables preview saving and clears local previews. Consent is required again before reconnecting. Agreeing again does not automatically enable preview saving. Withdrawal does not undo processing that already occurred or delete server data.
+
+**System permissions and session features.** The iOS client receives remote computer screens and audio as a controller; it does not capture the local screen, camera or microphone. Local network access supports connections to devices on your network and can be managed in system settings. File sending uses the system document picker without requiring access to the entire file library. The current iOS interface does not read or send local clipboard text. Text sent by the remote device may be written to the local clipboard during a session.
+
+The app and its communication components use local file metadata, preferences and timing APIs for file transfer, settings and network timing, not for device fingerprinting or advertising tracking.
+
+### 6. Access and deletion requests
+
+You can manage local recent connections, saved previews and received files. Removing a recent connection also removes its preview and remembered remote connection password.
+
+To request access to information, a data summary or deletion of records associated with your device in the default service, contact the email address below with the device ID and scope of your request. We verify the requester's authority to avoid unauthorized disclosure or deletion. Do not send access passwords, private keys or other sensitive credentials by email.
+
+Deleting a server-side device identity invalidates that identity and its credentials; reconnecting may register a new device. Deleting database records does not mean that logs, backups or content already received by other devices are also deleted. For a self-hosted service, direct server-side data requests to its operator.
+
+### 7. Policy changes and contact
+
+This policy may be updated as features and services change. Updated text and its date will be published in the privacy policy. You can review the policy bundled with your app in its settings at any time.
+
+For questions about this policy or the processing of personal information, contact:
+
+Email: [junkun.di@hotmail.com](mailto:junkun.di@hotmail.com)

README.md

@@ -1,264 +1,237 @@
-# CrossDesk
+<div align="center">
+  <img src="apps/desktop/resources/linux/crossdesk_128x128.png" width="80" alt="CrossDesk 标志" />
+  <h1>CrossDesk</h1>
+  <p>轻量、跨平台的远程桌面，让电脑、浏览器和 iPhone / iPad 连接到同一张桌面。</p>
+  <p><a href="https://www.crossdesk.cn/">官方网站</a> · <a href="https://github.com/kunkundi/crossdesk/releases">下载客户端</a> · <a href="https://web.crossdesk.cn/">打开 Web 客户端</a> · <a href="README_EN.md">English</a></p>
+</div>
 
-<a href="https://hellogithub.com/repository/kunkundi/crossdesk" target="_blank"><img src="https://api.hellogithub.com/v1/widgets/recommend.svg?rid=55d41367570345f1838e02fd12be7961&claim_uid=cb0OpZRrBuGVAfL&theme=small" alt="Featured｜HelloGitHub" /></a>
-[![Platform](https://img.shields.io/badge/platform-Windows%20%7C%20Linux%20%7C%20macOS-brightgreen.svg)]()
-[![License: LGPL v3](https://img.shields.io/badge/License-LGPL%20v3-blue.svg)](https://www.gnu.org/licenses/lgpl-3.0)
-[![GitHub last commit](https://img.shields.io/github/last-commit/kunkundi/crossdesk)](https://github.com/kunkundi/crossdesk/commits/web-client)
-[![Build Status](https://github.com/kunkundi/crossdesk/actions/workflows/build.yml/badge.svg)](https://github.com/kunkundi/crossdesk/actions)  
-[![Docker Pulls](https://img.shields.io/docker/pulls/crossdesk/crossdesk-server)](https://hub.docker.com/r/crossdesk/crossdesk-server/tags)
-[![GitHub issues](https://img.shields.io/github/issues/kunkundi/crossdesk.svg)]()
-[![GitHub stars](https://img.shields.io/github/stars/kunkundi/crossdesk.svg?style=social)]()
-[![GitHub forks](https://img.shields.io/github/forks/kunkundi/crossdesk.svg?style=social)]()
+<div align="center">
 
-[ [English](README_EN.md) / 中文 ]
+[![Platforms](https://img.shields.io/badge/platform-Windows%20%7C%20macOS%20%7C%20Linux%20%7C%20iOS-blue)](#download)
+[![Release](https://img.shields.io/github/v/release/kunkundi/crossdesk)](https://github.com/kunkundi/crossdesk/releases)
+[![Build](https://github.com/kunkundi/crossdesk/actions/workflows/build.yml/badge.svg)](https://github.com/kunkundi/crossdesk/actions/workflows/build.yml)
+[![License: GPL v3](https://img.shields.io/badge/license-GPL--3.0-blue)](LICENSE)
+[![Stars](https://img.shields.io/github/stars/kunkundi/crossdesk?style=social)](https://github.com/kunkundi/crossdesk/stargazers)
 
-PC 客户端
-![sup_example](https://github.com/user-attachments/assets/eeb64fbe-1f07-4626-be1c-b77396beb905)
+</div>
+
+CrossDesk 支持 Windows、macOS、Linux 之间的远程访问，也可从浏览器或原生 iOS 客户端控制电脑。项目基于 [MiniRTC](https://github.com/kunkundi/minirtc)，提供实时音视频传输、键鼠控制、文件传输与自托管能力，仍在持续开发中。
+
+> 本文按当前仓库代码整理。截图展示当前 Slint 桌面界面，使用演示 ID、密码、在线状态和连接记录；缩略图来自公开页面；下载包的功能与系统要求请同时核对对应 Release 说明。原生 iOS 客户端的构建、签名方式见下文。
+
+[界面预览](#preview) · [下载与安装](#download) · [快速连接](#quick-start) · [会话操作](#session) · [设置](#settings) · [iOS](#ios) · [自托管](#self-hosting) · [源码构建](docs/BUILD.md) · [常见问题](docs/FAQ.md)
+
+<a id="preview"></a>
+
+## 界面预览
+
+### 桌面客户端
+
+主窗口集中展示本机 ID、连接密码、远程连接入口和近期连接记录。
 
-Web 客户端
 <p align="center">
-  <img width="850" height="550" alt="6bddcbed47ffd4b9988a4037c7f4f524" src="https://github.com/user-attachments/assets/e44f73f9-24ac-46a3-a189-b7f8b6669881" />
+  <img src="docs/images/desktop-main-zh.png" width="800" alt="当前桌面客户端示例：已连接服务器，三台在线设备均显示页面缩略图" />
 </p>
 
-## 简介
-
-CrossDesk 是一个轻量级的跨平台远程桌面软件，支持 Web 端控制远程设备。
-
-CrossDesk 是 [MiniRTC](https://github.com/kunkundi/minirtc.git) 实时音视频传输库的实验性应用。MiniRTC 是一个轻量级的跨平台实时音视频传输库。它具有网络透传（[RFC5245](https://datatracker.ietf.org/doc/html/rfc5245)），视频软硬编解码（H264/AV1），音频编解码（[Opus](https://github.com/xiph/opus)），信令交互，网络拥塞控制，传输加密（[SRTP](https://tools.ietf.org/html/rfc3711)）等基础能力。
-
-## 系统要求
-
-| 平台 | 最低版本 |
-|----------------|---------------------------|
-| **Windows** | Windows 10 及以上 (64 位) |
-| **macOS** | macOS Intel 15.0 及以上 ( 大于 14.0 小于 15.0 的版本可自行编译实现兼容 )<br> macOS Apple Silicon 14.0 及以上 |
-| **Linux** | Ubuntu 22.04 及以上 ( 低版本可自行编译实现兼容 ) |
-
-## 使用
-
-在菜单栏“对端ID”处输入远端桌面的ID，点击“→”即可发起远程连接。
-
-![usage1](https://github.com/user-attachments/assets/3a4bb59f-c84c-44d2-9a20-11790aac510e)
-
-如果远端桌面设置了连接密码，则本端需填写正确的连接密码才能成功发起远程连接。
-
-![password](https://github.com/user-attachments/assets/1beadcce-640d-4f5c-8e77-51917b5294d5)
-
-发起连接前，可在设置中自定义配置项，如语言、视频编码格式等。
-![settings](https://github.com/user-attachments/assets/8bc5468d-7bbb-4e30-95bd-da1f352ac08c)
-
 ### Web 客户端
-浏览器访问 [CrossDesk Web Client](https://web.crossdesk.cn/)。
-输入 **远程设备 ID** 与 **密码**，点击连接即可接入远程设备。如图，**iOS Safari 远程控制 Win11**：
 
-<img width="645" height="300" alt="_cgi-bin_mmwebwx-bin_webwxgetmsgimg__ MsgID=932911462648581698 skey=@crypt_1f5153b1_b550ca7462b5009ce03c991cca2a92a7 mmweb_appid=wx_webfilehelper" src="https://github.com/user-attachments/assets/a5109e6f-752c-4654-9f4e-7e161bddf43e" />
+在浏览器中输入远程设备 ID 和密码，无需在控制端安装桌面客户端。
 
-## 如何编译
+<p align="center">
+  <img src="docs/images/web-client.png" width="800" alt="CrossDesk Web 客户端当前连接首页" />
+</p>
 
-依赖：
-- [xmake](https://xmake.io/#/guide/installation)
-- [cmake](https://cmake.org/download/)
+图片来源与更新方式见 [截图说明](docs/images/README.md)。
 
-Linux环境下需安装以下包：
+## 主要功能
 
-```
-sudo apt-get install -y software-properties-common git curl unzip build-essential libx11-dev libxrandr-dev libxinerama-dev libxcursor-dev libxi-dev libxcb-randr0-dev libxcb-xtest0-dev libxcb-xinerama0-dev libxcb-shape0-dev libxcb-xkb-dev libxcb-xfixes0-dev libxfixes-dev libxv-dev libxtst-dev libasound2-dev libsndio-dev libxcb-shm0-dev libasound2-dev libpulse-dev
+| 能力 | 当前支持 |
+| --- | --- |
+| 跨平台控制 | Windows / macOS / Linux 桌面互控；浏览器与原生 iOS 作为控制端 |
+| 实时画面与声音 | H.264 / AV1、硬件编解码、远端声音播放；会话中可调整画质、30 / 60 fps 与画面偏好 |
+| 多设备与多显示器 | 近期连接、设备别名、会话标签与远端显示器切换 |
+| 输入与协作 | 键鼠输入、远端光标同步、组合键、文本剪贴板同步、文件传输 |
+| 网络与部署 | P2P 直连、TURN 中继与强制中继、SRTP 媒体加密、自托管信令与中继服务 |
+| 隐私屏 | 被连接时自动开启，或在会话工具栏切换；可用性取决于被控端系统与采集方式 |
+| Windows 锁屏控制 | 通过 CrossDesk Service 支持锁屏、登录界面及安全桌面的输入转发 |
+| Linux 无头运行 | 复用已有桌面和应用，或创建独立 Xvfb 虚拟桌面；终端控制台可查看状态、修改密码和设置，见 [运行说明](docs/HEADLESS.md) |
+
+各客户端的入口和能力有所不同；桌面会话操作见下文，iOS 的具体功能见 [开发说明](apps/ios/README.md)。
+
+<a id="download"></a>
+
+## 下载与安装
+
+前往 [GitHub Releases](https://github.com/kunkundi/crossdesk/releases) 或 [官方网站](https://www.crossdesk.cn/)，按系统与 CPU 架构选择安装包。
+
+| 平台 | 当前源码 / CI 基线 | 安装方式 |
+| --- | --- | --- |
+| Windows | Windows 10+，x64 | `.exe` 安装包；便携构建也受支持 |
+| macOS | macOS 14.0+，Intel / Apple Silicon | 选择 x64 或 arm64 的 `.pkg` |
+| Linux | Ubuntu 20.04+，amd64 / arm64，glibc 2.31 基线 | `.deb` 安装包 |
+| iOS / iPadOS | iOS 16.0+，arm64 真机 | 原生客户端；使用 Xcode 构建并签名，CI 产物为未签名应用 |
+| Web | 支持 WebRTC 的浏览器 | 访问 [web.crossdesk.cn](https://web.crossdesk.cn/) |
+
+Linux 下载后，在下载目录中将文件名替换为实际安装包名称：
+
+```bash
+sudo apt install "./crossdesk-linux-amd64-<version>.deb"
 ```
 
-编译
-```
-git clone https://github.com/kunkundi/crossdesk.git
+**macOS 首次运行：** 按应用提示，在“系统设置 → 隐私与安全性”中授予 CrossDesk **屏幕录制**（新系统可能显示为“屏幕与系统音频录制”）及 **辅助功能**权限，再按系统提示重新打开应用。前者用于捕获桌面，后者用于远程键鼠输入。
 
-cd crossdesk
+<a id="quick-start"></a>
 
-git submodule init 
+## 快速连接
 
-git submodule update
+### 从另一台电脑连接
 
-xmake b -vy crossdesk
-```
-编译选项
-```
---USE_CUDA=true/false: 启用 CUDA 硬件编解码，默认不启用
---CROSSDESK_VERSION=xxx: 指定 CrossDesk 的版本
+1. **准备被控电脑。** 安装并运行 CrossDesk，等待底部显示“已连接服务器”。在左侧“本桌面”查看 **本机 ID** 和 **密码**，提供给控制端。
+2. **输入对端 ID。** 在控制端右侧“远程桌面 → 对端 ID”输入被控电脑的 ID，点击 **→**。
+3. **完成密码验证。** 按弹窗输入被控电脑当前的连接密码，确认后等待远程画面出现。需要保存密码时勾选“记住密码”。
+4. **再次连接。** 成功连接过的设备会出现在“近期连接”中，可通过卡片重连，也可编辑别名或删除记录。
 
-# 示例
-xmake f --CROSSDESK_VERSION=1.0.0 --USE_CUDA=true
-```
-运行
-```
-xmake r crossdesk
+本机密码旁的眼睛按钮用于显示 / 隐藏密码，刷新按钮用于生成新的随机密码，铅笔按钮用于手动修改。密码统一为 **6 位数字或英文字母**。修改或刷新时需保持连接服务器；等待修改成功、客户端重新连接后，再复制当前密码。已保存旧密码的控制端需重新输入。
+
+### 从浏览器连接
+
+1. 保持被控电脑上的 CrossDesk 运行，并确认已连接服务器。
+2. 打开 [Web 客户端](https://web.crossdesk.cn/)，输入 **远程设备 ID** 和 **密码**，点击“连接”。
+3. 连接后使用页面提供的显示器、鼠标模式和键盘控件操作远端；手机和平板也可通过浏览器访问。
+
+如果使用自建服务器，需要让控制端与被控端接入同一服务；Web 部署配置见 [CrossDesk Web Client](https://github.com/kunkundi/crossdesk-web-client)。
+
+<a id="session"></a>
+
+## 会话中的常用操作
+
+远程窗口通过会话标签切换设备，控制栏提供以下操作；控制栏收起时先点击展开按钮。将鼠标悬停在图标上可查看提示。
+
+| 入口 | 用途 |
+| --- | --- |
+| 显示器 | 切换远端显示器 |
+| 键盘 | 发送组合键；Windows 的 `Ctrl+Alt+Del` 依赖远端服务 |
+| 鼠标 | 控制 / 释放远端鼠标 |
+| 扬声器 | 播放声音 / 静音 |
+| 文件夹 | 选择文件发送到远端，并查看传输进度 |
+| 画面设置 | 在当前会话中调整画面质量、采集帧率与画面偏好 |
+| 网络状态 | 查看流量、丢包率、帧率、分辨率、直连 / 中继及加密状态 |
+| 隐私屏 | 开启或关闭被控电脑的隐私屏；悬停查看当前状态与可用操作 |
+| 全屏 | 进入 / 退出全屏 |
+| 断开连接 | 结束当前远程会话 |
+
+桌面端可同步文本剪贴板。接收文件的位置可在“设置 → 文件保存路径”调整。关闭主窗口会隐藏窗口并保持程序运行；需要完全退出时使用系统托盘或菜单栏中的退出入口。
+
+### 在会话中调整画面
+
+连接成功后，点击工具栏中的 **画面设置**（滑杆图标），直接选择低 / 中 / 高画质、**30 / 60 fps**，以及帧率优先 / 画质优先 / 平衡。选项会发送给当前被控端，无需断开重连；实际画面效果取决于网络、设备与编码器能力。旧版被控端不支持时，菜单会提示并禁用选项。
+
+<p align="center">
+  <img src="docs/images/desktop-stream-video-settings-zh.png" width="800" alt="当前远程会话的画面设置菜单：画面质量、采集帧率与画面偏好；背景为公开页面演示图" />
+</p>
+
+<a id="settings"></a>
+
+## 客户端设置与更新
+
+点击主窗口右上角 **☰ → 设置**，修改后点击“确认”保存。编码与连接选项建议在建立连接前调整；会话进行中部分选项不可修改。设置列表可向下滚动，查看自托管、启动方式与文件保存路径。画质、帧率和画面偏好在远程会话工具栏中调整。
+
+<p align="center">
+  <img src="docs/images/desktop-settings-zh.png" width="720" alt="当前客户端设置：编码格式、硬件编解码、中继、强制中继与自动隐私屏" />
+</p>
+
+| 设置 | 说明 |
+| --- | --- |
+| 语言 | 中文、English、Русский |
+| 采集方式（Windows） | 自动 / DXGI / WGC / GDI；无显示器主机使用“自动”启用自动适配 |
+| 视频编码格式 | H.264 / AV1；硬件编解码是否可用取决于平台、硬件与构建选项 |
+| 启用中继服务 | 允许借助 TURN 中继建立连接；P2P 连接失败时先检查此项 |
+| 强制中继连接 | 启用中继服务后可勾选，让连接通过中继建立；关闭中继服务会同时关闭此项 |
+| 保存远程画面预览 | 默认开启，保存远程画面预览；关闭后缩略图区域显示被控端平台，并清除已有预览，保留连接记录和密码 |
+| 被连接时开启隐私屏 | 设置本机被远程连接时是否自动启用隐私屏；会话中可从控制端工具栏切换 |
+| 自托管配置 | 填写服务器地址和信令服务端口，并勾选启用 |
+| 开机自启 / 启用守护进程 | 调整启动与进程守护行为，按界面提示重启后生效 |
+| 文件保存路径 | 选择接收文件的目录 |
+
+### 检查更新
+
+客户端启动后会在后台检查版本。发现新版本时，主窗口菜单入口会显示更新提示；打开 **☰ → 关于** 可查看版本，也可点击 **检查更新** 手动检查。发现更新后可查看更新说明并前往下载页面。
+
+<p align="center">
+  <img src="docs/images/desktop-about-zh.png" width="720" alt="关于窗口与检查更新按钮，版本号和检查结果为演示数据" />
+</p>
+
+<a id="ios"></a>
+
+## 原生 iOS / iPadOS 客户端
+
+仓库的 [`apps/ios`](apps/ios/README.md) 提供原生控制端，与桌面端使用同一套 MiniRTC 协议。它可以控制远端电脑；当前不提供将 iPhone / iPad 作为被控桌面的功能。
+
+1. 按 [iOS 开发说明](apps/ios/README.md) 使用 Xcode 构建并签名，安装到 iOS 16+ 的真机。
+2. 在首页输入对端 ID，点击连接并填写密码；成功连接后可从“最近连接”中重连。
+3. 在设置中选择鼠标模式：**相对位置**像触控板一样移动光标，**绝对位置**将触摸位置直接映射到远端画面。
+4. 点击悬浮图标展开菜单，可切换显示器、显示键盘、控制声音或发送文件。收到的文件位于应用的 `Documents/Received`，可通过传输状态旁的分享按钮导出。
+
+当前支持接收远端文本到 iOS 剪贴板；界面暂未提供主动发送本机剪贴板的按钮。
+
+当前支持单指点击、双指右键、长按拖动与捏合缩放；缩放后的双指平移用于移动视图。原生端与浏览器端分别维护，使用入口和手势可能不同。
+
+<a id="windows-service"></a>
+
+## Windows 锁屏与登录界面
+
+**CrossDesk Service**（服务名 `CrossDeskService`）提供锁屏、登录、凭据输入及安全桌面的状态上报、`Ctrl+Alt+Del` 发送和键鼠输入转发。
+
+安装版会注册按需启动的服务，客户端启动时尝试启动它；本机没有 CrossDesk 客户端进程后服务会自动退出。便携版可在提示窗口或“设置 → 锁屏控制服务”中安装服务，需要管理员权限。该服务依赖客户端运行。
+
+<details>
+<summary>手动部署与服务管理命令</summary>
+
+保留完整安装目录；自行部署构建产物时，将 `CrossDesk.exe`、`crossdesk_service.exe`、`crossdesk_session_helper.exe` 及同次构建输出的全部 `.dll` 放在同一目录。在该目录打开管理员 PowerShell，按需执行：
+
+```powershell
+.\CrossDesk.exe --service-install
+.\CrossDesk.exe --service-start
+.\CrossDesk.exe --service-status
+.\CrossDesk.exe --service-ping
+# 停止或卸载服务
+.\CrossDesk.exe --service-stop
+.\CrossDesk.exe --service-uninstall
 ```
 
-### 无 CUDA 环境下的开发支持
+</details>
 
-对于**未安装 CUDA 环境的 Linux 开发者，如果希望编译后的成果物拥有硬件编解码能力**，这里提供了预配置的 [Ubuntu 22.04 Docker 镜像](https://hub.docker.com/r/crossdesk/ubuntu22.04)。该镜像内置必要的构建依赖，可在容器中开箱即用，无需额外配置即可直接编译项目。
+出现“远端 Windows 服务不可用”时，检查被控电脑的安装和服务状态；普通桌面连接仍可使用，受保护界面的控制能力会受限。
 
-进入容器，下载工程后执行：
-```
-export CUDA_PATH=/usr/local/cuda
-export XMAKE_GLOBALDIR=/data
-
-xmake f --USE_CUDA=true
-xmake b --root -vy crossdesk
-```
-
-对于**未安装 CUDA 环境的 Windows 开发者**，执行下面的命令安装 CUDA 编译环境：
-```
-xmake require -vy "cuda 12.6.3"
-```
-安装完成后执行:
-```
-xmake require --info "cuda 12.6.3"
-```
-输出如下:
-
-<img width="860" height="226" alt="Image" src="https://github.com/user-attachments/assets/999ac365-581a-4b9a-806e-05eb3e4cf44d" />
-
-根据上述输出获取到 CUDA 的安装目录，即 installdir 指向的位置。将 CUDA_PATH 加入系统环境变量，或在终端中输入：
-```
-set CUDA_PATH=path_to_cuda_installdir
-```
-重新执行：
-```
-xmake f --USE_CUDA=true
-xmake b -vy crossdesk
-```
-
-#### 注意
-运行时如果客户端状态栏显示 **未连接服务器**，请先在 [CrossDesk 官方网站](https://www.crossdesk.cn/) 安装客户端，以便在环境中安装所需的证书文件。
-
-<img width="256" height="120" alt="image" src="https://github.com/user-attachments/assets/1812f7d6-516b-4b4f-8a3d-98bee505cc5a" />
-
-## 关于 Xmake
-
-#### 安装 Xmake
-使用 curl：
-```
-curl -fsSL https://xmake.io/shget.text | bash
-```
-使用 wget：
-```
-wget https://xmake.io/shget.text -O - | bash
-```
-使用 powershell：
-```
-irm https://xmake.io/psget.text | iex
-```
-
-#### 编译选项
-```
-# 切换编译模式
-xmake f -m debug/release
-
-# 可选编译参数
--r ：重新构建目标
--v ：显示详细的构建日志
--y ：自动确认提示
-
-# 示例
-xmake b -vy crossdesk
-```
-
-#### 运行选项
-```
-# 使用调试模式运行
-xmake r -d crossdesk
-```
-更多使用方法可参考 [Xmake官方文档](https://xmake.io/guide/quick-start.html) 。
+<a id="self-hosting"></a>
 
 ## 自托管服务器
-推荐使用Docker部署CrossDesk Server。
-```bash
-sudo docker run -d \
-  --name crossdesk_server \
-  --network host \
-  -e EXTERNAL_IP=xxx.xxx.xxx.xxx \
-  -e INTERNAL_IP=xxx.xxx.xxx.xxx \
-  -e CROSSDESK_SERVER_PORT=xxxx \
-  -e COTURN_PORT=xxxx \
-  -e MIN_PORT=xxxxx \
-  -e MAX_PORT=xxxxx \
-  -v /var/lib/crossdesk:/var/lib/crossdesk \
-  -v /var/log/crossdesk:/var/log/crossdesk \
-  crossdesk/crossdesk-server:v1.1.3
-```
 
-上述命令中，用户需注意的参数如下：
+可自行部署信令服务与 TURN 中继，并在桌面客户端 **☰ → 设置 → 自托管配置** 中填写连接信息。控制端与被控端都需要启用同一套配置。
 
-**参数**
-- EXTERNAL_IP：服务器公网 IP , 对应 CrossDesk 客户端**自托管服务器配置**中填写的**服务器地址**
-- INTERNAL_IP：服务器内网 IP
-- CROSSDESK_SERVER_PORT：自托管服务使用的端口，对应 CrossDesk 客户端**自托管服务器配置**中填写的**服务器端口**
-- COTURN_PORT: COTURN 服务使用的端口, 对应 CrossDesk 客户端**自托管服务器配置**中填写的**中继服务端口**
-- MIN_PORT/MAX_PORT：COTURN 服务使用的端口范围，例如：MIN_PORT=50000, MAX_PORT=60000，范围可根据客户端数量调整。
-- `-v /var/lib/crossdesk:/var/lib/crossdesk`：持久化数据库和证书文件到宿主机
-- `-v /var/log/crossdesk:/var/log/crossdesk`：持久化日志文件到宿主机
+- [自托管指南](docs/SELF_HOSTING.md)：当前 Compose 部署入口、客户端设置、证书信任与排查。
+- [CrossDesk Server](https://github.com/kunkundi/crossdesk-server)：服务端源码与发布配置。
+- [CrossDesk Web Client](https://github.com/kunkundi/crossdesk-web-client)：浏览器端源码与自托管说明。
 
-**示例**：
-```bash
-sudo docker run -d \
-  --name crossdesk_server \
-  --network host \
-  -e EXTERNAL_IP=114.114.114.114 \
-  -e INTERNAL_IP=10.0.0.1 \
-  -e CROSSDESK_SERVER_PORT=9099 \
-  -e COTURN_PORT=3478 \
-  -e MIN_PORT=50000 \
-  -e MAX_PORT=60000 \
-  -v /var/lib/crossdesk:/var/lib/crossdesk \
-  -v /var/log/crossdesk:/var/log/crossdesk \
-  crossdesk/crossdesk-server:v1.1.3
-```
+## 开发与反馈
 
-**注意**：
-- **服务器需开放端口：COTURN_PORT/udp，COTURN_PORT/tcp，MIN_PORT-MAX_PORT/udp，CROSSDESK_SERVER_PORT/tcp。**
-- 如果不挂载 volume，容器删除后数据会丢失
-- 证书文件会在首次启动时自动生成并持久化到宿主机的 `/var/lib/crossdesk/certs` 路径下。由于默认使用的是自签证书，无法保障安全性，建议在云服务商申请正式证书放到该目录下并重启服务。
-- 数据库文件会自动创建并持久化到宿主机的 `/var/lib/crossdesk/db/crossdesk-server.db` 路径下
-- 日志文件会自动创建并持久化到宿主机的 `/var/log/crossdesk/` 路径下
+- [源码构建](docs/BUILD.md)：Windows、macOS、Linux、可选编译参数与打包。
+- [iOS 开发说明](apps/ios/README.md)：原生端构建和真机验证。
+- [GUI 架构](docs/gui-architecture.md)：桌面 UI、平台实现与工程结构。
+- [常见问题](docs/FAQ.md)：连接失败、黑屏、文件位置与编译问题。
+- [提交问题](https://github.com/kunkundi/crossdesk/issues)：请附上两端系统、客户端版本、连接方式和可复现步骤。
 
-**权限注意**：如果 Docker 自动创建的目录权限不足（属于 root），容器内用户无法写入，会导致：
-  - 证书生成失败，容器启动脚本会报错退出
-  - 数据库目录创建失败，程序会抛出异常并崩溃
-  - 日志目录创建失败，日志文件无法写入（但程序可能继续运行）
-  
-**解决方案**：在启动容器前手动设置权限：
-```bash
-sudo mkdir -p /var/lib/crossdesk /var/log/crossdesk
-sudo chown -R $(id -u):$(id -g) /var/lib/crossdesk /var/log/crossdesk
-```
+## 致谢与许可
 
+感谢 [HelloGitHub](https://hellogithub.com/)、[阮一峰的科技爱好者周刊](https://github.com/ruanyf/weekly) 与 [LinuxDo](https://linux.do) 社区的推荐、交流与支持。
 
-### 客户端
-1. 点击右上角设置进入设置页面。<br><br>
-<img width="600" height="210" alt="image" src="https://github.com/user-attachments/assets/6431131d-b32a-4726-8783-6788f47baa3b" /><br>
+CrossDesk 使用 [GPL-3.0](LICENSE) 许可。隐私说明见 [隐私政策](PRIVACY.md#中文)。
 
-2. 点击`自托管服务器配置`按钮。<br><br>
-<img width="600" height="160" alt="image" src="https://github.com/user-attachments/assets/24c761a3-1985-4d7e-84be-787383c2afb8" /><br>
+### Code signing policy
 
-3. 输入`服务器地址`(**EXTERNAL_IP**)、`信令服务端口`(**CROSSDESK_SERVER_PORT**)、`中继服务端口`(**COTURN_PORT**)，点击确认按钮。
-   
-4. 勾选`自托管服务器配置`选项，点击确认按钮保存设置。如果服务端使用的是正式证书，则到此步骤为止，客户端即可显示已连接服务器。
+CrossDesk 使用 SignPath.io 为本仓库构建的官方 Windows 发布包提供代码签名。
 
-5. 如果使用默认证书（正式证书忽略此步骤），则需要将服务端`/var/lib/crossdesk/certs/`目录下的`api.crossdesk.cn_root.crt`自签根证书下载到运行客户端的机器，并执行下述命令安装证书：
+**Free code signing provided by [SignPath.io](https://signpath.io/), certificate by [SignPath Foundation](https://signpath.org/).**
 
-Windows 平台使用**管理员权限**打开 PowerShell 执行
-```
-certutil -addstore "Root" "C:\path\to\api.crossdesk.cn_root.crt"
-```
-Linux
-```
-sudo cp /path/to/api.crossdesk.cn_root.crt /usr/local/share/ca-certificates/api.crossdesk.cn_root.crt
-sudo update-ca-certificates
-```
-macOS
-```
-sudo security add-trusted-cert -d -r trustRoot -k /Library/Keychains/System.keychain path/to/api.crossdesk.cn_root.crt
-```
-
-### Web 客户端
-详情见项目 [CrossDesk Web Client](https://github.com/kunkundi/crossdesk-web-client)。
-
-# 常见问题
-见 [常见问题](https://github.com/kunkundi/crossdesk/blob/self-hosted-server/docs/FAQ.md) 。
+- **Committers and reviewers（代码提交与审核）：** [kunkundi](https://github.com/kunkundi)
+- **Approvers（签名审批）：** [kunkundi](https://github.com/kunkundi)

README_EN.md

@@ -1,276 +1,237 @@
-# CrossDesk
+<div align="center">
+  <img src="apps/desktop/resources/linux/crossdesk_128x128.png" width="80" alt="CrossDesk logo" />
+  <h1>CrossDesk</h1>
+  <p>A lightweight, cross-platform remote desktop for computers, browsers, and iPhone / iPad.</p>
+  <p><a href="https://www.crossdesk.cn/">Website</a> · <a href="https://github.com/kunkundi/crossdesk/releases">Download</a> · <a href="https://web.crossdesk.cn/">Open Web Client</a> · <a href="README.md">中文</a></p>
+</div>
 
-<a href="https://hellogithub.com/repository/kunkundi/crossdesk" target="_blank"><img src="https://api.hellogithub.com/v1/widgets/recommend.svg?rid=55d41367570345f1838e02fd12be7961&claim_uid=cb0OpZRrBuGVAfL&theme=small" alt="Featured｜HelloGitHub" /></a>
-[![Platform](https://img.shields.io/badge/platform-Windows%20%7C%20Linux%20%7C%20macOS-brightgreen.svg)]()
-[![License: LGPL v3](https://img.shields.io/badge/License-LGPL%20v3-blue.svg)](https://www.gnu.org/licenses/lgpl-3.0)
-[![GitHub last commit](https://img.shields.io/github/last-commit/kunkundi/crossdesk)](https://github.com/kunkundi/crossdesk/commits/web-client)
-[![Build Status](https://github.com/kunkundi/crossdesk/actions/workflows/build.yml/badge.svg)](https://github.com/kunkundi/crossdesk/actions)  
-[![Docker Pulls](https://img.shields.io/docker/pulls/crossdesk/crossdesk-server)](https://hub.docker.com/r/crossdesk/crossdesk-server/tags)
-[![GitHub issues](https://img.shields.io/github/issues/kunkundi/crossdesk.svg)]()
-[![GitHub stars](https://img.shields.io/github/stars/kunkundi/crossdesk.svg?style=social)]()
-[![GitHub forks](https://img.shields.io/github/forks/kunkundi/crossdesk.svg?style=social)]()
+<div align="center">
 
-[ [中文](README.md) / English ]
+[![Platforms](https://img.shields.io/badge/platform-Windows%20%7C%20macOS%20%7C%20Linux%20%7C%20iOS-blue)](#download)
+[![Release](https://img.shields.io/github/v/release/kunkundi/crossdesk)](https://github.com/kunkundi/crossdesk/releases)
+[![Build](https://github.com/kunkundi/crossdesk/actions/workflows/build.yml/badge.svg)](https://github.com/kunkundi/crossdesk/actions/workflows/build.yml)
+[![License: GPL v3](https://img.shields.io/badge/license-GPL--3.0-blue)](LICENSE)
+[![Stars](https://img.shields.io/github/stars/kunkundi/crossdesk?style=social)](https://github.com/kunkundi/crossdesk/stargazers)
 
-PC Client
-![sup_example](https://github.com/user-attachments/assets/3f17d8f3-7c4a-4b63-bae4-903363628687)
+</div>
+
+CrossDesk connects Windows, macOS, and Linux desktops, with browser and native iOS clients for controlling computers. Built on [MiniRTC](https://github.com/kunkundi/minirtc), it supports real-time video and audio, keyboard and mouse control, file transfer, and self-hosting. The project is under active development.
+
+> This guide follows the current repository source. Desktop screenshots render the current Slint UI with sample IDs, passwords, online statuses, and recent devices; thumbnails show public pages. Check each release's notes for the features and requirements of its binaries. Native iOS build and signing instructions are below.
+
+[Preview](#preview) · [Download](#download) · [Quick start](#quick-start) · [Session controls](#session) · [Settings](#settings) · [iOS](#ios) · [Self-hosting](#self-hosting) · [Build](docs/BUILD_EN.md) · [FAQ](docs/FAQ.md#english)
+
+<a id="preview"></a>
+
+## Preview
+
+### Desktop client
+
+The main window brings together your device ID, connection password, remote connection entry, and recent devices.
 
-Web Client
 <p align="center">
-  <img width="850" height="550" alt="6bddcbed47ffd4b9988a4037c7f4f524" src="https://github.com/user-attachments/assets/e44f73f9-24ac-46a3-a189-b7f8b6669881" />
+  <img src="docs/images/desktop-main-en.png" width="800" alt="Current desktop UI example showing a connected server and three online devices with page thumbnails" />
 </p>
 
-# Intro
+### Web client
 
-CrossDesk is a lightweight cross-platform remote desktop software.
+Enter a remote device ID and password in your browser without installing the desktop app on the controlling device.
 
-CrossDesk is an experimental application of [MiniRTC](https://github.com/kunkundi/minirtc.git), a lightweight cross-platform real-time audio and video transmission library. MiniRTC provides fundamental capabilities including network traversal ([RFC5245](https://datatracker.ietf.org/doc/html/rfc5245)), video software/hardware encoding and decoding (H264/AV1), audio encoding/decoding ([Opus](https://github.com/xiph/opus)), signaling interaction, network congestion control, and transmission encryption ([SRTP](https://tools.ietf.org/html/rfc3711)).
+<p align="center">
+  <img src="docs/images/web-client.png" width="800" alt="Current CrossDesk Web Client connection page in Chinese" />
+</p>
 
-## System Requirements
+See the [screenshot notes](docs/images/README.md) for image sources and refresh instructions.
 
-| Platform | Minimum Version |
-|-----------|-----------------|
-| **Windows** | Windows 10 or later (64-bit) |
-| **macOS** | macOS Intel 15.0 or later *(versions between 14.0 and 15.0 can be built manually for compatibility)*<br>macOS Apple Silicon 14.0 or later |
-| **Linux** | Ubuntu 22.04 or later *(older versions can be built manually for compatibility)* |
+## Features
 
+| Capability | Current support |
+| --- | --- |
+| Cross-platform control | Windows / macOS / Linux desktop control; browser and native iOS controllers |
+| Live video and audio | H.264 / AV1, hardware codecs, and remote audio; adjust quality, 30 / 60 fps, and video preference during a session |
+| Devices and displays | Recent connections, device aliases, session tabs, and remote display switching |
+| Input and sharing | Keyboard/mouse input, remote cursor synchronization, shortcuts, text clipboard synchronization, and file transfer |
+| Networking and deployment | Direct P2P connections, TURN relay and forced relay, SRTP media encryption, and self-hosted signaling/relay services |
+| Privacy screen | Enable automatically when connected to, or toggle from the session toolbar; availability depends on the host OS and capture method |
+| Windows protected desktops | CrossDesk Service forwards input on lock screens, sign-in screens, and secure desktops |
+| Linux headless operation | Reuse existing desktops and applications or create separate Xvfb desktops; use the terminal console to check status and change passwords or settings; see [setup](docs/HEADLESS_EN.md) |
 
-## Usage
+Controls and capabilities vary by client. Desktop controls are described below; see the [iOS guide](apps/ios/README.md) for native mobile features.
 
-Enter the remote desktop ID in the menu bar’s “Remote ID” field and click “→” to initiate a remote connection.
+<a id="download"></a>
 
-![usage1](https://github.com/user-attachments/assets/3a4bb59f-c84c-44d2-9a20-11790aac510e)
+## Download and install
 
-If the remote desktop requires a connection password, you must enter the correct password on your side to successfully establish the connection.
+Choose a package matching your OS and CPU architecture from [GitHub Releases](https://github.com/kunkundi/crossdesk/releases) or the [website](https://www.crossdesk.cn/).
 
-![password](https://github.com/user-attachments/assets/1beadcce-640d-4f5c-8e77-51917b5294d5)
+| Platform | Current source / CI baseline | Installation |
+| --- | --- | --- |
+| Windows | Windows 10+, x64 | `.exe` installer; portable builds are also supported |
+| macOS | macOS 14.0+, Intel / Apple Silicon | x64 or arm64 `.pkg` |
+| Linux | Ubuntu 20.04+, amd64 / arm64, glibc 2.31 baseline | `.deb` package |
+| iOS / iPadOS | iOS 16.0+, arm64 physical device | Native controller; build and sign with Xcode, or sign the unsigned CI app |
+| Web | A WebRTC-capable browser | Open [web.crossdesk.cn](https://web.crossdesk.cn/) |
 
-Before connecting, you can customize configuration options in the settings, such as language and video encoding format.
+On Linux, replace the example filename with the downloaded package name:
 
-![settings](https://github.com/user-attachments/assets/8bc5468d-7bbb-4e30-95bd-da1f352ac08c)
-
-### Web Client
-
-Visit  [CrossDesk Web Client](https://web.crossdesk.cn/).
-Enter the **Remote Device ID** and **Password**, then click Connect to access the remote device. As shown, **iOS Safari remotely controlling Windows 11**:
-
-<img width="645" height="300" alt="_cgi-bin_mmwebwx-bin_webwxgetmsgimg__ MsgID=932911462648581698 skey=@crypt_1f5153b1_b550ca7462b5009ce03c991cca2a92a7 mmweb_appid=wx_webfilehelper" src="https://github.com/user-attachments/assets/a5109e6f-752c-4654-9f4e-7e161bddf43e" />
-
-## How to build
-
-Requirements:
-- [xmake](https://xmake.io/#/guide/installation)
-- [cmake](https://cmake.org/download/)
-
-Following packages need to be installed on Linux:
-
-```
-sudo apt-get install -y software-properties-common git curl unzip build-essential libx11-dev libxrandr-dev libxinerama-dev libxcursor-dev libxi-dev libxcb-randr0-dev libxcb-xtest0-dev libxcb-xinerama0-dev libxcb-shape0-dev libxcb-xkb-dev libxcb-xfixes0-dev libxfixes-dev libxv-dev libxtst-dev libasound2-dev libsndio-dev libxcb-shm0-dev libasound2-dev libpulse-dev
-```
-
-Build:
-```
-git clone https://github.com/kunkundi/crossdesk.git
-
-cd crossdesk
-
-git submodule init 
-
-git submodule update
-
-xmake b -vy crossdesk
-```
-Build options:
-```
---USE_CUDA=true/false: enable CUDA acceleration codec, default: false
---CROSSDESK_VERSION=xxx: set the version number
-
-# example:
-xmake f --CROSSDESK_VERSION=1.0.0 --USE_CUDA=true
-```
-Run:
-```
-xmake r crossdesk
-```
-
-#### Development Without CUDA Environment
-
-For **Linux developers who do not have a CUDA environment installed and want to enable hardware codec feature**, a preconfigured [Ubuntu 22.04 Docker image](https://hub.docker.com/r/crossdesk/ubuntu22.04) is provided.  
-This image comes with all required build dependencies and allows you to build the project directly inside the container without any additional setup.
-
-After entering the container, download the project and run:
-```
-export CUDA_PATH=/usr/local/cuda
-export XMAKE_GLOBALDIR=/data
-
-xmake f --USE_CUDA=true
-xmake b --root -vy crossdesk
-```
-
-For **Windows developers without a CUDA environment** installed, run the following command to install the CUDA build environment:
-```
-xmake require -vy "cuda 12.6.3"
-```
-After the installation is complete, execute:
-```
-xmake require --info "cuda 12.6.3"
-```
-The output will look like this:
-
-<img width="860" height="226" alt="Image" src="https://github.com/user-attachments/assets/999ac365-581a-4b9a-806e-05eb3e4cf44d" />
-
-From the output above, locate the CUDA installation directory — this is the path pointed to by installdir.
-Add this path to your system environment variable CUDA_PATH, or set it in the terminal using:
-```
-set CUDA_PATH=path_to_cuda_installdir:
-```
-Then re-run:
-```
-xmake f --USE_CUDA=true
-xmake b -vy crossdesk
-```
-
-#### Notice
-If the client status bar shows **Disconnected** during runtime, please first install the client from the [CrossDesk official website](https://www.crossdesk.cn/) to ensure the required certificate files are available in the environment.
-
-<img width="256" height="120" alt="image" src="https://github.com/user-attachments/assets/1812f7d6-516b-4b4f-8a3d-98bee505cc5a" />
-
-## About Xmake
-#### Installing Xmake
-
-You can install Xmake using one of the following methods:
-
-Using curl:
-```
-curl -fsSL https://xmake.io/shget.text | bash
-```
-Using wget:
-```
-wget https://xmake.io/shget.text -O - | bash
-```
-Using powershell:
-```
-irm https://xmake.io/psget.text | iex
-```
-
-#### Build Options
-```
-# Switch build mode
-xmake f -m debug/release
-
-# Optional build parameters
--r : Rebuild the target
--v : Show detailed build logs
--y : Automatically confirm prompts
-
-# Example
-xmake b -vy crossdesk
-```
-
-#### Run Options
-```
-# Run in debug mode
-xmake r -d crossdesk
-```
-
-For more information, please refer to the [official Xmake documentation](https://xmake.io/guide/quick-start.html) .
-
-## Self-Hosted Server
-It is recommended to deploy CrossDesk Server using Docker.
-```
-sudo docker run -d \
-  --name crossdesk_server \
-  --network host \
-  -e EXTERNAL_IP=xxx.xxx.xxx.xxx \
-  -e INTERNAL_IP=xxx.xxx.xxx.xxx \
-  -e CROSSDESK_SERVER_PORT=xxxx \
-  -e COTURN_PORT=xxxx \
-  -e MIN_PORT=xxxxx \
-  -e MAX_PORT=xxxxx \
-  -v /var/lib/crossdesk:/var/lib/crossdesk \
-  -v /var/log/crossdesk:/var/log/crossdesk \
-  crossdesk/crossdesk-server:v1.1.3
-```
-
-The parameters you need to pay attention to are as follows:
-
-**Parameters**
-- **EXTERNAL_IP**: The server’s public IP. This corresponds to **Server Address** in the CrossDesk client’s **Self-Hosted Server Configuration**.
-- **INTERNAL_IP**: The server’s internal IP.
-- **CROSSDESK_SERVER_PORT**: The port used by the self-hosted service. This corresponds to **Server Port** in the CrossDesk client’s **Self-Hosted Server Configuration**.
-- **COTURN_PORT**: The port used by the COTURN service. This corresponds to **Relay Service Port** in the CrossDesk client’s **Self-Hosted Server Configuration**.
-- **MIN_PORT / MAX_PORT**: The port range used by the COTURN service. Example: `MIN_PORT=50000`, `MAX_PORT=60000`. Adjust the range depending on the number of clients.
-- `-v /var/lib/crossdesk:/var/lib/crossdesk`: Persists database and certificate files on the host machine.
-- `-v /var/log/crossdesk:/var/log/crossdesk`: Persists log files on the host machine.
-
-**Example**:
 ```bash
-sudo docker run -d \
-  --name crossdesk_server \
-  --network host \
-  -e EXTERNAL_IP=114.114.114.114 \
-  -e INTERNAL_IP=10.0.0.1 \
-  -e CROSSDESK_SERVER_PORT=9099 \
-  -e COTURN_PORT=3478 \
-  -e MIN_PORT=50000 \
-  -e MAX_PORT=60000 \
-  -v /var/lib/crossdesk:/var/lib/crossdesk \
-  -v /var/log/crossdesk:/var/log/crossdesk \
-  crossdesk/crossdesk-server:v1.1.3
+sudo apt install "./crossdesk-linux-amd64-<version>.deb"
 ```
 
-**Notes**
-- **The server must open the following ports: COTURN_PORT/udp, COTURN_PORT/tcp, MIN_PORT–MAX_PORT/udp, and CROSSDESK_SERVER_PORT/tcp.**
-- If you don’t mount volumes, all data will be lost when the container is removed.
-- Certificate files will be automatically generated on first startup and persisted to the host at `/var/lib/crossdesk/certs`.As the default certificates are self-signed and cannot guarantee security, it is strongly recommended to apply for a trusted certificate from a cloud provider, deploy it to this directory, and restart the service.
-- The database file will be automatically created and stored at `/var/lib/crossdesk/db/crossdesk-server.db`.
-- Log files will be created and stored at `/var/log/crossdesk/`.
+**First launch on macOS:** follow the app prompts to grant **Screen Recording** (called **Screen & System Audio Recording** on newer systems) and **Accessibility** under **System Settings → Privacy & Security**. Reopen the app if prompted. These permissions allow desktop capture and remote keyboard/mouse input respectively.
 
-**Permission Notice**
-If the directories automatically created by Docker belong to root and have insufficient write permissions, the container user may not be able to write to them. This can cause:
-  - Certificate generation failure, leading to startup script errors and container exit.
-  - Database directory creation failure, causing the program to throw exceptions and crash.
-  - Log directory creation failure, preventing logs from being written (though the program may continue running).
+<a id="quick-start"></a>
 
-**Solution:** Manually set permissions before starting the container:
-```bash
-sudo mkdir -p /var/lib/crossdesk /var/log/crossdesk
-sudo chown -R $(id -u):$(id -g) /var/lib/crossdesk /var/log/crossdesk
+## Quick start
+
+### Connect from another computer
+
+1. **Prepare the host.** Install and run CrossDesk on the computer to control. Wait for the bottom status bar to show that the server is connected. Share the **Local ID** and **Password** shown under **Local Desktop** with the controller.
+2. **Enter the remote ID.** On the controlling computer, enter the host's ID in **Remote Desktop → Remote ID**, then click **→**.
+3. **Verify the password.** Enter the host's current connection password when prompted and confirm. Select **Remember password** if you want to save it.
+4. **Reconnect later.** Previously connected devices appear under **Recent Connections**. Reconnect from a card, edit its alias, or remove its record.
+
+The eye button shows or hides the local password, the refresh button generates a new random password, and the pencil button lets you edit it. Passwords use **6 ASCII letters or digits**. Stay connected to the server when editing or refreshing a password. Wait for the change to succeed and the client to reconnect, then copy the current password. Controllers that saved the old password must enter it again.
+
+### Connect from a browser
+
+1. Keep CrossDesk running and connected to the server on the host computer.
+2. Open the [Web Client](https://web.crossdesk.cn/), enter the **Remote Device ID** and **Password**, and click **Connect**.
+3. Use the page's display, mouse-mode, and keyboard controls during the session. Phone and tablet browsers can also connect.
+
+For self-hosting, connect both sides to the same service. Browser deployment is documented in [CrossDesk Web Client](https://github.com/kunkundi/crossdesk-web-client).
+
+<a id="session"></a>
+
+## Session controls
+
+Switch devices using session tabs. Expand the control bar if it is collapsed, and hover over icons to see their tooltips.
+
+| Control | Action |
+| --- | --- |
+| Display | Switch the remote monitor |
+| Keyboard | Send shortcuts; Windows `Ctrl+Alt+Del` requires the remote service |
+| Mouse | Enable / release remote mouse control |
+| Speaker | Play / mute remote audio |
+| Folder | Select a file to send and view transfer progress |
+| Video settings | Adjust video quality, capture frame rate, and video preference during the current session |
+| Network statistics | Inspect traffic, packet loss, frame rate, resolution, direct / relay mode, and encryption status |
+| Privacy screen | Enable or disable the host's privacy screen; hover to see its status and available actions |
+| Fullscreen | Enter / exit fullscreen |
+| Disconnect | End the current remote session |
+
+Desktop clients synchronize text clipboard contents. Configure the receiving directory under **Settings → File Save Path**. Closing the main window hides it and keeps the app running; use the system tray or menu-bar exit command to quit completely.
+
+### Adjust video during a session
+
+After connecting, open **Video settings** (the sliders icon) in the toolbar. Choose low / medium / high quality, **30 / 60 fps**, and frame-rate priority / quality priority / balanced adaptation. Changes are sent to the current host without reconnecting; actual results depend on the network, device, and encoder. For older hosts that do not support live video settings, the menu explains the limitation and disables the options.
+
+<p align="center">
+  <img src="docs/images/desktop-stream-video-settings-en.png" width="800" alt="Current session video menu with quality, capture frame rate, and video preference; the background is a public page used for demonstration" />
+</p>
+
+<a id="settings"></a>
+
+## Client settings and updates
+
+Open **☰ → Settings** in the top-right corner and click **OK** to save. Configure codecs and connections before connecting; some settings are disabled during an active session. Scroll down for self-hosting, startup behavior, and the file save path. Adjust quality, frame rate, and video preference from the remote session toolbar.
+
+<p align="center">
+  <img src="docs/images/desktop-settings-en.png" width="720" alt="Current client settings with codec, hardware codecs, TURN, forced relay, and automatic privacy screen options" />
+</p>
+
+| Setting | Purpose |
+| --- | --- |
+| Language | 中文, English, Русский |
+| Capture Method (Windows) | Auto / DXGI / WGC / GDI; choose Auto for automatic headless adaptation |
+| Video Encode Format | H.264 / AV1; hardware codec availability depends on the platform, device, and build options |
+| Enable TURN Service | Allow relay-assisted connections; check this setting if P2P fails |
+| Force Relay | Require relay connections when TURN is enabled; turning TURN off also disables this option |
+| Save remote screen previews | On by default. When disabled, the thumbnail area shows the remote device’s platform and existing previews are cleared; connection records and passwords are preserved |
+| Privacy screen on connect | Automatically enable privacy when this computer is controlled remotely; the controller can toggle it from the session toolbar |
+| Self-Hosted Config | Set the server address and signaling port, then enable the checkbox |
+| Auto Start / Enable Daemon | Configure startup and process supervision; restart as indicated by the UI |
+| File Save Path | Choose where received files are saved |
+
+### Check for updates
+
+The client checks for updates in the background after launch. A new version adds an update indicator to the main window menu. Open **☰ → About** to view the version or click **Check for updates** to check manually. When an update is available, you can view its release notes and open the download page.
+
+<p align="center">
+  <img src="docs/images/desktop-about-en.png" width="720" alt="About dialog with the Check for updates button; version and check result are demonstration data" />
+</p>
+
+<a id="ios"></a>
+
+## Native iOS / iPadOS client
+
+[`apps/ios`](apps/ios/README.md) contains a native controller using the same MiniRTC protocol as the desktop client. It controls remote computers; it does not expose an iPhone or iPad as a remotely controlled desktop.
+
+1. Follow the [iOS guide](apps/ios/README.md) to build and sign the app with Xcode, then install it on an iOS 16+ physical device.
+2. Enter a remote ID on the home screen, connect, and enter its password. Successful connections become available in the recent devices list.
+3. Choose a mouse mode in Settings: **Relative Position** works like a trackpad; **Absolute Position** maps touches directly to the remote screen.
+4. Tap the floating icon to expand the menu, then switch displays, open the keyboard, toggle audio, or send files. Received files are stored in `Documents/Received` and can be exported using the share button beside the transfer status.
+
+The app currently receives remote text into the iOS clipboard. Its UI does not yet expose a button to send the local clipboard.
+
+Gestures include one-finger click, two-finger right-click, long-press drag, and pinch-to-zoom. When zoomed in, two-finger panning moves the viewport. The native and browser clients are maintained separately, so their controls and gestures may differ. The current native UI uses Chinese labels.
+
+<a id="windows-service"></a>
+
+## Windows lock screens and sign-in
+
+**CrossDesk Service** (`CrossDeskService`) reports protected desktop states and forwards `Ctrl+Alt+Del`, keyboard, and mouse input on lock screens, sign-in screens, credential prompts, and secure desktops.
+
+The installer registers an on-demand service. CrossDesk tries to start it on launch, and the service exits when no local CrossDesk client is running. Portable builds offer service installation in the prompt or **Settings → Lock Screen Service**, with administrator privileges. The service depends on a running client.
+
+<details>
+<summary>Manual deployment and service commands</summary>
+
+Keep the complete installation directory. For manual deployment, place `CrossDesk.exe`, `crossdesk_service.exe`, `crossdesk_session_helper.exe`, and all `.dll` files from the same build together. Open an administrator PowerShell in that directory and run the commands you need:
+
+```powershell
+.\CrossDesk.exe --service-install
+.\CrossDesk.exe --service-start
+.\CrossDesk.exe --service-status
+.\CrossDesk.exe --service-ping
+# Stop or uninstall the service
+.\CrossDesk.exe --service-stop
+.\CrossDesk.exe --service-uninstall
 ```
 
-### Server Side
-Place **crossdesk.cn.key** and **crossdesk.cn_bundle.crt** into the **/path/to/your/certs** directory.
+</details>
 
-### Client Side
-1. Click the settings icon in the top-right corner to enter the settings page.<br><br>
-<img width="600" height="210" alt="image" src="https://github.com/user-attachments/assets/6431131d-b32a-4726-8783-6788f47baa3b" /><br>
+If **Remote Windows service unavailable** appears, check installation and service status on the host. Ordinary desktop connections remain available, while control of protected screens is limited.
 
-2. Click `Self-Hosted Server Configuration` button.<br><br>
-<img width="600" height="160" alt="image" src="https://github.com/user-attachments/assets/24c761a3-1985-4d7e-84be-787383c2afb8" /><br>
+<a id="self-hosting"></a>
 
-3. Enter the `Server Address` (**EXTERNAL_IP**), `Signaling Service Port` (**CROSSDESK_SERVER_PORT**), and `Relay Service Port` (**COTURN_PORT**) and click OK button.
+## Self-hosting
 
-4. Check the `Self-hosted server configuration` option and click the OK button to save the settings. If the server is using a valid (official) certificate, the process ends here and the client will show that it is connected to the server.
+Host your own signaling and TURN services, then enter their connection details under **☰ → Settings → Self-Hosted Config**. Enable the same server configuration on both the controller and host.
 
-5. If the default certificate is used (skip this step if an official certificate is used), download the self-signed root certificate `api.crossdesk.cn_root.crt` from the server directory /var/lib/crossdesk/certs/ to the machine running the client, and install the certificate by executing the following command:
+- [Self-hosting guide](docs/SELF_HOSTING_EN.md): current Compose deployment, client settings, certificate trust, and troubleshooting.
+- [CrossDesk Server](https://github.com/kunkundi/crossdesk-server): server source and release configuration.
+- [CrossDesk Web Client](https://github.com/kunkundi/crossdesk-web-client): browser source and deployment instructions.
 
-On Windows, open PowerShell with **administrator privileges** and execute:
-```
-certutil -addstore "Root" "C:\path\to\api.crossdesk.cn_root.crt"
-```
-Linux
-```
-sudo cp /path/to/api.crossdesk.cn_root.crt /usr/local/share/ca-certificates/api.crossdesk.cn_root.crt
-sudo update-ca-certificates
-```
-macOS
-```
-sudo security add-trusted-cert -d -r trustRoot -k /Library/Keychains/System.keychain path/to/api.crossdesk.cn_root.crt
-```
+## Development and feedback
 
+- [Build from source](docs/BUILD_EN.md): Windows, macOS, Linux, optional flags, and packaging.
+- [iOS development](apps/ios/README.md): native build and physical-device checks.
+- [GUI architecture](docs/gui-architecture.md): desktop UI and platform organization.
+- [FAQ](docs/FAQ.md#english): connection failures, blank video, received files, and build issues.
+- [Report an issue](https://github.com/kunkundi/crossdesk/issues): include both operating systems, client versions, connection mode, and reproduction steps.
 
-### Web Client
-See [CrossDesk Web Client](https://github.com/kunkundi/crossdesk-web-client)。
+## Acknowledgements and license
 
-# FAQ
-See [FAQ](https://github.com/kunkundi/crosssesk/blob/self-hosted-server/docs/FAQ.md) .
+Thanks to [HelloGitHub](https://hellogithub.com/), [Ruanyf Weekly](https://github.com/ruanyf/weekly), and the [LinuxDo](https://linux.do) community for featuring CrossDesk and contributing feedback.
+
+CrossDesk is licensed under [GPL-3.0](LICENSE). See the [Privacy Policy](PRIVACY.md#english).
+
+### Code signing policy
+
+CrossDesk uses SignPath.io to sign official Windows releases built from this repository.
+
+**Free code signing provided by [SignPath.io](https://signpath.io/), certificate by [SignPath Foundation](https://signpath.org/).**
+
+- **Committers and reviewers:** [kunkundi](https://github.com/kunkundi)
+- **Approvers:** [kunkundi](https://github.com/kunkundi)

apps/desktop/resources/windows/crossdesk.manifest

@@ -1,17 +1,13 @@
 <?xml version="1.0" encoding="UTF-8" standalone="yes"?>
 <assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
 
-  <!-- 应用程序标识 -->
   <assemblyIdentity
       version="1.0.0.0"
-      processorArchitecture="*"
       name="CrossDesk"
       type="win32" />
 
-  <!-- 描述信息 -->
   <description>CrossDesk Application</description>
 
-  <!-- 权限：要求管理员运行 -->
   <trustInfo xmlns="urn:schemas-microsoft-com:asm.v3">
     <security>
       <requestedPrivileges>
@@ -20,24 +16,17 @@
     </security>
   </trustInfo>
 
-  <!-- DPI 感知设置：支持高分屏 -->
   <application xmlns="urn:schemas-microsoft-com:asm.v3">
     <windowsSettings>
-      <!-- Windows Vista/7 风格 DPI 感知 -->
-      <dpiAware>true/pm</dpiAware>
-      <!-- Windows 10/11 高级 DPI 感知 -->
-      <dpiAwareness>PerMonitorV2</dpiAwareness>
+      <dpiAware xmlns="http://schemas.microsoft.com/SMI/2005/WindowsSettings">true/pm</dpiAware>
+      <dpiAwareness xmlns="http://schemas.microsoft.com/SMI/2016/WindowsSettings">PerMonitorV2</dpiAwareness>
     </windowsSettings>
   </application>
 
-  <!-- Windows 兼容性声明 -->
   <compatibility xmlns="urn:schemas-microsoft-com:compatibility.v1">
     <application>
-      <!-- 支持 Windows 10 -->
-      <supportedOS Id="{8e0f7a12-bfb3-4fe8-b9a5-48fd50a15a9a}"/>
-      <!-- 支持 Windows 11（向下兼容 Win10 GUID） -->
       <supportedOS Id="{8e0f7a12-bfb3-4fe8-b9a5-48fd50a15a9a}"/>
     </application>
   </compatibility>
 
-</assembly>
+</assembly>

apps/desktop/resources/windows/crossdesk.rc

@@ -0,0 +1,16 @@
+// Application icon resource; load by the resource name IDI_ICON1.
+IDI_ICON1 ICON "crossdesk.ico"
+
+#define CREATEPROCESS_MANIFEST_RESOURCE_ID 1
+#define RT_MANIFEST 24
+
+#ifdef CROSSDESK_DEBUG
+CREATEPROCESS_MANIFEST_RESOURCE_ID RT_MANIFEST "crossdesk_debug.manifest"
+#else
+CREATEPROCESS_MANIFEST_RESOURCE_ID RT_MANIFEST "crossdesk.manifest"
+#endif
+
+#define CROSSDESK_FILE_DESCRIPTION "CrossDesk"
+#define CROSSDESK_ORIGINAL_FILENAME "CrossDesk.exe"
+
+#include "version_info.rcinc"

apps/desktop/resources/windows/crossdesk_debug.manifest

@@ -0,0 +1,32 @@
+<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
+<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
+
+  <assemblyIdentity
+      version="1.0.0.0"
+      name="CrossDesk"
+      type="win32" />
+
+  <description>CrossDesk Application</description>
+
+  <trustInfo xmlns="urn:schemas-microsoft-com:asm.v3">
+    <security>
+      <requestedPrivileges>
+        <requestedExecutionLevel level="asInvoker" uiAccess="false"/>
+      </requestedPrivileges>
+    </security>
+  </trustInfo>
+
+  <application xmlns="urn:schemas-microsoft-com:asm.v3">
+    <windowsSettings>
+      <dpiAware xmlns="http://schemas.microsoft.com/SMI/2005/WindowsSettings">true/pm</dpiAware>
+      <dpiAwareness xmlns="http://schemas.microsoft.com/SMI/2016/WindowsSettings">PerMonitorV2</dpiAwareness>
+    </windowsSettings>
+  </application>
+
+  <compatibility xmlns="urn:schemas-microsoft-com:compatibility.v1">
+    <application>
+      <supportedOS Id="{8e0f7a12-bfb3-4fe8-b9a5-48fd50a15a9a}"/>
+    </application>
+  </compatibility>
+
+</assembly>

apps/desktop/resources/windows/crossdesk_portable.manifest

@@ -0,0 +1,32 @@
+<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
+<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
+
+  <assemblyIdentity
+      version="1.0.0.0"
+      name="CrossDesk"
+      type="win32" />
+
+  <description>CrossDesk Portable Application</description>
+
+  <trustInfo xmlns="urn:schemas-microsoft-com:asm.v3">
+    <security>
+      <requestedPrivileges>
+        <requestedExecutionLevel level="asInvoker" uiAccess="false"/>
+      </requestedPrivileges>
+    </security>
+  </trustInfo>
+
+  <application xmlns="urn:schemas-microsoft-com:asm.v3">
+    <windowsSettings>
+      <dpiAware xmlns="http://schemas.microsoft.com/SMI/2005/WindowsSettings">true/pm</dpiAware>
+      <dpiAwareness xmlns="http://schemas.microsoft.com/SMI/2016/WindowsSettings">PerMonitorV2</dpiAwareness>
+    </windowsSettings>
+  </application>
+
+  <compatibility xmlns="urn:schemas-microsoft-com:compatibility.v1">
+    <application>
+      <supportedOS Id="{8e0f7a12-bfb3-4fe8-b9a5-48fd50a15a9a}"/>
+    </application>
+  </compatibility>
+
+</assembly>

apps/desktop/resources/windows/crossdesk_portable.rc

@@ -0,0 +1,13 @@
+// Portable build resource. The app itself runs as the current user; service
+// installation raises a separate UAC prompt only when the user chooses it.
+IDI_ICON1 ICON "crossdesk.ico"
+
+#define CREATEPROCESS_MANIFEST_RESOURCE_ID 1
+#define RT_MANIFEST 24
+
+CREATEPROCESS_MANIFEST_RESOURCE_ID RT_MANIFEST "crossdesk_portable.manifest"
+
+#define CROSSDESK_FILE_DESCRIPTION "CrossDesk Portable"
+#define CROSSDESK_ORIGINAL_FILENAME "CrossDesk.exe"
+
+#include "version_info.rcinc"

apps/desktop/resources/windows/crossdesk_privacy_window.rc

@@ -0,0 +1,13 @@
+/*
+ * @Author: DI JUNKUN
+ * @Date: 2026-09-11
+ * Copyright (c) 2026 by DI JUNKUN, All Rights Reserved.
+ */
+
+IDI_CROSSDESK_LOGO ICON "crossdesk.ico"
+
+#define CROSSDESK_FILE_DESCRIPTION "CrossDesk Privacy Window"
+#define CROSSDESK_ORIGINAL_FILENAME "crossdesk_privacy_window.dll"
+#define CROSSDESK_FILE_TYPE VFT_DLL
+
+#include "version_info.rcinc"

apps/desktop/resources/windows/crossdesk_service.rc

@@ -0,0 +1,4 @@
+#define CROSSDESK_FILE_DESCRIPTION "CrossDesk Service"
+#define CROSSDESK_ORIGINAL_FILENAME "crossdesk_service.exe"
+
+#include "version_info.rcinc"

apps/desktop/resources/windows/crossdesk_session_helper.rc

@@ -0,0 +1,18 @@
+// Session helper icon and manifest resources.
+IDI_ICON1 ICON "crossdesk.ico"
+
+#define CREATEPROCESS_MANIFEST_RESOURCE_ID 1
+#define RT_MANIFEST 24
+
+#ifdef CROSSDESK_PORTABLE
+CREATEPROCESS_MANIFEST_RESOURCE_ID RT_MANIFEST "crossdesk_portable.manifest"
+#elif defined(CROSSDESK_DEBUG)
+CREATEPROCESS_MANIFEST_RESOURCE_ID RT_MANIFEST "crossdesk_debug.manifest"
+#else
+CREATEPROCESS_MANIFEST_RESOURCE_ID RT_MANIFEST "crossdesk.manifest"
+#endif
+
+#define CROSSDESK_FILE_DESCRIPTION "CrossDesk Session Helper"
+#define CROSSDESK_ORIGINAL_FILENAME "crossdesk_session_helper.exe"
+
+#include "version_info.rcinc"

apps/desktop/resources/windows/usbmmidd_v2/License.txt

@@ -0,0 +1,12 @@
+Copyright 2014-2021 Amyuni Technologies Inc.
+https://www.amyuni.com
+
+This software is provided 'as-is', without any express or implied warranty. In no event will the authors be held liable for any damages arising from the use of this software.
+By using this software, you accept to be prompted with an advertisement page which is not always under the control of the author. A fully commercial version is available for users who do not wisth to see those advertisements.
+
+Permission is granted to anyone to use this software for any purpose subject to the following restrictions:
+
+1. The origin of this software must not be misrepresented; you must not claim that you wrote the original software.
+   If you use this software in a product, an acknowledgment in the product documentation would be required.
+2. Altered versions must be plainly marked as such, and must not be misrepresented as being the original software.
+3. This notice may not be removed or altered from any distribution.

apps/desktop/resources/windows/usbmmidd_v2/idd_instructions.txt

@@ -0,0 +1,50 @@
+Procedure to add a virtual monitor to your system (Windows 10 Only!)
+
+- Download our virtual display driver from https://www.amyuni.com/downloads/usbmmidd_v2.zip
+- Unpack the zip file to an empty folder, e.g. c:\temp\usbmmidd
+- Make sure you read the License.txt file as with any other software product
+- Open a command prompt window as Administrator (you cannot add a device to your system unless you "Run As Administrator")
+- Run the following commands:
+	- cd c:\temp\usbmmid (or whatever destination folder you chose)
+	- deviceinstaller64 install usbmmidd.inf usbmmidd (If you are on a 32-bit system, replace "deviceinstaller64" by "deviceinstaller")
+	- Make sure you see the message that the drivers are signed by Amyuni Technologies Inc. This is a confirmation that the drivers went through Microsoft driver signing procedure and are virus free
+	
+- Starting with version 2, the virtual monitor supports the following display resolutions by default:
+
+1024 x 768 pixels
+1360 x 768 pixels
+1440 x 900 pixels
+1600 x 900 pixels
+1600 x 1200 pixels
+1920 x 1080 pixels [Default Resolution]
+1920 x 1200 pixels
+2560 x 1440 pixels
+3840 x 2160 pixels
+
+After the first step above is executed, you can modify the list of supported resolutions by changing the following registry key:
+HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\WUDF\Services\usbmmIdd\Parameters\Monitors
+
+Up to 10 resolutions can be defined through this registry key. The keys should be named from "0" to "9". The (Default) registry value defines the default monitor resolution.
+
+Note that the list of resolutions can also be found in the usbmmidd.inf file that accompanies the printer driver. The inf file should not be modified in any way, otherwise the virtual display driver digital signature is invalidated.
+
+Once you are satisfied with the list of resolutions, you can activate the virtual monitor by running: 
+- deviceinstaller64 enableidd 1
+
+With version 2, rou can run this command multiple times to add up to 4 virtual monitors to your system.
+
+The included batch file usbmmidd.bat runs these commands automatically and selects between the 32- or 64-bit version of deviceinstaller.
+If you are not comfortable opening a command prompt and entering these commands, right-click on usbmmidd.bat and "Run As Administrator."
+
+That's it. You now have a high definition monitor in your Display Settings. You can change the display resolution, position the monitor, extend the desktop or do whatever you do with a real monitor.
+
+To deactivate the virtual monitor, run the command:
+deviceinstaller64 enableidd 0
+If ou have added more than one monitor, you should run this command multiple times to remove all monitors.
+
+to reactivate a virtual monitor:
+deviceinstaller64 enableidd 1
+
+To completely remove the drivers from your system, you can either go through the Device Manager and uninstall "USB Mobile Monitor Virtual Display", or run the commands:
+deviceinstaller64 stop usbmmidd
+deviceinstaller64 remove usbmmid

apps/desktop/resources/windows/usbmmidd_v2/usbmmidd.bat

@@ -0,0 +1,16 @@
+@cd /d "%~dp0"
+
+@goto %PROCESSOR_ARCHITECTURE%
+@exit
+
+:AMD64
+@cmd /c deviceinstaller64.exe install usbmmidd.inf usbmmidd
+@cmd /c deviceinstaller64.exe enableidd 1
+@goto end
+
+:x86
+@cmd /c deviceinstaller.exe install usbmmidd.inf usbmmidd
+@cmd /c deviceinstaller.exe enableidd 1
+
+:end
+@pause

apps/desktop/resources/windows/version_info.rcinc

@@ -0,0 +1,54 @@
+#include <winver.h>
+
+#ifndef CROSSDESK_VERSION_STRING
+#define CROSSDESK_VERSION_STRING "0.0.0"
+#endif
+
+#ifndef CROSSDESK_VERSION_NUMERIC
+#define CROSSDESK_VERSION_NUMERIC 0,0,0,0
+#endif
+
+#ifndef CROSSDESK_FILE_DESCRIPTION
+#define CROSSDESK_FILE_DESCRIPTION "CrossDesk"
+#endif
+
+#ifndef CROSSDESK_ORIGINAL_FILENAME
+#define CROSSDESK_ORIGINAL_FILENAME "CrossDesk.exe"
+#endif
+
+#ifndef CROSSDESK_FILE_TYPE
+#define CROSSDESK_FILE_TYPE VFT_APP
+#endif
+
+VS_VERSION_INFO VERSIONINFO
+ FILEVERSION CROSSDESK_VERSION_NUMERIC
+ PRODUCTVERSION CROSSDESK_VERSION_NUMERIC
+ FILEFLAGSMASK VS_FFI_FILEFLAGSMASK
+#ifdef CROSSDESK_DEBUG
+ FILEFLAGS VS_FF_DEBUG
+#else
+ FILEFLAGS 0x0L
+#endif
+ FILEOS VOS_NT_WINDOWS32
+ FILETYPE CROSSDESK_FILE_TYPE
+ FILESUBTYPE VFT2_UNKNOWN
+BEGIN
+    BLOCK "StringFileInfo"
+    BEGIN
+        BLOCK "040904B0"
+        BEGIN
+            VALUE "CompanyName", "CrossDesk\0"
+            VALUE "FileDescription", CROSSDESK_FILE_DESCRIPTION "\0"
+            VALUE "FileVersion", CROSSDESK_VERSION_STRING "\0"
+            VALUE "InternalName", CROSSDESK_ORIGINAL_FILENAME "\0"
+            VALUE "LegalCopyright", "Copyright (C) CrossDesk contributors\0"
+            VALUE "OriginalFilename", CROSSDESK_ORIGINAL_FILENAME "\0"
+            VALUE "ProductName", "CrossDesk\0"
+            VALUE "ProductVersion", CROSSDESK_VERSION_STRING "\0"
+        END
+    END
+    BLOCK "VarFileInfo"
+    BEGIN
+        VALUE "Translation", 0x0409, 1200
+    END
+END

apps/desktop/resources/windows/wgc_plugin.rc

@@ -0,0 +1,5 @@
+#define CROSSDESK_FILE_DESCRIPTION "CrossDesk Windows Graphics Capture Plugin"
+#define CROSSDESK_ORIGINAL_FILENAME "wgc_plugin.dll"
+#define CROSSDESK_FILE_TYPE VFT_DLL
+
+#include "version_info.rcinc"

apps/desktop/scripts/linux/package_deb.sh

@@ -0,0 +1,205 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+# Keep readelf and ldd output stable for the runtime dependency checks below.
+export LC_ALL=C
+
+if [[ $# -lt 3 || $# -gt 4 ]]; then
+    echo "Usage: $0 <debian-arch> <xmake-arch> <version> [extra-recommendation]" >&2
+    exit 2
+fi
+
+DEBIAN_ARCH="$1"
+XMAKE_ARCH="$2"
+INPUT_VERSION="$3"
+EXTRA_RECOMMENDATION="${4:-}"
+
+PKG_NAME="crossdesk"
+APP_NAME="CrossDesk"
+MAINTAINER="Junkun Di <junkun.di@hotmail.com>"
+DESCRIPTION="A simple cross-platform remote desktop client."
+ALSA_RUNTIME_DEP="libasound2 | libasound2t64"
+PORTAL_RUNTIME_RECOMMENDS="xdg-desktop-portal, xdg-desktop-portal-gtk | xdg-desktop-portal-kde | xdg-desktop-portal-wlr"
+TRAY_RUNTIME_RECOMMENDS="libayatana-appindicator3-1 | libappindicator3-1"
+# Every published package includes the prerequisites for all Linux headless
+# paths, including a complete independent desktop. Older Ubuntu releases ship
+# dbus-run-session in dbus; newer releases split it into dbus-daemon.
+HEADLESS_RUNTIME_DEPS="xvfb, xfce4, dbus-daemon | dbus"
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+PROJECT_ROOT="$(cd "$SCRIPT_DIR/../../../.." && pwd)"
+
+normalize_app_version() {
+    local input="$1"
+    local prefix=""
+    local body="$input"
+
+    if [[ "$body" == v* ]]; then
+        prefix="v"
+        body="${body#v}"
+    fi
+
+    if [[ "$body" =~ ^([0-9]+(\.[0-9]+){1,3})-([0-9]{8})-([0-9]+)$ ]]; then
+        echo "${prefix}${BASH_REMATCH[1]}-${BASH_REMATCH[4]}-${BASH_REMATCH[3]}"
+    else
+        echo "$input"
+    fi
+}
+
+find_slint_runtime() {
+    local needed="$1"
+    local resolved=""
+
+    resolved="$(ldd "$BUILD_BINARY" 2>/dev/null | awk -v needed="$needed" \
+        '$1 == needed && $2 == "=>" && $3 ~ /^\// { print $3; exit }')"
+    if [[ -n "$resolved" && -f "$resolved" ]]; then
+        echo "$resolved"
+        return 0
+    fi
+
+    local package_roots=()
+    if [[ -n "${XMAKE_GLOBALDIR:-}" ]]; then
+        package_roots+=("$XMAKE_GLOBALDIR/.xmake/packages")
+    fi
+    package_roots+=("$HOME/.xmake/packages" "/data/.xmake/packages")
+
+    local package_root=""
+    local candidate=""
+    for package_root in "${package_roots[@]}"; do
+        [[ -d "$package_root/s/slint" ]] || continue
+        candidate="$(find "$package_root/s/slint" -path "*/lib/$needed" -print -quit 2>/dev/null || true)"
+        if [[ -n "$candidate" ]]; then
+            echo "$candidate"
+            return 0
+        fi
+    done
+
+    return 1
+}
+
+APP_VERSION="$(normalize_app_version "$INPUT_VERSION")"
+DEB_VERSION="${APP_VERSION#v}"
+if [[ ! "$DEB_VERSION" =~ ^[0-9][0-9A-Za-z.+:~_-]*$ ]]; then
+    echo "Invalid Debian version: $DEB_VERSION" >&2
+    exit 2
+fi
+
+BUILD_BINARY="$PROJECT_ROOT/build/linux/$XMAKE_ARCH/release/crossdesk"
+if [[ ! -x "$BUILD_BINARY" ]]; then
+    echo "Missing release binary: $BUILD_BINARY" >&2
+    echo "Build it first with: xmake f -m release -y && xmake b -vy crossdesk" >&2
+    exit 1
+fi
+
+for command_name in readelf ldd dpkg-deb strip; do
+    if ! command -v "$command_name" >/dev/null 2>&1; then
+        echo "Required packaging command is missing: $command_name" >&2
+        exit 1
+    fi
+done
+
+WORK_DIR="$(mktemp -d "${TMPDIR:-/tmp}/crossdesk-deb.XXXXXX")"
+trap 'rm -rf "$WORK_DIR"' EXIT
+
+DEB_DIR="$WORK_DIR/${PKG_NAME}-${DEB_VERSION}"
+DEBIAN_DIR="$DEB_DIR/DEBIAN"
+BIN_DIR="$DEB_DIR/usr/bin"
+PRIVATE_DIR="$DEB_DIR/usr/lib/$PKG_NAME"
+ICON_BASE_DIR="$DEB_DIR/usr/share/icons/hicolor"
+DESKTOP_DIR="$DEB_DIR/usr/share/applications"
+OUTPUT_FILE="$PROJECT_ROOT/${PKG_NAME}-linux-${DEBIAN_ARCH}-${APP_VERSION}.deb"
+
+install -d "$DEBIAN_DIR" "$BIN_DIR" "$PRIVATE_DIR" "$DESKTOP_DIR"
+install -m 0755 "$BUILD_BINARY" "$PRIVATE_DIR/crossdesk-bin"
+
+# PipeWire is deliberately optional. The Wayland capturer resolves PipeWire
+# 0.3 with dlopen() so the same package can run on Ubuntu 20.04 without the
+# runtime while using the host runtime on newer Ubuntu releases.
+if readelf -d "$BUILD_BINARY" \
+    | grep -qE 'Shared library: \[libpipewire-0\.3\.so'; then
+    echo "CrossDesk must not link directly to the optional PipeWire runtime" >&2
+    exit 1
+fi
+
+# Slint is intentionally built as a shared library. Keep that runtime private
+# to CrossDesk instead of relying on a non-existent distribution package.
+SLINT_NEEDED="$(readelf -d "$BUILD_BINARY" | sed -n \
+    's/.*Shared library: \[\(libslint_cpp[^]]*\)\].*/\1/p' | head -n 1)"
+if [[ -n "$SLINT_NEEDED" ]]; then
+    SLINT_LIBRARY="$(find_slint_runtime "$SLINT_NEEDED" || true)"
+    if [[ -z "$SLINT_LIBRARY" ]]; then
+        echo "Unable to locate the required Slint runtime: $SLINT_NEEDED" >&2
+        exit 1
+    fi
+    install -m 0755 "$SLINT_LIBRARY" "$PRIVATE_DIR/$SLINT_NEEDED"
+    # Keep dynamic exports/relocations while removing unneeded symbols from the
+    # staged copy. Never strip Xmake's cached runtime in place.
+    strip --strip-unneeded "$PRIVATE_DIR/$SLINT_NEEDED"
+fi
+
+cat > "$BIN_DIR/$PKG_NAME" <<'EOF'
+#!/bin/sh
+private_lib_dir="/usr/lib/crossdesk"
+if [ -n "${LD_LIBRARY_PATH:-}" ]; then
+    export LD_LIBRARY_PATH="$private_lib_dir:$LD_LIBRARY_PATH"
+else
+    export LD_LIBRARY_PATH="$private_lib_dir"
+fi
+exec /usr/lib/crossdesk/crossdesk-bin "$@"
+EOF
+chmod 0755 "$BIN_DIR/$PKG_NAME"
+ln -s "$PKG_NAME" "$BIN_DIR/$APP_NAME"
+
+for size in 16 24 32 48 64 96 128 256; do
+    install -d "$ICON_BASE_DIR/${size}x${size}/apps"
+    install -m 0644 "$PROJECT_ROOT/apps/desktop/resources/linux/crossdesk_${size}x${size}.png" \
+        "$ICON_BASE_DIR/${size}x${size}/apps/${PKG_NAME}.png"
+done
+
+RECOMMENDS="$PORTAL_RUNTIME_RECOMMENDS, $TRAY_RUNTIME_RECOMMENDS"
+if [[ -n "$EXTRA_RECOMMENDATION" ]]; then
+    RECOMMENDS="$RECOMMENDS, $EXTRA_RECOMMENDATION"
+fi
+
+cat > "$DEBIAN_DIR/control" <<EOF
+Package: $PKG_NAME
+Version: $DEB_VERSION
+Architecture: $DEBIAN_ARCH
+Maintainer: $MAINTAINER
+Description: $DESCRIPTION
+Depends: libc6 (>= 2.31), libstdc++6 (>= 10), libx11-6, libxext6,
+ libxrender1, libxft2, libxrandr2, libxfixes3, libxcursor1, libxi6, libxcb1, libxcb-randr0,
+ libxcb-xtest0, libxcb-xinerama0, libxcb-shape0, libxcb-xkb1,
+ libxcb-xfixes0, libxv1, libxtst6, $ALSA_RUNTIME_DEP, libsndio7.0,
+ libxcb-shm0, libpulse0, libdrm2, libdbus-1-3, libgl1,
+ $HEADLESS_RUNTIME_DEPS
+Recommends: $RECOMMENDS
+Priority: optional
+Section: utils
+EOF
+
+cat > "$DESKTOP_DIR/$PKG_NAME.desktop" <<EOF
+[Desktop Entry]
+Version=1.0
+Name=$APP_NAME
+Comment=$DESCRIPTION
+Exec=/usr/bin/$PKG_NAME
+Icon=$PKG_NAME
+StartupWMClass=$PKG_NAME
+Terminal=false
+Type=Application
+Categories=Utility;
+EOF
+
+rm -f "$OUTPUT_FILE"
+dpkg-deb --root-owner-group --build "$DEB_DIR" "$OUTPUT_FILE"
+dpkg-deb --info "$OUTPUT_FILE" >/dev/null
+dpkg-deb --contents "$OUTPUT_FILE" > "$WORK_DIR/package-contents.txt"
+
+if [[ -n "$SLINT_NEEDED" ]] && \
+   ! grep -q "usr/lib/$PKG_NAME/$SLINT_NEEDED" "$WORK_DIR/package-contents.txt"; then
+    echo "Packaged artifact is missing $SLINT_NEEDED" >&2
+    exit 1
+fi
+
+echo "Deb package created: $OUTPUT_FILE"

apps/desktop/scripts/linux/pkg_amd64.sh

@@ -0,0 +1,11 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+
+if [[ $# -ne 1 ]]; then
+    echo "Usage: $0 <version>" >&2
+    exit 2
+fi
+
+exec bash "$SCRIPT_DIR/package_deb.sh" amd64 x86_64 "$1" nvidia-cuda-toolkit

apps/desktop/scripts/linux/pkg_arm64.sh

@@ -0,0 +1,11 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+
+if [[ $# -ne 1 ]]; then
+    echo "Usage: $0 <version>" >&2
+    exit 2
+fi
+
+exec bash "$SCRIPT_DIR/package_deb.sh" arm64 arm64 "$1"

apps/desktop/scripts/macos/bundle_app.sh

@@ -0,0 +1,135 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+if [[ $# -ne 2 ]]; then
+    echo "Usage: $0 <app-bundle> <expected-architecture>" >&2
+    exit 2
+fi
+
+APP_BUNDLE="$1"
+EXPECTED_ARCH="$2"
+APP_EXECUTABLE="$APP_BUNDLE/Contents/MacOS/CrossDesk"
+FRAMEWORKS_DIR="$APP_BUNDLE/Contents/Frameworks"
+
+for command_name in codesign install_name_tool lipo otool strip; do
+    if ! command -v "$command_name" >/dev/null 2>&1; then
+        echo "Required bundling command is missing: $command_name" >&2
+        exit 1
+    fi
+done
+
+if [[ ! -x "$APP_EXECUTABLE" ]]; then
+    echo "Missing app executable: $APP_EXECUTABLE" >&2
+    exit 1
+fi
+
+if ! lipo "$APP_EXECUTABLE" -verify_arch "$EXPECTED_ARCH" >/dev/null 2>&1; then
+    echo "App executable does not contain the expected architecture: $EXPECTED_ARCH" >&2
+    lipo -archs "$APP_EXECUTABLE" >&2 || true
+    exit 1
+fi
+
+SLINT_REFERENCE="$(otool -L "$APP_EXECUTABLE" | awk \
+    '$1 ~ /(^|\/)libslint_cpp[^\/[:space:]]*\.dylib$/ { print $1; exit }')"
+if [[ -z "$SLINT_REFERENCE" ]]; then
+    echo "The app executable does not reference the Slint runtime" >&2
+    exit 1
+fi
+
+SLINT_NAME="${SLINT_REFERENCE##*/}"
+SLINT_CURRENT_VERSION="$(otool -L "$APP_EXECUTABLE" | awk -v dependency="$SLINT_REFERENCE" '
+    $1 == dependency {
+        for (i = 1; i <= NF; ++i) {
+            if ($i == "current") {
+                version = $(i + 2)
+                gsub(/[),]/, "", version)
+                print version
+                exit
+            }
+        }
+    }')"
+
+slint_runtime_version() {
+    local library="$1"
+    otool -L "$library" | awk -v name="$SLINT_NAME" '
+        index($1, "/" name) || $1 == "@rpath/" name {
+            for (i = 1; i <= NF; ++i) {
+                if ($i == "current") {
+                    version = $(i + 2)
+                    gsub(/[),]/, "", version)
+                    print version
+                    exit
+                }
+            }
+        }'
+}
+
+find_slint_runtime() {
+    local candidate=""
+    local candidate_version=""
+    local package_root=""
+    local package_roots=()
+
+    if [[ "$SLINT_REFERENCE" == /* && -f "$SLINT_REFERENCE" ]]; then
+        if lipo "$SLINT_REFERENCE" -verify_arch "$EXPECTED_ARCH" >/dev/null 2>&1; then
+            echo "$SLINT_REFERENCE"
+            return 0
+        fi
+    fi
+
+    if [[ -n "${XMAKE_GLOBALDIR:-}" ]]; then
+        package_roots+=("$XMAKE_GLOBALDIR/.xmake/packages")
+    fi
+    package_roots+=("$HOME/.xmake/packages" "/data/.xmake/packages")
+
+    for package_root in "${package_roots[@]}"; do
+        [[ -d "$package_root/s/slint" ]] || continue
+        while IFS= read -r candidate; do
+            if ! lipo "$candidate" -verify_arch "$EXPECTED_ARCH" >/dev/null 2>&1; then
+                continue
+            fi
+
+            candidate_version="$(slint_runtime_version "$candidate")"
+            if [[ -n "$SLINT_CURRENT_VERSION" && "$candidate_version" != "$SLINT_CURRENT_VERSION" ]]; then
+                continue
+            fi
+
+            echo "$candidate"
+            return 0
+        done < <(find "$package_root/s/slint" -type f -path "*/lib/$SLINT_NAME" -print 2>/dev/null)
+    done
+
+    return 1
+}
+
+SLINT_LIBRARY="$(find_slint_runtime || true)"
+if [[ -z "$SLINT_LIBRARY" ]]; then
+    echo "Unable to locate $SLINT_NAME for $EXPECTED_ARCH (current version $SLINT_CURRENT_VERSION)" >&2
+    exit 1
+fi
+
+install -d "$FRAMEWORKS_DIR"
+install -m 0755 "$SLINT_LIBRARY" "$FRAMEWORKS_DIR/$SLINT_NAME"
+
+install_name_tool -id "@rpath/$SLINT_NAME" "$FRAMEWORKS_DIR/$SLINT_NAME"
+if [[ "$SLINT_REFERENCE" != "@rpath/$SLINT_NAME" ]]; then
+    install_name_tool -change "$SLINT_REFERENCE" "@rpath/$SLINT_NAME" "$APP_EXECUTABLE"
+fi
+
+if ! otool -l "$APP_EXECUTABLE" | awk '
+    $1 == "cmd" { in_rpath = ($2 == "LC_RPATH"); next }
+    in_rpath && $1 == "path" && $2 == "@executable_path/../Frameworks" { found = 1 }
+    END { exit(found ? 0 : 1) }'; then
+    install_name_tool -add_rpath "@executable_path/../Frameworks" "$APP_EXECUTABLE"
+fi
+
+# Strip only the staged runtime, retaining exported symbols for Slint's C ABI.
+# The package cache remains intact for debugging and other consumers.
+strip -S -x "$FRAMEWORKS_DIR/$SLINT_NAME"
+
+# install_name_tool and strip invalidate the linker's ad-hoc signature. Sign nested code
+# first, then seal the complete app bundle so local packages remain launchable.
+codesign --force --sign - "$FRAMEWORKS_DIR/$SLINT_NAME"
+codesign --force --deep --sign - "$APP_BUNDLE"
+
+echo "Bundled Slint runtime: $SLINT_LIBRARY"

apps/desktop/scripts/macos/pkg_arm64.sh

@@ -1,20 +1,44 @@
-#!/bin/bash
-set -e
+#!/usr/bin/env bash
+set -euo pipefail
 
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+PROJECT_ROOT="$(cd "$SCRIPT_DIR/../../../.." && pwd)"
 APP_NAME="crossdesk"
 APP_NAME_UPPER="CrossDesk"
-EXECUTABLE_PATH="./build/macosx/arm64/release/crossdesk"
-APP_VERSION="$1"
+EXECUTABLE_PATH="${PROJECT_ROOT}/build/macosx/arm64/release/crossdesk"
 PLATFORM="macos"
 ARCH="arm64"
+BINARY_ARCH="arm64"
 IDENTIFIER="cn.crossdesk.app"
-ICON_PATH="icons/macos/crossdesk.icns"
-MACOS_MIN_VERSION="10.12"
+ICON_PATH="${PROJECT_ROOT}/apps/desktop/resources/macos/crossdesk.icns"
+MACOS_MIN_VERSION="14.0"
+
+cd "$PROJECT_ROOT"
+
+normalize_app_version() {
+    local input="$1"
+    local prefix=""
+    local body="$input"
+
+    if [[ "$body" == v* ]]; then
+        prefix="v"
+        body="${body#v}"
+    fi
+
+    if [[ "$body" =~ ^([0-9]+(\.[0-9]+){1,3})-([0-9]{8})-([0-9]+)$ ]]; then
+        echo "${prefix}${BASH_REMATCH[1]}-${BASH_REMATCH[4]}-${BASH_REMATCH[3]}"
+    else
+        echo "$input"
+    fi
+}
+
+APP_VERSION="$(normalize_app_version "$1")"
 
 APP_BUNDLE="${APP_NAME_UPPER}.app"
 CONTENTS_DIR="${APP_BUNDLE}/Contents"
 MACOS_DIR="${CONTENTS_DIR}/MacOS"
 RESOURCES_DIR="${CONTENTS_DIR}/Resources"
+INSTALLER_TITLE="${APP_NAME_UPPER} ${APP_VERSION}"
 
 PKG_NAME="${APP_NAME}-${PLATFORM}-${ARCH}-${APP_VERSION}.pkg"
 DMG_NAME="${APP_NAME}-${PLATFORM}-${ARCH}-${APP_VERSION}.dmg"
@@ -73,67 +97,85 @@ cat > "${CONTENTS_DIR}/Info.plist" <<EOF
 </plist>
 EOF
 
+xattr -cr "${APP_BUNDLE}" 2>/dev/null || true
+find "${APP_BUNDLE}" -name '._*' -delete
+
+"${SCRIPT_DIR}/bundle_app.sh" "${APP_BUNDLE}" "${BINARY_ARCH}"
+"${SCRIPT_DIR}/verify_app.sh" "${APP_BUNDLE}" "${BINARY_ARCH}"
+
 echo ".app created successfully."
 
+mkdir -p build_pkg_scripts
+cp "${SCRIPT_DIR}/tcc_postinstall.sh" build_pkg_scripts/postinstall
+chmod +x build_pkg_scripts/postinstall
+
+mkdir -p build_pkg_resources
+cat > build_pkg_resources/welcome.html <<EOF
+<!doctype html>
+<html>
+<head>
+    <meta charset="utf-8">
+    <style>
+        body {
+            font-family: -apple-system, BlinkMacSystemFont, "Helvetica Neue", sans-serif;
+            font-size: 13px;
+            line-height: 1.5;
+            color: #222;
+            margin: 0;
+            padding: 0;
+        }
+        h1 {
+            font-size: 20px;
+            font-weight: 600;
+            margin: 0 0 12px;
+        }
+        p {
+            margin: 0 0 10px;
+        }
+    </style>
+</head>
+<body>
+    <h1>欢迎安装 ${INSTALLER_TITLE}</h1>
+    <p>CrossDesk 将安装到“应用程序”文件夹。</p>
+    <p>首次启动时，CrossDesk 会引导你在系统设置中授予必要权限，包括辅助功能、录屏与系统录音等。</p>
+    <p>为避免旧版本授权残留造成状态误判，安装后可能需要重新授权。</p>
+    <p>安装完成后，请从“应用程序”文件夹启动 CrossDesk。</p>
+</body>
+</html>
+EOF
+
 echo "building pkg..."
 pkgbuild \
   --identifier "${IDENTIFIER}" \
   --version "${APP_VERSION}" \
   --install-location "/Applications" \
   --component "${APP_BUNDLE}" \
+  --scripts build_pkg_scripts \
   build_pkg_temp/${APP_NAME}-component.pkg
 
-mkdir -p build_pkg_scripts
-
-cat > build_pkg_scripts/postinstall <<'EOF'
-#!/bin/bash
-set -e
-
-IDENTIFIER="cn.crossdesk.app"
-
-# 获取当前登录用户
-USER_HOME=$( /usr/bin/stat -f "%Su" /dev/console )
-HOME_DIR=$( /usr/bin/dscl . -read /Users/$USER_HOME NFSHomeDirectory | awk '{print $2}' )
-
-# 清除应用的权限授权，以便重新授权
-# 使用 tccutil 重置录屏权限和辅助功能权限
-if command -v tccutil >/dev/null 2>&1; then
-    # 重置录屏权限
-    tccutil reset ScreenCapture "$IDENTIFIER" 2>/dev/null || true
-    # 重置辅助功能权限
-    tccutil reset Accessibility "$IDENTIFIER" 2>/dev/null || true
-    # 重置摄像头权限（如果需要）
-    tccutil reset Camera "$IDENTIFIER" 2>/dev/null || true
-    # 重置麦克风权限（如果需要）
-    tccutil reset Microphone "$IDENTIFIER" 2>/dev/null || true
-fi
-
-# 为所有用户清除权限（可选，如果需要）
-# 遍历所有用户目录并清除权限
-for USER_DIR in /Users/*; do
-    if [ -d "$USER_DIR" ] && [ "$USER_DIR" != "/Users/Shared" ]; then
-        USER_NAME=$(basename "$USER_DIR")
-        # 跳过系统用户
-        if [ "$USER_NAME" != "Shared" ] && [ -d "$USER_DIR/Library" ]; then
-            # 删除 TCC 数据库中的相关条目（需要管理员权限）
-            TCC_DB="$USER_DIR/Library/Application Support/com.apple.TCC/TCC.db"
-            if [ -f "$TCC_DB" ]; then
-                # 使用 sqlite3 删除相关权限记录（如果可用）
-                if command -v sqlite3 >/dev/null 2>&1; then
-                    sqlite3 "$TCC_DB" "DELETE FROM access WHERE client='$IDENTIFIER' AND service IN ('kTCCServiceScreenCapture', 'kTCCServiceAccessibility');" 2>/dev/null || true
-                fi
-            fi
-        fi
-    fi
-done
-
-exit 0
+cat > build_pkg_temp/Distribution <<EOF
+<?xml version="1.0" encoding="utf-8"?>
+<installer-gui-script minSpecVersion="1">
+    <title>${INSTALLER_TITLE}</title>
+    <welcome file="welcome.html" mime-type="text/html"/>
+    <options customize="never" require-scripts="false" hostArchitectures="arm64"/>
+    <choices-outline>
+        <line choice="default">
+            <line choice="${IDENTIFIER}"/>
+        </line>
+    </choices-outline>
+    <choice id="default" title="${INSTALLER_TITLE}"/>
+    <choice id="${IDENTIFIER}" title="${INSTALLER_TITLE}" visible="false">
+        <pkg-ref id="${IDENTIFIER}"/>
+    </choice>
+    <pkg-ref id="${IDENTIFIER}" version="${APP_VERSION}" onConclusion="none">crossdesk-component.pkg</pkg-ref>
+</installer-gui-script>
 EOF
 
-chmod +x build_pkg_scripts/postinstall
-
 productbuild \
-  --package build_pkg_temp/${APP_NAME}-component.pkg \
+  --distribution build_pkg_temp/Distribution \
+  --package-path build_pkg_temp \
+  --resources build_pkg_resources \
   "${PKG_NAME}"
 
 echo "PKG package created: ${PKG_NAME}"
@@ -171,8 +213,8 @@ APPLESCRIPT
 fi
 echo "Set icon finished"
 
-rm -rf build_pkg_temp build_pkg_scripts ${APP_BUNDLE}
+rm -rf build_pkg_temp build_pkg_scripts build_pkg_resources ${APP_BUNDLE}
 
 echo "PKG package created successfully."
 echo "package ${APP_BUNDLE}"
-echo "installer ${PKG_NAME}"
+echo "installer ${PKG_NAME}"

apps/desktop/scripts/macos/pkg_x64.sh

@@ -1,20 +1,44 @@
-#!/bin/bash
-set -e
+#!/usr/bin/env bash
+set -euo pipefail
 
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+PROJECT_ROOT="$(cd "$SCRIPT_DIR/../../../.." && pwd)"
 APP_NAME="crossdesk"
 APP_NAME_UPPER="CrossDesk"
-EXECUTABLE_PATH="build/macosx/x86_64/release/crossdesk"
-APP_VERSION="$1"
+EXECUTABLE_PATH="${PROJECT_ROOT}/build/macosx/x86_64/release/crossdesk"
 PLATFORM="macos"
 ARCH="x64"
+BINARY_ARCH="x86_64"
 IDENTIFIER="cn.crossdesk.app"
-ICON_PATH="icons/macos/crossdesk.icns"
-MACOS_MIN_VERSION="10.12"
+ICON_PATH="${PROJECT_ROOT}/apps/desktop/resources/macos/crossdesk.icns"
+MACOS_MIN_VERSION="14.0"
+
+cd "$PROJECT_ROOT"
+
+normalize_app_version() {
+    local input="$1"
+    local prefix=""
+    local body="$input"
+
+    if [[ "$body" == v* ]]; then
+        prefix="v"
+        body="${body#v}"
+    fi
+
+    if [[ "$body" =~ ^([0-9]+(\.[0-9]+){1,3})-([0-9]{8})-([0-9]+)$ ]]; then
+        echo "${prefix}${BASH_REMATCH[1]}-${BASH_REMATCH[4]}-${BASH_REMATCH[3]}"
+    else
+        echo "$input"
+    fi
+}
+
+APP_VERSION="$(normalize_app_version "$1")"
 
 APP_BUNDLE="${APP_NAME_UPPER}.app"
 CONTENTS_DIR="${APP_BUNDLE}/Contents"
 MACOS_DIR="${CONTENTS_DIR}/MacOS"
 RESOURCES_DIR="${CONTENTS_DIR}/Resources"
+INSTALLER_TITLE="${APP_NAME_UPPER} ${APP_VERSION}"
 
 PKG_NAME="${APP_NAME}-${PLATFORM}-${ARCH}-${APP_VERSION}.pkg"
 DMG_NAME="${APP_NAME}-${PLATFORM}-${ARCH}-${APP_VERSION}.dmg"
@@ -73,67 +97,85 @@ cat > "${CONTENTS_DIR}/Info.plist" <<EOF
 </plist>
 EOF
 
+xattr -cr "${APP_BUNDLE}" 2>/dev/null || true
+find "${APP_BUNDLE}" -name '._*' -delete
+
+"${SCRIPT_DIR}/bundle_app.sh" "${APP_BUNDLE}" "${BINARY_ARCH}"
+"${SCRIPT_DIR}/verify_app.sh" "${APP_BUNDLE}" "${BINARY_ARCH}"
+
 echo ".app created successfully."
 
+mkdir -p build_pkg_scripts
+cp "${SCRIPT_DIR}/tcc_postinstall.sh" build_pkg_scripts/postinstall
+chmod +x build_pkg_scripts/postinstall
+
+mkdir -p build_pkg_resources
+cat > build_pkg_resources/welcome.html <<EOF
+<!doctype html>
+<html>
+<head>
+    <meta charset="utf-8">
+    <style>
+        body {
+            font-family: -apple-system, BlinkMacSystemFont, "Helvetica Neue", sans-serif;
+            font-size: 13px;
+            line-height: 1.5;
+            color: #222;
+            margin: 0;
+            padding: 0;
+        }
+        h1 {
+            font-size: 20px;
+            font-weight: 600;
+            margin: 0 0 12px;
+        }
+        p {
+            margin: 0 0 10px;
+        }
+    </style>
+</head>
+<body>
+    <h1>欢迎安装 ${INSTALLER_TITLE}</h1>
+    <p>CrossDesk 将安装到“应用程序”文件夹。</p>
+    <p>首次启动时，CrossDesk 会引导你在系统设置中授予必要权限，包括辅助功能、录屏与系统录音等。</p>
+    <p>为避免旧版本授权残留造成状态误判，安装后可能需要重新授权。</p>
+    <p>安装完成后，请从“应用程序”文件夹启动 CrossDesk。</p>
+</body>
+</html>
+EOF
+
 echo "building pkg..."
 pkgbuild \
   --identifier "${IDENTIFIER}" \
   --version "${APP_VERSION}" \
   --install-location "/Applications" \
   --component "${APP_BUNDLE}" \
+  --scripts build_pkg_scripts \
   build_pkg_temp/${APP_NAME}-component.pkg
 
-mkdir -p build_pkg_scripts
-
-cat > build_pkg_scripts/postinstall <<'EOF'
-#!/bin/bash
-set -e
-
-IDENTIFIER="cn.crossdesk.app"
-
-# 获取当前登录用户
-USER_HOME=$( /usr/bin/stat -f "%Su" /dev/console )
-HOME_DIR=$( /usr/bin/dscl . -read /Users/$USER_HOME NFSHomeDirectory | awk '{print $2}' )
-
-# 清除应用的权限授权，以便重新授权
-# 使用 tccutil 重置录屏权限和辅助功能权限
-if command -v tccutil >/dev/null 2>&1; then
-    # 重置录屏权限
-    tccutil reset ScreenCapture "$IDENTIFIER" 2>/dev/null || true
-    # 重置辅助功能权限
-    tccutil reset Accessibility "$IDENTIFIER" 2>/dev/null || true
-    # 重置摄像头权限（如果需要）
-    tccutil reset Camera "$IDENTIFIER" 2>/dev/null || true
-    # 重置麦克风权限（如果需要）
-    tccutil reset Microphone "$IDENTIFIER" 2>/dev/null || true
-fi
-
-# 为所有用户清除权限（可选，如果需要）
-# 遍历所有用户目录并清除权限
-for USER_DIR in /Users/*; do
-    if [ -d "$USER_DIR" ] && [ "$USER_DIR" != "/Users/Shared" ]; then
-        USER_NAME=$(basename "$USER_DIR")
-        # 跳过系统用户
-        if [ "$USER_NAME" != "Shared" ] && [ -d "$USER_DIR/Library" ]; then
-            # 删除 TCC 数据库中的相关条目（需要管理员权限）
-            TCC_DB="$USER_DIR/Library/Application Support/com.apple.TCC/TCC.db"
-            if [ -f "$TCC_DB" ]; then
-                # 使用 sqlite3 删除相关权限记录（如果可用）
-                if command -v sqlite3 >/dev/null 2>&1; then
-                    sqlite3 "$TCC_DB" "DELETE FROM access WHERE client='$IDENTIFIER' AND service IN ('kTCCServiceScreenCapture', 'kTCCServiceAccessibility');" 2>/dev/null || true
-                fi
-            fi
-        fi
-    fi
-done
-
-exit 0
+cat > build_pkg_temp/Distribution <<EOF
+<?xml version="1.0" encoding="utf-8"?>
+<installer-gui-script minSpecVersion="1">
+    <title>${INSTALLER_TITLE}</title>
+    <welcome file="welcome.html" mime-type="text/html"/>
+    <options customize="never" require-scripts="false" hostArchitectures="x86_64"/>
+    <choices-outline>
+        <line choice="default">
+            <line choice="${IDENTIFIER}"/>
+        </line>
+    </choices-outline>
+    <choice id="default" title="${INSTALLER_TITLE}"/>
+    <choice id="${IDENTIFIER}" title="${INSTALLER_TITLE}" visible="false">
+        <pkg-ref id="${IDENTIFIER}"/>
+    </choice>
+    <pkg-ref id="${IDENTIFIER}" version="${APP_VERSION}" onConclusion="none">crossdesk-component.pkg</pkg-ref>
+</installer-gui-script>
 EOF
 
-chmod +x build_pkg_scripts/postinstall
-
 productbuild \
-  --package build_pkg_temp/${APP_NAME}-component.pkg \
+  --distribution build_pkg_temp/Distribution \
+  --package-path build_pkg_temp \
+  --resources build_pkg_resources \
   "${PKG_NAME}"
 
 echo "PKG package created: ${PKG_NAME}"
@@ -171,8 +213,8 @@ APPLESCRIPT
 fi
 echo "Set icon finished"
 
-rm -rf build_pkg_temp build_pkg_scripts ${APP_BUNDLE}
+rm -rf build_pkg_temp build_pkg_scripts build_pkg_resources ${APP_BUNDLE}
 
 echo "PKG package created successfully."
 echo "package ${APP_BUNDLE}"
-echo "installer ${PKG_NAME}"
+echo "installer ${PKG_NAME}"

apps/desktop/scripts/macos/tcc_postinstall.sh

@@ -0,0 +1,112 @@
+#!/bin/bash
+set -e
+
+APP_IDENTIFIER="cn.crossdesk.app"
+
+# Keep known historical identifiers here. tccutil only resets identifiers that
+# Launch Services can currently resolve, so path/db cleanup below remains a
+# best-effort fallback for stale entries from unsigned or removed builds.
+BUNDLE_IDENTIFIERS=(
+    "cn.crossdesk.app"
+    "cn.crossdesk.CrossDesk"
+    "com.crossdesk.app"
+    "com.crossdesk.CrossDesk"
+    "com.kunkundi.crossdesk"
+    "com.kunkundi.CrossDesk"
+)
+
+TCC_SERVICES=(
+    "ScreenCapture"
+    "Accessibility"
+    "Microphone"
+    "AudioCapture"
+)
+
+run_tccutil() {
+    local user_name="$1"
+    local user_id="$2"
+    local service="$3"
+    local bundle_id="$4"
+
+    if [ -n "$user_name" ] && [ -n "$user_id" ]; then
+        /bin/launchctl asuser "$user_id" \
+            /usr/bin/sudo -u "$user_name" \
+            /usr/bin/tccutil reset "$service" "$bundle_id" >/dev/null 2>&1
+    else
+        /usr/bin/tccutil reset "$service" "$bundle_id" >/dev/null 2>&1
+    fi
+}
+
+reset_bundle_tcc() {
+    local user_name="$1"
+    local user_id="$2"
+    local bundle_id
+    local service
+
+    for bundle_id in "${BUNDLE_IDENTIFIERS[@]}"; do
+        if run_tccutil "$user_name" "$user_id" "All" "$bundle_id"; then
+            continue
+        fi
+
+        for service in "${TCC_SERVICES[@]}"; do
+            run_tccutil "$user_name" "$user_id" "$service" "$bundle_id" || true
+        done
+    done
+}
+
+cleanup_tcc_db() {
+    local db_path="$1"
+
+    if [ ! -f "$db_path" ] || ! command -v sqlite3 >/dev/null 2>&1; then
+        return
+    fi
+
+    /usr/bin/sqlite3 "$db_path" <<'SQL' >/dev/null 2>&1 || true
+DELETE FROM access
+WHERE service IN (
+  'kTCCServiceScreenCapture',
+  'kTCCServiceAccessibility',
+  'kTCCServiceMicrophone',
+  'kTCCServiceAudioCapture'
+)
+AND (
+  client IN (
+    'cn.crossdesk.app',
+    'cn.crossdesk.CrossDesk',
+    'com.crossdesk.app',
+    'com.crossdesk.CrossDesk',
+    'com.kunkundi.crossdesk',
+    'com.kunkundi.CrossDesk'
+  )
+  OR lower(client) LIKE '%crossdesk%'
+);
+SQL
+}
+
+cleanup_user_tcc_db() {
+    local user_name="$1"
+    local home_dir
+
+    home_dir=$(/usr/bin/dscl . -read "/Users/${user_name}" NFSHomeDirectory 2>/dev/null |
+        /usr/bin/awk '{print $2}')
+    if [ -z "$home_dir" ]; then
+        return
+    fi
+
+    cleanup_tcc_db "${home_dir}/Library/Application Support/com.apple.TCC/TCC.db"
+}
+
+CONSOLE_USER=$(/usr/bin/stat -f "%Su" /dev/console 2>/dev/null || true)
+if [ -n "$CONSOLE_USER" ] &&
+   [ "$CONSOLE_USER" != "root" ] &&
+   [ "$CONSOLE_USER" != "loginwindow" ]; then
+    CONSOLE_UID=$(/usr/bin/id -u "$CONSOLE_USER" 2>/dev/null || true)
+    reset_bundle_tcc "$CONSOLE_USER" "$CONSOLE_UID"
+    cleanup_user_tcc_db "$CONSOLE_USER"
+fi
+
+# Also clear any system/root-scoped decisions as a harmless fallback.
+reset_bundle_tcc "" ""
+cleanup_tcc_db "/Library/Application Support/com.apple.TCC/TCC.db"
+
+exit 0

apps/desktop/scripts/macos/verify_app.sh

@@ -0,0 +1,117 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+if [[ $# -lt 2 || $# -gt 3 ]]; then
+    echo "Usage: $0 <app-bundle> <expected-architecture> [expected-sdk-version]" >&2
+    exit 2
+fi
+
+APP_BUNDLE="$1"
+EXPECTED_ARCH="$2"
+EXPECTED_SDK_VERSION="${3:-}"
+APP_EXECUTABLE="$APP_BUNDLE/Contents/MacOS/CrossDesk"
+FRAMEWORKS_DIR="$APP_BUNDLE/Contents/Frameworks"
+INFO_PLIST="$APP_BUNDLE/Contents/Info.plist"
+
+if [[ ! -x "$APP_EXECUTABLE" ]]; then
+    echo "Missing app executable: $APP_EXECUTABLE" >&2
+    exit 1
+fi
+
+if ! lipo "$APP_EXECUTABLE" -verify_arch "$EXPECTED_ARCH" >/dev/null 2>&1; then
+    echo "Unexpected app architecture; expected $EXPECTED_ARCH" >&2
+    lipo -archs "$APP_EXECUTABLE" >&2 || true
+    exit 1
+fi
+
+if ! otool -l "$APP_EXECUTABLE" | awk '
+    $1 == "cmd" { in_rpath = ($2 == "LC_RPATH"); next }
+    in_rpath && $1 == "path" && $2 == "@executable_path/../Frameworks" { found = 1 }
+    END { exit(found ? 0 : 1) }'; then
+    echo "Missing app rpath: @executable_path/../Frameworks" >&2
+    exit 1
+fi
+
+verify_dependencies() {
+    local macho="$1"
+    local dependency=""
+    local relative_path=""
+
+    while IFS= read -r dependency; do
+        case "$dependency" in
+            /System/Library/*|/usr/lib/*)
+                ;;
+            @rpath/*)
+                relative_path="${dependency#@rpath/}"
+                if [[ ! -f "$FRAMEWORKS_DIR/$relative_path" ]]; then
+                    echo "Unbundled dependency in $macho: $dependency" >&2
+                    return 1
+                fi
+                ;;
+            @executable_path/../Frameworks/*)
+                relative_path="${dependency#@executable_path/../Frameworks/}"
+                if [[ ! -f "$FRAMEWORKS_DIR/$relative_path" ]]; then
+                    echo "Unbundled dependency in $macho: $dependency" >&2
+                    return 1
+                fi
+                ;;
+            @loader_path/*)
+                relative_path="${dependency#@loader_path/}"
+                if [[ ! -f "$(dirname "$macho")/$relative_path" ]]; then
+                    echo "Unbundled dependency in $macho: $dependency" >&2
+                    return 1
+                fi
+                ;;
+            *)
+                echo "External non-system dependency in $macho: $dependency" >&2
+                return 1
+                ;;
+        esac
+    done < <(otool -L "$macho" | tail -n +2 | awk '{ print $1 }')
+}
+
+verify_dependencies "$APP_EXECUTABLE"
+
+SLINT_LIBRARY="$(find "$FRAMEWORKS_DIR" -maxdepth 1 -type f -name 'libslint_cpp*.dylib' -print -quit 2>/dev/null || true)"
+if [[ -z "$SLINT_LIBRARY" ]]; then
+    echo "The packaged app does not contain libslint_cpp.dylib" >&2
+    exit 1
+fi
+
+if ! lipo "$SLINT_LIBRARY" -verify_arch "$EXPECTED_ARCH" >/dev/null 2>&1; then
+    echo "Unexpected Slint runtime architecture; expected $EXPECTED_ARCH" >&2
+    lipo -archs "$SLINT_LIBRARY" >&2 || true
+    exit 1
+fi
+verify_dependencies "$SLINT_LIBRARY"
+
+PLIST_MIN_VERSION="$(/usr/libexec/PlistBuddy -c 'Print :LSMinimumSystemVersion' "$INFO_PLIST")"
+BINARY_MIN_VERSION="$(otool -l "$APP_EXECUTABLE" | awk '
+    $1 == "cmd" { build_version = ($2 == "LC_BUILD_VERSION"); version_min = ($2 == "LC_VERSION_MIN_MACOSX"); next }
+    build_version && $1 == "minos" { print $2; exit }
+    version_min && $1 == "version" { print $2; exit }')"
+if [[ -z "$BINARY_MIN_VERSION" || "$PLIST_MIN_VERSION" != "$BINARY_MIN_VERSION" ]]; then
+    echo "Minimum macOS version mismatch: plist=$PLIST_MIN_VERSION binary=${BINARY_MIN_VERSION:-unknown}" >&2
+    exit 1
+fi
+
+if [[ -n "$EXPECTED_SDK_VERSION" ]]; then
+    verify_sdk_version() {
+        local macho="$1"
+        local actual_sdk=""
+        actual_sdk="$(otool -l "$macho" | awk '
+            $1 == "cmd" { build_version = ($2 == "LC_BUILD_VERSION"); next }
+            build_version && $1 == "sdk" { print $2; exit }')"
+        if [[ "$actual_sdk" != "$EXPECTED_SDK_VERSION" ]]; then
+            echo "Unexpected macOS SDK in $macho: expected $EXPECTED_SDK_VERSION, got ${actual_sdk:-unknown}" >&2
+            return 1
+        fi
+    }
+
+    verify_sdk_version "$APP_EXECUTABLE"
+    verify_sdk_version "$SLINT_LIBRARY"
+fi
+
+codesign --verify --deep --strict --verbose=2 "$APP_BUNDLE"
+
+echo "Verified $APP_BUNDLE ($EXPECTED_ARCH, macOS $BINARY_MIN_VERSION+)"

apps/desktop/scripts/windows/nsis_script.nsi

@@ -0,0 +1,307 @@
+; Set search path
+!addincludedir "${__FILEDIR__}"
+
+; Installer initial constants
+!define PRODUCT_NAME "CrossDesk"
+!define PRODUCT_VERSION "${VERSION}"
+!define PRODUCT_VERSION_NUMERIC "${VERSION_NUMERIC}"
+!define PRODUCT_PUBLISHER "CrossDesk"
+!define PRODUCT_WEB_SITE "https://www.crossdesk.cn/"
+!define APP_NAME "CrossDesk"
+!define UNINSTALL_REG_KEY "CrossDesk"
+!define PRODUCT_SERVICE_NAME "CrossDeskService"
+
+; Installer icon path
+!define MUI_ICON "${__FILEDIR__}\..\..\resources\windows\crossdesk.ico"
+
+; Compression settings
+SetCompressor /FINAL lzma
+
+; Request admin privileges (needed to write HKLM)
+RequestExecutionLevel admin
+
+; ------ MUI Modern UI Definition ------
+!include "MUI.nsh"
+!define MUI_ABORTWARNING
+!insertmacro MUI_PAGE_WELCOME
+!insertmacro MUI_PAGE_DIRECTORY
+!insertmacro MUI_PAGE_INSTFILES
+
+; Add run-after-install option
+!define MUI_FINISHPAGE_RUN
+!define MUI_FINISHPAGE_RUN_TEXT "Run ${PRODUCT_NAME}"
+!define MUI_FINISHPAGE_RUN_FUNCTION LaunchApp
+
+!insertmacro MUI_PAGE_FINISH
+!insertmacro MUI_LANGUAGE "SimpChinese"
+!insertmacro MUI_RESERVEFILE_INSTALLOPTIONS
+; ------ End of MUI Definition ------
+
+; Include LogicLib for process handling
+!include "LogicLib.nsh"
+
+Name "${PRODUCT_NAME} ${PRODUCT_VERSION}"
+OutFile "crossdesk-win-x64-${PRODUCT_VERSION}.exe"
+VIProductVersion "${PRODUCT_VERSION_NUMERIC}"
+VIAddVersionKey /LANG=2052 "CompanyName" "CrossDesk"
+VIAddVersionKey /LANG=2052 "FileDescription" "CrossDesk Installer"
+VIAddVersionKey /LANG=2052 "FileVersion" "${PRODUCT_VERSION}"
+VIAddVersionKey /LANG=2052 "LegalCopyright" "Copyright (C) CrossDesk contributors"
+VIAddVersionKey /LANG=2052 "OriginalFilename" "crossdesk-win-x64-${PRODUCT_VERSION}.exe"
+VIAddVersionKey /LANG=2052 "ProductName" "${PRODUCT_NAME}"
+VIAddVersionKey /LANG=2052 "ProductVersion" "${PRODUCT_VERSION}"
+InstallDir "$PROGRAMFILES\CrossDesk"
+InstallDirRegKey HKCU "Software\${PRODUCT_NAME}" "InstallDir"
+ShowInstDetails show
+
+Section "MainSection"
+    ; Check if CrossDesk is running
+    StrCpy $1 "CrossDesk.exe"
+    
+    nsProcess::_FindProcess "$1"
+    Pop $R0
+    ${If} $R0 = 0  ;
+        MessageBox MB_ICONQUESTION|MB_YESNO "CrossDesk is running. Do you want to close it and continue the installation?" IDYES closeApp IDNO cancelInstall
+    ${Else}
+        Goto installApp
+    ${EndIf}
+
+closeApp:
+    nsProcess::_KillProcess "$1"
+    Pop $R0
+    Sleep 500
+    Goto installApp
+
+cancelInstall:
+    SetDetailsPrint both
+    MessageBox MB_ICONEXCLAMATION|MB_OK "Installation has been aborted."
+    Abort
+
+installApp:
+    Call StopInstalledService
+
+    SetOutPath "$INSTDIR"
+    SetOverwrite ifnewer
+
+    ; Main application executable path
+    File /oname=CrossDesk.exe "..\..\..\..\build\windows\x64\release\crossdesk.exe"
+    ; Bundle service-side binaries required by the Windows service flow
+    File "..\..\..\..\build\windows\x64\release\crossdesk_service.exe"
+    File "..\..\..\..\build\windows\x64\release\crossdesk_session_helper.exe"
+    File "..\..\..\..\build\windows\x64\release\crossdesk_privacy_cursor_helper.exe"
+    File "..\..\..\..\build\windows\x64\release\crossdesk_privacy_window.dll"
+    ; Require the Slint runtime so an incomplete build cannot be packaged.
+    File "..\..\..\..\build\windows\x64\release\slint_cpp.dll"
+    ; Bundle the remaining runtime DLLs from the release output directory
+    File /x crossdesk_privacy_window.dll /x slint_cpp.dll "..\..\..\..\build\windows\x64\release\*.dll"
+    ; Amyuni usbmmidd_v2 virtual display driver for headless hosts. xmake
+    ; copies apps\desktop\resources\windows\usbmmidd_v2 into the release
+    ; output directory after building crossdesk; its License.txt ships with it.
+    File /r "..\..\..\..\build\windows\x64\release\usbmmidd_v2"
+
+    Call RegisterInstalledService
+
+    ; Write uninstall information
+    WriteUninstaller "$INSTDIR\uninstall.exe"
+
+    WriteRegStr HKLM "Software\Microsoft\Windows\CurrentVersion\Uninstall\${UNINSTALL_REG_KEY}" "DisplayName" "${PRODUCT_NAME}"
+    WriteRegStr HKLM "Software\Microsoft\Windows\CurrentVersion\Uninstall\${UNINSTALL_REG_KEY}" "UninstallString" "$INSTDIR\uninstall.exe"
+    WriteRegStr HKLM "Software\Microsoft\Windows\CurrentVersion\Uninstall\${UNINSTALL_REG_KEY}" "DisplayVersion" "${PRODUCT_VERSION}"
+    WriteRegStr HKLM "Software\Microsoft\Windows\CurrentVersion\Uninstall\${UNINSTALL_REG_KEY}" "Publisher" "${PRODUCT_PUBLISHER}"
+    WriteRegStr HKLM "Software\Microsoft\Windows\CurrentVersion\Uninstall\${UNINSTALL_REG_KEY}" "URLInfoAbout" "${PRODUCT_WEB_SITE}"
+    WriteRegStr HKLM "Software\Microsoft\Windows\CurrentVersion\Uninstall\${UNINSTALL_REG_KEY}" "DisplayIcon" "$INSTDIR\CrossDesk.exe"
+    WriteRegDWORD HKLM "Software\Microsoft\Windows\CurrentVersion\Uninstall\${UNINSTALL_REG_KEY}" "NoModify" 1
+    WriteRegDWORD HKLM "Software\Microsoft\Windows\CurrentVersion\Uninstall\${UNINSTALL_REG_KEY}" "NoRepair" 1
+    WriteRegStr HKCU "Software\${PRODUCT_NAME}" "InstallDir" "$INSTDIR"
+SectionEnd
+
+Section -AdditionalIcons
+    ; Desktop shortcut
+    CreateShortCut "$DESKTOP\${PRODUCT_NAME}.lnk" "$INSTDIR\CrossDesk.exe" "" "$INSTDIR\CrossDesk.exe"
+
+    ; Start menu shortcut
+    CreateShortCut "$SMPROGRAMS\${PRODUCT_NAME}.lnk" "$INSTDIR\CrossDesk.exe" "" "$INSTDIR\CrossDesk.exe"
+SectionEnd
+
+Section "Uninstall"
+    ; Check if CrossDesk is running
+    StrCpy $1 "CrossDesk.exe"
+    
+    nsProcess::_FindProcess "$1"
+    Pop $R0
+    ${If} $R0 = 0
+        MessageBox MB_ICONQUESTION|MB_YESNO "CrossDesk is running. Do you want to close it and uninstall?" IDYES closeApp IDNO cancelUninstall
+    ${Else}
+        Goto uninstallApp
+    ${EndIf}
+
+closeApp:
+    nsProcess::_KillProcess "$1"
+    Pop $R0
+    Sleep 500
+    Goto uninstallApp
+
+cancelUninstall:
+    SetDetailsPrint both
+    MessageBox MB_ICONEXCLAMATION|MB_OK "Uninstallation has been aborted."
+    Abort
+
+uninstallApp:
+    Call un.UnregisterInstalledService
+    Call un.RemoveUsbmmiddDriver
+
+    ; Delete main executable and uninstaller
+    Delete "$INSTDIR\CrossDesk.exe"
+    Delete "$INSTDIR\crossdesk_service.exe"
+    Delete "$INSTDIR\crossdesk_session_helper.exe"
+    Delete "$INSTDIR\crossdesk_privacy_cursor_helper.exe"
+    Delete "$INSTDIR\crossdesk_privacy_window.dll"
+    Delete "$INSTDIR\uninstall.exe"
+
+    ; Leave the install directory before removing it
+    SetOutPath "$TEMP"
+
+    ; Recursively delete installation directory
+    RMDir /r "$INSTDIR"
+
+    ; Delete desktop and start menu shortcuts
+    Delete "$DESKTOP\${PRODUCT_NAME}.lnk"
+    Delete "$SMPROGRAMS\${PRODUCT_NAME}.lnk"
+
+    ; Delete registry uninstall entry
+    DeleteRegKey HKLM "Software\Microsoft\Windows\CurrentVersion\Uninstall\${UNINSTALL_REG_KEY}"
+
+    ; Delete remembered install dir
+    DeleteRegKey HKCU "Software\${PRODUCT_NAME}"
+
+    ; Recursively delete CrossDesk folder in user AppData
+    RMDir /r "$APPDATA\CrossDesk"
+    RMDir /r "$LOCALAPPDATA\CrossDesk"
+SectionEnd
+
+; ------ Functions ------
+Function LaunchApp
+    Exec "$INSTDIR\CrossDesk.exe"
+FunctionEnd
+
+Function StopInstalledService
+    IfFileExists "$INSTDIR\CrossDesk.exe" 0 stop_with_sc
+    IfFileExists "$INSTDIR\crossdesk_service.exe" 0 stop_with_sc
+
+    DetailPrint "Stopping existing CrossDesk service"
+    ExecWait '"$INSTDIR\CrossDesk.exe" --service-stop' $0
+    ${If} $0 = 0
+        Return
+    ${EndIf}
+
+stop_with_sc:
+    DetailPrint "Stopping existing CrossDesk service via Service Control Manager"
+    ExecWait '"$SYSDIR\sc.exe" stop ${PRODUCT_SERVICE_NAME}' $0
+    ${If} $0 != 0
+    ${AndIf} $0 != 1060
+    ${AndIf} $0 != 1062
+        MessageBox MB_ICONSTOP|MB_OK "Failed to stop the existing CrossDesk service. The installation will be aborted."
+        Abort
+    ${EndIf}
+    Sleep 1500
+FunctionEnd
+
+Function RegisterInstalledService
+    IfFileExists "$INSTDIR\CrossDesk.exe" 0 missing_service_binary
+    IfFileExists "$INSTDIR\crossdesk_service.exe" 0 missing_service_binary
+    IfFileExists "$INSTDIR\crossdesk_session_helper.exe" 0 missing_service_binary
+
+    DetailPrint "Registering CrossDesk service"
+    ExecWait '"$INSTDIR\CrossDesk.exe" --service-install' $0
+    ${If} $0 != 0
+        MessageBox MB_ICONSTOP|MB_OK "Failed to register the CrossDesk service. The installation will be aborted."
+        Abort
+    ${EndIf}
+
+    DetailPrint "CrossDesk service registered for on-demand start"
+
+    Return
+
+missing_service_binary:
+    MessageBox MB_ICONSTOP|MB_OK "CrossDesk service files are missing from the installer package. The installation will be aborted."
+    Abort
+FunctionEnd
+
+Function un.UnregisterInstalledService
+    IfFileExists "$INSTDIR\CrossDesk.exe" 0 unregister_with_sc
+
+    DetailPrint "Stopping CrossDesk service"
+    ExecWait '"$INSTDIR\CrossDesk.exe" --service-stop' $0
+    ${If} $0 = 0
+        DetailPrint "Removing CrossDesk service"
+        ExecWait '"$INSTDIR\CrossDesk.exe" --service-uninstall' $0
+        ${If} $0 = 0
+            Return
+        ${EndIf}
+    ${EndIf}
+
+unregister_with_sc:
+    DetailPrint "Removing CrossDesk service via Service Control Manager"
+    ExecWait '"$SYSDIR\sc.exe" stop ${PRODUCT_SERVICE_NAME}' $0
+    ${If} $0 != 0
+    ${AndIf} $0 != 1060
+    ${AndIf} $0 != 1062
+        MessageBox MB_ICONSTOP|MB_OK "Failed to stop the CrossDesk service. Uninstall will be aborted."
+        Abort
+    ${EndIf}
+    Sleep 1500
+
+    ExecWait '"$SYSDIR\sc.exe" delete ${PRODUCT_SERVICE_NAME}' $0
+    ${If} $0 != 0
+    ${AndIf} $0 != 1060
+        MessageBox MB_ICONSTOP|MB_OK "Failed to remove the CrossDesk service. Uninstall will be aborted."
+        Abort
+    ${EndIf}
+FunctionEnd
+
+; The session helper (or an elevated CrossDesk) installs the bundled usbmmidd
+; driver on first headless use and records HKLM\SOFTWARE\CrossDesk\
+; UsbmmiddDriverInstalled in the 64-bit registry view. Only a driver CrossDesk
+; installed is removed here; one set up by the user for other software stays.
+; deviceinstaller64.exe resolves usbmmIdd.dll relative to the working
+; directory, so run it from the driver folder. Failures are logged, not fatal:
+; the driver can still be removed from Device Manager.
+Function un.RemoveUsbmmiddDriver
+    IfFileExists "$INSTDIR\usbmmidd_v2\deviceinstaller64.exe" 0 done
+
+    SetRegView 64
+    ClearErrors
+    ReadRegDWORD $0 HKLM "Software\${PRODUCT_NAME}" "UsbmmiddDriverInstalled"
+    ${If} ${Errors}
+    ${OrIf} $0 != 1
+        SetRegView lastused
+        Return
+    ${EndIf}
+
+    DetailPrint "Removing the usbmmidd virtual display driver installed by CrossDesk"
+    SetOutPath "$INSTDIR\usbmmidd_v2"
+    ; Unplug every virtual monitor first (the driver allows up to four).
+    StrCpy $1 0
+unplug_loop:
+    nsExec::ExecToLog '"$INSTDIR\usbmmidd_v2\deviceinstaller64.exe" enableidd 0'
+    Pop $2
+    IntOp $1 $1 + 1
+    ${If} $2 = 0
+    ${AndIf} $1 < 4
+        Goto unplug_loop
+    ${EndIf}
+    nsExec::ExecToLog '"$INSTDIR\usbmmidd_v2\deviceinstaller64.exe" stop usbmmidd'
+    Pop $2
+    nsExec::ExecToLog '"$INSTDIR\usbmmidd_v2\deviceinstaller64.exe" remove usbmmidd'
+    Pop $2
+    ${If} $2 != 0
+        DetailPrint "usbmmidd driver removal returned $2; remove 'USB Mobile Monitor Virtual Display' from Device Manager if it remains"
+    ${EndIf}
+    SetOutPath "$TEMP"
+
+    DeleteRegValue HKLM "Software\${PRODUCT_NAME}" "UsbmmiddDriverInstalled"
+    DeleteRegKey /ifempty HKLM "Software\${PRODUCT_NAME}"
+    SetRegView lastused
+
+done:
+FunctionEnd

apps/desktop/scripts/windows/pkg_x64.ps1

@@ -0,0 +1,68 @@
+param(
+  [Parameter(Mandatory = $true)]
+  [string]$Version
+)
+
+$ErrorActionPreference = "Stop"
+
+function Normalize-AppVersion {
+  param(
+    [Parameter(Mandatory = $true)]
+    [string]$InputVersion
+  )
+
+  $prefix = ""
+  $body = $InputVersion
+
+  if ($body.StartsWith("v")) {
+    $prefix = "v"
+    $body = $body.Substring(1)
+  }
+
+  if ($body -match '^([0-9]+(\.[0-9]+){1,3})-([0-9]{8})-([0-9]+)$') {
+    return "${prefix}$($Matches[1])-$($Matches[4])-$($Matches[3])"
+  }
+
+  return $InputVersion
+}
+
+function Convert-To-WindowsVersion {
+  param(
+    [Parameter(Mandatory = $true)]
+    [string]$InputVersion
+  )
+
+  $body = $InputVersion -replace '^v', ''
+  $baseMatch = [regex]::Match($body, '^[0-9]+(?:\.[0-9]+){0,3}')
+  if (!$baseMatch.Success) {
+    return "0.0.0.0"
+  }
+
+  $parts = [System.Collections.Generic.List[int]]::new()
+  foreach ($part in $baseMatch.Value.Split('.')) {
+    $value = [int]$part
+    if ($value -gt 65535) {
+      $value = 0
+    }
+    $parts.Add($value)
+  }
+  while ($parts.Count -lt 4) {
+    $parts.Add(0)
+  }
+
+  return ($parts -join '.')
+}
+
+$normalizedVersion = Normalize-AppVersion -InputVersion $Version
+$windowsVersion = Convert-To-WindowsVersion -InputVersion $normalizedVersion
+$scriptDir = Split-Path -Parent $MyInvocation.MyCommand.Path
+
+Push-Location $scriptDir
+try {
+  & makensis "/DVERSION=$normalizedVersion" "/DVERSION_NUMERIC=$windowsVersion" "nsis_script.nsi"
+  if ($LASTEXITCODE -ne 0) {
+    exit $LASTEXITCODE
+  }
+} finally {
+  Pop-Location
+}

apps/desktop/scripts/windows/signpath-installer.xml

@@ -0,0 +1,15 @@
+<?xml version="1.0" encoding="utf-8"?>
+<artifact-configuration xmlns="http://signpath.io/artifact-configuration/v1">
+  <parameters>
+    <parameter name="version" required="true" />
+  </parameters>
+  <pe-file path="crossdesk-win-x64-${version}.exe"
+           product-name="CrossDesk"
+           product-version="${version}"
+           file-version="${version}"
+           company-name="CrossDesk"
+           copyright="Copyright (C) CrossDesk contributors"
+           original-filename="crossdesk-win-x64-${version}.exe">
+    <authenticode-sign />
+  </pe-file>
+</artifact-configuration>

apps/desktop/src/app/daemon.cpp

@@ -0,0 +1,76 @@
+#include "daemon.h"
+
+#include <chrono>
+#include <iostream>
+#include <thread>
+#include <utility>
+
+#include "platform/daemon_backend.h"
+
+namespace {
+
+constexpr int kRestartDelayMs = 1000;
+
+}  // namespace
+
+Daemon::Daemon(const std::string& name) : name_(name), running_(false) {}
+
+void Daemon::stop() {
+  running_.store(false);
+  crossdesk::platform::RequestDaemonStop();
+}
+
+bool Daemon::isRunning() const {
+  return running_.load() && !crossdesk::platform::DaemonStopRequested();
+}
+
+bool Daemon::start(MainLoopFunc loop) {
+  crossdesk::platform::ResetDaemonStop();
+  if (!crossdesk::platform::PrepareDaemon()) return false;
+  running_.store(true);
+  return runWithRestart(std::move(loop));
+}
+
+bool Daemon::runWithRestart(MainLoopFunc loop) {
+  int restart_count = 0;
+  const std::string executable_path =
+      crossdesk::platform::GetDaemonExecutablePath();
+  if (executable_path.empty()) {
+    std::cerr
+        << "Failed to get executable path, falling back to direct execution"
+        << std::endl;
+    while (isRunning()) {
+      try {
+        loop();
+        break;
+      } catch (...) {
+        ++restart_count;
+        std::cerr << "Exception caught, restarting... (attempt "
+                  << restart_count << ")" << std::endl;
+        std::this_thread::sleep_for(
+            std::chrono::milliseconds(kRestartDelayMs));
+      }
+    }
+    return true;
+  }
+
+  while (isRunning()) {
+    const crossdesk::platform::DaemonChildResult result =
+        crossdesk::platform::RunDaemonChild(
+            executable_path, [this] { return isRunning(); });
+    if (!isRunning() || result.normal_exit) break;
+
+    ++restart_count;
+    if (!result.started) {
+      std::cerr << "Failed to create child process";
+    } else if (result.terminated_by_signal) {
+      std::cerr << "Child process crashed with signal " << result.exit_code;
+    } else {
+      std::cerr << "Child process exited with code " << result.exit_code;
+    }
+    std::cerr << ", restarting... (attempt " << restart_count << ")"
+              << std::endl;
+    std::this_thread::sleep_for(std::chrono::milliseconds(kRestartDelayMs));
+  }
+  return true;
+}

apps/desktop/src/app/daemon.h

@@ -7,11 +7,10 @@
 #ifndef _DAEMON_H_
 #define _DAEMON_H_
 
+#include <atomic>
 #include <functional>
 #include <string>
 
-#define DAEMON_DEFAULT_RESTART_DELAY_MS 1000
-
 class Daemon {
  public:
   using MainLoopFunc = std::function<void()>;
@@ -28,12 +27,7 @@ class Daemon {
   std::string name_;
   bool runWithRestart(MainLoopFunc loop);
 
-#ifdef _WIN32
-  bool running_;
-#else
-  static Daemon* instance_;
-  volatile bool running_;
-#endif
+  std::atomic<bool> running_;
 };
 
-#endif
+#endif

apps/desktop/src/app/main.cpp

@@ -0,0 +1,336 @@
+#ifdef _WIN32
+#ifdef CROSSDESK_DEBUG
+#pragma comment(linker, "/subsystem:\"console\"")
+#else
+#pragma comment(linker, "/subsystem:\"windows\" /entry:\"mainCRTStartup\"")
+#endif
+#endif
+
+#include <cstdlib>
+#include <cstring>
+#include <filesystem>
+#include <iostream>
+#include <memory>
+#include <string>
+
+#ifdef _WIN32
+#include <cstdio>
+
+#include "platform/windows/gui/slint_backend.h"
+#include "service_host.h"
+#endif
+
+#include "config_center.h"
+#include "daemon.h"
+#include "path_manager.h"
+#include "platform/single_instance.h"
+#include "rd_log.h"
+#include "render.h"
+
+#ifdef __linux__
+#include "SimpleIni.h"
+#include "platform/linux/headless/headless_console.h"
+#include "platform/linux/headless/headless_session.h"
+#include "platform/linux/privacy/privacy_guard.h"
+#endif
+
+#ifdef _WIN32
+namespace {
+
+void EnsureConsoleForCli() {
+  static bool console_ready = false;
+  if (console_ready) {
+    return;
+  }
+
+  if (!AttachConsole(ATTACH_PARENT_PROCESS)) {
+    DWORD error = GetLastError();
+    if (error != ERROR_ACCESS_DENIED) {
+      AllocConsole();
+    }
+  }
+
+  FILE* stream = nullptr;
+  freopen_s(&stream, "CONOUT$", "w", stdout);
+  freopen_s(&stream, "CONOUT$", "w", stderr);
+  freopen_s(&stream, "CONIN$", "r", stdin);
+  SetConsoleOutputCP(CP_UTF8);
+  console_ready = true;
+}
+
+void PrintServiceCliUsage() {
+  std::cout
+      << "CrossDesk service management commands\n"
+      << "  --service-install    Install the sibling crossdesk_service.exe\n"
+      << "  --service-uninstall  Remove the installed Windows service\n"
+      << "  --service-start      Start the Windows service\n"
+      << "  --service-stop       Stop the Windows service\n"
+      << "  --service-sas        Ask the service to send Secure Attention "
+         "Sequence\n"
+      << "  --service-ping       Ping the service over named pipe IPC\n"
+      << "  --service-status     Query service runtime status\n"
+      << "  --service-help       Show this help\n";
+}
+
+std::wstring GetCurrentExecutablePathW() {
+  wchar_t path[MAX_PATH] = {0};
+  DWORD length = GetModuleFileNameW(nullptr, path, MAX_PATH);
+  if (length == 0 || length >= MAX_PATH) {
+    return L"";
+  }
+  return std::wstring(path, length);
+}
+
+std::filesystem::path GetSiblingServiceExecutablePath() {
+  std::wstring current_executable = GetCurrentExecutablePathW();
+  if (current_executable.empty()) {
+    return {};
+  }
+
+  return std::filesystem::path(current_executable).parent_path() /
+         L"crossdesk_service.exe";
+}
+
+bool IsServiceCliCommand(const char* arg) {
+  if (arg == nullptr) {
+    return false;
+  }
+
+  return std::strcmp(arg, "--service-install") == 0 ||
+         std::strcmp(arg, "--service-uninstall") == 0 ||
+         std::strcmp(arg, "--service-start") == 0 ||
+         std::strcmp(arg, "--service-stop") == 0 ||
+         std::strcmp(arg, "--service-sas") == 0 ||
+         std::strcmp(arg, "--service-ping") == 0 ||
+         std::strcmp(arg, "--service-status") == 0 ||
+         std::strcmp(arg, "--service-help") == 0;
+}
+
+void TryStartManagedWindowsService() {
+  std::filesystem::path service_path = GetSiblingServiceExecutablePath();
+  if (service_path.empty() || !std::filesystem::exists(service_path)) {
+    return;
+  }
+
+  if (!crossdesk::IsCrossDeskServiceInstalled()) {
+    return;
+  }
+
+  crossdesk::StartCrossDeskService();
+}
+
+int HandleServiceCliCommand(const std::string& command) {
+  EnsureConsoleForCli();
+
+  if (command == "--service-help") {
+    PrintServiceCliUsage();
+    return 0;
+  }
+
+  if (command == "--service-install") {
+    std::filesystem::path service_path = GetSiblingServiceExecutablePath();
+    if (service_path.empty()) {
+      std::cerr << "Failed to locate crossdesk_service.exe" << std::endl;
+      return 1;
+    }
+    if (!std::filesystem::exists(service_path)) {
+      std::cerr << "Service binary not found: " << service_path.string()
+                << std::endl;
+      return 1;
+    }
+
+    bool success = crossdesk::InstallCrossDeskService(service_path.wstring());
+    std::cout << (success ? "install ok" : "install failed") << std::endl;
+    return success ? 0 : 1;
+  }
+
+  if (command == "--service-uninstall") {
+    bool success = crossdesk::UninstallCrossDeskService();
+    std::cout << (success ? "uninstall ok" : "uninstall failed") << std::endl;
+    return success ? 0 : 1;
+  }
+
+  if (command == "--service-start") {
+    bool success = crossdesk::StartCrossDeskService();
+    std::cout << (success ? "start ok" : "start failed") << std::endl;
+    return success ? 0 : 1;
+  }
+
+  if (command == "--service-stop") {
+    bool success = crossdesk::StopCrossDeskService();
+    std::cout << (success ? "stop ok" : "stop failed") << std::endl;
+    return success ? 0 : 1;
+  }
+
+  if (command == "--service-sas") {
+    std::cout << crossdesk::QueryCrossDeskService("sas") << std::endl;
+    return 0;
+  }
+
+  if (command == "--service-ping") {
+    std::cout << crossdesk::QueryCrossDeskService("ping") << std::endl;
+    return 0;
+  }
+
+  if (command == "--service-status") {
+    std::cout << crossdesk::QueryCrossDeskService("status") << std::endl;
+    return 0;
+  }
+
+  PrintServiceCliUsage();
+  return 1;
+}
+
+}  // namespace
+#endif
+
+static bool IsDaemonChild(int argc, char* argv[]) {
+  for (int i = 1; i < argc; ++i) {
+    if (std::strcmp(argv[i], "--child") == 0) return true;
+  }
+  return false;
+}
+
+static crossdesk::platform::InstanceResult AcquireInstance(
+    crossdesk::platform::SingleInstanceGuard& guard,
+    crossdesk::platform::InstanceRole role) {
+  std::string error;
+  const auto result = guard.TryAcquire(role, error);
+  if (result == crossdesk::platform::InstanceResult::kAlreadyRunning) {
+    std::cerr << "CrossDesk is already running for this user.\n";
+  } else if (result == crossdesk::platform::InstanceResult::kError) {
+    std::cerr << "CrossDesk cannot start: " << error << '\n';
+  }
+  return result;
+}
+
+static int RunApplication(
+    int argc, char* argv[],
+    crossdesk::platform::SingleInstanceGuard& client_instance) {
+  // The instance guards are held before any configuration or logger is opened.
+  auto path_manager = std::make_unique<crossdesk::PathManager>("CrossDesk");
+  crossdesk::InitLogger(path_manager->GetLogPath().string());
+
+  if (IsDaemonChild(argc, argv)) {
+    // child process: run render directly
+    crossdesk::Render render;
+    return render.Run();
+  }
+
+#ifdef _WIN32
+  TryStartManagedWindowsService();
+#endif
+
+  bool enable_daemon = false;
+  if (path_manager) {
+    std::string cache_path = path_manager->GetCachePath().string();
+    crossdesk::ConfigCenter config_center(cache_path + "/config.ini");
+    enable_daemon = config_center.IsEnableDaemon();
+  }
+
+#ifdef __linux__
+  // The headless supervisor owns the display and application lifetime. A
+  // detached daemon would outlive its display; systemd can restart the whole
+  // session instead.
+  if (std::getenv("CROSSDESK_HEADLESS_ACTIVE") ||
+      crossdesk::HeadlessConsole::Instance().active()) enable_daemon = false;
+#endif
+
+  if (enable_daemon) {
+    // The launcher lease stays in main for the supervisor's entire lifetime.
+    // Each --child must acquire its own client lease, so it is neither blocked
+    // by its supervisor nor able to bypass the single-client restriction.
+    client_instance.Release();
+    // start daemon with restart monitoring
+    Daemon daemon("CrossDesk");
+
+    // define main loop function: run render and stop daemon on normal exit
+    Daemon::MainLoopFunc main_loop = [&daemon, &client_instance]() {
+      // Executable discovery can fail and make the supervisor run the GUI in
+      // process. This fallback must retain the same client ownership rule.
+      if (AcquireInstance(client_instance,
+                          crossdesk::platform::InstanceRole::kClient) !=
+          crossdesk::platform::InstanceResult::kAcquired) {
+        daemon.stop();
+        return;
+      }
+      crossdesk::Render render;
+      render.Run();
+      daemon.stop();
+    };
+
+    // start daemon and return result
+    bool success = daemon.start(main_loop);
+    return success ? 0 : 1;
+  }
+
+  // run without daemon: direct execution
+  crossdesk::Render render;
+  return render.Run();
+}
+
+int main(int argc, char* argv[]) {
+#ifdef __linux__
+  // Run before GUI, configuration, logging or display initialization.
+  if (argc == 2 &&
+      std::strcmp(argv[1], crossdesk::kLinuxPrivacyGuardArgument) == 0) {
+    return crossdesk::RunLinuxPrivacyGuard();
+  }
+  auto& console = crossdesk::HeadlessConsole::Instance();
+  if (argc == 2 && std::strcmp(argv[1], "--headless-help") == 0) {
+    crossdesk::PathManager paths("CrossDesk");
+    CSimpleIniA config;
+    config.SetUnicode(true);
+    config.LoadFile((paths.GetCachePath() / "config.ini").string().c_str());
+    console.SetLanguage(static_cast<int>(config.GetLongValue("Settings", "language", 0)));
+    std::cout << console.Text("console_cli_help");
+    return 0;
+  }
+#endif
+#ifdef _WIN32
+  if (argc == 2 &&
+      std::strcmp(argv[1], crossdesk::kSlintRendererProbeArgument) == 0) {
+    return crossdesk::RunSlintRendererProbe();
+  }
+  if (argc > 1 && IsServiceCliCommand(argv[1])) {
+    EnsureConsoleForCli();
+    crossdesk::platform::SingleInstanceGuard cli_instance;
+    if (AcquireInstance(cli_instance, crossdesk::platform::InstanceRole::kServiceCli) !=
+        crossdesk::platform::InstanceResult::kAcquired) return 1;
+    crossdesk::PathManager paths("CrossDesk");
+    crossdesk::InitLogger(paths.GetLogPath().string(), "crossdesk-service-cli");
+    return HandleServiceCliCommand(argv[1]);
+  }
+#endif
+
+  using crossdesk::platform::InstanceResult;
+  using crossdesk::platform::InstanceRole;
+  crossdesk::platform::SingleInstanceGuard launcher_instance;
+  crossdesk::platform::SingleInstanceGuard client_instance;
+  if (!IsDaemonChild(argc, argv)) {
+    const auto result = AcquireInstance(launcher_instance, InstanceRole::kLauncher);
+    if (result != InstanceResult::kAcquired)
+      return result == InstanceResult::kAlreadyRunning ? 0 : 1;
+  }
+  const auto result = AcquireInstance(client_instance, InstanceRole::kClient);
+  if (result != InstanceResult::kAcquired)
+    return result == InstanceResult::kAlreadyRunning ? 0 : 1;
+
+#ifdef __linux__
+  const int exit_code = crossdesk::RunWithLinuxDisplay(
+      argc, argv, [&] { return RunApplication(argc, argv, client_instance); }, [&] {
+        crossdesk::PathManager paths("CrossDesk");
+        if (console.Enable(paths.GetLogPath(), paths.GetCachePath() / "config.ini")) return true;
+        std::cerr << "无法初始化日志或控制台，启动失败。\n";
+        return false;
+      });
+  if (console.active()) {
+    console.Notify(exit_code == 0 ? console.Text("console_exited")
+        : console.Text("console_stopped") + " " + std::to_string(exit_code) +
+          "; " + console.Text("console_log_file") + ": " + console.diagnostic_path());
+  }
+  return exit_code;
+#else
+  return RunApplication(argc, argv, client_instance);
+#endif
+}

apps/desktop/src/autostart/autostart.cpp

@@ -0,0 +1,21 @@
+#include "autostart.h"
+
+#include "platform/autostart_backend.h"
+
+namespace crossdesk {
+
+bool EnableAutostart(const std::string& app_name) {
+  const std::string executable_path = platform::GetAutostartExecutablePath();
+  return !executable_path.empty() &&
+         platform::EnableAutostart(app_name, executable_path);
+}
+
+bool DisableAutostart(const std::string& app_name) {
+  return platform::DisableAutostart(app_name);
+}
+
+bool IsAutostartEnabled(const std::string& app_name) {
+  return platform::IsAutostartEnabled(app_name);
+}
+
+}  // namespace crossdesk

apps/desktop/src/common/filesystem_utf8.h

@@ -0,0 +1,21 @@
+#ifndef CROSSDESK_COMMON_FILESYSTEM_UTF8_H_
+#define CROSSDESK_COMMON_FILESYSTEM_UTF8_H_
+
+#include <filesystem>
+#include <string>
+#include <string_view>
+
+namespace crossdesk {
+
+inline std::filesystem::path PathFromUtf8(std::string_view value) {
+#if defined(__cpp_char8_t)
+  const auto *begin = reinterpret_cast<const char8_t *>(value.data());
+  return std::filesystem::path(std::u8string(begin, begin + value.size()));
+#else
+  return std::filesystem::u8path(value.begin(), value.end());
+#endif
+}
+
+} // namespace crossdesk
+
+#endif // CROSSDESK_COMMON_FILESYSTEM_UTF8_H_

apps/desktop/src/common/nv12_scaler.cpp

@@ -0,0 +1,62 @@
+#include "nv12_scaler.h"
+
+#include <cstddef>
+#include <limits>
+
+#include "libyuv/planar_functions.h"
+
+namespace crossdesk {
+
+int ScaleNv12ViaI420(const uint8_t* src_y, int src_stride_y,
+                     const uint8_t* src_uv, int src_stride_uv, int src_width,
+                     int src_height, uint8_t* dst_y, int dst_stride_y,
+                     uint8_t* dst_uv, int dst_stride_uv, int dst_width,
+                     int dst_height, libyuv::FilterMode filtering,
+                     std::vector<uint8_t>* scratch_buffer) {
+  if (!src_y || !src_uv || !dst_y || !dst_uv || !scratch_buffer ||
+      src_width <= 0 || src_height <= 0 || dst_width <= 0 || dst_height <= 0 ||
+      (src_width & 1) != 0 || (src_height & 1) != 0 || (dst_width & 1) != 0 ||
+      (dst_height & 1) != 0) {
+    return -1;
+  }
+
+  const int src_chroma_width = src_width / 2;
+  const int src_chroma_height = src_height / 2;
+  const int dst_chroma_width = dst_width / 2;
+  const int dst_chroma_height = dst_height / 2;
+  const size_t src_chroma_size =
+      static_cast<size_t>(src_chroma_width) * src_chroma_height;
+  const size_t dst_chroma_size =
+      static_cast<size_t>(dst_chroma_width) * dst_chroma_height;
+  const size_t max_size = std::numeric_limits<size_t>::max();
+  if (src_chroma_size > max_size / 2 || dst_chroma_size > max_size / 2) {
+    return -1;
+  }
+
+  const size_t src_planes_size = 2 * src_chroma_size;
+  const size_t dst_planes_size = 2 * dst_chroma_size;
+  if (src_planes_size > max_size - dst_planes_size) {
+    return -1;
+  }
+  scratch_buffer->resize(src_planes_size + dst_planes_size);
+  uint8_t* src_u = scratch_buffer->data();
+  uint8_t* src_v = src_u + src_chroma_size;
+  uint8_t* dst_u = src_v + src_chroma_size;
+  uint8_t* dst_v = dst_u + dst_chroma_size;
+
+  libyuv::SplitUVPlane(src_uv, src_stride_uv, src_u, src_chroma_width, src_v,
+                       src_chroma_width, src_chroma_width, src_chroma_height);
+  const int result = libyuv::I420Scale(
+      src_y, src_stride_y, src_u, src_chroma_width, src_v, src_chroma_width,
+      src_width, src_height, dst_y, dst_stride_y, dst_u, dst_chroma_width,
+      dst_v, dst_chroma_width, dst_width, dst_height, filtering);
+  if (result != 0) {
+    return result;
+  }
+
+  libyuv::MergeUVPlane(dst_u, dst_chroma_width, dst_v, dst_chroma_width, dst_uv,
+                       dst_stride_uv, dst_chroma_width, dst_chroma_height);
+  return 0;
+}
+
+}  // namespace crossdesk

apps/desktop/src/common/nv12_scaler.h

@@ -0,0 +1,23 @@
+#ifndef CROSSDESK_COMMON_NV12_SCALER_H_
+#define CROSSDESK_COMMON_NV12_SCALER_H_
+
+#include <cstdint>
+#include <vector>
+
+#include "libyuv/scale.h"
+
+namespace crossdesk {
+
+// Scales NV12 by separating the interleaved chroma plane before filtering.
+// This avoids the downward chroma rounding bias in libyuv::NV12Scale while
+// preserving the requested filtering quality.
+int ScaleNv12ViaI420(const uint8_t* src_y, int src_stride_y,
+                     const uint8_t* src_uv, int src_stride_uv, int src_width,
+                     int src_height, uint8_t* dst_y, int dst_stride_y,
+                     uint8_t* dst_uv, int dst_stride_uv, int dst_width,
+                     int dst_height, libyuv::FilterMode filtering,
+                     std::vector<uint8_t>* scratch_buffer);
+
+}  // namespace crossdesk
+
+#endif  // CROSSDESK_COMMON_NV12_SCALER_H_

apps/desktop/src/common/platform.h

@@ -7,12 +7,13 @@
 #ifndef _PLATFORM_H_
 #define _PLATFORM_H_
 
-#include <iostream>
+#include <string>
 
 namespace crossdesk {
 
 std::string GetMac();
 std::string GetHostName();
+bool IsWaylandSession();
 
 }  // namespace crossdesk
-#endif
+#endif

apps/desktop/src/common/shared_cursor_state.cpp

@@ -0,0 +1,44 @@
+#include "shared_cursor_state.h"
+
+#include <remote_action.h>
+
+#include <mutex>
+
+namespace crossdesk {
+namespace {
+
+std::mutex g_cursor_state_mutex;
+SharedCursorState g_cursor_state;
+bool g_cursor_state_available = false;
+
+}  // namespace
+
+void PublishSharedCursorState(bool visible, RemoteCursorShape shape) {
+  std::lock_guard<std::mutex> lock(g_cursor_state_mutex);
+  ++g_cursor_state.generation;
+  g_cursor_state.visible = visible;
+  g_cursor_state.shape = visible ? shape : RemoteCursorShape::none;
+  g_cursor_state_available = true;
+}
+
+bool GetSharedCursorState(SharedCursorState* state) {
+  if (!state) {
+    return false;
+  }
+  std::lock_guard<std::mutex> lock(g_cursor_state_mutex);
+  if (!g_cursor_state_available) {
+    return false;
+  }
+  *state = g_cursor_state;
+  return true;
+}
+
+void ClearSharedCursorState() {
+  std::lock_guard<std::mutex> lock(g_cursor_state_mutex);
+  ++g_cursor_state.generation;
+  g_cursor_state.visible = false;
+  g_cursor_state.shape = RemoteCursorShape::none;
+  g_cursor_state_available = false;
+}
+
+}  // namespace crossdesk

apps/desktop/src/common/shared_cursor_state.h

@@ -0,0 +1,22 @@
+#ifndef CROSSDESK_COMMON_SHARED_CURSOR_STATE_H_
+#define CROSSDESK_COMMON_SHARED_CURSOR_STATE_H_
+
+#include <cstdint>
+
+#include <remote_cursor_shape.h>
+
+namespace crossdesk {
+
+struct SharedCursorState {
+  uint64_t generation = 0;
+  bool visible = false;
+  RemoteCursorShape shape = RemoteCursorShape::default_cursor;
+};
+
+void PublishSharedCursorState(bool visible, RemoteCursorShape shape);
+bool GetSharedCursorState(SharedCursorState* state);
+void ClearSharedCursorState();
+
+}  // namespace crossdesk
+
+#endif  // CROSSDESK_COMMON_SHARED_CURSOR_STATE_H_

apps/desktop/src/common/task_queue_lock_free.cpp

@@ -0,0 +1,88 @@
+#include "task_queue_lock_free.h"
+
+#include <concurrentqueue.h>
+
+#include <exception>
+#include <new>
+#include <stdexcept>
+#include <utility>
+
+namespace crossdesk {
+
+struct TaskQueueLockFree::QueueStorage {
+  moodycamel::ConcurrentQueue<TaskItem> tasks;
+  // All submissions share one producer so different caller threads keep FIFO.
+  moodycamel::ProducerToken producer{tasks};
+};
+
+TaskQueueLockFree::TaskQueueLockFree()
+    : queue_(std::make_unique<QueueStorage>()),
+      worker_([this] { WorkerThread(); }) {}
+
+TaskQueueLockFree::~TaskQueueLockFree() { Stop(); }
+
+std::future<void> TaskQueueLockFree::PostTask(std::function<void()> task) {
+  TaskItem item;
+  item.run = std::move(task);
+  auto result = item.completion.get_future();
+  {
+    std::lock_guard lock(mutex_);
+    if (stopping_) {
+      throw std::runtime_error("Cannot post to a stopped task queue");
+    }
+
+    // Count before publishing: the worker may dequeue as soon as enqueue returns.
+    ++pending_tasks_;
+    if (!queue_->tasks.enqueue(queue_->producer, std::move(item))) {
+      --pending_tasks_;
+      throw std::bad_alloc();
+    }
+  }
+  wake_.notify_one();
+  return result;
+}
+
+void TaskQueueLockFree::Stop() {
+  // Concurrent Stop callers all wait for the same worker shutdown to finish.
+  std::call_once(stop_once_, [this] {
+    {
+      std::lock_guard lock(mutex_);
+      stopping_ = true;
+    }
+    wake_.notify_all();
+    worker_.join();
+  });
+}
+
+void TaskQueueLockFree::WorkerThread() {
+  while (true) {
+    TaskItem item;
+    while (queue_->tasks.try_dequeue(item)) {
+      --pending_tasks_;
+
+      std::exception_ptr error;
+      try {
+        item.run();
+      } catch (...) {
+        error = std::current_exception();
+      }
+
+      // Release captured resources before marking the task complete.
+      item.run = nullptr;
+      if (error) {
+        item.completion.set_exception(error);
+      } else {
+        item.completion.set_value();
+      }
+    }
+
+    std::unique_lock lock(mutex_);
+    wake_.wait(lock, [this] { return stopping_ || pending_tasks_ > 0; });
+    // A stop request must not discard tasks submitted while the worker was idle.
+    if (stopping_ && pending_tasks_ == 0) {
+      return;
+    }
+  }
+}
+
+}  // namespace crossdesk

apps/desktop/src/common/task_queue_lock_free.h

@@ -0,0 +1,55 @@
+/*
+ * @Author: DI JUNKUN
+ * @Date: 2026-09-07
+ * Copyright (c) 2026 by DI JUNKUN, All Rights Reserved.
+ */
+
+#ifndef _TASK_QUEUE_LOCK_FREE_H_
+#define _TASK_QUEUE_LOCK_FREE_H_
+
+#include <atomic>
+#include <condition_variable>
+#include <cstddef>
+#include <functional>
+#include <future>
+#include <memory>
+#include <mutex>
+#include <thread>
+
+namespace crossdesk {
+
+// A single worker executes tasks in submission order. The concurrent queue
+// stores tasks; a mutex coordinates submissions, worker wakeups and shutdown.
+class TaskQueueLockFree {
+ public:
+  TaskQueueLockFree();
+  ~TaskQueueLockFree();
+
+  // Returns completion or the task's exception. Throws if the queue is stopped.
+  std::future<void> PostTask(std::function<void()> task);
+
+  // Rejects new tasks, finishes accepted tasks and joins the worker.
+  // May be called repeatedly, but never from the queue's own tasks.
+  void Stop();
+
+ private:
+  struct TaskItem {
+    std::function<void()> run;
+    std::promise<void> completion;
+  };
+
+  void WorkerThread();
+
+  struct QueueStorage;
+  std::unique_ptr<QueueStorage> queue_;
+  std::atomic<std::size_t> pending_tasks_{0};
+  std::mutex mutex_;
+  std::condition_variable wake_;
+  bool stopping_ = false;
+  std::once_flag stop_once_;
+  std::thread worker_;
+};
+
+}  // namespace crossdesk
+
+#endif

apps/desktop/src/config_center/config_center.cpp

@@ -0,0 +1,455 @@
+#include "config_center.h"
+
+#include <algorithm>
+#include <chrono>
+#include <cstring>
+#include <filesystem>
+#include <optional>
+#include <vector>
+
+#include "SimpleIni.h"
+#include "autostart.h"
+#include "rd_log.h"
+
+namespace crossdesk {
+
+struct ConfigCenter::IniStorage : CSimpleIniA {};
+
+namespace {
+
+bool IsValidTurnModeValue(long value) {
+  return value >= static_cast<long>(ConfigCenter::TURN_MODE::DISABLED) &&
+         value <= static_cast<long>(ConfigCenter::TURN_MODE::FORCE_TCP);
+}
+
+}  // namespace
+
+ConfigCenter::ConfigCenter(const std::string& config_path)
+    : config_path_(config_path), ini_(std::make_unique<IniStorage>()) {
+  ini_->SetUnicode(true);
+  Load();
+}
+
+ConfigCenter::~ConfigCenter() {}
+
+int ConfigCenter::Load() {
+  SI_Error rc = ini_->LoadFile(config_path_.c_str());
+  if (rc < 0) {
+    Save();
+    return -1;
+  }
+
+  bool persist_config_migration = false;
+  // These options now belong only to the active remote connection. Discard
+  // legacy local defaults so they cannot affect this host or new connections.
+  persist_config_migration |= ini_->Delete(section_, "video_quality");
+  persist_config_migration |= ini_->Delete(section_, "video_frame_rate");
+  persist_config_migration |= ini_->Delete(section_, "video_adaptation_policy");
+  persist_config_migration |= ini_->Delete(section_, "video_content_type");
+  persist_config_migration |= ini_->Delete(section_, "screen_content");
+  persist_config_migration |=
+      ini_->Delete(section_, "enable_desktop_quality_optimization");
+  persist_config_migration |=
+      ini_->Delete(section_, "enable_minimize_to_tray");
+
+  const long language_value =
+      ini_->GetLongValue(section_, "language", static_cast<long>(language_));
+  if (language_value < static_cast<long>(LANGUAGE::CHINESE) ||
+      language_value > static_cast<long>(LANGUAGE::RUSSIAN)) {
+    language_ = LANGUAGE::ENGLISH;
+  } else {
+    language_ = static_cast<LANGUAGE>(language_value);
+  }
+
+  const long screen_capture_method_value = ini_->GetLongValue(
+      section_, "screen_capture_method",
+      static_cast<long>(ScreenCaptureMethod::Auto));
+  screen_capture_method_ = IsValidScreenCaptureMethod(screen_capture_method_value)
+                               ? static_cast<ScreenCaptureMethod>(
+                                     screen_capture_method_value)
+                               : ScreenCaptureMethod::Auto;
+
+  video_encode_format_ = static_cast<VIDEO_ENCODE_FORMAT>(
+      ini_->GetLongValue(section_, "video_encode_format",
+                        static_cast<long>(video_encode_format_)));
+
+  hardware_video_codec_ = ini_->GetBoolValue(section_, "hardware_video_codec",
+                                            hardware_video_codec_);
+  const char* turn_mode_value = ini_->GetValue(section_, "turn_mode", nullptr);
+  if (turn_mode_value != nullptr && strlen(turn_mode_value) > 0) {
+    const long parsed_turn_mode = ini_->GetLongValue(
+        section_, "turn_mode", static_cast<long>(turn_mode_));
+    if (IsValidTurnModeValue(parsed_turn_mode)) {
+      turn_mode_ = static_cast<TURN_MODE>(parsed_turn_mode);
+    } else {
+      LOG_WARN("Invalid TURN mode [{}], using auto UDP/TCP",
+               parsed_turn_mode);
+      turn_mode_ = TURN_MODE::AUTO_UDP_TCP;
+    }
+  } else {
+    const bool legacy_enable_turn = ini_->GetBoolValue(
+        section_, "enable_turn", turn_mode_ != TURN_MODE::DISABLED);
+    turn_mode_ = legacy_enable_turn ? TURN_MODE::AUTO_UDP_TCP
+                                    : TURN_MODE::DISABLED;
+    ini_->SetLongValue(section_, "turn_mode", static_cast<long>(turn_mode_));
+    persist_config_migration = true;
+  }
+  // Migrate the former user switch. Keep true in the file for older builds,
+  // while the current application always requests encrypted native media.
+  if (!ini_->GetBoolValue(section_, "enable_srtp", false)) {
+    ini_->SetBoolValue(section_, "enable_srtp", true);
+    persist_config_migration = true;
+  }
+  enable_self_hosted_ =
+      ini_->GetBoolValue(section_, "enable_self_hosted", enable_self_hosted_);
+
+  const char* signal_server_host_value =
+      ini_->GetValue(section_, "signal_server_host", nullptr);
+  if (signal_server_host_value != nullptr &&
+      strlen(signal_server_host_value) > 0) {
+    signal_server_host_ = signal_server_host_value;
+  } else {
+    signal_server_host_ = "";
+  }
+  const char* signal_server_port_value =
+      ini_->GetValue(section_, "signal_server_port", nullptr);
+  if (signal_server_port_value != nullptr &&
+      strlen(signal_server_port_value) > 0) {
+    signal_server_port_ =
+        static_cast<int>(ini_->GetLongValue(section_, "signal_server_port", 0));
+  } else {
+    signal_server_port_ = 0;
+  }
+  enable_autostart_ =
+      ini_->GetBoolValue(section_, "enable_autostart", enable_autostart_);
+  enable_daemon_ = ini_->GetBoolValue(section_, "enable_daemon", enable_daemon_);
+  enable_privacy_screen_.store(
+      ini_->GetBoolValue(section_, "enable_privacy_screen", true));
+  save_remote_previews_.store(
+      ini_->GetBoolValue(section_, "save_remote_previews", true));
+  portable_service_prompt_suppressed_ =
+      ini_->GetBoolValue(section_, "portable_service_prompt_suppressed",
+                        portable_service_prompt_suppressed_);
+
+  const char* file_transfer_save_path_value =
+      ini_->GetValue(section_, "file_transfer_save_path", nullptr);
+  if (file_transfer_save_path_value != nullptr &&
+      strlen(file_transfer_save_path_value) > 0) {
+    file_transfer_save_path_ = file_transfer_save_path_value;
+  } else {
+    file_transfer_save_path_ = "";
+  }
+
+  if (persist_config_migration && CommitIni() < 0) {
+    return -1;
+  }
+
+  return 0;
+}
+
+int ConfigCenter::CommitIni() {
+  // Write beside the destination and rename only after a complete save. A
+  // failed write must not truncate the last usable configuration.
+  static std::atomic<unsigned long> sequence{0};
+  const std::string temporary = config_path_ + ".tmp-" +
+      std::to_string(std::chrono::steady_clock::now().time_since_epoch().count()) +
+      "-" + std::to_string(sequence++);
+  std::error_code error;
+  if (ini_->SaveFile(temporary.c_str()) < 0) {
+    LOG_ERROR("Failed to write configuration: {}", config_path_);
+    std::filesystem::remove(temporary, error);
+    return -1;
+  }
+  const auto previous = std::filesystem::status(config_path_, error);
+  if (!error && std::filesystem::is_regular_file(previous)) {
+    std::filesystem::permissions(temporary, previous.permissions(), error);
+    if (error) {
+      LOG_ERROR("Failed to preserve configuration permissions: {}", error.message());
+      std::filesystem::remove(temporary, error);
+      return -1;
+    }
+  }
+  std::filesystem::rename(temporary, config_path_, error);
+  if (!error) return 0;
+  LOG_ERROR("Failed to replace configuration {}: {}", config_path_, error.message());
+  std::filesystem::remove(temporary, error);
+  return -1;
+}
+
+int ConfigCenter::StoreValues(
+    std::initializer_list<std::pair<const char*, std::string>> values) {
+  std::vector<std::pair<const char*, std::optional<std::string>>> previous;
+  for (const auto& value : values) {
+    const char* old = ini_->GetValue(section_, value.first, nullptr);
+    previous.emplace_back(value.first, old ? std::optional<std::string>(old) : std::nullopt);
+    ini_->SetValue(section_, value.first, value.second.c_str());
+  }
+  if (CommitIni() == 0) return 0;
+  for (const auto& value : previous) {
+    if (value.second) ini_->SetValue(section_, value.first, value.second->c_str());
+    else ini_->Delete(section_, value.first);
+  }
+  return -1;
+}
+
+int ConfigCenter::Save() {
+  ini_->SetLongValue(section_, "language", static_cast<long>(language_));
+  ini_->SetLongValue(section_, "screen_capture_method",
+                    static_cast<long>(screen_capture_method_));
+  ini_->SetLongValue(section_, "video_encode_format",
+                    static_cast<long>(video_encode_format_));
+  ini_->SetBoolValue(section_, "hardware_video_codec", hardware_video_codec_);
+  ini_->SetLongValue(section_, "turn_mode", static_cast<long>(turn_mode_));
+  ini_->SetBoolValue(section_, "enable_turn",
+                    turn_mode_ != TURN_MODE::DISABLED);
+  ini_->SetBoolValue(section_, "enable_srtp", true);
+  ini_->SetBoolValue(section_, "enable_self_hosted", enable_self_hosted_);
+
+  // only save when self hosted
+  if (enable_self_hosted_) {
+    ini_->SetValue(section_, "signal_server_host", signal_server_host_.c_str());
+    ini_->SetLongValue(section_, "signal_server_port",
+                      static_cast<long>(signal_server_port_));
+  }
+
+  ini_->SetBoolValue(section_, "enable_autostart", enable_autostart_);
+  ini_->SetBoolValue(section_, "enable_daemon", enable_daemon_);
+  ini_->SetBoolValue(section_, "enable_privacy_screen",
+                    enable_privacy_screen_.load());
+  ini_->SetBoolValue(section_, "save_remote_previews",
+                    save_remote_previews_.load());
+  ini_->SetBoolValue(section_, "portable_service_prompt_suppressed",
+                    portable_service_prompt_suppressed_);
+
+  ini_->SetValue(section_, "file_transfer_save_path",
+                file_transfer_save_path_.c_str());
+
+  SI_Error rc = CommitIni();
+  if (rc < 0) {
+    return -1;
+  }
+
+  return 0;
+}
+
+// setters
+
+int ConfigCenter::SetLanguage(LANGUAGE language) {
+  const int value = static_cast<int>(language);
+  if (value < 0 || value > 2 || StoreValues({{"language", std::to_string(value)}}) != 0) return -1;
+  language_ = language;
+  return 0;
+}
+
+int ConfigCenter::SetScreenCaptureMethod(ScreenCaptureMethod method) {
+  if (!IsValidScreenCaptureMethod(static_cast<long>(method))) {
+    return -1;
+  }
+  ini_->SetLongValue(section_, "screen_capture_method", static_cast<long>(method));
+  if (CommitIni() < 0) {
+    ini_->SetLongValue(section_, "screen_capture_method",
+                      static_cast<long>(screen_capture_method_));
+    return -1;
+  }
+  screen_capture_method_ = method;
+  return 0;
+}
+
+int ConfigCenter::SetVideoEncodeFormat(VIDEO_ENCODE_FORMAT format) {
+  if (format != VIDEO_ENCODE_FORMAT::H264 && format != VIDEO_ENCODE_FORMAT::AV1) return -1;
+  if (StoreValues({{"video_encode_format", std::to_string(static_cast<int>(format))}}) != 0) return -1;
+  video_encode_format_ = format;
+  return 0;
+}
+
+int ConfigCenter::SetHardwareVideoCodec(bool enabled) {
+  if (enabled && !IsHardwareVideoCodecAvailable()) return -1;
+  if (StoreValues({{"hardware_video_codec", enabled ? "true" : "false"}}) != 0) return -1;
+  hardware_video_codec_ = enabled;
+  return 0;
+}
+
+int ConfigCenter::SetTurnMode(TURN_MODE mode) {
+  if (!IsValidTurnModeValue(static_cast<long>(mode))) return -1;
+  if (StoreValues({{"turn_mode", std::to_string(static_cast<int>(mode))},
+                   {"enable_turn", mode == TURN_MODE::DISABLED ? "false" : "true"}}) != 0) return -1;
+  turn_mode_ = mode;
+  return 0;
+}
+
+int ConfigCenter::SetTurn(bool enable_turn, bool force_relay) {
+  if (!enable_turn) {
+    return SetTurnMode(TURN_MODE::DISABLED);
+  }
+  if (!force_relay) {
+    return SetTurnMode(TURN_MODE::AUTO_UDP_TCP);
+  }
+  // Use TURN/UDP by default, preserving an explicitly configured TCP relay.
+  return SetTurnMode(turn_mode_ == TURN_MODE::FORCE_TCP ? TURN_MODE::FORCE_TCP
+                                                     : TURN_MODE::FORCE_UDP);
+}
+
+int ConfigCenter::SetServerHost(const std::string& host) {
+  if (host.empty() || host.size() > 253 || host.find_first_of("/\\@?#") != std::string::npos ||
+      std::any_of(host.begin(), host.end(), [](unsigned char c) { return c <= 32 || c == 127; })) return -1;
+  if (StoreValues({{"signal_server_host", host}}) != 0) return -1;
+  signal_server_host_ = host;
+  return 0;
+}
+
+int ConfigCenter::SetServerPort(int port) {
+  if (port < 1 || port > 65535 || StoreValues({{"signal_server_port", std::to_string(port)}}) != 0) return -1;
+  signal_server_port_ = port;
+  return 0;
+}
+
+int ConfigCenter::SetSelfHosted(bool enabled) {
+  if (enabled && (signal_server_host_.empty() || signal_server_port_ < 1 || signal_server_port_ > 65535)) return -1;
+  if (StoreValues({{"enable_self_hosted", enabled ? "true" : "false"}}) != 0) return -1;
+  enable_self_hosted_ = enabled;
+  return 0;
+}
+
+int ConfigCenter::SetAutostart(bool enabled) {
+  const bool previous = IsAutostartEnabled("CrossDesk");
+  if (enabled != previous && !(enabled ? EnableAutostart("CrossDesk") : DisableAutostart("CrossDesk"))) {
+    LOG_ERROR("SetAutostart failed");
+    return -1;
+  }
+  if (StoreValues({{"enable_autostart", enabled ? "true" : "false"}}) != 0) {
+    if (enabled != previous) {
+      if (previous) EnableAutostart("CrossDesk");
+      else DisableAutostart("CrossDesk");
+    }
+    return -1;
+  }
+  enable_autostart_ = enabled;
+  return 0;
+}
+
+int ConfigCenter::SetDaemon(bool enabled) {
+  if (StoreValues({{"enable_daemon", enabled ? "true" : "false"}}) != 0) return -1;
+  enable_daemon_ = enabled;
+  return 0;
+}
+
+int ConfigCenter::SetPrivacyScreen(bool enable_privacy_screen) {
+  const bool previous = enable_privacy_screen_.load();
+  if (previous == enable_privacy_screen) return 0;
+  ini_->SetBoolValue(section_, "enable_privacy_screen", enable_privacy_screen);
+  if (CommitIni() < 0) {
+    ini_->SetBoolValue(section_, "enable_privacy_screen", previous);
+    LOG_ERROR("Failed to save automatic privacy screen preference");
+    return -1;
+  }
+  // RTC callbacks read only the value committed by the settings thread.
+  enable_privacy_screen_.store(enable_privacy_screen);
+  LOG_INFO("Privacy screen on incoming connection: {}", enable_privacy_screen);
+  return 0;
+}
+
+int ConfigCenter::SetSaveRemotePreviews(bool enabled) {
+  if (StoreValues({{"save_remote_previews", enabled ? "true" : "false"}}) != 0) {
+    return -1;
+  }
+  save_remote_previews_.store(enabled);
+  return 0;
+}
+
+bool ConfigCenter::IsSaveRemotePreviews() const {
+  return save_remote_previews_.load();
+}
+
+int ConfigCenter::SetPortableServicePromptSuppressed(bool suppressed) {
+  portable_service_prompt_suppressed_ = suppressed;
+  ini_->SetBoolValue(section_, "portable_service_prompt_suppressed",
+                    portable_service_prompt_suppressed_);
+  SI_Error rc = CommitIni();
+  if (rc < 0) {
+    return -1;
+  }
+
+  return 0;
+}
+
+// getters
+
+ConfigCenter::LANGUAGE ConfigCenter::GetLanguage() const { return language_; }
+
+ScreenCaptureMethod ConfigCenter::GetScreenCaptureMethod() const {
+  return screen_capture_method_;
+}
+
+ConfigCenter::VIDEO_ENCODE_FORMAT ConfigCenter::GetVideoEncodeFormat() const {
+  return video_encode_format_;
+}
+
+bool ConfigCenter::IsHardwareVideoCodecAvailable() {
+#if (((defined(_WIN32) || defined(__linux__)) && !defined(__aarch64__) && \
+      !defined(__arm__) && USE_CUDA) ||                                   \
+     defined(__APPLE__))
+  return true;
+#else
+  return false;
+#endif
+}
+
+bool ConfigCenter::IsHardwareVideoCodec() const {
+  return IsHardwareVideoCodecAvailable() && hardware_video_codec_;
+}
+
+ConfigCenter::TURN_MODE ConfigCenter::GetTurnMode() const {
+  return turn_mode_;
+}
+
+bool ConfigCenter::IsEnableTurn() const {
+  return turn_mode_ != TURN_MODE::DISABLED;
+}
+
+bool ConfigCenter::IsForceRelay() const {
+  return turn_mode_ == TURN_MODE::FORCE_UDP || turn_mode_ == TURN_MODE::FORCE_TCP;
+}
+
+bool ConfigCenter::IsEnableSrtp() const { return true; }
+
+std::string ConfigCenter::GetSignalServerHost() const {
+  return signal_server_host_;
+}
+
+int ConfigCenter::GetSignalServerPort() const { return signal_server_port_; }
+
+std::string ConfigCenter::GetDefaultServerHost() const {
+  return signal_server_host_default_;
+}
+
+int ConfigCenter::GetDefaultSignalServerPort() const {
+  return server_port_default_;
+}
+
+bool ConfigCenter::IsSelfHosted() const { return enable_self_hosted_; }
+
+bool ConfigCenter::IsEnableAutostart() const { return enable_autostart_; }
+
+bool ConfigCenter::IsEnableDaemon() const { return enable_daemon_; }
+
+bool ConfigCenter::IsEnablePrivacyScreen() const {
+  return enable_privacy_screen_.load();
+}
+
+bool ConfigCenter::IsPortableServicePromptSuppressed() const {
+  return portable_service_prompt_suppressed_;
+}
+
+int ConfigCenter::SetFileTransferSavePath(const std::string& path) {
+  if (path.size() >= 512 || std::any_of(path.begin(), path.end(), [](unsigned char c) { return c < 32 || c == 127; })) return -1;
+  std::lock_guard<std::mutex> lock(file_path_mutex_);
+  if (StoreValues({{"file_transfer_save_path", path}}) != 0) return -1;
+  file_transfer_save_path_ = path;
+  return 0;
+}
+
+std::string ConfigCenter::GetFileTransferSavePath() const {
+  std::lock_guard<std::mutex> lock(file_path_mutex_);
+  return file_transfer_save_path_;
+}
+}  // namespace crossdesk

apps/desktop/src/config_center/config_center.h

@@ -7,18 +7,27 @@
 #ifndef _CONFIG_CENTER_H_
 #define _CONFIG_CENTER_H_
 
+#include <atomic>
+#include <initializer_list>
+#include <memory>
+#include <mutex>
+#include <utility>
 #include <string>
 
-#include "SimpleIni.h"
+#include "screen_capturer/screen_capture_method.h"
 
 namespace crossdesk {
 
 class ConfigCenter {
  public:
-  enum class LANGUAGE { CHINESE = 0, ENGLISH = 1 };
-  enum class VIDEO_QUALITY { LOW = 0, MEDIUM = 1, HIGH = 2 };
-  enum class VIDEO_FRAME_RATE { FPS_30 = 0, FPS_60 = 1 };
+  enum class LANGUAGE { CHINESE = 0, ENGLISH = 1, RUSSIAN = 2 };
   enum class VIDEO_ENCODE_FORMAT { H264 = 0, AV1 = 1 };
+  enum class TURN_MODE {
+    DISABLED = 0,
+    AUTO_UDP_TCP = 1,
+    FORCE_UDP = 2,
+    FORCE_TCP = 3
+  };
 
  public:
   explicit ConfigCenter(const std::string& config_path = "config.ini");
@@ -26,68 +35,73 @@ class ConfigCenter {
 
   // write config
   int SetLanguage(LANGUAGE language);
-  int SetVideoQuality(VIDEO_QUALITY video_quality);
-  int SetVideoFrameRate(VIDEO_FRAME_RATE video_frame_rate);
+  int SetScreenCaptureMethod(ScreenCaptureMethod method);
   int SetVideoEncodeFormat(VIDEO_ENCODE_FORMAT video_encode_format);
   int SetHardwareVideoCodec(bool hardware_video_codec);
-  int SetTurn(bool enable_turn);
-  int SetSrtp(bool enable_srtp);
+  int SetTurnMode(TURN_MODE turn_mode);
+  int SetTurn(bool enable_turn, bool force_relay);
   int SetServerHost(const std::string& signal_server_host);
   int SetServerPort(int signal_server_port);
-  int SetCoturnServerPort(int coturn_server_port);
   int SetSelfHosted(bool enable_self_hosted);
-  int SetMinimizeToTray(bool enable_minimize_to_tray);
   int SetAutostart(bool enable_autostart);
   int SetDaemon(bool enable_daemon);
+  int SetPrivacyScreen(bool enable_privacy_screen);
+  int SetSaveRemotePreviews(bool enabled);
+  int SetPortableServicePromptSuppressed(bool suppressed);
   int SetFileTransferSavePath(const std::string& path);
 
   // read config
 
   LANGUAGE GetLanguage() const;
-  VIDEO_QUALITY GetVideoQuality() const;
-  VIDEO_FRAME_RATE GetVideoFrameRate() const;
+  ScreenCaptureMethod GetScreenCaptureMethod() const;
   VIDEO_ENCODE_FORMAT GetVideoEncodeFormat() const;
+  // Whether this build includes a hardware video codec backend.
+  static bool IsHardwareVideoCodecAvailable();
   bool IsHardwareVideoCodec() const;
+  TURN_MODE GetTurnMode() const;
   bool IsEnableTurn() const;
+  bool IsForceRelay() const;
   bool IsEnableSrtp() const;
   std::string GetSignalServerHost() const;
   int GetSignalServerPort() const;
-  int GetCoturnServerPort() const;
   std::string GetDefaultServerHost() const;
   int GetDefaultSignalServerPort() const;
-  int GetDefaultCoturnServerPort() const;
   bool IsSelfHosted() const;
-  bool IsMinimizeToTray() const;
   bool IsEnableAutostart() const;
   bool IsEnableDaemon() const;
+  bool IsEnablePrivacyScreen() const;
+  bool IsSaveRemotePreviews() const;
+  bool IsPortableServicePromptSuppressed() const;
   std::string GetFileTransferSavePath() const;
 
   int Load();
   int Save();
 
  private:
+  int CommitIni();
+  int StoreValues(std::initializer_list<std::pair<const char*, std::string>> values);
+  mutable std::mutex file_path_mutex_;
   std::string config_path_;
-  CSimpleIniA ini_;
+  struct IniStorage;
+  std::unique_ptr<IniStorage> ini_;
   const char* section_ = "Settings";
 
   LANGUAGE language_ = LANGUAGE::CHINESE;
-  VIDEO_QUALITY video_quality_ = VIDEO_QUALITY::HIGH;
-  VIDEO_FRAME_RATE video_frame_rate_ = VIDEO_FRAME_RATE::FPS_60;
+  ScreenCaptureMethod screen_capture_method_ = ScreenCaptureMethod::Auto;
   VIDEO_ENCODE_FORMAT video_encode_format_ = VIDEO_ENCODE_FORMAT::H264;
   bool hardware_video_codec_ = false;
-  bool enable_turn_ = true;
-  bool enable_srtp_ = false;
+  TURN_MODE turn_mode_ = TURN_MODE::AUTO_UDP_TCP;
   std::string signal_server_host_ = "";
   std::string signal_server_host_default_ = "api.crossdesk.cn";
   int signal_server_port_ = 0;
   int server_port_default_ = 9099;
-  int coturn_server_port_ = 0;
-  int coturn_server_port_default_ = 3478;
   bool enable_self_hosted_ = false;
-  bool enable_minimize_to_tray_ = false;
   bool enable_autostart_ = false;
   bool enable_daemon_ = false;
+  std::atomic<bool> enable_privacy_screen_{true};
+  std::atomic<bool> save_remote_previews_{true};
+  bool portable_service_prompt_suppressed_ = false;
   std::string file_transfer_save_path_ = "";
 };
 }  // namespace crossdesk
-#endif
+#endif

apps/desktop/src/device_controller/device_controller.h

@@ -0,0 +1,55 @@
+/*
+ * @Author: DI JUNKUN
+ * @Date: 2023-12-14
+ * Copyright (c) 2023 by DI JUNKUN, All Rights Reserved.
+ */
+
+#ifndef _DEVICE_CONTROLLER_H_
+#define _DEVICE_CONTROLLER_H_
+
+#include <cstdint>
+#include <vector>
+
+#include <remote_action.h>
+
+#include "display_info.h"
+
+namespace crossdesk {
+
+// int key_code, bool is_down, uint32_t scan_code, bool extended
+using OnKeyAction = void (*)(int, bool, uint32_t, bool, void*);
+
+class DeviceController {
+ public:
+  virtual ~DeviceController() = default;
+};
+
+class MouseController : public DeviceController {
+ public:
+  ~MouseController() override = default;
+
+  virtual int Init(std::vector<DisplayInfo> display_info_list) = 0;
+  virtual int Destroy() = 0;
+  virtual int SendMouseCommand(RemoteAction remote_action,
+                               int display_index) = 0;
+  virtual void UpdateDisplayInfoList(
+      const std::vector<DisplayInfo>&) {}
+};
+
+class KeyboardCapturer : public DeviceController {
+ public:
+  ~KeyboardCapturer() override = default;
+
+  virtual int Hook(OnKeyAction on_key_action, void* user_ptr) = 0;
+  virtual int Unhook() = 0;
+  // Backends with an asynchronous capture loop override this so the UI can
+  // fall back to window events if that loop stops unexpectedly.
+  virtual bool IsHookActive() const { return true; }
+  virtual int SendKeyboardCommand(int key_code, bool is_down,
+                                  uint32_t scan_code = 0,
+                                  bool extended = false) = 0;
+};
+
+}  // namespace crossdesk
+
+#endif

apps/desktop/src/device_controller/device_controller_factory.h

@@ -8,8 +8,6 @@
 #define _DEVICE_CONTROLLER_FACTORY_H_
 
 #include "device_controller.h"
-#include "keyboard_capturer.h"
-#include "mouse_controller.h"
 
 namespace crossdesk {
 
@@ -21,16 +19,7 @@ class DeviceControllerFactory {
   virtual ~DeviceControllerFactory() {}
 
  public:
-  DeviceController* Create(Device device) {
-    switch (device) {
-      case Mouse:
-        return new MouseController();
-      case Keyboard:
-        return new KeyboardCapturer();
-      default:
-        return nullptr;
-    }
-  }
+  DeviceController* Create(Device device);
 };
 }  // namespace crossdesk
-#endif
+#endif

apps/desktop/src/device_controller/keyboard_converter.h

@@ -73,13 +73,13 @@ std::map<int, int> vkCodeToCGKeyCode = {
     {0x20, 0x31},  // Space
     {0x08, 0x33},  // Backspace
     {0x09, 0x30},  // Tab
-    {0x2C, 0x74},  // Print Screen
+    {0x2C, 0x69},  // Print Screen(F13)
     {0x2D, 0x72},  // Insert
     {0x2E, 0x75},  // Delete
     {0x24, 0x73},  // Home
     {0x23, 0x77},  // End
-    {0x21, 0x79},  // Page Up
-    {0x22, 0x7A},  // Page Down
+    {0x21, 0x74},  // Page Up
+    {0x22, 0x79},  // Page Down
 
     // arrow keys
     {0x25, 0x7B},  // Left Arrow
@@ -98,6 +98,7 @@ std::map<int, int> vkCodeToCGKeyCode = {
     {0x67, 0x59},  // Numpad 7
     {0x68, 0x5B},  // Numpad 8
     {0x69, 0x5C},  // Numpad 9
+    {0x90, 0x47},  // Num Lock / Keypad Clear
     {0x6E, 0x41},  // Numpad .
     {0x6F, 0x4B},  // Numpad /
     {0x6A, 0x43},  // Numpad *
@@ -191,13 +192,13 @@ std::map<int, int> CGKeyCodeToVkCode = {
     {0x31, 0x20},  // Space
     {0x33, 0x08},  // Backspace
     {0x30, 0x09},  // Tab
-    {0x74, 0x2C},  // Print Screen
+    {0x69, 0x2C},  // Print Screen(F13)
     {0x72, 0x2D},  // Insert
     {0x75, 0x2E},  // Delete
     {0x73, 0x24},  // Home
     {0x77, 0x23},  // End
-    {0x79, 0x21},  // Page Up
-    {0x7A, 0x22},  // Page Down
+    {0x74, 0x21},  // Page Up
+    {0x79, 0x22},  // Page Down
 
     // arrow keys
     {0x7B, 0x25},  // Left Arrow
@@ -216,6 +217,7 @@ std::map<int, int> CGKeyCodeToVkCode = {
     {0x59, 0x67},  // Numpad 7
     {0x5B, 0x68},  // Numpad 8
     {0x5C, 0x69},  // Numpad 9
+    {0x47, 0x90},  // Num Lock / Keypad Clear
     {0x41, 0x6E},  // Numpad .
     {0x4B, 0x6F},  // Numpad /
     {0x43, 0x6A},  // Numpad *
@@ -326,21 +328,22 @@ std::map<int, int> vkCodeToX11KeySym = {
     {0x28, 0xFF54},  // Down Arrow
 
     // numpad
-    {0x60, 0x0030},  // Numpad 0
-    {0x61, 0x0031},  // Numpad 1
-    {0x62, 0x0032},  // Numpad 2
-    {0x63, 0x0033},  // Numpad 3
-    {0x64, 0x0034},  // Numpad 4
-    {0x65, 0x0035},  // Numpad 5
-    {0x66, 0x0036},  // Numpad 6
-    {0x67, 0x0037},  // Numpad 7
-    {0x68, 0x0038},  // Numpad 8
-    {0x69, 0x0039},  // Numpad 9
-    {0x6E, 0x003A},  // Numpad .
-    {0x6F, 0x002F},  // Numpad /
-    {0x6A, 0x002A},  // Numpad *
-    {0x6D, 0x002D},  // Numpad -
-    {0x6B, 0x002B},  // Numpad +
+    {0x60, 0xFFB0},  // Numpad 0
+    {0x61, 0xFFB1},  // Numpad 1
+    {0x62, 0xFFB2},  // Numpad 2
+    {0x63, 0xFFB3},  // Numpad 3
+    {0x64, 0xFFB4},  // Numpad 4
+    {0x65, 0xFFB5},  // Numpad 5
+    {0x66, 0xFFB6},  // Numpad 6
+    {0x67, 0xFFB7},  // Numpad 7
+    {0x68, 0xFFB8},  // Numpad 8
+    {0x69, 0xFFB9},  // Numpad 9
+    {0x90, 0xFF7F},  // Num Lock
+    {0x6E, 0xFFAE},  // Numpad .
+    {0x6F, 0xFFAF},  // Numpad /
+    {0x6A, 0xFFAA},  // Numpad *
+    {0x6D, 0xFFAD},  // Numpad -
+    {0x6B, 0xFFAB},  // Numpad +
 
     // symbol keys
     {0xBA, 0x003B},  // ; (Semicolon)
@@ -454,21 +457,22 @@ std::map<int, int> x11KeySymToVkCode = {
     {0xFF54, 0x28},  // Down Arrow
 
     // numpad
-    {0x0030, 0x60},  // Numpad 0
-    {0x0031, 0x61},  // Numpad 1
-    {0x0032, 0x62},  // Numpad 2
-    {0x0033, 0x63},  // Numpad 3
-    {0x0034, 0x64},  // Numpad 4
-    {0x0035, 0x65},  // Numpad 5
-    {0x0036, 0x66},  // Numpad 6
-    {0x0037, 0x67},  // Numpad 7
-    {0x0038, 0x68},  // Numpad 8
-    {0x0039, 0x69},  // Numpad 9
-    {0x003A, 0x6E},  // Numpad .
-    {0x002F, 0x6F},  // Numpad /
-    {0x002A, 0x6A},  // Numpad *
-    {0x002D, 0x6D},  // Numpad -
-    {0x002B, 0x6B},  // Numpad +
+    {0xFFB0, 0x60},  // Numpad 0
+    {0xFFB1, 0x61},  // Numpad 1
+    {0xFFB2, 0x62},  // Numpad 2
+    {0xFFB3, 0x63},  // Numpad 3
+    {0xFFB4, 0x64},  // Numpad 4
+    {0xFFB5, 0x65},  // Numpad 5
+    {0xFFB6, 0x66},  // Numpad 6
+    {0xFFB7, 0x67},  // Numpad 7
+    {0xFFB8, 0x68},  // Numpad 8
+    {0xFFB9, 0x69},  // Numpad 9
+    {0xFF7F, 0x90},  // Num Lock
+    {0xFFAE, 0x6E},  // Numpad .
+    {0xFFAF, 0x6F},  // Numpad /
+    {0xFFAA, 0x6A},  // Numpad *
+    {0xFFAD, 0x6D},  // Numpad -
+    {0xFFAB, 0x6B},  // Numpad +
 
     // symbol keys
     {0x003B, 0xBA},  // ; (Semicolon)
@@ -557,13 +561,13 @@ std::map<int, int> cgKeyCodeToX11KeySym = {
     {0x31, 0x0020},  // Space
     {0x33, 0xFF08},  // Backspace
     {0x30, 0xFF09},  // Tab
-    {0x74, 0xFF15},  // Print Screen
+    {0x69, 0xFF15},  // Print Screen(F13)
     {0x72, 0xFF63},  // Insert
     {0x75, 0xFFFF},  // Delete
     {0x73, 0xFF50},  // Home
     {0x77, 0xFF57},  // End
-    {0x79, 0xFF55},  // Page Up
-    {0x7A, 0xFF56},  // Page Down
+    {0x74, 0xFF55},  // Page Up
+    {0x79, 0xFF56},  // Page Down
 
     // arrow keys
     {0x7B, 0xFF51},  // Left Arrow
@@ -572,21 +576,22 @@ std::map<int, int> cgKeyCodeToX11KeySym = {
     {0x7D, 0xFF54},  // Down Arrow
 
     // numpad
-    {0x52, 0x0030},  // Numpad 0
-    {0x53, 0x0031},  // Numpad 1
-    {0x54, 0x0032},  // Numpad 2
-    {0x55, 0x0033},  // Numpad 3
-    {0x56, 0x0034},  // Numpad 4
-    {0x57, 0x0035},  // Numpad 5
-    {0x58, 0x0036},  // Numpad 6
-    {0x59, 0x0037},  // Numpad 7
-    {0x5B, 0x0038},  // Numpad 8
-    {0x5C, 0x0039},  // Numpad 9
-    {0x41, 0x003A},  // Numpad .
-    {0x4B, 0x002F},  // Numpad /
-    {0x43, 0x002A},  // Numpad *
-    {0x4E, 0x002D},  // Numpad -
-    {0x45, 0x002B},  // Numpad +
+    {0x52, 0xFFB0},  // Numpad 0
+    {0x53, 0xFFB1},  // Numpad 1
+    {0x54, 0xFFB2},  // Numpad 2
+    {0x55, 0xFFB3},  // Numpad 3
+    {0x56, 0xFFB4},  // Numpad 4
+    {0x57, 0xFFB5},  // Numpad 5
+    {0x58, 0xFFB6},  // Numpad 6
+    {0x59, 0xFFB7},  // Numpad 7
+    {0x5B, 0xFFB8},  // Numpad 8
+    {0x5C, 0xFFB9},  // Numpad 9
+    {0x47, 0xFF7F},  // Num Lock / Keypad Clear
+    {0x41, 0xFFAE},  // Numpad .
+    {0x4B, 0xFFAF},  // Numpad /
+    {0x43, 0xFFAA},  // Numpad *
+    {0x4E, 0xFFAD},  // Numpad -
+    {0x45, 0xFFAB},  // Numpad +
 
     // symbol keys
     {0x29, 0x003B},  // ; (Semicolon)
@@ -683,13 +688,13 @@ std::map<int, int> x11KeySymToCgKeyCode = {
     {0x0020, 0x31},  // Space
     {0xFF08, 0x33},  // Backspace
     {0xFF09, 0x30},  // Tab
-    {0xFF15, 0x74},  // Print Screen
+    {0xFF15, 0x69},  // Print Screen(F13)
     {0xFF63, 0x72},  // Insert
     {0xFFFF, 0x75},  // Delete
     {0xFF50, 0x73},  // Home
     {0xFF57, 0x77},  // End
-    {0xFF55, 0x79},  // Page Up
-    {0xFF56, 0x7A},  // Page Down
+    {0xFF55, 0x74},  // Page Up
+    {0xFF56, 0x79},  // Page Down
 
     // arrow keys
     {0xFF51, 0x7B},  // Left Arrow
@@ -698,21 +703,22 @@ std::map<int, int> x11KeySymToCgKeyCode = {
     {0xFF54, 0x7D},  // Down Arrow
 
     // numpad
-    {0x0030, 0x52},  // Numpad 0
-    {0x0031, 0x53},  // Numpad 1
-    {0x0032, 0x54},  // Numpad 2
-    {0x0033, 0x55},  // Numpad 3
-    {0x0034, 0x56},  // Numpad 4
-    {0x0035, 0x57},  // Numpad 5
-    {0x0036, 0x58},  // Numpad 6
-    {0x0037, 0x59},  // Numpad 7
-    {0x0038, 0x5B},  // Numpad 8
-    {0x0039, 0x5C},  // Numpad 9
-    {0x003A, 0x41},  // Numpad .
-    {0x002F, 0x4B},  // Numpad /
-    {0x002A, 0x43},  // Numpad *
-    {0x002D, 0x4E},  // Numpad -
-    {0x002B, 0x45},  // Numpad +
+    {0xFFB0, 0x52},  // Numpad 0
+    {0xFFB1, 0x53},  // Numpad 1
+    {0xFFB2, 0x54},  // Numpad 2
+    {0xFFB3, 0x55},  // Numpad 3
+    {0xFFB4, 0x56},  // Numpad 4
+    {0xFFB5, 0x57},  // Numpad 5
+    {0xFFB6, 0x58},  // Numpad 6
+    {0xFFB7, 0x59},  // Numpad 7
+    {0xFFB8, 0x5B},  // Numpad 8
+    {0xFFB9, 0x5C},  // Numpad 9
+    {0xFF7F, 0x47},  // Num Lock / Keypad Clear
+    {0xFFAE, 0x41},  // Numpad .
+    {0xFFAF, 0x4B},  // Numpad /
+    {0xFFAA, 0x43},  // Numpad *
+    {0xFFAD, 0x4E},  // Numpad -
+    {0xFFAB, 0x45},  // Numpad +
 
     // symbol keys
     {0x003B, 0x29},  // ; (Semicolon)
@@ -739,4 +745,4 @@ std::map<int, int> x11KeySymToCgKeyCode = {
     {0xFFEC, 0x36},  // Right Command
 };
 }  // namespace crossdesk
-#endif
+#endif

apps/desktop/src/gui/application/application_state.h

@@ -0,0 +1,98 @@
+/*
+ * @Author: DI JUNKUN
+ * @Date: 2026-09-04
+ * Copyright (c) 2026 by DI JUNKUN, All Rights Reserved.
+ */
+
+#ifndef _APPLICATION_STATE_H_
+#define _APPLICATION_STATE_H_
+
+#include <atomic>
+#include <chrono>
+#include <cstdint>
+#include <string>
+
+namespace crossdesk::gui_detail {
+
+struct MainWindowState {
+  bool exit_ = false;
+};
+
+// Application-global interaction flags that coordinate UI events with media
+// and remote-control devices.
+struct InteractionState {
+  bool start_mouse_controller_ = false;
+  bool mouse_controller_is_started_ = false;
+  bool start_screen_capturer_ = false;
+  bool screen_capturer_is_started_ = false;
+  bool start_keyboard_capturer_ = false;
+  bool keyboard_capturer_is_started_ = false;
+  bool keyboard_capturer_uses_window_events_ = false;
+  bool focus_on_stream_window_ = false;
+  bool audio_capture_ = false;
+  int screen_width_ = 1280;
+  int screen_height_ = 720;
+  int selected_display_ = 0;
+  char remote_id_display_[12] = "";
+  unsigned char audio_buffer_[720]{};
+  int audio_len_ = 0;
+  bool audio_buffer_fresh_ = false;
+  bool need_to_rejoin_ = false;
+  std::chrono::steady_clock::time_point last_rejoin_check_time_ =
+      std::chrono::steady_clock::now();
+  std::string controlled_remote_id_;
+  std::string focused_remote_id_;
+  std::string remote_client_id_;
+};
+
+struct UpdateState {
+  bool update_available_ = false;
+  std::string latest_version_;
+  std::string release_name_;
+  std::string release_notes_;
+  std::string release_date_;
+};
+
+struct StreamWindowState {
+  bool need_to_create_stream_window_ = false;
+  bool stream_window_created_ = false;
+  bool stream_window_inited_ = false;
+  bool control_mouse_ = false;
+};
+
+struct ServerWindowState {
+  // Transport callbacks run outside the UI thread. Keep the two lifecycle
+  // requests atomic so a disconnect cannot be lost while the Slint timer is
+  // deciding whether to create or destroy the controlled-side window.
+  std::atomic<bool> need_to_create_server_window_{false};
+  std::atomic<bool> need_to_destroy_server_window_{false};
+  bool server_window_created_ = false;
+  bool server_window_inited_ = false;
+  bool server_window_collapsed_ = false;
+};
+
+struct UiState {
+  bool password_validating_ = false;
+  uint32_t password_validating_time_ = 0;
+  bool rejoin_ = false;
+  bool show_password_ = true;
+  bool show_connection_status_window_ = false;
+  bool fullscreen_button_pressed_ = false;
+  bool is_client_mode_ = false;
+  bool is_server_mode_ = false;
+  bool reload_recent_connections_ = true;
+  bool show_offline_warning_window_ = false;
+  std::string offline_warning_text_;
+  bool re_enter_remote_id_ = false;
+};
+
+struct ApplicationState : MainWindowState,
+                          InteractionState,
+                          UpdateState,
+                          StreamWindowState,
+                          ServerWindowState,
+                          UiState {};
+
+}  // namespace crossdesk::gui_detail
+
+#endif

apps/desktop/src/gui/application/gui_application.h

@@ -0,0 +1,110 @@
+/*
+ * @Author: DI JUNKUN
+ * @Date: 2026-09-04
+ * Copyright (c) 2026 by DI JUNKUN, All Rights Reserved.
+ */
+
+#ifndef _GUI_APPLICATION_H_
+#define _GUI_APPLICATION_H_
+
+#include <chrono>
+#include <memory>
+#include <string>
+#include <unordered_map>
+
+#include <remote_action.h>
+
+#include "runtime/cursor_state_provider.h"
+#include "runtime/gui_runtime.h"
+
+namespace crossdesk {
+
+class UpdateChecker;
+
+// Slint application shell. GuiRuntime remains the owner of transport, media,
+// device, clipboard, transfer and settings behavior.
+class GuiApplication final : private GuiRuntime {
+public:
+  GuiApplication();
+  ~GuiApplication();
+
+  int Run();
+
+private:
+  struct SlintUi;
+  struct CursorDeliveryState {
+    CursorState last_sent{};
+    bool has_sent = false;
+    bool feedback_pending = false;
+    std::chrono::steady_clock::time_point last_sent_time{};
+  };
+
+  void InitializeLogger();
+  void InitializeSettings();
+  bool InitializeSDL();
+  void InitializeModules();
+  void InitializeUi();
+  void InitializeSystemTray();
+  bool MinimizeMainWindowToTray();
+  void BindMainCallbacks();
+  void BindStreamCallbacks();
+  void BindServerCallbacks();
+  void Tick();
+  void PollUpdateCheck();
+  void ShareLocalCursorState();
+  bool RequestPasswordChange(const std::string &password);
+  void HandlePasswordChangeResult();
+  void HandleCredentialRecovery();
+  void SyncMainWindow();
+  void SyncAnnouncements();
+  void SyncConnectionDialog();
+  void SyncPlatformDialogs();
+  void SyncStreamWindow();
+  void SyncStreamVideoFrame();
+  void ScheduleNextVideoFrame();
+  void ConfigureStreamVideoRenderer();
+  void SyncStreamKeyboardFocus();
+  void SetStreamKeyboardFocus(bool focused);
+  void SyncServerWindow();
+#if defined(__linux__) && !defined(__APPLE__)
+  void SyncXWaylandWindowActivation();
+#endif
+  void UpdateLocalization();
+  void ResetSettingsUi();
+  void SaveSettingsFromUi();
+  void ApplySettingsFromConfig(bool reconnect);
+#if _WIN32 && CROSSDESK_PORTABLE
+  void CheckPortableWindowsService();
+  void StartPortableWindowsServiceInstall();
+  void JoinPortableWindowsServiceInstallThread();
+#endif
+  void ConnectFromUi(const std::string &remote_id);
+  void SelectStreamTab(int index);
+  void ReorderStreamTab(int from, float drop_x, float tab_width);
+  void CloseStreamTab(const std::string &remote_id);
+  void SendPointerInput(int button, int kind, float x, float y);
+  void SendScrollInput(float delta_x, float delta_y, float x, float y);
+  void SendKeyInput(const std::string &text, bool pressed, bool control,
+                    bool alt, bool shift, bool meta);
+  void Cleanup();
+
+  std::shared_ptr<RemoteSession> SelectedSession();
+  std::string OpenFileDialog(const std::string &title);
+  bool OpenUrl(const std::string &url);
+
+  std::unique_ptr<SlintUi> ui_;
+  std::unique_ptr<UpdateChecker> update_checker_;
+  CursorStateProvider cursor_state_provider_;
+  std::unordered_map<std::string, CursorDeliveryState>
+      cursor_delivery_states_;
+  uint32_t cursor_state_sequence_ = 0;
+  std::chrono::steady_clock::time_point next_video_frame_time_{};
+#if defined(__linux__) && !defined(__APPLE__)
+  bool use_xwayland_gui_ = false;
+  bool use_x11_custom_titlebar_ = false;
+#endif
+};
+
+} // namespace crossdesk
+
+#endif

apps/desktop/src/gui/application/server_window_state.h

@@ -0,0 +1,36 @@
+/*
+ * @Author: DI JUNKUN
+ * @Date: 2026-09-04
+ * Copyright (c) 2026 by DI JUNKUN, All Rights Reserved.
+ */
+
+#ifndef _SERVER_WINDOW_STATE_H_
+#define _SERVER_WINDOW_STATE_H_
+
+#include <algorithm>
+#include <iterator>
+#include <string>
+#include <vector>
+
+namespace crossdesk::server_window_state {
+
+inline int ReconcileSelectedController(const std::vector<std::string>& ids,
+                                       std::string* selected_id) {
+  if (!selected_id) {
+    return 0;
+  }
+  if (ids.empty()) {
+    selected_id->clear();
+    return 0;
+  }
+
+  const auto selected = std::find(ids.begin(), ids.end(), *selected_id);
+  if (selected == ids.end()) {
+    *selected_id = ids.front();
+    return 0;
+  }
+  return static_cast<int>(std::distance(ids.begin(), selected));
+}
+} // namespace crossdesk::server_window_state
+
+#endif

apps/desktop/src/gui/application/window_geometry.h

@@ -0,0 +1,49 @@
+/*
+ * @Author: DI JUNKUN
+ * @Date: 2026-09-04
+ * Copyright (c) 2026 by DI JUNKUN, All Rights Reserved.
+ */
+
+#ifndef _WINDOW_GEOMETRY_H_
+#define _WINDOW_GEOMETRY_H_
+
+#include <algorithm>
+
+namespace crossdesk::window_geometry {
+
+struct PhysicalRect {
+  int x = 0;
+  int y = 0;
+  int width = 0;
+  int height = 0;
+};
+
+struct PhysicalSize {
+  int width = 0;
+  int height = 0;
+};
+
+struct PhysicalPosition {
+  int x = 0;
+  int y = 0;
+};
+
+constexpr PhysicalPosition CenteredPosition(const PhysicalRect& bounds,
+                                            const PhysicalSize& size) {
+  return {
+      bounds.x + (bounds.width - std::min(bounds.width, size.width)) / 2,
+      bounds.y + (bounds.height - std::min(bounds.height, size.height)) / 2,
+  };
+}
+
+constexpr PhysicalPosition BottomRightPosition(const PhysicalRect& bounds,
+                                               const PhysicalSize& size) {
+  return {
+      bounds.x + std::max(0, bounds.width - size.width),
+      bounds.y + std::max(0, bounds.height - size.height),
+  };
+}
+
+}  // namespace crossdesk::window_geometry
+
+#endif

apps/desktop/src/gui/assets/localization/localization.h

@@ -0,0 +1,194 @@
+/*
+ * @Author: DI JUNKUN
+ * @Date: 2024-05-29
+ * Copyright (c) 2024 by DI JUNKUN, All Rights Reserved.
+ */
+#ifndef _LOCALIZATION_H_
+#define _LOCALIZATION_H_
+
+#include <cstddef>
+#include <string>
+#include <unordered_map>
+#include <vector>
+
+#include "localization_data.h"
+
+#if _WIN32
+#include <Windows.h>
+#endif
+
+namespace crossdesk {
+namespace localization {
+
+struct LanguageOption {
+  std::string code;
+  std::string display_name;
+};
+
+class LocalizedString {
+ public:
+  constexpr explicit LocalizedString(const char* key) : key_(key) {}
+  const std::string& operator[](int language_index) const;
+
+ private:
+  const char* key_;
+};
+
+inline const std::vector<LanguageOption>& GetSupportedLanguages() {
+  static const std::vector<LanguageOption> kSupportedLanguages = {
+      {"zh-CN", reinterpret_cast<const char*>(u8"中文")},
+      {"en-US", "English"},
+      {"ru-RU", reinterpret_cast<const char*>(u8"Русский")}};
+  return kSupportedLanguages;
+}
+
+namespace detail {
+
+inline int ClampLanguageIndex(int language_index) {
+  if (language_index >= 0 &&
+      language_index < static_cast<int>(GetSupportedLanguages().size())) {
+    return language_index;
+  }
+  return 0;
+}
+
+using TranslationTable =
+    std::unordered_map<std::string,
+                       std::unordered_map<std::string, std::string>>;
+
+inline std::unordered_map<std::string, std::string> MakeLocalizedValues(
+    const TranslationRow& row) {
+  return {{"zh-CN", reinterpret_cast<const char*>(row.zh)},
+          {"en-US", reinterpret_cast<const char*>(row.en)},
+          {"ru-RU", reinterpret_cast<const char*>(row.ru)}};
+}
+
+inline TranslationTable BuildTranslationTable() {
+  TranslationTable table;
+  for (const auto& row : kTranslationRows) {
+    table[row.key] = MakeLocalizedValues(row);
+  }
+
+  return table;
+}
+
+inline const TranslationTable& GetTranslationTable() {
+  static const TranslationTable table = BuildTranslationTable();
+  return table;
+}
+
+inline const std::string& GetTranslatedText(const std::string& key,
+                                            int language_index) {
+  static const std::string kEmptyText = "";
+
+  const auto& table = GetTranslationTable();
+  const auto key_it = table.find(key);
+  if (key_it == table.end()) {
+    return kEmptyText;
+  }
+
+  const auto& localized_values = key_it->second;
+  const std::string& language_code =
+      GetSupportedLanguages()[ClampLanguageIndex(language_index)].code;
+
+  const auto exact_it = localized_values.find(language_code);
+  if (exact_it != localized_values.end()) {
+    return exact_it->second;
+  }
+
+  const auto english_it = localized_values.find("en-US");
+  if (english_it != localized_values.end()) {
+    return english_it->second;
+  }
+
+  const auto chinese_it = localized_values.find("zh-CN");
+  if (chinese_it != localized_values.end()) {
+    return chinese_it->second;
+  }
+
+  return kEmptyText;
+}
+
+}  // namespace detail
+
+inline const std::string& LocalizedString::operator[](
+    int language_index) const {
+  return detail::GetTranslatedText(key_, language_index);
+}
+
+inline std::string FormatDisplayLabel(size_t display_index,
+                                      const std::string& display_name,
+                                      int language_index) {
+  const std::string number = std::to_string(display_index + 1);
+  std::string label =
+      detail::GetTranslatedText("display_screen", language_index) + " " +
+      number;
+  const std::string fallback_name = "Display" + number;
+  if (!display_name.empty() && display_name != fallback_name) {
+    label += " (" + display_name + ")";
+  }
+  return label;
+}
+
+#define CROSSDESK_DECLARE_LOCALIZED_STRING(name, zh, en, ru) \
+  inline const LocalizedString name(#name);
+CROSSDESK_LOCALIZATION_ALL(CROSSDESK_DECLARE_LOCALIZED_STRING)
+#undef CROSSDESK_DECLARE_LOCALIZED_STRING
+
+#if _WIN32
+inline const wchar_t* GetWindowsLocalizedLabel(
+    int language_index, const char* key, const wchar_t* fallback,
+    std::vector<std::wstring>& cache) {
+  const int normalized_index = detail::ClampLanguageIndex(language_index);
+  std::wstring& cached_text = cache[normalized_index];
+  if (!cached_text.empty()) {
+    return cached_text.c_str();
+  }
+
+  const std::string& utf8_text =
+      detail::GetTranslatedText(key, normalized_index);
+  if (utf8_text.empty()) {
+    cached_text = fallback;
+    return cached_text.c_str();
+  }
+
+  int wide_length =
+      MultiByteToWideChar(CP_UTF8, 0, utf8_text.c_str(), -1, nullptr, 0);
+  if (wide_length <= 0) {
+    cached_text = fallback;
+    return cached_text.c_str();
+  }
+
+  cached_text.resize(static_cast<size_t>(wide_length));
+  if (MultiByteToWideChar(CP_UTF8, 0, utf8_text.c_str(), -1,
+                          cached_text.data(), wide_length) <= 0) {
+    cached_text = fallback;
+    return cached_text.c_str();
+  }
+  cached_text.pop_back();
+  return cached_text.c_str();
+}
+
+inline const wchar_t* GetShowMainWindowLabel(int language_index) {
+  static std::vector<std::wstring> cache(GetSupportedLanguages().size());
+  return GetWindowsLocalizedLabel(language_index, "show_main_window",
+                                  L"Show Main Window", cache);
+}
+
+inline const wchar_t* GetSettingsLabel(int language_index) {
+  static std::vector<std::wstring> cache(GetSupportedLanguages().size());
+  return GetWindowsLocalizedLabel(language_index, "settings", L"Settings",
+                                  cache);
+}
+
+inline const wchar_t* GetExitProgramLabel(int language_index) {
+  static std::vector<std::wstring> cache(GetSupportedLanguages().size());
+  return GetWindowsLocalizedLabel(language_index, "exit_program", L"Exit",
+                                  cache);
+}
+#endif
+
+}  // namespace localization
+}  // namespace crossdesk
+
+#endif

apps/desktop/src/gui/assets/localization/localization_data.h

@@ -0,0 +1,392 @@
+/*
+ * @Author: DI JUNKUN
+ * @Date: 2024-05-29
+ * Copyright (c) 2024 by DI JUNKUN, All Rights Reserved.
+ */
+#ifndef _LOCALIZATION_DATA_H_
+#define _LOCALIZATION_DATA_H_
+
+namespace crossdesk {
+namespace localization {
+
+namespace detail {
+
+struct TranslationRow {
+  const char* key;
+  const void* zh;
+  const void* en;
+  const void* ru;
+};
+
+// Single source of truth for all UI strings.
+#define CROSSDESK_LOCALIZATION_ALL(X)                                          \
+  X(messages, u8"消息", "Messages", u8"Сообщения") \
+  X(message_unread, u8"未读", "Unread", u8"Не прочитано") \
+  X(message_read, u8"已读", "Read", u8"Прочитано") \
+  X(message_empty, u8"暂无公告", "No announcements", u8"Нет объявлений") \
+  X(message_select, u8"选择公告查看详情", "Select an announcement to read", u8"Выберите объявление") \
+  X(message_loading, u8"正在加载…", "Loading…", u8"Загрузка…") \
+  X(message_read_save_error, u8"无法保存本地阅读状态，请重新打开公告重试。", "Unable to save reading status locally. Open the announcement again to retry.", u8"Не удалось сохранить статус чтения. Откройте объявление снова.") \
+  X(message_close, u8"关闭", "Close", u8"Закрыть") \
+  X(message_delete, u8"删除", "Delete", u8"Удалить") \
+  X(message_delete_title, u8"删除公告", "Delete announcement", u8"Удалить объявление") \
+  X(message_delete_confirmation, u8"删除这条公告？", "Delete this announcement?", u8"Удалить это объявление?") \
+  X(message_delete_error, u8"无法删除这条公告，请重试。", "Unable to delete this announcement. Please try again.", u8"Не удалось удалить объявление. Повторите попытку.") \
+  X(console_cli_help, u8"Linux 无头运行选项：\n  --headless                  自动选择已有桌面并启用控制台\n  --headless-display DISPLAY  高级：指定已有显示会话\n  --headless-size WIDTHxHEIGHT 新建虚拟屏幕；默认1920x1080，偶数尺寸320..8192\n  --headless-session EXECUTABLE 启动桌面环境（startxfce4；none 仅启动裸屏幕）\n  --no-headless               禁用自动回退\n正常启动会自动选择已有桌面，无需填写显示编号。控制台输入 settings 管理设置。\n", "Linux headless options:\n  --headless                  Select an existing desktop and enable the console\n  --headless-display DISPLAY  Advanced: override desktop selection\n  --headless-size WIDTHxHEIGHT New virtual display; default 1920x1080, even 320..8192\n  --headless-session EXECUTABLE Start a desktop (startxfce4; none for a bare display)\n  --no-headless               Disable automatic fallback\nNormal startup selects your existing desktop automatically. Enter settings in the console to configure it.\n", u8"Параметры запуска без монитора:\n  --headless                  Выбрать рабочий стол и включить консоль\n  --headless-display DISPLAY  Дополнительно: указать сеанс дисплея\n  --headless-size WIDTHxHEIGHT Новый виртуальный экран; 1920x1080 по умолчанию, чётные размеры 320..8192\n  --headless-session EXECUTABLE Запустить рабочий стол (startxfce4; none — только экран)\n  --no-headless               Отключить автоматический резервный запуск\nРабочий стол выбирается автоматически. Команда settings открывает настройки консоли.\n") \
+  X(console_title, u8"CrossDesk 无头控制台", "CrossDesk headless console", u8"Консоль CrossDesk") \
+  X(console_log_file, u8"日志文件", "Log file", u8"Файл журнала") \
+  X(console_help, u8"命令: status 查看ID/密码/状态；settings 设置；password 修改密码；random 随机密码；help 帮助；quit 退出", "Commands: status, settings, password, random, help, quit", u8"Команды: status, settings, password, random, help, quit") \
+  X(console_status, u8"状态", "Status", u8"Состояние") \
+  X(console_online, u8"在线", "Online", u8"В сети") \
+  X(console_offline, u8"未连接服务器", "Disconnected from server", u8"Нет подключения к серверу") \
+  X(console_id, u8"设备 ID", "Device ID", u8"ID устройства") \
+  X(console_password, u8"连接密码", "Connection password", u8"Пароль подключения") \
+  X(console_waiting, u8"等待分配", "Waiting for assignment", u8"Ожидание назначения") \
+  X(console_password_hidden, u8"（仅在交互终端显示）", "(shown only in an interactive terminal)", u8"(виден только в интерактивном терминале)") \
+  X(console_cancelled, u8"已取消修改。", "Change cancelled.", u8"Изменение отменено.") \
+  X(console_password_invalid, u8"密码必须是6位英文字母或数字，未提交修改。", "Password must be 6 ASCII letters or digits; no change submitted.", u8"Пароль должен содержать 6 латинских букв или цифр. Изменение не отправлено.") \
+  X(console_password_offline, u8"尚未连接服务器，暂时无法修改密码。", "Connect to the server before changing the password.", u8"Для смены пароля подключитесь к серверу.") \
+  X(console_password_prompt, u8"输入新密码（6位英文字母或数字；输入 cancel 取消）:", "New password (6 ASCII letters or digits; cancel to abort):", u8"Новый пароль (6 латинских букв или цифр; cancel — отмена):") \
+  X(console_quitting, u8"正在退出 CrossDesk……", "Exiting CrossDesk...", u8"Выход из CrossDesk...") \
+  X(console_unknown_command, u8"未知命令，输入 help 查看帮助。", "Unknown command. Enter help for commands.", u8"Неизвестная команда. Введите help для справки.") \
+  X(console_line_too_long, u8"命令过长，已忽略。", "Command too long; ignored.", u8"Команда слишком длинная и проигнорирована.") \
+  X(console_random_failed, u8"无法生成随机密码，请重试。", "Unable to generate a random password; try again.", u8"Не удалось создать случайный пароль. Повторите попытку.") \
+  X(console_password_pending, u8"密码修改正在处理中，请等待服务器确认。", "Password change pending; wait for server confirmation.", u8"Смена пароля выполняется. Дождитесь подтверждения сервера.") \
+  X(console_password_stage_failed, u8"无法保存密码修改记录，未提交修改。请检查日志。", "Unable to save password recovery record; no change submitted. Check the log.", u8"Не удалось сохранить запись восстановления пароля. Изменение не отправлено. Проверьте журнал.") \
+  X(console_password_send_failed, u8"发送密码修改请求失败，请等待连接恢复后重试。", "Failed to submit password change; retry after reconnection.", u8"Не удалось отправить запрос смены пароля. Повторите после подключения.") \
+  X(console_password_submitted, u8"已提交密码修改，正在等待服务器确认……", "Password change submitted; waiting for server confirmation...", u8"Запрос смены пароля отправлен. Ожидание подтверждения...") \
+  X(console_password_uncertain, u8"密码修改结果尚未确认，正在重新连接服务器核实。", "Password change not yet confirmed; reconnecting to verify.", u8"Смена пароля не подтверждена. Повторное подключение для проверки.") \
+  X(console_password_rejected, u8"服务器未接受密码修改，原密码保持不变。详情见日志。", "Server rejected the password change; the original password remains. See the log.", u8"Сервер отклонил смену пароля. Старый пароль сохранён. См. журнал.") \
+  X(console_password_confirmed, u8"服务器已确认密码修改，正在重新连接。", "Server confirmed the password change; reconnecting.", u8"Сервер подтвердил смену пароля. Повторное подключение.") \
+  X(console_password_recovered, u8"重新连接确认：新密码已生效。", "Reconnection confirmed: the new password is active.", u8"Повторное подключение подтвердило новый пароль.") \
+  X(console_password_retained, u8"重新连接确认：继续使用原密码。", "Reconnection confirmed: the original password remains active.", u8"Повторное подключение подтвердило прежний пароль.") \
+  X(console_exited, u8"CrossDesk 已退出。", "CrossDesk exited.", u8"CrossDesk завершён.") \
+  X(console_stopped, u8"CrossDesk 已停止，退出码", "CrossDesk stopped; exit code", u8"CrossDesk остановлен; код выхода") \
+  X(console_settings_title, u8"设置（修改后立即保存）", "Settings (each change is saved immediately)", u8"Настройки (изменения сохраняются сразу)") \
+  X(console_settings_prompt, u8"输入编号或选项名称修改；back 返回。也可使用 settings set 名称 值。", "Enter an item number or key; back to return. Shortcut: settings set KEY VALUE.", u8"Введите номер или имя параметра; back — назад. Команда: settings set KEY VALUE.") \
+  X(console_settings_value, u8"输入新值（cancel 取消）", "Enter a new value (cancel to abort)", u8"Введите новое значение (cancel — отмена)") \
+  X(console_settings_unavailable, u8"设置尚未初始化，请稍后重试。", "Settings are not ready; try again shortly.", u8"Настройки ещё не готовы. Повторите позже.") \
+  X(console_settings_invalid, u8"无效的选项或值，未保存。请按菜单列出的格式输入。", "Invalid setting or value; not saved. Use the format shown in the menu.", u8"Неверный параметр или значение. Ничего не сохранено. Используйте указанный формат.") \
+  X(console_settings_save_failed, u8"保存设置失败，原设置保持不变。请检查日志。", "Failed to save settings; the previous value is retained. Check the log.", u8"Не удалось сохранить настройки. Прежнее значение сохранено. Проверьте журнал.") \
+  X(console_settings_busy, u8"有远程会话或密码修改正在进行，暂时不能更改连接设置。", "Connection settings cannot change during a remote session or password change.", u8"Нельзя менять параметры подключения во время удалённого сеанса или смены пароля.") \
+  X(console_settings_saved, u8"已保存并生效。", "Saved and applied.", u8"Сохранено и применено.") \
+  X(console_settings_unchanged, u8"设置未改变。", "Setting unchanged.", u8"Настройка не изменилась.") \
+  X(console_settings_reconnect, u8"已保存，正在重新连接服务器。", "Saved; reconnecting to the server.", u8"Сохранено. Повторное подключение к серверу.") \
+  X(console_settings_next_connection, u8"已保存，将用于后续连接。", "Saved; applies to subsequent connections.", u8"Сохранено. Будет применено к следующим подключениям.") \
+  X(console_settings_next_file, u8"已保存，将用于后续接收的文件。", "Saved; applies to subsequently received files.", u8"Сохранено. Будет применено к следующим получаемым файлам.") \
+  X(console_settings_autostart, u8"已保存，在下次图形桌面登录时生效。", "Saved; applies at the next graphical desktop login.", u8"Сохранено. Будет применено при следующем входе в графический сеанс.") \
+  X(console_settings_daemon, u8"已保存，普通模式重启后生效；无头控制台仍保持前台运行。", "Saved for the next normal-mode start; the headless console stays in the foreground.", u8"Сохранено для следующего запуска в обычном режиме. Консоль остаётся на переднем плане.") \
+  X(console_settings_hardware_unavailable, u8"当前构建不支持硬件编解码，未保存。", "Hardware codecs are unavailable in this build; not saved.", u8"Аппаратные кодеки недоступны в этой сборке. Не сохранено.") \
+  X(console_settings_server_required, u8"请先设置有效的服务器地址和端口，再启用自托管。", "Set a valid server host and port before enabling self-hosting.", u8"Укажите адрес и порт сервера перед включением собственного сервера.") \
+  X(console_settings_path_invalid, u8"请选择已存在且可写的绝对目录路径；default 使用默认目录。", "Use an existing writable absolute directory, or default for the default location.", u8"Укажите существующий доступный для записи абсолютный путь к каталогу или default.") \
+  X(console_settings_readonly, u8"该选项由系统或控制端管理，不可在此修改。", "This option is managed by the system or controller and is read-only here.", u8"Этот параметр управляется системой или клиентом и здесь недоступен для изменения.") \
+  X(console_setting_language, u8"语言", "Language", u8"Язык") \
+  X(console_setting_codec, u8"视频编码", "Video codec", u8"Видеокодек") \
+  X(console_setting_hardware, u8"硬件编解码", "Hardware codecs", u8"Аппаратные кодеки") \
+  X(console_setting_turn, u8"中继模式", "TURN relay mode", u8"Режим ретрансляции TURN") \
+  X(console_setting_self_hosted, u8"自托管", "Self-hosted server", u8"Собственный сервер") \
+  X(console_setting_host, u8"服务器地址", "Server host", u8"Адрес сервера") \
+  X(console_setting_port, u8"信令端口", "Signaling port", u8"Порт сигнализации") \
+  X(console_setting_privacy, u8"连接时自动开启隐私屏", "Privacy screen on connection", u8"Приватный экран при подключении") \
+  X(console_setting_files, u8"文件保存目录", "Received file directory", u8"Каталог получаемых файлов") \
+  X(console_setting_autostart, u8"登录桌面时自启", "Start at desktop login", u8"Запуск при входе в систему") \
+  X(console_setting_daemon, u8"守护进程（无头控制台中不生效）", "Daemon (inactive in headless console)", u8"Фоновый режим (не действует в консоли)") \
+  X(save_remote_previews, u8"保存远程画面预览:", "Save remote screen previews:", u8"Сохранять превью экрана:") \
+  X(unknown_platform, u8"未知平台", "Unknown platform", u8"Неизвестная платформа") \
+  X(privacy_screen, u8"隐私屏", "Privacy screen", u8"Приватный экран") \
+  X(privacy_enable, u8"开启隐私屏", "Enable privacy screen", u8"Включить приватный экран") \
+  X(privacy_disable, u8"关闭隐私屏", "Disable privacy screen", u8"Выключить приватный экран") \
+  X(privacy_on, u8"隐私屏：已开启", "Privacy screen: on", u8"Приватный экран: включён") \
+  X(privacy_off, u8"隐私屏：已关闭", "Privacy screen: off", u8"Приватный экран: выключен") \
+  X(privacy_unsupported, u8"隐私屏：不可用", "Privacy screen: unavailable", u8"Приватный экран: недоступен") \
+  X(local_desktop, u8"本桌面", "Local Desktop", u8"Локальный рабочий стол")    \
+  X(local_id, u8"本机ID", "Local ID", u8"Локальный ID")                        \
+  X(local_id_copied_to_clipboard, u8"已复制到剪贴板", "Copied to clipboard",   \
+    u8"Скопировано в буфер обмена")                                            \
+  X(password, u8"密码", "Password", u8"Пароль")                                \
+  X(refresh_password, u8"刷新随机密码", "Refresh random password",            \
+    u8"Обновить случайный пароль")                                           \
+  X(max_password_len, u8"最大6个字符", "Max 6 chars", u8"Макс. 6 символов")    \
+  X(remote_desktop, u8"远程桌面", "Remote Desktop",                            \
+    u8"Удаленный рабочий стол")                                                \
+  X(device_name, u8"设备名称", "Device Name", u8"Имя устройства")             \
+  X(remote_id, u8"对端ID", "Remote ID", u8"Удаленный ID")                      \
+  X(connect, u8"连接", "Connect", u8"Подключиться")                            \
+  X(recent_connections, u8"近期连接", "Recent Connections",                    \
+    u8"Недавние подключения")                                                  \
+  X(disconnect, u8"断开连接", "Disconnect", u8"Отключить")                     \
+  X(select_display, u8"选择显示器", "Select Display", u8"Выбрать дисплей")     \
+  X(display_screen, u8"显示屏", "Display", u8"Экран")                        \
+  X(expand_control_bar, u8"展开控制栏", "Expand Control Bar",                  \
+    u8"Развернуть панель управления")                                          \
+  X(collapse_control_bar, u8"收起控制栏", "Collapse Control Bar",              \
+    u8"Свернуть панель управления")                                            \
+  X(fullscreen, u8"全屏", " Fullscreen", u8"Полный экран")                     \
+  X(show_net_traffic_stats, u8"显示网络状态", "Show Net Traffic Stats",        \
+    u8"Показать статистику трафика")                                           \
+  X(hide_net_traffic_stats, u8"隐藏网络状态", "Hide Net Traffic Stats",        \
+    u8"Скрыть статистику трафика")                                             \
+  X(video, u8"视频", "Video", u8"Видео")                                       \
+  X(audio, u8"音频", "Audio", u8"Аудио")                                       \
+  X(data, u8"数据", "Data", u8"Данные")                                        \
+  X(total, u8"总计", "Total", u8"Итого")                                       \
+  X(in, u8"输入", "In", u8"Вход")                                              \
+  X(out, u8"输出", "Out", u8"Выход")                                           \
+  X(loss_rate, u8"丢包率", "Loss Rate", u8"Потери пакетов")                    \
+  X(exit_fullscreen, u8"退出全屏", "Exit fullscreen",                          \
+    u8"Выйти из полноэкранного режима")                                        \
+  X(control_mouse, u8"控制鼠标", "Control Mouse", u8"Управление мышью")        \
+  X(release_mouse, u8"释放鼠标", "Release Mouse", u8"Освободить мышь")         \
+  X(audio_capture, u8"播放声音", "Audio Capture", u8"Воспроизведение звука")   \
+  X(mute, u8" 静音", " Mute", u8"Без звука")                                   \
+  X(send_shortcut, u8"发送组合键", "Send Shortcut", u8"Сочетания клавиш")      \
+  X(send_sas, u8"发送SAS", "Send SAS", u8"Отправить SAS")                      \
+  X(lock_remote, u8"锁定远端", "Lock Remote", u8"Заблокировать")               \
+  X(remote_password_box_visible, u8"远端密码框已出现",                         \
+    "Remote password box visible", u8"Окно ввода пароля видно")                \
+  X(remote_lock_screen_hint, u8"远端处于锁屏封面，可发送SAS",                  \
+    "Remote lock screen visible, send SAS",                                    \
+    u8"Видна блокировка, отправьте SAS")                                       \
+  X(remote_secure_desktop_active, u8"远端已进入安全桌面",                      \
+    "Remote secure desktop active", u8"Активен защищенный рабочий стол")       \
+  X(remote_service_unavailable, u8"远端Windows服务不可用",                     \
+    "Remote Windows service unavailable",                                      \
+    u8"Служба Windows на удаленной стороне недоступна")                        \
+  X(windows_service_setup_title, u8"安装 CrossDesk Service",                   \
+    "Install CrossDesk Service", u8"Установить CrossDesk Service")             \
+  X(windows_service_setup_message,                                             \
+    u8"为支持该设备在锁屏状态下被远程控制，需要以管理员权限安装 CrossDesk "    \
+    u8"Service。\n未安装该服务不影响 CrossDesk "                               \
+    u8"正常使用，仅无法在锁屏状态下控制本机。",                                \
+    "To support remote control of this device while it is locked, CrossDesk "  \
+    "Service must be installed with administrator permission.\nWithout this "  \
+    "service, CrossDesk still works normally; only lock-screen control of "    \
+    "this computer is unavailable.",                                           \
+    u8"Чтобы поддерживать удаленное управление этим устройством на экране "    \
+    u8"блокировки, необходимо установить CrossDesk Service с правами "         \
+    u8"администратора.\nБез этой службы CrossDesk продолжит работать "         \
+    u8"нормально; будет недоступно только управление этим компьютером на "     \
+    u8"экране блокировки.")                                                    \
+  X(install_windows_service, u8"安装", "Install", u8"Установить")              \
+  X(windows_service_settings_label, u8"锁屏控制服务:",                         \
+    "Lock Screen Service:", u8"Служба блокировки экрана:")                     \
+  X(windows_service_installed, u8"已安装", "Installed", u8"Установлена")       \
+  X(do_not_remind_again, u8"不再提醒", "Do not remind again",                  \
+    u8"Больше не напоминать")                                                  \
+  X(windows_service_prompt_suppressed_message,                                 \
+    u8"已不再提醒。后续如需启用锁屏状态下被远程控制，可在设置中点击“安装”。",  \
+    "You will not be reminded again. To enable remote control while locked "   \
+    "later, click Install in Settings.",                                       \
+    u8"Напоминание отключено. Чтобы позже включить удаленное управление на "   \
+    u8"экране блокировки, нажмите «Установить» в настройках.")                 \
+  X(installing_windows_service, u8"正在安装服务...", "Installing service...",  \
+    u8"Установка службы...")                                                   \
+  X(windows_service_install_success, u8"服务已安装并启动",                     \
+    "Service installed and started", u8"Служба установлена и запущена")        \
+  X(windows_service_install_failed,                                            \
+    u8"服务安装失败。请确认 "                                                  \
+    u8"CrossDesk.exe、crossdesk_service.exe、crossdesk_session_helper.exe "    \
+    u8"位于同一便携目录中，并在系统弹窗中允许管理员权限。",                    \
+    "Service installation failed. Make sure CrossDesk.exe, "                   \
+    "crossdesk_service.exe, and crossdesk_session_helper.exe are in the same " \
+    "portable folder, then approve the administrator prompt.",                 \
+    u8"Не удалось установить службу. Убедитесь, что CrossDesk.exe, "           \
+    u8"crossdesk_service.exe и crossdesk_session_helper.exe находятся в "      \
+    u8"одной папке портативной версии, затем подтвердите запрос прав "         \
+    u8"администратора.")                                                       \
+  X(remote_unlock_requires_secure_desktop,                                     \
+    u8"当前仍需要安全桌面专用采集/输入",                                       \
+    "Secure desktop capture/input is still required",                          \
+    u8"По-прежнему нужен отдельный захват/ввод для защищенного рабочего "      \
+    u8"стола")                                                                 \
+  X(settings, u8"设置", "Settings", u8"Настройки")                             \
+  X(language, u8"语言:", "Language:", u8"Язык:")                               \
+  X(screen_capture_method, u8"采集方式:", "Capture Method:",                  \
+    u8"Способ захвата:")                                                      \
+  X(screen_capture_method_auto, u8"自动", "Auto", u8"Авто")                 \
+  X(video_settings, u8"画面设置", "Video settings", u8"Настройки видео") \
+  X(remote_update_title, u8"被控端版本过低", "Remote device needs an update", u8"Версия на удалённом устройстве устарела") \
+  X(remote_update, u8"请升级到最新版本。", "Please update to the latest version.", u8"Обновите её до последней версии.") \
+  X(remote_update_dismiss, u8"知道了", "Got it", u8"Понятно") \
+  X(video_settings_pending, u8"正在应用…", "Applying…", u8"Применение…") \
+  X(video_settings_failed, u8"调整失败，请重试。", "Could not apply settings. Try again.", u8"Не удалось применить настройки. Повторите попытку.") \
+  X(video_settings_unavailable, u8"连接建立后可调整，需被控端支持。", "Available when connected to a supported remote device.", u8"Доступно при подключении к поддерживаемому устройству.") \
+  X(video_quality, u8"画面质量:", "Video Quality:", u8"Качество видео:")       \
+  X(video_frame_rate, u8"画面采集帧率:",                                       \
+    "Video Capture Frame Rate:", u8"Частота захвата видео:")                   \
+  X(video_adaptation_policy, u8"画面偏好:", "Video Preference:",              \
+    u8"Режим видео:")                                                           \
+  X(video_priority_frame_rate, u8"帧率优先", "Frame Rate",                   \
+    u8"Частота кадров")                                                         \
+  X(video_priority_quality, u8"画质优先", "Quality", u8"Качество")          \
+  X(video_priority_balanced, u8"平衡", "Balanced", u8"Баланс")              \
+  X(video_quality_high, u8"高", "High", u8"Высокое")                           \
+  X(video_quality_medium, u8"中", "Medium", u8"Среднее")                       \
+  X(video_quality_low, u8"低", "Low", u8"Низкое")                              \
+  X(video_encode_format, u8"视频编码格式:",                                    \
+    "Video Encode Format:", u8"Формат кодека видео:")                          \
+  X(av1, u8"AV1", "AV1", "AV1")                                                \
+  X(h264, u8"H.264", "H.264", "H.264")                                         \
+  X(enable_hardware_video_codec, u8"启用硬件编解码器:",                        \
+    "Enable Hardware Video Codec:", u8"Использовать аппаратный кодек:")        \
+  X(enable_turn, u8"启用中继服务:",                                            \
+    "Enable TURN Service:", u8"Включить TURN-сервис:")                         \
+  X(force_relay, u8"强制中继连接:", "Force Relay:", u8"Только через реле:")   \
+  X(self_hosted_server_config, u8"自托管配置", "Self-Hosted Config",           \
+    u8"Конфигурация self-hosted")                                              \
+  X(self_hosted_server_settings, u8"自托管设置", "Self-Hosted Settings",       \
+    u8"Настройки self-hosted")                                                 \
+  X(self_hosted_server_address, u8"服务器地址:",                               \
+    "Server Address:", u8"Адрес сервера:")                                     \
+  X(self_hosted_server_port, u8"信令服务端口:",                                \
+    "Signal Service Port:", u8"Порт сигнального сервиса:")                     \
+  X(ok, u8"确认", "OK", u8"ОК")                                                \
+  X(cancel, u8"取消", "Cancel", u8"Отмена")                                    \
+  X(new_password, u8"请输入六位密码:",                                         \
+    "Please input a six-char password:", u8"Введите шестизначный пароль:")     \
+  X(input_password, u8"请输入密码:",                                           \
+    "Please input password:", u8"Введите пароль:")                             \
+  X(validate_password, u8"验证密码中...", "Validate password ...",             \
+    u8"Проверка пароля...")                                                    \
+  X(reinput_password, u8"请重新输入密码", "Please input password again",       \
+    u8"Повторно введите пароль")                                               \
+  X(remember_password, u8"记住密码", "Remember password",                      \
+    u8"Запомнить пароль")                                                      \
+  X(signal_connected, u8"已连接服务器", "Connected", u8"Подключено к серверу") \
+  X(signal_disconnected, u8"未连接服务器", "Disconnected",                     \
+    u8"Нет подключения к серверу")                                             \
+  X(signal_tls_cert_error, u8"证书验证失败，请重新安装自托管根证书",           \
+    "Certificate verification failed. Reinstall the self-hosted root "         \
+    "certificate.",                                                            \
+    u8"Ошибка проверки сертификата. Переустановите корневой сертификат.")      \
+  X(p2p_connected, u8"对等连接已建立", "P2P Connected", u8"P2P подключено")    \
+  X(p2p_disconnected, u8"对等连接已断开", "P2P Disconnected",                  \
+    u8"P2P отключено")                                                         \
+  X(p2p_connecting, u8"正在建立对等连接...", "P2P Connecting ...",             \
+    u8"Подключение P2P...")                                                    \
+  X(p2p_gathering, u8"正在收集候选地址...", "Gathering candidates ...",         \
+    u8"Сбор кандидатов...")                                                    \
+  X(receiving_screen, u8"画面接收中...", "Receiving screen...",                \
+    u8"Получение изображения...")                                              \
+  X(p2p_failed, u8"对等连接失败", "P2P Failed", u8"Сбой P2P")                  \
+  X(p2p_closed, u8"对等连接已关闭", "P2P closed", u8"P2P закрыто")             \
+  X(no_such_id, u8"无此ID", "No such ID", u8"ID не найден")                    \
+  X(about, u8"关于", "About", u8"О программе")                                 \
+  X(notification, u8"通知", "Notification", u8"Уведомление")                   \
+  X(new_version, u8"新版本", "New version", u8"Новая версия")                 \
+  X(new_version_available, u8"新版本可用", "New Version Available",            \
+    u8"Доступна новая версия")                                                 \
+  X(check_for_updates, u8"检查更新", "Check for updates",                     \
+    u8"Проверить обновления")                                                   \
+  X(checking_for_updates, u8"正在检查更新…", "Checking for updates…",         \
+    u8"Проверка обновлений…")                                                  \
+  X(up_to_date, u8"已是最新版本", "You're up to date",                         \
+    u8"Установлена последняя версия")                                          \
+  X(update_check_failed, u8"检查失败，请稍后重试",                             \
+    "Check failed. Please try again later.",                                    \
+    u8"Не удалось проверить обновления. Повторите позже.")                     \
+  X(release_notes, u8"更新内容", "Release Notes", u8"Содержание обновления") \
+  X(version, u8"版本", "Version", u8"Версия")                                  \
+  X(release_date, u8"发布日期: ", "Release Date: ", u8"Дата релиза: ")         \
+  X(access_website, u8"访问官网: ",                                            \
+    "Access Website: ", u8"Официальный сайт: ")                                \
+  X(update, u8"更新", "Update", u8"Обновить")                                  \
+  X(connection_alias, u8"修改名称", "Edit Alias",                              \
+    u8"Изменить имя подключения")                                              \
+  X(delete_connection, u8"删除连接", "Delete Connection",                      \
+    u8"Удалить подключение")                                                   \
+  X(connect_to_this_connection, u8"发起连接", "Connect to this connection",    \
+    u8"Подключиться")                                                          \
+  X(input_connection_alias, u8"请输入连接名称:",                               \
+    "Please input connection name:", u8"Введите имя подключения:")             \
+  X(confirm_delete_connection, u8"确认删除此连接",                             \
+    "Confirm to delete this connection", u8"Удалить это подключение?")         \
+  X(enable_autostart, u8"开机自启:", "Auto Start:", u8"Автозапуск:")           \
+  X(enable_daemon, u8"启用守护进程:", "Enable Daemon:", u8"Включить демон:")   \
+  X(privacy_on_connect, u8"被连接时开启隐私屏:", "Privacy screen on connect:", \
+    u8"Приватность при подключении:")                                       \
+  X(takes_effect_after_restart, u8"重启后生效", "Takes effect after restart",  \
+    u8"Вступит в силу после перезапуска")                                      \
+  X(select_file, u8"选择文件发送", "Select File to Send",                      \
+    u8"Выбрать файл для отправки")                                             \
+  X(file_transfer_progress, u8"文件传输进度", "File Transfer Progress",        \
+    u8"Прогресс передачи файлов")                                              \
+  X(queued, u8"队列中", "Queued", u8"В очереди")                               \
+  X(sending, u8"正在传输", "Sending", u8"Передача")                            \
+  X(completed, u8"已完成", "Completed", u8"Завершено")                         \
+  X(failed, u8"失败", "Failed", u8"Ошибка")                                    \
+  X(controller, u8"控制端:", "Controller:", u8"Контроллер:")                   \
+  X(file_transfer, u8"文件传输:", "File Transfer:", u8"Передача файлов:")      \
+  X(connection_status, u8"连接状态:",                                          \
+    "Connection Status:", u8"Состояние соединения:")                           \
+  X(file_transfer_save_path, u8"文件接收保存路径:",                            \
+    "File Transfer Save Path:", u8"Путь сохранения файлов:")                   \
+  X(default_desktop, u8"桌面", "Desktop", u8"Рабочий стол")                    \
+  X(resolution, u8"分辨率", "Res", u8"Разрешение")                             \
+  X(video_latency, u8"视频延时", "Video delay", u8"Задержка") \
+  X(connection_latency, u8"连接延时", "Connection RTT", u8"Задержка соединения") \
+  X(connection_mode, u8"连接模式", "Mode", u8"Режим")                          \
+  X(connection_mode_direct, u8"直连", "Direct", u8"Прямой")                    \
+  X(connection_mode_relay, u8"中继", "Relay", u8"Релейный")                    \
+  X(transport_encryption, u8"加密传输", "Encryption", u8"Шифрование")         \
+  X(transport_encryption_enabled, u8"已开启", "Enabled", u8"Включено")         \
+  X(transport_encryption_disabled, u8"未开启", "Disabled", u8"Выключено")       \
+  X(online, u8"在线", "Online", u8"Онлайн")                                    \
+  X(offline, u8"离线", "Offline", u8"Офлайн")                                  \
+  X(device_offline, u8"设备离线", "Device Offline", u8"Устройство офлайн")     \
+  X(request_permissions, u8"权限请求", "Request Permissions",                  \
+    u8"Запрос разрешений")                                                     \
+  X(screen_recording_permission, u8"屏幕录制权限",                             \
+    "Screen Recording Permission", u8"Разрешение на запись экрана")            \
+  X(accessibility_permission, u8"辅助功能权限", "Accessibility Permission",    \
+    u8"Разрешение специальных возможностей")                                   \
+  X(permission_required_message, u8"该应用需要授权以下权限:",                  \
+    "The application requires the following permissions:",                     \
+    u8"Для работы приложения требуются следующие разрешения:")                 \
+  X(wayland_notice_title, u8"Wayland 会话提示", "Wayland Session Notice",        \
+    u8"Уведомление о сеансе Wayland")                                          \
+  X(wayland_notice_subtitle, u8"检测到当前桌面会话使用 Wayland。",               \
+    "The current desktop session uses Wayland.",                              \
+    u8"Текущий сеанс рабочего стола использует Wayland.")                      \
+  X(wayland_permission_title, u8"每次共享均需本机授权",                        \
+    "Local approval required each time",                                      \
+    u8"Разрешение требуется каждый раз")                                      \
+  X(wayland_notice_message,                                                    \
+    u8"受 Wayland 安全机制限制，每次启动远程桌面共享时，"                      \
+    u8"均需在本机手动授权屏幕共享与远程控制，授权后方可正常使用。",             \
+    "Wayland security restrictions require you to authorize screen sharing "  \
+    "and remote control locally each time you start sharing this desktop. "   \
+    "Remote access is available only after authorization.",                    \
+    u8"Из-за ограничений безопасности Wayland при каждом запуске общего "       \
+    u8"доступа к рабочему столу необходимо вручную разрешать на этом "           \
+    u8"компьютере показ экрана и удалённое управление. Удалённый доступ "        \
+    u8"возможен только после разрешения.")                                     \
+  X(wayland_recommendation_title, u8"建议使用 X11（Xorg）",                      \
+    "X11 (Xorg) is recommended", u8"Рекомендуем X11 (Xorg)")                    \
+  X(wayland_recommendation_message,                                            \
+    u8"为便于持续使用远程桌面，建议注销当前桌面会话，"                        \
+    u8"在登录界面选择 X11（Xorg）会话后重新登录。",                            \
+    "For ongoing remote desktop access, we recommend logging out, selecting " \
+    "an X11 (Xorg) session on the login screen, and logging in again.",         \
+    u8"Для постоянного удалённого доступа рекомендуем завершить сеанс, "        \
+    u8"выбрать X11 (Xorg) на экране входа и войти снова.")                      \
+  X(wayland_notice_acknowledge, u8"我知道了", "Got it", u8"Понятно")            \
+  X(show_main_window, u8"显示主界面", "Show Main Window",                    \
+    u8"Показать главное окно")                                                \
+  X(privacy_screen_unlock_hint, u8"按下快捷键，解除隐私屏",                    \
+    "To turn off the privacy screen, press",                                 \
+    u8"Чтобы отключить приватный экран, нажмите")                             \
+  X(exit_program, u8"退出", "Exit", u8"Выход")
+
+inline constexpr TranslationRow kTranslationRows[] = {
+#define CROSSDESK_DECLARE_TRANSLATION_ROW(name, zh, en, ru) {#name, zh, en, ru},
+    CROSSDESK_LOCALIZATION_ALL(CROSSDESK_DECLARE_TRANSLATION_ROW)
+#undef CROSSDESK_DECLARE_TRANSLATION_ROW
+};
+
+}  // namespace detail
+
+}  // namespace localization
+}  // namespace crossdesk
+
+#endif

apps/desktop/src/gui/features/clipboard/clipboard_controller.cpp

@@ -0,0 +1,176 @@
+#include "features/clipboard/clipboard_controller.h"
+
+#include <SDL3/SDL_clipboard.h>
+#include <SDL3/SDL_error.h>
+#include <SDL3/SDL_events.h>
+
+#include <cstring>
+#include <shared_mutex>
+#include <utility>
+
+#include "rd_log.h"
+#include "runtime/gui_runtime.h"
+
+namespace crossdesk {
+namespace {
+
+// Keep a reliable clipboard message within MiniRTC/KCP's single-message
+// fragmentation window (MTU is configured to 1200 bytes).
+constexpr size_t kMaxClipboardTextBytes = 128 * 1024;
+
+} // namespace
+
+ClipboardController::ClipboardController(GuiRuntime &owner) : owner_(owner) {}
+
+void ClipboardController::SetEventType(uint32_t event_type) {
+  event_type_ = event_type;
+}
+
+uint32_t ClipboardController::event_type() const { return event_type_; }
+
+void ClipboardController::Initialize() {
+  last_text_.clear();
+
+  char *clipboard_text = SDL_GetClipboardText();
+  if (clipboard_text) {
+    last_text_.assign(clipboard_text);
+    SDL_free(clipboard_text);
+  }
+
+  events_enabled_.store(true, std::memory_order_release);
+}
+
+void ClipboardController::Shutdown() {
+  events_enabled_.store(false, std::memory_order_release);
+  std::lock_guard<std::mutex> lock(pending_mutex_);
+  pending_remote_text_.reset();
+}
+
+void ClipboardController::QueueRemoteText(const char *data, size_t size) {
+  if (!events_enabled_.load(std::memory_order_acquire)) {
+    return;
+  }
+  if (!data || size == 0) {
+    return;
+  }
+  if (size > kMaxClipboardTextBytes) {
+    LOG_WARN("Ignore oversized remote clipboard text: {} bytes", size);
+    return;
+  }
+  if (std::memchr(data, '\0', size) != nullptr) {
+    LOG_WARN("Ignore remote clipboard text containing an embedded NUL byte");
+    return;
+  }
+
+  {
+    std::lock_guard<std::mutex> lock(pending_mutex_);
+    if (!events_enabled_.load(std::memory_order_relaxed)) {
+      return;
+    }
+    // Only the newest clipboard value matters. Replacing it also bounds the
+    // amount of memory a busy or malicious peer can queue.
+    pending_remote_text_ = std::string(data, size);
+  }
+
+  SDL_Event event{};
+  event.type = event_type_;
+  if (event_type_ != 0 && !SDL_PushEvent(&event)) {
+    // MainLoop also drains the pending value after its wait timeout.
+    LOG_WARN("Failed to wake SDL loop for remote clipboard text: {}",
+             SDL_GetError());
+  }
+}
+
+void ClipboardController::ApplyPendingRemoteText() {
+  if (!events_enabled_.load(std::memory_order_acquire)) {
+    return;
+  }
+
+  std::optional<std::string> pending_text;
+  {
+    std::lock_guard<std::mutex> lock(pending_mutex_);
+    pending_text.swap(pending_remote_text_);
+  }
+  if (!pending_text || *pending_text == last_text_) {
+    return;
+  }
+
+  // SDL clipboard functions must run on the thread that initialized SDL.
+  if (!SDL_SetClipboardText(pending_text->c_str())) {
+    LOG_ERROR("Failed to set remote clipboard text: {}", SDL_GetError());
+    return;
+  }
+
+  // SDL will normally emit SDL_EVENT_CLIPBOARD_UPDATE for this write. Update
+  // the baseline first so that event cannot echo the text back to the sender.
+  last_text_ = std::move(*pending_text);
+}
+
+void ClipboardController::HandleLocalUpdate() {
+  if (!events_enabled_.load(std::memory_order_acquire)) {
+    return;
+  }
+  if (!SDL_HasClipboardText()) {
+    last_text_.clear();
+    return;
+  }
+
+  char *clipboard_text = SDL_GetClipboardText();
+  if (!clipboard_text) {
+    LOG_WARN("Failed to read local clipboard text: {}", SDL_GetError());
+    return;
+  }
+
+  std::string text(clipboard_text);
+  SDL_free(clipboard_text);
+  if (text == last_text_) {
+    return;
+  }
+
+  // Record the value before sending. Duplicate SDL notifications and a
+  // remote write of the same value must not create a clipboard feedback loop.
+  last_text_ = text;
+  if (text.empty()) {
+    return;
+  }
+  if (text.size() > kMaxClipboardTextBytes) {
+    LOG_WARN("Ignore oversized local clipboard text: {} bytes", text.size());
+    return;
+  }
+
+  SendToPeers(text);
+}
+
+int ClipboardController::SendToPeers(const std::string &text) {
+  std::shared_lock lock(owner_.remote_sessions_mutex_);
+  for (const auto &[remote_id, props] : owner_.remote_sessions_) {
+    if (!props || !props->peer_ || !props->connection_established_ ||
+        !props->enable_mouse_control_) {
+      continue;
+    }
+
+    const int ret =
+        SendReliableDataFrame(props->peer_, text.data(), text.size(),
+                              props->clipboard_label_.c_str());
+    if (ret != 0) {
+      LOG_WARN("Failed to send clipboard data to peer [{}], ret={}",
+               remote_id.c_str(), ret);
+      return ret;
+    }
+  }
+
+  if (owner_.peer_) {
+    const int ret =
+        SendReliableDataFrame(owner_.peer_, text.data(), text.size(),
+                              owner_.clipboard_label_.c_str());
+    if (ret != 0) {
+      LOG_WARN("Failed to send clipboard data to peer [{}], ret={}",
+               owner_.remote_id_display_, ret);
+      return ret;
+    }
+  }
+
+  return 0;
+}
+
+} // namespace crossdesk

apps/desktop/src/gui/features/clipboard/clipboard_controller.h

@@ -0,0 +1,49 @@
+/*
+ * @Author: DI JUNKUN
+ * @Date: 2026-09-25
+ * Copyright (c) 2026 by DI JUNKUN, All Rights Reserved.
+ */
+
+#ifndef _CLIPBOARD_CONTROLLER_H_
+#define _CLIPBOARD_CONTROLLER_H_
+
+#include <atomic>
+#include <cstddef>
+#include <cstdint>
+#include <mutex>
+#include <optional>
+#include <string>
+
+namespace crossdesk {
+
+class GuiRuntime;
+
+// Owns clipboard synchronization state and keeps feedback-loop prevention out
+// of the main UI coordinator.
+class ClipboardController {
+public:
+  explicit ClipboardController(GuiRuntime &owner);
+
+  void SetEventType(uint32_t event_type);
+  uint32_t event_type() const;
+
+  void Initialize();
+  void Shutdown();
+  void QueueRemoteText(const char *data, size_t size);
+  void ApplyPendingRemoteText();
+  void HandleLocalUpdate();
+
+private:
+  int SendToPeers(const std::string &text);
+
+  GuiRuntime &owner_;
+  uint32_t event_type_ = 0;
+  std::atomic<bool> events_enabled_{false};
+  std::mutex pending_mutex_;
+  std::optional<std::string> pending_remote_text_;
+  std::string last_text_;
+};
+
+} // namespace crossdesk
+
+#endif // _CLIPBOARD_CONTROLLER_H_

apps/desktop/src/gui/features/devices/session_device_manager.cpp

@@ -0,0 +1,737 @@
+#include "features/devices/session_device_manager.h"
+
+#include <SDL3/SDL_audio.h>
+#include <SDL3/SDL_error.h>
+#include <SDL3/SDL_init.h>
+
+#include <display_stream_id.h>
+#include <remote_action.h>
+
+#include <algorithm>
+#include <chrono>
+#include <cstdlib>
+#include <utility>
+
+#include "device_controller_factory.h"
+#include "screen_capturer_factory.h"
+#include "platform.h"
+#include "rd_log.h"
+#include "runtime/gui_runtime.h"
+#include "speaker_capturer_factory.h"
+#ifdef _WIN32
+#include "platform/windows/screen_capturer/screen_capturer_win.h"
+#include "platform/windows/input/mouse/mouse_controller.h"
+#endif
+
+namespace crossdesk {
+namespace {
+
+constexpr uint64_t kCaptureResumeKeyFrameGapMs = 500;
+constexpr size_t kMaxCapturedKeyboardInputs = 512;
+constexpr auto kFrameDeadlineTolerance = std::chrono::milliseconds(1);
+
+} // namespace
+
+SessionDeviceManager::SessionDeviceManager(GuiRuntime &owner)
+    : owner_(owner),
+      speaker_capture_(
+          [] {
+            return std::unique_ptr<SpeakerCapturer>(
+                SpeakerCapturerFactory().Create());
+          },
+          [this](unsigned char *data, size_t size, const char *) {
+            if (!owner_.peer_) return;
+            MiniRtcAudioFrame frame{};
+            frame.data = reinterpret_cast<const char *>(data);
+            frame.size = size;
+            frame.captured_timestamp = GetSystemTimeMicros(owner_.peer_);
+            SendAudioFrame(owner_.peer_, &frame, owner_.audio_label_.c_str());
+          }) {}
+
+SessionDeviceManager::~SessionDeviceManager() { speaker_capture_.Shutdown(); }
+
+bool SessionDeviceManager::ShouldSendCapturedFrame(
+    std::chrono::steady_clock::time_point now, int fps) {
+  const auto interval =
+      std::chrono::nanoseconds(std::chrono::seconds(1)) / (fps > 0 ? fps : 1);
+  if (next_frame_deadline_ == std::chrono::steady_clock::time_point{}) {
+    next_frame_deadline_ = now;
+  }
+  if (now + kFrameDeadlineTolerance < next_frame_deadline_) {
+    return false;
+  }
+  next_frame_deadline_ += interval;
+  if (next_frame_deadline_ <= now) {
+    next_frame_deadline_ = now + interval;
+  }
+  return true;
+}
+
+void SessionDeviceManager::RecordCaptureCadence(
+    std::chrono::steady_clock::time_point now, int fps,
+    bool from_secure_desktop) {
+  std::lock_guard<std::mutex> lock(capture_metrics_mutex_);
+  if (capture_metrics_started_ == std::chrono::steady_clock::time_point{})
+    capture_metrics_started_ = now;
+  const auto elapsed_us = std::chrono::duration_cast<std::chrono::microseconds>(
+                              now - capture_metrics_started_)
+                              .count();
+  if (elapsed_us >= 2000000) {
+    if (capture_forwarded_) {
+      const char* source = capture_secure_callbacks_ == 0 ? "normal_desktop"
+                           : capture_secure_callbacks_ == capture_callbacks_
+                               ? "secure_desktop"
+                               : "mixed";
+      LOG_DEBUG(
+          "Capture delivery: source={} normal_callbacks={} secure_callbacks={} "
+          "target_fps={} input_fps={:.2f} "
+          "forwarded_fps={:.2f} callbacks={} rate_dropped={} "
+          "forwarded={} send_errors={} max_callback_gap_us={} "
+          "send_avg_us={} send_max_us={} window_ms={}",
+          source, capture_callbacks_ - capture_secure_callbacks_,
+          capture_secure_callbacks_, fps,
+          capture_callbacks_ * 1000000.0 / elapsed_us,
+          capture_forwarded_ * 1000000.0 / elapsed_us, capture_callbacks_,
+          capture_rate_drops_, capture_forwarded_, capture_send_errors_,
+          capture_max_gap_us_, capture_send_us_ / capture_forwarded_,
+          capture_max_send_us_, elapsed_us / 1000);
+    }
+    capture_metrics_started_ = now;
+    capture_callbacks_ = capture_rate_drops_ = capture_forwarded_ = 0;
+    capture_secure_callbacks_ = 0;
+    capture_send_errors_ = 0;
+    capture_max_gap_us_ = capture_send_us_ = capture_max_send_us_ = 0;
+  }
+  if (last_capture_callback_ != std::chrono::steady_clock::time_point{}) {
+    capture_max_gap_us_ =
+        std::max<int64_t>(capture_max_gap_us_,
+                          std::chrono::duration_cast<std::chrono::microseconds>(
+                              now - last_capture_callback_)
+                              .count());
+  }
+  last_capture_callback_ = std::max(last_capture_callback_, now);
+  ++capture_callbacks_;
+  if (from_secure_desktop) ++capture_secure_callbacks_;
+}
+
+void SessionDeviceManager::Initialize() {
+  InitializeAudioOutput();
+  screen_capturer_factory_ = new ScreenCapturerFactory();
+  device_controller_factory_ = new DeviceControllerFactory();
+  keyboard_capturer_ =
+      static_cast<KeyboardCapturer *>(device_controller_factory_->Create(
+          DeviceControllerFactory::Device::Keyboard));
+}
+
+int SessionDeviceManager::InitializeScreenCapturer() {
+#ifdef __APPLE__
+  if (!owner_.EnsureMacScreenRecordingPermission()) {
+    return -1;
+  }
+#endif
+
+  if (!screen_capturer_) {
+    screen_capturer_ =
+        static_cast<ScreenCapturer *>(screen_capturer_factory_->Create());
+  }
+  screen_capturer_->SetPrivacyController(&owner_.privacy_);
+#ifdef _WIN32
+  if (auto windows = dynamic_cast<ScreenCapturerWin*>(screen_capturer_)) {
+    windows->SetCaptureMethod(owner_.config_center_->GetScreenCaptureMethod());
+  }
+#endif
+
+  last_frame_time_ = {};
+  next_frame_deadline_ = {};
+  capture_metrics_started_ = last_capture_callback_ = {};
+  capture_callbacks_ = capture_rate_drops_ = capture_forwarded_ = 0;
+  capture_secure_callbacks_ = 0;
+  capture_send_errors_ = 0;
+  capture_max_gap_us_ = capture_send_us_ = capture_max_send_us_ = 0;
+  // Keep the shared source ready for either live rate. MiniRTC admits 30/60
+  // frames independently per viewer, so switching never restarts native
+  // capture.
+  const int fps = 60;
+  LOG_INFO("Init screen capturer with {} fps", fps);
+  SetDisplayInfoList({});
+  registered_display_stream_count_ = 0;
+  last_video_frame_stream_id_.clear();
+  invalid_video_stream_id_logged_ = false;
+
+  const int init_ret = screen_capturer_->Init(
+      fps, [this, fps](unsigned char *data, int size, int width, int height,
+                       const char *display_name,
+                       const MiniRtcNativeVideoFrame *native_frame) {
+        const auto now_time = std::chrono::steady_clock::now();
+        bool from_secure_desktop = false;
+#ifdef _WIN32
+        from_secure_desktop =
+            ScreenCapturerWin::CurrentFrameIsFromSecureDesktop();
+#endif
+        RecordCaptureCadence(now_time, fps, from_secure_desktop);
+        if (!ShouldSendCapturedFrame(now_time, fps)) {
+          std::lock_guard<std::mutex> lock(capture_metrics_mutex_);
+          ++capture_rate_drops_;
+          return;
+        }
+
+        const bool has_previous_frame =
+            last_frame_time_.time_since_epoch().count() != 0;
+        const auto duration_ms =
+            has_previous_frame
+                ? std::chrono::duration_cast<std::chrono::milliseconds>(
+                      now_time - last_frame_time_)
+                      .count()
+                : 0;
+
+        std::vector<std::string> connected_remote_ids;
+        {
+          std::shared_lock lock(owner_.connection_status_mutex_);
+          connected_remote_ids.reserve(owner_.connection_status_.size());
+          for (const auto &[remote_id, status] : owner_.connection_status_) {
+            if (status == ConnectionStatus::Connected) {
+              connected_remote_ids.push_back(remote_id);
+            }
+          }
+        }
+
+        // Capture can still deliver frames while ICE is gathering or after
+        // the final controller disconnects. Do not broadcast those frames to
+        // MiniRTC: a broadcast also reaches newly joining peers whose ICE
+        // transport is not ready yet.
+        if (connected_remote_ids.empty()) {
+          last_frame_time_ = now_time;
+          return;
+        }
+
+        const std::string stream_id = ResolveDisplayStreamId(
+            display_name, registered_display_stream_count_, -1,
+            last_video_frame_stream_id_);
+        if (stream_id.empty()) {
+          if (!invalid_video_stream_id_logged_) {
+            LOG_ERROR(
+                "Drop captured frames with an empty or unregistered video "
+                "stream id, reported='{}', registered_streams={}",
+                display_name ? display_name : "",
+                registered_display_stream_count_);
+            invalid_video_stream_id_logged_ = true;
+          }
+          return;
+        }
+        invalid_video_stream_id_logged_ = false;
+        const bool resumed_after_gap =
+            has_previous_frame && duration_ms >= kCaptureResumeKeyFrameGapMs;
+        const bool stream_changed = !last_video_frame_stream_id_.empty() &&
+                                    last_video_frame_stream_id_ != stream_id;
+        if (resumed_after_gap || stream_changed) {
+          if (RequestVideoKeyFrame(owner_.peer_, stream_id.c_str()) == 0) {
+            LOG_DEBUG("Request video key frame before sending captured frame, "
+                     "stream='{}', gap_ms={}, stream_changed={}",
+                     stream_id, duration_ms, stream_changed);
+          }
+        }
+
+        MiniRtcVideoFrame frame{};
+        frame.data = reinterpret_cast<const char *>(data);
+        frame.size = size;
+        frame.width = width;
+        frame.height = height;
+        frame.captured_timestamp = GetSystemTimeMicros(owner_.peer_);
+        frame.native_frame = native_frame;
+        const auto send_started = std::chrono::steady_clock::now();
+        uint64_t send_errors = 0;
+        for (const std::string &remote_id : connected_remote_ids) {
+          if (SendVideoFrameToPeer(owner_.peer_, &frame, stream_id.c_str(),
+                                   remote_id.data(), remote_id.size()) != 0)
+            ++send_errors;
+        }
+        const auto send_us =
+            std::chrono::duration_cast<std::chrono::microseconds>(
+                std::chrono::steady_clock::now() - send_started)
+                .count();
+        {
+          std::lock_guard<std::mutex> lock(capture_metrics_mutex_);
+          ++capture_forwarded_;
+          capture_send_errors_ += send_errors;
+          capture_send_us_ += send_us;
+          capture_max_send_us_ =
+              std::max<int64_t>(capture_max_send_us_, send_us);
+        }
+        last_video_frame_stream_id_ = stream_id;
+        last_frame_time_ = now_time;
+      });
+
+  if (init_ret == 0) {
+    LOG_INFO("Init screen capturer success");
+    auto latest_display_info = screen_capturer_->GetDisplayInfoList();
+    registered_display_stream_count_ = latest_display_info.size();
+    if (!latest_display_info.empty()) {
+      SetDisplayInfoList(std::move(latest_display_info));
+    }
+    return 0;
+  }
+
+  LOG_ERROR("Init screen capturer failed");
+  screen_capturer_->Destroy();
+  delete screen_capturer_;
+  screen_capturer_ = nullptr;
+  return -1;
+}
+
+bool SessionDeviceManager::ShouldCaptureCursor() const {
+  std::shared_lock lock(owner_.connection_status_mutex_);
+  return std::any_of(owner_.connection_status_.begin(),
+                     owner_.connection_status_.end(), [](const auto& entry) {
+    return entry.second == ConnectionStatus::Connected &&
+           entry.first.find("web") != std::string::npos;
+  });
+}
+
+int SessionDeviceManager::StartScreenCapturer() {
+#ifdef __APPLE__
+  if (!owner_.EnsureMacScreenRecordingPermission()) {
+    return -1;
+  }
+#endif
+
+  if (!screen_capturer_) {
+    LOG_INFO("Screen capturer instance missing, recreating before start");
+    if (InitializeScreenCapturer() != 0) {
+      LOG_ERROR("Recreate screen capturer failed");
+      return -1;
+    }
+  }
+
+  // Clear before sampling, so a change arriving after the sample remains pending.
+  cursor_capture_dirty_.store(false, std::memory_order_relaxed);
+  const bool show_cursor = ShouldCaptureCursor();
+  LOG_INFO("Start screen capturer, show cursor: {}", show_cursor);
+  const int ret = screen_capturer_->Start(show_cursor);
+  if (ret != 0) {
+    LOG_ERROR("Start screen capturer failed: {}", ret);
+  }
+  return ret;
+}
+
+int SessionDeviceManager::StopScreenCapturer() {
+  if (screen_capturer_) {
+    LOG_INFO("Stop screen capturer");
+    screen_capturer_->Stop();
+  }
+  return 0;
+}
+
+#ifdef _WIN32
+void SessionDeviceManager::ReleaseRemoteMouseButtons() {
+  if (auto mouse = dynamic_cast<PlatformMouseController*>(mouse_controller_))
+    mouse->ReleasePressedButtons();
+}
+#endif
+
+void SessionDeviceManager::StartSpeakerCapturer() {
+  speaker_capture_.SetEnabled(true);
+}
+
+void SessionDeviceManager::StopSpeakerCapturer() {
+  speaker_capture_.SetEnabled(false);
+}
+
+bool SessionDeviceManager::SyncDisplayInfo() {
+  if (!screen_capturer_) return false;
+  auto displays = screen_capturer_->GetDisplayInfoList();
+  if (displays.empty()) return false;
+  // Called every UI tick; replace the shared list only when geometry actually
+  // changed so readers on other threads rarely contend for the lock.
+  bool changed = false;
+  {
+    std::lock_guard<std::mutex> lock(display_info_mutex_);
+    changed = !std::equal(
+        displays.begin(), displays.end(), display_info_list_.begin(),
+        display_info_list_.end(), [](const auto &a, const auto &b) {
+          return a.handle == b.handle && a.name == b.name &&
+                 a.is_primary == b.is_primary && a.left == b.left &&
+                 a.top == b.top && a.width == b.width && a.height == b.height;
+        });
+    if (changed) display_info_list_ = displays;
+  }
+  if (changed && mouse_controller_) mouse_controller_->UpdateDisplayInfoList(displays);
+  return true;
+}
+
+void SessionDeviceManager::SetDisplayInfoList(std::vector<DisplayInfo> displays) {
+  std::lock_guard<std::mutex> lock(display_info_mutex_);
+  display_info_list_ = std::move(displays);
+}
+
+int SessionDeviceManager::StartMouseController() {
+#ifdef __APPLE__
+  if (!owner_.EnsureMacAccessibilityPermission()) {
+    return -1;
+  }
+#endif
+
+  if (!device_controller_factory_) {
+    LOG_INFO("Device controller factory is nullptr");
+    return -1;
+  }
+
+#if defined(__linux__) && !defined(__APPLE__)
+  if (IsWaylandSession()) {
+    if (!screen_capturer_) {
+      return 1;
+    }
+    const auto latest_display_info = screen_capturer_->GetDisplayInfoList();
+    if (latest_display_info.empty() ||
+        latest_display_info[0].handle == nullptr) {
+      return 1;
+    }
+  }
+
+#endif
+
+  SyncDisplayInfo();
+  mouse_controller_ =
+      static_cast<MouseController *>(device_controller_factory_->Create(
+          DeviceControllerFactory::Device::Mouse));
+  if (!mouse_controller_) {
+    LOG_ERROR("Create mouse controller failed");
+    return -1;
+  }
+
+  const int init_ret = mouse_controller_->Init(display_info_list());
+  if (init_ret != 0) {
+    LOG_INFO("Destroy mouse controller");
+    mouse_controller_->Destroy();
+    delete mouse_controller_;
+    mouse_controller_ = nullptr;
+  }
+  return init_ret;
+}
+
+int SessionDeviceManager::StopMouseController() {
+  if (mouse_controller_) {
+    mouse_controller_->Destroy();
+    delete mouse_controller_;
+    mouse_controller_ = nullptr;
+  }
+  return 0;
+}
+
+int SessionDeviceManager::StartKeyboardCapturer() {
+  ClearCapturedKeyboardInput();
+  owner_.keyboard_capturer_uses_window_events_ = false;
+
+#ifdef __APPLE__
+  if (!owner_.EnsureMacAccessibilityPermission()) {
+    owner_.keyboard_capturer_uses_window_events_ = true;
+    return 0;
+  }
+#endif
+
+#if defined(__linux__) && !defined(__APPLE__)
+  if (IsWaylandSession()) {
+    owner_.keyboard_capturer_uses_window_events_ = true;
+    LOG_INFO("Start keyboard capturer with Slint Wayland backend");
+    return 0;
+  }
+#endif
+
+  if (!keyboard_capturer_) {
+    owner_.keyboard_capturer_uses_window_events_ = true;
+    LOG_WARN(
+        "keyboard capturer is nullptr, falling back to Slint keyboard events");
+    return 0;
+  }
+
+  const int hook_ret = keyboard_capturer_->Hook(
+      [](int key_code, bool is_down, uint32_t scan_code, bool extended,
+         void *user_ptr) {
+        if (user_ptr) {
+          auto *devices = static_cast<SessionDeviceManager *>(user_ptr);
+          devices->QueueCapturedKeyboardInput(key_code, is_down, scan_code,
+                                              extended);
+        }
+      },
+      this);
+  if (hook_ret != 0) {
+    keyboard_capturer_->Unhook();
+    owner_.keyboard_capturer_uses_window_events_ = true;
+    LOG_WARN(
+        "Start keyboard capturer failed, falling back to Slint keyboard events");
+  } else {
+    LOG_INFO("Start keyboard capturer with native input");
+  }
+  return 0;
+}
+
+int SessionDeviceManager::StopKeyboardCapturer() {
+  owner_.keyboard_capturer_is_started_ = false;
+  if (keyboard_capturer_) keyboard_capturer_->Unhook();
+  ClearCapturedKeyboardInput();
+  if (owner_.keyboard_capturer_uses_window_events_) {
+    owner_.keyboard_capturer_uses_window_events_ = false;
+    LOG_INFO("Stop keyboard capturer with Slint keyboard backend");
+    return 0;
+  }
+
+  if (keyboard_capturer_) {
+    LOG_INFO("Stop keyboard capturer");
+  }
+  return 0;
+}
+
+int SessionDeviceManager::InitializeAudioOutput() {
+  SDL_AudioSpec desired_out{};
+  desired_out.freq = 48000;
+  desired_out.format = SDL_AUDIO_S16;
+  desired_out.channels = 1;
+
+  auto open_stream = [&]() {
+    output_stream_ = SDL_OpenAudioDeviceStream(
+        SDL_AUDIO_DEVICE_DEFAULT_PLAYBACK, &desired_out, nullptr, nullptr);
+    return output_stream_ != nullptr;
+  };
+
+  if (!open_stream()) {
+#if defined(__linux__) && !defined(__APPLE__)
+    LOG_WARN("Failed to open output stream with driver [{}]: {}",
+             getenv("SDL_AUDIODRIVER") ? getenv("SDL_AUDIODRIVER")
+                                       : "(default)",
+             SDL_GetError());
+
+    setenv("SDL_AUDIODRIVER", "dummy", 1);
+    SDL_QuitSubSystem(SDL_INIT_AUDIO);
+    if (!SDL_InitSubSystem(SDL_INIT_AUDIO)) {
+      LOG_ERROR("Failed to reinitialize SDL audio with dummy driver: {}",
+                SDL_GetError());
+      return -1;
+    }
+    if (!open_stream()) {
+      LOG_ERROR("Failed to open output stream with dummy driver: {}",
+                SDL_GetError());
+      return -1;
+    }
+    LOG_WARN("Audio output disabled, using SDL dummy audio driver");
+#else
+    LOG_ERROR("Failed to open output stream: {}", SDL_GetError());
+    return -1;
+#endif
+  }
+
+  SDL_ResumeAudioDevice(SDL_GetAudioStreamDevice(output_stream_));
+  return 0;
+}
+
+int SessionDeviceManager::DestroyAudioOutput() {
+  if (output_stream_) {
+    SDL_CloseAudioDevice(SDL_GetAudioStreamDevice(output_stream_));
+    SDL_DestroyAudioStream(output_stream_);
+    output_stream_ = nullptr;
+  }
+  return 0;
+}
+
+void SessionDeviceManager::PushAudio(const char *data, size_t size) {
+  if (!output_stream_) {
+    return;
+  }
+  const int pushed = SDL_PutAudioStreamData(
+      output_stream_, reinterpret_cast<const Uint8 *>(data),
+      static_cast<int>(size));
+  if (pushed < 0) {
+    LOG_ERROR("Failed to push audio data: {}", SDL_GetError());
+  }
+}
+
+void SessionDeviceManager::UpdateInteractions() {
+#ifdef _WIN32
+  if (owner_.screen_capturer_is_started_ &&
+      cursor_capture_dirty_.load(std::memory_order_relaxed)) {
+    if (auto* windows = dynamic_cast<ScreenCapturerWin*>(screen_capturer_)) {
+      cursor_capture_dirty_.store(false, std::memory_order_relaxed);
+      windows->SetCursorCapture(ShouldCaptureCursor());
+    }
+  }
+#endif
+#if defined(__linux__) && !defined(__APPLE__)
+  const bool is_wayland_session = IsWaylandSession();
+  const bool stop_wayland_mouse_before_screen =
+      is_wayland_session && !owner_.start_screen_capturer_ &&
+      owner_.screen_capturer_is_started_ && !owner_.start_mouse_controller_ &&
+      owner_.mouse_controller_is_started_;
+  if (stop_wayland_mouse_before_screen) {
+    LOG_INFO("Stopping Wayland mouse controller before screen capturer to "
+             "cleanly release the shared portal session");
+    StopMouseController();
+    owner_.mouse_controller_is_started_ = false;
+  }
+#endif
+
+  if (owner_.start_screen_capturer_ && !owner_.screen_capturer_is_started_) {
+    if (StartScreenCapturer() == 0) {
+      owner_.screen_capturer_is_started_ = true;
+    }
+  } else if (!owner_.start_screen_capturer_ &&
+             owner_.screen_capturer_is_started_) {
+    StopScreenCapturer();
+    owner_.screen_capturer_is_started_ = false;
+  }
+
+  if (owner_.start_mouse_controller_ && !owner_.mouse_controller_is_started_) {
+    if (StartMouseController() == 0) {
+      owner_.mouse_controller_is_started_ = true;
+    }
+  } else if (!owner_.start_mouse_controller_ &&
+             owner_.mouse_controller_is_started_) {
+    StopMouseController();
+    owner_.mouse_controller_is_started_ = false;
+  }
+
+  if (owner_.screen_capturer_is_started_ && mouse_controller_ && SyncDisplayInfo()) {
+#ifdef _WIN32
+    const int active_display = screen_capturer_->GetCurrentMonitorIndex();
+    const auto displays = display_info_list();
+    if (active_display >= 0 &&
+        active_display < static_cast<int>(displays.size())) {
+      owner_.selected_display_ = active_display;
+      if (displays[active_display].width <= 0 ||
+          displays[active_display].height <= 0)
+        ReleaseRemoteMouseButtons();
+    }
+#endif
+  }
+
+  if (owner_.start_keyboard_capturer_ && owner_.focus_on_stream_window_) {
+    if (!owner_.keyboard_capturer_is_started_ && StartKeyboardCapturer() == 0) {
+      owner_.keyboard_capturer_is_started_ = true;
+    }
+    if (owner_.keyboard_capturer_is_started_) {
+      if (!owner_.keyboard_capturer_uses_window_events_ &&
+          (!keyboard_capturer_ || !keyboard_capturer_->IsHookActive())) {
+        StopKeyboardCapturer();
+        owner_.keyboard_.ForceReleasePressedKeys();
+        owner_.keyboard_capturer_uses_window_events_ = true;
+        owner_.keyboard_capturer_is_started_ = true;
+        LOG_WARN("Native keyboard capture stopped; using Slint keyboard events");
+      }
+      DrainCapturedKeyboardInput();
+      owner_.keyboard_.SendHeartbeat(false);
+    }
+  } else if (owner_.keyboard_capturer_is_started_) {
+    owner_.keyboard_.ForceReleasePressedKeys();
+    StopKeyboardCapturer();
+    owner_.keyboard_capturer_is_started_ = false;
+  }
+
+  owner_.keyboard_.CheckRemoteTimeouts();
+}
+
+void SessionDeviceManager::QueueCapturedKeyboardInput(int key_code,
+                                                       bool is_down,
+                                                       uint32_t scan_code,
+                                                       bool extended) {
+  std::lock_guard<std::mutex> lock(captured_keyboard_inputs_mutex_);
+  if (captured_keyboard_inputs_.size() >= kMaxCapturedKeyboardInputs) {
+    captured_keyboard_inputs_.pop_front();
+    LOG_WARN("Captured keyboard input queue overflow, dropping oldest event");
+  }
+  captured_keyboard_inputs_.push_back(
+      CapturedKeyboardInput{key_code, is_down, scan_code, extended});
+}
+
+void SessionDeviceManager::DrainCapturedKeyboardInput() {
+  std::deque<CapturedKeyboardInput> inputs;
+  {
+    std::lock_guard<std::mutex> lock(captured_keyboard_inputs_mutex_);
+    inputs.swap(captured_keyboard_inputs_);
+  }
+  if (owner_.privacy_.Snapshot().input_blocked) return;
+  for (const CapturedKeyboardInput &input : inputs) {
+    owner_.keyboard_.SendKeyCommand(input.key_code, input.is_down,
+                                    input.scan_code, input.extended);
+  }
+}
+
+void SessionDeviceManager::ClearCapturedKeyboardInput() {
+  std::lock_guard<std::mutex> lock(captured_keyboard_inputs_mutex_);
+  captured_keyboard_inputs_.clear();
+}
+
+bool SessionDeviceManager::SendKeyboardCommand(int key_code, bool is_down,
+                                               uint32_t scan_code,
+                                               bool extended) {
+  return keyboard_capturer_ && keyboard_capturer_->SendKeyboardCommand(
+                                   key_code, is_down, scan_code, extended) == 0;
+}
+
+void SessionDeviceManager::SendMouseCommand(const RemoteAction &action,
+                                            int selected_display) {
+  if (mouse_controller_) {
+    mouse_controller_->SendMouseCommand(action, selected_display);
+  }
+}
+
+int SessionDeviceManager::SwitchDisplay(int display_id) {
+  if (!screen_capturer_) return -1;
+  const int ret = screen_capturer_->SwitchTo(display_id);
+  if (ret == 0) SyncDisplayInfo();
+  return ret;
+}
+
+void SessionDeviceManager::ResetToInitialDisplay() {
+  if (!screen_capturer_) {
+    return;
+  }
+  const int ret = screen_capturer_->ResetToInitialMonitor();
+  if (ret != 0) {
+    LOG_WARN("Reset to initial display failed, ret={}", ret);
+    return;
+  }
+  // Capture backends start at display 0. Reset the input mapping as well so
+  // the next connection cannot show that display while controlling another.
+  owner_.selected_display_ = 0;
+  SyncDisplayInfo();
+}
+
+std::vector<DisplayInfo> SessionDeviceManager::display_info_list() const {
+  std::lock_guard<std::mutex> lock(display_info_mutex_);
+  return display_info_list_;
+}
+
+std::vector<HostDisplay> SessionDeviceManager::host_display_list() const {
+  std::lock_guard<std::mutex> lock(display_info_mutex_);
+  std::vector<HostDisplay> displays;
+  displays.reserve(display_info_list_.size());
+  for (const auto &display : display_info_list_) {
+    displays.push_back({display.name, display.left, display.top, display.right,
+                        display.bottom});
+  }
+  return displays;
+}
+
+void SessionDeviceManager::DestroyDevices() {
+  speaker_capture_.Shutdown();
+  if (mouse_controller_) {
+    mouse_controller_->Destroy();
+    delete mouse_controller_;
+    mouse_controller_ = nullptr;
+  }
+  if (screen_capturer_) {
+    screen_capturer_->Destroy();
+    delete screen_capturer_;
+    screen_capturer_ = nullptr;
+  }
+  if (keyboard_capturer_) {
+    delete keyboard_capturer_;
+    keyboard_capturer_ = nullptr;
+  }
+}
+
+void SessionDeviceManager::DestroyFactories() {
+  delete screen_capturer_factory_;
+  screen_capturer_factory_ = nullptr;
+  delete device_controller_factory_;
+  device_controller_factory_ = nullptr;
+}
+
+} // namespace crossdesk

apps/desktop/src/gui/features/devices/session_device_manager.h

@@ -0,0 +1,136 @@
+/*
+ * @Author: DI JUNKUN
+ * @Date: 2026-09-09
+ * Copyright (c) 2026 by DI JUNKUN, All Rights Reserved.
+ */
+
+#ifndef _SESSION_DEVICE_MANAGER_H_
+#define _SESSION_DEVICE_MANAGER_H_
+
+
+#include <atomic>
+#include <chrono>
+#include <cstddef>
+#include <cstdint>
+#include <deque>
+#include <mutex>
+#include <string>
+#include <vector>
+
+#include <remote_action.h>
+
+#include "device_controller.h"
+#include "display_info.h"
+#include "speaker_capture_controller.h"
+
+struct SDL_AudioStream;
+
+namespace crossdesk {
+
+class GuiRuntime;
+class DeviceControllerFactory;
+class ScreenCapturerFactory;
+class ScreenCapturer;
+
+// Owns media capture/playback and remote input devices for the active GUI
+// session. GuiRuntime supplies application intent; this class handles device
+// creation, updates and teardown.
+class SessionDeviceManager {
+public:
+  explicit SessionDeviceManager(GuiRuntime &owner);
+  ~SessionDeviceManager();
+
+  void Initialize();
+  void UpdateInteractions();
+  // Call after changing the controller map. UpdateInteractions consumes this
+  // notification on the UI thread before reading the map under its mutex.
+  void OnControllerConnectionsChanged() {
+    cursor_capture_dirty_.store(true, std::memory_order_relaxed);
+  }
+  void DestroyDevices();
+  void DestroyFactories();
+
+  int InitializeScreenCapturer();
+  int StartScreenCapturer();
+  int StopScreenCapturer();
+#ifdef _WIN32
+  void ReleaseRemoteMouseButtons();
+#endif
+  // Requests are asynchronous; Stop drains/revokes audio delivery before
+  // returning so the connection peer can be destroyed safely.
+  void StartSpeakerCapturer();
+  void StopSpeakerCapturer();
+  int StartMouseController();
+  int StopMouseController();
+  int StartKeyboardCapturer();
+  int StopKeyboardCapturer();
+
+  int InitializeAudioOutput();
+  int DestroyAudioOutput();
+  void PushAudio(const char *data, size_t size);
+
+  bool SendKeyboardCommand(int key_code, bool is_down, uint32_t scan_code,
+                           bool extended);
+  void SendMouseCommand(const RemoteAction &action, int selected_display);
+  int SwitchDisplay(int display_id);
+  void ResetToInitialDisplay();
+
+  // Snapshot of the capture displays. The UI thread refreshes the list every
+  // tick while transport threads build host information and map mouse input
+  // from it, so callers get a copy taken under the lock.
+  std::vector<DisplayInfo> display_info_list() const;
+  // The same snapshot in the wire's host information form.
+  std::vector<HostDisplay> host_display_list() const;
+
+private:
+  struct CapturedKeyboardInput {
+    int key_code = 0;
+    bool is_down = false;
+    uint32_t scan_code = 0;
+    bool extended = false;
+  };
+
+  void QueueCapturedKeyboardInput(int key_code, bool is_down,
+                                  uint32_t scan_code, bool extended);
+  void DrainCapturedKeyboardInput();
+  void ClearCapturedKeyboardInput();
+  bool ShouldSendCapturedFrame(std::chrono::steady_clock::time_point now,
+                               int fps);
+  bool ShouldCaptureCursor() const;
+  bool SyncDisplayInfo();
+  void SetDisplayInfoList(std::vector<DisplayInfo> displays);
+  void RecordCaptureCadence(std::chrono::steady_clock::time_point now, int fps,
+                            bool from_secure_desktop);
+
+  GuiRuntime &owner_;
+  SDL_AudioStream *output_stream_ = nullptr;
+  ScreenCapturerFactory *screen_capturer_factory_ = nullptr;
+  ScreenCapturer *screen_capturer_ = nullptr;
+  std::atomic<bool> cursor_capture_dirty_{true};
+  SpeakerCaptureController speaker_capture_;
+  DeviceControllerFactory *device_controller_factory_ = nullptr;
+  MouseController *mouse_controller_ = nullptr;
+  KeyboardCapturer *keyboard_capturer_ = nullptr;
+  // Guards display_info_list_ (UI thread writes, transport threads read).
+  mutable std::mutex display_info_mutex_;
+  std::vector<DisplayInfo> display_info_list_;
+  size_t registered_display_stream_count_ = 0;
+  std::deque<CapturedKeyboardInput> captured_keyboard_inputs_;
+  std::mutex captured_keyboard_inputs_mutex_;
+  std::chrono::steady_clock::time_point last_frame_time_{};
+  std::chrono::steady_clock::time_point next_frame_deadline_{};
+  std::mutex capture_metrics_mutex_;
+  std::chrono::steady_clock::time_point capture_metrics_started_{};
+  std::chrono::steady_clock::time_point last_capture_callback_{};
+  uint64_t capture_callbacks_ = 0, capture_rate_drops_ = 0;
+  uint64_t capture_secure_callbacks_ = 0;
+  uint64_t capture_forwarded_ = 0, capture_send_errors_ = 0;
+  int64_t capture_max_gap_us_ = 0;
+  int64_t capture_send_us_ = 0, capture_max_send_us_ = 0;
+  std::string last_video_frame_stream_id_;
+  bool invalid_video_stream_id_logged_ = false;
+};
+
+} // namespace crossdesk
+
+#endif

apps/desktop/src/gui/features/file_transfer/file_transfer_manager.cpp

@@ -0,0 +1,370 @@
+#include "features/file_transfer/file_transfer_manager.h"
+
+#include <algorithm>
+#include <chrono>
+#include <filesystem>
+#include <limits>
+#include <memory>
+#include <mutex>
+#include <shared_mutex>
+#include <string>
+#include <thread>
+#include <utility>
+
+#include "file_transfer.h"
+#include "filesystem_utf8.h"
+#include "rd_log.h"
+#include "runtime/gui_runtime.h"
+
+namespace crossdesk {
+
+FileTransferManager::FileTransferManager(GuiRuntime &owner) : owner_(owner) {}
+
+FileTransferManager::~FileTransferManager() {
+  std::vector<std::future<void>> workers;
+  {
+    std::lock_guard lock(workers_mutex_);
+    stopping_ = true;
+    workers.swap(workers_);
+  }
+  for (auto& worker : workers) worker.wait();
+}
+
+FileTransferManager::FileTransferState &FileTransferManager::global_state() {
+  return global_state_;
+}
+
+FileTransferManager::FileTransferState &FileTransferManager::state_for(
+    const std::shared_ptr<RemoteSession> &props) {
+  return props ? props->file_transfer_ : global_state_;
+}
+
+void FileTransferManager::ProcessSelectedFile(
+    const std::string &path,
+    const std::shared_ptr<RemoteSession> &props,
+    const std::string &file_label, const std::string &remote_id) {
+  if (path.empty()) {
+    return;
+  }
+
+  FileTransferState &state = state_for(props);
+  LOG_INFO("Selected file: {}", path.c_str());
+
+  const std::filesystem::path file_path = PathFromUtf8(path);
+  std::error_code ec;
+  if (!std::filesystem::is_regular_file(file_path, ec)) {
+    LOG_ERROR("Selected path is not a regular file: {}", path);
+    return;
+  }
+  const uint64_t file_size = std::filesystem::file_size(file_path, ec);
+  if (ec) {
+    LOG_ERROR("Failed to get file size: {}", ec.message());
+    return;
+  }
+
+  {
+    std::lock_guard<std::mutex> lock(state.file_transfer_list_mutex_);
+    FileTransferState::FileTransferInfo info;
+    const auto utf8_name = file_path.filename().u8string();
+    info.file_name.assign(reinterpret_cast<const char *>(utf8_name.data()),
+                          utf8_name.size());
+    info.file_path = file_path;
+    info.file_size = file_size;
+    info.status = FileTransferState::FileTransferStatus::Queued;
+    state.file_transfer_list_.push_back(std::move(info));
+  }
+  state.file_transfer_window_visible_ = true;
+
+  auto enqueue = [&]() {
+    size_t queue_size = 0;
+    {
+      std::lock_guard<std::mutex> lock(state.file_queue_mutex_);
+      state.file_send_queue_.push(
+          FileTransferState::QueuedFile{file_path, file_label, remote_id});
+      queue_size = state.file_send_queue_.size();
+    }
+    LOG_INFO("File added to queue: {} ({} files in queue)",
+             file_path.filename().string().c_str(), queue_size);
+  };
+
+  if (state.file_sending_.load()) {
+    enqueue();
+    return;
+  }
+
+  Start(props, file_path, file_label, remote_id);
+  if (!state.file_sending_.load()) {
+    enqueue();
+  }
+}
+
+void FileTransferManager::Start(
+    std::shared_ptr<RemoteSession> props,
+    const std::filesystem::path &file_path, const std::string &file_label,
+    const std::string &remote_id) {
+  if (props && props->closing_) return;
+  const bool is_global = !props;
+  PeerPtr* peer = nullptr;
+  std::shared_ptr<PeerEventHandler> peer_events;
+  {
+    std::shared_lock lock(owner_.remote_sessions_mutex_);
+    if (props && props->closing_) return;
+    peer = is_global ? owner_.peer_ : props->peer_;
+    peer_events = is_global ? owner_.peer_events_ : props->peer_events_;
+  }
+  if (!peer) {
+    LOG_ERROR("StartFileTransfer: invalid peer");
+    return;
+  }
+
+  FileTransferState &initial_state = state_for(props);
+  bool expected = false;
+  if (!initial_state.file_sending_.compare_exchange_strong(expected, true)) {
+    LOG_WARN("StartFileTransfer called while another file is active: {}",
+             file_path.filename().string().c_str());
+    return;
+  }
+
+  const auto props_weak = std::weak_ptr<RemoteSession>(props);
+  std::lock_guard workers_lock(workers_mutex_);
+  if (stopping_) return;
+  // Reap finished senders without blocking the UI.
+  std::erase_if(workers_, [](auto& worker) {
+    return worker.wait_for(std::chrono::seconds(0)) == std::future_status::ready;
+  });
+  workers_.push_back(std::async(std::launch::async,
+      [this, peer, peer_events, file_path, file_label, props_weak, remote_id,
+               is_global]() {
+    auto props_locked = props_weak.lock();
+    FileTransferState *state = nullptr;
+    if (props_locked) {
+      state = &props_locked->file_transfer_;
+    } else if (is_global) {
+      state = &global_state_;
+    } else {
+      return;
+    }
+
+    std::error_code ec;
+    const uint64_t total_size = std::filesystem::file_size(file_path, ec);
+    if (ec) {
+      LOG_ERROR("Failed to get file size: {}", ec.message().c_str());
+      state->file_sending_ = false;
+      return;
+    }
+
+    state->file_sent_bytes_ = 0;
+    state->file_total_bytes_ = total_size;
+    state->file_send_rate_bps_ = 0;
+    state->file_transfer_window_visible_ = true;
+    {
+      std::lock_guard<std::mutex> lock(state->file_transfer_mutex_);
+      state->file_send_start_time_ = std::chrono::steady_clock::now();
+      state->file_send_last_update_time_ = state->file_send_start_time_;
+      state->file_send_last_bytes_ = 0;
+    }
+
+    FileSender sender;
+    const uint32_t file_id = FileSender::NextFileId();
+    if (props_locked) {
+      std::lock_guard<std::shared_mutex> lock(file_id_to_props_mutex_);
+      file_id_to_props_[file_id] = props_weak;
+    } else {
+      std::lock_guard<std::shared_mutex> lock(file_id_to_state_mutex_);
+      file_id_to_state_[file_id] = state;
+    }
+    state->current_file_id_ = file_id;
+
+    {
+      std::lock_guard<std::mutex> lock(state->file_transfer_list_mutex_);
+      for (auto &info : state->file_transfer_list_) {
+        if (info.file_path == file_path &&
+            info.status == FileTransferState::FileTransferStatus::Queued) {
+          info.status = FileTransferState::FileTransferStatus::Sending;
+          info.file_id = file_id;
+          info.file_size = total_size;
+          info.sent_bytes = 0;
+          break;
+        }
+      }
+    }
+
+    const int ret = sender.SendFile(
+        file_path, file_path.filename().string(),
+        [peer, peer_events, file_label, remote_id, props_locked](const char *buffer, size_t size) {
+          // Close drains each in-flight send before detaching the peer.
+          if (props_locked && props_locked->closing_) return -1;
+          auto callback = peer_events->EnterCallback();
+          if (!callback) return -1;
+          if (remote_id.empty()) {
+            return SendReliableDataFrame(peer, buffer, size,
+                                         file_label.c_str());
+          }
+          return SendReliableDataFrameToPeer(
+              peer, buffer, size, file_label.c_str(), remote_id.c_str(),
+              remote_id.size());
+        },
+        64 * 1024, file_id);
+
+    if (ret == 0) {
+      return;
+    }
+
+    state->file_sending_ = false;
+    state->file_transfer_window_visible_ = false;
+    state->file_sent_bytes_ = 0;
+    state->file_total_bytes_ = 0;
+    state->file_send_rate_bps_ = 0;
+    state->current_file_id_ = 0;
+    Unregister(file_id, props_locked != nullptr);
+
+    {
+      std::lock_guard<std::mutex> lock(state->file_transfer_list_mutex_);
+      for (auto &info : state->file_transfer_list_) {
+        if (info.file_id == file_id) {
+          info.status = FileTransferState::FileTransferStatus::Failed;
+          break;
+        }
+      }
+    }
+    LOG_ERROR("FileSender::SendFile failed for [{}], ret={}",
+              file_path.string().c_str(), ret);
+    if (peer_events->IsActive()) ProcessQueue(props_locked);
+  }));
+}
+
+void FileTransferManager::ProcessQueue(
+    std::shared_ptr<RemoteSession> props) {
+  if (props && props->closing_) return;
+  FileTransferState &state = state_for(props);
+  if (state.file_sending_.load()) {
+    return;
+  }
+
+  FileTransferState::QueuedFile queued_file;
+  {
+    std::lock_guard<std::mutex> lock(state.file_queue_mutex_);
+    if (state.file_send_queue_.empty()) {
+      return;
+    }
+    queued_file = state.file_send_queue_.front();
+    state.file_send_queue_.pop();
+  }
+  Start(props, queued_file.file_path, queued_file.file_label,
+        queued_file.remote_id);
+}
+
+void FileTransferManager::Unregister(uint32_t file_id, bool per_peer) {
+  if (per_peer) {
+    std::lock_guard<std::shared_mutex> lock(file_id_to_props_mutex_);
+    file_id_to_props_.erase(file_id);
+  } else {
+    std::lock_guard<std::shared_mutex> lock(file_id_to_state_mutex_);
+    file_id_to_state_.erase(file_id);
+  }
+}
+
+void FileTransferManager::HandleAck(const char *data, size_t size) {
+  FileTransferAck ack{};
+  if (!DecodeFileTransferAck(data, size, &ack)) {
+    LOG_ERROR("FileTransferAck: invalid payload, size={}", size);
+    return;
+  }
+
+  std::shared_ptr<RemoteSession> props;
+  {
+    std::shared_lock lock(file_id_to_props_mutex_);
+    const auto it = file_id_to_props_.find(ack.file_id);
+    if (it != file_id_to_props_.end()) {
+      props = it->second.lock();
+    }
+  }
+
+  FileTransferState *state = props ? &props->file_transfer_ : nullptr;
+  if (!state) {
+    std::shared_lock lock(file_id_to_state_mutex_);
+    const auto it = file_id_to_state_.find(ack.file_id);
+    if (it != file_id_to_state_.end()) {
+      state = it->second;
+    }
+  }
+  if (!state) {
+    LOG_WARN("FileTransferAck: no state found for file_id={}", ack.file_id);
+    return;
+  }
+
+  state->file_sent_bytes_ = ack.acked_offset;
+  state->file_total_bytes_ = ack.total_size;
+  uint32_t rate_bps = 0;
+  if (props) {
+    const uint32_t bitrate =
+        props->net_traffic_stats_.DataOutboundBitrate();
+    if (bitrate > 0 && state->file_sending_.load()) {
+      rate_bps = static_cast<uint32_t>(bitrate * 0.99f);
+      const uint32_t current_rate = state->file_send_rate_bps_.load();
+      if (current_rate > 0) {
+        rate_bps = static_cast<uint32_t>(current_rate * 0.7 + rate_bps * 0.3);
+      }
+    } else {
+      rate_bps = state->file_send_rate_bps_.load();
+    }
+  } else {
+    const uint32_t current_rate = state->file_send_rate_bps_.load();
+    uint32_t estimated_rate = 0;
+    const auto now = std::chrono::steady_clock::now();
+    uint64_t last_bytes = 0;
+    std::chrono::steady_clock::time_point last_time;
+    {
+      std::lock_guard<std::mutex> lock(state->file_transfer_mutex_);
+      last_bytes = state->file_send_last_bytes_;
+      last_time = state->file_send_last_update_time_;
+    }
+    if (state->file_sending_.load() && ack.acked_offset >= last_bytes) {
+      const auto delta_bytes = ack.acked_offset - last_bytes;
+      const double seconds =
+          std::chrono::duration<double>(now - last_time).count();
+      if (seconds > 0.0 && delta_bytes > 0) {
+        const double bits_per_second = delta_bytes * 8.0 / seconds;
+        estimated_rate = static_cast<uint32_t>((std::min)(
+            bits_per_second,
+            static_cast<double>((std::numeric_limits<uint32_t>::max)())));
+      }
+    }
+    rate_bps =
+        estimated_rate > 0 && current_rate > 0
+            ? static_cast<uint32_t>(current_rate * 0.7 + estimated_rate * 0.3)
+        : estimated_rate > 0 ? estimated_rate
+                             : current_rate;
+  }
+
+  state->file_send_rate_bps_ = rate_bps;
+  state->file_send_last_bytes_ = ack.acked_offset;
+  state->file_send_last_update_time_ = std::chrono::steady_clock::now();
+  {
+    std::lock_guard<std::mutex> lock(state->file_transfer_list_mutex_);
+    for (auto &info : state->file_transfer_list_) {
+      if (info.file_id == ack.file_id) {
+        info.sent_bytes = ack.acked_offset;
+        info.file_size = ack.total_size;
+        info.rate_bps = rate_bps;
+        if ((ack.flags & 0x01) != 0) {
+          info.status = FileTransferState::FileTransferStatus::Completed;
+          info.sent_bytes = ack.total_size;
+        }
+        break;
+      }
+    }
+  }
+
+  if ((ack.flags & 0x01) == 0) {
+    return;
+  }
+  LOG_INFO("File transfer completed: file_id={}, bytes={}", ack.file_id,
+           ack.total_size);
+  state->file_transfer_window_visible_ = true;
+  state->file_sending_ = false;
+  Unregister(ack.file_id, props != nullptr);
+  ProcessQueue(props);
+}
+
+} // namespace crossdesk

apps/desktop/src/gui/features/file_transfer/file_transfer_manager.h

@@ -0,0 +1,61 @@
+#ifndef CROSSDESK_GUI_FILE_TRANSFER_MANAGER_H_
+#define CROSSDESK_GUI_FILE_TRANSFER_MANAGER_H_
+
+#include <cstddef>
+#include <cstdint>
+#include <filesystem>
+#include <future>
+#include <mutex>
+#include <vector>
+#include <memory>
+#include <shared_mutex>
+#include <string>
+#include <unordered_map>
+
+#include "runtime/remote_session.h"
+
+namespace crossdesk {
+
+class GuiRuntime;
+
+class FileTransferManager {
+public:
+  using FileTransferState = gui_detail::FileTransferState;
+  using RemoteSession = gui_detail::RemoteSession;
+
+  explicit FileTransferManager(GuiRuntime &owner);
+  ~FileTransferManager();
+
+  FileTransferState &global_state();
+  FileTransferState &
+  state_for(const std::shared_ptr<RemoteSession> &props);
+
+  void
+  ProcessSelectedFile(const std::string &path,
+                      const std::shared_ptr<RemoteSession> &props,
+                      const std::string &file_label,
+                      const std::string &remote_id = "");
+  void HandleAck(const char *data, size_t size);
+
+private:
+  void Start(std::shared_ptr<RemoteSession> props,
+             const std::filesystem::path &file_path,
+             const std::string &file_label, const std::string &remote_id = "");
+  void ProcessQueue(std::shared_ptr<RemoteSession> props);
+  void Unregister(uint32_t file_id, bool per_peer);
+
+  std::mutex workers_mutex_;
+  std::vector<std::future<void>> workers_;
+  bool stopping_ = false;
+  GuiRuntime &owner_;
+  FileTransferState global_state_;
+  std::unordered_map<uint32_t, std::weak_ptr<RemoteSession>>
+      file_id_to_props_;
+  std::shared_mutex file_id_to_props_mutex_;
+  std::unordered_map<uint32_t, FileTransferState *> file_id_to_state_;
+  std::shared_mutex file_id_to_state_mutex_;
+};
+
+} // namespace crossdesk
+
+#endif // CROSSDESK_GUI_FILE_TRANSFER_MANAGER_H_

apps/desktop/src/gui/features/input/keyboard_controller.cpp

@@ -0,0 +1,412 @@
+#include "features/input/keyboard_controller.h"
+
+#include <remote_action.h>
+
+#include <SDL3/SDL.h>
+
+#include <cstdint>
+#include <mutex>
+#include <nlohmann/json.hpp>
+#include <string>
+#include <unordered_map>
+#include <vector>
+
+#include "minirtc.h"
+#include "rd_log.h"
+#include "runtime/gui_runtime.h"
+#include "windows_key_metadata.h"
+#if _WIN32
+#include "interactive_state.h"
+#include "service_host.h"
+#endif
+
+namespace crossdesk {
+namespace {
+
+constexpr uint32_t kHeartbeatIntervalMs = 500;
+constexpr uint32_t kRemoteReleaseTimeoutMs = 2500;
+
+int NormalizeWindowsModifierVk(int key_code, uint32_t scan_code,
+                               bool extended) {
+#if _WIN32
+  if (key_code != 0x10 && key_code != 0x11 && key_code != 0x12) {
+    return key_code;
+  }
+
+  UINT scan_code_with_prefix = static_cast<UINT>(scan_code & 0xFF);
+  if (extended) {
+    scan_code_with_prefix |= 0xE000;
+  }
+  const UINT normalized_vk =
+      MapVirtualKeyW(scan_code_with_prefix, MAPVK_VSC_TO_VK_EX);
+  return normalized_vk != 0 ? static_cast<int>(normalized_vk) : key_code;
+#else
+  (void)scan_code;
+  (void)extended;
+  return key_code;
+#endif
+}
+
+void PopulateWindowsKeyMetadataFromVk(int key_code, uint32_t* scan_code_out,
+                                      bool* extended_out) {
+  if (!scan_code_out || !extended_out) {
+    return;
+  }
+  if (LookupWindowsKeyMetadataFromVk(key_code, scan_code_out, extended_out)) {
+    return;
+  }
+#if _WIN32
+  const UINT scan_code =
+      MapVirtualKeyW(static_cast<UINT>(key_code), MAPVK_VK_TO_VSC_EX);
+  if (scan_code != 0) {
+    *scan_code_out = static_cast<uint32_t>(scan_code & 0xFF);
+    *extended_out = (scan_code & 0xFF00) != 0;
+    return;
+  }
+#endif
+}
+
+#if _WIN32
+constexpr uint32_t kSecureDesktopInputLogIntervalMs = 2000;
+
+void LogSecureDesktopInputBlocked(uint32_t* last_tick, const char* stage) {
+  const uint32_t now = static_cast<uint32_t>(SDL_GetTicks());
+  if (*last_tick != 0 && now - *last_tick < kSecureDesktopInputLogIntervalMs) {
+    return;
+  }
+  *last_tick = now;
+  LOG_WARN(
+      "local secure-desktop input blocked, stage={}, normal SendInput path "
+      "cannot drive the Windows password UI",
+      stage ? stage : "");
+}
+
+bool IsTransientSecureDesktopInputFailure(const nlohmann::json& response,
+                                          const RemoteAction& action) {
+  return response.is_object() &&
+         response.value("error", std::string()) == "send_input_failed" &&
+         response.value("code", 0u) == ERROR_ACCESS_DENIED &&
+         action.type == ControlType::keyboard &&
+         action.k.flag == KeyFlag::key_up;
+}
+#endif
+
+}  // namespace
+
+KeyboardController::KeyboardController(GuiRuntime& owner) : owner_(owner) {}
+
+void KeyboardController::TrackPressedKey(int key_code, bool is_down,
+                                         uint32_t scan_code, bool extended) {
+  std::lock_guard<std::mutex> lock(pressed_keys_mutex_);
+  if (is_down) {
+    pressed_keys_[key_code] = PressedKey{key_code, scan_code, extended};
+  } else {
+    pressed_keys_.erase(key_code);
+  }
+}
+
+void KeyboardController::ForceReleasePressedKeys() {
+  std::vector<PressedKey> pressed_keys;
+  {
+    std::lock_guard<std::mutex> lock(pressed_keys_mutex_);
+    pressed_keys.reserve(pressed_keys_.size());
+    for (const auto& [_, key] : pressed_keys_) {
+      pressed_keys.push_back(key);
+    }
+    pressed_keys_.clear();
+  }
+
+  for (const PressedKey& key : pressed_keys) {
+    SendKeyCommand(key.key_code, false, key.scan_code, key.extended);
+  }
+  SendHeartbeat(true);
+}
+
+void KeyboardController::SendHeartbeat(bool force) {
+  const uint32_t now = static_cast<uint32_t>(SDL_GetTicks());
+  if (!force && now - last_heartbeat_tick_ < kHeartbeatIntervalMs) {
+    return;
+  }
+
+  RemoteAction action{};
+  action.type = ControlType::keyboard_state;
+  action.ks.seq = ++state_sequence_;
+  {
+    std::lock_guard<std::mutex> lock(pressed_keys_mutex_);
+    size_t index = 0;
+    for (const auto& [_, key] : pressed_keys_) {
+      if (index >= kMaxKeyboardStateKeys) {
+        LOG_WARN("Keyboard heartbeat truncated, pressed_keys={}",
+                 pressed_keys_.size());
+        break;
+      }
+      action.ks.pressed_keys[index].key_value =
+          static_cast<size_t>(key.key_code);
+      action.ks.pressed_keys[index].scan_code = key.scan_code;
+      action.ks.pressed_keys[index].extended = key.extended;
+      ++index;
+    }
+    action.ks.pressed_count = index;
+  }
+
+  const std::string target_id = owner_.controlled_remote_id_.empty()
+                                    ? owner_.focused_remote_id_
+                                    : owner_.controlled_remote_id_;
+  std::shared_lock sessions_lock(owner_.remote_sessions_mutex_);
+  const auto props_it = owner_.remote_sessions_.find(target_id);
+  if (target_id.empty() || props_it == owner_.remote_sessions_.end() ||
+      props_it->second->connection_status_.load() !=
+          ConnectionStatus::Connected ||
+      !props_it->second->peer_) {
+    last_heartbeat_tick_ = now;
+    return;
+  }
+
+  const std::string message = action.to_json();
+  const int result = SendReliableDataFrame(
+      props_it->second->peer_, message.c_str(), message.size(),
+      props_it->second->keyboard_label_.c_str());
+  if (result != 0) {
+    LOG_WARN("Send keyboard heartbeat failed, remote_id={}, ret={}", target_id,
+             result);
+  }
+  last_heartbeat_tick_ = now;
+}
+
+int KeyboardController::SendKeyCommand(int key_code, bool is_down,
+                                       uint32_t scan_code, bool extended) {
+  if (scan_code == 0) {
+    PopulateWindowsKeyMetadataFromVk(key_code, &scan_code, &extended);
+  }
+#if _WIN32
+  key_code = NormalizeWindowsModifierVk(key_code, scan_code, extended);
+#endif
+
+  RemoteAction action{};
+  action.type = ControlType::keyboard;
+  action.k.flag = is_down ? KeyFlag::key_down : KeyFlag::key_up;
+  action.k.key_value = key_code;
+  action.k.scan_code = scan_code;
+  action.k.extended = extended;
+
+  const std::string target_id = owner_.controlled_remote_id_.empty()
+                                    ? owner_.focused_remote_id_
+                                    : owner_.controlled_remote_id_;
+  std::shared_lock sessions_lock(owner_.remote_sessions_mutex_);
+  const auto props_it = owner_.remote_sessions_.find(target_id);
+  if (!target_id.empty() && props_it != owner_.remote_sessions_.end() &&
+      props_it->second->connection_status_.load() ==
+          ConnectionStatus::Connected &&
+      props_it->second->peer_) {
+    const std::string message = action.to_json();
+    const int result = SendReliableDataFrame(
+        props_it->second->peer_, message.c_str(), message.size(),
+        props_it->second->keyboard_label_.c_str());
+    if (result != 0) {
+      LOG_WARN("Send keyboard command failed, remote_id={}, ret={}", target_id,
+               result);
+    }
+  }
+
+  TrackPressedKey(key_code, is_down, scan_code, extended);
+  return 0;
+}
+
+bool KeyboardController::InjectRemoteKey(int key_code, bool is_down,
+                                         uint32_t scan_code, bool extended) {
+#if _WIN32
+  if (owner_.privacy_.Engaged() && !IsWindowsPrivacyDesktopAvailable()) {
+    owner_.privacy_.Fail("Secure desktop or locked session; privacy screen will turn off");
+  }
+  if (owner_.local_service_status_received_ &&
+      IsSecureDesktopInteractionRequired(owner_.local_interactive_stage_)) {
+    const std::string response = SendCrossDeskSecureDesktopKeyInput(
+        key_code, is_down, scan_code, extended, 1000);
+    const auto json = nlohmann::json::parse(response, nullptr, false);
+    if (json.is_discarded() || !json.value("ok", false)) {
+      RemoteAction action{};
+      action.type = ControlType::keyboard;
+      action.k.key_value = static_cast<size_t>(key_code);
+      action.k.scan_code = scan_code;
+      action.k.extended = extended;
+      action.k.flag = is_down ? KeyFlag::key_down : KeyFlag::key_up;
+      if (!json.is_discarded() &&
+          IsTransientSecureDesktopInputFailure(json, action)) {
+        LOG_INFO(
+            "Secure desktop keyboard injection transient failure, "
+            "key_code={}, is_down={}, response={}",
+            key_code, is_down, response);
+        return true;
+      }
+
+      LogSecureDesktopInputBlocked(
+          &owner_.last_local_secure_input_block_log_tick_,
+          owner_.local_interactive_stage_.c_str());
+      LOG_WARN(
+          "Secure desktop keyboard injection failed, key_code={}, is_down={}, "
+          "response={}",
+          key_code, is_down, response);
+      return false;
+    }
+    return true;
+  }
+#endif
+  // Recheck after the desktop query; key-up cleanup remains allowed while paused.
+  return owner_.devices_.SendKeyboardCommand(key_code, is_down, scan_code,
+                                             extended);
+}
+
+void KeyboardController::ApplyRemoteEvent(const std::string& remote_id,
+                                          const RemoteAction& action) {
+  const int key_code = static_cast<int>(action.k.key_value);
+  const bool is_down = action.k.flag == KeyFlag::key_down;
+  const bool injected =
+      InjectRemoteKey(key_code, is_down, action.k.scan_code, action.k.extended);
+
+  std::lock_guard<std::mutex> lock(remote_states_mutex_);
+  auto& state = remote_states_[remote_id];
+  state.last_seen_tick = static_cast<uint32_t>(SDL_GetTicks());
+  if (is_down && injected) {
+    state.pressed_keys[key_code] =
+        PressedKey{key_code, action.k.scan_code, action.k.extended};
+  } else if (!is_down && injected) {
+    state.pressed_keys.erase(key_code);
+  }
+}
+
+void KeyboardController::ApplyRemoteState(const std::string& remote_id,
+                                          const RemoteAction& action) {
+  std::vector<PressedKey> keys_to_release;
+  std::vector<PressedKey> keys_to_press;
+  {
+    std::lock_guard<std::mutex> lock(remote_states_mutex_);
+    auto& state = remote_states_[remote_id];
+    if (action.ks.seq != 0 && state.last_seq != 0 &&
+        static_cast<int32_t>(action.ks.seq - state.last_seq) <= 0) {
+      return;
+    }
+
+    state.last_seq = action.ks.seq;
+    state.last_seen_tick = static_cast<uint32_t>(SDL_GetTicks());
+    state.keyboard_state_seen = true;
+
+    std::unordered_map<int, PressedKey> desired_keys;
+    const size_t count =
+        (std::min)(action.ks.pressed_count, kMaxKeyboardStateKeys);
+    for (size_t index = 0; index < count; ++index) {
+      const auto& key = action.ks.pressed_keys[index];
+      const int key_code = static_cast<int>(key.key_value);
+      desired_keys[key_code] =
+          PressedKey{key_code, key.scan_code, key.extended};
+    }
+    for (const auto& [key_code, key] : state.pressed_keys) {
+      if (desired_keys.find(key_code) == desired_keys.end()) {
+        keys_to_release.push_back(key);
+      }
+    }
+    for (const auto& [key_code, key] : desired_keys) {
+      if (state.pressed_keys.find(key_code) == state.pressed_keys.end()) {
+        keys_to_press.push_back(key);
+      }
+    }
+  }
+
+  for (const PressedKey& key : keys_to_release) {
+    if (InjectRemoteKey(key.key_code, false, key.scan_code, key.extended)) {
+      std::lock_guard<std::mutex> lock(remote_states_mutex_);
+      const auto state_it = remote_states_.find(remote_id);
+      if (state_it != remote_states_.end()) {
+        state_it->second.pressed_keys.erase(key.key_code);
+      }
+    }
+  }
+  for (const PressedKey& key : keys_to_press) {
+    if (InjectRemoteKey(key.key_code, true, key.scan_code, key.extended)) {
+      std::lock_guard<std::mutex> lock(remote_states_mutex_);
+      remote_states_[remote_id].pressed_keys[key.key_code] = key;
+    }
+  }
+}
+
+void KeyboardController::ReleaseRemotePressedKeys(const std::string& remote_id,
+                                                  const char* reason) {
+  std::vector<PressedKey> keys_to_release;
+  {
+    std::lock_guard<std::mutex> lock(remote_states_mutex_);
+    const auto state_it = remote_states_.find(remote_id);
+    if (state_it == remote_states_.end()) {
+      return;
+    }
+    for (const auto& [_, key] : state_it->second.pressed_keys) {
+      keys_to_release.push_back(key);
+    }
+    remote_states_.erase(state_it);
+  }
+
+  if (!keys_to_release.empty()) {
+    LOG_WARN("Releasing {} remote keyboard keys for remote_id={}, reason={}",
+             keys_to_release.size(), remote_id, reason ? reason : "unknown");
+  }
+  for (const PressedKey& key : keys_to_release) {
+    if (!InjectRemoteKey(key.key_code, false, key.scan_code, key.extended)) {
+#ifdef _WIN32
+      if (owner_.privacy_.Engaged()) {
+        std::lock_guard lock(remote_states_mutex_);
+        pending_privacy_releases_[key.key_code] = key;
+      }
+#endif
+    }
+  }
+}
+
+void KeyboardController::ReleaseAllRemotePressedKeys(const char* reason) {
+  std::vector<std::string> remotes;
+  {
+    std::lock_guard lock(remote_states_mutex_);
+    for (const auto& [id, state] : remote_states_) remotes.push_back(id);
+  }
+  for (const auto& id : remotes) ReleaseRemotePressedKeys(id, reason);
+  CheckRemoteTimeouts();
+}
+
+void KeyboardController::CheckRemoteTimeouts() {
+#ifdef _WIN32
+  bool pending = false;
+  {
+    std::lock_guard lock(remote_states_mutex_);
+    pending = !pending_privacy_releases_.empty();
+  }
+  // A key-up rejected on the secure desktop is retained until the ordinary
+  // desktop returns. Never route cleanup through the security UI helper.
+  if (pending && IsWindowsPrivacyDesktopAvailable()) {
+    std::unordered_map<int, PressedKey> releases;
+    {
+      std::lock_guard lock(remote_states_mutex_);
+      releases.swap(pending_privacy_releases_);
+    }
+    for (const auto& [code, key] : releases) {
+      if (!owner_.devices_.SendKeyboardCommand(code, false, key.scan_code, key.extended)) {
+        std::lock_guard lock(remote_states_mutex_);
+        pending_privacy_releases_[code] = key;
+      }
+    }
+  }
+#endif
+  const uint32_t now = static_cast<uint32_t>(SDL_GetTicks());
+  std::vector<std::string> timed_out_remotes;
+  {
+    std::lock_guard<std::mutex> lock(remote_states_mutex_);
+    for (const auto& [remote_id, state] : remote_states_) {
+      if (state.keyboard_state_seen && !state.pressed_keys.empty() &&
+          state.last_seen_tick != 0 &&
+          now - state.last_seen_tick > kRemoteReleaseTimeoutMs) {
+        timed_out_remotes.push_back(remote_id);
+      }
+    }
+  }
+  for (const std::string& remote_id : timed_out_remotes) {
+    ReleaseRemotePressedKeys(remote_id, "keyboard_heartbeat_timeout");
+  }
+}
+
+}  // namespace crossdesk

apps/desktop/src/gui/features/input/keyboard_controller.h

@@ -0,0 +1,69 @@
+#ifndef CROSSDESK_GUI_KEYBOARD_CONTROLLER_H_
+#define CROSSDESK_GUI_KEYBOARD_CONTROLLER_H_
+
+#include <cstdint>
+#include <mutex>
+#include <string>
+#include <unordered_map>
+
+#include <remote_action.h>
+
+#include "device_controller.h"
+
+namespace crossdesk {
+
+class GuiRuntime;
+
+// Synchronizes local and remote keyboard state, including heartbeat recovery
+// for keys whose key-up event was lost during a connection interruption.
+class KeyboardController {
+public:
+  explicit KeyboardController(GuiRuntime &owner);
+
+  int SendKeyCommand(int key_code, bool is_down, uint32_t scan_code = 0,
+                     bool extended = false);
+  void ForceReleasePressedKeys();
+  void SendHeartbeat(bool force);
+  void ApplyRemoteEvent(const std::string &remote_id,
+                        const RemoteAction &remote_action);
+  void ApplyRemoteState(const std::string &remote_id,
+                        const RemoteAction &remote_action);
+  void ReleaseRemotePressedKeys(const std::string &remote_id,
+                                const char *reason);
+  void ReleaseAllRemotePressedKeys(const char* reason);
+  void CheckRemoteTimeouts();
+
+private:
+  struct PressedKey {
+    int key_code = 0;
+    uint32_t scan_code = 0;
+    bool extended = false;
+  };
+
+  struct RemoteState {
+    std::unordered_map<int, PressedKey> pressed_keys;
+    uint32_t last_seq = 0;
+    uint32_t last_seen_tick = 0;
+    bool keyboard_state_seen = false;
+  };
+
+  void TrackPressedKey(int key_code, bool is_down, uint32_t scan_code,
+                       bool extended);
+  bool InjectRemoteKey(int key_code, bool is_down, uint32_t scan_code,
+                       bool extended);
+
+  GuiRuntime &owner_;
+  std::unordered_map<int, PressedKey> pressed_keys_;
+  std::mutex pressed_keys_mutex_;
+  uint32_t state_sequence_ = 0;
+  uint32_t last_heartbeat_tick_ = 0;
+  std::unordered_map<std::string, RemoteState> remote_states_;
+  std::mutex remote_states_mutex_;
+#ifdef _WIN32
+  std::unordered_map<int, PressedKey> pending_privacy_releases_;
+#endif
+};
+
+} // namespace crossdesk
+
+#endif // CROSSDESK_GUI_KEYBOARD_CONTROLLER_H_

apps/desktop/src/gui/features/settings/settings_manager.cpp

@@ -0,0 +1,600 @@
+#include "features/settings/settings_manager.h"
+
+#include <chrono>
+#include <cstddef>
+#include <cstdio>
+#include <cstring>
+#include <exception>
+#include <filesystem>
+#include <fstream>
+#include <functional>
+#include <memory>
+#include <nlohmann/json.hpp>
+#include <string>
+#include <thread>
+
+#if defined(_WIN32)
+#include <io.h>
+#include <windows.h>
+#else
+#include <fcntl.h>
+#include <unistd.h>
+#endif
+
+#include "localization.h"
+#include "rd_log.h"
+#include "runtime/gui_runtime.h"
+
+namespace crossdesk {
+namespace {
+
+constexpr uint32_t kCacheV3Magic = 0x33444358;  // "XCD3"
+constexpr uint32_t kCacheV3Version = 3;
+
+template <size_t Size>
+void CopyString(char (&destination)[Size], const char *source) {
+  static_assert(Size > 0);
+  std::memset(destination, 0, Size);
+  if (source) {
+    std::strncpy(destination, source, Size - 1);
+  }
+}
+
+uint32_t CacheChecksum(const void *data, size_t size) {
+  const auto *bytes = static_cast<const unsigned char *>(data);
+  uint32_t hash = 2166136261u;
+  for (size_t i = 0; i < size; ++i) {
+    hash ^= bytes[i];
+    hash *= 16777619u;
+  }
+  return hash;
+}
+
+std::filesystem::path TemporaryPathFor(
+    const std::filesystem::path &target) {
+  const auto timestamp = std::chrono::steady_clock::now()
+                             .time_since_epoch()
+                             .count();
+  const auto thread_id =
+      std::hash<std::thread::id>{}(std::this_thread::get_id());
+  std::filesystem::path temporary = target;
+  temporary += ".tmp-" + std::to_string(timestamp) + "-" +
+               std::to_string(thread_id);
+  return temporary;
+}
+
+bool FlushFileToDisk(FILE *file) {
+  if (!file || std::fflush(file) != 0) {
+    return false;
+  }
+#if defined(_WIN32)
+  return _commit(_fileno(file)) == 0;
+#else
+  return fsync(fileno(file)) == 0;
+#endif
+}
+
+bool ReplaceFileAtomically(const std::filesystem::path &temporary,
+                           const std::filesystem::path &target) {
+#if defined(_WIN32)
+  return MoveFileExW(temporary.c_str(), target.c_str(),
+                     MOVEFILE_REPLACE_EXISTING | MOVEFILE_WRITE_THROUGH) != 0;
+#else
+  if (::rename(temporary.c_str(), target.c_str()) != 0) {
+    return false;
+  }
+
+  const std::filesystem::path parent = target.parent_path().empty()
+                                           ? std::filesystem::path(".")
+                                           : target.parent_path();
+  int directory_flags = O_RDONLY;
+#if defined(O_DIRECTORY)
+  directory_flags |= O_DIRECTORY;
+#endif
+  const int directory = open(parent.c_str(), directory_flags);
+  if (directory >= 0) {
+    const bool synced = fsync(directory) == 0;
+    close(directory);
+    return synced;
+  }
+  return false;
+#endif
+}
+
+bool WriteFileAtomically(const std::filesystem::path &target,
+                         const void *data, size_t size) {
+  std::error_code ec;
+  const std::filesystem::path parent = target.parent_path();
+  if (!parent.empty()) {
+    std::filesystem::create_directories(parent, ec);
+    if (ec) {
+      return false;
+    }
+  }
+
+  const std::filesystem::path temporary = TemporaryPathFor(target);
+#if defined(_WIN32)
+  FILE *file = _wfopen(temporary.c_str(), L"wb");
+#else
+  FILE *file = std::fopen(temporary.c_str(), "wb");
+#endif
+  if (!file) {
+    return false;
+  }
+
+  const bool written = std::fwrite(data, 1, size, file) == size;
+  const bool flushed = written && FlushFileToDisk(file);
+  const bool closed = std::fclose(file) == 0;
+  if (!written || !flushed || !closed ||
+      !ReplaceFileAtomically(temporary, target)) {
+    std::filesystem::remove(temporary, ec);
+    return false;
+  }
+  return true;
+}
+
+} // namespace
+
+SettingsManager::SettingsManager(GuiRuntime &owner) : owner_(owner) {}
+
+int SettingsManager::Save() {
+  std::lock_guard<std::mutex> lock(cache_mutex_);
+  return SaveLocked();
+}
+
+int SettingsManager::SaveLocked() {
+  CopyString(cache_v2_.client_id_with_password,
+             owner_.client_id_with_password_);
+  std::memcpy(cache_v2_.key, owner_.aes128_key_, sizeof(owner_.aes128_key_));
+  std::memcpy(cache_v2_.iv, owner_.aes128_iv_, sizeof(owner_.aes128_iv_));
+  CopyString(cache_v2_.self_hosted_id, owner_.self_hosted_id_);
+
+  cache_v3_.magic = kCacheV3Magic;
+  cache_v3_.version = kCacheV3Version;
+  cache_v3_.base = cache_v2_;
+  cache_v3_.pending_identity[sizeof(cache_v3_.pending_identity) - 1] = '\0';
+  cache_v3_.pending_server_host[sizeof(cache_v3_.pending_server_host) - 1] =
+      '\0';
+  cache_v3_.pending_request_id[sizeof(cache_v3_.pending_request_id) - 1] =
+      '\0';
+  cache_v3_.checksum =
+      CacheChecksum(&cache_v3_, offsetof(CacheV3, checksum));
+
+  if (!WriteFileAtomically(owner_.cache_path_ + "/secure_cache_v3.enc",
+                           &cache_v3_, sizeof(cache_v3_))) {
+    return -1;
+  }
+
+  if (!WriteFileAtomically(owner_.cache_path_ + "/secure_cache_v2.enc",
+                           &cache_v2_, sizeof(cache_v2_))) {
+    LOG_WARN("Failed to update legacy v2 credential cache");
+  }
+
+  // Keep writing the legacy cache while older installations may still read it.
+  CopyString(cache_v1_.client_id_with_password,
+             owner_.client_id_with_password_);
+  std::memcpy(cache_v1_.key, owner_.aes128_key_, sizeof(owner_.aes128_key_));
+  std::memcpy(cache_v1_.iv, owner_.aes128_iv_, sizeof(owner_.aes128_iv_));
+  if (!WriteFileAtomically(owner_.cache_path_ + "/secure_cache.enc",
+                           &cache_v1_, sizeof(cache_v1_))) {
+    LOG_WARN("Failed to update legacy v1 credential cache");
+  }
+
+  return 0;
+}
+
+bool SettingsManager::ReadV3Locked() {
+  std::ifstream cache_file(owner_.cache_path_ + "/secure_cache_v3.enc",
+                           std::ios::binary);
+  if (!cache_file) {
+    return false;
+  }
+
+  CacheV3 loaded{};
+  cache_file.read(reinterpret_cast<char *>(&loaded), sizeof(loaded));
+  if (cache_file.gcount() != static_cast<std::streamsize>(sizeof(loaded)) ||
+      loaded.magic != kCacheV3Magic ||
+      loaded.version != kCacheV3Version ||
+      loaded.checksum != CacheChecksum(&loaded, offsetof(CacheV3, checksum))) {
+    LOG_WARN("Ignore invalid v3 credential cache");
+    return false;
+  }
+
+  loaded.base.client_id_with_password
+      [sizeof(loaded.base.client_id_with_password) - 1] = '\0';
+  loaded.base.self_hosted_id[sizeof(loaded.base.self_hosted_id) - 1] = '\0';
+  loaded.pending_identity[sizeof(loaded.pending_identity) - 1] = '\0';
+  loaded.pending_server_host[sizeof(loaded.pending_server_host) - 1] = '\0';
+  loaded.pending_request_id[sizeof(loaded.pending_request_id) - 1] = '\0';
+  cache_v3_ = loaded;
+  cache_v2_ = loaded.base;
+  return true;
+}
+
+bool SettingsManager::ReadV2Locked() {
+  std::ifstream cache_v2_file(owner_.cache_path_ + "/secure_cache_v2.enc",
+                              std::ios::binary);
+  if (!cache_v2_file) {
+    return false;
+  }
+  cache_v2_file.read(reinterpret_cast<char *>(&cache_v2_), sizeof(cache_v2_));
+  if (cache_v2_file.gcount() !=
+      static_cast<std::streamsize>(sizeof(cache_v2_))) {
+    return false;
+  }
+  cache_v2_
+      .client_id_with_password[sizeof(cache_v2_.client_id_with_password) - 1] =
+      '\0';
+  cache_v2_.self_hosted_id[sizeof(cache_v2_.self_hosted_id) - 1] = '\0';
+  return true;
+}
+
+int SettingsManager::Load() {
+  std::unique_lock<std::mutex> lock(cache_mutex_);
+
+  const bool loaded_v3 = ReadV3Locked();
+  if (loaded_v3 || ReadV2Locked()) {
+    CopyString(owner_.client_id_with_password_,
+               cache_v2_.client_id_with_password);
+    CopyString(owner_.self_hosted_id_, cache_v2_.self_hosted_id);
+    std::memcpy(owner_.aes128_key_, cache_v2_.key, sizeof(cache_v2_.key));
+    std::memcpy(owner_.aes128_iv_, cache_v2_.iv, sizeof(cache_v2_.iv));
+    if (loaded_v3) {
+      LOG_INFO("Load settings from v3 cache file");
+    } else {
+      cache_v3_ = {};
+      SaveLocked();
+      LOG_INFO("Migrated settings from v2 to v3 cache file");
+    }
+  } else {
+    std::ifstream cache_v1_file(owner_.cache_path_ + "/secure_cache.enc",
+                                std::ios::binary);
+    if (!cache_v1_file) {
+      lock.unlock();
+
+      std::memset(owner_.password_saved_, 0, sizeof(owner_.password_saved_));
+      std::memset(owner_.aes128_key_, 0, sizeof(owner_.aes128_key_));
+      std::memset(owner_.aes128_iv_, 0, sizeof(owner_.aes128_iv_));
+      std::memset(owner_.self_hosted_id_, 0, sizeof(owner_.self_hosted_id_));
+
+      owner_.thumbnail_ =
+          std::make_shared<Thumbnail>(owner_.cache_path_ + "/thumbnails/");
+      owner_.thumbnail_->GetKeyAndIv(owner_.aes128_key_, owner_.aes128_iv_);
+      owner_.thumbnail_->DeleteAllFilesInDirectory();
+
+      Save();
+      return -1;
+    }
+
+    cache_v1_file.read(reinterpret_cast<char *>(&cache_v1_), sizeof(cache_v1_));
+    cache_v1_
+        .client_id_with_password[sizeof(cache_v1_.client_id_with_password) -
+                                 1] = '\0';
+
+    CopyString(cache_v2_.client_id_with_password,
+               cache_v1_.client_id_with_password);
+    std::memcpy(cache_v2_.key, cache_v1_.key, sizeof(cache_v1_.key));
+    std::memcpy(cache_v2_.iv, cache_v1_.iv, sizeof(cache_v1_.iv));
+    std::memset(cache_v2_.self_hosted_id, 0, sizeof(cache_v2_.self_hosted_id));
+
+    CopyString(owner_.client_id_with_password_,
+               cache_v1_.client_id_with_password);
+    std::memset(owner_.self_hosted_id_, 0, sizeof(owner_.self_hosted_id_));
+    std::memcpy(owner_.aes128_key_, cache_v1_.key, sizeof(cache_v1_.key));
+    std::memcpy(owner_.aes128_iv_, cache_v1_.iv, sizeof(cache_v1_.iv));
+
+    cache_v3_ = {};
+    SaveLocked();
+    LOG_INFO("Migrated settings from v1 to v3 cache file");
+  }
+
+  lock.unlock();
+
+  ActivateCachedPublicIdentity();
+
+  owner_.thumbnail_ =
+      std::make_shared<Thumbnail>(owner_.cache_path_ + "/thumbnails/",
+                                  owner_.aes128_key_, owner_.aes128_iv_);
+
+  owner_.language_button_value_ = localization::detail::ClampLanguageIndex(
+      static_cast<int>(owner_.config_center_->GetLanguage()));
+  owner_.video_encode_format_button_value_ =
+      static_cast<int>(owner_.config_center_->GetVideoEncodeFormat());
+  owner_.enable_hardware_video_codec_ =
+      owner_.config_center_->IsHardwareVideoCodec();
+  owner_.enable_turn_ = owner_.config_center_->IsEnableTurn();
+  owner_.enable_self_hosted_ = owner_.config_center_->IsSelfHosted();
+  owner_.enable_autostart_ = owner_.config_center_->IsEnableAutostart();
+  owner_.enable_daemon_ = owner_.config_center_->IsEnableDaemon();
+#if _WIN32 && CROSSDESK_PORTABLE
+  owner_.portable_service_prompt_suppressed_ =
+      owner_.config_center_->IsPortableServicePromptSuppressed();
+  owner_.portable_service_do_not_remind_ =
+      owner_.portable_service_prompt_suppressed_;
+#endif
+
+  const std::string saved_path =
+      owner_.config_center_->GetFileTransferSavePath();
+  CopyString(owner_.file_transfer_save_path_buf_, saved_path.c_str());
+  owner_.file_transfer_save_path_last_ = saved_path;
+
+  owner_.language_button_value_last_ = owner_.language_button_value_;
+  owner_.video_encode_format_button_value_last_ =
+      owner_.video_encode_format_button_value_;
+  owner_.enable_hardware_video_codec_last_ =
+      owner_.enable_hardware_video_codec_;
+  owner_.enable_turn_last_ = owner_.enable_turn_;
+  owner_.enable_self_hosted_last_ = owner_.enable_self_hosted_;
+  owner_.enable_autostart_last_ = owner_.enable_autostart_;
+
+  LOG_INFO("Load settings from cache file");
+  return 0;
+}
+
+bool SettingsManager::LoadCachedSelfHostedIdentity() {
+  std::lock_guard<std::mutex> lock(cache_mutex_);
+  if ((!ReadV3Locked() && !ReadV2Locked()) ||
+      cache_v2_.self_hosted_id[0] == '\0') {
+    std::memset(owner_.self_hosted_id_, 0, sizeof(owner_.self_hosted_id_));
+    std::memset(owner_.client_id_, 0, sizeof(owner_.client_id_));
+    std::memset(owner_.password_saved_, 0, sizeof(owner_.password_saved_));
+    return false;
+  }
+
+  CopyString(owner_.self_hosted_id_, cache_v2_.self_hosted_id);
+  const char *at_pos = std::strchr(owner_.self_hosted_id_, '@');
+  if (at_pos == nullptr) {
+    CopyString(owner_.client_id_, owner_.self_hosted_id_);
+    std::memset(owner_.password_saved_, 0, sizeof(owner_.password_saved_));
+  } else {
+    const std::string id(owner_.self_hosted_id_,
+                         at_pos - owner_.self_hosted_id_);
+    CopyString(owner_.client_id_, id.c_str());
+    CopyString(owner_.password_saved_, at_pos + 1);
+  }
+  return true;
+}
+
+bool SettingsManager::ActivateCachedPublicIdentity() {
+  if (owner_.client_id_with_password_[0] == '\0') {
+    std::memset(owner_.client_id_, 0, sizeof(owner_.client_id_));
+    std::memset(owner_.password_saved_, 0, sizeof(owner_.password_saved_));
+    return false;
+  }
+
+  const char *at_pos = std::strchr(owner_.client_id_with_password_, '@');
+  if (at_pos == nullptr) {
+    CopyString(owner_.client_id_, owner_.client_id_with_password_);
+    std::memset(owner_.password_saved_, 0, sizeof(owner_.password_saved_));
+  } else {
+    const std::string id(owner_.client_id_with_password_,
+                         at_pos - owner_.client_id_with_password_);
+    CopyString(owner_.client_id_, id.c_str());
+    CopyString(owner_.password_saved_, at_pos + 1);
+  }
+  return owner_.client_id_[0] != '\0';
+}
+
+void SettingsManager::ActivateIdentity(const char *identity,
+                                       bool self_hosted) {
+  if (!identity) {
+    return;
+  }
+
+  if (self_hosted) {
+    CopyString(owner_.self_hosted_id_, identity);
+  } else {
+    CopyString(owner_.client_id_with_password_, identity);
+  }
+
+  const char *at_pos = std::strchr(identity, '@');
+  if (at_pos == nullptr) {
+    CopyString(owner_.client_id_, identity);
+    std::memset(owner_.password_saved_, 0, sizeof(owner_.password_saved_));
+    return;
+  }
+
+  const std::string id(identity, at_pos - identity);
+  CopyString(owner_.client_id_, id.c_str());
+  CopyString(owner_.password_saved_, at_pos + 1);
+}
+
+bool SettingsManager::StagePendingPasswordChange(
+    const std::string &identity, bool self_hosted,
+    const std::string &server_host, int server_port,
+    const std::string &request_id) {
+  if (identity.empty() || identity.size() >= sizeof(cache_v3_.pending_identity) ||
+      server_host.empty() ||
+      server_host.size() >= sizeof(cache_v3_.pending_server_host) ||
+      server_port <= 0 || request_id.empty() ||
+      request_id.size() >= sizeof(cache_v3_.pending_request_id)) {
+    return false;
+  }
+
+  std::lock_guard<std::mutex> lock(cache_mutex_);
+  if (cache_v3_.pending_identity[0] != '\0' &&
+      (cache_v3_.pending_self_hosted != self_hosted ||
+       cache_v3_.pending_server_port != server_port ||
+       server_host != cache_v3_.pending_server_host ||
+       request_id != cache_v3_.pending_request_id)) {
+    LOG_WARN("Refuse to overwrite an unresolved password change");
+    return false;
+  }
+  const CacheV3 previous = cache_v3_;
+  CopyString(cache_v3_.pending_identity, identity.c_str());
+  CopyString(cache_v3_.pending_server_host, server_host.c_str());
+  cache_v3_.pending_server_port = server_port;
+  cache_v3_.pending_self_hosted = self_hosted;
+  CopyString(cache_v3_.pending_request_id, request_id.c_str());
+  if (SaveLocked() != 0) {
+    cache_v3_ = previous;
+    return false;
+  }
+  return true;
+}
+
+std::string SettingsManager::PendingPasswordChangeIdentity(
+    bool self_hosted, const std::string &server_host, int server_port) const {
+  std::lock_guard<std::mutex> lock(cache_mutex_);
+  if (cache_v3_.pending_identity[0] == '\0' ||
+      cache_v3_.pending_self_hosted != self_hosted ||
+      cache_v3_.pending_server_port != server_port ||
+      server_host != cache_v3_.pending_server_host) {
+    return {};
+  }
+  return cache_v3_.pending_identity;
+}
+
+bool SettingsManager::PromotePendingPasswordChange() {
+  std::lock_guard<std::mutex> lock(cache_mutex_);
+  if (cache_v3_.pending_identity[0] == '\0') {
+    return true;
+  }
+
+  const CacheV3 previous = cache_v3_;
+  const std::string identity = cache_v3_.pending_identity;
+  const bool self_hosted = cache_v3_.pending_self_hosted;
+  ActivateIdentity(identity.c_str(), self_hosted);
+  std::memset(cache_v3_.pending_identity, 0,
+              sizeof(cache_v3_.pending_identity));
+  std::memset(cache_v3_.pending_server_host, 0,
+              sizeof(cache_v3_.pending_server_host));
+  cache_v3_.pending_server_port = 0;
+  cache_v3_.pending_self_hosted = false;
+  std::memset(cache_v3_.pending_request_id, 0,
+              sizeof(cache_v3_.pending_request_id));
+  if (SaveLocked() != 0) {
+    // The already-durable pending credential remains the recovery source on
+    // disk. Keep it in memory as well so a reconnect in this process retries
+    // the credential that the server has accepted.
+    cache_v3_ = previous;
+    return false;
+  }
+  return true;
+}
+
+bool SettingsManager::ClearPendingPasswordChange() {
+  std::lock_guard<std::mutex> lock(cache_mutex_);
+  if (cache_v3_.pending_identity[0] == '\0') {
+    return true;
+  }
+
+  const CacheV3 previous = cache_v3_;
+  std::memset(cache_v3_.pending_identity, 0,
+              sizeof(cache_v3_.pending_identity));
+  std::memset(cache_v3_.pending_server_host, 0,
+              sizeof(cache_v3_.pending_server_host));
+  cache_v3_.pending_server_port = 0;
+  cache_v3_.pending_self_hosted = false;
+  std::memset(cache_v3_.pending_request_id, 0,
+              sizeof(cache_v3_.pending_request_id));
+  if (SaveLocked() != 0) {
+    cache_v3_ = previous;
+    return false;
+  }
+  return true;
+}
+
+void SettingsManager::PersistSelfHostedIdentity(const char *client_id) {
+  if (!client_id) {
+    return;
+  }
+
+  std::lock_guard<std::mutex> lock(cache_mutex_);
+  CopyString(owner_.self_hosted_id_, client_id);
+  if (SaveLocked() != 0) {
+    LOG_ERROR("Failed to persist self-hosted identity atomically");
+  }
+}
+
+int SettingsManager::LoadRecentConnectionAliases() {
+  recent_connection_aliases_.clear();
+
+  std::ifstream alias_file(owner_.cache_path_ +
+                           "/recent_connection_aliases.json");
+  if (!alias_file.good()) {
+    return 0;
+  }
+
+  try {
+    nlohmann::json alias_json;
+    alias_file >> alias_json;
+
+    const nlohmann::json *aliases = &alias_json;
+    if (alias_json.contains("aliases") && alias_json["aliases"].is_object()) {
+      aliases = &alias_json["aliases"];
+    }
+    if (!aliases->is_object()) {
+      LOG_WARN("Invalid recent connection alias file");
+      return -1;
+    }
+
+    for (auto it = aliases->begin(); it != aliases->end(); ++it) {
+      if (it.value().is_string()) {
+        const std::string remote_id = it.key();
+        const std::string alias = it.value().get<std::string>();
+        if (!remote_id.empty() && !alias.empty()) {
+          recent_connection_aliases_[remote_id] = alias;
+        }
+      }
+    }
+  } catch (const std::exception &e) {
+    LOG_WARN("Load recent connection aliases failed: {}", e.what());
+    return -1;
+  }
+  return 0;
+}
+
+int SettingsManager::SaveRecentConnectionAliases() const {
+  std::error_code ec;
+  std::filesystem::create_directories(owner_.cache_path_, ec);
+  if (ec) {
+    LOG_WARN("Create cache directory failed while saving aliases: {}",
+             ec.message());
+    return -1;
+  }
+
+  nlohmann::json alias_json;
+  alias_json["aliases"] = nlohmann::json::object();
+  for (const auto &[remote_id, alias] : recent_connection_aliases_) {
+    if (!remote_id.empty() && !alias.empty()) {
+      alias_json["aliases"][remote_id] = alias;
+    }
+  }
+
+  std::ofstream alias_file(
+      owner_.cache_path_ + "/recent_connection_aliases.json", std::ios::trunc);
+  if (!alias_file.good()) {
+    LOG_WARN("Open recent connection alias file failed");
+    return -1;
+  }
+  alias_file << alias_json.dump(2);
+  return 0;
+}
+
+std::string SettingsManager::RecentConnectionDisplayName(
+    const Thumbnail::RecentConnection &connection) const {
+  const auto alias_it = recent_connection_aliases_.find(connection.remote_id);
+  if (alias_it != recent_connection_aliases_.end() &&
+      !alias_it->second.empty()) {
+    return alias_it->second;
+  }
+  if (!connection.remote_host_name.empty() &&
+      connection.remote_host_name != "unknown") {
+    return connection.remote_host_name;
+  }
+  return connection.remote_id;
+}
+
+void SettingsManager::SetRecentConnectionAlias(const std::string &remote_id,
+                                               const std::string &alias) {
+  if (!remote_id.empty()) {
+    recent_connection_aliases_[remote_id] = alias;
+  }
+}
+
+void SettingsManager::EraseRecentConnectionAlias(const std::string &remote_id) {
+  recent_connection_aliases_.erase(remote_id);
+}
+
+} // namespace crossdesk

apps/desktop/src/gui/features/settings/settings_manager.h

@@ -0,0 +1,114 @@
+#ifndef CROSSDESK_GUI_SETTINGS_MANAGER_H_
+#define CROSSDESK_GUI_SETTINGS_MANAGER_H_
+
+#include <cstdint>
+#include <mutex>
+#include <string>
+#include <unordered_map>
+
+#include "thumbnail.h"
+
+namespace crossdesk {
+
+class GuiRuntime;
+
+// Owns persistent GUI settings and recent-connection aliases. GuiRuntime keeps
+// only the runtime/UI state that consumes these values.
+class SettingsManager {
+public:
+  explicit SettingsManager(GuiRuntime &owner);
+
+  int Save();
+  int Load();
+
+  int LoadRecentConnectionAliases();
+  int SaveRecentConnectionAliases() const;
+  std::string RecentConnectionDisplayName(
+      const Thumbnail::RecentConnection &connection) const;
+  void SetRecentConnectionAlias(const std::string &remote_id,
+                                const std::string &alias);
+  void EraseRecentConnectionAlias(const std::string &remote_id);
+
+  // Loads the cached self-hosted identity into the owner's active connection
+  // fields. Returns true only when a non-empty identity was restored.
+  bool LoadCachedSelfHostedIdentity();
+  // Restores the public-server identity kept in the in-memory cache fields.
+  // This must run when switching away from a self-hosted server so signal
+  // callbacks are matched against the identity used by the replacement peer.
+  bool ActivateCachedPublicIdentity();
+  void PersistSelfHostedIdentity(const char *client_id);
+
+  // Password rotation is deliberately persisted in two phases. The active
+  // credential remains usable while the pending credential records the value
+  // that may already have been committed by the server. On the next launch the
+  // caller can try the pending credential first and safely fall back to the
+  // active credential when the request never reached the server.
+  bool StagePendingPasswordChange(const std::string &identity,
+                                  bool self_hosted,
+                                  const std::string &server_host,
+                                  int server_port,
+                                  const std::string &request_id);
+  std::string PendingPasswordChangeIdentity(
+      bool self_hosted, const std::string &server_host,
+      int server_port) const;
+  bool PromotePendingPasswordChange();
+  bool ClearPendingPasswordChange();
+
+private:
+  struct CacheV1 {
+    char client_id_with_password[17];
+    int language;
+    // Reserved legacy slots: retain the on-disk cache layout.
+    int legacy_video_quality;
+    int legacy_video_frame_rate;
+    int video_encode_format;
+    bool enable_hardware_video_codec;
+    bool enable_turn;
+    bool enable_srtp;
+    unsigned char key[16];
+    unsigned char iv[16];
+  };
+
+  struct CacheV2 {
+    char client_id_with_password[17];
+    int language;
+    // Reserved legacy slots: retain the on-disk cache layout.
+    int legacy_video_quality;
+    int legacy_video_frame_rate;
+    int video_encode_format;
+    bool enable_hardware_video_codec;
+    bool enable_turn;
+    bool enable_srtp;
+    unsigned char key[16];
+    unsigned char iv[16];
+    char self_hosted_id[17];
+  };
+
+  struct CacheV3 {
+    uint32_t magic;
+    uint32_t version;
+    CacheV2 base;
+    char pending_identity[17];
+    char pending_server_host[256];
+    int pending_server_port;
+    bool pending_self_hosted;
+    char pending_request_id[64];
+    uint32_t checksum;
+  };
+
+  int SaveLocked();
+  bool ReadV3Locked();
+  bool ReadV2Locked();
+  void ActivateIdentity(const char *identity, bool self_hosted);
+
+  GuiRuntime &owner_;
+  CacheV1 cache_v1_{};
+  CacheV2 cache_v2_{};
+  CacheV3 cache_v3_{};
+  mutable std::mutex cache_mutex_;
+  std::unordered_map<std::string, std::string> recent_connection_aliases_;
+};
+
+} // namespace crossdesk
+
+#endif // CROSSDESK_GUI_SETTINGS_MANAGER_H_

apps/desktop/src/gui/render.cpp

@@ -0,0 +1,15 @@
+#include "render.h"
+
+#include <memory>
+
+#include "application/gui_application.h"
+
+namespace crossdesk {
+
+Render::Render() : application_(std::make_unique<GuiApplication>()) {}
+
+Render::~Render() = default;
+
+int Render::Run() { return application_->Run(); }
+
+} // namespace crossdesk

apps/desktop/src/gui/render.h

@@ -0,0 +1,34 @@
+/*
+ * @Author: DI JUNKUN
+ * @Date: 2026-09-04
+ * Copyright (c) 2026 by DI JUNKUN, All Rights Reserved.
+ */
+
+#ifndef _RENDER_H_
+#define _RENDER_H_
+
+#include <memory>
+
+namespace crossdesk {
+
+class GuiApplication;
+
+// Stable application-facing facade. The Slint application and feature
+// controllers remain private implementation details.
+class Render {
+public:
+  Render();
+  ~Render();
+
+  Render(const Render &) = delete;
+  Render &operator=(const Render &) = delete;
+
+  int Run();
+
+private:
+  std::unique_ptr<GuiApplication> application_;
+};
+
+} // namespace crossdesk
+
+#endif

apps/desktop/src/gui/rendering/slint_video_presenter.cpp

@@ -0,0 +1,504 @@
+#include "rendering/slint_video_presenter.h"
+#include "crossdesk_ui.h"
+
+#include <libyuv.h>
+#include <slint.h>
+
+#include <algorithm>
+#include <cmath>
+#include <mutex>
+#include <unordered_map>
+#include <utility>
+
+#include "nv12_scaler.h"
+#include "platform/video_renderer.h"
+#include "rd_log.h"
+
+#if defined(__APPLE__)
+#include "platform/macos/gui/metal_video_renderer.h"
+#else
+#if defined(_WIN32)
+#include <windows.h>
+#endif
+#include <GL/gl.h>
+
+#include "platform/common/gui/opengl_video_renderer.h"
+#endif
+
+namespace crossdesk {
+namespace {
+
+#if !defined(__APPLE__)
+constexpr GLint kGlClampToEdge = 0x812F;
+constexpr float kStreamWindowCornerRadius = 12.0f;
+#else
+constexpr int kMetalAttachmentAttemptLimit = 30;
+#endif
+
+struct VideoRenderSize {
+  int width = 0;
+  int height = 0;
+
+  bool operator==(const VideoRenderSize&) const = default;
+};
+
+VideoRenderSize FitVideoToRenderArea(int source_width, int source_height,
+                                     int area_width, int area_height) {
+  if (source_width <= 0 || source_height <= 0 || area_width <= 0 ||
+      area_height <= 0) {
+    return {};
+  }
+
+  const double scale =
+      std::min({1.0, static_cast<double>(area_width) / source_width,
+                static_cast<double>(area_height) / source_height});
+  int width = std::max(2, static_cast<int>(std::floor(source_width * scale)));
+  int height = std::max(2, static_cast<int>(std::floor(source_height * scale)));
+
+  width &= ~1;
+  height &= ~1;
+  return {std::min(width, source_width & ~1),
+          std::min(height, source_height & ~1)};
+}
+
+}  // namespace
+
+struct SlintVideoPresenter::Impl {
+  explicit Impl(VideoRenderer& renderer) : renderer(renderer) {}
+
+  VideoRenderer& renderer;
+  slint::ComponentHandle<ui::StreamWindow>* stream = nullptr;
+  StateProvider state_provider;
+  DirtyCallback dirty_callback;
+  std::unordered_map<std::string, uint64_t> displayed_frame_sequence;
+  std::unordered_map<std::string, uint64_t> seeded_frame_sequence;
+  std::vector<uint8_t> scaled_video_frame;
+  std::vector<uint8_t> scaled_video_frame_scratch;
+
+#if defined(__APPLE__)
+  int attachment_attempts = 0;
+  bool skip_attachment_once = false;
+#else
+  std::mutex gl_mutex;
+  std::vector<uint8_t> gl_conversion_frame;
+  std::vector<uint8_t> gl_pending_frame;
+  uint32_t gl_texture = 0;
+  VideoRenderSize gl_texture_size;
+  VideoRenderSize gl_image_size;
+  VideoRenderSize gl_pending_size;
+  bool gl_pending_dirty = false;
+  VideoLatencyFrame gl_pending_timing;
+#endif
+
+  SurfaceState CurrentState() const {
+    return state_provider ? state_provider() : SurfaceState{};
+  }
+
+  void MarkDirty() const {
+    if (dirty_callback) {
+      dirty_callback();
+    }
+  }
+
+  bool MarkPresented(const std::string& remote_id, uint64_t sequence) {
+    if (remote_id.empty() || sequence == 0 ||
+        displayed_frame_sequence[remote_id] == sequence) {
+      return false;
+    }
+    displayed_frame_sequence[remote_id] = sequence;
+    return true;
+  }
+
+#if !defined(__APPLE__)
+  void ConfigureOpenGlNotifier() {
+    if (!stream) {
+      return;
+    }
+
+    const auto error = (*stream)->window().set_rendering_notifier(
+        [this](slint::RenderingState state, slint::GraphicsAPI graphics_api) {
+          if (graphics_api != slint::GraphicsAPI::NativeOpenGL) {
+            return;
+          }
+
+          std::lock_guard lock(gl_mutex);
+          auto* opengl_renderer =
+              dynamic_cast<OpenGlVideoRenderer*>(&renderer);
+          if (state == slint::RenderingState::RenderingSetup) {
+            GLuint texture = 0;
+            glGenTextures(1, &texture);
+            if (texture == 0) {
+              return;
+            }
+            GLint previous_texture = 0;
+            glGetIntegerv(GL_TEXTURE_BINDING_2D, &previous_texture);
+            glBindTexture(GL_TEXTURE_2D, texture);
+            glTexParameteri(GL_TEXTURE_2D, GL_TEXTURE_MIN_FILTER, GL_LINEAR);
+            glTexParameteri(GL_TEXTURE_2D, GL_TEXTURE_MAG_FILTER, GL_LINEAR);
+            glTexParameteri(GL_TEXTURE_2D, GL_TEXTURE_WRAP_S, kGlClampToEdge);
+            glTexParameteri(GL_TEXTURE_2D, GL_TEXTURE_WRAP_T, kGlClampToEdge);
+            glBindTexture(GL_TEXTURE_2D, static_cast<GLuint>(previous_texture));
+            gl_texture = texture;
+            if (opengl_renderer && opengl_renderer->Setup()) {
+              const std::string selected_stream =
+                  CurrentState().selected_stream;
+              opengl_renderer->SetSelectedStream(selected_stream);
+              seeded_frame_sequence.erase(selected_stream);
+              MarkDirty();
+            }
+            return;
+          }
+
+          if (state == slint::RenderingState::BeforeRendering && stream &&
+              opengl_renderer && opengl_renderer->IsReady() &&
+              (*stream)->get_native_video_enabled()) {
+            const SurfaceState surface = CurrentState();
+            const auto window_size = (*stream)->window().size();
+            const float scale_factor =
+                std::max(1.0f, (*stream)->window().scale_factor());
+            const int top_inset = static_cast<int>(std::lround(
+                (*stream)->get_video_area_top() * scale_factor));
+            const bool rounded_window = (*stream)->get_custom_titlebar() &&
+                                        !surface.fullscreen &&
+                                        !(*stream)->window().is_maximized();
+            const int corner_radius =
+                rounded_window ? static_cast<int>(std::lround(
+                                     kStreamWindowCornerRadius * scale_factor))
+                               : 0;
+            opengl_renderer->RenderLatest(
+                surface.selected_stream, static_cast<int>(window_size.width),
+                static_cast<int>(window_size.height), top_inset, corner_radius);
+            return;
+          }
+
+          if (state == slint::RenderingState::BeforeRendering &&
+              gl_texture != 0 && gl_pending_dirty &&
+              !gl_pending_frame.empty()) {
+            GLint previous_texture = 0;
+            GLint previous_unpack_alignment = 0;
+            glGetIntegerv(GL_TEXTURE_BINDING_2D, &previous_texture);
+            glGetIntegerv(GL_UNPACK_ALIGNMENT, &previous_unpack_alignment);
+            glBindTexture(GL_TEXTURE_2D, gl_texture);
+            glPixelStorei(GL_UNPACK_ALIGNMENT, 1);
+            if (gl_texture_size != gl_pending_size) {
+              glTexImage2D(GL_TEXTURE_2D, 0, GL_RGBA, gl_pending_size.width,
+                           gl_pending_size.height, 0, GL_RGBA, GL_UNSIGNED_BYTE,
+                           gl_pending_frame.data());
+              gl_texture_size = gl_pending_size;
+            } else {
+              glTexSubImage2D(GL_TEXTURE_2D, 0, 0, 0, gl_pending_size.width,
+                              gl_pending_size.height, GL_RGBA, GL_UNSIGNED_BYTE,
+                              gl_pending_frame.data());
+            }
+            glPixelStorei(GL_UNPACK_ALIGNMENT, previous_unpack_alignment);
+            glBindTexture(GL_TEXTURE_2D, static_cast<GLuint>(previous_texture));
+            gl_pending_dirty = false;
+            gl_pending_timing.MarkSubmitted();
+            return;
+          }
+
+          if (state == slint::RenderingState::RenderingTeardown) {
+            if (opengl_renderer) {
+              opengl_renderer->Teardown();
+            }
+            if (gl_texture != 0) {
+              const GLuint texture = gl_texture;
+              glDeleteTextures(1, &texture);
+            }
+            gl_texture = 0;
+            gl_texture_size = {};
+            gl_image_size = {};
+            gl_pending_size = {};
+            gl_pending_dirty = false;
+            gl_pending_frame.clear();
+          }
+        });
+
+    if (error.has_value()) {
+      LOG_WARN("Slint OpenGL video renderer unavailable, using pixel buffers");
+    } else {
+      renderer.SetSelectedStream(CurrentState().selected_stream);
+    }
+  }
+#endif
+};
+
+SlintVideoPresenter::SlintVideoPresenter(VideoRenderer& renderer)
+    : impl_(std::make_unique<Impl>(renderer)) {}
+
+SlintVideoPresenter::~SlintVideoPresenter() = default;
+
+void SlintVideoPresenter::PrepareWindow(
+    slint::ComponentHandle<ui::StreamWindow>& stream,
+    StateProvider state_provider, DirtyCallback dirty_callback) {
+  impl_->stream = &stream;
+  impl_->state_provider = std::move(state_provider);
+  impl_->dirty_callback = std::move(dirty_callback);
+#if defined(__APPLE__)
+  stream->set_native_video_enabled(false);
+  impl_->attachment_attempts = kMetalAttachmentAttemptLimit;
+  impl_->skip_attachment_once = true;
+#else
+  impl_->ConfigureOpenGlNotifier();
+#endif
+}
+
+bool SlintVideoPresenter::EnsureAttached() {
+#if defined(__APPLE__)
+  if (!impl_->stream || impl_->attachment_attempts <= 0) {
+    return false;
+  }
+  if (impl_->skip_attachment_once) {
+    impl_->skip_attachment_once = false;
+    return false;
+  }
+
+  auto* metal_renderer =
+      dynamic_cast<MacMetalVideoRenderer*>(&impl_->renderer);
+  if (!metal_renderer) {
+    impl_->attachment_attempts = 0;
+    (*impl_->stream)->set_native_video_enabled(false);
+    return false;
+  }
+  if (!metal_renderer->IsReady()) {
+    impl_->attachment_attempts = 0;
+    (*impl_->stream)->set_native_video_enabled(false);
+    return false;
+  }
+  if (metal_renderer->IsAttached()) {
+    impl_->attachment_attempts = 0;
+    return false;
+  }
+
+  if (void* view = (*impl_->stream)->window().appkit_view()) {
+    (*impl_->stream)->set_native_video_enabled(true);
+    if (metal_renderer->Attach(view)) {
+      impl_->attachment_attempts = 0;
+      const SurfaceState surface = impl_->CurrentState();
+      impl_->displayed_frame_sequence.erase(surface.selected_stream);
+      impl_->seeded_frame_sequence.erase(surface.selected_stream);
+      if (metal_renderer->SetSelectedStream(surface.selected_stream)) {
+        impl_->MarkDirty();
+      }
+      return true;
+    }
+    (*impl_->stream)->set_native_video_enabled(false);
+  }
+
+  if (--impl_->attachment_attempts == 0) {
+    (*impl_->stream)->set_native_video_enabled(false);
+    LOG_WARN("Unable to attach the Metal video surface; using CPU rendering");
+  }
+#endif
+  return false;
+}
+
+bool SlintVideoPresenter::NeedsRedraw() const {
+#if defined(__APPLE__)
+  const auto* metal_renderer =
+      dynamic_cast<const MacMetalVideoRenderer*>(&impl_->renderer);
+  return metal_renderer && metal_renderer->IsActive() &&
+         metal_renderer->NeedsSurfaceRedraw();
+#else
+  return false;
+#endif
+}
+
+bool SlintVideoPresenter::SelectStream(std::string remote_id) {
+  const bool changed = impl_->renderer.SetSelectedStream(remote_id);
+  if (changed && !remote_id.empty()) {
+    impl_->seeded_frame_sequence.erase(remote_id);
+  }
+  return changed;
+}
+
+SlintVideoPresenter::PresentResult SlintVideoPresenter::Present(
+    const Frame& frame) {
+  PresentResult result;
+  if (!impl_->stream || frame.remote_id.empty()) {
+    return result;
+  }
+
+  if (impl_->renderer.IsActive() && frame.nv12 && frame.width > 0 &&
+      frame.height > 0 && frame.sequence > 0 &&
+      impl_->seeded_frame_sequence[frame.remote_id] != frame.sequence) {
+    const auto submit_result = impl_->renderer.SubmitCachedNv12(
+        frame.remote_id, frame.nv12->data(), frame.nv12->size(), frame.width,
+        frame.height, frame.timing);
+    if (submit_result == VideoRenderer::SubmitResult::submitted ||
+        submit_result == VideoRenderer::SubmitResult::dropped) {
+      impl_->seeded_frame_sequence[frame.remote_id] = frame.sequence;
+    }
+  }
+
+#if defined(__APPLE__)
+  auto* metal_renderer =
+      dynamic_cast<MacMetalVideoRenderer*>(&impl_->renderer);
+  if (metal_renderer && metal_renderer->IsActive()) {
+    const SurfaceState surface = impl_->CurrentState();
+    const double top_inset = (*impl_->stream)->get_video_area_top();
+    const auto outcome = metal_renderer->RenderLatest(
+        frame.remote_id, top_inset, !surface.fullscreen);
+    if (outcome.result == VideoRenderer::RenderResult::rendered) {
+      (*impl_->stream)->set_has_frame(true);
+      (*impl_->stream)->set_receiving_text("");
+      result.width = outcome.width;
+      result.height = outcome.height;
+      result.new_frame =
+          impl_->MarkPresented(frame.remote_id, outcome.sequence);
+    } else if (outcome.result == VideoRenderer::RenderResult::empty) {
+      (*impl_->stream)->set_has_frame(false);
+    }
+    return result;
+  }
+#else
+  auto* opengl_renderer =
+      dynamic_cast<OpenGlVideoRenderer*>(&impl_->renderer);
+  if (opengl_renderer && opengl_renderer->IsReady()) {
+    opengl_renderer->SetSelectedStream(frame.remote_id);
+    if (!(*impl_->stream)->get_native_video_enabled()) {
+      (*impl_->stream)->set_native_video_enabled(true);
+    }
+
+    const bool has_frame =
+        frame.width > 0 && frame.height > 0 && frame.sequence > 0;
+    (*impl_->stream)->set_has_frame(has_frame);
+    if (has_frame) {
+      (*impl_->stream)->set_receiving_text("");
+      result.width = frame.width;
+      result.height = frame.height;
+      result.new_frame = impl_->MarkPresented(frame.remote_id, frame.sequence);
+    }
+    (*impl_->stream)->window().request_redraw();
+    return result;
+  }
+  if ((*impl_->stream)->get_native_video_enabled()) {
+    (*impl_->stream)->set_native_video_enabled(false);
+  }
+#endif
+
+  const size_t nv12_size =
+      static_cast<size_t>(frame.width) * frame.height * 3 / 2;
+  if (!frame.nv12 || frame.width <= 0 || frame.height <= 0 ||
+      frame.nv12->size() < nv12_size) {
+    (*impl_->stream)->set_has_frame(false);
+    return result;
+  }
+  if (impl_->displayed_frame_sequence[frame.remote_id] == frame.sequence) {
+    return result;
+  }
+
+  const auto window_size = (*impl_->stream)->window().size();
+  const VideoRenderSize render_size = FitVideoToRenderArea(
+      frame.width, frame.height, static_cast<int>(window_size.width),
+      static_cast<int>(window_size.height));
+  const uint8_t* y_plane = frame.nv12->data();
+  const uint8_t* uv_plane =
+      frame.nv12->data() + static_cast<size_t>(frame.width) * frame.height;
+  int output_width = frame.width;
+  int output_height = frame.height;
+
+  if (render_size.width > 0 && render_size.height > 0 &&
+      (render_size.width != frame.width ||
+       render_size.height != frame.height)) {
+    const size_t scaled_nv12_size =
+        static_cast<size_t>(render_size.width) * render_size.height * 3 / 2;
+    impl_->scaled_video_frame.resize(scaled_nv12_size);
+    uint8_t* scaled_y = impl_->scaled_video_frame.data();
+    uint8_t* scaled_uv =
+        scaled_y + static_cast<size_t>(render_size.width) * render_size.height;
+    if (ScaleNv12ViaI420(y_plane, frame.width, uv_plane, frame.width,
+                         frame.width, frame.height, scaled_y, render_size.width,
+                         scaled_uv, render_size.width, render_size.width,
+                         render_size.height, libyuv::kFilterBox,
+                         &impl_->scaled_video_frame_scratch) == 0) {
+      y_plane = scaled_y;
+      uv_plane = scaled_uv;
+      output_width = render_size.width;
+      output_height = render_size.height;
+    }
+  }
+
+#if !defined(__APPLE__)
+  uint32_t texture_id = 0;
+  {
+    std::lock_guard lock(impl_->gl_mutex);
+    texture_id = impl_->gl_texture;
+  }
+  if (texture_id != 0) {
+    impl_->gl_conversion_frame.resize(static_cast<size_t>(output_width) *
+                                      output_height * 4);
+    if (libyuv::NV12ToABGR(y_plane, output_width, uv_plane, output_width,
+                           impl_->gl_conversion_frame.data(), output_width * 4,
+                           output_width, output_height) != 0) {
+      return result;
+    }
+    {
+      std::lock_guard lock(impl_->gl_mutex);
+      if (impl_->gl_texture == 0) {
+        return result;
+      }
+      texture_id = impl_->gl_texture;
+      impl_->gl_pending_frame.swap(impl_->gl_conversion_frame);
+      impl_->gl_pending_size = {output_width, output_height};
+      impl_->gl_pending_dirty = true;
+      impl_->gl_pending_timing = frame.timing;
+    }
+    const VideoRenderSize output_size{output_width, output_height};
+    if (impl_->gl_image_size != output_size) {
+      (*impl_->stream)
+          ->set_frame(slint::Image::create_from_borrowed_gl_2d_rgba_texture(
+              texture_id,
+              slint::Size<uint32_t>{static_cast<uint32_t>(output_width),
+                                    static_cast<uint32_t>(output_height)}));
+      impl_->gl_image_size = output_size;
+    }
+    (*impl_->stream)->set_has_frame(true);
+    (*impl_->stream)->set_receiving_text("");
+    (*impl_->stream)->window().request_redraw();
+    result.width = frame.width;
+    result.height = frame.height;
+    result.new_frame = impl_->MarkPresented(frame.remote_id, frame.sequence);
+    return result;
+  }
+#endif
+
+  slint::SharedPixelBuffer<slint::Rgb8Pixel> pixels(output_width,
+                                                    output_height);
+  if (libyuv::NV12ToRAW(y_plane, output_width, uv_plane, output_width,
+                        reinterpret_cast<uint8_t*>(pixels.begin()),
+                        output_width * 3, output_width, output_height) != 0) {
+    return result;
+  }
+
+  (*impl_->stream)->set_frame(slint::Image(std::move(pixels)));
+  frame.timing.MarkSubmitted();
+  (*impl_->stream)->set_has_frame(true);
+  (*impl_->stream)->set_receiving_text("");
+  result.width = frame.width;
+  result.height = frame.height;
+  result.new_frame = impl_->MarkPresented(frame.remote_id, frame.sequence);
+  return result;
+}
+
+void SlintVideoPresenter::ForgetStream(const std::string& remote_id) {
+  impl_->displayed_frame_sequence.erase(remote_id);
+  impl_->seeded_frame_sequence.erase(remote_id);
+}
+
+void SlintVideoPresenter::Detach() {
+  impl_->renderer.SetSelectedStream({});
+#if defined(__APPLE__)
+  if (auto* metal_renderer =
+          dynamic_cast<MacMetalVideoRenderer*>(&impl_->renderer)) {
+    metal_renderer->Detach();
+  }
+  impl_->attachment_attempts = 0;
+  impl_->skip_attachment_once = false;
+#endif
+  impl_->stream = nullptr;
+  impl_->state_provider = {};
+  impl_->dirty_callback = {};
+}
+
+}  // namespace crossdesk

apps/desktop/src/gui/rendering/slint_video_presenter.h

@@ -0,0 +1,89 @@
+/*
+ * @Author: DI JUNKUN
+ * @Date: 2026-09-04
+ * Copyright (c) 2026 by DI JUNKUN, All Rights Reserved.
+ */
+
+#ifndef _SLINT_VIDEO_PRESENTER_H_
+#define _SLINT_VIDEO_PRESENTER_H_
+
+#include <cstddef>
+#include <cstdint>
+#include <functional>
+#include <memory>
+#include <string>
+#include <vector>
+
+#include "rendering/video_latency.h"
+
+namespace slint {
+template <typename T> class ComponentHandle;
+}
+
+namespace crossdesk::ui {
+class StreamWindow;
+}
+
+namespace crossdesk {
+
+class VideoRenderer;
+
+// Owns the bridge between decoded NV12 frames, the selected native graphics
+// backend and Slint's StreamWindow. Platform macros and graphics-API lifecycle
+// details are intentionally contained in the implementation file.
+class SlintVideoPresenter {
+public:
+  struct SurfaceState {
+    std::string selected_stream;
+    bool fullscreen = false;
+  };
+
+  struct Frame {
+    std::string remote_id;
+    std::shared_ptr<std::vector<unsigned char>> nv12;
+    int width = 0;
+    int height = 0;
+    uint64_t sequence = 0;
+    VideoLatencyFrame timing;
+  };
+
+  struct PresentResult {
+    int width = 0;
+    int height = 0;
+    bool new_frame = false;
+  };
+
+  using StateProvider = std::function<SurfaceState()>;
+  using DirtyCallback = std::function<void()>;
+
+  explicit SlintVideoPresenter(VideoRenderer& renderer);
+  ~SlintVideoPresenter();
+
+  SlintVideoPresenter(const SlintVideoPresenter&) = delete;
+  SlintVideoPresenter& operator=(const SlintVideoPresenter&) = delete;
+
+  // Called before the window is shown. OpenGL installs Slint's rendering
+  // notifier here; macOS deliberately defers native view attachment until a
+  // later UI pass, after AppKit has committed the ordinary window style.
+  void PrepareWindow(slint::ComponentHandle<ui::StreamWindow>& stream,
+                     StateProvider state_provider,
+                     DirtyCallback dirty_callback);
+
+  // Returns true only when a deferred native surface became attached during
+  // this call, allowing the caller to seed it from a cached frame once.
+  bool EnsureAttached();
+  bool NeedsRedraw() const;
+
+  bool SelectStream(std::string remote_id);
+  PresentResult Present(const Frame& frame);
+  void ForgetStream(const std::string& remote_id);
+  void Detach();
+
+private:
+  struct Impl;
+  std::unique_ptr<Impl> impl_;
+};
+
+}  // namespace crossdesk
+
+#endif

apps/desktop/src/gui/rendering/video_geometry.h

@@ -0,0 +1,51 @@
+/*
+ * @Author: DI JUNKUN
+ * @Date: 2026-09-22
+ * Copyright (c) 2026 by DI JUNKUN, All Rights Reserved.
+ */
+
+#ifndef _VIDEO_GEOMETRY_H_
+#define _VIDEO_GEOMETRY_H_
+
+#include <algorithm>
+#include <cmath>
+#include <optional>
+
+namespace crossdesk {
+
+struct VideoPoint {
+  float x;
+  float y;
+};
+
+// Area dimensions and pointer positions must use the same coordinate space.
+// Slint supplies both in logical pixels; remote input is resolution
+// independent.
+inline std::optional<VideoPoint> MapVideoPoint(float x, float y,
+                                               float area_width,
+                                               float area_height,
+                                               int video_width,
+                                               int video_height) {
+  if (!std::isfinite(x) || !std::isfinite(y) || !std::isfinite(area_width) ||
+      !std::isfinite(area_height) || area_width <= 0 || area_height <= 0 ||
+      video_width <= 0 || video_height <= 0) {
+    return std::nullopt;
+  }
+
+  const double scale =
+      std::min(static_cast<double>(area_width) / video_width,
+               static_cast<double>(area_height) / video_height);
+  const double width = video_width * scale;
+  const double height = video_height * scale;
+  const double left = (area_width - width) * 0.5;
+  const double top = (area_height - height) * 0.5;
+  if (x < left || x > left + width || y < top || y > top + height) {
+    return std::nullopt;
+  }
+  return VideoPoint{static_cast<float>((x - left) / width),
+                    static_cast<float>((y - top) / height)};
+}
+
+}  // namespace crossdesk
+
+#endif

apps/desktop/src/gui/rendering/video_latency.h

@@ -0,0 +1,110 @@
+/*
+ * @Author: DI JUNKUN
+ * @Date: 2026-09-26
+ * Copyright (c) 2026 by DI JUNKUN, All Rights Reserved.
+ */
+
+#ifndef _VIDEO_LATENCY_H_
+#define _VIDEO_LATENCY_H_
+
+#include <chrono>
+#include <cstddef>
+#include <cstdint>
+#include <deque>
+#include <memory>
+#include <mutex>
+#include <optional>
+
+namespace crossdesk {
+
+class VideoLatencyStats;
+
+// Travels with the exact queued pixels, including native frames. Its clock is
+// translated once at the receive callback; rendering needs no live PeerPtr.
+struct VideoLatencyFrame {
+  using Clock = std::chrono::steady_clock;
+  std::shared_ptr<VideoLatencyStats> stats;
+  uint64_t id = 0;
+  Clock::time_point capture_time{};
+  void MarkPresented(Clock::time_point now = Clock::now()) const;
+  // Fallback for renderers which expose submission but no presentation time.
+  void MarkSubmitted(Clock::time_point now = Clock::now()) const;
+};
+
+class VideoLatencyStats
+    : public std::enable_shared_from_this<VideoLatencyStats> {
+ public:
+  using Clock = VideoLatencyFrame::Clock;
+  struct Snapshot {
+    double average_ms;
+    size_t samples;
+  };
+
+  VideoLatencyFrame Frame(uint64_t captured_us, int64_t local_now_us,
+                          Clock::time_point now = Clock::now()) {
+    if (captured_us == 0 || local_now_us <= 0 ||
+        captured_us > uint64_t(local_now_us) ||
+        uint64_t(local_now_us) - captured_us > 5'000'000)
+      return {};
+    std::lock_guard lock(mutex_);
+    return {shared_from_this(), ++issued_id_,
+            now - std::chrono::microseconds(local_now_us - captured_us)};
+  }
+
+  void Record(const VideoLatencyFrame& frame, Clock::time_point now) {
+    std::lock_guard lock(mutex_);
+    // Redraws, cached snapshots and late completions must not count twice.
+    if (frame.id <= last_id_) return;
+    last_id_ = frame.id;
+    const double ms =
+        std::chrono::duration<double, std::milli>(now - frame.capture_time)
+            .count();
+    if (ms < 0 || ms > 5000) return;
+    samples_.push_back({now, ms});
+    Prune(now);
+  }
+
+  std::optional<Snapshot> Get(Clock::time_point now = Clock::now()) {
+    std::lock_guard lock(mutex_);
+    Prune(now);
+    if (samples_.empty()) return std::nullopt;
+    double sum = 0;
+    for (const auto& sample : samples_) {
+      sum += sample.ms;
+    }
+    return Snapshot{sum / samples_.size(), samples_.size()};
+  }
+
+  void Reset() {
+    std::lock_guard lock(mutex_);
+    samples_.clear();
+    last_id_ = issued_id_;  // Invalidate frames still held by a renderer.
+  }
+
+ private:
+  void Prune(Clock::time_point now) {
+    while (!samples_.empty() &&
+           (now - samples_.front().time > std::chrono::seconds(1) ||
+            samples_.size() > 240))
+      samples_.pop_front();
+  }
+  struct Sample {
+    Clock::time_point time;
+    double ms;
+  };
+  std::mutex mutex_;
+  uint64_t issued_id_ = 0;
+  uint64_t last_id_ = 0;
+  std::deque<Sample> samples_;
+};
+
+inline void VideoLatencyFrame::MarkSubmitted(Clock::time_point now) const {
+  MarkPresented(now);
+}
+
+inline void VideoLatencyFrame::MarkPresented(Clock::time_point now) const {
+  if (stats) stats->Record(*this, now);
+}
+}  // namespace crossdesk
+
+#endif

apps/desktop/src/gui/runtime/announcement_inbox.cpp

@@ -0,0 +1,483 @@
+#include "runtime/announcement_inbox.h"
+
+#include <openssl/sha.h>
+
+#include <algorithm>
+#include <charconv>
+#include <fstream>
+#include <set>
+#include <system_error>
+
+#ifdef _WIN32
+#include <windows.h>
+#endif
+
+namespace crossdesk {
+namespace {
+using nlohmann::json;
+bool Integer(const json& object, const char* key, int64_t low, int64_t high) {
+  return object.contains(key) && object[key].is_number_integer() &&
+         object[key] >= low && object[key] <= high;
+}
+std::string ScopeFilename(const std::string& scope) {
+  unsigned char digest[SHA256_DIGEST_LENGTH];
+  SHA256(reinterpret_cast<const unsigned char*>(scope.data()), scope.size(),
+         digest);
+  std::string name;
+  constexpr char hex[] = "0123456789abcdef";
+  for (auto byte : digest) {
+    name += hex[byte >> 4];
+    name += hex[byte & 15];
+  }
+  return name + ".json";
+}
+}  // namespace
+
+AnnouncementInbox::Snapshot AnnouncementInbox::Get() const {
+  std::lock_guard<std::mutex> lock(mutex_);
+  return state_;
+}
+uint64_t AnnouncementInbox::Version() const {
+  std::lock_guard<std::mutex> lock(mutex_);
+  return state_.version;
+}
+void AnnouncementInbox::SetStorageDirectory(
+    const std::filesystem::path& directory) {
+  std::lock_guard<std::mutex> lock(mutex_);
+  directory_ = directory;
+}
+void AnnouncementInbox::Configure(std::string host, int port,
+                                  const std::string& device_id) {
+  std::lock_guard<std::mutex> lock(mutex_);
+  if (directory_.empty() || host.empty() || port <= 0 || device_id.empty())
+    return;
+  for (auto& ch : host)
+    if (ch >= 'A' && ch <= 'Z') ch += 'a' - 'A';
+  if (host.back() == '.') host.pop_back();
+  const auto scope = json::array({host, port, device_id}).dump();
+  if (scope_ == scope) return;
+  scope_ = scope;
+  read_file_ = directory_ / ScopeFilename(scope);
+  const auto version = state_.version + 1;
+  state_ = {};
+  state_.version = version;
+  catalog_.clear();
+  catalog_revision_ = -1;
+  page_ids_.clear();
+  page_bodies_.clear();
+  visible_limit_ = 20;
+  LoadLocalState();
+  BeginCatalog();
+}
+void AnnouncementInbox::Reset() {
+  std::lock_guard<std::mutex> lock(mutex_);
+  const auto version = state_.version + 1;
+  state_ = {};
+  state_.version = version;
+  scope_.clear();
+  read_file_.clear();
+  reads_.clear();
+  dismissed_.clear();
+  page_ids_.clear();
+  page_bodies_.clear();
+  visible_limit_ = 20;
+  catalog_.clear();
+  catalog_revision_ = -1;
+  connected_ = false;
+  BeginCatalog();
+}
+void AnnouncementInbox::BeginCatalog() {
+  pending_catalog_.clear();
+  pending_revision_ = -1;
+  pending_total_ = 0;
+  phase_ = Phase::Catalog;
+  request_id_.clear();
+  state_.loading = false;
+  refresh_ = connected_;
+  ++state_.version;
+}
+void AnnouncementInbox::SetConnected(bool connected) {
+  std::lock_guard<std::mutex> lock(mutex_);
+  connected_ = connected;
+  BeginCatalog();
+}
+void AnnouncementInbox::Refresh() {
+  std::lock_guard<std::mutex> lock(mutex_);
+  BeginCatalog();
+}
+void AnnouncementInbox::LoadMore() {
+  std::lock_guard<std::mutex> lock(mutex_);
+  if (!connected_ || state_.loading || refresh_ || state_.failed ||
+      catalog_revision_ < 0 || visible_limit_ >= state_.total)
+    return;
+  visible_limit_ += (std::min)(20, state_.total - visible_limit_);
+  RebuildVisibleItems();
+  ++state_.version;
+}
+void AnnouncementInbox::UpdateReadingState() {
+  state_.total = 0;
+  state_.unread = 0;
+  for (const auto& [id, revision] : catalog_) {
+    if (IsDismissed(id, revision)) continue;
+    ++state_.total;
+    const auto read = reads_.find(id);
+    if (read == reads_.end() || read->second != revision) ++state_.unread;
+  }
+  for (auto& item : state_.items) {
+    const auto read = reads_.find(item["id"]);
+    item["read"] = read != reads_.end() && read->second == item["revision"];
+  }
+}
+bool AnnouncementInbox::Read(int64_t id, int64_t revision) {
+  std::lock_guard<std::mutex> lock(mutex_);
+  for (const auto& item : state_.items) {
+    if (item["id"] != id || item["revision"] != revision) continue;
+    if (item["read"].get<bool>()) return true;
+    auto updated = reads_;
+    updated[id] = revision;
+    if (!SaveLocalState(updated, dismissed_)) {
+      state_.read_save_failed = true;
+      ++state_.version;
+      return false;
+    }
+    reads_ = std::move(updated);
+    state_.read_save_failed = false;
+    state_.delete_failed = false;
+    UpdateReadingState();
+    ++state_.version;
+    return true;
+  }
+  return false;
+}
+bool AnnouncementInbox::IsDismissed(int64_t id, int64_t revision) const {
+  const auto found = dismissed_.find(id);
+  return found != dismissed_.end() && found->second == revision;
+}
+
+bool AnnouncementInbox::Dismiss(int64_t id, int64_t revision) {
+  std::lock_guard<std::mutex> lock(mutex_);
+  for (const auto& item : state_.items) {
+    if (item["id"] != id || item["revision"] != revision) continue;
+    auto updated = dismissed_;
+    updated[id] = revision;
+    if (!SaveLocalState(reads_, updated)) {
+      state_.delete_failed = true;
+      ++state_.version;
+      return false;
+    }
+    dismissed_ = std::move(updated);
+    state_.delete_failed = false;
+    state_.read_save_failed = false;
+    // An index refresh already in flight must finish before reusing its order.
+    if (phase_ == Phase::Catalog && (state_.loading || refresh_)) {
+      auto visible = json::array();
+      for (const auto& current : state_.items)
+        if (!IsDismissed(current["id"], current["revision"]))
+          visible.push_back(current);
+      state_.items = std::move(visible);
+      UpdateReadingState();
+    } else {
+      request_id_.clear();
+      state_.loading = false;
+      RebuildVisibleItems();
+    }
+    ++state_.version;
+    return true;
+  }
+  // The confirmation may refer to an announcement updated while it was open.
+  state_.delete_failed = true;
+  ++state_.version;
+  return false;
+}
+
+void AnnouncementInbox::RebuildVisibleItems() {
+  UpdateReadingState();
+  const int wanted = (std::min)(visible_limit_, state_.total);
+  auto visible = json::array();
+  std::set<int> retained_pages;
+  int position = 0;
+  phase_ = Phase::Page;
+  refresh_ = false;
+  for (int physical = 0;
+       wanted > 0 && physical < static_cast<int>(catalog_.size());
+       physical += 20) {
+    const auto ids = page_ids_.find(physical);
+    if (ids == page_ids_.end()) {
+      pending_page_offset_ = physical;
+      refresh_ = connected_;
+      break;
+    }
+    std::set<int64_t> page_selection;
+    for (auto id : ids->second) {
+      const auto entry = catalog_.find(id);
+      if (entry == catalog_.end() || IsDismissed(id, entry->second)) continue;
+      if (position < wanted) page_selection.insert(id);
+      ++position;
+    }
+    if (page_selection.empty()) {
+      page_bodies_.erase(physical);
+      continue;
+    }
+    retained_pages.insert(physical);
+    const auto bodies = page_bodies_.find(physical);
+    if (bodies == page_bodies_.end()) {
+      pending_page_offset_ = physical;
+      refresh_ = connected_;
+      break;
+    }
+    for (const auto& item : bodies->second)
+      if (page_selection.count(item["id"])) visible.push_back(item);
+    if (visible.size() == static_cast<size_t>(wanted)) break;
+  }
+  if (visible.size() == static_cast<size_t>(wanted)) {
+    for (auto it = page_bodies_.begin(); it != page_bodies_.end();)
+      if (!retained_pages.count(it->first))
+        it = page_bodies_.erase(it);
+      else
+        ++it;
+  }
+  // A failed body fetch must not erase announcements already received. Keep
+  // still-published, unchanged versions until the replacement batch arrives.
+  if (visible.size() < static_cast<size_t>(wanted)) {
+    std::set<int64_t> retained_ids;
+    for (const auto& item : visible) retained_ids.insert(item["id"].get<int64_t>());
+    for (const auto& item : state_.items) {
+      const int64_t id = item["id"];
+      const auto current = catalog_.find(id);
+      if (current == catalog_.end() || current->second != item["revision"] ||
+          IsDismissed(id, current->second) || !retained_ids.insert(id).second)
+        continue;
+      visible.push_back(item);
+      if (visible.size() == static_cast<size_t>(wanted)) break;
+    }
+  }
+  state_.items = std::move(visible);
+  state_.loaded = true;
+  UpdateReadingState();
+}
+
+void AnnouncementInbox::Fail() {
+  request_id_.clear();
+  refresh_ = false;
+  state_.loading = false;
+  state_.failed = true;
+  ++state_.version;
+}
+nlohmann::json AnnouncementInbox::TakePendingRequest(
+    std::chrono::steady_clock::time_point now) {
+  std::lock_guard<std::mutex> lock(mutex_);
+  if (!connected_ || scope_.empty()) return nullptr;
+  if (state_.loading && now >= deadline_) Fail();
+  if (!refresh_) return nullptr;
+  refresh_ = false;
+  request_id_ = std::to_string(++serial_);
+  state_.loading = true;
+  state_.failed = false;
+  ++state_.version;
+  deadline_ = now + std::chrono::seconds(12);
+  return {{"type", "announcements_list"},
+          {"request_id", request_id_},
+          {"summary_only", phase_ == Phase::Catalog},
+          {"offset", phase_ == Phase::Catalog
+                         ? static_cast<int>(pending_catalog_.size())
+                         : pending_page_offset_}};
+}
+void AnnouncementInbox::Failed(const std::string& request_id) {
+  std::lock_guard<std::mutex> lock(mutex_);
+  if (request_id == request_id_) Fail();
+}
+void AnnouncementInbox::Receive(const nlohmann::json& message) {
+  std::lock_guard<std::mutex> lock(mutex_);
+  if (!message.is_object() || !message.contains("request_id") ||
+      message["request_id"] != request_id_ || request_id_.empty())
+    return;
+  if (message.contains("error")) {
+    Fail();
+    return;
+  }
+  const bool summary = phase_ == Phase::Catalog;
+  const int limit = summary ? 200 : 20;
+  if (!Integer(message, "offset", 0, INT32_MAX) ||
+      !Integer(message, "total", 0, INT32_MAX) ||
+      !Integer(message, "catalog_revision", 0, INT64_MAX) ||
+      !message.contains("summary_only") || message["summary_only"] != summary ||
+      !message.contains("items") || !message["items"].is_array() ||
+      message["items"].size() > static_cast<size_t>(limit)) {
+    Fail();
+    return;
+  }
+  const int offset = message["offset"], total = message["total"];
+  const int64_t revision = message["catalog_revision"];
+  if (offset > total ||
+      message["items"].size() !=
+          static_cast<size_t>((std::min)(limit, total - offset))) {
+    Fail();
+    return;
+  }
+  const auto expected_revision =
+      summary ? pending_revision_ : catalog_revision_;
+  if (expected_revision >= 0 && expected_revision != revision) {
+    BeginCatalog();
+    return;
+  }
+  for (const auto& item : message["items"]) {
+    if (!item.is_object() || !Integer(item, "id", 1, INT64_MAX) ||
+        !Integer(item, "revision", 1, INT64_MAX)) {
+      Fail();
+      return;
+    }
+    if (!summary) {
+      if (!Integer(item, "updated_at", 1, 32503680000LL)) {
+        Fail();
+        return;
+      }
+      for (const auto* key : {"title", "body"}) {
+        if (!item.contains(key) || !item[key].is_string() ||
+            item[key].get_ref<const std::string&>().size() >
+                (std::string(key) == "title" ? 240u : 8000u)) {
+          Fail();
+          return;
+        }
+      }
+      const auto found = catalog_.find(item["id"]);
+      if (found == catalog_.end() || found->second != item["revision"]) {
+        Fail();
+        return;
+      }
+    }
+  }
+  request_id_.clear();
+  state_.loading = false;
+  if (summary) {
+    if (pending_revision_ < 0) {
+      pending_revision_ = revision;
+      pending_total_ = total;
+    }
+    if (pending_total_ != total ||
+        offset != static_cast<int>(pending_catalog_.size())) {
+      Fail();
+      return;
+    }
+    for (const auto& item : message["items"]) {
+      if (!pending_catalog_.emplace(item["id"], item["revision"]).second) {
+        Fail();
+        return;
+      }
+    }
+    if (static_cast<int>(pending_catalog_.size()) < total) {
+      refresh_ = true;
+      ++state_.version;
+      return;
+    }
+    if (catalog_revision_ != revision) {
+      page_ids_.clear();
+      page_bodies_.clear();
+    }
+    catalog_ = std::move(pending_catalog_);
+    catalog_revision_ = revision;
+    // Prune expired records in memory; the next local action persists them.
+    for (auto* records : {&reads_, &dismissed_}) {
+      for (auto it = records->begin(); it != records->end();)
+        if (!catalog_.count(it->first))
+          it = records->erase(it);
+        else
+          ++it;
+    }
+  } else {
+    if (total != static_cast<int>(catalog_.size())) {
+      Fail();
+      return;
+    }
+    if (offset != pending_page_offset_) {
+      Fail();
+      return;
+    }
+    std::set<int64_t> unique;
+    std::vector<int64_t> ids;
+    for (const auto& item : message["items"]) {
+      const int64_t id = item["id"];
+      if (!unique.insert(id).second) {
+        Fail();
+        return;
+      }
+      ids.push_back(id);
+    }
+    page_ids_[offset] = std::move(ids);
+    page_bodies_[offset] = message["items"];
+  }
+  RebuildVisibleItems();
+  state_.failed = false;
+  ++state_.version;
+}
+
+void AnnouncementInbox::LoadLocalState() {
+  reads_.clear();
+  dismissed_.clear();
+  std::error_code ec;
+  const auto size = std::filesystem::file_size(read_file_, ec);
+  if (ec || size > 16 * 1024 * 1024) return;
+  std::ifstream input(read_file_, std::ios::binary);
+  const auto data = json::parse(input, nullptr, false);
+  if (!data.is_object() || !data.contains("scope") || data["scope"] != scope_ ||
+      !data.contains("version") ||
+      (data["version"] != 1 && data["version"] != 2) ||
+      !data.contains("reads") || !data["reads"].is_object())
+    return;
+  const auto load = [](const json& entries, Revisions& destination) {
+    if (!entries.is_object()) return;
+    for (const auto& entry : entries.items()) {
+      int64_t id = 0;
+      const auto parsed = std::from_chars(
+          entry.key().data(), entry.key().data() + entry.key().size(), id);
+      if (parsed.ec == std::errc{} &&
+          parsed.ptr == entry.key().data() + entry.key().size() && id > 0 &&
+          entry.value().is_number_integer() && entry.value() > 0 &&
+          entry.value() <= INT64_MAX)
+        destination[id] = entry.value();
+    }
+  };
+  load(data["reads"], reads_);
+  if (data.contains("dismissed")) load(data["dismissed"], dismissed_);
+}
+bool AnnouncementInbox::SaveLocalState(const Revisions& reads,
+                                       const Revisions& dismissed) const {
+  if (read_file_.empty()) return false;
+  std::error_code ec;
+  std::filesystem::create_directories(directory_, ec);
+  if (ec) return false;
+  const auto encode = [](const Revisions& records) {
+    auto entries = json::object();
+    for (const auto& [id, revision] : records)
+      entries[std::to_string(id)] = revision;
+    return entries;
+  };
+  const auto payload = json({{"version", 2},
+                             {"scope", scope_},
+                             {"reads", encode(reads)},
+                             {"dismissed", encode(dismissed)}})
+                           .dump();
+  auto temporary = read_file_;
+  temporary += ".tmp-" +
+               std::to_string(
+                   std::chrono::steady_clock::now().time_since_epoch().count());
+  {
+    std::ofstream output(temporary, std::ios::binary | std::ios::trunc);
+    output.write(payload.data(), static_cast<std::streamsize>(payload.size()));
+    output.close();
+    if (!output) {
+      std::filesystem::remove(temporary, ec);
+      return false;
+    }
+  }
+#ifdef _WIN32
+  const bool saved =
+      MoveFileExW(temporary.c_str(), read_file_.c_str(),
+                  MOVEFILE_REPLACE_EXISTING | MOVEFILE_WRITE_THROUGH) != 0;
+#else
+  std::filesystem::rename(temporary, read_file_, ec);
+  const bool saved = !ec;
+#endif
+  if (!saved) std::filesystem::remove(temporary, ec);
+  return saved;
+}
+}  // namespace crossdesk

apps/desktop/src/gui/runtime/announcement_inbox.h

@@ -0,0 +1,78 @@
+/*
+ * @Author: DI JUNKUN
+ * @Date: 2026-09-29
+ * Copyright (c) 2026 by DI JUNKUN, All Rights Reserved.
+ */
+
+#ifndef _ANNOUNCEMENT_INBOX_H_
+#define _ANNOUNCEMENT_INBOX_H_
+
+#include <chrono>
+#include <cstdint>
+#include <filesystem>
+#include <map>
+#include <mutex>
+#include <nlohmann/json.hpp>
+#include <string>
+#include <vector>
+
+namespace crossdesk {
+// Announcement data is shared; read and dismissed versions stay on this device.
+class AnnouncementInbox {
+ public:
+  struct Snapshot {
+    nlohmann::json items = nlohmann::json::array();
+    int total = 0, unread = 0;
+    bool loaded = false, loading = false, failed = false;
+    bool read_save_failed = false;
+    bool delete_failed = false;
+    uint64_t version = 0;
+  };
+  Snapshot Get() const;
+  uint64_t Version() const;
+  void SetStorageDirectory(const std::filesystem::path& directory);
+  // Called on the UI thread after login supplies the actual device ID.
+  void Configure(std::string host, int port, const std::string& device_id);
+  void Reset();
+  void SetConnected(bool connected);
+  void Refresh();
+  void LoadMore();
+  bool Read(int64_t id, int64_t revision);
+  bool Dismiss(int64_t id, int64_t revision);
+  nlohmann::json TakePendingRequest(std::chrono::steady_clock::time_point now =
+                                        std::chrono::steady_clock::now());
+  void Failed(const std::string& request_id);
+  void Receive(const nlohmann::json& message);
+
+ private:
+  using Revisions = std::map<int64_t, int64_t>;
+  enum class Phase { Catalog, Page };
+  void BeginCatalog();
+  void Fail();
+  void UpdateReadingState();
+  bool IsDismissed(int64_t id, int64_t revision) const;
+  void RebuildVisibleItems();
+  void LoadLocalState();
+  bool SaveLocalState(const Revisions& reads, const Revisions& dismissed) const;
+
+  mutable std::mutex mutex_;
+  Snapshot state_;
+  std::filesystem::path directory_, read_file_;
+  std::string scope_, request_id_;
+  Revisions reads_, dismissed_, catalog_, pending_catalog_;
+  // Keep bodies for the loaded list prefix. Lightweight page IDs let us skip
+  // locally deleted entries without sending deletion state upstream.
+  std::map<int, std::vector<int64_t>> page_ids_;
+  std::map<int, nlohmann::json> page_bodies_;
+  int pending_page_offset_ = 0;
+  int visible_limit_ = 20;
+  int64_t catalog_revision_ = -1, pending_revision_ = -1;
+  int pending_total_ = 0;
+  Phase phase_ = Phase::Catalog;
+  bool connected_ = false, refresh_ = false;
+  uint64_t serial_ = 0;
+  std::chrono::steady_clock::time_point deadline_{};
+};
+}  // namespace crossdesk
+
+#endif

apps/desktop/src/gui/runtime/connection_latency.h

@@ -0,0 +1,59 @@
+/*
+ * @Author: DI JUNKUN
+ * @Date: 2026-09-26
+ * Copyright (c) 2026 by DI JUNKUN, All Rights Reserved.
+ */
+
+#ifndef _CONNECTION_LATENCY_H_
+#define _CONNECTION_LATENCY_H_
+
+#include <chrono>
+#include <cmath>
+#include <mutex>
+#include <optional>
+
+namespace crossdesk::gui_detail {
+
+// Presentation-only smoothing. The transport's raw RTT remains available for
+// recovery, congestion control and diagnostics. A missing one-second report
+// does not flicker, but a disconnected/stalled peer cannot leave a stale value.
+class ConnectionLatencyStats {
+ public:
+  using Clock = std::chrono::steady_clock;
+
+  void Update(double rtt_ms, Clock::time_point now = Clock::now()) {
+    if (!std::isfinite(rtt_ms) || rtt_ms < 0 || rtt_ms > 2000) return;
+    std::lock_guard lock(mutex_);
+    if (average_ms_ && now < updated_) return;
+    if (!Fresh(now)) {
+      average_ms_ = rtt_ms;
+    } else {
+      *average_ms_ += 0.25 * (rtt_ms - *average_ms_);
+    }
+    updated_ = now;
+  }
+
+  std::optional<double> Get(Clock::time_point now = Clock::now()) const {
+    std::lock_guard lock(mutex_);
+    return Fresh(now) ? average_ms_ : std::nullopt;
+  }
+
+  void Reset() {
+    std::lock_guard lock(mutex_);
+    average_ms_.reset();
+  }
+
+ private:
+  bool Fresh(Clock::time_point now) const {
+    // The UI may snapshot `now` just before the report thread updates us.
+    // A newer valid report must not cause a one-frame unavailable flicker.
+    return average_ms_ && now - updated_ < std::chrono::seconds(3);
+  }
+  mutable std::mutex mutex_;
+  std::optional<double> average_ms_;
+  Clock::time_point updated_{};
+};
+
+}  // namespace crossdesk::gui_detail
+
+#endif