[fix] keep Windows privacy screen active when running as administrator

.github/workflows/build.yml

@@ -271,7 +271,7 @@ jobs:
 
       - name: Build CrossDesk
         run: |
-          xmake f --target_minver=${MACOSX_DEPLOYMENT_TARGET} --CROSSDESK_VERSION=${VERSION_NUM} --USE_CUDA=false -y
+          xmake f --target_minver=${MACOSX_DEPLOYMENT_TARGET} --CROSSDESK_VERSION=${VERSION_NUM} --USE_CUDA=false -vyD
           xmake b -vy crossdesk
 
       - name: Package CrossDesk app
@@ -311,6 +311,8 @@ jobs:
     name: Build on iOS (arm64)
     runs-on: macos-26
     timeout-minutes: 120
+    outputs:
+      version: ${{ steps.ios_version.outputs.version }}
     env:
       IOS_DEPLOYMENT_TARGET: "16.0"
       EXPECTED_IOS_SDK: "26.5"
@@ -369,6 +371,26 @@ jobs:
       - name: Checkout code
         uses: actions/checkout@v5
 
+      - name: Read independent iOS version
+        id: ios_version
+        shell: bash
+        run: |
+          IOS_VERSION_BASE="$(xcodebuild \
+            -project apps/ios/CrossDeskMobile.xcodeproj \
+            -scheme CrossDeskMobile \
+            -configuration Release \
+            -destination 'generic/platform=iOS' \
+            -showBuildSettings CODE_SIGNING_ALLOWED=NO | \
+            awk '$1 == "MARKETING_VERSION" && $2 == "=" { print $3 }')"
+          if [[ ! "${IOS_VERSION_BASE}" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
+            echo "Invalid iOS marketing version: ${IOS_VERSION_BASE}" >&2
+            exit 1
+          fi
+          VERSION_NUM="v${IOS_VERSION_BASE}-${VERSION_NUM##*-}"
+          echo "IOS_VERSION_BASE=${IOS_VERSION_BASE}" >> "${GITHUB_ENV}"
+          echo "VERSION_NUM=${VERSION_NUM}" >> "${GITHUB_ENV}"
+          echo "version=${VERSION_NUM}" >> "${GITHUB_OUTPUT}"
+
       - name: Initialize submodules
         run: git submodule update --init --recursive
 
@@ -439,6 +461,11 @@ jobs:
           fi
 
           xcrun lipo "${EXECUTABLE_PATH}" -verify_arch arm64
+          APP_VERSION=$(/usr/libexec/PlistBuddy -c 'Print :CFBundleShortVersionString' "${INFO_PLIST}")
+          if [[ "${APP_VERSION}" != "${IOS_VERSION_BASE}" ]]; then
+            echo "Unexpected iOS app version: expected ${IOS_VERSION_BASE}, got ${APP_VERSION}" >&2
+            exit 1
+          fi
           MINIMUM_OS=$(/usr/libexec/PlistBuddy -c 'Print :MinimumOSVersion' "${INFO_PLIST}")
           if [[ "${MINIMUM_OS}" != "${IOS_DEPLOYMENT_TARGET}" ]]; then
             echo "Unexpected minimum iOS version: expected ${IOS_DEPLOYMENT_TARGET}, got ${MINIMUM_OS}" >&2
@@ -655,7 +682,9 @@ jobs:
           $portableFiles = @(
             @("crossdesk.exe", "CrossDesk.exe"),
             @("crossdesk_service.exe", "crossdesk_service.exe"),
-            @("crossdesk_session_helper.exe", "crossdesk_session_helper.exe")
+            @("crossdesk_session_helper.exe", "crossdesk_session_helper.exe"),
+            @("crossdesk_privacy_cursor_helper.exe", "crossdesk_privacy_cursor_helper.exe"),
+            @("crossdesk_privacy_window.dll", "crossdesk_privacy_window.dll")
           )
 
           foreach ($file in $portableFiles) {
@@ -749,6 +778,25 @@ jobs:
           echo "BUILD_DATE_ISO=${BUILD_DATE_ISO}" >> $GITHUB_OUTPUT
           echo "PATCH_NUMBER=${PATCH_NUMBER}" >> $GITHUB_OUTPUT
 
+      - name: Prepare release notes
+        env:
+          RELEASE_TAG: ${{ steps.version.outputs.VERSION_WITH_V }}
+          VERSION_BASE: ${{ steps.version.outputs.VERSION_BASE }}
+        run: |
+          if [[ -f "docs/releases/${RELEASE_TAG}.md" ]]; then
+            cp "docs/releases/${RELEASE_TAG}.md" release-notes.md
+          elif [[ -f "docs/releases/v${VERSION_BASE}.md" ]]; then
+            cp "docs/releases/v${VERSION_BASE}.md" release-notes.md
+          else
+            cat > release-notes.md << 'EOF'
+          Binary release only. Source code is not included.
+
+          ## Code signing policy
+
+          Free code signing provided by [SignPath.io](https://signpath.io/), certificate by [SignPath Foundation](https://signpath.org/).
+          EOF
+          fi
+
       - name: Rename artifacts
         run: |
           mkdir -p release
@@ -756,7 +804,7 @@ jobs:
           cp artifacts/crossdesk-macos-arm64-${{ steps.version.outputs.VERSION_WITH_V }}/* release/crossdesk-macos-arm64-${{ steps.version.outputs.VERSION_WITH_V }}.pkg
           cp artifacts/crossdesk-linux-amd64-${{ steps.version.outputs.VERSION_WITH_V }}/* release/crossdesk-linux-amd64-${{ steps.version.outputs.VERSION_WITH_V }}.deb
           cp artifacts/crossdesk-linux-arm64-${{ steps.version.outputs.VERSION_WITH_V }}/* release/crossdesk-linux-arm64-${{ steps.version.outputs.VERSION_WITH_V }}.deb
-          cp artifacts/crossdesk-ios-arm64-unsigned-${{ steps.version.outputs.VERSION_WITH_V }}/* release/crossdesk-ios-arm64-unsigned-${{ steps.version.outputs.VERSION_WITH_V }}.zip
+          cp artifacts/crossdesk-ios-arm64-unsigned-${{ needs.build-ios.outputs.version }}/* release/crossdesk-ios-arm64-unsigned-${{ needs.build-ios.outputs.version }}.zip
           cp artifacts/crossdesk-win-x64-${{ steps.version.outputs.VERSION_WITH_V }}/* release/crossdesk-win-x64-${{ steps.version.outputs.VERSION_WITH_V }}.exe
           cp artifacts/crossdesk-win-x64-portable-${{ steps.version.outputs.VERSION_WITH_V }}/* release/crossdesk-win-x64-portable-${{ steps.version.outputs.VERSION_WITH_V }}.zip
 
@@ -767,17 +815,13 @@ jobs:
         uses: softprops/action-gh-release@v2
         with:
           tag_name: ${{ steps.version.outputs.VERSION_WITH_V }}
+          target_commitish: ${{ github.sha }}
           name: Release ${{ steps.version.outputs.VERSION_WITH_V }}
           draft: false
           prerelease: false
           files: release/*
           generate_release_notes: false
-          body: |
-            Binary release only. Source code is not included.
-
-            ## Code signing policy
-
-            Free code signing provided by [SignPath.io](https://signpath.io/), certificate by [SignPath Foundation](https://signpath.org/).
+          body_path: release-notes.md
 
       - name: Create or update 'latest' tag
         run: |
@@ -795,12 +839,7 @@ jobs:
           prerelease: false
           files: release/*
           generate_release_notes: false
-          body: |
-            Binary release only. Source code is not included.
-
-            ## Code signing policy
-
-            Free code signing provided by [SignPath.io](https://signpath.io/), certificate by [SignPath Foundation](https://signpath.org/).
+          body_path: release-notes.md
 
       - name: Upload artifacts to server
         uses: burnett01/rsync-deployments@5.2
@@ -851,6 +890,11 @@ jobs:
             }
           }
           EOF
+          jq --arg release_name "Release ${{ steps.version.outputs.VERSION_WITH_V }}" \
+            --rawfile release_notes release-notes.md \
+            '.releaseName = $release_name | .releaseNotes = $release_notes' \
+            version.json > version-with-notes.json
+          mv version-with-notes.json version.json
           cat version.json
 
       - name: Upload version.json to server

README.md

@@ -1,429 +1,211 @@
-# CrossDesk
+<div align="center">
+  <img src="apps/desktop/resources/linux/crossdesk_128x128.png" width="80" alt="CrossDesk 标志" />
+  <h1>CrossDesk</h1>
+  <p>轻量、跨平台的远程桌面，让电脑、浏览器和 iPhone / iPad 连接到同一张桌面。</p>
+  <p><a href="https://www.crossdesk.cn/">官方网站</a> · <a href="https://github.com/kunkundi/crossdesk/releases">下载客户端</a> · <a href="https://web.crossdesk.cn/">打开 Web 客户端</a> · <a href="README_EN.md">English</a></p>
+</div>
 
-<a href="https://hellogithub.com/repository/kunkundi/crossdesk" target="_blank"><img src="https://api.hellogithub.com/v1/widgets/recommend.svg?rid=55d41367570345f1838e02fd12be7961&claim_uid=cb0OpZRrBuGVAfL&theme=small" alt="Featured｜HelloGitHub" /></a>
+<div align="center">
 
-[![Platform](https://img.shields.io/badge/platform-Windows%20%7C%20Linux%20%7C%20macOS-brightgreen.svg)](https://www.crossdesk.cn/)
-[![License: GPL v3](https://img.shields.io/badge/License-GPL%20v3-blue.svg)](https://www.gnu.org/licenses/gpl-3.0)
-[![GitHub last commit](https://img.shields.io/github/last-commit/kunkundi/crossdesk)](https://github.com/kunkundi/crossdesk/commits/web-client)
-[![Build Status](https://github.com/kunkundi/crossdesk/actions/workflows/build.yml/badge.svg)](https://github.com/kunkundi/crossdesk/actions)  
-[![Docker Pulls](https://img.shields.io/docker/pulls/crossdesk/crossdesk-server)](https://hub.docker.com/r/crossdesk/crossdesk-server/tags)
-[![GitHub issues](https://img.shields.io/github/issues/kunkundi/crossdesk.svg)](https://github.com/kunkundi/crossdesk/issues)
-[![GitHub stars](https://img.shields.io/github/stars/kunkundi/crossdesk.svg?style=social)](https://github.com/kunkundi/crossdesk/stargazers)
-[![GitHub forks](https://img.shields.io/github/forks/kunkundi/crossdesk.svg?style=social)](https://github.com/kunkundi/crossdesk/forks)
+[![Platforms](https://img.shields.io/badge/platform-Windows%20%7C%20macOS%20%7C%20Linux%20%7C%20iOS-blue)](#download)
+[![Release](https://img.shields.io/github/v/release/kunkundi/crossdesk)](https://github.com/kunkundi/crossdesk/releases)
+[![Build](https://github.com/kunkundi/crossdesk/actions/workflows/build.yml/badge.svg)](https://github.com/kunkundi/crossdesk/actions/workflows/build.yml)
+[![License: GPL v3](https://img.shields.io/badge/license-GPL--3.0-blue)](LICENSE)
+[![Stars](https://img.shields.io/github/stars/kunkundi/crossdesk?style=social)](https://github.com/kunkundi/crossdesk/stargazers)
 
-[ [English](README_EN.md) / 中文 ]
+</div>
 
----
+CrossDesk 支持 Windows、macOS、Linux 之间的远程访问，也可从浏览器或原生 iOS 客户端控制电脑。项目基于 [MiniRTC](https://github.com/kunkundi/minirtc)，提供实时音视频传输、键鼠控制、文件传输与自托管能力，仍在持续开发中。
+
+> 本文按当前仓库代码整理。截图展示当前 Slint 桌面界面，使用演示 ID、密码、在线状态和连接记录；缩略图来自公开页面；下载包的功能与系统要求请同时核对对应 Release 说明。原生 iOS 客户端的构建、签名方式见下文。
+
+[界面预览](#preview) · [下载与安装](#download) · [快速连接](#quick-start) · [会话操作](#session) · [设置](#settings) · [iOS](#ios) · [自托管](#self-hosting) · [源码构建](docs/BUILD.md) · [常见问题](docs/FAQ.md)
+
+<a id="preview"></a>
 
 ## 界面预览
 
-### PC 客户端
+### 桌面客户端
 
-![sup_example](https://github.com/user-attachments/assets/eeb64fbe-1f07-4626-be1c-b77396beb905)
+主窗口集中展示本机 ID、连接密码、远程连接入口和近期连接记录。
+
+<p align="center">
+  <img src="docs/images/desktop-main-zh.png" width="800" alt="当前桌面客户端示例：已连接服务器，三台在线设备均显示页面缩略图" />
+</p>
 
 ### Web 客户端
 
+在浏览器中输入远程设备 ID 和密码，无需在控制端安装桌面客户端。
+
 <p align="center">
-  <img width="850" height="550" alt="6bddcbed47ffd4b9988a4037c7f4f524" src="https://github.com/user-attachments/assets/e44f73f9-24ac-46a3-a189-b7f8b6669881" />
+  <img src="docs/images/web-client.png" width="800" alt="CrossDesk Web 客户端当前连接首页" />
 </p>
 
----
+图片来源与更新方式见 [截图说明](docs/images/README.md)。
 
-## 简介
+## 主要功能
 
-CrossDesk 是一个轻量级的跨平台远程桌面软件，支持 Web 端控制远程设备。
-
-CrossDesk 是 [MiniRTC](https://github.com/kunkundi/minirtc.git) 实时音视频传输库的实验性应用。MiniRTC 是一个轻量级的跨平台实时音视频传输库。它具有网络透传（[RFC5245](https://datatracker.ietf.org/doc/html/rfc5245)），视频软硬编解码（H264/AV1），音频编解码（[Opus](https://github.com/xiph/opus)），信令交互，网络拥塞控制，传输加密（[SRTP](https://tools.ietf.org/html/rfc3711)）等基础能力。
-
----
-
-## 系统要求
-
-| 平台 | 最低版本 |
+| 能力 | 当前支持 |
 | --- | --- |
-| **Windows** | Windows 10 及以上 (64 位) |
-| **macOS** | macOS Intel 15.0 及以上 ( 大于 14.0 小于 15.0 的版本可自行编译实现兼容 )<br> macOS Apple Silicon 14.0 及以上 |
-| **Linux** | Ubuntu 20.04 及以上 |
+| 跨平台控制 | Windows / macOS / Linux 桌面互控；浏览器与原生 iOS 作为控制端 |
+| 实时画面与声音 | H.264 / AV1、30 / 60 fps 设置、硬件编解码选项、远端声音播放；实际能力取决于设备与构建配置 |
+| 多设备与多显示器 | 近期连接、设备别名、会话标签与远端显示器切换 |
+| 输入与协作 | 键鼠输入、远端光标同步、组合键、文本剪贴板同步、文件传输 |
+| 网络与部署 | P2P 直连、TURN 中继、SRTP 加密选项、自托管信令与中继服务 |
+| Windows 锁屏控制 | 通过 CrossDesk Service 支持锁屏、登录界面及安全桌面的输入转发 |
 
----
+各客户端的入口和能力有所不同；桌面会话操作见下文，iOS 的具体功能见 [开发说明](apps/ios/README.md)。
 
-## 使用
+<a id="download"></a>
 
-在菜单栏“对端ID”处输入远端桌面的ID，点击“→”即可发起远程连接。
+## 下载与安装
 
-![usage1](https://github.com/user-attachments/assets/3a4bb59f-c84c-44d2-9a20-11790aac510e)
+前往 [GitHub Releases](https://github.com/kunkundi/crossdesk/releases) 或 [官方网站](https://www.crossdesk.cn/)，按系统与 CPU 架构选择安装包。
 
-如果远端桌面设置了连接密码，则本端需填写正确的连接密码才能成功发起远程连接。
+| 平台 | 当前源码 / CI 基线 | 安装方式 |
+| --- | --- | --- |
+| Windows | Windows 10+，x64 | `.exe` 安装包；便携构建也受支持 |
+| macOS | macOS 14.0+，Intel / Apple Silicon | 选择 x64 或 arm64 的 `.pkg` |
+| Linux | Ubuntu 20.04+，amd64 / arm64，glibc 2.31 基线 | `.deb` 安装包 |
+| iOS / iPadOS | iOS 16.0+，arm64 真机 | 原生客户端；使用 Xcode 构建并签名，CI 产物为未签名应用 |
+| Web | 支持 WebRTC 的浏览器 | 访问 [web.crossdesk.cn](https://web.crossdesk.cn/) |
 
-![password](https://github.com/user-attachments/assets/1beadcce-640d-4f5c-8e77-51917b5294d5)
+Linux 下载后，在下载目录中将文件名替换为实际安装包名称：
 
-发起连接前，可在设置中自定义配置项，如语言、视频编码格式等。
-![settings](https://github.com/user-attachments/assets/8bc5468d-7bbb-4e30-95bd-da1f352ac08c)
+```bash
+sudo apt install "./crossdesk-linux-amd64-<version>.deb"
+```
 
-### 使用 Web 客户端
+**macOS 首次运行：** 按应用提示，在“系统设置 → 隐私与安全性”中授予 CrossDesk **屏幕录制**（新系统可能显示为“屏幕与系统音频录制”）及 **辅助功能**权限，再按系统提示重新打开应用。前者用于捕获桌面，后者用于远程键鼠输入。
 
-浏览器访问 [CrossDesk Web Client](https://web.crossdesk.cn/)。
-输入 **远程设备 ID** 与 **密码**，点击连接即可接入远程设备。如图，**iOS Safari 远程控制 Win11**：
+<a id="quick-start"></a>
 
-<img width="645" height="300" alt="_cgi-bin_mmwebwx-bin_webwxgetmsgimg__ MsgID=932911462648581698 skey=@crypt_1f5153b1_b550ca7462b5009ce03c991cca2a92a7 mmweb_appid=wx_webfilehelper" src="https://github.com/user-attachments/assets/a5109e6f-752c-4654-9f4e-7e161bddf43e" />
+## 快速连接
 
-### Windows 服务（CrossDesk Service）
+### 从另一台电脑连接
 
-CrossDesk 在 Windows 平台提供本地辅助服务 **CrossDesk Service**，服务名为 `CrossDeskService`。该服务用于锁屏、登录界面和安全桌面等受保护场景下的远程控制增强能力，包括：
+1. **准备被控电脑。** 安装并运行 CrossDesk，等待底部显示“已连接服务器”。在左侧“本桌面”查看 **本机 ID** 和 **密码**，提供给控制端。
+2. **输入对端 ID。** 在控制端右侧“远程桌面 → 对端 ID”输入被控电脑的 ID，点击 **→**。
+3. **完成密码验证。** 按弹窗输入被控电脑当前的连接密码，确认后等待远程画面出现。需要保存密码时勾选“记住密码”。
+4. **再次连接。** 成功连接过的设备会出现在“近期连接”中，可通过卡片重连，也可编辑别名或删除记录。
 
-- 上报远端当前是否处于锁屏、登录、凭据输入或安全桌面状态；
-- 支持从控制端发送 `Ctrl+Alt+Del`（SAS）；
-- 在锁屏、登录和安全桌面阶段转发键盘、鼠标输入。
+本机密码旁的眼睛按钮用于显示 / 隐藏密码，铅笔按钮用于修改密码。修改时使用 **6 位数字或英文字母**，并保持连接服务器；等待修改成功、客户端重新连接后，再复制当前密码。已保存旧密码的控制端需重新输入。
 
-Windows 安装包会自动打包 `crossdesk_service.exe` 和 `crossdesk_session_helper.exe`，并在安装时注册为按需启动的 Windows 服务。CrossDesk 客户端启动时会尝试启动已安装的服务；当本机没有 CrossDesk 客户端进程运行时，服务会自动退出。卸载客户端时会同步停止并移除该服务。
+### 从浏览器连接
 
-如果是手动编译或手动部署 Windows 版本，请确保 `CrossDesk.exe`、`crossdesk_service.exe` 和 `crossdesk_session_helper.exe` 位于同一目录。安装或卸载服务需要使用管理员权限打开 PowerShell：
+1. 保持被控电脑上的 CrossDesk 运行，并确认已连接服务器；在被控端“设置”中保持 **启用 SRTP** 开启。
+2. 打开 [Web 客户端](https://web.crossdesk.cn/)，输入 **远程设备 ID** 和 **密码**，点击“连接”。
+3. 连接后使用页面提供的显示器、鼠标模式和键盘控件操作远端；手机和平板也可通过浏览器访问。
+
+如果使用自建服务器，需要让控制端与被控端接入同一服务；Web 部署配置见 [CrossDesk Web Client](https://github.com/kunkundi/crossdesk-web-client)。
+
+<a id="session"></a>
+
+## 会话中的常用操作
+
+远程窗口通过会话标签切换设备，控制栏提供以下操作；控制栏收起时先点击展开按钮。将鼠标悬停在图标上可查看提示。
+
+| 入口 | 用途 |
+| --- | --- |
+| 显示器 | 切换远端显示器 |
+| 键盘 | 发送组合键；Windows 的 `Ctrl+Alt+Del` 依赖远端服务 |
+| 鼠标 | 控制 / 释放远端鼠标 |
+| 扬声器 | 播放声音 / 静音 |
+| 文件夹 | 选择文件发送到远端，并查看传输进度 |
+| 网络状态 | 查看流量、丢包率、帧率、分辨率及直连 / 中继状态 |
+| 全屏 | 进入 / 退出全屏 |
+| 断开连接 | 结束当前远程会话 |
+
+桌面端可同步文本剪贴板。接收文件的位置可在“设置 → 文件保存路径”调整。关闭主窗口会隐藏窗口并保持程序运行；需要完全退出时使用系统托盘或菜单栏中的退出入口。
+
+<a id="settings"></a>
+
+## 调整画面与连接设置
+
+点击主窗口右上角 **☰ → 设置**，修改后点击“确认”保存。建议在建立连接前调整；会话进行中部分选项不可修改。设置列表可向下滚动，查看自托管、启动方式与文件保存路径。
+
+<p align="center">
+  <img src="docs/images/desktop-settings-zh.png" width="720" alt="当前设置界面：画质、帧率、画面偏好、编解码、中继与 SRTP" />
+</p>
+
+| 设置 | 说明 |
+| --- | --- |
+| 画面质量 / 帧率 | 选择低、中、高画质与 30 / 60 fps；实际帧率取决于网络和设备 |
+| 画面偏好 | 在帧率优先、画质优先、平衡之间选择 |
+| 视频编码格式 | H.264 / AV1；硬件编解码是否可用取决于平台、硬件与构建选项 |
+| 启用中继服务 | 允许借助 TURN 中继建立连接；P2P 连接失败时先检查此项 |
+| 启用 SRTP | 媒体传输加密选项，两端配置需兼容 |
+| 自托管配置 | 设置服务器地址、信令端口与中继端口，并勾选启用 |
+| 开机自启 / 启用守护进程 | 调整启动与进程守护行为，按界面提示重启后生效 |
+| 文件保存路径 | 选择接收文件的目录 |
+
+<a id="ios"></a>
+
+## 原生 iOS / iPadOS 客户端
+
+仓库的 [`apps/ios`](apps/ios/README.md) 提供原生控制端，与桌面端使用同一套 MiniRTC 协议。它可以控制远端电脑；当前不提供将 iPhone / iPad 作为被控桌面的功能。
+
+1. 按 [iOS 开发说明](apps/ios/README.md) 使用 Xcode 构建并签名，安装到 iOS 16+ 的真机。
+2. 在首页输入对端 ID，点击连接并填写密码；成功连接后可从“最近连接”中重连。
+3. 在设置中选择鼠标模式：**相对位置**像触控板一样移动光标，**绝对位置**将触摸位置直接映射到远端画面。
+4. 点击悬浮图标展开菜单，可切换显示器、显示键盘、控制声音或发送文件。收到的文件位于应用的 `Documents/Received`，可通过传输状态旁的分享按钮导出。
+
+当前支持接收远端文本到 iOS 剪贴板；界面暂未提供主动发送本机剪贴板的按钮。
+
+当前支持单指点击、双指右键、长按拖动与捏合缩放；缩放后的双指平移用于移动视图。原生端与浏览器端分别维护，使用入口和手势可能不同。
+
+<a id="windows-service"></a>
+
+## Windows 锁屏与登录界面
+
+**CrossDesk Service**（服务名 `CrossDeskService`）提供锁屏、登录、凭据输入及安全桌面的状态上报、`Ctrl+Alt+Del` 发送和键鼠输入转发。
+
+安装版会注册按需启动的服务，客户端启动时尝试启动它；本机没有 CrossDesk 客户端进程后服务会自动退出。便携版可在提示窗口或“设置 → 锁屏控制服务”中安装服务，需要管理员权限。该服务依赖客户端运行。
+
+<details>
+<summary>手动部署与服务管理命令</summary>
+
+保留完整安装目录；自行部署构建产物时，将 `CrossDesk.exe`、`crossdesk_service.exe`、`crossdesk_session_helper.exe` 及同次构建输出的全部 `.dll` 放在同一目录。在该目录打开管理员 PowerShell，按需执行：
 
 ```powershell
-# 安装
 .\CrossDesk.exe --service-install
-# 启动
 .\CrossDesk.exe --service-start
-# 查看状态
 .\CrossDesk.exe --service-status
-# 停止
+.\CrossDesk.exe --service-ping
+# 停止或卸载服务
 .\CrossDesk.exe --service-stop
-# 卸载
 .\CrossDesk.exe --service-uninstall
 ```
 
-如果远端 Windows 服务未安装、未启动或暂时不可用，基础远程桌面连接仍可使用，但锁屏、登录界面和安全桌面阶段的控制能力会受限，客户端会提示“远端Windows服务不可用”。
+</details>
 
----
+出现“远端 Windows 服务不可用”时，检查被控电脑的安装和服务状态；普通桌面连接仍可使用，受保护界面的控制能力会受限。
 
-## 如何编译
-
-### 构建依赖
-
-- [xmake](https://xmake.io/#/guide/installation)
-- [cmake](https://cmake.org/download/) 3.21 及以上（系统版本过低时由 xmake 自动安装）
-
-### Linux
-
-Linux 构建支持 Ubuntu 20.04 及以上版本的 amd64 和 arm64。发布安装包以
-Ubuntu 20.04/glibc 2.31 为兼容基线。先安装基础编译依赖：
-
-```bash
-sudo apt-get update
-sudo apt-get install -y \
-  git curl unzip build-essential gcc-10 g++-10 python3-pip \
-  pkg-config binutils dpkg-dev \
-  libx11-dev libxext-dev libxrender-dev libxft-dev libxrandr-dev \
-  libxinerama-dev libxcursor-dev libxi-dev libxfixes-dev libxv-dev \
-  libxtst-dev libxcb-randr0-dev libxcb-xtest0-dev libxcb-xinerama0-dev \
-  libxcb-shape0-dev libxcb-xkb-dev libxcb-xfixes0-dev libxcb-shm0-dev \
-  libasound2-dev libsndio-dev libpulse-dev \
-  libgl1-mesa-dev
-```
-
-Ubuntu 20.04 自带的 CMake 3.16 不满足要求时，xmake 会自动下载并使用
-CMake 3.21 或更高版本，无需手动替换系统 CMake。
-
-Ubuntu 20.04 默认的 GCC 9 缺少 Slint C++ API 所需的部分 C++20 标准库，
-因此上述命令同时安装并在后续配置中指定 GCC 10。
-
-需要启用 Wayland 捕获或 DRM 捕获时，再安装对应依赖：
-
-```bash
-sudo apt-get install -y libdbus-1-dev libdrm-dev
-
-# Ubuntu 22.04 及以上也可以直接安装系统开发包
-# sudo apt-get install -y libpipewire-0.3-dev libspa-0.2-dev
-```
-
-下载子模块并编译 Release 版本：
-
-```bash
-git clone --recurse-submodules https://github.com/kunkundi/crossdesk.git
-cd crossdesk
-
-# 已经克隆过仓库时执行这一行
-git submodule update --init --recursive
-
-# Ubuntu 20.04 没有 PipeWire 0.3 开发包，安装仅用于编译的头文件 SDK。
-# 已安装发行版 PipeWire 0.3 开发包时可跳过此步骤。
-sudo ./docker/linux-build/install-pipewire-sdk.sh
-
-xmake f -c -m release --USE_CUDA=false --toolchain=gcc-10 -y
-xmake b -vy crossdesk
-```
-
-这里应使用 `--toolchain=gcc-10`，以确保 CrossDesk 及 xmake 在配置阶段构建的
-libyuv 等第三方包都使用 GCC 10。只指定 `--cc`/`--cxx` 时，依赖安装可能仍回退到
-系统默认的 `/bin/cc` 和 `/bin/c++`。`-c` 会清除旧配置，切换编译器时必须保留。
-
-amd64 构建结果位于 `build/linux/x86_64/release/crossdesk`，arm64 构建结果位于 `build/linux/arm64/release/crossdesk`。
-
-启用 Wayland 和 DRM 的配置示例：
-
-```bash
-xmake f -c -m release --USE_WAYLAND=true --USE_DRM=true --USE_CUDA=false \
-  --toolchain=gcc-10 -y
-xmake b -vy crossdesk
-```
-
-生成 Debian 安装包（必须在对应架构上先完成 Release 编译）：
-
-```bash
-# amd64
-./apps/desktop/scripts/linux/pkg_amd64.sh 1.0.0
-
-# arm64
-./apps/desktop/scripts/linux/pkg_arm64.sh 1.0.0
-```
-
-打包脚本会将 Slint 共享运行库安装到软件包私有目录 `/usr/lib/crossdesk`，无需用户另外安装 `libslint_cpp.so`。
-PipeWire 不属于强制运行时依赖：程序在运行时检测宿主系统的 PipeWire 0.3，
-没有该运行库时仍可使用 X11（以及构建时启用的 DRM）捕获。
-
-### 通用编译选项
-
-```text
---USE_CUDA=true/false: 启用 CUDA 硬件编解码，默认不启用
---USE_WAYLAND=true/false: 在 Linux 上启用 Wayland/PipeWire 捕获，默认不启用
---USE_DRM=true/false: 在 Linux 上启用 DRM 捕获，默认不启用
---CROSSDESK_PORTABLE=true/false: 构建便携版本，默认不启用
---CROSSDESK_VERSION=xxx: 指定 CrossDesk 的版本
-
-# 示例
-xmake f --CROSSDESK_VERSION=1.0.0 --USE_CUDA=true
-```
-
-运行：
-
-```bash
-xmake r crossdesk
-```
-
-### 无 CUDA 环境下的开发支持
-
-对于**未安装 CUDA 环境的 Linux 开发者，如果希望编译后的成果物拥有硬件编解码能力**，这里提供了预配置的 [Ubuntu 20.04 兼容构建镜像](https://hub.docker.com/r/crossdesk/ubuntu20.04)。该镜像内置必要的构建依赖，可生成兼容 glibc 2.31 的单一 Linux 安装包。
-
-进入容器，下载工程后执行：
-
-```bash
-export CUDA_PATH=/usr/local/cuda
-export XMAKE_GLOBALDIR=/data
-
-xmake f --USE_CUDA=true
-xmake b --root -vy crossdesk
-```
-
-对于**未安装 CUDA 环境的 Windows 开发者**，执行下面的命令安装 CUDA 编译环境：
-
-```powershell
-xmake require -vy "cuda 12.6.3"
-```
-
-安装完成后执行:
-
-```powershell
-xmake require --info "cuda 12.6.3"
-```
-
-输出如下:
-
-<img width="860" height="226" alt="Image" src="https://github.com/user-attachments/assets/999ac365-581a-4b9a-806e-05eb3e4cf44d" />
-
-根据上述输出获取到 CUDA 的安装目录，即 installdir 指向的位置。将 CUDA_PATH 加入系统环境变量，或在终端中输入：
-
-```powershell
-set CUDA_PATH=path_to_cuda_installdir
-```
-
-重新执行：
-
-```powershell
-xmake f --USE_CUDA=true
-xmake b -vy crossdesk
-```
-
-#### 注意
-
-运行时如果客户端状态栏显示 **未连接服务器**，请先在 [CrossDesk 官方网站](https://www.crossdesk.cn/) 安装客户端，以便在环境中安装所需的证书文件。
-
-<img width="256" height="120" alt="image" src="https://github.com/user-attachments/assets/1812f7d6-516b-4b4f-8a3d-98bee505cc5a" />
-
-### 关于 Xmake
-
-#### 安装 Xmake
-
-使用 curl：
-
-```bash
-curl -fsSL https://xmake.io/shget.text | bash
-```
-
-使用 wget：
-
-```bash
-wget https://xmake.io/shget.text -O - | bash
-```
-
-使用 powershell：
-
-```powershell
-irm https://xmake.io/psget.text | iex
-```
-
-#### 编译选项
-
-```text
-# 切换编译模式
-xmake f -m debug/release
-
-# 可选编译参数
--r ：重新构建目标
--v ：显示详细的构建日志
--y ：自动确认提示
-
-# 示例
-xmake b -vy crossdesk
-```
-
-#### 运行选项
-
-```bash
-# 使用调试模式运行
-xmake r -d crossdesk
-```
-
-更多使用方法可参考 [Xmake 官方文档](https://xmake.io/guide/quick-start.html)。
-
----
+<a id="self-hosting"></a>
 
 ## 自托管服务器
 
-### 服务端
+可自行部署信令服务与 TURN 中继，并在桌面客户端 **☰ → 设置 → 自托管配置** 中填写连接信息。控制端与被控端都需要启用同一套配置。
 
-推荐使用 Docker 部署 CrossDesk Server。
+- [自托管指南](docs/SELF_HOSTING.md)：当前 Compose 部署入口、客户端设置、证书信任与排查。
+- [CrossDesk Server](https://github.com/kunkundi/crossdesk-server)：服务端源码与发布配置。
+- [CrossDesk Web Client](https://github.com/kunkundi/crossdesk-web-client)：浏览器端源码与自托管说明。
 
-```bash
-sudo docker run -d \
-  --name crossdesk_server \
-  --network host \
-  -e EXTERNAL_IP=xxx.xxx.xxx.xxx \
-  -e INTERNAL_IP=xxx.xxx.xxx.xxx \
-  -e CROSSDESK_SERVER_PORT=xxxx \
-  -e COTURN_PORT=xxxx \
-  -e MIN_PORT=xxxxx \
-  -e MAX_PORT=xxxxx \
-  -v /var/lib/crossdesk:/var/lib/crossdesk \
-  -v /var/log/crossdesk:/var/log/crossdesk \
-  crossdesk/crossdesk-server:v1.1.6
-```
+## 开发与反馈
 
-上述命令中，用户需注意的参数如下：
+- [源码构建](docs/BUILD.md)：Windows、macOS、Linux、可选编译参数与打包。
+- [iOS 开发说明](apps/ios/README.md)：原生端构建和真机验证。
+- [GUI 架构](docs/gui-architecture.md)：桌面 UI、平台实现与工程结构。
+- [常见问题](docs/FAQ.md)：连接失败、黑屏、文件位置与编译问题。
+- [提交问题](https://github.com/kunkundi/crossdesk/issues)：请附上两端系统、客户端版本、连接方式和可复现步骤。
 
-#### 配置参数
+## 致谢与许可
 
-- EXTERNAL_IP：服务器公网 IP , 对应 CrossDesk 客户端**自托管服务器配置**中填写的**服务器地址**
-- INTERNAL_IP：服务器内网 IP
-- CROSSDESK_SERVER_PORT：自托管服务使用的端口，对应 CrossDesk 客户端**自托管服务器配置**中填写的**服务器端口**
-- COTURN_PORT: COTURN 服务使用的端口, 对应 CrossDesk 客户端**自托管服务器配置**中填写的**中继服务端口**
-- MIN_PORT/MAX_PORT：COTURN 服务使用的端口范围，例如：MIN_PORT=50000, MAX_PORT=60000，范围可根据客户端数量调整。
-- `-v /var/lib/crossdesk:/var/lib/crossdesk`：持久化数据库和证书文件到宿主机
-- `-v /var/log/crossdesk:/var/log/crossdesk`：持久化日志文件到宿主机
+感谢 [HelloGitHub](https://hellogithub.com/)、[阮一峰的科技爱好者周刊](https://github.com/ruanyf/weekly) 与 [LinuxDo](https://linux.do) 社区的推荐、交流与支持。
 
-#### 部署示例
+CrossDesk 使用 [GPL-3.0](LICENSE) 许可。隐私说明见 [隐私政策](PRIVACY.md#中文)。
 
-```bash
-sudo docker run -d \
-  --name crossdesk_server \
-  --network host \
-  -e EXTERNAL_IP=114.114.114.114 \
-  -e INTERNAL_IP=10.0.0.1 \
-  -e CROSSDESK_SERVER_PORT=9099 \
-  -e COTURN_PORT=3478 \
-  -e MIN_PORT=50000 \
-  -e MAX_PORT=60000 \
-  -v /var/lib/crossdesk:/var/lib/crossdesk \
-  -v /var/log/crossdesk:/var/log/crossdesk \
-  crossdesk/crossdesk-server:v1.1.6
-```
-
-#### 注意事项
-
-- **服务器需开放端口：COTURN_PORT/udp，COTURN_PORT/tcp，MIN_PORT-MAX_PORT/udp，CROSSDESK_SERVER_PORT/tcp。**
-- 如果不挂载 volume，容器删除后数据会丢失
-- 证书文件会在首次启动时自动生成并持久化到宿主机的 `/var/lib/crossdesk/certs` 路径下。由于默认使用的是自签证书，无法保障安全性，建议在云服务商申请正式证书放到该目录下并重启服务。
-- 数据库文件会自动创建并持久化到宿主机的 `/var/lib/crossdesk/db/crossdesk-server.db` 路径下
-- 日志文件会自动创建并持久化到宿主机的 `/var/log/crossdesk/` 路径下
-
-#### 目录权限
-
-如果 Docker 自动创建的目录权限不足（属于 root），容器内用户无法写入，会导致：
-
-- 证书生成失败，容器启动脚本会报错退出
-- 数据库目录创建失败，程序会抛出异常并崩溃
-- 日志目录创建失败，日志文件无法写入（但程序可能继续运行）
-
-在启动容器前手动设置权限：
-
-```bash
-sudo mkdir -p /var/lib/crossdesk /var/log/crossdesk
-sudo chown -R $(id -u):$(id -g) /var/lib/crossdesk /var/log/crossdesk
-```
-
-### 客户端
-
-1. 点击右上角设置进入设置页面。<br><br>
-<img width="600" height="210" alt="image" src="https://github.com/user-attachments/assets/6431131d-b32a-4726-8783-6788f47baa3b" /><br>
-
-2. 点击`自托管服务器配置`按钮。<br><br>
-<img width="600" height="160" alt="image" src="https://github.com/user-attachments/assets/24c761a3-1985-4d7e-84be-787383c2afb8" /><br>
-
-3. 输入`服务器地址`(**EXTERNAL_IP**)、`信令服务端口`(**CROSSDESK_SERVER_PORT**)、`中继服务端口`(**COTURN_PORT**)，点击确认按钮。
-
-4. 勾选`自托管服务器配置`选项，点击确认按钮保存设置。如果服务端使用的是正式证书，则到此步骤为止，客户端即可显示已连接服务器。
-
-5. 如果使用默认证书（正式证书忽略此步骤），则需要将服务端`/var/lib/crossdesk/certs/`目录下的`api.crossdesk.cn_root.crt`自签根证书下载到运行客户端的机器，并执行下述命令安装证书：
-
-**Windows：** 使用管理员权限打开 PowerShell 执行：
-
-```powershell
-certutil -addstore "Root" "C:\path\to\api.crossdesk.cn_root.crt"
-```
-
-**Linux：**
-
-```bash
-sudo cp /path/to/api.crossdesk.cn_root.crt /usr/local/share/ca-certificates/api.crossdesk.cn_root.crt
-sudo update-ca-certificates
-```
-
-**macOS：**
-
-```bash
-sudo security add-trusted-cert -d -r trustRoot -k /Library/Keychains/System.keychain path/to/api.crossdesk.cn_root.crt
-```
-
-### 自托管 Web 客户端
-
-详情见项目 [CrossDesk Web Client](https://github.com/kunkundi/crossdesk-web-client)。
-
----
-
-## 常见问题
-
-见 [常见问题](https://github.com/kunkundi/crossdesk/blob/self-hosted-server/docs/FAQ.md)。
-
----
-
-## 致谢
-
-- 感谢 [HelloGitHub](https://hellogithub.com/) 的推荐与关注。
-- 感谢 [阮一峰的科技爱好者周刊](https://github.com/ruanyf/weekly) 的收录与推荐。
-- 感谢 [LinuxDo](https://linux.do) 社区的关注、交流与支持，为 CrossDesk 项目的完善提供了帮助。
-
----
-
-## Code signing policy
+### Code signing policy
 
 CrossDesk 使用 SignPath.io 为本仓库构建的官方 Windows 发布包提供代码签名。
 
@@ -431,4 +213,3 @@ CrossDesk 使用 SignPath.io 为本仓库构建的官方 Windows 发布包提供
 
 - **Committers and reviewers（代码提交与审核）：** [kunkundi](https://github.com/kunkundi)
 - **Approvers（签名审批）：** [kunkundi](https://github.com/kunkundi)
-- **隐私政策：** [查看 CrossDesk 隐私政策](PRIVACY.md#中文)

README_EN.md

@@ -1,451 +1,215 @@
-# CrossDesk
+<div align="center">
+  <img src="apps/desktop/resources/linux/crossdesk_128x128.png" width="80" alt="CrossDesk logo" />
+  <h1>CrossDesk</h1>
+  <p>A lightweight, cross-platform remote desktop for computers, browsers, and iPhone / iPad.</p>
+  <p><a href="https://www.crossdesk.cn/">Website</a> · <a href="https://github.com/kunkundi/crossdesk/releases">Download</a> · <a href="https://web.crossdesk.cn/">Open Web Client</a> · <a href="README.md">中文</a></p>
+</div>
 
-<a href="https://hellogithub.com/repository/kunkundi/crossdesk" target="_blank"><img src="https://api.hellogithub.com/v1/widgets/recommend.svg?rid=55d41367570345f1838e02fd12be7961&claim_uid=cb0OpZRrBuGVAfL&theme=small" alt="Featured｜HelloGitHub" /></a>
+<div align="center">
 
-[![Platform](https://img.shields.io/badge/platform-Windows%20%7C%20Linux%20%7C%20macOS-brightgreen.svg)](https://www.crossdesk.cn/)
-[![License: GPL v3](https://img.shields.io/badge/License-GPL%20v3-blue.svg)](https://www.gnu.org/licenses/gpl-3.0)
-[![GitHub last commit](https://img.shields.io/github/last-commit/kunkundi/crossdesk)](https://github.com/kunkundi/crossdesk/commits/web-client)
-[![Build Status](https://github.com/kunkundi/crossdesk/actions/workflows/build.yml/badge.svg)](https://github.com/kunkundi/crossdesk/actions)  
-[![Docker Pulls](https://img.shields.io/docker/pulls/crossdesk/crossdesk-server)](https://hub.docker.com/r/crossdesk/crossdesk-server/tags)
-[![GitHub issues](https://img.shields.io/github/issues/kunkundi/crossdesk.svg)](https://github.com/kunkundi/crossdesk/issues)
-[![GitHub stars](https://img.shields.io/github/stars/kunkundi/crossdesk.svg?style=social)](https://github.com/kunkundi/crossdesk/stargazers)
-[![GitHub forks](https://img.shields.io/github/forks/kunkundi/crossdesk.svg?style=social)](https://github.com/kunkundi/crossdesk/forks)
+[![Platforms](https://img.shields.io/badge/platform-Windows%20%7C%20macOS%20%7C%20Linux%20%7C%20iOS-blue)](#download)
+[![Release](https://img.shields.io/github/v/release/kunkundi/crossdesk)](https://github.com/kunkundi/crossdesk/releases)
+[![Build](https://github.com/kunkundi/crossdesk/actions/workflows/build.yml/badge.svg)](https://github.com/kunkundi/crossdesk/actions/workflows/build.yml)
+[![License: GPL v3](https://img.shields.io/badge/license-GPL--3.0-blue)](LICENSE)
+[![Stars](https://img.shields.io/github/stars/kunkundi/crossdesk?style=social)](https://github.com/kunkundi/crossdesk/stargazers)
 
-[ [中文](README.md) / English ]
+</div>
 
----
+CrossDesk connects Windows, macOS, and Linux desktops, with browser and native iOS clients for controlling computers. Built on [MiniRTC](https://github.com/kunkundi/minirtc), it supports real-time video and audio, keyboard and mouse control, file transfer, and self-hosting. The project is under active development.
+
+> This guide follows the current repository source. Desktop screenshots render the current Slint UI with sample IDs, passwords, online statuses, and recent devices; thumbnails show public pages. Check each release's notes for the features and requirements of its binaries. Native iOS build and signing instructions are below.
+
+[Preview](#preview) · [Download](#download) · [Quick start](#quick-start) · [Session controls](#session) · [Settings](#settings) · [iOS](#ios) · [Self-hosting](#self-hosting) · [Build](docs/BUILD_EN.md) · [FAQ](docs/FAQ.md#english)
+
+<a id="preview"></a>
 
 ## Preview
 
-### PC Client
+### Desktop client
 
-![sup_example](https://github.com/user-attachments/assets/3f17d8f3-7c4a-4b63-bae4-903363628687)
-
-### Web Client
+The main window brings together your device ID, connection password, remote connection entry, and recent devices.
 
 <p align="center">
-  <img width="850" height="550" alt="6bddcbed47ffd4b9988a4037c7f4f524" src="https://github.com/user-attachments/assets/e44f73f9-24ac-46a3-a189-b7f8b6669881" />
+  <img src="docs/images/desktop-main-en.png" width="800" alt="Current desktop UI example showing a connected server and three online devices with page thumbnails" />
 </p>
 
----
+### Web client
 
-## Introduction
+Enter a remote device ID and password in your browser without installing the desktop app on the controlling device.
 
-CrossDesk is a lightweight cross-platform remote desktop software.
+<p align="center">
+  <img src="docs/images/web-client.png" width="800" alt="Current CrossDesk Web Client connection page in Chinese" />
+</p>
 
-CrossDesk is an experimental application of [MiniRTC](https://github.com/kunkundi/minirtc.git), a lightweight cross-platform real-time audio and video transmission library. MiniRTC provides fundamental capabilities including network traversal ([RFC5245](https://datatracker.ietf.org/doc/html/rfc5245)), video software/hardware encoding and decoding (H264/AV1), audio encoding/decoding ([Opus](https://github.com/xiph/opus)), signaling interaction, network congestion control, and transmission encryption ([SRTP](https://tools.ietf.org/html/rfc3711)).
+See the [screenshot notes](docs/images/README.md) for image sources and refresh instructions.
 
----
+## Features
 
-## System Requirements
-
-| Platform | Minimum Version |
+| Capability | Current support |
 | --- | --- |
-| **Windows** | Windows 10 or later (64-bit) |
-| **macOS** | macOS Intel 15.0 or later *(versions between 14.0 and 15.0 can be built manually for compatibility)*<br>macOS Apple Silicon 14.0 or later |
-| **Linux** | Ubuntu 20.04 or later |
+| Cross-platform control | Windows / macOS / Linux desktop control; browser and native iOS controllers |
+| Live video and audio | H.264 / AV1, 30 / 60 fps settings, hardware codec options, and remote audio; availability depends on hardware and build configuration |
+| Devices and displays | Recent connections, device aliases, session tabs, and remote display switching |
+| Input and sharing | Keyboard/mouse input, remote cursor synchronization, shortcuts, text clipboard synchronization, and file transfer |
+| Networking and deployment | Direct P2P connections, TURN relay, an SRTP encryption option, and self-hosted signaling/relay services |
+| Windows protected desktops | CrossDesk Service forwards input on lock screens, sign-in screens, and secure desktops |
 
----
+Controls and capabilities vary by client. Desktop controls are described below; see the [iOS guide](apps/ios/README.md) for native mobile features.
 
-## Usage
+<a id="download"></a>
 
-Enter the remote desktop ID in the menu bar’s “Remote ID” field and click “→” to initiate a remote connection.
+## Download and install
 
-![usage1](https://github.com/user-attachments/assets/3a4bb59f-c84c-44d2-9a20-11790aac510e)
+Choose a package matching your OS and CPU architecture from [GitHub Releases](https://github.com/kunkundi/crossdesk/releases) or the [website](https://www.crossdesk.cn/).
 
-If the remote desktop requires a connection password, you must enter the correct password on your side to successfully establish the connection.
+| Platform | Current source / CI baseline | Installation |
+| --- | --- | --- |
+| Windows | Windows 10+, x64 | `.exe` installer; portable builds are also supported |
+| macOS | macOS 14.0+, Intel / Apple Silicon | x64 or arm64 `.pkg` |
+| Linux | Ubuntu 20.04+, amd64 / arm64, glibc 2.31 baseline | `.deb` package |
+| iOS / iPadOS | iOS 16.0+, arm64 physical device | Native controller; build and sign with Xcode, or sign the unsigned CI app |
+| Web | A WebRTC-capable browser | Open [web.crossdesk.cn](https://web.crossdesk.cn/) |
 
-![password](https://github.com/user-attachments/assets/1beadcce-640d-4f5c-8e77-51917b5294d5)
+On Linux, replace the example filename with the downloaded package name:
 
-Before connecting, you can customize configuration options in the settings, such as language and video encoding format.
+```bash
+sudo apt install "./crossdesk-linux-amd64-<version>.deb"
+```
 
-![settings](https://github.com/user-attachments/assets/8bc5468d-7bbb-4e30-95bd-da1f352ac08c)
+**First launch on macOS:** follow the app prompts to grant **Screen Recording** (called **Screen & System Audio Recording** on newer systems) and **Accessibility** under **System Settings → Privacy & Security**. Reopen the app if prompted. These permissions allow desktop capture and remote keyboard/mouse input respectively.
 
-### Using the Web Client
+<a id="quick-start"></a>
 
-Visit [CrossDesk Web Client](https://web.crossdesk.cn/).
-Enter the **Remote Device ID** and **Password**, then click Connect to access the remote device. As shown, **iOS Safari remotely controlling Windows 11**:
+## Quick start
 
-<img width="645" height="300" alt="_cgi-bin_mmwebwx-bin_webwxgetmsgimg__ MsgID=932911462648581698 skey=@crypt_1f5153b1_b550ca7462b5009ce03c991cca2a92a7 mmweb_appid=wx_webfilehelper" src="https://github.com/user-attachments/assets/a5109e6f-752c-4654-9f4e-7e161bddf43e" />
+### Connect from another computer
 
-### Windows Service (CrossDesk Service)
+1. **Prepare the host.** Install and run CrossDesk on the computer to control. Wait for the bottom status bar to show that the server is connected. Share the **Local ID** and **Password** shown under **Local Desktop** with the controller.
+2. **Enter the remote ID.** On the controlling computer, enter the host's ID in **Remote Desktop → Remote ID**, then click **→**.
+3. **Verify the password.** Enter the host's current connection password when prompted and confirm. Select **Remember password** if you want to save it.
+4. **Reconnect later.** Previously connected devices appear under **Recent Connections**. Reconnect from a card, edit its alias, or remove its record.
 
-CrossDesk provides a local helper service on Windows named **CrossDesk Service**. Its service name is `CrossDeskService`. The service improves remote control in protected Windows states such as the lock screen, sign-in UI, credential UI, and secure desktop. It provides:
+The eye button shows or hides the local password; the pencil button changes it. Use **6 ASCII letters or digits** and stay connected to the server while changing it. Wait for the change to succeed and the client to reconnect, then copy the current password. Controllers that saved the old password must enter it again.
 
-- Remote status reporting for lock screen, sign-in, credential, and secure desktop states.
-- Remote `Ctrl+Alt+Del` (SAS) delivery.
-- Keyboard and mouse input forwarding while the remote Windows device is on the lock screen, sign-in UI, or secure desktop.
+### Connect from a browser
 
-The Windows installer bundles `crossdesk_service.exe` and `crossdesk_session_helper.exe`, then registers the service as an on-demand Windows service during installation. When the CrossDesk client starts, it tries to start the installed service automatically. When no CrossDesk client process is running on the machine, the service exits automatically. Uninstalling the client also stops and removes the service.
+1. Keep CrossDesk running and connected to the server on the host computer, with **Enable SRTP** enabled in its Settings.
+2. Open the [Web Client](https://web.crossdesk.cn/), enter the **Remote Device ID** and **Password**, and click **Connect**.
+3. Use the page's display, mouse-mode, and keyboard controls during the session. Phone and tablet browsers can also connect.
 
-For manual Windows builds or deployments, make sure `CrossDesk.exe`, `crossdesk_service.exe`, and `crossdesk_session_helper.exe` are placed in the same directory. Open PowerShell with administrator privileges to install or uninstall the service:
+For self-hosting, connect both sides to the same service. Browser deployment is documented in [CrossDesk Web Client](https://github.com/kunkundi/crossdesk-web-client).
+
+<a id="session"></a>
+
+## Session controls
+
+Switch devices using session tabs. Expand the control bar if it is collapsed, and hover over icons to see their tooltips.
+
+| Control | Action |
+| --- | --- |
+| Display | Switch the remote monitor |
+| Keyboard | Send shortcuts; Windows `Ctrl+Alt+Del` requires the remote service |
+| Mouse | Enable / release remote mouse control |
+| Speaker | Play / mute remote audio |
+| Folder | Select a file to send and view transfer progress |
+| Network statistics | Inspect traffic, packet loss, frame rate, resolution, and direct / relay mode |
+| Fullscreen | Enter / exit fullscreen |
+| Disconnect | End the current remote session |
+
+Desktop clients synchronize text clipboard contents. Configure the receiving directory under **Settings → File Save Path**. Closing the main window hides it and keeps the app running; use the system tray or menu-bar exit command to quit completely.
+
+<a id="settings"></a>
+
+## Video and connection settings
+
+Open **☰ → Settings** in the top-right corner and click **OK** to save. Configure the session before connecting; some settings are disabled during an active session. Scroll down for self-hosting, startup behavior, and the file save path.
+
+<p align="center">
+  <img src="docs/images/desktop-settings-en.png" width="720" alt="Current settings for quality, frame rate, video preference, codecs, relay, and SRTP" />
+</p>
+
+| Setting | Purpose |
+| --- | --- |
+| Video Quality / Video Capture Frame Rate | Low, medium, or high quality and 30 / 60 fps; actual performance depends on the connection and device |
+| Video Preference | Choose frame-rate priority, quality priority, or balanced adaptation |
+| Video Encode Format | H.264 / AV1; hardware codec availability depends on the platform, device, and build options |
+| Enable TURN Service | Allow relay-assisted connections; check this setting if P2P fails |
+| SRTP | Media encryption option; configurations on both ends must be compatible |
+| Self-Hosted Config | Set the host, signaling port, and TURN port, then enable the checkbox |
+| Auto Start / Enable Daemon | Configure startup and process supervision; restart as indicated by the UI |
+| File Save Path | Choose where received files are saved |
+
+<a id="ios"></a>
+
+## Native iOS / iPadOS client
+
+[`apps/ios`](apps/ios/README.md) contains a native controller using the same MiniRTC protocol as the desktop client. It controls remote computers; it does not expose an iPhone or iPad as a remotely controlled desktop.
+
+1. Follow the [iOS guide](apps/ios/README.md) to build and sign the app with Xcode, then install it on an iOS 16+ physical device.
+2. Enter a remote ID on the home screen, connect, and enter its password. Successful connections become available in the recent devices list.
+3. Choose a mouse mode in Settings: **Relative Position** works like a trackpad; **Absolute Position** maps touches directly to the remote screen.
+4. Tap the floating icon to expand the menu, then switch displays, open the keyboard, toggle audio, or send files. Received files are stored in `Documents/Received` and can be exported using the share button beside the transfer status.
+
+The app currently receives remote text into the iOS clipboard. Its UI does not yet expose a button to send the local clipboard.
+
+Gestures include one-finger click, two-finger right-click, long-press drag, and pinch-to-zoom. When zoomed in, two-finger panning moves the viewport. The native and browser clients are maintained separately, so their controls and gestures may differ. The current native UI uses Chinese labels.
+
+<a id="windows-service"></a>
+
+## Windows lock screens and sign-in
+
+**CrossDesk Service** (`CrossDeskService`) reports protected desktop states and forwards `Ctrl+Alt+Del`, keyboard, and mouse input on lock screens, sign-in screens, credential prompts, and secure desktops.
+
+The installer registers an on-demand service. CrossDesk tries to start it on launch, and the service exits when no local CrossDesk client is running. Portable builds offer service installation in the prompt or **Settings → Lock Screen Service**, with administrator privileges. The service depends on a running client.
+
+<details>
+<summary>Manual deployment and service commands</summary>
+
+Keep the complete installation directory. For manual deployment, place `CrossDesk.exe`, `crossdesk_service.exe`, `crossdesk_session_helper.exe`, and all `.dll` files from the same build together. Open an administrator PowerShell in that directory and run the commands you need:
 
 ```powershell
-# install
 .\CrossDesk.exe --service-install
-# start
 .\CrossDesk.exe --service-start
-# check status
 .\CrossDesk.exe --service-status
 .\CrossDesk.exe --service-ping
-# stop
+# Stop or uninstall the service
 .\CrossDesk.exe --service-stop
-# uninstall
 .\CrossDesk.exe --service-uninstall
 ```
 
-If the remote Windows service is not installed, not running, or temporarily unavailable, the basic remote desktop connection still works, but remote control on the lock screen, sign-in UI, and secure desktop is limited. The client will show “Remote Windows service unavailable”.
+</details>
 
----
+If **Remote Windows service unavailable** appears, check installation and service status on the host. Ordinary desktop connections remain available, while control of protected screens is limited.
 
-## How to build
+<a id="self-hosting"></a>
 
-### Build requirements
+## Self-hosting
 
-- [xmake](https://xmake.io/#/guide/installation)
-- [cmake](https://cmake.org/download/) 3.21 or later (installed automatically by xmake when the system version is too old)
+Host your own signaling and TURN services, then enter their connection details under **☰ → Settings → Self-Hosted Config**. Enable the same server configuration on both the controller and host.
 
-### Linux
+- [Self-hosting guide](docs/SELF_HOSTING_EN.md): current Compose deployment, client settings, certificate trust, and troubleshooting.
+- [CrossDesk Server](https://github.com/kunkundi/crossdesk-server): server source and release configuration.
+- [CrossDesk Web Client](https://github.com/kunkundi/crossdesk-web-client): browser source and deployment instructions.
 
-Linux builds support Ubuntu 20.04 or later on amd64 and arm64. Release packages
-use Ubuntu 20.04/glibc 2.31 as their compatibility baseline. Install the base
-build dependencies first:
+## Development and feedback
 
-```bash
-sudo apt-get update
-sudo apt-get install -y \
-  git curl unzip build-essential gcc-10 g++-10 python3-pip \
-  pkg-config binutils dpkg-dev \
-  libx11-dev libxext-dev libxrender-dev libxft-dev libxrandr-dev \
-  libxinerama-dev libxcursor-dev libxi-dev libxfixes-dev libxv-dev \
-  libxtst-dev libxcb-randr0-dev libxcb-xtest0-dev libxcb-xinerama0-dev \
-  libxcb-shape0-dev libxcb-xkb-dev libxcb-xfixes0-dev libxcb-shm0-dev \
-  libasound2-dev libsndio-dev libpulse-dev \
-  libgl1-mesa-dev
-```
+- [Build from source](docs/BUILD_EN.md): Windows, macOS, Linux, optional flags, and packaging.
+- [iOS development](apps/ios/README.md): native build and physical-device checks.
+- [GUI architecture](docs/gui-architecture.md): desktop UI and platform organization.
+- [FAQ](docs/FAQ.md#english): connection failures, blank video, received files, and build issues.
+- [Report an issue](https://github.com/kunkundi/crossdesk/issues): include both operating systems, client versions, connection mode, and reproduction steps.
 
-When Ubuntu 20.04's bundled CMake 3.16 is too old, xmake automatically
-downloads and uses CMake 3.21 or later; replacing the system CMake manually is
-not required.
+## Acknowledgements and license
 
-Ubuntu 20.04's default GCC 9 lacks parts of the C++20 standard library needed
-by Slint's C++ API, so the commands above install GCC 10 and the configuration
-below selects it explicitly.
+Thanks to [HelloGitHub](https://hellogithub.com/), [Ruanyf Weekly](https://github.com/ruanyf/weekly), and the [LinuxDo](https://linux.do) community for featuring CrossDesk and contributing feedback.
 
-Install the optional dependencies when Wayland capture or DRM capture is enabled:
+CrossDesk is licensed under [GPL-3.0](LICENSE). See the [Privacy Policy](PRIVACY.md#english).
 
-```bash
-sudo apt-get install -y libdbus-1-dev libdrm-dev
+### Code signing policy
 
-# Ubuntu 22.04 and later can alternatively use the distribution packages.
-# sudo apt-get install -y libpipewire-0.3-dev libspa-0.2-dev
-```
-
-Clone the submodules and build a release binary:
-
-```bash
-git clone --recurse-submodules https://github.com/kunkundi/crossdesk.git
-cd crossdesk
-
-# Run this when the repository has already been cloned
-git submodule update --init --recursive
-
-# Ubuntu 20.04 has no PipeWire 0.3 development package. Install the
-# header-only SDK used during compilation. Skip this when the distribution's
-# PipeWire 0.3 development packages are already installed.
-sudo ./docker/linux-build/install-pipewire-sdk.sh
-
-xmake f -c -m release --USE_CUDA=false --toolchain=gcc-10 -y
-xmake b -vy crossdesk
-```
-
-Use `--toolchain=gcc-10` so that both CrossDesk and third-party packages such
-as libyuv, which xmake builds during configuration, use GCC 10. Specifying only
-`--cc`/`--cxx` may still let dependency builds fall back to the system
-`/bin/cc` and `/bin/c++`. Keep `-c` when switching compilers to clear the old
-configuration.
-
-The amd64 binary is written to `build/linux/x86_64/release/crossdesk`; the arm64 binary is written to `build/linux/arm64/release/crossdesk`.
-
-Example configuration with Wayland and DRM capture enabled:
-
-```bash
-xmake f -c -m release --USE_WAYLAND=true --USE_DRM=true --USE_CUDA=false \
-  --toolchain=gcc-10 -y
-xmake b -vy crossdesk
-```
-
-Build a Debian package after compiling a release binary on the matching architecture:
-
-```bash
-# amd64
-./apps/desktop/scripts/linux/pkg_amd64.sh 1.0.0
-
-# arm64
-./apps/desktop/scripts/linux/pkg_arm64.sh 1.0.0
-```
-
-The package scripts install the shared Slint runtime in the private `/usr/lib/crossdesk` directory, so users do not need to install `libslint_cpp.so` separately.
-PipeWire is not a mandatory runtime dependency. CrossDesk detects the host's
-PipeWire 0.3 runtime dynamically and can still use X11 capture (and DRM when
-enabled at build time) when it is unavailable.
-
-### Common build options
-
-```text
---USE_CUDA=true/false: Enable CUDA hardware codec acceleration, disabled by default
---USE_WAYLAND=true/false: Enable Wayland/PipeWire capture on Linux, disabled by default
---USE_DRM=true/false: Enable DRM capture on Linux, disabled by default
---CROSSDESK_PORTABLE=true/false: Build the portable variant, disabled by default
---CROSSDESK_VERSION=xxx: Set the CrossDesk version
-
-# Example
-xmake f --CROSSDESK_VERSION=1.0.0 --USE_CUDA=true
-```
-
-Run:
-
-```bash
-xmake r crossdesk
-```
-
-### Development Without CUDA Environment
-
-For **Linux developers who do not have a CUDA environment installed and want to enable hardware codec feature**, a preconfigured [Ubuntu 20.04 compatibility build image](https://hub.docker.com/r/crossdesk/ubuntu20.04) is provided.
-This image contains the required build dependencies and produces a single Linux package compatible with the glibc 2.31 baseline.
-
-After entering the container, download the project and run:
-
-```bash
-export CUDA_PATH=/usr/local/cuda
-export XMAKE_GLOBALDIR=/data
-
-xmake f --USE_CUDA=true
-xmake b --root -vy crossdesk
-```
-
-For **Windows developers without a CUDA environment** installed, run the following command to install the CUDA build environment:
-
-```powershell
-xmake require -vy "cuda 12.6.3"
-```
-
-After the installation is complete, execute:
-
-```powershell
-xmake require --info "cuda 12.6.3"
-```
-
-The output will look like this:
-
-<img width="860" height="226" alt="Image" src="https://github.com/user-attachments/assets/999ac365-581a-4b9a-806e-05eb3e4cf44d" />
-
-From the output above, locate the CUDA installation directory — this is the path pointed to by installdir.
-Add this path to your system environment variable CUDA_PATH, or set it in the terminal using:
-
-```powershell
-set CUDA_PATH=path_to_cuda_installdir
-```
-
-Then re-run:
-
-```powershell
-xmake f --USE_CUDA=true
-xmake b -vy crossdesk
-```
-
-#### Notice
-
-If the client status bar shows **Disconnected** during runtime, please first install the client from the [CrossDesk official website](https://www.crossdesk.cn/) to ensure the required certificate files are available in the environment.
-
-<img width="256" height="120" alt="image" src="https://github.com/user-attachments/assets/1812f7d6-516b-4b4f-8a3d-98bee505cc5a" />
-
-### About Xmake
-
-#### Installing Xmake
-
-You can install Xmake using one of the following methods:
-
-Using curl:
-
-```bash
-curl -fsSL https://xmake.io/shget.text | bash
-```
-
-Using wget:
-
-```bash
-wget https://xmake.io/shget.text -O - | bash
-```
-
-Using powershell:
-
-```powershell
-irm https://xmake.io/psget.text | iex
-```
-
-#### Build Options
-
-```text
-# Switch build mode
-xmake f -m debug/release
-
-# Optional build parameters
--r : Rebuild the target
--v : Show detailed build logs
--y : Automatically confirm prompts
-
-# Example
-xmake b -vy crossdesk
-```
-
-#### Run Options
-
-```bash
-# Run in debug mode
-xmake r -d crossdesk
-```
-
-For more information, please refer to the [official Xmake documentation](https://xmake.io/guide/quick-start.html).
-
----
-
-## Self-Hosted Server
-
-### Server
-
-It is recommended to deploy CrossDesk Server using Docker.
-
-```bash
-sudo docker run -d \
-  --name crossdesk_server \
-  --network host \
-  -e EXTERNAL_IP=xxx.xxx.xxx.xxx \
-  -e INTERNAL_IP=xxx.xxx.xxx.xxx \
-  -e CROSSDESK_SERVER_PORT=xxxx \
-  -e COTURN_PORT=xxxx \
-  -e MIN_PORT=xxxxx \
-  -e MAX_PORT=xxxxx \
-  -v /var/lib/crossdesk:/var/lib/crossdesk \
-  -v /var/log/crossdesk:/var/log/crossdesk \
-  crossdesk/crossdesk-server:v1.1.6
-```
-
-The parameters you need to pay attention to are as follows:
-
-#### Parameters
-
-- **EXTERNAL_IP**: The server’s public IP. This corresponds to **Server Address** in the CrossDesk client’s **Self-Hosted Server Configuration**.
-- **INTERNAL_IP**: The server’s internal IP.
-- **CROSSDESK_SERVER_PORT**: The port used by the self-hosted service. This corresponds to **Server Port** in the CrossDesk client’s **Self-Hosted Server Configuration**.
-- **COTURN_PORT**: The port used by the COTURN service. This corresponds to **Relay Service Port** in the CrossDesk client’s **Self-Hosted Server Configuration**.
-- **MIN_PORT / MAX_PORT**: The port range used by the COTURN service. Example: `MIN_PORT=50000`, `MAX_PORT=60000`. Adjust the range depending on the number of clients.
-- `-v /var/lib/crossdesk:/var/lib/crossdesk`: Persists database and certificate files on the host machine.
-- `-v /var/log/crossdesk:/var/log/crossdesk`: Persists log files on the host machine.
-
-#### Example
-
-```bash
-sudo docker run -d \
-  --name crossdesk_server \
-  --network host \
-  -e EXTERNAL_IP=114.114.114.114 \
-  -e INTERNAL_IP=10.0.0.1 \
-  -e CROSSDESK_SERVER_PORT=9099 \
-  -e COTURN_PORT=3478 \
-  -e MIN_PORT=50000 \
-  -e MAX_PORT=60000 \
-  -v /var/lib/crossdesk:/var/lib/crossdesk \
-  -v /var/log/crossdesk:/var/log/crossdesk \
-  crossdesk/crossdesk-server:v1.1.6
-```
-
-#### Notes
-
-- **The server must open the following ports: COTURN_PORT/udp, COTURN_PORT/tcp, MIN_PORT–MAX_PORT/udp, and CROSSDESK_SERVER_PORT/tcp.**
-- If you don’t mount volumes, all data will be lost when the container is removed.
-- Certificate files will be automatically generated on first startup and persisted to the host at `/var/lib/crossdesk/certs`. As the default certificates are self-signed and cannot guarantee security, it is strongly recommended to apply for a trusted certificate from a cloud provider, deploy it to this directory, and restart the service.
-- The database file will be automatically created and stored at `/var/lib/crossdesk/db/crossdesk-server.db`.
-- Log files will be created and stored at `/var/log/crossdesk/`.
-
-#### Directory permissions
-
-If the directories automatically created by Docker belong to root and have insufficient write permissions, the container user may not be able to write to them. This can cause:
-
-- Certificate generation failure, leading to startup script errors and container exit.
-- Database directory creation failure, causing the program to throw exceptions and crash.
-- Log directory creation failure, preventing logs from being written (though the program may continue running).
-
-Manually set permissions before starting the container:
-
-```bash
-sudo mkdir -p /var/lib/crossdesk /var/log/crossdesk
-sudo chown -R $(id -u):$(id -g) /var/lib/crossdesk /var/log/crossdesk
-```
-
-#### TLS certificate
-
-Place **crossdesk.cn.key** and **crossdesk.cn_bundle.crt** into the **/path/to/your/certs** directory.
-
-### Client
-
-1. Click the settings icon in the top-right corner to enter the settings page.<br><br>
-<img width="600" height="210" alt="image" src="https://github.com/user-attachments/assets/6431131d-b32a-4726-8783-6788f47baa3b" /><br>
-
-2. Click `Self-Hosted Server Configuration` button.<br><br>
-<img width="600" height="160" alt="image" src="https://github.com/user-attachments/assets/24c761a3-1985-4d7e-84be-787383c2afb8" /><br>
-
-3. Enter the `Server Address` (**EXTERNAL_IP**), `Signaling Service Port` (**CROSSDESK_SERVER_PORT**), and `Relay Service Port` (**COTURN_PORT**) and click OK button.
-
-4. Check the `Self-hosted server configuration` option and click the OK button to save the settings. If the server is using a valid (official) certificate, the process ends here and the client will show that it is connected to the server.
-
-5. If the default certificate is used (skip this step if an official certificate is used), download the self-signed root certificate `api.crossdesk.cn_root.crt` from the server directory /var/lib/crossdesk/certs/ to the machine running the client, and install the certificate by executing the following command:
-
-**Windows:** Open PowerShell with administrator privileges and execute:
-
-```powershell
-certutil -addstore "Root" "C:\path\to\api.crossdesk.cn_root.crt"
-```
-
-**Linux:**
-
-```bash
-sudo cp /path/to/api.crossdesk.cn_root.crt /usr/local/share/ca-certificates/api.crossdesk.cn_root.crt
-sudo update-ca-certificates
-```
-
-**macOS:**
-
-```bash
-sudo security add-trusted-cert -d -r trustRoot -k /Library/Keychains/System.keychain path/to/api.crossdesk.cn_root.crt
-```
-
-### Self-Hosted Web Client
-
-See [CrossDesk Web Client](https://github.com/kunkundi/crossdesk-web-client).
-
----
-
-## FAQ
-
-See [FAQ](https://github.com/kunkundi/crossdesk/blob/self-hosted-server/docs/FAQ.md).
-
----
-
-## Acknowledgements
-
-- Thanks to [HelloGitHub](https://hellogithub.com/) for the recommendation and exposure.
-- Thanks to [Ruanyf Weekly](https://github.com/ruanyf/weekly) for featuring CrossDesk.
-- Thanks to the [LinuxDo](https://linux.do) community for the attention, discussions, and support that helped improve CrossDesk.
-
----
-
-## Code signing policy
-
-CrossDesk uses SignPath.io to code-sign official Windows releases built from this repository.
+CrossDesk uses SignPath.io to sign official Windows releases built from this repository.
 
 **Free code signing provided by [SignPath.io](https://signpath.io/), certificate by [SignPath Foundation](https://signpath.org/).**
 
 - **Committers and reviewers:** [kunkundi](https://github.com/kunkundi)
 - **Approvers:** [kunkundi](https://github.com/kunkundi)
-- **Privacy policy:** [Read the CrossDesk Privacy Policy](PRIVACY.md#english)

apps/desktop/resources/windows/crossdesk_privacy_window.rc

@@ -0,0 +1,13 @@
+/*
+ * @Author: DI JUNKUN
+ * @Date: 2026-09-11
+ * Copyright (c) 2026 by DI JUNKUN, All Rights Reserved.
+ */
+
+IDI_CROSSDESK_LOGO ICON "crossdesk.ico"
+
+#define CROSSDESK_FILE_DESCRIPTION "CrossDesk Privacy Window"
+#define CROSSDESK_ORIGINAL_FILENAME "crossdesk_privacy_window.dll"
+#define CROSSDESK_FILE_TYPE VFT_DLL
+
+#include "version_info.rcinc"

apps/desktop/scripts/linux/package_deb.sh

@@ -1,6 +1,9 @@
 #!/usr/bin/env bash
 set -euo pipefail
 
+# Keep readelf and ldd output stable for the runtime dependency checks below.
+export LC_ALL=C
+
 if [[ $# -lt 3 || $# -gt 4 ]]; then
     echo "Usage: $0 <debian-arch> <xmake-arch> <version> [extra-recommendation]" >&2
     exit 2
@@ -84,7 +87,7 @@ if [[ ! -x "$BUILD_BINARY" ]]; then
     exit 1
 fi
 
-for command_name in readelf ldd dpkg-deb; do
+for command_name in readelf ldd dpkg-deb strip; do
     if ! command -v "$command_name" >/dev/null 2>&1; then
         echo "Required packaging command is missing: $command_name" >&2
         exit 1
@@ -125,6 +128,9 @@ if [[ -n "$SLINT_NEEDED" ]]; then
         exit 1
     fi
     install -m 0755 "$SLINT_LIBRARY" "$PRIVATE_DIR/$SLINT_NEEDED"
+    # Keep dynamic exports/relocations while removing unneeded symbols from the
+    # staged copy. Never strip Xmake's cached runtime in place.
+    strip --strip-unneeded "$PRIVATE_DIR/$SLINT_NEEDED"
 fi
 
 cat > "$BIN_DIR/$PKG_NAME" <<'EOF'
@@ -158,7 +164,7 @@ Architecture: $DEBIAN_ARCH
 Maintainer: $MAINTAINER
 Description: $DESCRIPTION
 Depends: libc6 (>= 2.31), libstdc++6 (>= 10), libx11-6, libxext6,
- libxrender1, libxft2, libxrandr2, libxfixes3, libxcursor1, libxcb1, libxcb-randr0,
+ libxrender1, libxft2, libxrandr2, libxfixes3, libxcursor1, libxi6, libxcb1, libxcb-randr0,
  libxcb-xtest0, libxcb-xinerama0, libxcb-shape0, libxcb-xkb1,
  libxcb-xfixes0, libxv1, libxtst6, $ALSA_RUNTIME_DEP, libsndio7.0,
  libxcb-shm0, libpulse0, libdrm2, libdbus-1-3, libgl1
@@ -169,11 +175,12 @@ EOF
 
 cat > "$DESKTOP_DIR/$PKG_NAME.desktop" <<EOF
 [Desktop Entry]
-Version=$DEB_VERSION
+Version=1.0
 Name=$APP_NAME
 Comment=$DESCRIPTION
 Exec=/usr/bin/$PKG_NAME
 Icon=$PKG_NAME
+StartupWMClass=$PKG_NAME
 Terminal=false
 Type=Application
 Categories=Utility;

apps/desktop/scripts/macos/bundle_app.sh

@@ -11,7 +11,7 @@ EXPECTED_ARCH="$2"
 APP_EXECUTABLE="$APP_BUNDLE/Contents/MacOS/CrossDesk"
 FRAMEWORKS_DIR="$APP_BUNDLE/Contents/Frameworks"
 
-for command_name in codesign install_name_tool lipo otool; do
+for command_name in codesign install_name_tool lipo otool strip; do
     if ! command -v "$command_name" >/dev/null 2>&1; then
         echo "Required bundling command is missing: $command_name" >&2
         exit 1
@@ -123,7 +123,11 @@ if ! otool -l "$APP_EXECUTABLE" | awk '
     install_name_tool -add_rpath "@executable_path/../Frameworks" "$APP_EXECUTABLE"
 fi
 
-# install_name_tool invalidates the linker's ad-hoc signature. Sign nested code
+# Strip only the staged runtime, retaining exported symbols for Slint's C ABI.
+# The package cache remains intact for debugging and other consumers.
+strip -S -x "$FRAMEWORKS_DIR/$SLINT_NAME"
+
+# install_name_tool and strip invalidate the linker's ad-hoc signature. Sign nested code
 # first, then seal the complete app bundle so local packages remain launchable.
 codesign --force --sign - "$FRAMEWORKS_DIR/$SLINT_NAME"
 codesign --force --deep --sign - "$APP_BUNDLE"

apps/desktop/scripts/windows/nsis_script.nsi

@@ -88,8 +88,10 @@ installApp:
     ; Bundle service-side binaries required by the Windows service flow
     File "..\..\..\..\build\windows\x64\release\crossdesk_service.exe"
     File "..\..\..\..\build\windows\x64\release\crossdesk_session_helper.exe"
+    File "..\..\..\..\build\windows\x64\release\crossdesk_privacy_cursor_helper.exe"
+    File "..\..\..\..\build\windows\x64\release\crossdesk_privacy_window.dll"
     ; Bundle runtime DLLs from the release output directory
-    File "..\..\..\..\build\windows\x64\release\*.dll"
+    File /x crossdesk_privacy_window.dll "..\..\..\..\build\windows\x64\release\*.dll"
 
     Call RegisterInstalledService
 
@@ -145,6 +147,8 @@ uninstallApp:
     Delete "$INSTDIR\CrossDesk.exe"
     Delete "$INSTDIR\crossdesk_service.exe"
     Delete "$INSTDIR\crossdesk_session_helper.exe"
+    Delete "$INSTDIR\crossdesk_privacy_cursor_helper.exe"
+    Delete "$INSTDIR\crossdesk_privacy_window.dll"
     Delete "$INSTDIR\uninstall.exe"
 
     ; Recursively delete installation directory

apps/desktop/src/app/main.cpp

@@ -15,14 +15,20 @@
 #ifdef _WIN32
 #include <cstdio>
 
+#include "platform/windows/gui/slint_backend.h"
 #include "service_host.h"
 #endif
 
 #include "config_center.h"
 #include "daemon.h"
 #include "path_manager.h"
+#include "rd_log.h"
 #include "render.h"
 
+#ifdef __linux__
+#include "platform/linux/privacy/privacy_guard.h"
+#endif
+
 #ifdef _WIN32
 namespace {
 
@@ -174,6 +180,26 @@ int HandleServiceCliCommand(const std::string& command) {
 #endif
 
 int main(int argc, char* argv[]) {
+#ifdef __linux__
+  // Run before GUI, configuration, logging or daemon initialization. The
+  // guard owns native privacy resources and restores them if this app exits.
+  if (argc == 2 &&
+      std::strcmp(argv[1], crossdesk::kLinuxPrivacyGuardArgument) == 0) {
+    return crossdesk::RunLinuxPrivacyGuard();
+  }
+#endif
+#ifdef _WIN32
+  if (argc == 2 &&
+      std::strcmp(argv[1], crossdesk::kSlintRendererProbeArgument) == 0) {
+    return crossdesk::RunSlintRendererProbe();
+  }
+#endif
+
+  // Service operations and config migration can log before the GUI starts.
+  // Configure the directory first, including CLI and daemon child paths.
+  auto path_manager = std::make_unique<crossdesk::PathManager>("CrossDesk");
+  crossdesk::InitLogger(path_manager->GetLogPath().string());
+
 #ifdef _WIN32
   if (argc > 1 && IsServiceCliCommand(argv[1])) {
     return HandleServiceCliCommand(argv[1]);
@@ -201,7 +227,6 @@ int main(int argc, char* argv[]) {
 #endif
 
   bool enable_daemon = false;
-  auto path_manager = std::make_unique<crossdesk::PathManager>("CrossDesk");
   if (path_manager) {
     std::string cache_path = path_manager->GetCachePath().string();
     crossdesk::ConfigCenter config_center(cache_path + "/config.ini");
@@ -228,4 +253,4 @@ int main(int argc, char* argv[]) {
   crossdesk::Render render;
   render.Run();
   return 0;
-}
+}

apps/desktop/src/common/task_queue_lock_free.cpp

@@ -0,0 +1,79 @@
+#include "task_queue_lock_free.h"
+
+#include <exception>
+#include <new>
+#include <stdexcept>
+#include <utility>
+
+namespace crossdesk {
+
+TaskQueueLockFree::TaskQueueLockFree()
+    : producer_(task_queue_), worker_([this] { WorkerThread(); }) {}
+
+TaskQueueLockFree::~TaskQueueLockFree() { Stop(); }
+
+std::future<void> TaskQueueLockFree::PostTask(std::function<void()> task) {
+  TaskItem item;
+  item.run = std::move(task);
+  auto result = item.completion.get_future();
+  {
+    std::lock_guard lock(mutex_);
+    if (stopping_) {
+      throw std::runtime_error("Cannot post to a stopped task queue");
+    }
+
+    // Count before publishing: the worker may dequeue as soon as enqueue returns.
+    ++pending_tasks_;
+    if (!task_queue_.enqueue(producer_, std::move(item))) {
+      --pending_tasks_;
+      throw std::bad_alloc();
+    }
+  }
+  wake_.notify_one();
+  return result;
+}
+
+void TaskQueueLockFree::Stop() {
+  // Concurrent Stop callers all wait for the same worker shutdown to finish.
+  std::call_once(stop_once_, [this] {
+    {
+      std::lock_guard lock(mutex_);
+      stopping_ = true;
+    }
+    wake_.notify_all();
+    worker_.join();
+  });
+}
+
+void TaskQueueLockFree::WorkerThread() {
+  while (true) {
+    TaskItem item;
+    while (task_queue_.try_dequeue(item)) {
+      --pending_tasks_;
+
+      std::exception_ptr error;
+      try {
+        item.run();
+      } catch (...) {
+        error = std::current_exception();
+      }
+
+      // Release captured resources before marking the task complete.
+      item.run = nullptr;
+      if (error) {
+        item.completion.set_exception(error);
+      } else {
+        item.completion.set_value();
+      }
+    }
+
+    std::unique_lock lock(mutex_);
+    wake_.wait(lock, [this] { return stopping_ || pending_tasks_ > 0; });
+    // A stop request must not discard tasks submitted while the worker was idle.
+    if (stopping_ && pending_tasks_ == 0) {
+      return;
+    }
+  }
+}
+
+}  // namespace crossdesk

apps/desktop/src/common/task_queue_lock_free.h

@@ -0,0 +1,57 @@
+/*
+ * @Author: DI JUNKUN
+ * @Date: 2026-09-07
+ * Copyright (c) 2026 by DI JUNKUN, All Rights Reserved.
+ */
+
+#ifndef _TASK_QUEUE_LOCK_FREE_H_
+#define _TASK_QUEUE_LOCK_FREE_H_
+
+#include <atomic>
+#include <condition_variable>
+#include <cstddef>
+#include <functional>
+#include <future>
+#include <mutex>
+#include <thread>
+
+#include <concurrentqueue.h>
+
+namespace crossdesk {
+
+// A single worker executes tasks in submission order. The concurrent queue
+// stores tasks; a mutex coordinates submissions, worker wakeups and shutdown.
+class TaskQueueLockFree {
+ public:
+  TaskQueueLockFree();
+  ~TaskQueueLockFree();
+
+  // Returns completion or the task's exception. Throws if the queue is stopped.
+  std::future<void> PostTask(std::function<void()> task);
+
+  // Rejects new tasks, finishes accepted tasks and joins the worker.
+  // May be called repeatedly, but never from the queue's own tasks.
+  void Stop();
+
+ private:
+  struct TaskItem {
+    std::function<void()> run;
+    std::promise<void> completion;
+  };
+
+  void WorkerThread();
+
+  moodycamel::ConcurrentQueue<TaskItem> task_queue_;
+  // All submissions share one producer so different caller threads keep FIFO.
+  moodycamel::ProducerToken producer_;
+  std::atomic<std::size_t> pending_tasks_{0};
+  std::mutex mutex_;
+  std::condition_variable wake_;
+  bool stopping_ = false;
+  std::once_flag stop_once_;
+  std::thread worker_;
+};
+
+}  // namespace crossdesk
+
+#endif

apps/desktop/src/config_center/config_center.cpp

@@ -58,6 +58,14 @@ int ConfigCenter::Load() {
   video_frame_rate_ = static_cast<VIDEO_FRAME_RATE>(ini_.GetLongValue(
       section_, "video_frame_rate", static_cast<long>(video_frame_rate_)));
 
+  const long screen_capture_method_value = ini_.GetLongValue(
+      section_, "screen_capture_method",
+      static_cast<long>(ScreenCaptureMethod::Auto));
+  screen_capture_method_ = IsValidScreenCaptureMethod(screen_capture_method_value)
+                               ? static_cast<ScreenCaptureMethod>(
+                                     screen_capture_method_value)
+                               : ScreenCaptureMethod::Auto;
+
   const long video_adaptation_policy_value = ini_.GetLongValue(
       section_, "video_adaptation_policy",
       static_cast<long>(video_adaptation_policy_));
@@ -95,7 +103,12 @@ int ConfigCenter::Load() {
     ini_.SetLongValue(section_, "turn_mode", static_cast<long>(turn_mode_));
     persist_config_migration = true;
   }
-  enable_srtp_ = ini_.GetBoolValue(section_, "enable_srtp", enable_srtp_);
+  // Migrate the former user switch. Keep true in the file for older builds,
+  // while the current application always requests encrypted native media.
+  if (!ini_.GetBoolValue(section_, "enable_srtp", false)) {
+    ini_.SetBoolValue(section_, "enable_srtp", true);
+    persist_config_migration = true;
+  }
   enable_self_hosted_ =
       ini_.GetBoolValue(section_, "enable_self_hosted", enable_self_hosted_);
 
@@ -116,19 +129,11 @@ int ConfigCenter::Load() {
   } else {
     signal_server_port_ = 0;
   }
-  const char* coturn_server_port_value =
-      ini_.GetValue(section_, "coturn_server_port", nullptr);
-  if (coturn_server_port_value != nullptr &&
-      strlen(coturn_server_port_value) > 0) {
-    coturn_server_port_ =
-        static_cast<int>(ini_.GetLongValue(section_, "coturn_server_port", 0));
-  } else {
-    coturn_server_port_ = 0;
-  }
-
   enable_autostart_ =
       ini_.GetBoolValue(section_, "enable_autostart", enable_autostart_);
   enable_daemon_ = ini_.GetBoolValue(section_, "enable_daemon", enable_daemon_);
+  enable_privacy_screen_.store(
+      ini_.GetBoolValue(section_, "enable_privacy_screen", true));
   portable_service_prompt_suppressed_ =
       ini_.GetBoolValue(section_, "portable_service_prompt_suppressed",
                         portable_service_prompt_suppressed_);
@@ -155,6 +160,8 @@ int ConfigCenter::Save() {
                     static_cast<long>(video_quality_));
   ini_.SetLongValue(section_, "video_frame_rate",
                     static_cast<long>(video_frame_rate_));
+  ini_.SetLongValue(section_, "screen_capture_method",
+                    static_cast<long>(screen_capture_method_));
   ini_.SetLongValue(section_, "video_adaptation_policy",
                     static_cast<long>(video_adaptation_policy_));
   ini_.SetLongValue(section_, "video_encode_format",
@@ -163,7 +170,7 @@ int ConfigCenter::Save() {
   ini_.SetLongValue(section_, "turn_mode", static_cast<long>(turn_mode_));
   ini_.SetBoolValue(section_, "enable_turn",
                     turn_mode_ != TURN_MODE::DISABLED);
-  ini_.SetBoolValue(section_, "enable_srtp", enable_srtp_);
+  ini_.SetBoolValue(section_, "enable_srtp", true);
   ini_.SetBoolValue(section_, "enable_self_hosted", enable_self_hosted_);
 
   // only save when self hosted
@@ -171,12 +178,12 @@ int ConfigCenter::Save() {
     ini_.SetValue(section_, "signal_server_host", signal_server_host_.c_str());
     ini_.SetLongValue(section_, "signal_server_port",
                       static_cast<long>(signal_server_port_));
-    ini_.SetLongValue(section_, "coturn_server_port",
-                      static_cast<long>(coturn_server_port_));
   }
 
   ini_.SetBoolValue(section_, "enable_autostart", enable_autostart_);
   ini_.SetBoolValue(section_, "enable_daemon", enable_daemon_);
+  ini_.SetBoolValue(section_, "enable_privacy_screen",
+                    enable_privacy_screen_.load());
   ini_.SetBoolValue(section_, "portable_service_prompt_suppressed",
                     portable_service_prompt_suppressed_);
 
@@ -225,6 +232,20 @@ int ConfigCenter::SetVideoFrameRate(VIDEO_FRAME_RATE video_frame_rate) {
   return 0;
 }
 
+int ConfigCenter::SetScreenCaptureMethod(ScreenCaptureMethod method) {
+  if (!IsValidScreenCaptureMethod(static_cast<long>(method))) {
+    return -1;
+  }
+  ini_.SetLongValue(section_, "screen_capture_method", static_cast<long>(method));
+  if (ini_.SaveFile(config_path_.c_str()) < 0) {
+    ini_.SetLongValue(section_, "screen_capture_method",
+                      static_cast<long>(screen_capture_method_));
+    return -1;
+  }
+  screen_capture_method_ = method;
+  return 0;
+}
+
 int ConfigCenter::SetVideoAdaptationPolicy(
     VIDEO_ADAPTATION_POLICY policy) {
   video_adaptation_policy_ = policy;
@@ -285,16 +306,6 @@ int ConfigCenter::SetTurn(bool enable_turn) {
   return SetTurnMode(turn_mode_);
 }
 
-int ConfigCenter::SetSrtp(bool enable_srtp) {
-  enable_srtp_ = enable_srtp;
-  ini_.SetBoolValue(section_, "enable_srtp", enable_srtp_);
-  SI_Error rc = ini_.SaveFile(config_path_.c_str());
-  if (rc < 0) {
-    return -1;
-  }
-  return 0;
-}
-
 int ConfigCenter::SetServerHost(const std::string& signal_server_host) {
   signal_server_host_ = signal_server_host;
   ini_.SetValue(section_, "signal_server_host", signal_server_host_.c_str());
@@ -316,17 +327,6 @@ int ConfigCenter::SetServerPort(int signal_server_port) {
   return 0;
 }
 
-int ConfigCenter::SetCoturnServerPort(int coturn_server_port) {
-  coturn_server_port_ = coturn_server_port;
-  ini_.SetLongValue(section_, "coturn_server_port",
-                    static_cast<long>(coturn_server_port_));
-  SI_Error rc = ini_.SaveFile(config_path_.c_str());
-  if (rc < 0) {
-    return -1;
-  }
-  return 0;
-}
-
 int ConfigCenter::SetSelfHosted(bool enable_self_hosted) {
   enable_self_hosted_ = enable_self_hosted;
   ini_.SetBoolValue(section_, "enable_self_hosted", enable_self_hosted_);
@@ -346,19 +346,9 @@ int ConfigCenter::SetSelfHosted(bool enable_self_hosted) {
       signal_server_port_ = static_cast<int>(
           ini_.GetLongValue(section_, "signal_server_port", 0));
     }
-    const char* coturn_server_port_value =
-        ini_.GetValue(section_, "coturn_server_port", nullptr);
-    if (coturn_server_port_value != nullptr &&
-        strlen(coturn_server_port_value) > 0) {
-      coturn_server_port_ = static_cast<int>(
-          ini_.GetLongValue(section_, "coturn_server_port", 0));
-    }
-
     ini_.SetValue(section_, "signal_server_host", signal_server_host_.c_str());
     ini_.SetLongValue(section_, "signal_server_port",
                       static_cast<long>(signal_server_port_));
-    ini_.SetLongValue(section_, "coturn_server_port",
-                      static_cast<long>(coturn_server_port_));
   }
 
   SI_Error rc = ini_.SaveFile(config_path_.c_str());
@@ -403,6 +393,21 @@ int ConfigCenter::SetDaemon(bool enable_daemon) {
   return 0;
 }
 
+int ConfigCenter::SetPrivacyScreen(bool enable_privacy_screen) {
+  const bool previous = enable_privacy_screen_.load();
+  if (previous == enable_privacy_screen) return 0;
+  ini_.SetBoolValue(section_, "enable_privacy_screen", enable_privacy_screen);
+  if (ini_.SaveFile(config_path_.c_str()) < 0) {
+    ini_.SetBoolValue(section_, "enable_privacy_screen", previous);
+    LOG_ERROR("Failed to save automatic privacy screen preference");
+    return -1;
+  }
+  // RTC callbacks read only the value committed by the settings thread.
+  enable_privacy_screen_.store(enable_privacy_screen);
+  LOG_INFO("Privacy screen on incoming connection: {}", enable_privacy_screen);
+  return 0;
+}
+
 int ConfigCenter::SetPortableServicePromptSuppressed(bool suppressed) {
   portable_service_prompt_suppressed_ = suppressed;
   ini_.SetBoolValue(section_, "portable_service_prompt_suppressed",
@@ -427,6 +432,10 @@ ConfigCenter::VIDEO_FRAME_RATE ConfigCenter::GetVideoFrameRate() const {
   return video_frame_rate_;
 }
 
+ScreenCaptureMethod ConfigCenter::GetScreenCaptureMethod() const {
+  return screen_capture_method_;
+}
+
 ConfigCenter::VIDEO_ADAPTATION_POLICY
 ConfigCenter::GetVideoAdaptationPolicy() const {
   return video_adaptation_policy_;
@@ -436,8 +445,18 @@ ConfigCenter::VIDEO_ENCODE_FORMAT ConfigCenter::GetVideoEncodeFormat() const {
   return video_encode_format_;
 }
 
+bool ConfigCenter::IsHardwareVideoCodecAvailable() {
+#if (((defined(_WIN32) || defined(__linux__)) && !defined(__aarch64__) && \
+      !defined(__arm__) && USE_CUDA) ||                                   \
+     defined(__APPLE__))
+  return true;
+#else
+  return false;
+#endif
+}
+
 bool ConfigCenter::IsHardwareVideoCodec() const {
-  return hardware_video_codec_;
+  return IsHardwareVideoCodecAvailable() && hardware_video_codec_;
 }
 
 ConfigCenter::TURN_MODE ConfigCenter::GetTurnMode() const {
@@ -448,7 +467,7 @@ bool ConfigCenter::IsEnableTurn() const {
   return turn_mode_ != TURN_MODE::DISABLED;
 }
 
-bool ConfigCenter::IsEnableSrtp() const { return enable_srtp_; }
+bool ConfigCenter::IsEnableSrtp() const { return true; }
 
 std::string ConfigCenter::GetSignalServerHost() const {
   return signal_server_host_;
@@ -456,8 +475,6 @@ std::string ConfigCenter::GetSignalServerHost() const {
 
 int ConfigCenter::GetSignalServerPort() const { return signal_server_port_; }
 
-int ConfigCenter::GetCoturnServerPort() const { return coturn_server_port_; }
-
 std::string ConfigCenter::GetDefaultServerHost() const {
   return signal_server_host_default_;
 }
@@ -466,16 +483,16 @@ int ConfigCenter::GetDefaultSignalServerPort() const {
   return server_port_default_;
 }
 
-int ConfigCenter::GetDefaultCoturnServerPort() const {
-  return coturn_server_port_default_;
-}
-
 bool ConfigCenter::IsSelfHosted() const { return enable_self_hosted_; }
 
 bool ConfigCenter::IsEnableAutostart() const { return enable_autostart_; }
 
 bool ConfigCenter::IsEnableDaemon() const { return enable_daemon_; }
 
+bool ConfigCenter::IsEnablePrivacyScreen() const {
+  return enable_privacy_screen_.load();
+}
+
 bool ConfigCenter::IsPortableServicePromptSuppressed() const {
   return portable_service_prompt_suppressed_;
 }

apps/desktop/src/config_center/config_center.h

@@ -7,9 +7,11 @@
 #ifndef _CONFIG_CENTER_H_
 #define _CONFIG_CENTER_H_
 
+#include <atomic>
 #include <string>
 
 #include "SimpleIni.h"
+#include "screen_capturer/screen_capture_method.h"
 
 namespace crossdesk {
 
@@ -39,18 +41,18 @@ class ConfigCenter {
   int SetLanguage(LANGUAGE language);
   int SetVideoQuality(VIDEO_QUALITY video_quality);
   int SetVideoFrameRate(VIDEO_FRAME_RATE video_frame_rate);
+  int SetScreenCaptureMethod(ScreenCaptureMethod method);
   int SetVideoAdaptationPolicy(VIDEO_ADAPTATION_POLICY policy);
   int SetVideoEncodeFormat(VIDEO_ENCODE_FORMAT video_encode_format);
   int SetHardwareVideoCodec(bool hardware_video_codec);
   int SetTurnMode(TURN_MODE turn_mode);
   int SetTurn(bool enable_turn);
-  int SetSrtp(bool enable_srtp);
   int SetServerHost(const std::string& signal_server_host);
   int SetServerPort(int signal_server_port);
-  int SetCoturnServerPort(int coturn_server_port);
   int SetSelfHosted(bool enable_self_hosted);
   int SetAutostart(bool enable_autostart);
   int SetDaemon(bool enable_daemon);
+  int SetPrivacyScreen(bool enable_privacy_screen);
   int SetPortableServicePromptSuppressed(bool suppressed);
   int SetFileTransferSavePath(const std::string& path);
 
@@ -59,21 +61,23 @@ class ConfigCenter {
   LANGUAGE GetLanguage() const;
   VIDEO_QUALITY GetVideoQuality() const;
   VIDEO_FRAME_RATE GetVideoFrameRate() const;
+  ScreenCaptureMethod GetScreenCaptureMethod() const;
   VIDEO_ADAPTATION_POLICY GetVideoAdaptationPolicy() const;
   VIDEO_ENCODE_FORMAT GetVideoEncodeFormat() const;
+  // Whether this build includes a hardware video codec backend.
+  static bool IsHardwareVideoCodecAvailable();
   bool IsHardwareVideoCodec() const;
   TURN_MODE GetTurnMode() const;
   bool IsEnableTurn() const;
   bool IsEnableSrtp() const;
   std::string GetSignalServerHost() const;
   int GetSignalServerPort() const;
-  int GetCoturnServerPort() const;
   std::string GetDefaultServerHost() const;
   int GetDefaultSignalServerPort() const;
-  int GetDefaultCoturnServerPort() const;
   bool IsSelfHosted() const;
   bool IsEnableAutostart() const;
   bool IsEnableDaemon() const;
+  bool IsEnablePrivacyScreen() const;
   bool IsPortableServicePromptSuppressed() const;
   std::string GetFileTransferSavePath() const;
 
@@ -88,21 +92,20 @@ class ConfigCenter {
   LANGUAGE language_ = LANGUAGE::CHINESE;
   VIDEO_QUALITY video_quality_ = VIDEO_QUALITY::HIGH;
   VIDEO_FRAME_RATE video_frame_rate_ = VIDEO_FRAME_RATE::FPS_60;
+  ScreenCaptureMethod screen_capture_method_ = ScreenCaptureMethod::Auto;
   VIDEO_ADAPTATION_POLICY video_adaptation_policy_ =
       VIDEO_ADAPTATION_POLICY::QUALITY_PRIORITY;
   VIDEO_ENCODE_FORMAT video_encode_format_ = VIDEO_ENCODE_FORMAT::H264;
   bool hardware_video_codec_ = false;
   TURN_MODE turn_mode_ = TURN_MODE::AUTO_UDP_TCP;
-  bool enable_srtp_ = false;
   std::string signal_server_host_ = "";
   std::string signal_server_host_default_ = "api.crossdesk.cn";
   int signal_server_port_ = 0;
   int server_port_default_ = 9099;
-  int coturn_server_port_ = 0;
-  int coturn_server_port_default_ = 3478;
   bool enable_self_hosted_ = false;
   bool enable_autostart_ = false;
   bool enable_daemon_ = false;
+  std::atomic<bool> enable_privacy_screen_{true};
   bool portable_service_prompt_suppressed_ = false;
   std::string file_transfer_save_path_ = "";
 };

apps/desktop/src/device_controller/device_controller.h

@@ -42,6 +42,9 @@ class KeyboardCapturer : public DeviceController {
 
   virtual int Hook(OnKeyAction on_key_action, void* user_ptr) = 0;
   virtual int Unhook() = 0;
+  // Backends with an asynchronous capture loop override this so the UI can
+  // fall back to window events if that loop stops unexpectedly.
+  virtual bool IsHookActive() const { return true; }
   virtual int SendKeyboardCommand(int key_code, bool is_down,
                                   uint32_t scan_code = 0,
                                   bool extended = false) = 0;

apps/desktop/src/gui/application/application_state.h

@@ -1,5 +1,11 @@
-#ifndef CROSSDESK_GUI_APPLICATION_STATE_H_
-#define CROSSDESK_GUI_APPLICATION_STATE_H_
+/*
+ * @Author: DI JUNKUN
+ * @Date: 2026-09-04
+ * Copyright (c) 2026 by DI JUNKUN, All Rights Reserved.
+ */
+
+#ifndef _APPLICATION_STATE_H_
+#define _APPLICATION_STATE_H_
 
 #include <atomic>
 #include <chrono>
@@ -60,10 +66,7 @@ struct InteractionState {
   bool mouse_controller_is_started_ = false;
   bool start_screen_capturer_ = false;
   bool screen_capturer_is_started_ = false;
-  bool start_speaker_capturer_ = false;
-  bool speaker_capturer_is_started_ = false;
   bool start_keyboard_capturer_ = false;
-  bool show_cursor_ = false;
   bool keyboard_capturer_is_started_ = false;
   bool keyboard_capturer_uses_window_events_ = false;
   bool foucs_on_main_window_ = false;
@@ -192,4 +195,4 @@ struct ApplicationState : MainWindowState,
 
 }  // namespace crossdesk::gui_detail
 
-#endif  // CROSSDESK_GUI_APPLICATION_STATE_H_
+#endif

apps/desktop/src/gui/application/gui_application.cpp

@@ -34,10 +34,13 @@
 #include "platform.h"
 #include "platform/video_renderer.h"
 #include "rendering/slint_video_presenter.h"
+#include "runtime/privacy_control_state.h"
 #if _WIN32
 #include <windows.h>
 
+#include "platform/windows/gui/slint_backend.h"
 #include "platform/windows/gui/tray/win_tray.h"
+#include "platform/windows/gui/window_icons.h"
 #elif defined(__APPLE__)
 #include "platform/macos/gui/tray/mac_tray.h"
 #include "platform/window_drag.h"
@@ -47,6 +50,7 @@
 #include <X11/Xlib.h>
 #include <unistd.h>
 
+#include "platform/linux/gui/cuda_graphics.h"
 #include "platform/linux/gui/tray/linux_tray.h"
 #endif
 #include "rd_log.h"
@@ -947,10 +951,10 @@ int GuiApplication::Run() {
   }
   exec_log_path_ = path_manager_->GetLogPath().string();
   dll_log_path_ = exec_log_path_;
+  InitializeLogger();
   cache_path_ = path_manager_->GetCachePath().string();
   config_center_ = std::make_unique<ConfigCenter>(cache_path_ + "/config.ini");
 
-  InitializeLogger();
   LOG_INFO("CrossDesk version: {} (Slint UI)", CROSSDESK_VERSION);
 
   strncpy(signal_server_ip_self_, config_center_->GetSignalServerHost().c_str(),
@@ -992,6 +996,15 @@ int GuiApplication::Run() {
   if (!InitializeSDL()) {
     return -1;
   }
+#if _WIN32
+  const auto backend = ConfigureWindowsSlintBackend();
+  if (!backend.success) {
+    LOG_ERROR("{}", backend.diagnostic);
+    SDL_Quit();
+    return -1;
+  }
+  LOG_INFO("Slint backend: {}; {}", backend.backend, backend.diagnostic);
+#endif
   InitializeModules();
   InitializeUi();
 
@@ -1001,6 +1014,9 @@ int GuiApplication::Run() {
   // when deciding whether the last hidden window should stop the event loop.
   // Keep the loop alive until the tray's explicit Exit action requests quit.
   ui_->main->show();
+#if _WIN32
+  ConfigureWindowsWindowIcons(ui_->main->window().win32_hwnd());
+#endif
   slint::run_event_loop(slint::EventLoopMode::RunUntilQuit);
   Cleanup();
   return 0;
@@ -1016,10 +1032,13 @@ void GuiApplication::InitializeSettings() {
   language_button_value_ = localization_language_index_;
   localization_language_ =
       static_cast<ConfigCenter::LANGUAGE>(localization_language_index_);
+  privacy_.SetText({
+      localization::privacy_screen_unlock_hint[localization_language_index_]});
 }
 
 bool GuiApplication::InitializeSDL() {
 #if defined(__linux__) && !defined(__APPLE__)
+  ConfigureLinuxCudaGraphics(config_center_->IsHardwareVideoCodec());
   // Standard Wayland top-level windows cannot choose an absolute screen
   // position. Use the session's XWayland compatibility server for the GUI so
   // auxiliary windows such as the controlled-side status window can be
@@ -1099,6 +1118,9 @@ void GuiApplication::InitializeUi() {
     wayland_display_guard.emplace("WAYLAND_DISPLAY");
     wayland_socket_guard.emplace("WAYLAND_SOCKET");
   }
+  // Match crossdesk.desktop even when the Debian launcher runs crossdesk-bin.
+  // Set this before creating any windows so X11 and Wayland share the same id.
+  slint::set_xdg_app_id("crossdesk");
 #endif
   ui_ = std::make_unique<SlintUi>();
   ui_->video_presenter =
@@ -1137,8 +1159,12 @@ void GuiApplication::InitializeSystemTray() {
       return;
     }
     ui_->main->show();
+#if _WIN32
+    ConfigureWindowsWindowIcons(ui_->main->window().win32_hwnd());
+#endif
     ui_->main->window().set_minimized(false);
 #if defined(__APPLE__)
+    MacActivateWindow(ui_->main->window().appkit_view());
     // A window restored from the tray may only obtain its NSWindow after the
     // callback returns, so let the regular UI tick configure it.
     ui_->main_native_titlebar_attempts = 30;
@@ -1149,16 +1175,12 @@ void GuiApplication::InitializeSystemTray() {
       ui_->main->hide();
     }
   };
-  auto open_settings = [this] {
+  auto open_settings = [this, show_window] {
     if (!ui_) {
       return;
     }
-    ui_->main->show();
-    ui_->main->window().set_minimized(false);
+    show_window();
     ui_->main->set_settings_open(true);
-#if defined(__APPLE__)
-    ui_->main_native_titlebar_attempts = 30;
-#endif
   };
   auto exit_app = [this] {
     exit_ = true;
@@ -1209,16 +1231,30 @@ void GuiApplication::ResetSettingsUi() {
   ui_->main->set_adaptation_policy_index(
       video_adaptation_policy_button_value_);
   ui_->main->set_codec_index(video_encode_format_button_value_);
-  ui_->main->set_hardware_codec_enabled(enable_hardware_video_codec_);
+  const bool hardware_codec_available =
+      ConfigCenter::IsHardwareVideoCodecAvailable();
+  ui_->main->set_hardware_codec_available(hardware_codec_available);
+  ui_->main->set_hardware_codec_enabled(hardware_codec_available &&
+                                       enable_hardware_video_codec_);
   ui_->main->set_turn_enabled(enable_turn_);
-  ui_->main->set_srtp_enabled(enable_srtp_);
   ui_->main->set_self_hosted_enabled(enable_self_hosted_);
   ui_->main->set_autostart_enabled(enable_autostart_);
   ui_->main->set_daemon_enabled(enable_daemon_);
+  ui_->main->set_privacy_on_connect_enabled(
+      config_center_->IsEnablePrivacyScreen());
+#ifdef _WIN32
+  ui_->main->set_capture_method_visible(true);
+  ui_->main->set_capture_method_index(
+      static_cast<int>(config_center_->GetScreenCaptureMethod()));
+#endif
+#if defined(_WIN32) || defined(__APPLE__) || defined(__linux__)
+  ui_->main->set_privacy_setting_available(true);
+#else
+  ui_->main->set_privacy_setting_available(false);
+#endif
   ui_->main->set_file_save_path(file_transfer_save_path_buf_);
   ui_->main->set_server_host(signal_server_ip_self_);
   ui_->main->set_server_port(signal_server_port_self_);
-  ui_->main->set_coturn_port(coturn_server_port_self_);
 }
 
 void GuiApplication::BindMainCallbacks() {
@@ -1376,7 +1412,6 @@ void GuiApplication::BindMainCallbacks() {
   main->on_save_self_hosted_settings([this] {
     const std::string host(ui_->main->get_server_host());
     const auto signal_port = ParsePort(ui_->main->get_server_port());
-    const auto coturn_port = ParsePort(ui_->main->get_coturn_port());
     if (!host.empty()) {
       config_center_->SetServerHost(host);
       std::memset(signal_server_ip_self_, 0, sizeof(signal_server_ip_self_));
@@ -1393,25 +1428,14 @@ void GuiApplication::BindMainCallbacks() {
       std::snprintf(signal_server_port_, sizeof(signal_server_port_), "%d",
                     *signal_port);
     }
-    if (coturn_port) {
-      config_center_->SetCoturnServerPort(*coturn_port);
-      std::snprintf(coturn_server_port_self_, sizeof(coturn_server_port_self_),
-                    "%d", *coturn_port);
-      std::snprintf(coturn_server_port_, sizeof(coturn_server_port_), "%d",
-                    *coturn_port);
-    }
   });
   main->on_cancel_self_hosted_settings([this] {
     const std::string host = config_center_->GetSignalServerHost();
     ui_->main->set_server_host(UiText(host));
     const int signal_port = config_center_->GetSignalServerPort();
-    const int coturn_port = config_center_->GetCoturnServerPort();
     ui_->main->set_server_port(signal_port > 0
                                    ? UiText(std::to_string(signal_port))
                                    : slint::SharedString{});
-    ui_->main->set_coturn_port(coturn_port > 0
-                                   ? UiText(std::to_string(coturn_port))
-                                   : slint::SharedString{});
   });
   main->on_open_download([this] { OpenUrl("https://crossdesk.cn"); });
   main->on_connection_cancel([this] {
@@ -1567,6 +1591,10 @@ void GuiApplication::BindStreamCallbacks() {
       return;
     }
     props->selected_display_ = index;
+    {
+      std::lock_guard lock(props->remote_cursor_state_mutex_);
+      props->cursor_presentation_ = {};
+    }
     RemoteAction action{};
     action.type = ControlType::display_id;
     action.d = index;
@@ -1588,6 +1616,36 @@ void GuiApplication::BindStreamCallbacks() {
     SendReliableDataFrame(props->peer_, message.c_str(), message.size(),
                           props->control_data_label_.c_str());
   });
+  stream->on_toggle_privacy([this] {
+    auto props = SelectedSession();
+    if (!props || !props->peer_ || !props->control_mouse_ ||
+        props->connection_status_.load() != ConnectionStatus::Connected) return;
+    RemoteAction action{};
+    action.type = ControlType::privacy_command;
+    {
+      std::lock_guard lock(props->privacy_status_mutex_);
+      const auto& status = props->privacy_status_;
+      const uint64_t now = SDL_GetTicks();
+      const auto controls = GetPrivacyControlState(
+          status, props->privacy_status_received_, props->privacy_command_pending_,
+          now - props->privacy_status_tick_, now - props->privacy_command_tick_);
+      if (!controls.can_toggle) return;
+      action.pc.flag = controls.active ? PrivacyCommandFlag::disable
+                                      : PrivacyCommandFlag::enable;
+      action.pc.block_local_input = true;
+      props->privacy_command_pending_ = true;
+      props->privacy_command_tick_ = now;
+      props->privacy_request_revision_ = status.revision;
+    }
+    const auto message = action.to_json();
+    if (SendReliableDataFrame(props->peer_, message.data(), message.size(),
+                              props->control_data_label_.c_str()) != 0) {
+      std::lock_guard lock(props->privacy_status_mutex_);
+      props->privacy_command_pending_ = false;
+      props->privacy_status_received_ = false;
+      LOG_WARN("Privacy command send failed, remote_id={}", props->remote_id_);
+    }
+  });
   stream->on_toggle_mouse_control([this] {
     auto props = SelectedSession();
     if (!props || !props->connection_established_) {
@@ -1597,6 +1655,7 @@ void GuiApplication::BindStreamCallbacks() {
     props->enable_mouse_control_ = props->control_mouse_;
     start_keyboard_capturer_ = props->control_mouse_;
     if (!props->control_mouse_) {
+      devices_.StopKeyboardCapturer();
       keyboard_.ForceReleasePressedKeys();
     }
   });
@@ -1728,7 +1787,7 @@ void GuiApplication::BindServerCallbacks() {
   });
   server->on_disconnect_controller([this] {
     if (peer_ && !selected_server_remote_id_.empty()) {
-      LeaveConnection(peer_, selected_server_remote_id_.c_str());
+      CloseServerController(selected_server_remote_id_);
     }
   });
 }
@@ -1738,6 +1797,7 @@ void GuiApplication::Tick() {
     slint::quit_event_loop();
     return;
   }
+  HandleSessionCleanup();
   HandlePasswordChangeResult();
   HandleCredentialRecovery();
   if (!peer_) {
@@ -1794,6 +1854,7 @@ void GuiApplication::Tick() {
   HandleConnectionStatusChange();
   HandlePendingPresenceProbe();
   HandlePresenceProbeTimeout();
+  HandlePrivacy();
   HandleWindowsServiceIntegration();
 #if defined(__linux__) && !defined(__APPLE__)
   SyncXWaylandWindowActivation();
@@ -1833,9 +1894,20 @@ void GuiApplication::ShareLocalCursorState() {
   }
 
   CursorState sampled{};
-  if (!cursor_state_provider_.Sample(devices_.display_info_list(),
-                                     selected_display_, &sampled)) {
-    return;
+  const bool sample_ok = cursor_state_provider_.Sample(
+      devices_.display_info_list(), selected_display_, &sampled);
+  if (!sample_ok) {
+    sampled.render_mode = CursorRenderMode::unknown;
+    if (sampled.hidden_reason == CursorHiddenReason::unspecified) {
+      sampled.hidden_reason = CursorHiddenReason::sampling_failed;
+    }
+  } else if (sampled.render_mode == CursorRenderMode::legacy) {
+    // Providers without platform-specific presentation metadata only need to
+    // sample visible/shape; normalize that common case once for every peer.
+    sampled.render_mode = sampled.visible ? CursorRenderMode::separate
+                                          : CursorRenderMode::hidden;
+    sampled.hidden_reason = sampled.visible ? CursorHiddenReason::unspecified
+                                            : CursorHiddenReason::system_hidden;
   }
 
   const auto now = std::chrono::steady_clock::now();
@@ -1874,21 +1946,23 @@ void GuiApplication::ShareLocalCursorState() {
 
     const CursorState& previous = delivery.last_sent;
     const bool shape_changed =
-        !delivery.has_sent || sampled.visible != previous.visible ||
-        sampled.shape != previous.shape ||
-        std::abs(sampled.visual_offset_x - previous.visual_offset_x) >
-            kCursorPositionEpsilon ||
-        std::abs(sampled.visual_offset_y - previous.visual_offset_y) >
-            kCursorPositionEpsilon;
+        !delivery.has_sent || sampled.render_mode != previous.render_mode ||
+        sampled.hidden_reason != previous.hidden_reason ||
+        (sample_ok &&
+         (sampled.visible != previous.visible || sampled.shape != previous.shape ||
+          std::abs(sampled.visual_offset_x - previous.visual_offset_x) >
+              kCursorPositionEpsilon ||
+          std::abs(sampled.visual_offset_y - previous.visual_offset_y) >
+              kCursorPositionEpsilon));
     // Preserve sub-point cursor motion. At 10x client zoom, the old roughly
     // one-logical-pixel threshold became several visible phone points.
     const bool position_changed =
-        !delivery.has_sent ||
-        sampled.position_valid != previous.position_valid ||
-        sampled.display_id != previous.display_id ||
-        (sampled.position_valid && previous.position_valid &&
-         (std::abs(sampled.x - previous.x) > kCursorPositionEpsilon ||
-          std::abs(sampled.y - previous.y) > kCursorPositionEpsilon));
+        sample_ok &&
+        (!delivery.has_sent || sampled.position_valid != previous.position_valid ||
+         sampled.display_id != previous.display_id ||
+         (sampled.position_valid && previous.position_valid &&
+          (std::abs(sampled.x - previous.x) > kCursorPositionEpsilon ||
+           std::abs(sampled.y - previous.y) > kCursorPositionEpsilon)));
     const bool position_update_due =
         position_changed &&
         (delivery.last_sent_time.time_since_epoch().count() == 0 ||
@@ -1896,16 +1970,12 @@ void GuiApplication::ShareLocalCursorState() {
     const bool heartbeat_due =
         delivery.last_sent_time.time_since_epoch().count() == 0 ||
         now - delivery.last_sent_time >= kCursorStateHeartbeatInterval;
-    if (suppress_position) {
-      // Cursor appearance is independent of cursor position. Continue sending
-      // shape changes to every controller while withholding only the sampled
-      // position from the connection that originated recent input.
-      if (shape_changed || heartbeat_due) {
-        recipients.push_back({remote_id, false});
-      }
-    } else if (delivery.feedback_pending || shape_changed ||
-               position_update_due || heartbeat_due) {
-      recipients.push_back({remote_id, true});
+    // Position feedback waits for a good sample and the echo-suppression
+    // interval. Appearance changes and heartbeats are independent of both.
+    const bool include_position = sample_ok && !suppress_position;
+    if (shape_changed || heartbeat_due ||
+        (include_position && (delivery.feedback_pending || position_update_due))) {
+      recipients.push_back({remote_id, include_position});
     }
   }
   if (recipients.empty()) return;
@@ -1914,6 +1984,18 @@ void GuiApplication::ShareLocalCursorState() {
   for (const auto& recipient : recipients) {
     auto& delivery = cursor_delivery_states_[recipient.remote_id];
     CursorState outgoing = sampled;
+    if (!sample_ok) {
+      // Explicitly report unknown to new receivers, but retain the last
+      // presentation for peers that only understand visible/shape.
+      outgoing = delivery.has_sent ? delivery.last_sent : CursorState{};
+      if (!delivery.has_sent) {
+        outgoing.visible = true;
+        outgoing.shape = RemoteCursorShape::default_cursor;
+      }
+      outgoing.seq = sampled.seq;
+      outgoing.render_mode = sampled.render_mode;
+      outgoing.hidden_reason = sampled.hidden_reason;
+    }
     outgoing.position_update = recipient.include_position;
     if (!recipient.include_position) {
       // Keep legacy receivers at their last acknowledged position as well.
@@ -1932,7 +2014,7 @@ void GuiApplication::ShareLocalCursorState() {
     action.type = ControlType::cursor_state;
     action.cs = outgoing;
     const std::string message = action.to_json();
-    const int result = SendDataFrameToPeer(
+    const int result = SendReliableDataFrameToPeer(
         peer_, message.c_str(), message.size(), mouse_label_.c_str(),
         recipient.remote_id.c_str(), recipient.remote_id.size());
     if (result != 0) {
@@ -1941,6 +2023,13 @@ void GuiApplication::ShareLocalCursorState() {
       continue;
     }
 
+    if (!delivery.has_sent ||
+        delivery.last_sent.render_mode != outgoing.render_mode ||
+        delivery.last_sent.hidden_reason != outgoing.hidden_reason) {
+      LOG_INFO("Send cursor presentation to [{}]: mode={}, reason={}",
+               recipient.remote_id, static_cast<int>(outgoing.render_mode),
+               static_cast<int>(outgoing.hidden_reason));
+    }
     delivery.last_sent = outgoing;
     delivery.has_sent = true;
     if (recipient.include_position) {
@@ -1998,8 +2087,7 @@ void GuiApplication::HandlePasswordChangeResult() {
     }
     show_offline_warning_window_ = true;
     if (uncertain && peer_) {
-      LeaveConnection(peer_, client_id_);
-      DestroyPeer(&peer_);
+      CloseConnectionPeer();
     }
     return;
   }
@@ -2012,8 +2100,7 @@ void GuiApplication::HandlePasswordChangeResult() {
 
   LOG_INFO("Password changed successfully for [{}]", client_id_);
   if (peer_) {
-    LeaveConnection(peer_, client_id_);
-    DestroyPeer(&peer_);
+    CloseConnectionPeer();
   }
 }
 
@@ -2037,7 +2124,7 @@ void GuiApplication::HandleCredentialRecovery() {
   if (retry_active) {
     LOG_INFO("Pending credential was not accepted; retrying active credential");
     if (peer_) {
-      DestroyPeer(&peer_);
+      CloseConnectionPeer();
     }
     return;
   }
@@ -2082,6 +2169,9 @@ void GuiApplication::SyncMainWindow() {
   if (!ui_) {
     return;
   }
+#if _WIN32
+  ConfigureWindowsWindowIcons(ui_->main->window().win32_hwnd());
+#endif
 #if defined(__APPLE__)
   if (ui_->main_native_titlebar_attempts > 0) {
     if (HideDisabledMainWindowZoomButton()) {
@@ -2106,15 +2196,7 @@ void GuiApplication::SyncMainWindow() {
   ui_->main->set_latest_version(UiText(latest_version_));
   ui_->main->set_release_name(UiText(release_name_));
   ui_->main->set_release_date(UiText(release_date_));
-  ui_->main->set_settings_session_active(stream_window_inited_);
-#if (((defined(_WIN32) || defined(__linux__)) && !defined(__aarch64__) && \
-      !defined(__arm__) && USE_CUDA) ||                                   \
-     defined(__APPLE__))
-  ui_->main->set_hardware_codec_available(true);
-#else
-  ui_->main->set_hardware_codec_available(false);
-#endif
-
+  ui_->main->set_settings_session_active(HasActiveSession());
   if (show_offline_warning_window_) {
     ui_->main->set_offline_warning(UiText(offline_warning_text_));
     show_offline_warning_window_ = false;
@@ -2324,6 +2406,7 @@ void GuiApplication::SetStreamKeyboardFocus(bool focused) {
 
   focus_on_stream_window_ = focused;
   if (!focused) {
+    devices_.StopKeyboardCapturer();
     keyboard_.ForceReleasePressedKeys();
   }
 }
@@ -2378,8 +2461,10 @@ void GuiApplication::SyncStreamWindow() {
   if (!ui_->stream) {
     return;
   }
+#if _WIN32
+  ConfigureWindowsWindowIcons((*ui_->stream)->window().win32_hwnd());
+#endif
   (*ui_->stream)->set_window_maximized((*ui_->stream)->window().is_maximized());
-  (*ui_->stream)->set_srtp_enabled(enable_srtp_);
 #if defined(__APPLE__)
   if (ui_->stream_live_resize_configuration_attempts > 0) {
     if (ConfigureStreamWindowLiveResize(
@@ -2509,6 +2594,29 @@ void GuiApplication::SyncStreamWindow() {
               ? localization::receiving_screen[localization_language_index_]
               : std::string{}));
   (*ui_->stream)->set_mouse_control_enabled(props->control_mouse_);
+  {
+    std::lock_guard lock(props->privacy_status_mutex_);
+    const auto& status = props->privacy_status_;
+    const uint64_t now = SDL_GetTicks();
+    const auto controls = GetPrivacyControlState(
+        status, props->privacy_status_received_, props->privacy_command_pending_,
+        now - props->privacy_status_tick_, now - props->privacy_command_tick_);
+    const bool connected =
+        props->connection_status_.load() == ConnectionStatus::Connected;
+    (*ui_->stream)->set_privacy_active(controls.active);
+    (*ui_->stream)->set_privacy_off(connected && controls.off);
+    (*ui_->stream)->set_privacy_unsupported(controls.unsupported);
+    (*ui_->stream)->set_privacy_can_toggle(
+        props->control_mouse_ && connected && controls.can_toggle);
+    const int language = localization_language_index_;
+    std::string text = !connected || !props->privacy_status_received_
+        ? localization::privacy_screen[language]
+        : controls.unsupported ? localization::privacy_unsupported[language]
+        : controls.enabled ? localization::privacy_on[language]
+        : controls.off ? localization::privacy_off[language]
+        : localization::privacy_screen[language];
+    (*ui_->stream)->set_privacy_status_text(UiText(text));
+  }
   int remote_cursor_shape =
       static_cast<int>(RemoteCursorShape::default_cursor);
   bool remote_cursor_active = false;
@@ -2519,9 +2627,7 @@ void GuiApplication::SyncStreamWindow() {
         props->remote_cursor_state_received_;
     if (remote_cursor_active) {
       remote_cursor_shape = static_cast<int>(
-          props->remote_cursor_state_.visible
-              ? props->remote_cursor_state_.shape
-              : RemoteCursorShape::none);
+          props->cursor_presentation_.Resolve(SDL_GetTicks()));
     }
   }
   (*ui_->stream)->set_remote_cursor_active(remote_cursor_active);
@@ -2546,6 +2652,8 @@ void GuiApplication::SyncStreamWindow() {
   (*ui_->stream)->set_selected_display(props->selected_display_);
 
   const auto& net = props->net_traffic_stats_;
+  (*ui_->stream)->set_stats_encryption_enabled(
+      status == ConnectionStatus::Connected && net.srtp_active);
   std::vector<ui::NetworkStatsRow> stats_rows;
   stats_rows.reserve(4);
   const auto append_stats_row = [&](const std::string& label,
@@ -2752,7 +2860,19 @@ void GuiApplication::SyncServerWindow() {
                     });
   }
 
-  if (has_connected_controller && !ui_->server) {
+  // Privacy protects local display output while preserving capture.
+  // Keep the panel alive throughout privacy transitions so remote
+  // controllers can still see and operate it without resetting its UI state.
+  bool show_controller_window = has_connected_controller;
+#if !defined(_WIN32) && !defined(__APPLE__) && !defined(__linux__)
+  // Preserve the existing panel behavior on other platforms.
+  const auto privacy_status = privacy_.Snapshot();
+  const bool privacy_covering = privacy_status.overlay_active ||
+      privacy_status.state == PrivacyState::starting ||
+      privacy_status.state == PrivacyState::stopping;
+  show_controller_window = show_controller_window && !privacy_covering;
+#endif
+  if (show_controller_window && !ui_->server) {
     ui_->server.emplace(ui::ServerWindow::create());
     RegisterFontAwesome((*ui_->server)->window());
     (*ui_->server)->set_controllers(ui_->controller_model);
@@ -2776,7 +2896,7 @@ void GuiApplication::SyncServerWindow() {
     server_window_created_ = true;
     server_window_inited_ = true;
   }
-  if (!has_connected_controller && ui_->server) {
+  if (!show_controller_window && ui_->server) {
     (*ui_->server)->hide();
     ui_->server.reset();
     server_window_created_ = false;
@@ -2790,6 +2910,10 @@ void GuiApplication::SyncServerWindow() {
     return;
   }
 
+#if _WIN32
+  ConfigureWindowsWindowIcons((*ui_->server)->window().win32_hwnd());
+#endif
+
   std::vector<ui::ControllerEntry> controllers;
   std::vector<slint::SharedString> names;
   ui_->controller_ids.clear();
@@ -2909,9 +3033,9 @@ void GuiApplication::SaveSettingsFromUi() {
   video_adaptation_policy_button_value_ =
       std::clamp(main->get_adaptation_policy_index(), 0, 2);
   video_encode_format_button_value_ = std::clamp(main->get_codec_index(), 0, 1);
-  enable_hardware_video_codec_ = main->get_hardware_codec_enabled();
+  enable_hardware_video_codec_ = ConfigCenter::IsHardwareVideoCodecAvailable() &&
+                                  main->get_hardware_codec_enabled();
   enable_turn_ = main->get_turn_enabled();
-  enable_srtp_ = main->get_srtp_enabled();
   enable_self_hosted_ = main->get_self_hosted_enabled();
   enable_autostart_ = main->get_autostart_enabled();
   enable_daemon_ = main->get_daemon_enabled();
@@ -2920,6 +3044,8 @@ void GuiApplication::SaveSettingsFromUi() {
       static_cast<ConfigCenter::LANGUAGE>(language_button_value_);
   localization_language_index_ = language_button_value_;
   config_center_->SetLanguage(localization_language_);
+  privacy_.SetText({
+      localization::privacy_screen_unlock_hint[localization_language_index_]});
   config_center_->SetVideoQuality(
       static_cast<ConfigCenter::VIDEO_QUALITY>(video_quality_button_value_));
   config_center_->SetVideoFrameRate(static_cast<ConfigCenter::VIDEO_FRAME_RATE>(
@@ -2932,10 +3058,27 @@ void GuiApplication::SaveSettingsFromUi() {
           video_encode_format_button_value_));
   config_center_->SetHardwareVideoCodec(enable_hardware_video_codec_);
   config_center_->SetTurn(enable_turn_);
-  config_center_->SetSrtp(enable_srtp_);
   config_center_->SetSelfHosted(enable_self_hosted_);
   config_center_->SetAutostart(enable_autostart_);
   config_center_->SetDaemon(enable_daemon_);
+#ifdef _WIN32
+  if (!HasActiveSession()) {
+    const auto capture_method = static_cast<ScreenCaptureMethod>(
+        std::clamp(main->get_capture_method_index(), 0, 3));
+    if (config_center_->SetScreenCaptureMethod(capture_method) != 0) {
+      LOG_ERROR("Failed to save screen capture method");
+    }
+  }
+  main->set_capture_method_index(
+      static_cast<int>(config_center_->GetScreenCaptureMethod()));
+#endif
+#if defined(_WIN32) || defined(__APPLE__) || defined(__linux__)
+  if (config_center_->SetPrivacyScreen(main->get_privacy_on_connect_enabled()) !=
+      0) {
+    main->set_privacy_on_connect_enabled(
+        config_center_->IsEnablePrivacyScreen());
+  }
+#endif
 
   const std::string path(main->get_file_save_path());
   std::memset(file_transfer_save_path_buf_, 0,
@@ -2951,9 +3094,6 @@ void GuiApplication::SaveSettingsFromUi() {
   if (const auto port = ParsePort(main->get_server_port())) {
     config_center_->SetServerPort(*port);
   }
-  if (const auto port = ParsePort(main->get_coturn_port())) {
-    config_center_->SetCoturnServerPort(*port);
-  }
 
   language_button_value_last_ = language_button_value_;
   video_quality_button_value_last_ = video_quality_button_value_;
@@ -2963,14 +3103,13 @@ void GuiApplication::SaveSettingsFromUi() {
   video_encode_format_button_value_last_ = video_encode_format_button_value_;
   enable_hardware_video_codec_last_ = enable_hardware_video_codec_;
   enable_turn_last_ = enable_turn_;
-  enable_srtp_last_ = enable_srtp_;
   enable_self_hosted_last_ = enable_self_hosted_;
   enable_autostart_last_ = enable_autostart_;
   enable_daemon_last_ = enable_daemon_;
   file_transfer_save_path_last_ = path;
   ui_->localized_language = -1;
 
-  if (!stream_window_inited_) {
+  if (!HasActiveSession()) {
     CloseAllRemoteSessions();
     CreateConnectionPeer();
   }
@@ -3007,6 +3146,7 @@ void GuiApplication::SelectStreamTab(int index) {
   bool renderer_selection_changed = false;
   if (!controlled_remote_id_.empty() &&
       controlled_remote_id_ != selected_remote_id) {
+    devices_.StopKeyboardCapturer();
     keyboard_.ForceReleasePressedKeys();
   }
   focused_remote_id_ = selected_remote_id;
@@ -3073,9 +3213,6 @@ void GuiApplication::CloseStreamTab(const std::string& remote_id) {
   }
   keyboard_.ReleaseRemotePressedKeys(remote_id, "stream_tab_closed");
   CloseRemoteSession(props);
-  WaitForThumbnailSaveTasks();
-  reload_recent_connections_ = true;
-  recent_connection_image_save_time_ = 0;
   ResetRemoteSessionResources(props);
   {
     std::unique_lock lock(remote_sessions_mutex_);
@@ -3179,8 +3316,12 @@ void GuiApplication::SendPointerInput(int button, int kind, float x, float y) {
 
   controlled_remote_id_ = props->remote_id_;
   const std::string message = action.to_json();
-  SendDataFrame(props->peer_, message.c_str(), message.size(),
-                props->mouse_label_.c_str());
+  {
+    std::lock_guard lock(props->remote_cursor_state_mutex_);
+    props->cursor_presentation_.NoteInput(SDL_GetTicks());
+  }
+  SendReliableDataFrame(props->peer_, message.c_str(), message.size(),
+                        props->mouse_label_.c_str());
 }
 
 void GuiApplication::SendScrollInput(float delta_x, float delta_y, float x,
@@ -3217,10 +3358,14 @@ void GuiApplication::SendScrollInput(float delta_x, float delta_y, float x,
   if (action.m.s == 0) {
     return;
   }
+  {
+    std::lock_guard lock(props->remote_cursor_state_mutex_);
+    props->cursor_presentation_.NoteInput(SDL_GetTicks());
+  }
   controlled_remote_id_ = props->remote_id_;
   const std::string message = action.to_json();
-  SendDataFrame(props->peer_, message.c_str(), message.size(),
-                props->mouse_label_.c_str());
+  SendReliableDataFrame(props->peer_, message.c_str(), message.size(),
+                        props->mouse_label_.c_str());
 }
 
 void GuiApplication::SendKeyInput(const std::string& text, bool pressed,
@@ -3275,12 +3420,15 @@ void GuiApplication::Cleanup() {
 #if _WIN32 && CROSSDESK_PORTABLE
   JoinPortableWindowsServiceInstallThread();
 #endif
+  privacy_.Disable();
   clipboard_.Shutdown();
   keyboard_.ForceReleasePressedKeys();
+  keyboard_.ReleaseAllRemotePressedKeys("application_exit");
   devices_.DestroyDevices();
+  privacy_.Shutdown();
   devices_.DestroyFactories();
   CloseAllRemoteSessions();
-  WaitForThumbnailSaveTasks();
+  WaitForSessionCleanup();
   devices_.DestroyAudioOutput();
   if (ui_->stream) {
 #if defined(__APPLE__)

apps/desktop/src/gui/application/gui_application.h

@@ -1,3 +1,9 @@
+/*
+ * @Author: DI JUNKUN
+ * @Date: 2026-09-04
+ * Copyright (c) 2026 by DI JUNKUN, All Rights Reserved.
+ */
+
 #ifndef _GUI_APPLICATION_H_
 #define _GUI_APPLICATION_H_
 
@@ -94,4 +100,4 @@ private:
 
 } // namespace crossdesk
 
-#endif
+#endif

apps/desktop/src/gui/application/sdl_events.cpp

@@ -366,8 +366,8 @@ int GuiApplication::ProcessMouseEvent(const SDL_Event &event) {
       }
       if (props->peer_) {
         std::string msg = remote_action.to_json();
-        SendDataFrame(props->peer_, msg.c_str(), msg.size(),
-                      props->mouse_label_.c_str());
+        SendReliableDataFrame(props->peer_, msg.c_str(), msg.size(),
+                              props->mouse_label_.c_str());
       }
     } else if (SDL_EVENT_MOUSE_WHEEL == event.type &&
                last_mouse_event.button.x >= render_rect.x &&
@@ -412,8 +412,8 @@ int GuiApplication::ProcessMouseEvent(const SDL_Event &event) {
       }
       if (props->peer_) {
         std::string msg = remote_action.to_json();
-        SendDataFrame(props->peer_, msg.c_str(), msg.size(),
-                      props->mouse_label_.c_str());
+        SendReliableDataFrame(props->peer_, msg.c_str(), msg.size(),
+                              props->mouse_label_.c_str());
       }
     }
   }

apps/desktop/src/gui/application/server_window_state.h

@@ -1,4 +1,11 @@
-#pragma once
+/*
+ * @Author: DI JUNKUN
+ * @Date: 2026-09-04
+ * Copyright (c) 2026 by DI JUNKUN, All Rights Reserved.
+ */
+
+#ifndef _SERVER_WINDOW_STATE_H_
+#define _SERVER_WINDOW_STATE_H_
 
 #include <algorithm>
 #include <iterator>
@@ -24,5 +31,6 @@ inline int ReconcileSelectedController(const std::vector<std::string>& ids,
   }
   return static_cast<int>(std::distance(ids.begin(), selected));
 }
+} // namespace crossdesk::server_window_state
 
-}  // namespace crossdesk::server_window_state
+#endif

apps/desktop/src/gui/application/window_geometry.h

@@ -1,4 +1,11 @@
-#pragma once
+/*
+ * @Author: DI JUNKUN
+ * @Date: 2026-09-04
+ * Copyright (c) 2026 by DI JUNKUN, All Rights Reserved.
+ */
+
+#ifndef _WINDOW_GEOMETRY_H_
+#define _WINDOW_GEOMETRY_H_
 
 #include <algorithm>
 
@@ -38,3 +45,5 @@ constexpr PhysicalPosition BottomRightPosition(const PhysicalRect& bounds,
 }
 
 }  // namespace crossdesk::window_geometry
+
+#endif

apps/desktop/src/gui/assets/layouts/layout.h

@@ -53,8 +53,6 @@
 #define ENABLE_HARDWARE_VIDEO_CODEC_CHECKBOX_PADDING_EN 218 * dpi_scale_
 #define ENABLE_TURN_CHECKBOX_PADDING_CN 171 * dpi_scale_
 #define ENABLE_TURN_CHECKBOX_PADDING_EN 218 * dpi_scale_
-#define ENABLE_SRTP_CHECKBOX_PADDING_CN 171 * dpi_scale_
-#define ENABLE_SRTP_CHECKBOX_PADDING_EN 218 * dpi_scale_
 #define ENABLE_SELF_HOSTED_SERVER_CHECKBOX_PADDING_CN 171 * dpi_scale_
 #define ENABLE_SELF_HOSTED_SERVER_CHECKBOX_PADDING_EN 218 * dpi_scale_
 #define ENABLE_AUTOSTART_PADDING_CN 171 * dpi_scale_

apps/desktop/src/gui/assets/layouts/layout_relative.h

@@ -57,8 +57,6 @@
 #define ENABLE_HARDWARE_VIDEO_CODEC_CHECKBOX_PADDING_EN 218
 #define ENABLE_TURN_CHECKBOX_PADDING_CN 171
 #define ENABLE_TURN_CHECKBOX_PADDING_EN 218
-#define ENABLE_SRTP_CHECKBOX_PADDING_CN 171
-#define ENABLE_SRTP_CHECKBOX_PADDING_EN 218
 #define ENABLE_SELF_HOSTED_SERVER_CHECKBOX_PADDING_CN 171
 #define ENABLE_SELF_HOSTED_SERVER_CHECKBOX_PADDING_EN 218
 #define ENABLE_AUTOSTART_PADDING_CN 171

apps/desktop/src/gui/assets/localization/localization_data.h

@@ -20,6 +20,12 @@ struct TranslationRow {
 
 // Single source of truth for all UI strings.
 #define CROSSDESK_LOCALIZATION_ALL(X)                                          \
+  X(privacy_screen, u8"隐私屏", "Privacy screen", u8"Приватный экран") \
+  X(privacy_enable, u8"开启隐私屏", "Enable privacy screen", u8"Включить приватный экран") \
+  X(privacy_disable, u8"关闭隐私屏", "Disable privacy screen", u8"Выключить приватный экран") \
+  X(privacy_on, u8"隐私屏：已开启", "Privacy screen: on", u8"Приватный экран: включён") \
+  X(privacy_off, u8"隐私屏：已关闭", "Privacy screen: off", u8"Приватный экран: выключен") \
+  X(privacy_unsupported, u8"隐私屏：不可用", "Privacy screen: unavailable", u8"Приватный экран: недоступен") \
   X(local_desktop, u8"本桌面", "Local Desktop", u8"Локальный рабочий стол")    \
   X(local_id, u8"本机ID", "Local ID", u8"Локальный ID")                        \
   X(local_id_copied_to_clipboard, u8"已复制到剪贴板", "Copied to clipboard",   \
@@ -120,6 +126,9 @@ struct TranslationRow {
     u8"стола")                                                                 \
   X(settings, u8"设置", "Settings", u8"Настройки")                             \
   X(language, u8"语言:", "Language:", u8"Язык:")                               \
+  X(screen_capture_method, u8"采集方式:", "Capture Method:",                  \
+    u8"Способ захвата:")                                                      \
+  X(screen_capture_method_auto, u8"自动", "Auto", u8"Авто")                 \
   X(video_quality, u8"画面质量:", "Video Quality:", u8"Качество видео:")       \
   X(video_frame_rate, u8"画面采集帧率:",                                       \
     "Video Capture Frame Rate:", u8"Частота захвата видео:")                   \
@@ -140,7 +149,6 @@ struct TranslationRow {
     "Enable Hardware Video Codec:", u8"Использовать аппаратный кодек:")        \
   X(enable_turn, u8"启用中继服务:",                                            \
     "Enable TURN Service:", u8"Включить TURN-сервис:")                         \
-  X(enable_srtp, u8"启用SRTP:", "Enable SRTP:", u8"Включить SRTP:")            \
   X(self_hosted_server_config, u8"自托管配置", "Self-Hosted Config",           \
     u8"Конфигурация self-hosted")                                              \
   X(self_hosted_server_settings, u8"自托管设置", "Self-Hosted Settings",       \
@@ -149,8 +157,6 @@ struct TranslationRow {
     "Server Address:", u8"Адрес сервера:")                                     \
   X(self_hosted_server_port, u8"信令服务端口:",                                \
     "Signal Service Port:", u8"Порт сигнального сервиса:")                     \
-  X(self_hosted_server_coturn_server_port, u8"中继服务端口:",                  \
-    "Relay Service Port:", u8"Порт реле-сервиса:")                             \
   X(ok, u8"确认", "OK", u8"ОК")                                                \
   X(cancel, u8"取消", "Cancel", u8"Отмена")                                    \
   X(new_password, u8"请输入六位密码:",                                         \
@@ -204,6 +210,8 @@ struct TranslationRow {
     "Confirm to delete this connection", u8"Удалить это подключение?")         \
   X(enable_autostart, u8"开机自启:", "Auto Start:", u8"Автозапуск:")           \
   X(enable_daemon, u8"启用守护进程:", "Enable Daemon:", u8"Включить демон:")   \
+  X(privacy_on_connect, u8"被连接时开启隐私屏:", "Privacy screen on connect:", \
+    u8"Приватность при подключении:")                                       \
   X(takes_effect_after_restart, u8"重启后生效", "Takes effect after restart",  \
     u8"Вступит в силу после перезапуска")                                      \
   X(select_file, u8"选择文件发送", "Select File to Send",                      \
@@ -225,6 +233,9 @@ struct TranslationRow {
   X(connection_mode, u8"连接模式", "Mode", u8"Режим")                          \
   X(connection_mode_direct, u8"直连", "Direct", u8"Прямой")                    \
   X(connection_mode_relay, u8"中继", "Relay", u8"Релейный")                    \
+  X(transport_encryption, u8"加密传输", "Encryption", u8"Шифрование")         \
+  X(transport_encryption_enabled, u8"已开启", "Enabled", u8"Включено")         \
+  X(transport_encryption_disabled, u8"未开启", "Disabled", u8"Выключено")       \
   X(online, u8"在线", "Online", u8"Онлайн")                                    \
   X(offline, u8"离线", "Offline", u8"Офлайн")                                  \
   X(device_offline, u8"设备离线", "Device Offline", u8"Устройство офлайн")     \
@@ -239,6 +250,9 @@ struct TranslationRow {
     u8"Для работы приложения требуются следующие разрешения:")                 \
   X(show_main_window, u8"显示主界面", "Show Main Window",                    \
     u8"Показать главное окно")                                                \
+  X(privacy_screen_unlock_hint, u8"按下快捷键，解除隐私屏",                    \
+    "To turn off the privacy screen, press",                                 \
+    u8"Чтобы отключить приватный экран, нажмите")                             \
   X(exit_program, u8"退出", "Exit", u8"Выход")
 
 inline constexpr TranslationRow kTranslationRows[] = {

apps/desktop/src/gui/features/devices/session_device_manager.cpp

@@ -1,14 +1,20 @@
 #include "features/devices/session_device_manager.h"
 
+#include <display_stream_id.h>
 #include <remote_action.h>
 
+#include <algorithm>
 #include <chrono>
 #include <cstdlib>
 
-#include <display_stream_id.h>
 #include "platform.h"
 #include "rd_log.h"
 #include "runtime/gui_runtime.h"
+#include "speaker_capturer_factory.h"
+#ifdef _WIN32
+#include "platform/windows/screen_capturer/screen_capturer_win.h"
+#include "platform/windows/input/mouse/mouse_controller.h"
+#endif
 
 namespace crossdesk {
 namespace {
@@ -19,7 +25,23 @@ constexpr auto kFrameDeadlineTolerance = std::chrono::milliseconds(1);
 
 } // namespace
 
-SessionDeviceManager::SessionDeviceManager(GuiRuntime &owner) : owner_(owner) {}
+SessionDeviceManager::SessionDeviceManager(GuiRuntime &owner)
+    : owner_(owner),
+      speaker_capture_(
+          [] {
+            return std::unique_ptr<SpeakerCapturer>(
+                SpeakerCapturerFactory().Create());
+          },
+          [this](unsigned char *data, size_t size, const char *) {
+            if (!owner_.peer_) return;
+            MiniRtcAudioFrame frame{};
+            frame.data = reinterpret_cast<const char *>(data);
+            frame.size = size;
+            frame.captured_timestamp = GetSystemTimeMicros(owner_.peer_);
+            SendAudioFrame(owner_.peer_, &frame, owner_.audio_label_.c_str());
+          }) {}
+
+SessionDeviceManager::~SessionDeviceManager() { speaker_capture_.Shutdown(); }
 
 bool SessionDeviceManager::ShouldSendCapturedFrame(
     std::chrono::steady_clock::time_point now, int fps) {
@@ -38,10 +60,56 @@ bool SessionDeviceManager::ShouldSendCapturedFrame(
   return true;
 }
 
+void SessionDeviceManager::RecordCaptureCadence(
+    std::chrono::steady_clock::time_point now, int fps,
+    bool from_secure_desktop) {
+  std::lock_guard<std::mutex> lock(capture_metrics_mutex_);
+  if (capture_metrics_started_ == std::chrono::steady_clock::time_point{})
+    capture_metrics_started_ = now;
+  const auto elapsed_us = std::chrono::duration_cast<std::chrono::microseconds>(
+                              now - capture_metrics_started_)
+                              .count();
+  if (elapsed_us >= 2000000) {
+    if (capture_forwarded_) {
+      const char* source = capture_secure_callbacks_ == 0 ? "normal_desktop"
+                           : capture_secure_callbacks_ == capture_callbacks_
+                               ? "secure_desktop"
+                               : "mixed";
+      LOG_INFO(
+          "Capture delivery: source={} normal_callbacks={} secure_callbacks={} "
+          "target_fps={} input_fps={:.2f} "
+          "forwarded_fps={:.2f} callbacks={} rate_dropped={} "
+          "forwarded={} send_errors={} max_callback_gap_us={} "
+          "send_avg_us={} send_max_us={} window_ms={}",
+          source, capture_callbacks_ - capture_secure_callbacks_,
+          capture_secure_callbacks_, fps,
+          capture_callbacks_ * 1000000.0 / elapsed_us,
+          capture_forwarded_ * 1000000.0 / elapsed_us, capture_callbacks_,
+          capture_rate_drops_, capture_forwarded_, capture_send_errors_,
+          capture_max_gap_us_, capture_send_us_ / capture_forwarded_,
+          capture_max_send_us_, elapsed_us / 1000);
+    }
+    capture_metrics_started_ = now;
+    capture_callbacks_ = capture_rate_drops_ = capture_forwarded_ = 0;
+    capture_secure_callbacks_ = 0;
+    capture_send_errors_ = 0;
+    capture_max_gap_us_ = capture_send_us_ = capture_max_send_us_ = 0;
+  }
+  if (last_capture_callback_ != std::chrono::steady_clock::time_point{}) {
+    capture_max_gap_us_ =
+        std::max<int64_t>(capture_max_gap_us_,
+                          std::chrono::duration_cast<std::chrono::microseconds>(
+                              now - last_capture_callback_)
+                              .count());
+  }
+  last_capture_callback_ = std::max(last_capture_callback_, now);
+  ++capture_callbacks_;
+  if (from_secure_desktop) ++capture_secure_callbacks_;
+}
+
 void SessionDeviceManager::Initialize() {
   InitializeAudioOutput();
   screen_capturer_factory_ = new ScreenCapturerFactory();
-  speaker_capturer_factory_ = new SpeakerCapturerFactory();
   device_controller_factory_ = new DeviceControllerFactory();
   keyboard_capturer_ =
       static_cast<KeyboardCapturer *>(device_controller_factory_->Create(
@@ -59,9 +127,20 @@ int SessionDeviceManager::InitializeScreenCapturer() {
     screen_capturer_ =
         static_cast<ScreenCapturer *>(screen_capturer_factory_->Create());
   }
+  screen_capturer_->SetPrivacyController(&owner_.privacy_);
+#ifdef _WIN32
+  if (auto windows = dynamic_cast<ScreenCapturerWin*>(screen_capturer_)) {
+    windows->SetCaptureMethod(owner_.config_center_->GetScreenCaptureMethod());
+  }
+#endif
 
   last_frame_time_ = {};
   next_frame_deadline_ = {};
+  capture_metrics_started_ = last_capture_callback_ = {};
+  capture_callbacks_ = capture_rate_drops_ = capture_forwarded_ = 0;
+  capture_secure_callbacks_ = 0;
+  capture_send_errors_ = 0;
+  capture_max_gap_us_ = capture_send_us_ = capture_max_send_us_ = 0;
   const int fps = owner_.config_center_->GetVideoFrameRate() ==
                           ConfigCenter::VIDEO_FRAME_RATE::FPS_30
                       ? 30
@@ -74,9 +153,18 @@ int SessionDeviceManager::InitializeScreenCapturer() {
 
   const int init_ret = screen_capturer_->Init(
       fps, [this, fps](unsigned char *data, int size, int width, int height,
-                       const char *display_name) {
+                       const char *display_name,
+                       const MiniRtcNativeVideoFrame *native_frame) {
         const auto now_time = std::chrono::steady_clock::now();
+        bool from_secure_desktop = false;
+#ifdef _WIN32
+        from_secure_desktop =
+            ScreenCapturerWin::CurrentFrameIsFromSecureDesktop();
+#endif
+        RecordCaptureCadence(now_time, fps, from_secure_desktop);
         if (!ShouldSendCapturedFrame(now_time, fps)) {
+          std::lock_guard<std::mutex> lock(capture_metrics_mutex_);
+          ++capture_rate_drops_;
           return;
         }
 
@@ -136,15 +224,31 @@ int SessionDeviceManager::InitializeScreenCapturer() {
           }
         }
 
-        XVideoFrame frame{};
+        MiniRtcVideoFrame frame{};
         frame.data = reinterpret_cast<const char *>(data);
         frame.size = size;
         frame.width = width;
         frame.height = height;
         frame.captured_timestamp = GetSystemTimeMicros(owner_.peer_);
+        frame.native_frame = native_frame;
+        const auto send_started = std::chrono::steady_clock::now();
+        uint64_t send_errors = 0;
         for (const std::string &remote_id : connected_remote_ids) {
-          SendVideoFrameToPeer(owner_.peer_, &frame, stream_id.c_str(),
-                               remote_id.data(), remote_id.size());
+          if (SendVideoFrameToPeer(owner_.peer_, &frame, stream_id.c_str(),
+                                   remote_id.data(), remote_id.size()) != 0)
+            ++send_errors;
+        }
+        const auto send_us =
+            std::chrono::duration_cast<std::chrono::microseconds>(
+                std::chrono::steady_clock::now() - send_started)
+                .count();
+        {
+          std::lock_guard<std::mutex> lock(capture_metrics_mutex_);
+          ++capture_forwarded_;
+          capture_send_errors_ += send_errors;
+          capture_send_us_ += send_us;
+          capture_max_send_us_ =
+              std::max<int64_t>(capture_max_send_us_, send_us);
         }
         last_video_frame_stream_id_ = stream_id;
         last_frame_time_ = now_time;
@@ -167,6 +271,15 @@ int SessionDeviceManager::InitializeScreenCapturer() {
   return -1;
 }
 
+bool SessionDeviceManager::ShouldCaptureCursor() const {
+  std::shared_lock lock(owner_.connection_status_mutex_);
+  return std::any_of(owner_.connection_status_.begin(),
+                     owner_.connection_status_.end(), [](const auto& entry) {
+    return entry.second == ConnectionStatus::Connected &&
+           entry.first.find("web") != std::string::npos;
+  });
+}
+
 int SessionDeviceManager::StartScreenCapturer() {
 #ifdef __APPLE__
   if (!owner_.EnsureMacScreenRecordingPermission()) {
@@ -182,8 +295,11 @@ int SessionDeviceManager::StartScreenCapturer() {
     }
   }
 
-  LOG_INFO("Start screen capturer, show cursor: {}", owner_.show_cursor_);
-  const int ret = screen_capturer_->Start(owner_.show_cursor_);
+  // Clear before sampling, so a change arriving after the sample remains pending.
+  cursor_capture_dirty_.store(false, std::memory_order_relaxed);
+  const bool show_cursor = ShouldCaptureCursor();
+  LOG_INFO("Start screen capturer, show cursor: {}", show_cursor);
+  const int ret = screen_capturer_->Start(show_cursor);
   if (ret != 0) {
     LOG_ERROR("Start screen capturer failed: {}", ret);
   }
@@ -198,42 +314,19 @@ int SessionDeviceManager::StopScreenCapturer() {
   return 0;
 }
 
-int SessionDeviceManager::StartSpeakerCapturer() {
-  if (!speaker_capturer_) {
-    speaker_capturer_ =
-        static_cast<SpeakerCapturer *>(speaker_capturer_factory_->Create());
-    const int init_ret = speaker_capturer_->Init(
-        [this](unsigned char *data, size_t size, const char *audio_name) {
-          SendAudioFrame(owner_.peer_, reinterpret_cast<const char *>(data),
-                         size, owner_.audio_label_.c_str());
-        });
+#ifdef _WIN32
+void SessionDeviceManager::ReleaseRemoteMouseButtons() {
+  if (auto mouse = dynamic_cast<PlatformMouseController*>(mouse_controller_))
+    mouse->ReleasePressedButtons();
+}
+#endif
 
-    if (init_ret != 0) {
-      speaker_capturer_->Destroy();
-      delete speaker_capturer_;
-      speaker_capturer_ = nullptr;
-    }
-  }
-
-  if (!speaker_capturer_) {
-    return -1;
-  }
-
-  const int ret = speaker_capturer_->Start();
-  if (ret != 0) {
-    LOG_ERROR("Start speaker capturer failed: {}", ret);
-    return ret;
-  }
-  owner_.start_speaker_capturer_ = true;
-  return 0;
+void SessionDeviceManager::StartSpeakerCapturer() {
+  speaker_capture_.SetEnabled(true);
 }
 
-int SessionDeviceManager::StopSpeakerCapturer() {
-  if (speaker_capturer_) {
-    speaker_capturer_->Stop();
-    owner_.start_speaker_capturer_ = false;
-  }
-  return 0;
+void SessionDeviceManager::StopSpeakerCapturer() {
+  speaker_capture_.SetEnabled(false);
 }
 
 int SessionDeviceManager::StartMouseController() {
@@ -296,6 +389,7 @@ int SessionDeviceManager::StopMouseController() {
 }
 
 int SessionDeviceManager::StartKeyboardCapturer() {
+  ClearCapturedKeyboardInput();
   owner_.keyboard_capturer_uses_window_events_ = false;
 
 #ifdef __APPLE__
@@ -331,6 +425,7 @@ int SessionDeviceManager::StartKeyboardCapturer() {
       },
       this);
   if (hook_ret != 0) {
+    keyboard_capturer_->Unhook();
     owner_.keyboard_capturer_uses_window_events_ = true;
     LOG_WARN(
         "Start keyboard capturer failed, falling back to Slint keyboard events");
@@ -341,6 +436,9 @@ int SessionDeviceManager::StartKeyboardCapturer() {
 }
 
 int SessionDeviceManager::StopKeyboardCapturer() {
+  owner_.keyboard_capturer_is_started_ = false;
+  if (keyboard_capturer_) keyboard_capturer_->Unhook();
+  ClearCapturedKeyboardInput();
   if (owner_.keyboard_capturer_uses_window_events_) {
     owner_.keyboard_capturer_uses_window_events_ = false;
     LOG_INFO("Stop keyboard capturer with Slint keyboard backend");
@@ -348,8 +446,6 @@ int SessionDeviceManager::StopKeyboardCapturer() {
   }
 
   if (keyboard_capturer_) {
-    keyboard_capturer_->Unhook();
-    ClearCapturedKeyboardInput();
     LOG_INFO("Stop keyboard capturer");
   }
   return 0;
@@ -419,6 +515,15 @@ void SessionDeviceManager::PushAudio(const char *data, size_t size) {
 }
 
 void SessionDeviceManager::UpdateInteractions() {
+#ifdef _WIN32
+  if (owner_.screen_capturer_is_started_ &&
+      cursor_capture_dirty_.load(std::memory_order_relaxed)) {
+    if (auto* windows = dynamic_cast<ScreenCapturerWin*>(screen_capturer_)) {
+      cursor_capture_dirty_.store(false, std::memory_order_relaxed);
+      windows->SetCursorCapture(ShouldCaptureCursor());
+    }
+  }
+#endif
 #if defined(__linux__) && !defined(__APPLE__)
   const bool is_wayland_session = IsWaylandSession();
   const bool stop_wayland_mouse_before_screen =
@@ -443,16 +548,6 @@ void SessionDeviceManager::UpdateInteractions() {
     owner_.screen_capturer_is_started_ = false;
   }
 
-  if (owner_.start_speaker_capturer_ && !owner_.speaker_capturer_is_started_) {
-    if (StartSpeakerCapturer() == 0) {
-      owner_.speaker_capturer_is_started_ = true;
-    }
-  } else if (!owner_.start_speaker_capturer_ &&
-             owner_.speaker_capturer_is_started_) {
-    StopSpeakerCapturer();
-    owner_.speaker_capturer_is_started_ = false;
-  }
-
   if (owner_.start_mouse_controller_ && !owner_.mouse_controller_is_started_) {
     if (StartMouseController() == 0) {
       owner_.mouse_controller_is_started_ = true;
@@ -479,6 +574,14 @@ void SessionDeviceManager::UpdateInteractions() {
       owner_.keyboard_capturer_is_started_ = true;
     }
     if (owner_.keyboard_capturer_is_started_) {
+      if (!owner_.keyboard_capturer_uses_window_events_ &&
+          (!keyboard_capturer_ || !keyboard_capturer_->IsHookActive())) {
+        StopKeyboardCapturer();
+        owner_.keyboard_.ForceReleasePressedKeys();
+        owner_.keyboard_capturer_uses_window_events_ = true;
+        owner_.keyboard_capturer_is_started_ = true;
+        LOG_WARN("Native keyboard capture stopped; using Slint keyboard events");
+      }
       DrainCapturedKeyboardInput();
       owner_.keyboard_.SendHeartbeat(false);
     }
@@ -510,6 +613,7 @@ void SessionDeviceManager::DrainCapturedKeyboardInput() {
     std::lock_guard<std::mutex> lock(captured_keyboard_inputs_mutex_);
     inputs.swap(captured_keyboard_inputs_);
   }
+  if (owner_.privacy_.Snapshot().input_blocked) return;
   for (const CapturedKeyboardInput &input : inputs) {
     owner_.keyboard_.SendKeyCommand(input.key_code, input.is_down,
                                     input.scan_code, input.extended);
@@ -551,6 +655,7 @@ SessionDeviceManager::display_info_list() const {
 }
 
 void SessionDeviceManager::DestroyDevices() {
+  speaker_capture_.Shutdown();
   if (mouse_controller_) {
     mouse_controller_->Destroy();
     delete mouse_controller_;
@@ -561,11 +666,6 @@ void SessionDeviceManager::DestroyDevices() {
     delete screen_capturer_;
     screen_capturer_ = nullptr;
   }
-  if (speaker_capturer_) {
-    speaker_capturer_->Destroy();
-    delete speaker_capturer_;
-    speaker_capturer_ = nullptr;
-  }
   if (keyboard_capturer_) {
     delete keyboard_capturer_;
     keyboard_capturer_ = nullptr;
@@ -575,8 +675,6 @@ void SessionDeviceManager::DestroyDevices() {
 void SessionDeviceManager::DestroyFactories() {
   delete screen_capturer_factory_;
   screen_capturer_factory_ = nullptr;
-  delete speaker_capturer_factory_;
-  speaker_capturer_factory_ = nullptr;
   delete device_controller_factory_;
   device_controller_factory_ = nullptr;
 }

apps/desktop/src/gui/features/devices/session_device_manager.h

@@ -1,8 +1,16 @@
-#ifndef CROSSDESK_GUI_SESSION_DEVICE_MANAGER_H_
-#define CROSSDESK_GUI_SESSION_DEVICE_MANAGER_H_
+/*
+ * @Author: DI JUNKUN
+ * @Date: 2026-09-09
+ * Copyright (c) 2026 by DI JUNKUN, All Rights Reserved.
+ */
+
+#ifndef _SESSION_DEVICE_MANAGER_H_
+#define _SESSION_DEVICE_MANAGER_H_
+
 
 #include <SDL3/SDL.h>
 
+#include <atomic>
 #include <chrono>
 #include <cstddef>
 #include <cstdint>
@@ -17,7 +25,7 @@
 #include "device_controller_factory.h"
 #include "display_info.h"
 #include "screen_capturer_factory.h"
-#include "speaker_capturer_factory.h"
+#include "speaker_capture_controller.h"
 
 namespace crossdesk {
 
@@ -29,17 +37,28 @@ class GuiRuntime;
 class SessionDeviceManager {
 public:
   explicit SessionDeviceManager(GuiRuntime &owner);
+  ~SessionDeviceManager();
 
   void Initialize();
   void UpdateInteractions();
+  // Call after changing the controller map. UpdateInteractions consumes this
+  // notification on the UI thread before reading the map under its mutex.
+  void OnControllerConnectionsChanged() {
+    cursor_capture_dirty_.store(true, std::memory_order_relaxed);
+  }
   void DestroyDevices();
   void DestroyFactories();
 
   int InitializeScreenCapturer();
   int StartScreenCapturer();
   int StopScreenCapturer();
-  int StartSpeakerCapturer();
-  int StopSpeakerCapturer();
+#ifdef _WIN32
+  void ReleaseRemoteMouseButtons();
+#endif
+  // Requests are asynchronous; Stop drains/revokes audio delivery before
+  // returning so the connection peer can be destroyed safely.
+  void StartSpeakerCapturer();
+  void StopSpeakerCapturer();
   int StartMouseController();
   int StopMouseController();
   int StartKeyboardCapturer();
@@ -71,13 +90,16 @@ private:
   void ClearCapturedKeyboardInput();
   bool ShouldSendCapturedFrame(std::chrono::steady_clock::time_point now,
                                int fps);
+  bool ShouldCaptureCursor() const;
+  void RecordCaptureCadence(std::chrono::steady_clock::time_point now, int fps,
+                            bool from_secure_desktop);
 
   GuiRuntime &owner_;
   SDL_AudioStream *output_stream_ = nullptr;
   ScreenCapturerFactory *screen_capturer_factory_ = nullptr;
   ScreenCapturer *screen_capturer_ = nullptr;
-  SpeakerCapturerFactory *speaker_capturer_factory_ = nullptr;
-  SpeakerCapturer *speaker_capturer_ = nullptr;
+  std::atomic<bool> cursor_capture_dirty_{true};
+  SpeakerCaptureController speaker_capture_;
   DeviceControllerFactory *device_controller_factory_ = nullptr;
   MouseController *mouse_controller_ = nullptr;
   KeyboardCapturer *keyboard_capturer_ = nullptr;
@@ -87,10 +109,18 @@ private:
   std::mutex captured_keyboard_inputs_mutex_;
   std::chrono::steady_clock::time_point last_frame_time_{};
   std::chrono::steady_clock::time_point next_frame_deadline_{};
+  std::mutex capture_metrics_mutex_;
+  std::chrono::steady_clock::time_point capture_metrics_started_{};
+  std::chrono::steady_clock::time_point last_capture_callback_{};
+  uint64_t capture_callbacks_ = 0, capture_rate_drops_ = 0;
+  uint64_t capture_secure_callbacks_ = 0;
+  uint64_t capture_forwarded_ = 0, capture_send_errors_ = 0;
+  int64_t capture_max_gap_us_ = 0;
+  int64_t capture_send_us_ = 0, capture_max_send_us_ = 0;
   std::string last_video_frame_stream_id_;
   bool invalid_video_stream_id_logged_ = false;
 };
 
 } // namespace crossdesk
 
-#endif // CROSSDESK_GUI_SESSION_DEVICE_MANAGER_H_
+#endif

apps/desktop/src/gui/features/file_transfer/file_transfer_manager.cpp

@@ -20,6 +20,16 @@ namespace crossdesk {
 
 FileTransferManager::FileTransferManager(GuiRuntime &owner) : owner_(owner) {}
 
+FileTransferManager::~FileTransferManager() {
+  std::vector<std::future<void>> workers;
+  {
+    std::lock_guard lock(workers_mutex_);
+    stopping_ = true;
+    workers.swap(workers_);
+  }
+  for (auto& worker : workers) worker.wait();
+}
+
 FileTransferManager::FileTransferState &FileTransferManager::global_state() {
   return global_state_;
 }
@@ -92,8 +102,16 @@ void FileTransferManager::Start(
     std::shared_ptr<RemoteSession> props,
     const std::filesystem::path &file_path, const std::string &file_label,
     const std::string &remote_id) {
+  if (props && props->closing_) return;
   const bool is_global = !props;
-  PeerPtr *peer = is_global ? owner_.peer_ : props->peer_;
+  PeerPtr* peer = nullptr;
+  std::shared_ptr<PeerEventHandler> peer_events;
+  {
+    std::shared_lock lock(owner_.remote_sessions_mutex_);
+    if (props && props->closing_) return;
+    peer = is_global ? owner_.peer_ : props->peer_;
+    peer_events = is_global ? owner_.peer_events_ : props->peer_events_;
+  }
   if (!peer) {
     LOG_ERROR("StartFileTransfer: invalid peer");
     return;
@@ -108,7 +126,14 @@ void FileTransferManager::Start(
   }
 
   const auto props_weak = std::weak_ptr<RemoteSession>(props);
-  std::thread([this, peer, file_path, file_label, props_weak, remote_id,
+  std::lock_guard workers_lock(workers_mutex_);
+  if (stopping_) return;
+  // Reap finished senders without blocking the UI.
+  std::erase_if(workers_, [](auto& worker) {
+    return worker.wait_for(std::chrono::seconds(0)) == std::future_status::ready;
+  });
+  workers_.push_back(std::async(std::launch::async,
+      [this, peer, peer_events, file_path, file_label, props_weak, remote_id,
                is_global]() {
     auto props_locked = props_weak.lock();
     FileTransferState *state = nullptr;
@@ -166,7 +191,11 @@ void FileTransferManager::Start(
 
     const int ret = sender.SendFile(
         file_path, file_path.filename().string(),
-        [peer, file_label, remote_id](const char *buffer, size_t size) {
+        [peer, peer_events, file_label, remote_id, props_locked](const char *buffer, size_t size) {
+          // Close drains each in-flight send before detaching the peer.
+          if (props_locked && props_locked->closing_) return -1;
+          auto callback = peer_events->EnterCallback();
+          if (!callback) return -1;
           if (remote_id.empty()) {
             return SendReliableDataFrame(peer, buffer, size,
                                          file_label.c_str());
@@ -200,12 +229,13 @@ void FileTransferManager::Start(
     }
     LOG_ERROR("FileSender::SendFile failed for [{}], ret={}",
               file_path.string().c_str(), ret);
-    ProcessQueue(props_locked);
-  }).detach();
+    if (peer_events->IsActive()) ProcessQueue(props_locked);
+  }));
 }
 
 void FileTransferManager::ProcessQueue(
     std::shared_ptr<RemoteSession> props) {
+  if (props && props->closing_) return;
   FileTransferState &state = state_for(props);
   if (state.file_sending_.load()) {
     return;

apps/desktop/src/gui/features/file_transfer/file_transfer_manager.h

@@ -4,6 +4,9 @@
 #include <cstddef>
 #include <cstdint>
 #include <filesystem>
+#include <future>
+#include <mutex>
+#include <vector>
 #include <memory>
 #include <shared_mutex>
 #include <string>
@@ -21,6 +24,7 @@ public:
   using RemoteSession = gui_detail::RemoteSession;
 
   explicit FileTransferManager(GuiRuntime &owner);
+  ~FileTransferManager();
 
   FileTransferState &global_state();
   FileTransferState &
@@ -40,6 +44,9 @@ private:
   void ProcessQueue(std::shared_ptr<RemoteSession> props);
   void Unregister(uint32_t file_id, bool per_peer);
 
+  std::mutex workers_mutex_;
+  std::vector<std::future<void>> workers_;
+  bool stopping_ = false;
   GuiRuntime &owner_;
   FileTransferState global_state_;
   std::unordered_map<uint32_t, std::weak_ptr<RemoteSession>>

apps/desktop/src/gui/features/input/keyboard_controller.cpp

@@ -150,6 +150,7 @@ void KeyboardController::SendHeartbeat(bool force) {
   const std::string target_id = owner_.controlled_remote_id_.empty()
                                     ? owner_.focused_remote_id_
                                     : owner_.controlled_remote_id_;
+  std::shared_lock sessions_lock(owner_.remote_sessions_mutex_);
   const auto props_it = owner_.remote_sessions_.find(target_id);
   if (target_id.empty() || props_it == owner_.remote_sessions_.end() ||
       props_it->second->connection_status_.load() !=
@@ -189,6 +190,7 @@ int KeyboardController::SendKeyCommand(int key_code, bool is_down,
   const std::string target_id = owner_.controlled_remote_id_.empty()
                                     ? owner_.focused_remote_id_
                                     : owner_.controlled_remote_id_;
+  std::shared_lock sessions_lock(owner_.remote_sessions_mutex_);
   const auto props_it = owner_.remote_sessions_.find(target_id);
   if (!target_id.empty() && props_it != owner_.remote_sessions_.end() &&
       props_it->second->connection_status_.load() ==
@@ -211,6 +213,9 @@ int KeyboardController::SendKeyCommand(int key_code, bool is_down,
 bool KeyboardController::InjectRemoteKey(int key_code, bool is_down,
                                          uint32_t scan_code, bool extended) {
 #if _WIN32
+  if (owner_.privacy_.Engaged() && !IsWindowsPrivacyDesktopAvailable()) {
+    owner_.privacy_.Fail("Secure desktop or locked session; privacy screen will turn off");
+  }
   if (owner_.local_service_status_received_ &&
       IsSecureDesktopInteractionRequired(owner_.local_interactive_stage_)) {
     const std::string response = SendCrossDeskSecureDesktopKeyInput(
@@ -244,6 +249,7 @@ bool KeyboardController::InjectRemoteKey(int key_code, bool is_down,
     return true;
   }
 #endif
+  // Recheck after the desktop query; key-up cleanup remains allowed while paused.
   return owner_.devices_.SendKeyboardCommand(key_code, is_down, scan_code,
                                              extended);
 }
@@ -340,11 +346,50 @@ void KeyboardController::ReleaseRemotePressedKeys(const std::string& remote_id,
              keys_to_release.size(), remote_id, reason ? reason : "unknown");
   }
   for (const PressedKey& key : keys_to_release) {
-    InjectRemoteKey(key.key_code, false, key.scan_code, key.extended);
+    if (!InjectRemoteKey(key.key_code, false, key.scan_code, key.extended)) {
+#ifdef _WIN32
+      if (owner_.privacy_.Engaged()) {
+        std::lock_guard lock(remote_states_mutex_);
+        pending_privacy_releases_[key.key_code] = key;
+      }
+#endif
+    }
   }
 }
 
+void KeyboardController::ReleaseAllRemotePressedKeys(const char* reason) {
+  std::vector<std::string> remotes;
+  {
+    std::lock_guard lock(remote_states_mutex_);
+    for (const auto& [id, state] : remote_states_) remotes.push_back(id);
+  }
+  for (const auto& id : remotes) ReleaseRemotePressedKeys(id, reason);
+  CheckRemoteTimeouts();
+}
+
 void KeyboardController::CheckRemoteTimeouts() {
+#ifdef _WIN32
+  bool pending = false;
+  {
+    std::lock_guard lock(remote_states_mutex_);
+    pending = !pending_privacy_releases_.empty();
+  }
+  // A key-up rejected on the secure desktop is retained until the ordinary
+  // desktop returns. Never route cleanup through the security UI helper.
+  if (pending && IsWindowsPrivacyDesktopAvailable()) {
+    std::unordered_map<int, PressedKey> releases;
+    {
+      std::lock_guard lock(remote_states_mutex_);
+      releases.swap(pending_privacy_releases_);
+    }
+    for (const auto& [code, key] : releases) {
+      if (!owner_.devices_.SendKeyboardCommand(code, false, key.scan_code, key.extended)) {
+        std::lock_guard lock(remote_states_mutex_);
+        pending_privacy_releases_[code] = key;
+      }
+    }
+  }
+#endif
   const uint32_t now = static_cast<uint32_t>(SDL_GetTicks());
   std::vector<std::string> timed_out_remotes;
   {

apps/desktop/src/gui/features/input/keyboard_controller.h

@@ -30,6 +30,7 @@ public:
                         const RemoteAction &remote_action);
   void ReleaseRemotePressedKeys(const std::string &remote_id,
                                 const char *reason);
+  void ReleaseAllRemotePressedKeys(const char* reason);
   void CheckRemoteTimeouts();
 
 private:
@@ -58,6 +59,9 @@ private:
   uint32_t last_heartbeat_tick_ = 0;
   std::unordered_map<std::string, RemoteState> remote_states_;
   std::mutex remote_states_mutex_;
+#ifdef _WIN32
+  std::unordered_map<int, PressedKey> pending_privacy_releases_;
+#endif
 };
 
 } // namespace crossdesk

apps/desktop/src/gui/features/settings/settings_manager.cpp

@@ -308,7 +308,6 @@ int SettingsManager::Load() {
   owner_.enable_hardware_video_codec_ =
       owner_.config_center_->IsHardwareVideoCodec();
   owner_.enable_turn_ = owner_.config_center_->IsEnableTurn();
-  owner_.enable_srtp_ = owner_.config_center_->IsEnableSrtp();
   owner_.enable_self_hosted_ = owner_.config_center_->IsSelfHosted();
   owner_.enable_autostart_ = owner_.config_center_->IsEnableAutostart();
   owner_.enable_daemon_ = owner_.config_center_->IsEnableDaemon();
@@ -335,7 +334,6 @@ int SettingsManager::Load() {
   owner_.enable_hardware_video_codec_last_ =
       owner_.enable_hardware_video_codec_;
   owner_.enable_turn_last_ = owner_.enable_turn_;
-  owner_.enable_srtp_last_ = owner_.enable_srtp_;
   owner_.enable_self_hosted_last_ = owner_.enable_self_hosted_;
   owner_.enable_autostart_last_ = owner_.enable_autostart_;
 

apps/desktop/src/gui/render.h

@@ -1,5 +1,11 @@
-#ifndef CROSSDESK_GUI_RENDER_H_
-#define CROSSDESK_GUI_RENDER_H_
+/*
+ * @Author: DI JUNKUN
+ * @Date: 2026-09-04
+ * Copyright (c) 2026 by DI JUNKUN, All Rights Reserved.
+ */
+
+#ifndef _RENDER_H_
+#define _RENDER_H_
 
 #include <memory>
 
@@ -25,4 +31,4 @@ private:
 
 } // namespace crossdesk
 
-#endif // CROSSDESK_GUI_RENDER_H_
+#endif

apps/desktop/src/gui/rendering/slint_video_presenter.cpp

@@ -119,21 +119,9 @@ struct SlintVideoPresenter::Impl {
             return;
           }
 
+          std::lock_guard lock(gl_mutex);
           auto* opengl_renderer =
               dynamic_cast<OpenGlVideoRenderer*>(&renderer);
-          if (state == slint::RenderingState::AfterRendering && stream &&
-              opengl_renderer &&
-              (*stream)->get_native_video_enabled() &&
-              opengl_renderer->ShouldContinueRendering()) {
-            // Queue the next frame directly from the display callback. A
-            // 16/17 ms polling timer can drift across vsync and make Windows
-            // coalesce every second request, effectively capping video near
-            // 30 fps even when decode and submission stay near 60 fps.
-            (*stream)->window().request_redraw();
-            return;
-          }
-
-          std::lock_guard lock(gl_mutex);
           if (state == slint::RenderingState::RenderingSetup) {
             GLuint texture = 0;
             glGenTextures(1, &texture);

apps/desktop/src/gui/rendering/slint_video_presenter.h

@@ -1,5 +1,11 @@
-#ifndef CROSSDESK_GUI_RENDERING_SLINT_VIDEO_PRESENTER_H_
-#define CROSSDESK_GUI_RENDERING_SLINT_VIDEO_PRESENTER_H_
+/*
+ * @Author: DI JUNKUN
+ * @Date: 2026-09-04
+ * Copyright (c) 2026 by DI JUNKUN, All Rights Reserved.
+ */
+
+#ifndef _SLINT_VIDEO_PRESENTER_H_
+#define _SLINT_VIDEO_PRESENTER_H_
 
 #include <cstddef>
 #include <cstdint>
@@ -72,4 +78,4 @@ private:
 
 }  // namespace crossdesk
 
-#endif  // CROSSDESK_GUI_RENDERING_SLINT_VIDEO_PRESENTER_H_
+#endif

apps/desktop/src/gui/runtime/connection_runtime.cpp

@@ -6,6 +6,7 @@
 #include <shared_mutex>
 #include <string>
 #include <thread>
+#include <utility>
 #include <vector>
 
 #include <display_stream_id.h>
@@ -13,42 +14,49 @@
 #include "platform.h"
 #include "platform/video_renderer.h"
 #include "rd_log.h"
+#include "runtime/device_presence_request.h"
 #include "runtime/gui_runtime.h"
 
 namespace crossdesk {
 
 namespace {
 constexpr auto kPresenceProbeTimeout = std::chrono::seconds(5);
+constexpr auto kPresenceRefreshInterval = std::chrono::seconds(30);
+constexpr auto kPresenceRetryInterval = std::chrono::seconds(1);
 }  // namespace
 
+bool GuiRuntime::HasActiveSession() {
+  if (stream_window_inited_) return true;
+  std::shared_lock lock(connection_status_mutex_);
+  return std::any_of(connection_status_.begin(), connection_status_.end(),
+                     [](const auto& entry) {
+                       return entry.second == ConnectionStatus::Connecting ||
+                              entry.second == ConnectionStatus::Connected;
+                     });
+}
+
 void GuiRuntime::HandleConnectionStatusChange() {
-  if (signal_connected_ && peer_ && need_to_send_recent_connections_) {
-    if (!recent_connection_ids_.empty()) {
-      nlohmann::json j;
-      j["type"] = "recent_connections_presence";
-      j["user_id"] = client_id_;
-      j["devices"] = nlohmann::json::array();
-      for (const auto& id : recent_connection_ids_) {
-        std::string pure_id = id;
-        size_t pos_y = pure_id.find('Y');
-        size_t pos_n = pure_id.find('N');
-        size_t pos = std::string::npos;
-        if (pos_y != std::string::npos &&
-            (pos_n == std::string::npos || pos_y < pos_n)) {
-          pos = pos_y;
-        } else if (pos_n != std::string::npos) {
-          pos = pos_n;
-        }
-        if (pos != std::string::npos) {
-          pure_id = pure_id.substr(0, pos);
-        }
-        j["devices"].push_back(pure_id);
-      }
-      auto s = j.dump();
-      SendSignalMessage(peer_, s.data(), s.size());
-    }
+  if (!signal_connected_ || !peer_) {
+    return;
+  }
+  const auto now = std::chrono::steady_clock::now();
+  if (now - last_presence_request_attempt_at_ < kPresenceRetryInterval) {
+    return;
+  }
+  // Consume the flag before sending so a concurrent reconnect cannot lose its
+  // refresh request. Keep it pending while disconnected or after a send error.
+  const bool requested = need_to_send_recent_connections_.exchange(false);
+  if (!requested && now < next_presence_refresh_at_) {
+    return;
+  }
+  last_presence_request_attempt_at_ = now;
+  const auto message =
+      BuildDevicePresenceRequest(client_id_, recent_connection_ids_, true).dump();
+  if (SendSignalMessage(peer_, message.data(), message.size()) == 0) {
+    next_presence_refresh_at_ = now + kPresenceRefreshInterval;
+  } else {
+    need_to_send_recent_connections_ = true;
   }
-  need_to_send_recent_connections_ = false;
 }
 
 void GuiRuntime::HandlePendingPresenceProbe() {
@@ -123,36 +131,41 @@ void GuiRuntime::HandlePresenceProbeTimeout() {
 void GuiRuntime::HandleServerControllerDisconnected(
     const std::string& remote_id, const char* reason) {
   keyboard_.ReleaseRemotePressedKeys(remote_id, reason);
+#ifdef _WIN32
+  devices_.ReleaseRemoteMouseButtons();
+#endif
   {
     std::lock_guard lock(remote_pointer_input_mutex_);
     last_remote_pointer_input_time_.erase(remote_id);
   }
 
   bool has_connected_controller = false;
-  bool has_web_controller = false;
   std::string remaining_controller_id;
   {
     std::unique_lock lock(connection_status_mutex_);
     connection_status_.erase(remote_id);
+    devices_.OnControllerConnectionsChanged();
     connection_host_names_.erase(remote_id);
+    privacy_sessions_.Disconnected(remote_id);
     for (const auto& [id, status] : connection_status_) {
       if (status != ConnectionStatus::Connected) {
         continue;
       }
       has_connected_controller = true;
-      has_web_controller =
-          has_web_controller || id.find("web") != std::string::npos;
       if (remaining_controller_id.empty()) {
         remaining_controller_id = id;
       }
     }
   }
-  show_cursor_ = has_web_controller;
   if (has_connected_controller) {
     remote_client_id_ = remaining_controller_id;
     return;
   }
 
+  LOG_INFO("Last remote controller disconnected; recovering privacy, reason={}",
+           reason ? reason : "unknown");
+  privacy_.Disconnected();
+
   need_to_create_server_window_.store(false, std::memory_order_release);
   need_to_destroy_server_window_.store(true, std::memory_order_release);
   is_server_mode_ = false;
@@ -170,14 +183,11 @@ void GuiRuntime::HandleServerControllerDisconnected(
 #else
   start_screen_capturer_ = false;
 #endif
-  start_speaker_capturer_ = false;
+  devices_.StopSpeakerCapturer();
   start_mouse_controller_ = false;
   start_keyboard_capturer_ = false;
   remote_client_id_.clear();
-  if (audio_capture_) {
-    devices_.StopSpeakerCapturer();
-    audio_capture_ = false;
-  }
+  audio_capture_ = false;
   devices_.ResetToInitialDisplay();
 }
 
@@ -199,11 +209,9 @@ int GuiRuntime::RequestSingleDevicePresence(const std::string& remote_id,
     pending_presence_remember_password_ = remember_password;
   }
 
-  nlohmann::json j;
-  j["type"] = "recent_connections_presence";
-  j["user_id"] = client_id_;
-  j["devices"] = nlohmann::json::array({remote_id});
-  auto s = j.dump();
+  const auto s = BuildDevicePresenceRequest(
+                     client_id_, recent_connection_ids_, false, remote_id)
+                     .dump();
 
   int ret = SendSignalMessage(peer_, s.data(), s.size());
   if (ret != 0) {
@@ -220,6 +228,11 @@ int GuiRuntime::RequestSingleDevicePresence(const std::string& remote_id,
 }
 
 void GuiRuntime::CloseRemoteSession(std::shared_ptr<RemoteSession> props) {
+  if (!props || props->closing_.exchange(true)) return;
+  if (props->peer_events_) props->peer_events_->Deactivate();
+  props->connection_established_ = false;
+  props->streaming_ = false;
+  props->connection_status_.store(ConnectionStatus::Closed);
   std::shared_ptr<std::vector<unsigned char>> frame_snapshot;
   int video_width = 0;
   int video_height = 0;
@@ -245,85 +258,161 @@ void GuiRuntime::CloseRemoteSession(std::shared_ptr<RemoteSession> props) {
     }
   }
 
-  if (frame_snapshot && !frame_snapshot->empty() && video_width > 0 &&
-      video_height > 0) {
-    std::vector<unsigned char> buffer_copy(*frame_snapshot);
-    std::string remote_id = props->remote_id_;
-    std::string remote_host_name = props->remote_host_name_;
-    std::string password =
-        props->remember_password_ ? props->remote_password_ : "";
-
-    std::thread save_thread([buffer_copy, video_width, video_height, remote_id,
-                             remote_host_name, password,
-                             thumbnail = thumbnail_]() {
-      thumbnail->SaveToThumbnail((char*)buffer_copy.data(), video_width,
-                                 video_height, remote_id, remote_host_name,
-                                 password);
-    });
-
-    {
-      std::lock_guard<std::mutex> lock(thumbnail_save_threads_mutex_);
-      thumbnail_save_threads_.emplace_back(std::move(save_thread));
-    }
-  }
-
   if (native_renderer) {
     native_renderer->DiscardStream(props->remote_id_);
     video_frame_dirty_.store(true, std::memory_order_release);
   }
 
-  if (props->peer_) {
-    LOG_INFO("[{}] Leave connection [{}]", props->local_id_, props->remote_id_);
-    LeaveConnection(props->peer_, props->remote_id_.c_str());
-    LOG_INFO("Destroy peer [{}]", props->local_id_);
-    DestroyPeer(&props->peer_);
+  PeerPtr* peer = nullptr;
+  {
+    // Audio/clipboard senders hold a shared map lock while using this pointer.
+    std::unique_lock lock(remote_sessions_mutex_);
+    peer = std::exchange(props->peer_, nullptr);
   }
+  const auto queued_at = std::chrono::steady_clock::now();
+  session_cleanup_tasks_[props->remote_id_] = session_cleanup_queue_.PostTask(
+      [props, peer, frame_snapshot, video_width, video_height,
+       thumbnail = thumbnail_, queued_at]() mutable {
+        if (peer) {
+          LOG_INFO("[{}] Background leave connection [{}]", props->local_id_,
+                   props->remote_id_);
+          LeaveConnection(peer, props->remote_id_.c_str());
+          DestroyPeer(&peer);
+        }
+        if (thumbnail && frame_snapshot && !frame_snapshot->empty() &&
+            video_width > 0 && video_height > 0) {
+          thumbnail->SaveToThumbnail(
+              reinterpret_cast<char*>(frame_snapshot->data()), video_width,
+              video_height, props->remote_id_, props->remote_host_name_,
+              props->remember_password_ ? props->remote_password_ : "");
+        }
+        const auto elapsed = std::chrono::duration_cast<std::chrono::milliseconds>(
+            std::chrono::steady_clock::now() - queued_at).count();
+        LOG_INFO("[{}] Session cleanup completed in {} ms", props->remote_id_,
+                 elapsed);
+      });
+}
+
+void GuiRuntime::CloseServerController(const std::string& remote_id) {
+  if (!peer_ || remote_id.empty() || controller_cleanup_tasks_.count(remote_id))
+    return;
+  controller_cleanup_tasks_[remote_id] = session_cleanup_queue_.PostTask(
+      [peer = peer_, remote_id] { LeaveConnection(peer, remote_id.c_str()); });
+}
+
+void GuiRuntime::CloseConnectionPeer() {
+  if (!peer_) return;
+  peer_events_->Deactivate();
+  std::vector<std::string> controllers;
+  {
+    std::shared_lock lock(connection_status_mutex_);
+    for (const auto& [id, status] : connection_status_) controllers.push_back(id);
+  }
+  for (const auto& id : controllers)
+    HandleServerControllerDisconnected(id, "peer_closed");
+  devices_.StopMouseController();
+  devices_.StopScreenCapturer();
+  devices_.StopSpeakerCapturer();
+  devices_.StopKeyboardCapturer();
+  signal_connected_ = false;
+  device_presence_cache_.SetSignalConnected(false);
+  signal_status_ = SignalStatus::SignalClosed;
+  PeerPtr* peer;
+  {
+    std::unique_lock lock(remote_sessions_mutex_);
+    peer = std::exchange(peer_, nullptr);
+  }
+  // The same serial queue also owns outstanding controller disconnects, so
+  // these finish before the shared peer is destroyed.
+  connection_peer_cleanup_ = session_cleanup_queue_.PostTask(
+      [peer, handler = peer_events_, id = std::string(client_id_)]() mutable {
+        LOG_INFO("[{}] Background connection peer cleanup", id);
+        LeaveConnection(peer, id.c_str());
+        DestroyPeer(&peer);
+      });
 }
 
 void GuiRuntime::CloseAllRemoteSessions() {
-  if (peer_) {
-    LOG_INFO("[{}] Leave connection [{}]", client_id_, client_id_);
-    LeaveConnection(peer_, client_id_);
-    is_client_mode_ = false;
-    devices_.StopMouseController();
-    devices_.StopScreenCapturer();
-    devices_.StopSpeakerCapturer();
-    devices_.StopKeyboardCapturer();
-    LOG_INFO("Destroy peer [{}]", client_id_);
-    DestroyPeer(&peer_);
-  }
-
+  CloseConnectionPeer();
+  is_client_mode_ = false;
+  pending_reconnects_.clear();
+  std::vector<std::shared_ptr<RemoteSession>> sessions;
   {
-    // std::shared_lock lock(remote_sessions_mutex_);
-    for (auto& it : remote_sessions_) {
-      auto props = it.second;
-      CloseRemoteSession(props);
-    }
+    std::shared_lock lock(remote_sessions_mutex_);
+    for (const auto& [id, props] : remote_sessions_) sessions.push_back(props);
   }
-
+  for (const auto& props : sessions) CloseRemoteSession(props);
   {
-    // std::unique_lock lock(remote_sessions_mutex_);
+    std::unique_lock lock(remote_sessions_mutex_);
     remote_sessions_.clear();
   }
 }
 
-void GuiRuntime::WaitForThumbnailSaveTasks() {
-  std::vector<std::thread> threads_to_join;
-
-  {
-    std::lock_guard<std::mutex> lock(thumbnail_save_threads_mutex_);
-    threads_to_join.swap(thumbnail_save_threads_);
+void GuiRuntime::HandleSessionCleanup() {
+  auto completed = [](std::future<void>& task) {
+    if (!task.valid() || task.wait_for(std::chrono::seconds(0)) !=
+                             std::future_status::ready) return false;
+    try {
+      task.get();
+    } catch (const std::exception& error) {
+      LOG_ERROR("Connection cleanup failed: {}", error.what());
+    }
+    return true;
+  };
+  completed(connection_peer_cleanup_);
+  for (auto it = controller_cleanup_tasks_.begin();
+       it != controller_cleanup_tasks_.end();) {
+    if (completed(it->second)) it = controller_cleanup_tasks_.erase(it);
+    else ++it;
   }
-
-  if (threads_to_join.empty()) {
-    return;
+  std::vector<std::pair<std::string, PendingReconnect>> reconnects;
+  for (auto it = session_cleanup_tasks_.begin();
+       it != session_cleanup_tasks_.end();) {
+    if (it->second.wait_for(std::chrono::seconds(0)) !=
+        std::future_status::ready) {
+      ++it;
+      continue;
+    }
+    try {
+      it->second.get();
+    } catch (const std::exception& error) {
+      LOG_ERROR("[{}] Session cleanup failed: {}", it->first, error.what());
+    }
+    if (auto pending = pending_reconnects_.find(it->first);
+        pending != pending_reconnects_.end()) {
+      reconnects.emplace_back(pending->first, std::move(pending->second));
+      pending_reconnects_.erase(pending);
+    }
+    it = session_cleanup_tasks_.erase(it);
+    reload_recent_connections_ = true;
+    recent_connection_image_save_time_ = 0;
   }
+  for (const auto& [id, request] : reconnects) {
+    ConnectTo(id, request.password.c_str(), request.remember_password);
+  }
+}
 
-  for (auto& thread : threads_to_join) {
-    if (thread.joinable()) {
-      thread.join();
+void GuiRuntime::WaitForSessionCleanup() {
+  pending_reconnects_.clear();
+  auto drain = [](std::future<void>& task) {
+    if (!task.valid()) return;
+    try {
+      task.get();
+    } catch (const std::exception& error) {
+      LOG_ERROR("Connection cleanup failed: {}", error.what());
+    }
+  };
+  drain(connection_peer_cleanup_);
+  for (auto& [id, task] : controller_cleanup_tasks_) drain(task);
+  controller_cleanup_tasks_.clear();
+  for (auto& [id, task] : session_cleanup_tasks_) {
+    try {
+      task.get();
+    } catch (const std::exception& error) {
+      LOG_ERROR("[{}] Session cleanup failed: {}", id, error.what());
     }
   }
+  session_cleanup_tasks_.clear();
 }
 
 void GuiRuntime::ResetRemoteSessionResources(
@@ -346,6 +435,7 @@ void GuiRuntime::ResetRemoteSessionResources(
     std::lock_guard<std::mutex> lock(props->remote_cursor_state_mutex_);
     props->remote_cursor_state_ = {};
     props->remote_cursor_state_received_ = false;
+    props->cursor_presentation_ = {};
   }
 }
 
@@ -365,6 +455,11 @@ std::shared_ptr<GuiRuntime::RemoteSession> GuiRuntime::FindRemoteSession(
 
 int GuiRuntime::ConnectTo(const std::string& remote_id, const char* password,
                           bool remember_password, bool bypass_presence_check) {
+  if (session_cleanup_tasks_.count(remote_id)) {
+    pending_reconnects_[remote_id] = {password ? password : "", remember_password};
+    LOG_INFO("[{}] Reconnect queued until previous peer is destroyed", remote_id);
+    return 0;
+  }
   if (!bypass_presence_check && !device_presence_cache_.IsOnline(remote_id)) {
     int ret =
         RequestSingleDevicePresence(remote_id, password, remember_password);
@@ -382,16 +477,14 @@ int GuiRuntime::ConnectTo(const std::string& remote_id, const char* password,
   LOG_INFO("Connect to [{}]", remote_id);
   focused_remote_id_ = remote_id;
 
-  // std::shared_lock shared_lock(remote_sessions_mutex_);
-  bool exists = (remote_sessions_.find(remote_id) != remote_sessions_.end());
-  // shared_lock.unlock();
+  bool exists = FindRemoteSession(remote_id) != nullptr;
 
   if (!exists) {
     PeerPtr* peer_to_init = nullptr;
     std::string local_id;
 
     {
-      // std::unique_lock unique_lock(remote_sessions_mutex_);
+      std::unique_lock unique_lock(remote_sessions_mutex_);
       if (remote_sessions_.find(remote_id) == remote_sessions_.end()) {
         remote_sessions_[remote_id] = std::make_shared<RemoteSession>();
         auto props = remote_sessions_[remote_id];
@@ -399,6 +492,8 @@ int GuiRuntime::ConnectTo(const std::string& remote_id, const char* password,
         props->remote_id_ = remote_id;
         memcpy(&props->params_, &params_, sizeof(Params));
         props->params_.user_id = props->local_id_.c_str();
+        props->peer_events_ = std::make_shared<PeerEventHandler>(*this);
+        props->params_.user_data = props->peer_events_.get();
         props->peer_ = CreatePeer(&props->params_);
 
         props->control_window_width_ = title_bar_height_ * 10.0f;
@@ -423,7 +518,7 @@ int GuiRuntime::ConnectTo(const std::string& remote_id, const char* password,
         }
         AddAudioStream(props->peer_, props->audio_label_.c_str());
         AddDataStream(props->peer_, props->data_label_.c_str(), false);
-        AddDataStream(props->peer_, props->mouse_label_.c_str(), false);
+        AddDataStream(props->peer_, props->mouse_label_.c_str(), true);
         AddDataStream(props->peer_, props->keyboard_label_.c_str(), true);
         AddDataStream(props->peer_, props->control_data_label_.c_str(), true);
         AddDataStream(props->peer_, props->file_label_.c_str(), true);
@@ -445,8 +540,8 @@ int GuiRuntime::ConnectTo(const std::string& remote_id, const char* password,
   }
 
   int ret = -1;
-  // std::shared_lock read_lock(remote_sessions_mutex_);
-  auto props = remote_sessions_[remote_id];
+  auto props = FindRemoteSession(remote_id);
+  if (!props || props->closing_) return -1;
   if (!props->connection_established_) {
     props->connection_status_.store(ConnectionStatus::Connecting);
     show_connection_status_window_ = true;
@@ -470,7 +565,6 @@ int GuiRuntime::ConnectTo(const std::string& remote_id, const char* password,
       }
     }
   }
-  // read_lock.unlock();
 
   return 0;
 }

apps/desktop/src/gui/runtime/cursor_position.h

@@ -1,3 +1,9 @@
+/*
+ * @Author: DI JUNKUN
+ * @Date: 2026-09-04
+ * Copyright (c) 2026 by DI JUNKUN, All Rights Reserved.
+ */
+
 #ifndef _CURSOR_POSITION_H_
 #define _CURSOR_POSITION_H_
 
@@ -64,4 +70,4 @@ inline bool NormalizeCursorPosition(
 
 }  // namespace crossdesk
 
-#endif
+#endif

apps/desktop/src/gui/runtime/cursor_presentation.h

@@ -0,0 +1,77 @@
+/*
+ * @Author: DI JUNKUN
+ * @Date: 2026-09-16
+ * Copyright (c) 2026 by DI JUNKUN, All Rights Reserved.
+ */
+
+#ifndef _CURSOR_PRESENTATION_H_
+#define _CURSOR_PRESENTATION_H_
+
+#include <remote_action.h>
+
+#include <cstdint>
+#include <optional>
+
+namespace crossdesk {
+
+// All times use one monotonic millisecond clock. The owning session's cursor
+// mutex protects this policy from the transport and UI threads.
+class CursorPresentation {
+ public:
+  static constexpr uint64_t kStateTimeoutMs = 1500;  // Three 500ms heartbeats.
+  static constexpr uint64_t kInputActivityMs = 1500;
+
+  void Observe(const CursorState& state, uint64_t now) {
+    if (state.render_mode == CursorRenderMode::unknown) {
+      // Repeated unavailable samples must not extend the recovery deadline.
+      if (!sample_unavailable_) stale_at_ = now + kStateTimeoutMs;
+      sample_unavailable_ = true;
+      return;
+    }
+    sample_unavailable_ = false;
+    stale_at_ = now + kStateTimeoutMs;
+    const bool separate =
+        state.render_mode == CursorRenderMode::separate ||
+        (state.render_mode == CursorRenderMode::legacy && state.visible);
+    // Old senders cannot distinguish embedded from hidden. Only explicit
+    // metadata from a new sender can establish the no-device compatibility
+    // case.
+    no_device_ = state.render_mode == CursorRenderMode::hidden &&
+                 state.hidden_reason == CursorHiddenReason::no_pointing_device;
+    held_shape_ = separate ? state.shape : RemoteCursorShape::none;
+    if (held_shape_ != RemoteCursorShape::none) {
+      last_visible_shape_ = held_shape_;
+    }
+    if (!no_device_) fallback_engaged_ = false;
+  }
+
+  void NoteInput(uint64_t now) { last_input_ = now; }
+
+  RemoteCursorShape Resolve(uint64_t now) {
+    if (!stale_at_) return RemoteCursorShape::default_cursor;
+
+    const bool recent_input =
+        last_input_ && now - *last_input_ < kInputActivityMs;
+    const bool can_recover =
+        now >= *stale_at_ || (!sample_unavailable_ && no_device_);
+    if (can_recover && recent_input) {
+      fallback_engaged_ = true;
+    }
+    // Once needed, retain the locator while idle until a good non-compatibility
+    // sample arrives. Otherwise it would blink off whenever input pauses.
+    return fallback_engaged_ ? last_visible_shape_ : held_shape_;
+  }
+
+ private:
+  bool sample_unavailable_ = false;
+  bool no_device_ = false;
+  bool fallback_engaged_ = false;
+  std::optional<uint64_t> stale_at_;
+  std::optional<uint64_t> last_input_;
+  RemoteCursorShape held_shape_ = RemoteCursorShape::default_cursor;
+  RemoteCursorShape last_visible_shape_ = RemoteCursorShape::default_cursor;
+};
+
+}  // namespace crossdesk
+
+#endif

apps/desktop/src/gui/runtime/cursor_state_provider.cpp

@@ -6,39 +6,17 @@
 
 #include <windows.h>
 
+#include "platform/windows/input/windows_cursor_state.h"
+#include "platform/windows/screen_capturer/captured_cursor_state.h"
+#include "platform/windows/screen_capturer/dxgi_cursor_state.h"
+#include "platform/windows/screen_capturer/secure_desktop_cursor_state.h"
 #include "runtime/cursor_position.h"
 
 namespace crossdesk {
-namespace {
 
-bool IsSystemCursor(HCURSOR cursor, LPCWSTR resource) {
-  return cursor != nullptr && cursor == LoadCursorW(nullptr, resource);
-}
-
-RemoteCursorShape ShapeFromWindowsCursor(HCURSOR cursor) {
-  if (IsSystemCursor(cursor, IDC_HELP)) return RemoteCursorShape::help;
-  if (IsSystemCursor(cursor, IDC_HAND)) return RemoteCursorShape::pointer;
-  if (IsSystemCursor(cursor, IDC_APPSTARTING))
-    return RemoteCursorShape::progress;
-  if (IsSystemCursor(cursor, IDC_WAIT)) return RemoteCursorShape::wait;
-  if (IsSystemCursor(cursor, IDC_CROSS)) return RemoteCursorShape::crosshair;
-  if (IsSystemCursor(cursor, IDC_IBEAM)) return RemoteCursorShape::text;
-  if (IsSystemCursor(cursor, IDC_NO))
-    return RemoteCursorShape::not_allowed;
-  if (IsSystemCursor(cursor, IDC_SIZEALL)) return RemoteCursorShape::move;
-  if (IsSystemCursor(cursor, IDC_SIZEWE)) return RemoteCursorShape::ew_resize;
-  if (IsSystemCursor(cursor, IDC_SIZENS)) return RemoteCursorShape::ns_resize;
-  if (IsSystemCursor(cursor, IDC_SIZENESW))
-    return RemoteCursorShape::nesw_resize;
-  if (IsSystemCursor(cursor, IDC_SIZENWSE))
-    return RemoteCursorShape::nwse_resize;
-  if (IsSystemCursor(cursor, IDC_UPARROW)) return RemoteCursorShape::n_resize;
-  return RemoteCursorShape::default_cursor;
-}
-
-}  // namespace
-
-struct CursorStateProvider::Impl {};
+struct CursorStateProvider::Impl {
+  WindowsCursorState cursor;
+};
 
 CursorStateProvider::CursorStateProvider() : impl_(std::make_unique<Impl>()) {}
 CursorStateProvider::~CursorStateProvider() = default;
@@ -47,16 +25,39 @@ bool CursorStateProvider::Sample(const std::vector<DisplayInfo>& displays,
                                  int preferred_display, CursorState* state) {
   if (!state) return false;
 
+  SecureDesktopCursorSnapshot secure_cursor{};
+  if (SharedSecureDesktopCursorState().Get(&secure_cursor)) {
+    if (!secure_cursor.valid) {
+      state->hidden_reason = CursorHiddenReason::secure_desktop_pending;
+      return false;
+    }
+    state->seq = 0;
+    NormalizeCursorPosition(secure_cursor.x, secure_cursor.y, displays,
+                            preferred_display, state);
+    state->visible = secure_cursor.visible != 0;
+    state->render_mode = static_cast<CursorRenderMode>(secure_cursor.render_mode);
+    state->hidden_reason =
+        static_cast<CursorHiddenReason>(secure_cursor.hidden_reason);
+    state->shape = state->visible
+                       ? static_cast<RemoteCursorShape>(secure_cursor.shape)
+                       : RemoteCursorShape::none;
+    return true;
+  }
+
   CURSORINFO info{};
   info.cbSize = sizeof(info);
   if (!GetCursorInfo(&info)) return false;
 
   state->seq = 0;
-  state->visible = (info.flags & CURSOR_SHOWING) != 0;
-  state->shape = state->visible ? ShapeFromWindowsCursor(info.hCursor)
-                                : RemoteCursorShape::none;
   NormalizeCursorPosition(info.ptScreenPos.x, info.ptScreenPos.y, displays,
                           preferred_display, state);
+  void* cursor_monitor = state->position_valid
+                             ? displays[state->display_id].handle
+                             : nullptr;
+  const bool embedded = SharedCapturedCursorState().IsEmbedded(cursor_monitor) ||
+      ((info.flags & CURSOR_SHOWING) != 0 &&
+       !SharedDxgiCursorState().ShouldDrawCursor(true, cursor_monitor));
+  impl_->cursor.Sample(info, embedded, state);
   return true;
 }
 

apps/desktop/src/gui/runtime/cursor_state_provider.h

@@ -1,3 +1,9 @@
+/*
+ * @Author: DI JUNKUN
+ * @Date: 2026-09-04
+ * Copyright (c) 2026 by DI JUNKUN, All Rights Reserved.
+ */
+
 #ifndef _CURSOR_STATE_PROVIDER_H_
 #define _CURSOR_STATE_PROVIDER_H_
 
@@ -30,4 +36,4 @@ class CursorStateProvider {
 
 }  // namespace crossdesk
 
-#endif
+#endif

apps/desktop/src/gui/runtime/device_presence_cache.h

@@ -1,12 +1,13 @@
 /*
  * @Author: DI JUNKUN
- * @Date: 2026-02-28
+ * @Date: 2026-09-04
  * Copyright (c) 2026 by DI JUNKUN, All Rights Reserved.
  */
 
-#ifndef CROSSDESK_GUI_DEVICE_PRESENCE_CACHE_H_
-#define CROSSDESK_GUI_DEVICE_PRESENCE_CACHE_H_
+#ifndef _DEVICE_PRESENCE_CACHE_H_
+#define _DEVICE_PRESENCE_CACHE_H_
 
+#include <chrono>
 #include <mutex>
 #include <string>
 #include <unordered_map>
@@ -15,15 +16,29 @@ namespace crossdesk {
 
 class DevicePresenceCache {
 public:
-  void SetOnline(const std::string &device_id, bool online) {
+  using Clock = std::chrono::steady_clock;
+  static constexpr auto kMaxAge = std::chrono::seconds(60);
+
+  void SetSignalConnected(bool connected) {
     std::lock_guard<std::mutex> lock(mutex_);
-    cache_[device_id] = online;
+    signal_connected_ = connected;
+    cache_.clear();
   }
 
-  bool IsOnline(const std::string &device_id) const {
+  void SetOnline(const std::string &device_id, bool online,
+                 Clock::time_point now = Clock::now()) {
+    std::lock_guard<std::mutex> lock(mutex_);
+    if (signal_connected_) {
+      cache_[device_id] = {online, now};
+    }
+  }
+
+  bool IsOnline(const std::string &device_id,
+                Clock::time_point now = Clock::now()) const {
     std::lock_guard<std::mutex> lock(mutex_);
     const auto it = cache_.find(device_id);
-    return it != cache_.end() && it->second;
+    return signal_connected_ && it != cache_.end() && it->second.online &&
+           now - it->second.updated_at < kMaxAge;
   }
 
   void Clear() {
@@ -32,10 +47,15 @@ public:
   }
 
 private:
-  std::unordered_map<std::string, bool> cache_;
+  struct Entry {
+    bool online;
+    Clock::time_point updated_at;
+  };
+  bool signal_connected_ = false;
+  std::unordered_map<std::string, Entry> cache_;
   mutable std::mutex mutex_;
 };
 
 } // namespace crossdesk
 
-#endif // CROSSDESK_GUI_DEVICE_PRESENCE_CACHE_H_
+#endif

apps/desktop/src/gui/runtime/device_presence_request.h

@@ -0,0 +1,43 @@
+/*
+ * @Author: DI JUNKUN
+ * @Date: 2026-09-07
+ * Copyright (c) 2026 by DI JUNKUN, All Rights Reserved.
+ */
+
+#ifndef _DEVICE_PRESENCE_REQUEST_H_
+#define _DEVICE_PRESENCE_REQUEST_H_
+
+#include <algorithm>
+#include <nlohmann/json.hpp>
+#include <string>
+#include <vector>
+
+namespace crossdesk {
+
+inline nlohmann::json BuildDevicePresenceRequest(
+    const std::string& client_id, const std::vector<std::string>& recent_ids,
+    bool subscribe, const std::string& probe_id = {}) {
+  std::vector<std::string> devices;
+  for (const auto& id : recent_ids) {
+    // Recent connection keys contain Y/N plus display settings after the ID.
+    const std::string pure_id = id.substr(0, id.find_first_of("YN"));
+    if (!pure_id.empty() &&
+        std::find(devices.begin(), devices.end(), pure_id) == devices.end()) {
+      devices.push_back(pure_id);
+    }
+  }
+  if (!probe_id.empty() &&
+      std::find(devices.begin(), devices.end(), probe_id) == devices.end()) {
+    devices.push_back(probe_id);
+  }
+  // Include recent devices even in a one-shot probe: older servers ignore
+  // subscribe=false and replace their subscriptions with this device list.
+  return {{"type", "recent_connections_presence"},
+          {"user_id", client_id},
+          {"devices", devices},
+          {"subscribe", subscribe}};
+}
+
+}  // namespace crossdesk
+
+#endif

apps/desktop/src/gui/runtime/gui_runtime.cpp

@@ -19,21 +19,25 @@ namespace crossdesk {
 
 GuiRuntime::GuiRuntime()
     : clipboard_(*this), devices_(*this), transfers_(*this), settings_(*this),
-      keyboard_(*this), peer_events_(*this) {}
+      keyboard_(*this) {}
 
-GuiRuntime::~GuiRuntime() = default;
+GuiRuntime::~GuiRuntime() { WaitForSessionCleanup(); }
 
 int GuiRuntime::CreateConnectionPeer() {
+  // Tick retries after the old peer's leave notification and socket shutdown.
+  if (connection_peer_cleanup_.valid()) return 0;
+  {
+    std::unique_lock lock(remote_sessions_mutex_);
+    peer_events_ = std::make_shared<PeerEventHandler>(*this);
+  }
   params_.use_cfg_file = false;
 
   std::string signal_server_ip;
   int signal_server_port;
-  int coturn_server_port;
 
   if (config_center_->IsSelfHosted()) {
     signal_server_ip = config_center_->GetSignalServerHost();
     signal_server_port = config_center_->GetSignalServerPort();
-    coturn_server_port = config_center_->GetCoturnServerPort();
 
     std::string current_self_hosted_ip = config_center_->GetSignalServerHost();
     const bool use_cached_id = settings_.LoadCachedSelfHostedIdentity();
@@ -58,7 +62,6 @@ int GuiRuntime::CreateConnectionPeer() {
   } else {
     signal_server_ip = config_center_->GetDefaultServerHost();
     signal_server_port = config_center_->GetDefaultSignalServerPort();
-    coturn_server_port = config_center_->GetDefaultCoturnServerPort();
     settings_.ActivateCachedPublicIdentity();
     params_.user_id = client_id_with_password_;
   }
@@ -109,41 +112,19 @@ int GuiRuntime::CreateConnectionPeer() {
   } else {
     signal_server_port_self_[0] = '\0';
   }
-  int coturn_port = config_center_->GetCoturnServerPort();
-  if (coturn_port > 0) {
-    strncpy(coturn_server_port_self_, std::to_string(coturn_port).c_str(),
-            sizeof(coturn_server_port_self_) - 1);
-    coturn_server_port_self_[sizeof(coturn_server_port_self_) - 1] = '\0';
-  } else {
-    coturn_server_port_self_[0] = '\0';
-  }
-
   // peer config
   strncpy((char *)params_.signal_server_ip, signal_server_ip.c_str(),
           sizeof(params_.signal_server_ip) - 1);
   params_.signal_server_ip[sizeof(params_.signal_server_ip) - 1] = '\0';
   params_.signal_server_port = signal_server_port;
-  strncpy((char *)params_.stun_server_ip, signal_server_ip.c_str(),
-          sizeof(params_.stun_server_ip) - 1);
-  params_.stun_server_ip[sizeof(params_.stun_server_ip) - 1] = '\0';
-  params_.stun_server_port = coturn_server_port;
-  strncpy((char *)params_.turn_server_ip, signal_server_ip.c_str(),
-          sizeof(params_.turn_server_ip) - 1);
-  params_.turn_server_ip[sizeof(params_.turn_server_ip) - 1] = '\0';
-  params_.turn_server_port = coturn_server_port;
-  // TURN credentials are issued by the signaling server after login. Keep the
-  // initial values empty so a reusable static password is never embedded in
-  // the client binary.
-  params_.turn_server_username[0] = '\0';
-  params_.turn_server_password[0] = '\0';
-
   strncpy(params_.log_path, dll_log_path_.c_str(),
           sizeof(params_.log_path) - 1);
   params_.log_path[sizeof(params_.log_path) - 1] = '\0';
   params_.hardware_acceleration = config_center_->IsHardwareVideoCodec();
-#if defined(_WIN32)
-  // Windows accepts ref-counted CPU NV12 and CUDA device NV12. The OpenGL
-  // renderer retains the decoded frame until the UI thread has uploaded it.
+#if defined(_WIN32) || defined(__linux__) || defined(__APPLE__)
+  // Windows and Linux retain pooled CPU NV12 frames or CUDA device frames;
+  // macOS retains VideoToolbox CVPixelBuffers for direct Metal sampling. All
+  // platforms fall back to a packed CPU copy when native upload is unavailable.
   params_.native_video_output = true;
 #else
   params_.native_video_output = false;
@@ -188,14 +169,19 @@ int GuiRuntime::CreateConnectionPeer() {
   params_.on_connection_status = PeerEventHandler::OnConnectionStatus;
   params_.on_net_status_report = PeerEventHandler::OnNetStatusReport;
 
-  params_.user_data = &peer_events_;
+  params_.user_data = peer_events_.get();
 
   // The previous peer may have left a terminal status behind. Reset it before
   // Init() starts emitting callbacks for the newly selected server.
   signal_connected_ = false;
+  device_presence_cache_.SetSignalConnected(false);
+  need_to_send_recent_connections_ = true;
   signal_status_ = SignalStatus::SignalConnecting;
 
-  peer_ = CreatePeer(&params_);
+  {
+    std::unique_lock lock(remote_sessions_mutex_);
+    peer_ = CreatePeer(&params_);
+  }
   if (peer_) {
     LOG_INFO("Create peer instance [{}] successful", client_id_);
     Init(peer_);
@@ -213,7 +199,7 @@ int GuiRuntime::CreateConnectionPeer() {
 
     AddAudioStream(peer_, audio_label_.c_str());
     AddDataStream(peer_, data_label_.c_str(), false);
-    AddDataStream(peer_, mouse_label_.c_str(), false);
+    AddDataStream(peer_, mouse_label_.c_str(), true);
     AddDataStream(peer_, keyboard_label_.c_str(), true);
     AddDataStream(peer_, control_data_label_.c_str(), true);
     AddDataStream(peer_, file_label_.c_str(), true);
@@ -239,7 +225,7 @@ void GuiRuntime::UpdateLabels() {
 
 
 void GuiRuntime::HandleRecentConnections() {
-  if (reload_recent_connections_ && thumbnail_) {
+  if (session_cleanup_tasks_.empty() && reload_recent_connections_ && thumbnail_) {
     uint32_t now_time = SDL_GetTicks();
     if (now_time - recent_connection_image_save_time_ >= 50) {
       int ret = thumbnail_->LoadThumbnail(recent_connections_,
@@ -268,11 +254,22 @@ void GuiRuntime::SdlCaptureAudioIn(void *userdata, Uint8 *stream, int len) {
 
   if (1) {
     std::shared_lock lock(runtime->remote_sessions_mutex_);
+    uint64_t captured_timestamp = 0;
     for (const auto &it : runtime->remote_sessions_) {
       auto props = it.second;
       if (props->connection_status_.load() == ConnectionStatus::Connected) {
         if (props->peer_) {
-          SendAudioFrame(props->peer_, (const char *)stream, len,
+          if (captured_timestamp == 0) {
+            const int64_t timestamp_us = GetSystemTimeMicros(props->peer_);
+            if (timestamp_us > 0) {
+              captured_timestamp = static_cast<uint64_t>(timestamp_us);
+            }
+          }
+          MiniRtcAudioFrame frame{};
+          frame.data = reinterpret_cast<const char *>(stream);
+          frame.size = static_cast<size_t>(len);
+          frame.captured_timestamp = captured_timestamp;
+          SendAudioFrame(props->peer_, &frame,
                          runtime->audio_label_.c_str());
         }
       }
@@ -289,29 +286,6 @@ void GuiRuntime::SdlCaptureAudioIn(void *userdata, Uint8 *stream, int len) {
 void GuiRuntime::SdlCaptureAudioOut([[maybe_unused]] void *userdata,
                                     [[maybe_unused]] Uint8 *stream,
                                     [[maybe_unused]] int len) {
-  // GuiApplication *runtime = (GuiApplication *)userdata;
-  // for (auto it : runtime->remote_sessions_) {
-  //   auto props = it.second;
-  //   if (props->connection_status_ == SignalStatus::SignalConnected) {
-  //     SendAudioFrame(props->peer_, (const char *)stream, len);
-  //   }
-  // }
-
-  // if (!runtime->audio_buffer_fresh_) {
-  //   return;
-  // }
-
-  // SDL_memset(stream, 0, len);
-
-  // if (runtime->audio_len_ == 0) {
-  //   return;
-  // } else {
-  // }
-
-  // len = (len > runtime->audio_len_ ? runtime->audio_len_ : len);
-  // SDL_MixAudioFormat(stream, runtime->audio_buffer_, AUDIO_S16LSB, len,
-  //                    SDL_MIX_MAXVOLUME);
-  // runtime->audio_buffer_fresh_ = false;
 }
 
 } // namespace crossdesk

apps/desktop/src/gui/runtime/gui_runtime.h

@@ -1,7 +1,14 @@
-#ifndef CROSSDESK_GUI_RUNTIME_H_
-#define CROSSDESK_GUI_RUNTIME_H_
+/*
+ * @Author: DI JUNKUN
+ * @Date: 2026-09-04
+ * Copyright (c) 2026 by DI JUNKUN, All Rights Reserved.
+ */
+
+#ifndef _GUI_RUNTIME_H_
+#define _GUI_RUNTIME_H_
 
 #include <atomic>
+#include <deque>
 #include <memory>
 #include <string>
 
@@ -10,8 +17,10 @@
 #include "features/file_transfer/file_transfer_manager.h"
 #include "features/input/keyboard_controller.h"
 #include "features/settings/settings_manager.h"
+#include "privacy_controller.h"
 #include "runtime/gui_state.h"
 #include "runtime/peer_event_handler.h"
+#include "runtime/privacy_session_policy.h"
 
 namespace crossdesk {
 
@@ -49,14 +58,22 @@ class GuiRuntime : protected gui_detail::GuiState {
   void HandleConnectionStatusChange();
   void HandlePendingPresenceProbe();
   void HandlePresenceProbeTimeout();
+  bool HasActiveSession();
   void HandleServerControllerDisconnected(const std::string& remote_id,
                                           const char* reason);
   void HandleWindowsServiceIntegration();
+  void HandlePrivacy();
+  bool IsAuthorizedController(const std::string& remote_id);
+  void SetControllerPrivacySupport(const std::string& remote_id, bool supported);
+  void QueuePrivacyCommand(const std::string& remote_id, const PrivacyCommand& command);
 
   void CloseRemoteSession(std::shared_ptr<RemoteSession> props);
   void CloseAllRemoteSessions();
+  void CloseConnectionPeer();
+  void CloseServerController(const std::string& remote_id);
   void ResetRemoteSessionResources(std::shared_ptr<RemoteSession> props);
-  void WaitForThumbnailSaveTasks();
+  void HandleSessionCleanup();
+  void WaitForSessionCleanup();
   std::shared_ptr<RemoteSession> FindRemoteSession(
       const std::string& remote_id);
 
@@ -78,12 +95,18 @@ class GuiRuntime : protected gui_detail::GuiState {
   bool EnsureMacAccessibilityPermission();
 #endif
 
+  PrivacyController privacy_;
+  PrivacySessionPolicy privacy_sessions_;
+  std::mutex privacy_commands_mutex_;
+  std::deque<std::pair<std::string, PrivacyCommand>> privacy_commands_;
+  uint32_t last_privacy_revision_ = 0;
+  uint64_t last_privacy_status_tick_ = 0;
   ClipboardController clipboard_;
   SessionDeviceManager devices_;
   FileTransferManager transfers_;
   SettingsManager settings_;
   KeyboardController keyboard_;
-  PeerEventHandler peer_events_;
+  std::shared_ptr<PeerEventHandler> peer_events_;
   std::atomic<bool> video_frame_dirty_{false};
   std::unique_ptr<VideoRenderer> video_renderer_;
 
@@ -98,4 +121,4 @@ class GuiRuntime : protected gui_detail::GuiState {
 
 }  // namespace crossdesk
 
-#endif  // CROSSDESK_GUI_RUNTIME_H_
+#endif

apps/desktop/src/gui/runtime/gui_state.h

@@ -1,13 +1,11 @@
 /*
- * Aggregate state visible to GuiRuntime and GuiApplication.
- *
- * Definitions live beside their owners: SDL/window state in application and
- * connection/session state in runtime. This header is intentionally only the
- * composition point.
+ * @Author: DI JUNKUN
+ * @Date: 2026-09-04
+ * Copyright (c) 2026 by DI JUNKUN, All Rights Reserved.
  */
 
-#ifndef CROSSDESK_GUI_STATE_H_
-#define CROSSDESK_GUI_STATE_H_
+#ifndef _GUI_STATE_H_
+#define _GUI_STATE_H_
 
 #include "application/application_state.h"
 #include "runtime/runtime_state.h"
@@ -18,4 +16,4 @@ struct GuiState : ApplicationState, RuntimeState {};
 
 } // namespace crossdesk::gui_detail
 
-#endif // CROSSDESK_GUI_STATE_H_
+#endif

apps/desktop/src/gui/runtime/peer_data_callbacks.cpp

@@ -79,6 +79,9 @@ void PeerEventHandler::OnReceiveDataBuffer(
     const char *data, size_t size, const char *user_id, size_t user_id_size,
     const char *src_id, size_t src_id_size, void *user_data) {
   auto *handler = static_cast<PeerEventHandler *>(user_data);
+  if (!handler) return;
+  auto callback = handler->EnterCallback();
+  if (!callback) return;
   GuiRuntime *runtime = handler ? &handler->owner_ : nullptr;
   if (!runtime) {
     return;
@@ -144,15 +147,57 @@ void PeerEventHandler::OnReceiveDataBuffer(
   }
 
   std::string remote_id(user_id, user_id_size);
+  if (remote_action.type == ControlType::privacy_status) {
+    if (auto props = runtime->FindRemoteSession(remote_id)) {
+      if (source_id != props->control_data_label_) return;
+      std::lock_guard lock(props->privacy_status_mutex_);
+      if (!props->privacy_status_received_ ||
+          static_cast<int32_t>(remote_action.ps.revision - props->privacy_status_.revision) >= 0) {
+        props->privacy_status_ = remote_action.ps;
+        props->privacy_status_received_ = true;
+        props->privacy_status_tick_ = SDL_GetTicks();
+        if (static_cast<int32_t>(remote_action.ps.revision - props->privacy_request_revision_) > 0 &&
+            remote_action.ps.state != PrivacyState::starting &&
+            remote_action.ps.state != PrivacyState::stopping)
+          props->privacy_command_pending_ = false;
+      }
+    }
+    return;
+  }
+  if (remote_action.type == ControlType::privacy_command) {
+    if (source_id == runtime->control_data_label_)
+      runtime->QueuePrivacyCommand(remote_id, remote_action.pc);
+    return;
+  }
+  const bool operates_host = remote_action.type == ControlType::mouse ||
+      remote_action.type == ControlType::keyboard || remote_action.type == ControlType::keyboard_state ||
+      remote_action.type == ControlType::service_command || remote_action.type == ControlType::display_id ||
+      remote_action.type == ControlType::audio_capture;
+  if (operates_host) {
+    if (!runtime->IsAuthorizedController(remote_id)) return;
+#ifdef _WIN32
+    // KeyboardController checks the desktop immediately before each native
+    // key injection, including state reconciliation and cleanup. Avoid a
+    // second synchronous session query for every received keyboard packet.
+    const bool keyboard_input = remote_action.type == ControlType::keyboard ||
+                                remote_action.type == ControlType::keyboard_state;
+    if (!keyboard_input && runtime->privacy_.Engaged() &&
+        !IsWindowsPrivacyDesktopAvailable()) {
+      runtime->privacy_.Fail("Secure desktop or lock screen; privacy screen will turn off");
+    }
+#endif
+  }
   if (remote_action.type == ControlType::service_status) {
-    auto props_it = runtime->remote_sessions_.find(remote_id);
-    if (props_it != runtime->remote_sessions_.end()) {
-      runtime->ApplyRemoteServiceStatus(*props_it->second, remote_action.ss);
+    if (auto props = runtime->FindRemoteSession(remote_id)) {
+      runtime->ApplyRemoteServiceStatus(*props, remote_action.ss);
     }
     return;
   }
 
   if (remote_action.type == ControlType::service_command) {
+    if (runtime->privacy_.Engaged()) {
+      runtime->privacy_.Fail("Security shortcut requested; privacy screen will turn off");
+    }
 #if _WIN32
     if (remote_action.c.flag == ServiceCommandFlag::send_sas) {
       runtime->pending_windows_service_sas_.store(true,
@@ -189,7 +234,11 @@ void PeerEventHandler::OnReceiveDataBuffer(
       const bool changed =
           !props->remote_cursor_state_received_ ||
           props->remote_cursor_state_.visible != remote_action.cs.visible ||
-          props->remote_cursor_state_.shape != remote_action.cs.shape;
+          props->remote_cursor_state_.shape != remote_action.cs.shape ||
+          props->remote_cursor_state_.render_mode !=
+              remote_action.cs.render_mode ||
+          props->remote_cursor_state_.hidden_reason !=
+              remote_action.cs.hidden_reason;
       CursorState merged = remote_action.cs;
       if (!remote_action.cs.position_update &&
           props->remote_cursor_state_received_) {
@@ -200,10 +249,14 @@ void PeerEventHandler::OnReceiveDataBuffer(
       }
       props->remote_cursor_state_ = merged;
       props->remote_cursor_state_received_ = true;
+      props->cursor_presentation_.Observe(merged, SDL_GetTicks());
       if (changed) {
-        LOG_INFO("Received cursor state: seq={}, visible={}, shape={}",
+        LOG_INFO("Received cursor state: seq={}, visible={}, shape={}, "
+                 "mode={}, reason={}",
                  remote_action.cs.seq, remote_action.cs.visible,
-                 static_cast<int>(remote_action.cs.shape));
+                 static_cast<int>(remote_action.cs.shape),
+                 static_cast<int>(remote_action.cs.render_mode),
+                 static_cast<int>(remote_action.cs.hidden_reason));
       }
     }
     return;
@@ -245,6 +298,10 @@ void PeerEventHandler::OnReceiveDataBuffer(
         runtime->connection_host_names_[remote_id] = host_name;
       }
       LOG_INFO("Remote hostname: [{}]", host_name);
+      if (source_id == runtime->control_data_label_) {
+        runtime->SetControllerPrivacySupport(
+            remote_id, remote_action.i.supports_privacy_screen);
+      }
       remote_action_codec::Free(remote_action);
     }
   } else {
@@ -296,9 +353,9 @@ void PeerEventHandler::OnReceiveDataBuffer(
       runtime->devices_.SendMouseCommand(remote_action,
                                         runtime->selected_display_);
     } else if (remote_action.type == ControlType::audio_capture) {
-      if (remote_action.a && !runtime->start_speaker_capturer_)
+      if (remote_action.a)
         runtime->devices_.StartSpeakerCapturer();
-      else if (!remote_action.a && runtime->start_speaker_capturer_)
+      else
         runtime->devices_.StopSpeakerCapturer();
     } else if (remote_action.type == ControlType::keyboard) {
       runtime->keyboard_.ApplyRemoteEvent(remote_id, remote_action);

apps/desktop/src/gui/runtime/peer_event_handler.cpp

@@ -60,6 +60,9 @@ PeerEventHandler::PeerEventHandler(GuiRuntime& owner) : owner_(owner) {}
 void PeerEventHandler::OnSignalMessage(const char* message, size_t size,
                                        void* user_data) {
   auto* handler = static_cast<PeerEventHandler*>(user_data);
+  if (!handler) return;
+  auto callback = handler->EnterCallback();
+  if (!callback) return;
   GuiRuntime* runtime = handler ? &handler->owner_ : nullptr;
   if (!runtime || !message || size == 0) {
     return;
@@ -153,6 +156,9 @@ void PeerEventHandler::OnSignalMessage(const char* message, size_t size,
 void PeerEventHandler::OnSignalStatus(SignalStatus status, const char* user_id,
                                       size_t user_id_size, void* user_data) {
   auto* handler = static_cast<PeerEventHandler*>(user_data);
+  if (!handler) return;
+  auto callback = handler->EnterCallback();
+  if (!callback) return;
   GuiRuntime* runtime = handler ? &handler->owner_ : nullptr;
   if (!runtime) {
     return;
@@ -161,6 +167,8 @@ void PeerEventHandler::OnSignalStatus(SignalStatus status, const char* user_id,
   std::string client_id(user_id, user_id_size);
   if (client_id == runtime->client_id_) {
     runtime->signal_status_ = status;
+    runtime->device_presence_cache_.SetSignalConnected(
+        status == SignalStatus::SignalConnected);
     if (SignalStatus::SignalConnecting == status) {
       runtime->signal_connected_ = false;
     } else if (SignalStatus::SignalConnected == status) {
@@ -198,12 +206,8 @@ void PeerEventHandler::OnSignalStatus(SignalStatus status, const char* user_id,
     }
 
     std::string remote_id(client_id.begin() + 2, client_id.end());
-    // std::shared_lock lock(runtime->remote_sessions_mutex_);
-    if (runtime->remote_sessions_.find(remote_id) ==
-        runtime->remote_sessions_.end()) {
-      return;
-    }
-    auto props = runtime->remote_sessions_.find(remote_id)->second;
+    auto props = runtime->FindRemoteSession(remote_id);
+    if (!props) return;
     props->signal_status_ = status;
     if (SignalStatus::SignalConnecting == status) {
       props->signal_connected_ = false;
@@ -230,6 +234,9 @@ void PeerEventHandler::OnConnectionStatus(ConnectionStatus status,
                                           const size_t user_id_size,
                                           void* user_data) {
   auto* handler = static_cast<PeerEventHandler*>(user_data);
+  if (!handler) return;
+  auto callback = handler->EnterCallback();
+  if (!callback) return;
   GuiRuntime* runtime = handler ? &handler->owner_ : nullptr;
   if (!runtime) return;
 
@@ -255,9 +262,11 @@ void PeerEventHandler::OnConnectionStatus(ConnectionStatus status,
           std::lock_guard lock(props->remote_cursor_state_mutex_);
           props->remote_cursor_state_ = {};
           props->remote_cursor_state_received_ = false;
+          props->cursor_presentation_ = {};
         }
         {
-          RemoteAction remote_action;
+          RemoteAction remote_action{};
+          remote_action.i.supports_privacy_screen = true;
           remote_action.i.display_num =
               runtime->devices_.display_info_list().size();
           remote_action.i.display_list =
@@ -304,8 +313,7 @@ void PeerEventHandler::OnConnectionStatus(ConnectionStatus status,
           remote_action_codec::Free(remote_action);
         }
 
-        if (!runtime->need_to_create_stream_window_ &&
-            !runtime->remote_sessions_.empty()) {
+        if (!runtime->need_to_create_stream_window_) {
           runtime->need_to_create_stream_window_ = true;
         }
         props->connection_established_ = true;
@@ -324,6 +332,7 @@ void PeerEventHandler::OnConnectionStatus(ConnectionStatus status,
           std::lock_guard lock(props->remote_cursor_state_mutex_);
           props->remote_cursor_state_ = {};
           props->remote_cursor_state_received_ = false;
+          props->cursor_presentation_ = {};
         }
 
         std::shared_ptr<std::vector<unsigned char>> native_snapshot;
@@ -399,7 +408,18 @@ void PeerEventHandler::OnConnectionStatus(ConnectionStatus status,
     runtime->show_connection_status_window_ = true;
     {
       std::unique_lock lock(runtime->connection_status_mutex_);
+      if (status == ConnectionStatus::Connected) {
+        // Wait for explicit desktop capability before enabling privacy or
+        // sending privacy messages. Legacy and web controllers never opt in.
+        runtime->privacy_sessions_.Connected(
+            remote_id, runtime->config_center_->IsEnablePrivacyScreen());
+        if (!runtime->privacy_sessions_.CanEnable() &&
+            runtime->privacy_.Engaged()) {
+          runtime->privacy_.Disable();
+        }
+      }
       runtime->connection_status_[remote_id] = status;
+      runtime->devices_.OnControllerConnectionsChanged();
     }
 
     switch (status) {
@@ -408,7 +428,8 @@ void PeerEventHandler::OnConnectionStatus(ConnectionStatus status,
         runtime->last_windows_service_status_tick_ = 0;
 #endif
         {
-          RemoteAction remote_action;
+          RemoteAction remote_action{};
+          remote_action.i.supports_privacy_screen = true;
           remote_action.i.display_num =
               runtime->devices_.display_info_list().size();
           remote_action.i.display_list =
@@ -462,19 +483,9 @@ void PeerEventHandler::OnConnectionStatus(ConnectionStatus status,
                                                      std::memory_order_release);
         runtime->is_server_mode_ = true;
         runtime->start_screen_capturer_ = true;
-        runtime->start_speaker_capturer_ = true;
+        runtime->devices_.StartSpeakerCapturer();
         runtime->remote_client_id_ = remote_id;
         runtime->start_mouse_controller_ = true;
-        {
-          std::shared_lock lock(runtime->connection_status_mutex_);
-          if (std::all_of(runtime->connection_status_.begin(),
-                          runtime->connection_status_.end(),
-                          [](const auto& kv) {
-                            return kv.first.find("web") != std::string::npos;
-                          })) {
-            runtime->show_cursor_ = true;
-          }
-        }
 
         break;
       }
@@ -493,9 +504,12 @@ void PeerEventHandler::OnConnectionStatus(ConnectionStatus status,
 
 void PeerEventHandler::OnNetStatusReport(
     const char* client_id, size_t client_id_size, TraversalMode mode,
-    const XNetTrafficStats* net_traffic_stats, const char* user_id,
+    const MiniRtcNetTrafficStats* net_traffic_stats, const char* user_id,
     const size_t user_id_size, void* user_data) {
   auto* handler = static_cast<PeerEventHandler*>(user_data);
+  if (!handler) return;
+  auto callback = handler->EnterCallback();
+  if (!callback) return;
   GuiRuntime* runtime = handler ? &handler->owner_ : nullptr;
   if (!runtime) {
     return;
@@ -556,12 +570,8 @@ void PeerEventHandler::OnNetStatusReport(
   }
 
   std::string remote_id(user_id, user_id_size);
-  // std::shared_lock lock(runtime->remote_sessions_mutex_);
-  if (runtime->remote_sessions_.find(remote_id) ==
-      runtime->remote_sessions_.end()) {
-    return;
-  }
-  auto props = runtime->remote_sessions_.find(remote_id)->second;
+  auto props = runtime->FindRemoteSession(remote_id);
+  if (!props) return;
   if (props->traversal_mode_ != mode) {
     props->traversal_mode_ = mode;
     LOG_INFO("Net mode: [{}]", int(props->traversal_mode_));

apps/desktop/src/gui/runtime/peer_event_handler.h

@@ -1,10 +1,17 @@
-#ifndef CROSSDESK_GUI_PEER_EVENT_HANDLER_H_
-#define CROSSDESK_GUI_PEER_EVENT_HANDLER_H_
+/*
+ * @Author: DI JUNKUN
+ * @Date: 2026-09-04
+ * Copyright (c) 2026 by DI JUNKUN, All Rights Reserved.
+ */
+
+#ifndef _PEER_EVENT_HANDLER_H_
+#define _PEER_EVENT_HANDLER_H_
 
 #include <cstddef>
 #include <string>
 
 #include "minirtc.h"
+#include "runtime/session_lifecycle.h"
 
 namespace crossdesk {
 
@@ -15,7 +22,11 @@ class PeerEventHandler {
 public:
   explicit PeerEventHandler(GuiRuntime &owner);
 
-  static void OnReceiveVideoBuffer(const XVideoFrame *video_frame,
+  bool IsActive() const { return callbacks_.IsActive(); }
+  auto EnterCallback() { return callbacks_.Enter(); }
+  void Deactivate() { callbacks_.Close(); }
+
+  static void OnReceiveVideoBuffer(const MiniRtcVideoFrame *video_frame,
                                    const char *user_id, size_t user_id_size,
                                    const char *src_id, size_t src_id_size,
                                    void *user_data);
@@ -35,7 +46,7 @@ public:
                                  size_t user_id_size, void *user_data);
   static void OnNetStatusReport(const char *client_id, size_t client_id_size,
                                 TraversalMode mode,
-                                const XNetTrafficStats *net_traffic_stats,
+                                const MiniRtcNetTrafficStats *net_traffic_stats,
                                 const char *user_id, size_t user_id_size,
                                 void *user_data);
 
@@ -43,8 +54,9 @@ private:
   static void SendClientInfo(PeerPtr *peer, const std::string &client_id);
 
   GuiRuntime &owner_;
+  gui_detail::SessionCallbackGate callbacks_;
 };
 
 } // namespace crossdesk
 
-#endif // CROSSDESK_GUI_PEER_EVENT_HANDLER_H_
+#endif

apps/desktop/src/gui/runtime/peer_media_callbacks.cpp

@@ -14,42 +14,35 @@ namespace {
 
 constexpr auto kBackgroundSnapshotInterval = std::chrono::seconds(1);
 
-#if defined(_WIN32)
-const XWindowsVideoFrame* GetWindowsNativeFrame(const XVideoFrame* frame) {
-  if (!frame ||
-      frame->native_handle_type != XVideoFrameNativeHandleWindowsNv12 ||
-      !frame->native_handle) {
+const MiniRtcNativeVideoFrame* GetNativeVideoFrame(const MiniRtcVideoFrame* frame) {
+  if (!frame || !frame->native_frame) {
     return nullptr;
   }
-  const auto* native =
-      static_cast<const XWindowsVideoFrame*>(frame->native_handle);
+  const auto* native = frame->native_frame;
   return native->struct_size >=
-                     static_cast<uint32_t>(sizeof(XWindowsVideoFrame)) &&
-                 native->owner && native->copy_to_cpu
+                     static_cast<uint32_t>(sizeof(MiniRtcNativeVideoFrame)) &&
+                 native->owner && native->copy_to_nv12
              ? native
              : nullptr;
 }
-#endif
 
 }  // namespace
 
 void PeerEventHandler::OnReceiveVideoBuffer(
-    const XVideoFrame* video_frame, const char* user_id, size_t user_id_size,
+    const MiniRtcVideoFrame* video_frame, const char* user_id, size_t user_id_size,
     const char* src_id, size_t src_id_size, void* user_data) {
   auto* handler = static_cast<PeerEventHandler*>(user_data);
+  if (!handler) return;
+  auto callback = handler->EnterCallback();
+  if (!callback) return;
   GuiRuntime* runtime = handler ? &handler->owner_ : nullptr;
   if (!runtime) {
     return;
   }
 
   std::string remote_id(user_id, user_id_size);
-  // std::shared_lock lock(runtime->remote_sessions_mutex_);
-  if (runtime->remote_sessions_.find(remote_id) ==
-      runtime->remote_sessions_.end()) {
-    return;
-  }
-  GuiRuntime::RemoteSession* props =
-      runtime->remote_sessions_.find(remote_id)->second.get();
+  auto props = runtime->FindRemoteSession(remote_id);
+  if (!props) return;
 
   if (props->connection_established_) {
     bool background_snapshot_only = false;
@@ -57,12 +50,10 @@ void PeerEventHandler::OnReceiveVideoBuffer(
     if (native_renderer && native_renderer->IsActive()) {
       VideoRenderer::SubmitResult submit_result =
           VideoRenderer::SubmitResult::failed;
-#if defined(_WIN32)
-      if (GetWindowsNativeFrame(video_frame)) {
-        submit_result =
-            native_renderer->SubmitNativeFrame(remote_id, *video_frame);
+      if (GetNativeVideoFrame(video_frame)) {
+        submit_result = native_renderer->SubmitNativeFrame(
+            remote_id, *video_frame->native_frame);
       } else
-#endif
       {
         submit_result = native_renderer->SubmitNv12(
             remote_id, reinterpret_cast<const uint8_t*>(video_frame->data),
@@ -116,14 +107,12 @@ void PeerEventHandler::OnReceiveVideoBuffer(
       }
 
       size_t frame_size = video_frame->size;
-#if defined(_WIN32)
-      const XWindowsVideoFrame* windows_native_frame =
-          GetWindowsNativeFrame(video_frame);
-      if (windows_native_frame) {
-        frame_size = static_cast<size_t>(windows_native_frame->width) *
-                     windows_native_frame->height * 3U / 2U;
+      const MiniRtcNativeVideoFrame* native_frame =
+          GetNativeVideoFrame(video_frame);
+      if (native_frame) {
+        frame_size = static_cast<size_t>(native_frame->width) *
+                     native_frame->height * 3U / 2U;
       }
-#endif
       if (frame_size == 0) {
         return;
       }
@@ -137,15 +126,13 @@ void PeerEventHandler::OnReceiveVideoBuffer(
         props->back_frame_->resize(frame_size);
       }
 
-#if defined(_WIN32)
-      if (windows_native_frame) {
-        if (windows_native_frame->copy_to_cpu(
-                windows_native_frame->owner, props->back_frame_->data(),
+      if (native_frame) {
+        if (native_frame->copy_to_nv12(
+                native_frame->owner, props->back_frame_->data(),
                 props->back_frame_->size()) != 0) {
           return;
         }
       } else
-#endif
       {
         if (!video_frame->data || video_frame->size < frame_size) {
           return;
@@ -185,6 +172,9 @@ void PeerEventHandler::OnReceiveAudioBuffer(
     const char* data, size_t size, const char* user_id, size_t user_id_size,
     const char* src_id, size_t src_id_size, void* user_data) {
   auto* handler = static_cast<PeerEventHandler*>(user_data);
+  if (!handler) return;
+  auto callback = handler->EnterCallback();
+  if (!callback) return;
   GuiRuntime* runtime = handler ? &handler->owner_ : nullptr;
   if (!runtime) {
     return;

apps/desktop/src/gui/runtime/privacy_control_state.h

@@ -0,0 +1,53 @@
+/*
+ * @Author: DI JUNKUN
+ * @Date: 2026-09-12
+ * Copyright (c) 2026 by DI JUNKUN, All Rights Reserved.
+ */
+
+#ifndef _PRIVACY_CONTROL_STATE_H_
+#define _PRIVACY_CONTROL_STATE_H_
+
+#include <cstdint>
+
+#include "remote_action.h"
+
+namespace crossdesk {
+
+struct PrivacyControlState {
+  bool active = false;
+  bool enabled = false;
+  bool off = false;
+  bool unsupported = false;
+  bool can_toggle = false;
+};
+
+// Use the same host-confirmed state for presentation and command admission.
+// Missing confirmation or a failure makes only this toolbar control unavailable.
+inline PrivacyControlState GetPrivacyControlState(
+    const PrivacyStatus& status, bool received, bool command_pending,
+    uint64_t status_age_ms, uint64_t command_age_ms) {
+  PrivacyControlState result;
+  const bool timeout = command_pending && command_age_ms > 15000;
+  result.unsupported = timeout ||
+      (received && (status_age_ms > 5000 || !status.supported ||
+                    status.state == PrivacyState::failed));
+  if (result.unsupported) return result;
+
+  result.active = status.overlay_active || status.remote_paused ||
+                  status.state == PrivacyState::on ||
+                  status.state == PrivacyState::starting ||
+                  status.state == PrivacyState::stopping ||
+                  status.state == PrivacyState::failed;
+  // A command in flight only gates repeated clicks; it adds no display state.
+  result.enabled = received &&
+                   status.state == PrivacyState::on && status.overlay_active &&
+                   !status.remote_paused;
+  result.off = received &&
+               status.state == PrivacyState::off && !result.active;
+  result.can_toggle = !command_pending && (result.active || received);
+  return result;
+}
+
+}  // namespace crossdesk
+
+#endif

apps/desktop/src/gui/runtime/privacy_runtime.cpp

@@ -0,0 +1,114 @@
+/*
+ * @Author: DI JUNKUN
+ * @Date: 2026-09-11
+ * Copyright (c) 2026 by DI JUNKUN, All Rights Reserved.
+ */
+
+#include <cstring>
+#include <shared_mutex>
+
+#include "rd_log.h"
+#include "runtime/gui_runtime.h"
+
+namespace crossdesk {
+
+bool GuiRuntime::IsAuthorizedController(const std::string& remote_id) {
+  // Connections appear here only after the existing password/signalling/RTC
+  // admission path. Outgoing/viewer sessions live in remote_sessions_ instead.
+  std::shared_lock lock(connection_status_mutex_);
+  const auto found = connection_status_.find(remote_id);
+  return found != connection_status_.end() &&
+         found->second == ConnectionStatus::Connected;
+}
+
+void GuiRuntime::SetControllerPrivacySupport(const std::string& remote_id,
+                                           bool supported) {
+  std::unique_lock lock(connection_status_mutex_);
+  const auto found = connection_status_.find(remote_id);
+  if (found == connection_status_.end() ||
+      found->second != ConnectionStatus::Connected) return;
+
+  const bool automatic_enable =
+      privacy_sessions_.SetSupported(remote_id, supported);
+  if (!privacy_sessions_.CanEnable()) {
+    if (privacy_.Engaged()) privacy_.Disable();
+  } else if (automatic_enable && config_center_->IsEnablePrivacyScreen()) {
+    privacy_.EnableOnConnection();
+  }
+}
+
+void GuiRuntime::QueuePrivacyCommand(const std::string& remote_id,
+                                     const PrivacyCommand& command) {
+  std::shared_lock session_lock(connection_status_mutex_);
+  const auto found = connection_status_.find(remote_id);
+  if (found == connection_status_.end() ||
+      found->second != ConnectionStatus::Connected ||
+      !privacy_sessions_.Supports(remote_id)) return;
+  std::lock_guard lock(privacy_commands_mutex_);
+  if (privacy_commands_.size() < 32)
+    privacy_commands_.emplace_back(remote_id, command);
+}
+
+void GuiRuntime::HandlePrivacy() {
+  std::deque<std::pair<std::string, PrivacyCommand>> commands;
+  {
+    std::lock_guard lock(privacy_commands_mutex_);
+    commands.swap(privacy_commands_);
+  }
+  for (const auto& [remote_id, command] : commands) {
+    // Keep admission and activation under the connection lock so an unknown
+    // controller cannot join between the capability check and enabling.
+    std::shared_lock lock(connection_status_mutex_);
+    const auto found = connection_status_.find(remote_id);
+    if (found == connection_status_.end() ||
+        found->second != ConnectionStatus::Connected ||
+        !privacy_sessions_.Supports(remote_id)) continue;
+    if (command.flag == PrivacyCommandFlag::enable) {
+      if (privacy_sessions_.CanEnable())
+        privacy_.Enable(command.block_local_input);
+    } else if (command.flag == PrivacyCommandFlag::disable) {
+      privacy_.Disable();
+    }
+    last_privacy_status_tick_ = 0;
+  }
+  auto status = privacy_.Snapshot();
+  const uint64_t now = SDL_GetTicks();
+  if (!peer_ || (last_privacy_status_tick_ != 0 &&
+                 status.revision == last_privacy_revision_ &&
+                 now - last_privacy_status_tick_ < 1000))
+    return;
+  std::vector<std::string> controllers;
+  {
+    std::shared_lock lock(connection_status_mutex_);
+    for (const auto& [id, state] : connection_status_)
+      if (state == ConnectionStatus::Connected && privacy_sessions_.Supports(id))
+        controllers.push_back(id);
+    if (!privacy_sessions_.CanEnable()) {
+      status.state = PrivacyState::unsupported;
+      status.supported = false;
+      status.input_block_supported = false;
+      std::strcpy(status.reason,
+                  "A connected controller does not support privacy screen");
+    }
+  }
+  RemoteAction action{};
+  action.type = ControlType::privacy_status;
+  action.ps = status;
+  const auto message = action.to_json();
+  bool sent = true;
+  for (const auto& id : controllers) {
+    const int result = SendReliableDataFrameToPeer(
+        peer_, message.data(), message.size(), control_data_label_.c_str(),
+        id.data(), id.size());
+    if (result != 0) {
+      sent = false;
+      LOG_WARN("Privacy status send failed, peer={}, ret={}", id, result);
+    }
+  }
+  if (sent) {
+    last_privacy_revision_ = status.revision;
+    last_privacy_status_tick_ = now;
+  }
+}
+
+}  // namespace crossdesk

apps/desktop/src/gui/runtime/privacy_session_policy.h

@@ -0,0 +1,61 @@
+/*
+ * @Author: DI JUNKUN
+ * @Date: 2026-09-15
+ * Copyright (c) 2026 by DI JUNKUN, All Rights Reserved.
+ */
+
+#ifndef _PRIVACY_SESSION_POLICY_H_
+#define _PRIVACY_SESSION_POLICY_H_
+
+#include <algorithm>
+#include <string>
+#include <unordered_map>
+
+namespace crossdesk {
+
+// Guarded by GuiRuntime's connection_status_mutex_. Privacy covers the shared
+// desktop, so every connected controller must explicitly support it.
+class PrivacySessionPolicy {
+ public:
+  void Connected(const std::string& remote_id, bool automatic_privacy) {
+    const auto [entry, inserted] = controllers_.try_emplace(remote_id, false);
+    if (inserted && controllers_.size() == 1 && automatic_privacy) {
+      automatic_controller_ = remote_id;
+    }
+  }
+
+  void Disconnected(const std::string& remote_id) {
+    controllers_.erase(remote_id);
+    if (automatic_controller_ == remote_id) automatic_controller_.clear();
+  }
+
+  // Consume automatic activation once, on the first controller's host info.
+  // Repeated metadata or a later join must not undo an explicit privacy exit.
+  bool SetSupported(const std::string& remote_id, bool supported) {
+    const auto entry = controllers_.find(remote_id);
+    if (entry == controllers_.end()) return false;
+    entry->second = supported && remote_id.find("web") == std::string::npos;
+    if (automatic_controller_ != remote_id) return false;
+    automatic_controller_.clear();
+    return CanEnable();
+  }
+
+  bool Supports(const std::string& remote_id) const {
+    const auto entry = controllers_.find(remote_id);
+    return entry != controllers_.end() && entry->second;
+  }
+
+  bool CanEnable() const {
+    return !controllers_.empty() &&
+           std::all_of(controllers_.begin(), controllers_.end(),
+                       [](const auto& entry) { return entry.second; });
+  }
+
+ private:
+  std::unordered_map<std::string, bool> controllers_;
+  std::string automatic_controller_;
+};
+
+}  // namespace crossdesk
+
+#endif

apps/desktop/src/gui/runtime/remote_action_codec.cpp

@@ -55,6 +55,7 @@ bool Deserialize(const char *data, size_t size, RemoteAction &out) {
   out.type = static_cast<ControlType>(data[offset++]);
 
   if (out.type == ControlType::host_infomation) {
+    out.i.supports_privacy_screen = false;
     size_t name_len;
     if (!read(&name_len, sizeof(size_t)) ||
         name_len >= sizeof(out.i.host_name)) {

apps/desktop/src/gui/runtime/remote_action_codec.h

@@ -1,5 +1,11 @@
-#ifndef CROSSDESK_GUI_REMOTE_ACTION_CODEC_H_
-#define CROSSDESK_GUI_REMOTE_ACTION_CODEC_H_
+/*
+ * @Author: DI JUNKUN
+ * @Date: 2026-09-04
+ * Copyright (c) 2026 by DI JUNKUN, All Rights Reserved.
+ */
+
+#ifndef _REMOTE_ACTION_CODEC_H_
+#define _REMOTE_ACTION_CODEC_H_
 
 #include <cstddef>
 #include <vector>
@@ -14,4 +20,4 @@ void Free(RemoteAction &action);
 
 } // namespace crossdesk::remote_action_codec
 
-#endif // CROSSDESK_GUI_REMOTE_ACTION_CODEC_H_
+#endif

apps/desktop/src/gui/runtime/remote_session.h

@@ -1,3 +1,9 @@
+/*
+ * @Author: DI JUNKUN
+ * @Date: 2026-09-04
+ * Copyright (c) 2026 by DI JUNKUN, All Rights Reserved.
+ */
+
 #ifndef _REMOTE_SESSION_H_
 #define _REMOTE_SESSION_H_
 
@@ -16,8 +22,11 @@
 #include <remote_action.h>
 #include <stream_names.h>
 #include "display_info.h"
+#include "cursor_presentation.h"
 #include "minirtc.h"
 
+namespace crossdesk { class PeerEventHandler; }
+
 namespace crossdesk::gui_detail {
 
 struct FileTransferState {
@@ -61,6 +70,8 @@ struct FileTransferState {
 struct RemoteSession {
   Params params_;
   PeerPtr* peer_ = nullptr;
+  std::shared_ptr<PeerEventHandler> peer_events_;
+  std::atomic<bool> closing_{false};
   std::string audio_label_ = kAudioStream;
   std::string data_label_ = kDataStream;
   std::string mouse_label_ = kMouseStream;
@@ -147,6 +158,13 @@ struct RemoteSession {
   std::string audio_capture_button_label_ = "Audio Capture";
   std::string remote_host_name_;
   bool remote_service_status_received_ = false;
+  std::mutex privacy_status_mutex_;
+  PrivacyStatus privacy_status_{};
+  bool privacy_status_received_ = false;
+  bool privacy_command_pending_ = false;
+  uint64_t privacy_command_tick_ = 0;
+  uint32_t privacy_request_revision_ = 0;
+  uint64_t privacy_status_tick_ = 0;
   bool remote_service_available_ = false;
   std::string remote_interactive_stage_;
   std::vector<DisplayInfo> display_info_list_;
@@ -156,13 +174,14 @@ struct RemoteSession {
   std::mutex remote_cursor_state_mutex_;
   CursorState remote_cursor_state_{};
   bool remote_cursor_state_received_ = false;
+  CursorPresentation cursor_presentation_;
   // Shared by minirtc callbacks, Slint rendering and SDL audio callbacks.
   std::atomic<ConnectionStatus> connection_status_ = ConnectionStatus::Closed;
   TraversalMode traversal_mode_ = TraversalMode::UnknownMode;
   int fps_ = 0;
   int frame_count_ = 0;
   std::chrono::steady_clock::time_point last_time_;
-  XNetTrafficStats net_traffic_stats_{};
+  MiniRtcNetTrafficStats net_traffic_stats_{};
 
   using QueuedFile = FileTransferState::QueuedFile;
   using FileTransferStatus = FileTransferState::FileTransferStatus;

apps/desktop/src/gui/runtime/runtime_state.h

@@ -1,3 +1,9 @@
+/*
+ * @Author: DI JUNKUN
+ * @Date: 2026-09-04
+ * Copyright (c) 2026 by DI JUNKUN, All Rights Reserved.
+ */
+
 #ifndef _RUNTIME_STATE_H_
 #define _RUNTIME_STATE_H_
 
@@ -16,9 +22,11 @@
 #include <stream_names.h>
 
 #include "config_center.h"
+#include "common/task_queue_lock_free.h"
 #include "path_manager.h"
 #include "runtime/device_presence_cache.h"
 #include "runtime/remote_session.h"
+#include "runtime/session_lifecycle.h"
 #include "thumbnail.h"
 
 namespace crossdesk::gui_detail {
@@ -47,13 +55,15 @@ struct RecentConnectionsState {
   int recent_connection_image_height_ = 90;
   uint32_t recent_connection_image_save_time_ = 0;
   DevicePresenceCache device_presence_cache_;
-  bool need_to_send_recent_connections_ = true;
+  std::atomic<bool> need_to_send_recent_connections_{true};
+  std::chrono::steady_clock::time_point next_presence_refresh_at_{};
+  std::chrono::steady_clock::time_point last_presence_request_attempt_at_{};
 };
 
 struct PeerState {
   SignalStatus signal_status_ = SignalStatus::SignalClosed;
   std::string signal_status_str_;
-  bool signal_connected_ = false;
+  std::atomic<bool> signal_connected_{false};
   PeerPtr *peer_ = nullptr;
   PeerPtr *peer_reserved_ = nullptr;
   std::string video_primary_label_ = "primary_display";
@@ -126,10 +136,8 @@ struct UserSettingsState {
   int video_encode_format_button_value_ = 0;
   bool enable_hardware_video_codec_ = true;
   bool enable_turn_ = true;
-  bool enable_srtp_ = false;
   char signal_server_ip_[256] = "api.crossdesk.cn";
   char signal_server_port_[6] = "9099";
-  char coturn_server_port_[6] = "3478";
   bool enable_self_hosted_ = false;
   int language_button_value_last_ = 0;
   int video_quality_button_value_last_ = 0;
@@ -138,7 +146,6 @@ struct UserSettingsState {
   int video_encode_format_button_value_last_ = 0;
   bool enable_hardware_video_codec_last_ = false;
   bool enable_turn_last_ = true;
-  bool enable_srtp_last_ = false;
   bool enable_self_hosted_last_ = false;
   bool enable_autostart_ = false;
   bool enable_autostart_last_ = false;
@@ -148,7 +155,6 @@ struct UserSettingsState {
   std::string file_transfer_save_path_last_;
   char signal_server_ip_self_[256] = "";
   char signal_server_port_self_[6] = "";
-  char coturn_server_port_self_[6] = "";
   bool settings_window_pos_reset_ = true;
   bool self_hosted_server_config_window_pos_reset_ = true;
   std::string selected_current_file_path_;
@@ -178,8 +184,15 @@ struct ConnectionState {
       std::unordered_map<std::string, RemoteSessionPtr>;
   RemoteSessionMap remote_sessions_;
   std::shared_mutex remote_sessions_mutex_;
-  std::vector<std::thread> thumbnail_save_threads_;
-  std::mutex thumbnail_save_threads_mutex_;
+  TaskQueueLockFree session_cleanup_queue_;
+  std::unordered_map<std::string, std::future<void>> session_cleanup_tasks_;
+  std::future<void> connection_peer_cleanup_;
+  std::unordered_map<std::string, std::future<void>> controller_cleanup_tasks_;
+  struct PendingReconnect {
+    std::string password;
+    bool remember_password = false;
+  };
+  std::unordered_map<std::string, PendingReconnect> pending_reconnects_;
 
   std::shared_mutex connection_status_mutex_;
   std::unordered_map<std::string, ConnectionStatus> connection_status_;

apps/desktop/src/gui/runtime/session_lifecycle.cpp

@@ -0,0 +1,47 @@
+#include "runtime/session_lifecycle.h"
+
+namespace crossdesk::gui_detail {
+
+CallbackGuard::CallbackGuard(SessionCallbackGate& callbacks)
+    : callbacks_(callbacks), accepted_(callbacks.BeginCallback()) {}
+
+CallbackGuard::~CallbackGuard() {
+  if (accepted_) {
+    callbacks_.EndCallback();
+  }
+}
+
+bool SessionCallbackGate::IsActive() const {
+  std::lock_guard lock(mutex_);
+  return accepting_callbacks_;
+}
+
+CallbackGuard SessionCallbackGate::Enter() {
+  return CallbackGuard(*this);
+}
+
+bool SessionCallbackGate::BeginCallback() {
+  std::lock_guard lock(mutex_);
+  if (!accepting_callbacks_) {
+    return false;
+  }
+  ++running_callbacks_;
+  return true;
+}
+
+void SessionCallbackGate::EndCallback() {
+  std::lock_guard lock(mutex_);
+  --running_callbacks_;
+  if (running_callbacks_ == 0) {
+    callbacks_finished_.notify_all();
+  }
+}
+
+void SessionCallbackGate::Close() {
+  std::unique_lock lock(mutex_);
+  accepting_callbacks_ = false;
+  // Waiting releases the lock so running callbacks can call EndCallback().
+  callbacks_finished_.wait(lock, [this] { return running_callbacks_ == 0; });
+}
+
+}  // namespace crossdesk::gui_detail

apps/desktop/src/gui/runtime/session_lifecycle.h

@@ -0,0 +1,58 @@
+/*
+ * @Author: DI JUNKUN
+ * @Date: 2026-09-07
+ * Copyright (c) 2026 by DI JUNKUN, All Rights Reserved.
+ */
+
+#ifndef _SESSION_LIFECYCLE_H_
+#define _SESSION_LIFECYCLE_H_
+
+#include <condition_variable>
+#include <cstddef>
+#include <mutex>
+
+namespace crossdesk::gui_detail {
+
+class SessionCallbackGate;
+
+// Decrements the count on scope exit, including early returns and exceptions.
+class CallbackGuard {
+ public:
+  explicit CallbackGuard(SessionCallbackGate& callbacks);
+  ~CallbackGuard();
+
+  CallbackGuard(const CallbackGuard&) = delete;
+  CallbackGuard& operator=(const CallbackGuard&) = delete;
+
+  explicit operator bool() const { return accepted_; }
+
+ private:
+  SessionCallbackGate& callbacks_;
+  bool accepted_;
+};
+
+// Each peer counts callbacks as they enter and leave.
+// Closing rejects new callbacks, then waits for running callbacks to finish.
+class SessionCallbackGate {
+ public:
+  bool IsActive() const;
+  CallbackGuard Enter();
+
+  // Called by the session owner, never from within this session's callbacks.
+  void Close();
+
+ private:
+  friend class CallbackGuard;
+
+  bool BeginCallback();
+  void EndCallback();
+
+  mutable std::mutex mutex_;
+  std::condition_variable callbacks_finished_;
+  bool accepting_callbacks_ = true;
+  std::size_t running_callbacks_ = 0;
+};
+
+}  // namespace crossdesk::gui_detail
+
+#endif

apps/desktop/src/gui/ui/common.slint

@@ -45,6 +45,7 @@ export global FontAwesomeIcons {
     out property <string> shield-halved: "\u{f3ed}";
     out property <string> square-full: "\u{f45c}";
     out property <string> trash-can: "\u{f2ed}";
+    out property <string> user-secret: "\u{f21b}";
     out property <string> volume-high: "\u{f028}";
     out property <string> volume-xmark: "\u{f6a9}";
     out property <string> xmark: "\u{f00d}";

apps/desktop/src/gui/ui/main_window.slint

@@ -39,6 +39,8 @@ export global UiStrings {
     in-out property <string> language: "Language";
     in-out property <string> video-quality: "Video quality";
     in-out property <string> frame-rate: "Frame rate";
+    in-out property <string> capture-method: "Capture method";
+    in-out property <string> capture-method-auto: "Auto";
     in-out property <string> adaptation-policy: "Video preference";
     in-out property <string> priority-frame-rate: "Frame rate";
     in-out property <string> priority-quality: "Quality";
@@ -46,15 +48,14 @@ export global UiStrings {
     in-out property <string> codec: "Video codec";
     in-out property <string> hardware-codec: "Hardware video codec";
     in-out property <string> turn-relay: "TURN relay";
-    in-out property <string> srtp: "SRTP encryption";
     in-out property <string> self-hosted: "Self-hosted server";
     in-out property <string> autostart: "Start with system";
     in-out property <string> daemon: "Run in background";
+    in-out property <string> privacy-on-connect: "Privacy screen on connect";
     in-out property <string> file-save-path: "File save path";
     in-out property <string> default-desktop: "Desktop";
     in-out property <string> server-host: "Server host";
     in-out property <string> server-port: "Signal port";
-    in-out property <string> coturn-port: "TURN port";
     in-out property <string> version: "Version";
     in-out property <string> copyright: "© 2026 by JUNKUN DI. All right reserved.";
     in-out property <string> license: "Licensed under GNU GPL v3.";
@@ -186,6 +187,7 @@ component ConnectionDialogButton inherits Rectangle {
 
 export component MainWindow inherits Window {
     title: "CrossDesk";
+    icon: @image-url("../../../resources/linux/crossdesk_256x256.png");
     preferred-width: 640px;
     preferred-height: 450px + root.titlebar-height;
     min-width: 640px;
@@ -238,18 +240,21 @@ export component MainWindow inherits Window {
     in-out property <int> language-index: 0;
     in-out property <int> video-quality-index: 2;
     in-out property <int> frame-rate-index: 1;
+    in property <bool> capture-method-visible: false;
+    in-out property <int> capture-method-index: 0;
     in-out property <int> adaptation-policy-index: 1;
     in-out property <int> codec-index: 0;
     in-out property <bool> hardware-codec-enabled: true;
     in-out property <bool> turn-enabled: true;
-    in-out property <bool> srtp-enabled: false;
     in-out property <bool> self-hosted-enabled: false;
     in-out property <bool> autostart-enabled: false;
     in-out property <bool> daemon-enabled: false;
+    // Show the preference on every platform; only adapted hosts can change it.
+    in property <bool> privacy-setting-available: false;
+    in-out property <bool> privacy-on-connect-enabled: true;
     in-out property <string> file-save-path: "";
     in-out property <string> server-host: "";
     in-out property <string> server-port: "";
-    in-out property <string> coturn-port: "";
     in property <bool> settings-session-active: false;
     // Keep the setting visible on every platform. Unsupported builds expose it
     // as disabled so the fixed settings layout never turns into a blank row.
@@ -1446,6 +1451,11 @@ export component MainWindow inherits Window {
                         Text { x: 8px; y: 3px; width: root.compact-language ? 94px : 162px; height: 24px; text: UiStrings.language; font-size: ImGuiFontStyle.body; overflow: elide; vertical-alignment: center; }
                         CompactComboBox { x: root.compact-language ? 106px : 174px; y: 2px; model: ["中文", "English", "Русский"]; current-index <=> root.language-index; }
                     }
+                    if root.capture-method-visible: Rectangle {
+                        height: 30px;
+                        Text { x: 8px; y: 3px; width: root.compact-language ? 94px : 162px; height: 24px; text: UiStrings.capture-method; font-size: ImGuiFontStyle.body; overflow: elide; vertical-alignment: center; }
+                        CompactComboBox { x: root.compact-language ? 106px : 174px; y: 2px; enabled: !root.settings-session-active; model: [UiStrings.capture-method-auto, "DXGI", "WGC", "GDI"]; current-index <=> root.capture-method-index; }
+                    }
                     Rectangle {
                         height: 30px;
                         Text { x: 8px; y: 3px; width: root.compact-language ? 94px : 162px; height: 24px; text: UiStrings.video-quality; font-size: ImGuiFontStyle.body; overflow: elide; vertical-alignment: center; }
@@ -1478,8 +1488,8 @@ export component MainWindow inherits Window {
                     }
                     Rectangle {
                         height: 30px;
-                        Text { x: 8px; y: 3px; width: root.compact-language ? 145px : 212px; height: 24px; text: UiStrings.srtp; font-size: ImGuiFontStyle.body; overflow: elide; vertical-alignment: center; }
-                        ImGuiCheckBox { x: root.compact-language ? 157px : 224px; y: 3px; checked <=> root.srtp-enabled; enabled: !root.settings-session-active; }
+                        Text { x: 8px; y: 3px; width: root.compact-language ? 145px : 212px; height: 24px; text: UiStrings.privacy-on-connect; color: root.privacy-setting-available ? #202124 : #8b8f95; font-size: ImGuiFontStyle.body; overflow: elide; vertical-alignment: center; }
+                        ImGuiCheckBox { x: root.compact-language ? 157px : 224px; y: 3px; checked <=> root.privacy-on-connect-enabled; enabled: root.privacy-setting-available; }
                     }
                     Rectangle {
                         height: 30px;
@@ -1518,7 +1528,7 @@ export component MainWindow inherits Window {
             x: root.compact-language ? 190px : 140px;
             y: 105px;
             width: root.compact-language ? 260px : 360px;
-            height: 168px;
+            height: 138px;
             border-radius: 7px;
 
             Rectangle {
@@ -1558,21 +1568,8 @@ export component MainWindow inherits Window {
                 LineEdit { x: 1px; y: 1.5px; width: parent.width - 2px; height: parent.height - 2px; text <=> root.server-port; input-type: InputType.number; font-size: ImGuiFontStyle.body; }
                 LineEditFocusUnderlineMask { x: 5px; y: parent.height - 3px; width: parent.width - 10px; }
             }
-            Text { x: 8px; y: 91px; width: root.compact-language ? 88px : 165px; height: 24px; text: UiStrings.coturn-port; font-size: ImGuiFontStyle.body; overflow: elide; vertical-alignment: center; }
-            Rectangle {
-                x: root.compact-language ? 100px : 173px;
-                y: 90px;
-                width: root.compact-language ? 152px : 179px;
-                height: 24px;
-                background: white;
-                border-width: 1px;
-                border-color: ImGuiLineStyle.border;
-                border-radius: 4px;
-                LineEdit { x: 1px; y: 1.5px; width: parent.width - 2px; height: parent.height - 2px; text <=> root.coturn-port; input-type: InputType.number; font-size: ImGuiFontStyle.body; }
-                LineEditFocusUnderlineMask { x: 5px; y: parent.height - 3px; width: parent.width - 10px; }
-            }
-            CompactButton { x: root.compact-language ? 93px : 135px; y: 130px; primary: true; text: UiStrings.ok; clicked => { root.save-self-hosted-settings(); root.self-host-settings-open = false; } }
-            CompactButton { x: root.compact-language ? 134px : 176px; y: 130px; width: root.compact-language ? 34px : 56px; text: UiStrings.cancel; clicked => { root.cancel-self-hosted-settings(); root.self-host-settings-open = false; } }
+            CompactButton { x: root.compact-language ? 93px : 135px; y: 100px; primary: true; text: UiStrings.ok; clicked => { root.save-self-hosted-settings(); root.self-host-settings-open = false; } }
+            CompactButton { x: root.compact-language ? 134px : 176px; y: 100px; width: root.compact-language ? 34px : 56px; text: UiStrings.cancel; clicked => { root.cancel-self-hosted-settings(); root.self-host-settings-open = false; } }
         }
     }
 

apps/desktop/src/gui/ui/server_window.slint

@@ -7,6 +7,7 @@ export struct ControllerEntry {
 
 export component ServerWindow inherits Window {
     title: "CrossDesk";
+    icon: @image-url("../../../resources/linux/crossdesk_256x256.png");
     preferred-width: root.language-index == 0 ? 250px : root.language-index == 1 ? 330px : 430px;
     preferred-height: 150px;
     min-width: root.language-index == 0 ? 250px : root.language-index == 1 ? 330px : 430px;

apps/desktop/src/gui/ui/stream_window.slint

@@ -25,6 +25,8 @@ export struct NetworkStatsRow {
 export global StreamStrings {
     in-out property <string> select-display: "Select Display";
     in-out property <string> send-shortcut: "Send Shortcut";
+    in-out property <string> privacy-enable: "Enable privacy screen";
+    in-out property <string> privacy-disable: "Turn privacy off / recover";
     in-out property <string> control-mouse: "Control Mouse";
     in-out property <string> release-mouse: "Release Mouse";
     in-out property <string> audio: "Audio Capture";
@@ -43,6 +45,14 @@ export global StreamStrings {
     in-out property <string> stats-loss-rate: "Loss Rate";
     in-out property <string> stats-resolution: "Res";
     in-out property <string> stats-connection-mode: "Mode";
+    in-out property <string> stats-encryption: "Encryption";
+    in-out property <string> stats-encryption-enabled: "Enabled";
+    in-out property <string> stats-encryption-disabled: "Disabled";
+}
+
+struct ControlBarTooltip {
+    text: string,
+    anchor-x: length,
 }
 
 // The legacy ImGui control bar uses 24px buttons with Font Awesome rendered
@@ -54,19 +64,27 @@ component ControlBarButton inherits Rectangle {
     in property <string> tooltip: "";
     in property <bool> selected: false;
     in property <bool> slashed: false;
+    in property <bool> action-enabled: true;
+    // Capability and temporary command availability have different visuals.
+    in property <bool> muted: false;
     in property <length> icon-size: 16px;
+    out property <bool> has-hover: touch.has-hover;
+    out property <ControlBarTooltip> tooltip-info: {
+        text: root.visible && touch.has-hover && !touch.pressed ? root.tooltip : "",
+        anchor-x: root.x + root.width / 2,
+    };
     callback clicked;
 
     width: 24px;
     height: 24px;
-    background: touch.pressed ? #0f87fa
+    background: root.muted ? #eef0f3 : touch.pressed && root.action-enabled ? #0f87fa
                               : touch.has-hover ? #4296fa
                                                 : root.selected ? #4296fa : #4296fa66;
     border-radius: 3px;
 
     Text {
         text: root.icon;
-        color: #24272d;
+        color: root.muted ? #8a8f96 : #24272d;
         font-family: "Font Awesome 6 Free";
         font-weight: 900;
         font-size: root.icon-size;
@@ -105,12 +123,14 @@ component ControlBarButton inherits Rectangle {
     }
 
     touch := TouchArea {
-        clicked => { root.clicked(); }
+        // Keep disabled controls hit-testable so clicks cannot reach the peer.
+        clicked => { if root.action-enabled { root.clicked(); } }
     }
 }
 
 export component StreamWindow inherits Window {
     title: "CrossDesk";
+    icon: @image-url("../../../resources/linux/crossdesk_256x256.png");
     preferred-width: 1280px;
     preferred-height: 720px + (root.custom-titlebar ? 32px : 0px);
     min-width: 640px;
@@ -133,17 +153,23 @@ export component StreamWindow inherits Window {
     in property <[string]> displays;
     in-out property <int> selected-display: 0;
     in property <bool> mouse-control-enabled: true;
+    in property <bool> privacy-can-toggle: false;
+    in property <bool> privacy-active: false;
+    in property <bool> privacy-off: false;
+    in property <bool> privacy-unsupported: false;
+    // Privacy feedback stays on its toolbar button and hover tooltip.
+    in property <string> privacy-status-text: "Privacy screen";
     // Numeric values mirror crossdesk::RemoteCursorShape and Slint's MouseCursor.
     in property <bool> remote-cursor-active: false;
     in property <int> remote-cursor-shape: 0;
     in property <bool> audio-enabled: true;
-    in property <bool> srtp-enabled: false;
     in property <bool> fullscreen-enabled: false;
     in property <bool> stats-visible: false;
     in property <[NetworkStatsRow]> stats-rows;
     in property <string> stats-fps: "0";
     in property <string> stats-resolution: "";
     in property <string> stats-connection-mode: "";
+    in property <bool> stats-encryption-enabled: false;
     in property <bool> file-transfer-visible: false;
     in property <[FileTransferEntry]> file-transfers;
 
@@ -153,6 +179,7 @@ export component StreamWindow inherits Window {
     callback switch-display(int);
     callback send-shortcut(string);
     callback toggle-mouse-control;
+    callback toggle-privacy;
     callback toggle-audio;
     callback select-file;
     callback close-file-transfer;
@@ -171,10 +198,35 @@ export component StreamWindow inherits Window {
     callback keyboard-focus-changed(bool);
 
     private property <bool> control-expanded: true;
+    private property <length> control-toolbar-height: 38px;
+    private property <length> control-button-step: 32px;
+    private property <length> stats-row-height: 18px;
+    private property <length> stats-header-height: 18px;
+    private property <length> stats-content-height:
+        root.stats-header-height + root.stats-rows.length * root.stats-row-height + 44px;
     private property <bool> display-menu-open: false;
     private property <bool> display-menu-animation-enabled: false;
     private property <float> display-menu-progress: 0.0;
     private property <bool> shortcut-menu-open: false;
+    private property <bool> control-tooltip-visible: false;
+    private property <ControlBarTooltip> hovered-control: {
+        if root.window-active && !root.control-dragging
+            && !root.display-menu-open && !root.shortcut-menu-open {
+            if collapse-button.has-hover { return collapse-button.tooltip-info; }
+            if root.control-expanded {
+                if display-button.has-hover { return display-button.tooltip-info; }
+                if shortcut-button.has-hover { return shortcut-button.tooltip-info; }
+                if mouse-button.has-hover { return mouse-button.tooltip-info; }
+                if privacy-button.has-hover { return privacy-button.tooltip-info; }
+                if audio-button.has-hover { return audio-button.tooltip-info; }
+                if file-button.has-hover { return file-button.tooltip-info; }
+                if stats-button.has-hover { return stats-button.tooltip-info; }
+                if fullscreen-button.has-hover { return fullscreen-button.tooltip-info; }
+                if close-button.has-hover { return close-button.tooltip-info; }
+            }
+        }
+        return { text: "", anchor-x: 0px };
+    }
     // A popup can remove itself from the scene in its clicked callback before
     // the video input layer observes the same pointer release. Remember that
     // the press belonged to local UI so that release cannot reach the peer.
@@ -214,6 +266,20 @@ export component StreamWindow inherits Window {
         }
     }
 
+    changed hovered-control => {
+        root.control-tooltip-visible = false;
+        control-tooltip-timer.running = root.hovered-control.text != "";
+        if root.hovered-control.text != "" { control-tooltip-timer.restart(); }
+    }
+    control-tooltip-timer := Timer {
+        interval: 450ms;
+        running: false;
+        triggered => {
+            self.running = false;
+            root.control-tooltip-visible = true;
+        }
+    }
+
     is-local-control-area(pointer-x, pointer-y) => {
         let over-control = pointer-x >= control.x
             && pointer-x <= control.x + control.width
@@ -227,11 +293,11 @@ export component StreamWindow inherits Window {
             && pointer-x <= display-menu-x + 180px
             && pointer-y >= display-menu-y
             && pointer-y <= display-menu-y + display-menu-height;
-        let shortcut-menu-x = control.x + (root.control-docked-left ? 41px : 74px);
+        let shortcut-menu-x = control.x + shortcut-button.x;
         let shortcut-menu-y = control.y + 40px;
         let over-shortcut-menu = root.shortcut-menu-open
             && pointer-x >= shortcut-menu-x
-            && pointer-x <= shortcut-menu-x + 150px
+            && pointer-x <= shortcut-menu-x + 180px
             && pointer-y >= shortcut-menu-y
             && pointer-y <= shortcut-menu-y + 68px;
         return over-control || over-display-menu || over-shortcut-menu;
@@ -449,20 +515,8 @@ export component StreamWindow inherits Window {
                         width: parent.width - 27px;
                         height: parent.height;
                         background: transparent;
-                        if root.srtp-enabled: Text {
-                            x: 0px;
-                            width: 12px;
-                            height: parent.height;
-                            text: FontAwesomeIcons.shield-halved;
-                            color: #30343b;
-                            font-family: "Font Awesome 6 Free";
-                            font-weight: 900;
-                            font-size: ImGuiFontStyle.base;
-                            horizontal-alignment: center;
-                            vertical-alignment: center;
-                        }
                         Text {
-                            x: root.srtp-enabled ? 16px : 0px;
+                            x: 0px;
                             width: parent.width - self.x;
                             height: parent.height;
                             text: tab.title;
@@ -638,8 +692,10 @@ export component StreamWindow inherits Window {
             control := Rectangle {
                 x: root.control-dragging ? root.control-drag-x : root.control-docked-left ? 0px : parent.width - self.width;
                 y: min(max(0px, root.control-pos-y), parent.height - self.height);
-                width: root.control-expanded ? min(300px, parent.width) : 20px;
-                height: root.stats-visible && root.control-expanded ? min(180px, parent.height) : 38px;
+                width: root.control-expanded ? min(76px + 8 * root.control-button-step, parent.width) : 20px;
+                height: root.stats-visible && root.control-expanded
+                    ? min(root.control-toolbar-height + root.stats-content-height + 8px, parent.height)
+                    : root.control-toolbar-height;
                 background: white;
                 border-width: 1px;
                 border-color: ImGuiLineStyle.border;
@@ -656,7 +712,8 @@ export component StreamWindow inherits Window {
                     background: ImGuiLineStyle.control-separator;
                 }
 
-                if root.control-expanded: display-button := ControlBarButton {
+                display-button := ControlBarButton {
+                    visible: root.control-expanded;
                     x: root.control-docked-left ? 9px : 42px; y: 7px;
                     icon: FontAwesomeIcons.display;
                     badge: root.selected-display + 1;
@@ -672,8 +729,9 @@ export component StreamWindow inherits Window {
                         }
                     }
                 }
-                if root.control-expanded: shortcut-button := ControlBarButton {
-                    x: root.control-docked-left ? 41px : 74px; y: 7px;
+                shortcut-button := ControlBarButton {
+                    visible: root.control-expanded;
+                    x: (root.control-docked-left ? 9px : 42px) + root.control-button-step; y: 7px;
                     icon: FontAwesomeIcons.keyboard; tooltip: StreamStrings.send-shortcut;
                     clicked => {
                         display-menu-open-timer.running = false;
@@ -683,47 +741,53 @@ export component StreamWindow inherits Window {
                         root.display-menu-open = false;
                     }
                 }
-                if root.control-expanded: mouse-button := ControlBarButton {
-                    x: root.control-docked-left ? 73px : 106px; y: 7px;
+                mouse-button := ControlBarButton {
+                    visible: root.control-expanded;
+                    x: (root.control-docked-left ? 9px : 42px) + 2 * root.control-button-step; y: 7px;
                     icon: FontAwesomeIcons.computer-mouse; slashed: !root.mouse-control-enabled;
                     tooltip: root.mouse-control-enabled ? StreamStrings.release-mouse : StreamStrings.control-mouse;
                     clicked => { root.toggle-mouse-control(); }
                 }
-                if root.control-expanded: audio-button := ControlBarButton {
-                    x: root.control-docked-left ? 105px : 138px; y: 7px;
+                audio-button := ControlBarButton {
+                    visible: root.control-expanded;
+                    x: (root.control-docked-left ? 9px : 42px) + 4 * root.control-button-step; y: 7px;
                     icon: FontAwesomeIcons.volume-high; slashed: !root.audio-enabled;
                     tooltip: root.audio-enabled ? StreamStrings.mute : StreamStrings.audio;
                     clicked => { root.toggle-audio(); }
                 }
-                if root.control-expanded: file-button := ControlBarButton {
-                    x: root.control-docked-left ? 137px : 170px; y: 7px;
+                file-button := ControlBarButton {
+                    visible: root.control-expanded;
+                    x: (root.control-docked-left ? 9px : 42px) + 5 * root.control-button-step; y: 7px;
                     icon: FontAwesomeIcons.folder-open; tooltip: StreamStrings.select-file;
                     clicked => { root.select-file(); }
                 }
-                if root.control-expanded: stats-button := ControlBarButton {
-                    x: root.control-docked-left ? 169px : 202px; y: 7px;
+                stats-button := ControlBarButton {
+                    visible: root.control-expanded;
+                    x: (root.control-docked-left ? 9px : 42px) + 6 * root.control-button-step; y: 7px;
                     icon: FontAwesomeIcons.signal; selected: root.stats-visible;
                     tooltip: root.stats-visible ? StreamStrings.hide-stats : StreamStrings.show-stats;
                     clicked => { root.toggle-stats(); }
                 }
-                if root.control-expanded: fullscreen-button := ControlBarButton {
-                    x: root.control-docked-left ? 201px : 234px; y: 7px;
+                fullscreen-button := ControlBarButton {
+                    visible: root.control-expanded;
+                    x: (root.control-docked-left ? 9px : 42px) + 7 * root.control-button-step; y: 7px;
                     icon: root.fullscreen-enabled ? FontAwesomeIcons.compress : FontAwesomeIcons.expand;
                     tooltip: root.fullscreen-enabled ? StreamStrings.exit-fullscreen : StreamStrings.fullscreen;
                     clicked => { root.toggle-fullscreen(); }
                 }
-                if root.control-expanded: close-button := ControlBarButton {
-                    x: root.control-docked-left ? 233px : 266px; y: 7px;
+                close-button := ControlBarButton {
+                    visible: root.control-expanded;
+                    x: (root.control-docked-left ? 9px : 42px) + 8 * root.control-button-step; y: 7px;
                     icon: FontAwesomeIcons.xmark; tooltip: StreamStrings.disconnect;
                     clicked => { root.disconnect(); }
                 }
 
                 if root.control-expanded && root.control-docked-left: Rectangle {
-                    x: 267px; y: 12px; width: 2px; height: 15px;
+                    x: parent.width - 33px; y: 12px; width: 2px; height: 15px;
                     background: ImGuiLineStyle.control-separator;
                 }
                 collapse-button := ControlBarButton {
-                    x: root.control-expanded ? (root.control-docked-left ? 275px : 10px) : 2px;
+                    x: root.control-expanded ? (root.control-docked-left ? parent.width - 25px : 10px) : 2px;
                     y: 7px;
                     width: 15px;
                     icon: root.control-expanded
@@ -733,76 +797,124 @@ export component StreamWindow inherits Window {
                     clicked => { root.control-expanded = !root.control-expanded; }
                 }
 
+                privacy-button := ControlBarButton {
+                    visible: root.control-expanded;
+                    x: (root.control-docked-left ? 9px : 42px) + 3 * root.control-button-step; y: 7px;
+                    icon: FontAwesomeIcons.user-secret;
+                    slashed: root.privacy-off && !root.privacy-unsupported;
+                    muted: root.privacy-unsupported;
+                    action-enabled: root.privacy-can-toggle;
+                    tooltip: root.privacy-status-text
+                        + (root.privacy-can-toggle ? "\n" + (root.privacy-active
+                            ? StreamStrings.privacy-disable : StreamStrings.privacy-enable) : "");
+                    clicked => { root.toggle-privacy(); }
+                }
+
                 if root.stats-visible && root.control-expanded: stats-table := Rectangle {
-                    x: 14px;
-                    y: 38px;
-                    width: parent.width - 28px;
-                    height: 128px;
+                    x: 8px;
+                    y: root.control-toolbar-height + 2px;
+                    width: parent.width - 16px;
+                    height: root.stats-content-height;
                     background: transparent;
-                    private property <length> row-height: 16px;
-                    private property <length> label-column-width: 60px;
-                    private property <length> loss-column-width: 66px;
+                    private property <length> row-height: root.stats-row-height;
+                    private property <length> label-column-width: 50px;
+                    private property <length> loss-column-width:
+                        max((self.width - self.label-column-width) / 3,
+                            stats-loss-label.preferred-width + 8px);
                     private property <length> value-column-width:
                         (self.width - self.label-column-width - self.loss-column-width) / 2;
+                    private property <length> details-right-width:
+                        right-label-width-probe.preferred-width + 6px
+                            + max(resolution-width-probe.preferred-width,
+                                encryption-width-probe.preferred-width
+                                    + (root.stats-encryption-enabled ? 14px : 0px));
+                    private property <length> details-right-x: self.width / 2;
 
-                    Rectangle {
-                        y: 0px;
-                        height: 1px;
-                        background: ImGuiLineStyle.border;
+                    left-label-width-probe := Text {
+                        visible: false;
+                        text: "FPS\n" + StreamStrings.stats-connection-mode;
+                        font-size: ImGuiFontStyle.small;
+                    }
+                    right-label-width-probe := Text {
+                        visible: false;
+                        text: StreamStrings.stats-resolution + "\n" + StreamStrings.stats-encryption;
+                        font-size: ImGuiFontStyle.small;
+                    }
+                    resolution-width-probe := Text {
+                        visible: false;
+                        text: root.stats-resolution;
+                        font-size: ImGuiFontStyle.body;
+                        font-weight: 600;
+                    }
+                    encryption-width-probe := Text {
+                        visible: false;
+                        text: root.stats-encryption-enabled
+                            ? StreamStrings.stats-encryption-enabled : StreamStrings.stats-encryption-disabled;
+                        font-size: ImGuiFontStyle.body;
+                        font-weight: 600;
                     }
 
                     Rectangle {
+                        x: 0px;
                         y: 0px;
-                        height: stats-table.row-height;
+                        width: parent.width;
+                        height: root.stats-header-height;
+                        background: #f3f5f8;
+                        border-radius: 4px;
                         Text {
                             x: stats-table.label-column-width + 4px;
                             width: stats-table.value-column-width - 8px;
                             text: StreamStrings.stats-in;
-                            color: #30343b;
+                            color: #667085;
                             font-size: ImGuiFontStyle.small;
+                            horizontal-alignment: right;
                             vertical-alignment: center;
                         }
                         Text {
                             x: stats-table.label-column-width + stats-table.value-column-width + 4px;
                             width: stats-table.value-column-width - 8px;
                             text: StreamStrings.stats-out;
-                            color: #30343b;
+                            color: #667085;
                             font-size: ImGuiFontStyle.small;
+                            horizontal-alignment: right;
                             vertical-alignment: center;
                         }
-                        Text {
+                        stats-loss-label := Text {
                             x: stats-table.label-column-width + stats-table.value-column-width * 2 + 4px;
                             width: stats-table.loss-column-width - 8px;
                             text: StreamStrings.stats-loss-rate;
-                            color: #30343b;
+                            color: #667085;
                             font-size: ImGuiFontStyle.small;
+                            horizontal-alignment: right;
                             vertical-alignment: center;
                             overflow: elide;
                         }
-                        Rectangle {
-                            y: parent.height - 1px;
-                            height: 1px;
-                            background: ImGuiLineStyle.border;
-                        }
                     }
 
                     for row[index] in root.stats-rows: Rectangle {
-                        y: (index + 1) * stats-table.row-height;
+                        x: 0px;
+                        y: root.stats-header-height + index * stats-table.row-height;
+                        width: parent.width;
                         height: stats-table.row-height;
+                        background: index == root.stats-rows.length - 1 ? #edf3fc : transparent;
+                        border-radius: 4px;
                         Text {
                             x: 4px;
                             width: stats-table.label-column-width - 8px;
                             text: row.label;
-                            color: #30343b;
-                            font-size: ImGuiFontStyle.small;
+                            color: #475467;
+                            font-size: ImGuiFontStyle.body;
+                            font-weight: index == root.stats-rows.length - 1 ? 600 : 400;
                             vertical-alignment: center;
                         }
                         Text {
                             x: stats-table.label-column-width + 4px;
                             width: stats-table.value-column-width - 8px;
                             text: row.inbound;
-                            color: #30343b;
-                            font-size: ImGuiFontStyle.small;
+                            color: #253247;
+                            font-size: ImGuiFontStyle.body;
+                            font-weight: index == root.stats-rows.length - 1 ? 600 : 400;
+                            horizontal-alignment: right;
                             vertical-alignment: center;
                             overflow: elide;
                         }
@@ -810,8 +922,10 @@ export component StreamWindow inherits Window {
                             x: stats-table.label-column-width + stats-table.value-column-width + 4px;
                             width: stats-table.value-column-width - 8px;
                             text: row.outbound;
-                            color: #30343b;
-                            font-size: ImGuiFontStyle.small;
+                            color: #253247;
+                            font-size: ImGuiFontStyle.body;
+                            font-weight: index == root.stats-rows.length - 1 ? 600 : 400;
+                            horizontal-alignment: right;
                             vertical-alignment: center;
                             overflow: elide;
                         }
@@ -819,46 +933,73 @@ export component StreamWindow inherits Window {
                             x: stats-table.label-column-width + stats-table.value-column-width * 2 + 4px;
                             width: stats-table.loss-column-width - 8px;
                             text: row.loss-rate;
-                            color: #30343b;
-                            font-size: ImGuiFontStyle.small;
+                            color: #475467;
+                            font-size: ImGuiFontStyle.body;
+                            font-weight: index == root.stats-rows.length - 1 ? 600 : 400;
+                            horizontal-alignment: right;
                             vertical-alignment: center;
                             overflow: elide;
                         }
-                        Rectangle {
+                        if index < root.stats-rows.length - 2: Rectangle {
+                            x: 4px;
                             y: parent.height - 1px;
+                            width: parent.width - 8px;
                             height: 1px;
-                            background: ImGuiLineStyle.border;
+                            background: #edf0f4;
                         }
                     }
 
                     for metric[index] in [
-                        { label: "FPS:", value: root.stats-fps },
-                        { label: StreamStrings.stats-resolution + ":", value: root.stats-resolution },
-                        { label: StreamStrings.stats-connection-mode + ":", value: root.stats-connection-mode },
+                        { label: "FPS", value: root.stats-fps },
+                        { label: StreamStrings.stats-resolution, value: root.stats-resolution },
+                        { label: StreamStrings.stats-connection-mode, value: root.stats-connection-mode },
+                        { label: StreamStrings.stats-encryption, value: root.stats-encryption-enabled
+                            ? StreamStrings.stats-encryption-enabled : StreamStrings.stats-encryption-disabled },
                     ]: Rectangle {
-                        y: (index + 5) * stats-table.row-height;
-                        height: stats-table.row-height;
-                        Text {
-                            x: 4px;
-                            width: stats-table.label-column-width - 8px;
+                        private property <length> encryption-icon-width:
+                            index == 3 && root.stats-encryption-enabled ? 14px : 0px;
+                        x: mod(index, 2) == 1 ? stats-table.details-right-x : 6px;
+                        y: root.stats-header-height + root.stats-rows.length * stats-table.row-height
+                            + 2px + floor(index / 2) * 21px;
+                        width: mod(index, 2) == 1 ? stats-table.details-right-width
+                            : stats-table.details-right-x - 14px;
+                        height: 21px;
+                        metric-label := Text {
+                            x: 0px;
+                            y: 0px;
+                            width: mod(index, 2) == 1 ? right-label-width-probe.preferred-width
+                                : left-label-width-probe.preferred-width;
+                            height: parent.height;
                             text: metric.label;
-                            color: #30343b;
+                            color: #667085;
                             font-size: ImGuiFontStyle.small;
                             vertical-alignment: center;
                         }
-                        Text {
-                            x: stats-table.label-column-width + 4px;
-                            width: stats-table.value-column-width - 8px;
+                        metric-value := Text {
+                            x: metric-label.width + 6px;
+                            y: 0px;
+                            height: parent.height;
+                            width: parent.width - self.x - parent.encryption-icon-width;
                             text: metric.value;
-                            color: #30343b;
-                            font-size: ImGuiFontStyle.small;
+                            color: index == 3 && root.stats-encryption-enabled ? #18794e : #253247;
+                            font-size: ImGuiFontStyle.body;
+                            font-weight: 600;
+                            horizontal-alignment: left;
                             vertical-alignment: center;
                             overflow: elide;
                         }
-                        Rectangle {
-                            y: parent.height - 1px;
-                            height: 1px;
-                            background: ImGuiLineStyle.border;
+                        if index == 3 && root.stats-encryption-enabled: Text {
+                            x: metric-value.x + min(metric-value.preferred-width, metric-value.width) + 4px;
+                            y: metric-value.y + (metric-value.height - self.height) / 2;
+                            width: 10px;
+                            height: 12px;
+                            text: FontAwesomeIcons.shield-halved;
+                            font-family: "Font Awesome 6 Free";
+                            font-weight: 900;
+                            font-size: 10px;
+                            color: #238653;
+                            horizontal-alignment: center;
+                            vertical-alignment: center;
                         }
                     }
                 }
@@ -942,7 +1083,7 @@ export component StreamWindow inherits Window {
             }
 
             if root.shortcut-menu-open: Rectangle {
-                x: control.x + (root.control-docked-left ? 41px : 74px); y: control.y + 40px; width: 150px; height: 68px;
+                x: control.x + shortcut-button.x; y: control.y + 40px; width: 180px; height: 68px;
                 background: white; border-width: 1px; border-color: ImGuiLineStyle.border; border-radius: 5px; z: 11;
                 VerticalLayout {
                     padding: 4px; spacing: 1px;
@@ -961,6 +1102,30 @@ export component StreamWindow inherits Window {
                 }
             }
 
+            // Measure unwrapped text so short hints stay compact. Render outside
+            // the clipped control bar, capping longer hints before wrapping.
+            control-tooltip-width-probe := Text {
+                visible: false;
+                text: root.hovered-control.text;
+                font-size: ImGuiFontStyle.body;
+            }
+            if root.hovered-control.text != "" && root.control-tooltip-visible: Rectangle {
+                width: min(240px, video.width - 8px,
+                    control-tooltip-width-probe.preferred-width + 16px);
+                x: min(max(4px, control.x + root.hovered-control.anchor-x - self.width / 2),
+                    video.width - self.width - 4px);
+                height: control-tip.preferred-height + 12px;
+                // Anchor to the button row so expanded stats stay beneath the tooltip.
+                y: control.y + root.control-toolbar-height + self.height + 8px <= video.height
+                    ? control.y + root.control-toolbar-height + 4px : max(4px, control.y - self.height - 4px);
+                background: #30343bf5; border-radius: 5px; z: 12;
+                control-tip := Text {
+                    x: 8px; y: 6px; width: parent.width - 16px;
+                    text: root.hovered-control.text;
+                    color: white; font-size: ImGuiFontStyle.body; wrap: word-wrap;
+                }
+            }
+
             // Transfer progress overlay at bottom-left.
             if root.file-transfer-visible: Rectangle {
                 x: 18px; y: parent.height - min(210px, parent.height * 0.35); width: min(430px, parent.width * 0.6); height: min(190px, parent.height * 0.32);

apps/desktop/src/gui/ui/ui_localization.h

@@ -1,5 +1,11 @@
-#ifndef CROSSDESK_GUI_UI_UI_LOCALIZATION_H_
-#define CROSSDESK_GUI_UI_UI_LOCALIZATION_H_
+/*
+ * @Author: DI JUNKUN
+ * @Date: 2026-09-04
+ * Copyright (c) 2026 by DI JUNKUN, All Rights Reserved.
+ */
+
+#ifndef _UI_LOCALIZATION_H_
+#define _UI_LOCALIZATION_H_
 
 #include <slint.h>
 
@@ -48,6 +54,9 @@ inline int ApplyMainWindowStrings(
   strings.set_language(Text(localization::language[language]));
   strings.set_video_quality(Text(localization::video_quality[language]));
   strings.set_frame_rate(Text(localization::video_frame_rate[language]));
+  strings.set_capture_method(Text(localization::screen_capture_method[language]));
+  strings.set_capture_method_auto(
+      Text(localization::screen_capture_method_auto[language]));
   strings.set_adaptation_policy(
       Text(localization::video_adaptation_policy[language]));
   strings.set_priority_frame_rate(
@@ -60,11 +69,11 @@ inline int ApplyMainWindowStrings(
   strings.set_hardware_codec(
       Text(localization::enable_hardware_video_codec[language]));
   strings.set_turn_relay(Text(localization::enable_turn[language]));
-  strings.set_srtp(Text(localization::enable_srtp[language]));
   strings.set_self_hosted(
       Text(localization::self_hosted_server_config[language]));
   strings.set_autostart(Text(localization::enable_autostart[language]));
   strings.set_daemon(Text(localization::enable_daemon[language]));
+  strings.set_privacy_on_connect(Text(localization::privacy_on_connect[language]));
   strings.set_file_save_path(
       Text(localization::file_transfer_save_path[language]));
   strings.set_default_desktop(Text(localization::default_desktop[language]));
@@ -72,8 +81,6 @@ inline int ApplyMainWindowStrings(
       Text(localization::self_hosted_server_address[language]));
   strings.set_server_port(
       Text(localization::self_hosted_server_port[language]));
-  strings.set_coturn_port(
-      Text(localization::self_hosted_server_coturn_server_port[language]));
   strings.set_version(Text(localization::version[language]));
   strings.set_signal_connected(Text(localization::signal_connected[language]));
   strings.set_signal_disconnected(
@@ -134,6 +141,8 @@ inline int ApplyStreamWindowStrings(
   auto& strings = window->template global<ui::StreamStrings>();
   strings.set_select_display(Text(localization::select_display[language]));
   strings.set_send_shortcut(Text(localization::send_shortcut[language]));
+  strings.set_privacy_enable(Text(localization::privacy_enable[language]));
+  strings.set_privacy_disable(Text(localization::privacy_disable[language]));
   strings.set_control_mouse(Text(localization::control_mouse[language]));
   strings.set_release_mouse(Text(localization::release_mouse[language]));
   strings.set_audio(Text(localization::audio_capture[language]));
@@ -157,9 +166,16 @@ inline int ApplyStreamWindowStrings(
   strings.set_stats_resolution(Text(localization::resolution[language]));
   strings.set_stats_connection_mode(
       Text(localization::connection_mode[language]));
+  strings.set_stats_encryption(
+      Text(localization::transport_encryption[language]));
+  strings.set_stats_encryption_enabled(
+      Text(localization::transport_encryption_enabled[language]));
+  strings.set_stats_encryption_disabled(
+      Text(localization::transport_encryption_disabled[language]));
   return language;
 }
 
 }  // namespace crossdesk::ui_localization
 
-#endif  // CROSSDESK_GUI_UI_UI_LOCALIZATION_H_
+
+#endif

apps/desktop/src/gui/views/windows/main_settings_window.cpp

@@ -268,25 +268,6 @@ int GuiApplication::SettingWindow() {
 
       ImGui::Separator();
 
-      {
-        settings_items_offset += settings_items_padding;
-        ImGui::SetCursorPosY(settings_items_offset);
-        ImGui::AlignTextToFramePadding();
-        ImGui::Text(
-            "%s",
-            localization::enable_srtp[localization_language_index_].c_str());
-        ImGui::SameLine();
-        if (ConfigCenter::LANGUAGE::CHINESE == localization_language_) {
-          ImGui::SetCursorPosX(title_bar_button_width_ * 4.275f);
-        } else {
-          ImGui::SetCursorPosX(title_bar_button_width_ * 5.955f);
-        }
-
-        ImGui::Checkbox("##enable_srtp", &enable_srtp_);
-      }
-
-      ImGui::Separator();
-
       {
         settings_items_offset += settings_items_padding;
         ImGui::SetCursorPosY(settings_items_offset + 1);
@@ -569,14 +550,6 @@ int GuiApplication::SettingWindow() {
         }
         enable_turn_last_ = enable_turn_;
 
-        // SRTP
-        if (enable_srtp_) {
-          config_center_->SetSrtp(true);
-        } else {
-          config_center_->SetSrtp(false);
-        }
-        enable_srtp_last_ = enable_srtp_;
-
         if (enable_self_hosted_) {
           config_center_->SetSelfHosted(true);
         } else {

apps/desktop/src/gui/views/windows/server_settings_window.cpp

@@ -36,12 +36,12 @@ int GuiApplication::SelfHostedServerWindow() {
         ImGui::SetNextWindowPos(
             ImVec2(io.DisplaySize.x * 0.298f, io.DisplaySize.y * 0.25f));
         ImGui::SetNextWindowSize(
-            ImVec2(io.DisplaySize.x * 0.407f, io.DisplaySize.y * 0.35f));
+            ImVec2(io.DisplaySize.x * 0.407f, io.DisplaySize.y * 0.29f));
       } else {
         ImGui::SetNextWindowPos(
             ImVec2(io.DisplaySize.x * 0.27f, io.DisplaySize.y * 0.3f));
         ImGui::SetNextWindowSize(
-            ImVec2(io.DisplaySize.x * 0.465f, io.DisplaySize.y * 0.35f));
+            ImVec2(io.DisplaySize.x * 0.465f, io.DisplaySize.y * 0.29f));
       }
 
       self_hosted_server_config_window_pos_reset_ = false;
@@ -101,25 +101,6 @@ int GuiApplication::SelfHostedServerWindow() {
                          IM_ARRAYSIZE(signal_server_port_self_));
       }
 
-      ImGui::Separator();
-
-      {
-        ImGui::AlignTextToFramePadding();
-        ImGui::Text("%s", localization::self_hosted_server_coturn_server_port
-                              [localization_language_index_]
-                                  .c_str());
-        ImGui::SameLine();
-        if (ConfigCenter::LANGUAGE::CHINESE == localization_language_) {
-          ImGui::SetCursorPosX(title_bar_button_width_ * 2.5f);
-        } else {
-          ImGui::SetCursorPosX(title_bar_button_width_ * 3.43f);
-        }
-        ImGui::SetNextItemWidth(title_bar_button_width_ * 3.8f);
-
-        ImGui::InputText("##coturn_server_port_self_", coturn_server_port_self_,
-                         IM_ARRAYSIZE(coturn_server_port_self_));
-      }
-
       if (stream_window_inited_) {
         ImGui::EndDisabled();
       }
@@ -141,17 +122,12 @@ int GuiApplication::SelfHostedServerWindow() {
 
         config_center_->SetServerHost(signal_server_ip_self_);
         config_center_->SetServerPort(atoi(signal_server_port_self_));
-        config_center_->SetCoturnServerPort(atoi(coturn_server_port_self_));
         strncpy(signal_server_ip_, signal_server_ip_self_,
                 sizeof(signal_server_ip_) - 1);
         signal_server_ip_[sizeof(signal_server_ip_) - 1] = '\0';
         strncpy(signal_server_port_, signal_server_port_self_,
                 sizeof(signal_server_port_) - 1);
         signal_server_port_[sizeof(signal_server_port_) - 1] = '\0';
-        strncpy(coturn_server_port_, coturn_server_port_self_,
-                sizeof(coturn_server_port_) - 1);
-        coturn_server_port_[sizeof(coturn_server_port_) - 1] = '\0';
-
         self_hosted_server_config_window_pos_reset_ = true;
       }
 
@@ -173,14 +149,6 @@ int GuiApplication::SelfHostedServerWindow() {
         } else {
           signal_server_port_self_[0] = '\0';
         }
-        int coturn_port = config_center_->GetCoturnServerPort();
-        if (coturn_port > 0) {
-          strncpy(coturn_server_port_self_, std::to_string(coturn_port).c_str(),
-                  sizeof(coturn_server_port_self_) - 1);
-          coturn_server_port_self_[sizeof(coturn_server_port_self_) - 1] = '\0';
-        } else {
-          coturn_server_port_self_[0] = '\0';
-        }
       }
 
       ImGui::SetWindowFontScale(1.0f);

apps/desktop/src/gui/views/windows/stream_window.cpp

@@ -136,10 +136,7 @@ int GuiApplication::StreamWindow() {
           continue;
         }
 
-        std::string tab_label =
-            enable_srtp_
-                ? std::string(ICON_FA_SHIELD_HALVED) + " " + props->remote_id_
-                : props->remote_id_;
+        const std::string& tab_label = props->remote_id_;
         if (ImGui::BeginTabItem(tab_label.c_str(), &props->tab_opened_)) {
           props->tab_selected_ = true;
           ImGui::SetWindowFontScale(0.6f);
@@ -308,4 +305,4 @@ int GuiApplication::StreamWindow() {
 
   return 0;
 }
-} // namespace crossdesk
+} // namespace crossdesk

apps/desktop/src/log/rd_log.cpp

@@ -1,6 +1,5 @@
 #include "rd_log.h"
 
-#include <atomic>
 #include <filesystem>
 
 namespace crossdesk {
@@ -9,26 +8,38 @@ namespace {
 
 std::string g_log_dir = "logs";
 std::once_flag g_logger_once_flag;
+std::mutex g_logger_mutex;
 std::shared_ptr<spdlog::logger> g_logger;
-std::atomic<bool> g_logger_created{false};
+
+std::string NormalizeLogDirectory(const std::string& log_dir) {
+  const std::filesystem::path path = log_dir.empty() ? "logs" : log_dir;
+  std::error_code ec;
+  const auto absolute = std::filesystem::absolute(path, ec);
+  return (ec ? path : absolute).lexically_normal().string();
+}
 
 }  // namespace
 
 void InitLogger(const std::string& log_dir) {
-  if (g_logger_created.load()) {
-    LOG_WARN(
-        "InitLogger called after logger initialized. Ignoring log_dir: {}, "
-        "using previous log_dir: {}",
-        log_dir, g_log_dir);
+  const auto directory = NormalizeLogDirectory(log_dir);
+  std::lock_guard<std::mutex> lock(g_logger_mutex);
+  if (g_logger) {
+    if (directory != g_log_dir) {
+      g_logger->warn(
+          "InitLogger called after logger initialized. Ignoring log_dir: {}, "
+          "using previous log_dir: {}",
+          directory, g_log_dir);
+    }
     return;
   }
 
-  g_log_dir = log_dir;
+  g_log_dir = directory;
 }
 
 std::shared_ptr<spdlog::logger> get_logger() {
   std::call_once(g_logger_once_flag, []() {
-    g_logger_created.store(true);
+    std::lock_guard<std::mutex> lock(g_logger_mutex);
+    g_log_dir = NormalizeLogDirectory(g_log_dir);
 
     std::error_code ec;
     std::filesystem::create_directories(g_log_dir, ec);
@@ -54,10 +65,12 @@ std::shared_ptr<spdlog::logger> get_logger() {
     sinks.push_back(std::make_shared<spdlog::sinks::rotating_file_sink_mt>(
         filename, 5 * 1024 * 1024, 3));
 
-    g_logger = std::make_shared<spdlog::logger>(LOGGER_NAME, sinks.begin(),
-                                                sinks.end());
-    g_logger->flush_on(spdlog::level::info);
-    spdlog::register_logger(g_logger);
+    auto logger = std::make_shared<spdlog::logger>(LOGGER_NAME, sinks.begin(),
+                                                   sinks.end());
+    logger->flush_on(spdlog::level::info);
+    spdlog::register_logger(logger);
+    logger->info("Logger initialized: path={}", filename);
+    g_logger = std::move(logger);
   });
 
   return g_logger;

apps/desktop/src/platform/common/gui/cuda_driver.cpp

@@ -0,0 +1,82 @@
+#include "platform/common/gui/cuda_driver.h"
+
+#if CROSSDESK_HAS_CUDA_DRIVER
+#if defined(_WIN32)
+#include <windows.h>
+#else
+#include <dlfcn.h>
+#endif
+
+#include <type_traits>
+
+#include "rd_log.h"
+
+namespace crossdesk {
+
+const CudaDriver* CudaDriver::Get() {
+  static const CudaDriver driver;
+  return driver.loaded_ ? &driver : nullptr;
+}
+
+void* CudaDriver::Symbol(const char* name) const {
+#if defined(_WIN32)
+  return reinterpret_cast<void*>(
+      GetProcAddress(static_cast<HMODULE>(module_), name));
+#else
+  return dlsym(module_, name);
+#endif
+}
+
+CudaDriver::CudaDriver() {
+#if defined(_WIN32)
+  module_ = LoadLibraryW(L"nvcuda.dll");
+#else
+  module_ = dlopen("libcuda.so.1", RTLD_LAZY | RTLD_LOCAL);
+#endif
+  if (!module_) return;
+  const auto load = [this](auto& function, const char* name) {
+    function = reinterpret_cast<std::decay_t<decltype(function)>>(Symbol(name));
+    return function != nullptr;
+  };
+  loaded_ = load(init, "cuInit") &&
+      load(device_get_count, "cuDeviceGetCount") &&
+      load(device_get, "cuDeviceGet") &&
+      load(context_create, "cuCtxCreate_v2") &&
+      load(context_destroy, "cuCtxDestroy_v2") &&
+      load(context_push, "cuCtxPushCurrent_v2") &&
+      load(context_pop, "cuCtxPopCurrent_v2") &&
+      load(error_name, "cuGetErrorName") &&
+      load(mem_alloc, "cuMemAlloc_v2") &&
+      load(mem_free, "cuMemFree_v2") &&
+      load(memcpy_2d, "cuMemcpy2D_v2") &&
+      load(memcpy_2d_async, "cuMemcpy2DAsync_v2") &&
+      load(stream_create, "cuStreamCreate") &&
+      load(stream_destroy, "cuStreamDestroy_v2") &&
+      load(stream_synchronize, "cuStreamSynchronize") &&
+      load(register_gl_buffer, "cuGraphicsGLRegisterBuffer") &&
+      load(unregister_resource, "cuGraphicsUnregisterResource") &&
+      load(map_resources, "cuGraphicsMapResources") &&
+      load(unmap_resources, "cuGraphicsUnmapResources") &&
+      load(mapped_pointer, "cuGraphicsResourceGetMappedPointer_v2");
+}
+
+CudaDriver::~CudaDriver() {
+  if (!module_) return;
+#if defined(_WIN32)
+  FreeLibrary(static_cast<HMODULE>(module_));
+#else
+  dlclose(module_);
+#endif
+}
+
+bool CudaDriver::Check(CUresult result, const char* operation) const {
+  if (result == CUDA_SUCCESS) return true;
+  const char* name = nullptr;
+  error_name(result, &name);
+  LOG_WARN("CUDA/OpenGL {} failed: {} ({})", operation,
+           name ? name : "unknown CUDA error", static_cast<int>(result));
+  return false;
+}
+
+}  // namespace crossdesk
+#endif

apps/desktop/src/platform/common/gui/cuda_driver.h

@@ -0,0 +1,63 @@
+/*
+ * @Author: DI JUNKUN
+ * @Date: 2026-09-07
+ * Copyright (c) 2026 by DI JUNKUN, All Rights Reserved.
+ */
+
+#ifndef _CUDA_DRIVER_H_
+#define _CUDA_DRIVER_H_
+
+#if defined(USE_CUDA) && USE_CUDA && \
+    (defined(_WIN32) || \
+     (defined(__linux__) && (defined(__x86_64__) || defined(__amd64__))))
+#define CROSSDESK_HAS_CUDA_DRIVER 1
+
+#include <cuda.h>
+
+namespace crossdesk {
+
+// Application-owned driver entry points. No codec library or MiniRTC internals
+// are involved; the module remains loaded for this singleton's lifetime.
+class CudaDriver {
+ public:
+  static const CudaDriver* Get();
+  bool Check(CUresult result, const char* operation) const;
+
+  decltype(&cuInit) init = nullptr;
+  decltype(&cuDeviceGetCount) device_get_count = nullptr;
+  decltype(&cuDeviceGet) device_get = nullptr;
+  CUresult(CUDAAPI* context_create)(CUcontext*, unsigned int, CUdevice) = nullptr;
+  decltype(&cuCtxDestroy) context_destroy = nullptr;
+  decltype(&cuCtxPushCurrent) context_push = nullptr;
+  decltype(&cuCtxPopCurrent) context_pop = nullptr;
+  decltype(&cuGetErrorName) error_name = nullptr;
+  decltype(&cuMemAlloc) mem_alloc = nullptr;
+  decltype(&cuMemFree) mem_free = nullptr;
+  decltype(&cuMemcpy2D) memcpy_2d = nullptr;
+  decltype(&cuMemcpy2DAsync) memcpy_2d_async = nullptr;
+  decltype(&cuStreamCreate) stream_create = nullptr;
+  decltype(&cuStreamDestroy) stream_destroy = nullptr;
+  decltype(&cuStreamSynchronize) stream_synchronize = nullptr;
+  CUresult(CUDAAPI* register_gl_buffer)(CUgraphicsResource*, unsigned int,
+                                       unsigned int) = nullptr;
+  decltype(&cuGraphicsUnregisterResource) unregister_resource = nullptr;
+  decltype(&cuGraphicsMapResources) map_resources = nullptr;
+  decltype(&cuGraphicsUnmapResources) unmap_resources = nullptr;
+  decltype(&cuGraphicsResourceGetMappedPointer) mapped_pointer = nullptr;
+
+ private:
+  CudaDriver();
+  ~CudaDriver();
+  CudaDriver(const CudaDriver&) = delete;
+  CudaDriver& operator=(const CudaDriver&) = delete;
+  void* Symbol(const char* name) const;
+  void* module_ = nullptr;
+  bool loaded_ = false;
+};
+
+}  // namespace crossdesk
+#else
+#define CROSSDESK_HAS_CUDA_DRIVER 0
+#endif
+
+#endif

apps/desktop/src/platform/common/gui/cuda_opengl_interop.cpp

@@ -0,0 +1,198 @@
+#include "platform/common/gui/cuda_opengl_interop.h"
+#include "platform/common/gui/cuda_driver.h"
+
+#include <memory>
+#include <new>
+
+#include "platform/common/gui/native_video_frame_ref.h"
+
+namespace crossdesk {
+
+#if CROSSDESK_HAS_CUDA_DRIVER
+
+namespace {
+
+class ScopedCudaContext {
+ public:
+  ScopedCudaContext(const CudaDriver& driver, CUcontext context)
+      : cuda(driver),
+        active_(cuda.Check(cuda.context_push(context), "cuCtxPushCurrent")) {}
+  ~ScopedCudaContext() { Pop(); }
+  explicit operator bool() const { return active_; }
+  bool Pop() {
+    if (!active_) return true;
+    active_ = false;
+    CUcontext context = nullptr;
+    return cuda.Check(cuda.context_pop(&context), "cuCtxPopCurrent");
+  }
+
+ private:
+  const CudaDriver& cuda;
+  bool active_;
+};
+
+bool IsCudaFrame(const MiniRtcNativeVideoFrame* frame) {
+  return frame && GetOpenGlNativeFrame(*frame) &&
+         frame->type == MiniRtcNativeVideoFrameCudaNv12;
+}
+
+}  // namespace
+
+struct CudaOpenGlVideoBuffer {
+  const CudaDriver* driver = nullptr;
+  CUcontext context = nullptr;
+  CUstream stream = nullptr;
+  CUgraphicsResource resource = nullptr;
+  bool mapped = false;
+  bool failed = false;
+  NativeVideoFrameRef source_frame;
+};
+
+bool IsCudaDeviceAvailable() {
+  const auto* cuda = CudaDriver::Get();
+  int count = 0;
+  return cuda && cuda->init(0) == CUDA_SUCCESS &&
+         cuda->device_get_count(&count) == CUDA_SUCCESS && count > 0;
+}
+
+CudaOpenGlVideoBuffer* CreateCudaOpenGlVideoBuffer(
+    const MiniRtcNativeVideoFrame* frame, uint32_t gl_buffer) {
+  const auto* driver = CudaDriver::Get();
+  if (!IsCudaFrame(frame) || gl_buffer == 0 || !driver) {
+    return nullptr;
+  }
+  std::unique_ptr<CudaOpenGlVideoBuffer, decltype(&DestroyCudaOpenGlVideoBuffer)>
+      buffer(new (std::nothrow) CudaOpenGlVideoBuffer,
+             &DestroyCudaOpenGlVideoBuffer);
+  if (!buffer) return nullptr;
+  buffer->driver = driver;
+  const auto& cuda = *driver;
+  buffer->context = static_cast<CUcontext>(frame->payload.cuda_nv12.context);
+  buffer->source_frame = NativeVideoFrameRef(frame);
+  ScopedCudaContext context(cuda, buffer->context);
+  if (!context ||
+      !cuda.Check(cuda.stream_create(&buffer->stream,
+                                     CU_STREAM_NON_BLOCKING),
+                  "cuStreamCreate") ||
+      !cuda.Check(cuda.register_gl_buffer(
+                      &buffer->resource, gl_buffer,
+                      CU_GRAPHICS_REGISTER_FLAGS_WRITE_DISCARD),
+                  "cuGraphicsGLRegisterBuffer") ||
+      !context.Pop()) {
+    return nullptr;
+  }
+  return buffer.release();
+}
+
+int UploadCudaFrameToOpenGlBuffer(
+    CudaOpenGlVideoBuffer* buffer, const MiniRtcNativeVideoFrame* frame) {
+  if (!buffer || buffer->failed || !IsCudaFrame(frame) ||
+      frame->payload.cuda_nv12.context != buffer->context) {
+    return -1;
+  }
+  const auto& cuda = *buffer->driver;
+  ScopedCudaContext context(cuda, buffer->context);
+  if (!context) {
+    buffer->failed = true;
+    return -1;
+  }
+  // The caller has completed this buffer's previous GL use. Hold the new
+  // surface through asynchronous copies, including partially failed uploads.
+  buffer->source_frame = NativeVideoFrameRef(frame);
+  const char* operation = "cuGraphicsMapResources";
+  CUresult result =
+      cuda.map_resources(1, &buffer->resource, buffer->stream);
+  buffer->mapped = result == CUDA_SUCCESS;
+  CUdeviceptr destination = 0;
+  size_t mapped_size = 0;
+  if (result == CUDA_SUCCESS) {
+    operation = "cuGraphicsResourceGetMappedPointer";
+    result = cuda.mapped_pointer(
+        &destination, &mapped_size, buffer->resource);
+  }
+  const size_t y_size = static_cast<size_t>(frame->width) * frame->height;
+  if (result == CUDA_SUCCESS && mapped_size < y_size + y_size / 2) {
+    operation = "validate mapped buffer size";
+    result = CUDA_ERROR_INVALID_VALUE;
+  }
+  if (result == CUDA_SUCCESS) {
+    CUDA_MEMCPY2D copy{};
+    copy.srcMemoryType = CU_MEMORYTYPE_DEVICE;
+    copy.srcDevice = frame->payload.cuda_nv12.y_device_pointer;
+    copy.srcPitch = frame->payload.cuda_nv12.y_stride;
+    copy.dstMemoryType = CU_MEMORYTYPE_DEVICE;
+    copy.dstDevice = destination;
+    copy.dstPitch = frame->width;
+    copy.WidthInBytes = frame->width;
+    copy.Height = frame->height;
+    operation = "cuMemcpy2DAsync (Y plane)";
+    result = cuda.memcpy_2d_async(&copy, buffer->stream);
+    if (result == CUDA_SUCCESS) {
+      copy.srcDevice = frame->payload.cuda_nv12.uv_device_pointer;
+      copy.srcPitch = frame->payload.cuda_nv12.uv_stride;
+      copy.dstDevice = destination + y_size;
+      copy.Height = frame->height / 2;
+      operation = "cuMemcpy2DAsync (UV plane)";
+      result = cuda.memcpy_2d_async(&copy, buffer->stream);
+    }
+  }
+  if (buffer->mapped) {
+    const CUresult unmap =
+        cuda.unmap_resources(1, &buffer->resource, buffer->stream);
+    buffer->mapped = unmap != CUDA_SUCCESS;
+    if (result == CUDA_SUCCESS) {
+      operation = "cuGraphicsUnmapResources";
+      result = unmap;
+    } else {
+      cuda.Check(unmap, "cuGraphicsUnmapResources (cleanup)");
+    }
+  }
+  const bool copied = cuda.Check(result, operation);
+  const bool popped = context.Pop();
+  buffer->failed = !copied || !popped;
+  return buffer->failed ? -1 : 0;
+}
+
+void DestroyCudaOpenGlVideoBuffer(CudaOpenGlVideoBuffer* buffer) {
+  if (!buffer) return;
+  // Keep the frame's device context alive until after the context is popped.
+  std::unique_ptr<CudaOpenGlVideoBuffer> owner(buffer);
+  const auto& cuda = *buffer->driver;
+  ScopedCudaContext context(cuda, buffer->context);
+  if (!context) return;
+  if (buffer->stream) {
+    cuda.Check(cuda.stream_synchronize(buffer->stream),
+               "cuStreamSynchronize (destroy)");
+  }
+  if (buffer->mapped) {
+    cuda.Check(cuda.unmap_resources(
+                  1, &buffer->resource, buffer->stream),
+               "cuGraphicsUnmapResources (destroy)");
+    cuda.Check(cuda.stream_synchronize(buffer->stream),
+               "cuStreamSynchronize (unmap)");
+  }
+  if (buffer->resource) {
+    cuda.Check(cuda.unregister_resource(buffer->resource),
+               "cuGraphicsUnregisterResource");
+  }
+  if (buffer->stream) {
+    cuda.Check(cuda.stream_destroy(buffer->stream), "cuStreamDestroy");
+  }
+}
+
+#else
+
+bool IsCudaDeviceAvailable() { return false; }
+CudaOpenGlVideoBuffer* CreateCudaOpenGlVideoBuffer(
+    const MiniRtcNativeVideoFrame*, uint32_t) {
+  return nullptr;
+}
+int UploadCudaFrameToOpenGlBuffer(
+    CudaOpenGlVideoBuffer*, const MiniRtcNativeVideoFrame*) {
+  return -1;
+}
+void DestroyCudaOpenGlVideoBuffer(CudaOpenGlVideoBuffer*) {}
+
+#endif
+
+}  // namespace crossdesk

apps/desktop/src/platform/common/gui/cuda_opengl_interop.h

@@ -0,0 +1,35 @@
+/*
+ * @Author: DI JUNKUN
+ * @Date: 2026-09-07
+ * Copyright (c) 2026 by DI JUNKUN, All Rights Reserved.
+ */
+
+#ifndef _CUDA_OPENGL_INTEROP_H_
+#define _CUDA_OPENGL_INTEROP_H_
+
+#include "minirtc.h"
+
+namespace crossdesk {
+
+bool IsCudaDeviceAvailable();
+
+struct CudaOpenGlVideoBuffer;
+
+// These operations require the matching GL context to be current. The caller
+// owns the GL buffer and must allocate its storage before registering it.
+CudaOpenGlVideoBuffer* CreateCudaOpenGlVideoBuffer(
+    const MiniRtcNativeVideoFrame* frame, uint32_t gl_buffer);
+
+// Asynchronous, GPU-only NV12 copy. Retains the source through the next upload
+// or destruction, including on failure. Before reusing the buffer, the caller
+// must wait for the previous GL fence. Frames must use the same CUDA context.
+int UploadCudaFrameToOpenGlBuffer(CudaOpenGlVideoBuffer* buffer,
+                                 const MiniRtcNativeVideoFrame* frame);
+
+// Finish prior GL use before calling. Waits for CUDA work and releases retained
+// frames; the caller may then resize/delete the GL buffer. Accepts null.
+void DestroyCudaOpenGlVideoBuffer(CudaOpenGlVideoBuffer* buffer);
+
+}  // namespace crossdesk
+
+#endif

apps/desktop/src/platform/common/gui/native_video_frame_ref.h

@@ -0,0 +1,99 @@
+/*
+ * @Author: DI JUNKUN
+ * @Date: 2026-09-07
+ * Copyright (c) 2026 by DI JUNKUN, All Rights Reserved.
+ */
+
+#ifndef _NATIVE_VIDEO_FRAME_REF_H_
+#define _NATIVE_VIDEO_FRAME_REF_H_
+
+#include <limits>
+#include <utility>
+
+#include "minirtc.h"
+
+namespace crossdesk {
+
+class NativeVideoFrameRef {
+public:
+  NativeVideoFrameRef() = default;
+
+  explicit NativeVideoFrameRef(const MiniRtcNativeVideoFrame *frame) {
+    if (frame && frame->owner && frame->retain && frame->release) {
+      frame_ = *frame;
+      frame_.struct_size = sizeof(frame_);
+      frame_.retain(frame_.owner);
+      valid_ = true;
+    }
+  }
+
+  NativeVideoFrameRef(const NativeVideoFrameRef &other)
+      : NativeVideoFrameRef(other.Get()) {}
+
+  NativeVideoFrameRef(NativeVideoFrameRef &&other) noexcept
+      : frame_(other.frame_), valid_(std::exchange(other.valid_, false)) {
+    other.frame_ = {};
+  }
+
+  NativeVideoFrameRef &operator=(NativeVideoFrameRef other) noexcept {
+    Swap(other);
+    return *this;
+  }
+
+  ~NativeVideoFrameRef() { Reset(); }
+
+  void Reset() {
+    if (valid_ && frame_.owner && frame_.release) {
+      frame_.release(frame_.owner);
+    }
+    frame_ = {};
+    valid_ = false;
+  }
+
+  void Swap(NativeVideoFrameRef &other) noexcept {
+    std::swap(frame_, other.frame_);
+    std::swap(valid_, other.valid_);
+  }
+
+  const MiniRtcNativeVideoFrame *Get() const { return valid_ ? &frame_ : nullptr; }
+  explicit operator bool() const { return valid_; }
+
+private:
+  MiniRtcNativeVideoFrame frame_{};
+  bool valid_ = false;
+};
+
+inline const MiniRtcNativeVideoFrame *GetOpenGlNativeFrame(
+    const MiniRtcNativeVideoFrame &frame) {
+  const MiniRtcNativeVideoFrame *native = &frame;
+  if (native->struct_size < static_cast<uint32_t>(sizeof(MiniRtcNativeVideoFrame)) ||
+      !native->owner || !native->retain || !native->release ||
+      !native->copy_to_nv12 || native->width == 0 || native->height == 0 ||
+      (native->width & 1U) != 0 || (native->height & 1U) != 0 ||
+      native->width > static_cast<uint32_t>(std::numeric_limits<int>::max()) ||
+      native->height > static_cast<uint32_t>(std::numeric_limits<int>::max())) {
+    return nullptr;
+  }
+  if (native->type == MiniRtcNativeVideoFrameCpuNv12) {
+    return native->payload.cpu_nv12.y_plane &&
+                   native->payload.cpu_nv12.uv_plane &&
+                   native->payload.cpu_nv12.y_stride >= native->width &&
+                   native->payload.cpu_nv12.uv_stride >= native->width
+               ? native
+               : nullptr;
+  }
+  if (native->type == MiniRtcNativeVideoFrameCudaNv12) {
+    return native->payload.cuda_nv12.y_device_pointer != 0 &&
+                   native->payload.cuda_nv12.uv_device_pointer != 0 &&
+                   native->payload.cuda_nv12.y_stride >= native->width &&
+                   native->payload.cuda_nv12.uv_stride >= native->width &&
+                   native->payload.cuda_nv12.context
+               ? native
+               : nullptr;
+  }
+  return nullptr;
+}
+
+}  // namespace crossdesk
+
+#endif

apps/desktop/src/platform/common/gui/opengl_video_renderer.h

@@ -13,11 +13,10 @@
 namespace crossdesk {
 
 // NV12 underlay for Slint's FemtoVG OpenGL renderer on Windows and Linux.
-// MiniRTC submits either ref-counted Windows native NV12 frames or packed CPU
-// NV12 fallback frames from its decode callback thread. CUDA-backed frames use
-// CUDA/OpenGL interop; CPU-backed frames are retained without an intermediate
-// queue copy. The Slint UI thread updates Y and UV textures and performs color
-// conversion and scaling before Slint draws its overlay.
+// MiniRTC submits cross-platform native NV12 descriptors or tightly packed CPU
+// fallback frames from its decode callback thread. CUDA frames rotate through
+// fenced OpenGL upload resources; CPU descriptors expose their planes without
+// an intermediate queue copy. The UI thread always consumes the newest frame.
 class OpenGlVideoRenderer final : public VideoRenderer {
 public:
   OpenGlVideoRenderer();
@@ -33,11 +32,6 @@ public:
   bool IsReady() const override;
   bool IsActive() const override;
 
-  // Keeps Slint's native surface on a display-driven redraw loop while decoded
-  // frames are arriving. This avoids timer/vsync phase drift that otherwise
-  // causes every second redraw request to be coalesced on Windows.
-  bool ShouldContinueRendering() const;
-
   // Only the selected stream is queued for upload. Frames for other tabs are
   // retained by GuiRuntime at a throttled rate for thumbnail/tab restoration.
   bool SetSelectedStream(std::string remote_id) override;
@@ -49,7 +43,7 @@ public:
   SubmitResult SubmitCachedNv12(std::string_view remote_id, const uint8_t *data,
                                 size_t size, int width, int height) override;
   SubmitResult SubmitNativeFrame(std::string_view remote_id,
-                                 const XVideoFrame &frame) override;
+                                 const MiniRtcNativeVideoFrame &frame) override;
 
   // Draws below Slint while its OpenGL context is current. All dimensions are
   // physical pixels in the window client area. corner_radius_pixels clips the

apps/desktop/src/platform/common/gui/service_status_runtime.cpp

@@ -3,6 +3,13 @@
 namespace crossdesk {
 
 void GuiRuntime::ResetRemoteServiceStatus(RemoteSession& props) {
+  {
+    std::lock_guard lock(props.privacy_status_mutex_);
+    props.privacy_status_ = {};
+    props.privacy_status_received_ = false;
+    props.privacy_command_pending_ = false;
+    props.privacy_status_tick_ = 0;
+  }
   props.remote_service_status_received_ = false;
   props.remote_service_available_ = false;
   props.remote_interactive_stage_.clear();

apps/desktop/src/platform/linux/gui/cuda_graphics.cpp

@@ -0,0 +1,53 @@
+#include "platform/linux/gui/cuda_graphics.h"
+
+#include <cstdlib>
+#include <initializer_list>
+
+#include "rd_log.h"
+
+#include "platform/common/gui/cuda_opengl_interop.h"
+
+namespace crossdesk {
+
+void ConfigureLinuxCudaGraphics(bool hardware_acceleration) {
+#if USE_CUDA && (defined(__x86_64__) || defined(__amd64__))
+  if (!hardware_acceleration) {
+    return;
+  }
+
+  // Respect explicit GPU/driver selection, including a request to use Mesa
+  // or software rendering. Native frames can still use the CPU fallback.
+  for (const char* name : {"__NV_PRIME_RENDER_OFFLOAD",
+                           "__NV_PRIME_RENDER_OFFLOAD_PROVIDER",
+                           "__GLX_VENDOR_LIBRARY_NAME",
+                           "__EGL_VENDOR_LIBRARY_FILENAMES",
+                           "__EGL_VENDOR_LIBRARY_DIRS", "DRI_PRIME",
+                           "LIBGL_ALWAYS_SOFTWARE",
+                           "MESA_LOADER_DRIVER_OVERRIDE"}) {
+    const char* value = std::getenv(name);
+    if (value && value[0] != '\0') {
+      LOG_INFO("Keeping explicit Linux graphics selection: {}={}", name,
+               value);
+      return;
+    }
+  }
+
+  if (!IsCudaDeviceAvailable()) {
+    return;
+  }
+
+  // Both EGL and GLX need to render on NVIDIA to share CUDA frame buffers.
+  // These are process-local, not desktop settings.
+  // https://download.nvidia.com/XFree86/Linux-x86_64/595.45.04/README/primerenderoffload.html
+  if (setenv("__NV_PRIME_RENDER_OFFLOAD", "1", 1) != 0 ||
+      setenv("__GLX_VENDOR_LIBRARY_NAME", "nvidia", 1) != 0) {
+    LOG_WARN("Unable to select NVIDIA PRIME rendering for CUDA video");
+    return;
+  }
+  LOG_INFO("Selected NVIDIA PRIME rendering for CUDA/OpenGL video interop");
+#else
+  (void)hardware_acceleration;
+#endif
+}
+
+}  // namespace crossdesk

apps/desktop/src/platform/linux/gui/cuda_graphics.h

@@ -0,0 +1,18 @@
+/*
+ * @Author: DI JUNKUN
+ * @Date: 2026-09-07
+ * Copyright (c) 2026 by DI JUNKUN, All Rights Reserved.
+ */
+
+#ifndef _CUDA_GRAPHICS_H_
+#define _CUDA_GRAPHICS_H_
+
+namespace crossdesk {
+
+// Call before SDL or Slint initializes EGL/GLX. Hybrid laptops otherwise
+// create the GUI context on the integrated GPU while NVDEC uses NVIDIA.
+void ConfigureLinuxCudaGraphics(bool hardware_acceleration);
+
+}  // namespace crossdesk
+
+#endif

apps/desktop/src/platform/linux/gui/tray/linux_tray.cpp

@@ -392,7 +392,10 @@ struct LinuxTrayImpl {
         exit_menu_label(GetExitMenuLabel(language_index_value)),
         exit_menu_ascii_label(IsAsciiPrintable(exit_menu_label)
                                   ? exit_menu_label
-                                  : "Exit") {}
+                                  : "Exit") {
+
+    EnsureTrayIcon();
+  }
 
   explicit LinuxTrayImpl(std::function<void()> show_window_callback,
                          std::function<void()> hide_window_callback,
@@ -416,7 +419,9 @@ struct LinuxTrayImpl {
         exit_menu_label(GetExitMenuLabel(language_index_value)),
         exit_menu_ascii_label(IsAsciiPrintable(exit_menu_label)
                                   ? exit_menu_label
-                                  : "Exit") {}
+                                  : "Exit") {
+    EnsureTrayIcon();
+  }
 
   ~LinuxTrayImpl() { RemoveTrayIcon(); }
 

apps/desktop/src/platform/linux/input/keyboard/keyboard_capturer.cpp

@@ -1,9 +1,15 @@
 #include "keyboard_capturer.h"
 
+#include <X11/XKBlib.h>
+#include <X11/Xatom.h>
 #include <X11/Xlib.h>
+#include <X11/extensions/XInput2.h>
 #include <X11/extensions/XTest.h>
 #include <X11/keysym.h>
 
+#include <array>
+#include <exception>
+
 #include <errno.h>
 #include <poll.h>
 
@@ -15,9 +21,6 @@
 
 namespace crossdesk {
 
-static OnKeyAction g_on_key_action = nullptr;
-static void* g_user_ptr = nullptr;
-
 static KeyCode ResolveX11Keycode(Display* display, int key_code,
                                  uint32_t scan_code, bool extended) {
   if (!display) {
@@ -59,36 +62,8 @@ static KeySym NormalizeKeySym(KeySym key_sym) {
   return key_sym;
 }
 
-static int KeyboardEventHandler(Display* display, XEvent* event) {
-  (void)display;
-  if (event->xkey.type == KeyPress || event->xkey.type == KeyRelease) {
-    KeySym key_sym = NormalizeKeySym(XLookupKeysym(&event->xkey, 0));
-    auto key_it = x11KeySymToVkCode.find(static_cast<int>(key_sym));
-    if (key_it == x11KeySymToVkCode.end()) {
-      key_sym = NormalizeKeySym(XLookupKeysym(&event->xkey, 1));
-      key_it = x11KeySymToVkCode.find(static_cast<int>(key_sym));
-    }
-
-    if (key_it == x11KeySymToVkCode.end()) {
-      return 0;
-    }
-
-    int key_code = key_it->second;
-    bool is_key_down = (event->xkey.type == KeyPress);
-    uint32_t scan_code = 0;
-    bool extended = false;
-    LookupWindowsKeyMetadataFromVk(key_code, &scan_code, &extended);
-
-    if (g_on_key_action) {
-      g_on_key_action(key_code, is_key_down, scan_code, extended, g_user_ptr);
-    }
-  }
-  return 0;
-}
-
 PlatformKeyboardCapturer::PlatformKeyboardCapturer()
     : display_(nullptr),
-      root_(0),
       running_(false),
       use_wayland_portal_(false),
       wayland_init_attempted_(false),
@@ -121,82 +96,253 @@ PlatformKeyboardCapturer::~PlatformKeyboardCapturer() {
   }
 }
 
+bool PlatformKeyboardCapturer::RefreshXTestDevices() {
+  // XTEST identifies injected input. Do not filter by names such as "virtual":
+  // an xrdp keyboard is a legitimate controller input device.
+  const Atom property = XInternAtom(capture_display_, "XTEST Device", True);
+  if (property == None) return false;
+  int count = 0;
+  XIDeviceInfo* devices = XIQueryDevice(capture_display_, XIAllDevices, &count);
+  if (!devices) return false;
+  xtest_devices_.clear();
+  for (int i = 0; i < count; ++i) {
+    if (devices[i].use != XISlaveKeyboard) continue;
+    Atom type = None;
+    int format = 0;
+    unsigned long items = 0, remaining = 0;
+    unsigned char* value = nullptr;
+    const int result = XIGetProperty(
+        capture_display_, devices[i].deviceid, property, 0, 1, False,
+        XA_INTEGER, &type, &format, &items, &remaining, &value);
+    if (result == Success && type == XA_INTEGER && format == 8 &&
+        items == 1 && value && value[0] == 1) {
+      xtest_devices_.insert(devices[i].deviceid);
+    }
+    if (value) XFree(value);
+  }
+  XIFreeDeviceInfo(devices);
+  return true;
+}
+
+void PlatformKeyboardCapturer::CaptureKey(int source_id, int x11_keycode,
+                                          bool is_down) {
+  if (!capture_has_focus_ || xtest_devices_.count(source_id) ||
+      x11_keycode < 8 || x11_keycode > 255)
+    return;
+
+  // The GUI stops capture on focus loss, but its event loop may lag behind
+  // the native input thread. Never forward keys typed into another window.
+  Window focus = None;
+  int revert = 0;
+  XGetInputFocus(capture_display_, &focus, &revert);
+  if (focus != capture_focus_) return;
+
+  const uint64_t identity = (static_cast<uint64_t>(source_id) << 32) |
+                            static_cast<uint32_t>(x11_keycode);
+  auto found = captured_keys_.find(identity);
+  if (found == captured_keys_.end()) {
+    // A press can have reached the Slint fallback just before native capture
+    // started. Forward its release too, so that handoff cannot leave a key down.
+    CapturedKey key;
+    // Use unshifted key identity, independently of the local input method.
+    // Preserve it until release, even if the keyboard mapping changes.
+    for (int level = 0; level < 2 && key.key_code == 0; ++level) {
+      const KeySym symbol = NormalizeKeySym(XkbKeycodeToKeysym(
+          capture_display_, static_cast<KeyCode>(x11_keycode), 0, level));
+      if (symbol == XK_KP_Enter) {
+        key = {0x0D, 0x1C, true};
+      } else if (symbol == XK_ISO_Level3_Shift) {
+        key.key_code = 0xA5;
+      } else if (symbol == XK_grave) {
+        key.key_code = 0xC0;
+      } else if (const auto vk = x11KeySymToVkCode.find(symbol);
+                 vk != x11KeySymToVkCode.end()) {
+        key.key_code = vk->second;
+      }
+    }
+    if (!key.key_code) return;
+    if (!key.scan_code) {
+      LookupWindowsKeyMetadataFromVk(key.key_code, &key.scan_code, &key.extended);
+      if (!key.scan_code) {
+        const int evdev = LinuxEvdevKeycodeFromWindowsVk(key.key_code);
+        for (uint32_t scan = 1; scan <= 0x58; ++scan) {
+          if (evdev >= 0 &&
+              LinuxEvdevKeycodeFromWindowsScanCode(scan, false) == evdev) {
+            key.scan_code = scan;
+            break;
+          }
+        }
+      }
+    }
+    found = captured_keys_.emplace(identity, key).first;
+  }
+  const CapturedKey key = found->second;
+  if (!is_down) captured_keys_.erase(found);
+  if (on_key_action_) {
+    on_key_action_(key.key_code, is_down, key.scan_code, key.extended, user_ptr_);
+  }
+}
+
+void PlatformKeyboardCapturer::RunCapture() {
+  const int fd = ConnectionNumber(capture_display_);
+  while (running_) {
+    while (running_ && XPending(capture_display_) > 0) {
+      XEvent event{};
+      XNextEvent(capture_display_, &event);
+      if (event.type == xkb_event_base_) {
+        auto* xkb = reinterpret_cast<XkbEvent*>(&event);
+        if (xkb->any.xkb_type == XkbMapNotify)
+          XkbRefreshKeyboardMapping(&xkb->map);
+      } else if (event.type == MappingNotify) {
+        XRefreshKeyboardMapping(&event.xmapping);
+      } else if (event.type == FocusOut) {
+        // Keep focus changes in event order too: a fast switch away and back
+        // may finish before either the GUI or XGetInputFocus observes it.
+        capture_has_focus_ = false;
+        for (const auto& [identity, key] : captured_keys_) {
+          if (on_key_action_)
+            on_key_action_(key.key_code, false, key.scan_code, key.extended,
+                           user_ptr_);
+        }
+        captured_keys_.clear();
+        raw_presses_.fill({});
+      } else if (event.type == FocusIn) {
+        capture_has_focus_ = true;
+      } else if (event.type == KeyPress && !event.xkey.send_event &&
+                 event.xkey.keycode < raw_presses_.size() &&
+                 event.xkey.time != raw_presses_[event.xkey.keycode].time) {
+        // Server-generated repeats have no matching raw press. Subscribe to
+        // core events on the focused window so Slint's core/XIM delivery is
+        // preserved (selecting XI_KeyPress here would take precedence over it).
+        const int source = raw_presses_[event.xkey.keycode].source_id;
+        const uint64_t identity = (static_cast<uint64_t>(source) << 32) |
+                                  event.xkey.keycode;
+        if (captured_keys_.count(identity))
+          CaptureKey(source, event.xkey.keycode, true);
+      } else if (event.type == GenericEvent &&
+                 event.xcookie.extension == xi_opcode_ &&
+                 XGetEventData(capture_display_, &event.xcookie)) {
+        if (event.xcookie.evtype == XI_RawKeyPress ||
+            event.xcookie.evtype == XI_RawKeyRelease) {
+          const auto* key = static_cast<XIRawEvent*>(event.xcookie.data);
+          const bool is_down = event.xcookie.evtype == XI_RawKeyPress;
+          if (is_down && key->detail >= 0 &&
+              static_cast<size_t>(key->detail) < raw_presses_.size()) {
+            // Include filtered XTEST presses, so their core events cannot be
+            // mistaken for repeats of a physically held key.
+            raw_presses_[key->detail] = {key->time, key->sourceid};
+          }
+          CaptureKey(key->sourceid, key->detail, is_down);
+        } else if (event.xcookie.evtype == XI_HierarchyChanged &&
+                   !RefreshXTestDevices()) {
+          LOG_ERROR("Failed to refresh XInput2 keyboard devices");
+          running_ = false;
+        }
+        XFreeEventData(capture_display_, &event.xcookie);
+      }
+    }
+    if (!running_) break;
+    struct pollfd pfd = {fd, POLLIN, 0};
+    const int result = poll(&pfd, 1, 50);
+    if ((result < 0 && errno != EINTR) ||
+        (result > 0 && (pfd.revents & (POLLERR | POLLHUP | POLLNVAL)))) {
+      LOG_ERROR("XInput2 keyboard capture event connection failed");
+      break;
+    }
+  }
+  running_ = false;
+}
+
 int PlatformKeyboardCapturer::Hook(OnKeyAction on_key_action, void* user_ptr) {
-  if (!display_) {
-    LOG_ERROR("Display not initialized.");
+  if (running_) return 0;
+  Unhook();
+  capture_display_ = XOpenDisplay(nullptr);
+  if (!capture_display_ || !on_key_action) {
+    LOG_ERROR("Cannot open X11 keyboard capture display or callback is empty");
+    Unhook();
     return -1;
   }
 
-  g_on_key_action = on_key_action;
-  g_user_ptr = user_ptr;
-
-  if (running_) {
-    return 0;
+  int event = 0, error = 0;
+  // XI 2.1 supplies raw-event source IDs, needed to exclude XTEST devices.
+  int major = 2, minor = 1;
+  if (!XQueryExtension(capture_display_, "XInputExtension", &xi_opcode_,
+                       &event, &error) ||
+      XIQueryVersion(capture_display_, &major, &minor) != Success || major < 2 ||
+      (major == 2 && minor < 1)) {
+    LOG_WARN("XInput2 keyboard capture is unavailable");
+    Unhook();
+    return -1;
+  }
+  major = XkbMajorVersion;
+  minor = XkbMinorVersion;
+  int xkb_opcode = 0;
+  if (!XkbQueryExtension(capture_display_, &xkb_opcode, &xkb_event_base_,
+                         &error, &major, &minor) || !RefreshXTestDevices()) {
+    LOG_WARN("Cannot initialize XKB or enumerate XInput2 keyboard devices");
+    Unhook();
+    return -1;
   }
 
-  root_ = DefaultRootWindow(display_);
-  XSelectInput(display_, root_, KeyPressMask | KeyReleaseMask);
-  XFlush(display_);
+  int revert = 0;
+  XGetInputFocus(capture_display_, &capture_focus_, &revert);
+  if (capture_focus_ == None || capture_focus_ == PointerRoot) {
+    LOG_WARN("XInput2 keyboard capture requires a focused application window");
+    Unhook();
+    return -1;
+  }
+  capture_has_focus_ = true;
 
-  running_ = true;
-  const int x11_fd = ConnectionNumber(display_);
-  event_thread_ = std::thread([this, x11_fd]() {
-    while (running_) {
-      while (running_ && XPending(display_) > 0) {
-        XEvent event;
-        XNextEvent(display_, &event);
-        KeyboardEventHandler(display_, &event);
-      }
-
-      if (!running_) {
-        break;
-      }
-
-      struct pollfd pfd = {x11_fd, POLLIN, 0};
-      int poll_ret = poll(&pfd, 1, 50);
-      if (poll_ret < 0) {
-        if (errno == EINTR) {
-          continue;
-        }
-        LOG_ERROR("poll for X11 events failed.");
-        running_ = false;
-        break;
-      }
-
-      if (poll_ret == 0) {
-        continue;
-      }
-
-      if ((pfd.revents & (POLLERR | POLLHUP | POLLNVAL)) != 0) {
-        LOG_ERROR("poll got invalid X11 event fd state.");
-        running_ = false;
-        break;
-      }
-
-      if ((pfd.revents & POLLIN) == 0) {
-        continue;
-      }
+  std::array<unsigned char, XIMaskLen(XI_LASTEVENT)> raw{};
+  std::array<unsigned char, XIMaskLen(XI_LASTEVENT)> hierarchy{};
+  XISetMask(raw.data(), XI_RawKeyPress);
+  XISetMask(raw.data(), XI_RawKeyRelease);
+  XISetMask(hierarchy.data(), XI_HierarchyChanged);
+  XIEventMask masks[] = {
+      {XIAllMasterDevices, static_cast<int>(raw.size()), raw.data()},
+      {XIAllDevices, static_cast<int>(hierarchy.size()), hierarchy.data()}};
+  for (int screen = 0; screen < ScreenCount(capture_display_); ++screen) {
+    if (XISelectEvents(capture_display_, RootWindow(capture_display_, screen),
+                       masks, 2) != Success) {
+      LOG_WARN("Cannot subscribe to XInput2 keyboard events");
+      Unhook();
+      return -1;
     }
-  });
-
+  }
+  XSelectInput(capture_display_, capture_focus_, KeyPressMask | FocusChangeMask);
+  XkbSelectEvents(capture_display_, XkbUseCoreKbd, XkbMapNotifyMask,
+                   XkbMapNotifyMask);
+  XSync(capture_display_, False);
+  on_key_action_ = on_key_action;
+  user_ptr_ = user_ptr;
+  running_ = true;
+  try {
+    event_thread_ = std::thread([this] { RunCapture(); });
+  } catch (const std::exception& error) {
+    LOG_ERROR("Cannot start XInput2 keyboard capture thread: {}", error.what());
+    Unhook();
+    return -1;
+  }
+  LOG_INFO("XInput2 keyboard capture started");
   return 0;
 }
 
 int PlatformKeyboardCapturer::Unhook() {
   running_ = false;
-
-  if (event_thread_.joinable()) {
-    event_thread_.join();
+  if (event_thread_.joinable()) event_thread_.join();
+  // Closing the private connection removes every subscription and queued
+  // event, so restarting capture cannot forward keys from the previous focus.
+  if (capture_display_) {
+    XCloseDisplay(capture_display_);
+    capture_display_ = nullptr;
   }
-
-  g_on_key_action = nullptr;
-  g_user_ptr = nullptr;
-
-  if (display_ && root_ != 0) {
-    XSelectInput(display_, root_, 0);
-    XFlush(display_);
-  }
-
+  on_key_action_ = nullptr;
+  user_ptr_ = nullptr;
+  captured_keys_.clear();
+  raw_presses_.fill({});
+  xtest_devices_.clear();
+  capture_focus_ = None;
+  capture_has_focus_ = false;
   return 0;
 }
 

apps/desktop/src/platform/linux/input/keyboard/keyboard_capturer.h

@@ -7,12 +7,15 @@
 #ifndef _KEYBOARD_CAPTURER_H_
 #define _KEYBOARD_CAPTURER_H_
 
+#include <array>
 #include <atomic>
 #include <cstdint>
 #include <functional>
 #include <mutex>
 #include <string>
 #include <thread>
+#include <unordered_map>
+#include <unordered_set>
 
 #include "device_controller.h"
 
@@ -30,11 +33,25 @@ class PlatformKeyboardCapturer final : public KeyboardCapturer {
  public:
   virtual int Hook(OnKeyAction on_key_action, void* user_ptr);
   virtual int Unhook();
+  bool IsHookActive() const override { return running_.load(); }
   virtual int SendKeyboardCommand(int key_code, bool is_down,
                                   uint32_t scan_code = 0,
                                   bool extended = false);
 
  private:
+  struct CapturedKey {
+    int key_code = 0;
+    uint32_t scan_code = 0;
+    bool extended = false;
+  };
+  struct RawKeyPress {
+    unsigned long time = 0;
+    int source_id = 0;
+  };
+  bool RefreshXTestDevices();
+  void CaptureKey(int source_id, int x11_keycode, bool is_down);
+  void RunCapture();
+
   bool InitWaylandPortal();
   void CleanupWaylandPortal();
   int SendWaylandKeyboardCommand(int key_code, bool is_down, uint32_t scan_code,
@@ -47,7 +64,17 @@ class PlatformKeyboardCapturer final : public KeyboardCapturer {
 
  private:
   _XDisplay* display_;
-  unsigned long root_;
+  // Capture owns a separate connection, including its XKB event queue.
+  _XDisplay* capture_display_ = nullptr;
+  unsigned long capture_focus_ = 0;
+  bool capture_has_focus_ = false;
+  int xi_opcode_ = 0;
+  int xkb_event_base_ = 0;
+  OnKeyAction on_key_action_ = nullptr;
+  void* user_ptr_ = nullptr;
+  std::unordered_set<int> xtest_devices_;
+  std::unordered_map<uint64_t, CapturedKey> captured_keys_;
+  std::array<RawKeyPress, 256> raw_presses_{};
   std::atomic<bool> running_;
   std::thread event_thread_;
   std::mutex x11_injection_mutex_;

apps/desktop/src/platform/linux/privacy/privacy_backend_linux.cpp

@@ -0,0 +1,244 @@
+/*
+ * @Author: DI JUNKUN
+ * @Date: 2026-09-13
+ * Copyright (c) 2026 by DI JUNKUN, All Rights Reserved.
+ */
+
+#ifndef _PRIVACY_BACKEND_LINUX_H_
+#define _PRIVACY_BACKEND_LINUX_H_
+
+#include <poll.h>
+#include <spawn.h>
+#include <sys/eventfd.h>
+#include <sys/socket.h>
+#include <sys/wait.h>
+#include <unistd.h>
+
+#include <algorithm>
+#include <cerrno>
+#include <chrono>
+#include <cstring>
+#include <thread>
+
+#include "privacy_backend.h"
+#include "privacy_guard.h"
+
+extern char** environ;
+
+namespace crossdesk {
+namespace {
+using Clock = std::chrono::steady_clock;
+
+class LinuxPrivacyBackend final : public PrivacyBackend {
+ public:
+  LinuxPrivacyBackend() : wake_(eventfd(0, EFD_CLOEXEC | EFD_NONBLOCK)) {}
+  ~LinuxPrivacyBackend() override {
+    // EOF also recovers after a crash, SIGKILL, or a normal shutdown. Never
+    // terminate the guard: it must finish restoring the saved display ramps.
+    if (socket_ >= 0) close(socket_);
+    if (wake_ >= 0) close(wake_);
+    if (child_ > 0) {
+      const pid_t child = child_;
+      std::thread([child] {
+        while (waitpid(child, nullptr, 0) < 0 && errno == EINTR) {
+        }
+      }).detach();
+    }
+  }
+
+  PrivacyCapabilities Query() override {
+    if (wake_ < 0)
+      return {false, false, "Cannot create Linux privacy wake event"};
+    if (!StartGuard()) return {false, false, failure_};
+    if (!Send(LinuxPrivacyCommand::query)) return {false, false, failure_};
+    // The first query also serves automatic privacy on the first connection.
+    // Bound process startup so an unavailable helper cannot stall the GUI.
+    if (!discovered_) {
+      pollfd fd{socket_, POLLIN, 0};
+      poll(&fd, 1, 1000);
+    }
+    ReadReplies();
+    return {reply_.supported, reply_.input_supported,
+            reply_.capability_reason[0] ? reply_.capability_reason
+                                        : "Checking Linux privacy support"};
+  }
+
+  bool Enable(bool block_input, const PrivacyScreenText&,
+              std::string& error) override {
+    failure_.clear();
+    emergency_ = false;
+    if (!Send(block_input ? LinuxPrivacyCommand::enable_blocking
+                          : LinuxPrivacyCommand::enable)) {
+      error = failure_;
+      return false;
+    }
+    engaged_ = true;
+    ++generation_;
+    last_reply_ = Clock::now();
+    recovered_ = false;
+    reply_.active = false;
+    return true;
+  }
+
+  void Recover() override {
+    ReadReplies();
+    if (recovered_) {
+      failure_.clear();
+      return;
+    }
+    if (recovering_) return;
+    if (Send(LinuxPrivacyCommand::recover)) recovering_ = true;
+  }
+  bool IsRecovered() const override { return recovered_; }
+  bool RecoveryPending() const override { return recovering_; }
+
+  PrivacyHealth Poll() override {
+    ReadReplies();
+    if (engaged_ && Clock::now() - last_reply_ > std::chrono::seconds(1))
+      failure_ = "Linux privacy guard stopped responding";
+    if (engaged_ &&
+        Clock::now() - last_heartbeat_ >= std::chrono::milliseconds(100)) {
+      Send(LinuxPrivacyCommand::heartbeat);
+      last_heartbeat_ = Clock::now();
+    }
+    const bool emergency = emergency_;
+    emergency_ = false;
+    return {failure_, emergency, reply_.active};
+  }
+
+  void WaitForEvents(unsigned timeout_ms) override {
+    pollfd fds[] = {{wake_, POLLIN, 0}, {socket_, POLLIN, 0}};
+    poll(fds, 2, static_cast<int>(timeout_ms));
+    uint64_t value;
+    if (fds[0].revents & POLLIN) {
+      while (read(wake_, &value, sizeof(value)) == sizeof(value)) {
+      }
+    }
+  }
+  void Wake() override {
+    const uint64_t value = 1;
+    if (wake_ >= 0) {
+      const auto ignored = write(wake_, &value, sizeof(value));
+      (void)ignored;
+    }
+  }
+
+ private:
+  bool StartGuard() {
+    if (socket_ >= 0) return true;
+    if (child_ > 0) {
+      const auto result = waitpid(child_, nullptr, WNOHANG);
+      if (result == 0) return false;
+      child_ = -1;
+    }
+    int sockets[2];
+    if (socketpair(AF_UNIX, SOCK_SEQPACKET | SOCK_CLOEXEC | SOCK_NONBLOCK, 0,
+                   sockets) != 0) {
+      failure_ = "Cannot create Linux privacy guard socket";
+      return false;
+    }
+    posix_spawn_file_actions_t actions;
+    int result = posix_spawn_file_actions_init(&actions);
+    if (result == 0) {
+      // Close the parent end first: it may occupy the guard's destination fd.
+      result = posix_spawn_file_actions_addclose(&actions, sockets[0]);
+      if (result == 0)
+        result = posix_spawn_file_actions_adddup2(&actions, sockets[1],
+                                                  kLinuxPrivacyGuardSocket);
+      if (result == 0 && sockets[1] != kLinuxPrivacyGuardSocket)
+        result = posix_spawn_file_actions_addclose(&actions, sockets[1]);
+      if (result == 0) {
+        char executable[] = "/proc/self/exe";
+        char* args[] = {executable,
+                        const_cast<char*>(kLinuxPrivacyGuardArgument), nullptr};
+        result =
+            posix_spawn(&child_, executable, &actions, nullptr, args, environ);
+      }
+      posix_spawn_file_actions_destroy(&actions);
+    }
+    close(sockets[1]);
+    if (result != 0) {
+      close(sockets[0]);
+      child_ = -1;
+      failure_ = std::string("Cannot start Linux privacy guard: ") +
+                 std::strerror(result);
+      return false;
+    }
+    socket_ = sockets[0];
+    reply_ = {};
+    discovered_ = false;
+    generation_ = 0;
+    failure_.clear();
+    return true;
+  }
+
+  void LostGuard() {
+    if (socket_ >= 0) close(socket_);
+    socket_ = -1;
+    reply_ = {};
+    recovering_ = false;
+    failure_ =
+        "Linux privacy guard disconnected; local protection is unavailable";
+    // Do not claim successful recovery after an unexpected guard failure.
+    // A normal guard reports restoration before closing its socket.
+  }
+  bool Send(LinuxPrivacyCommand command) {
+    if (socket_ < 0) return false;
+    if (send(socket_, &command, sizeof(command), MSG_NOSIGNAL) ==
+        sizeof(command))
+      return true;
+    if (errno != EAGAIN && errno != EWOULDBLOCK && errno != EINTR) LostGuard();
+    return false;
+  }
+  void ReadReplies() {
+    if (socket_ < 0) return;
+    for (;;) {
+      LinuxPrivacyReply next;
+      const auto bytes = recv(socket_, &next, sizeof(next), 0);
+      if (bytes < 0 &&
+          (errno == EAGAIN || errno == EWOULDBLOCK || errno == EINTR))
+        return;
+      if (bytes != sizeof(next)) {
+        LostGuard();
+        return;
+      }
+      next.capability_reason[sizeof(next.capability_reason) - 1] = '\0';
+      next.failure[sizeof(next.failure) - 1] = '\0';
+      discovered_ = true;
+      // Ignore queued capability/heartbeat replies from before this enable.
+      // A matching generation can also acknowledge watchdog-driven recovery.
+      if (next.generation != generation_) continue;
+      reply_ = next;
+      last_reply_ = Clock::now();
+      emergency_ = emergency_ || next.emergency;
+      if (next.failure[0]) failure_ = next.failure;
+      recovered_ = next.recovered;
+      if (next.recovered) {
+        recovering_ = false;
+        engaged_ = false;
+      }
+    }
+  }
+
+  int wake_ = -1;
+  int socket_ = -1;
+  pid_t child_ = -1;
+  LinuxPrivacyReply reply_;
+  uint64_t generation_ = 0;
+  bool engaged_ = false;
+  bool discovered_ = false;
+  bool recovering_ = false;
+  bool recovered_ = true;
+  bool emergency_ = false;
+  std::string failure_;
+  Clock::time_point last_heartbeat_{};
+  Clock::time_point last_reply_{};
+};
+}  // namespace
+
+std::unique_ptr<PrivacyBackend> CreateLinuxPrivacyBackend() {
+  return std::make_unique<LinuxPrivacyBackend>();
+}
+}  // namespace crossdesk
+
+#endif

apps/desktop/src/platform/linux/privacy/privacy_guard.cpp

@@ -0,0 +1,721 @@
+/* Copyright (c) 2026 by DI JUNKUN, All Rights Reserved. */
+#include "privacy_guard.h"
+
+#include <X11/XKBlib.h>
+#include <X11/Xatom.h>
+#include <X11/extensions/XInput.h>
+#include <X11/extensions/XInput2.h>
+#include <X11/extensions/XTest.h>
+#include <X11/extensions/Xfixes.h>
+#include <X11/extensions/Xrandr.h>
+#include <X11/keysym.h>
+#include <fcntl.h>
+#include <poll.h>
+#include <sys/socket.h>
+#include <unistd.h>
+
+#include <algorithm>
+#include <array>
+#include <cerrno>
+#include <chrono>
+#include <csignal>
+#include <cstdlib>
+#include <cstring>
+#include <map>
+#include <memory>
+#include <string>
+#include <tuple>
+#include <vector>
+
+namespace crossdesk {
+namespace {
+using Clock = std::chrono::steady_clock;
+using Gamma = std::unique_ptr<XRRCrtcGamma, decltype(&XRRFreeGamma)>;
+using Resources =
+    std::unique_ptr<XRRScreenResources, decltype(&XRRFreeScreenResources)>;
+using CrtcInfo = std::unique_ptr<XRRCrtcInfo, decltype(&XRRFreeCrtcInfo)>;
+volatile std::sig_atomic_t stopping = 0;
+int x_error = 0;
+
+void StopGuard(int) { stopping = 1; }
+int OnXError(Display*, XErrorEvent* event) {
+  x_error = event->error_code;
+  return 0;
+}
+
+template <size_t N>
+void SetText(char (&dest)[N], const std::string& text) {
+  std::strncpy(dest, text.c_str(), N - 1);
+  dest[N - 1] = '\0';
+}
+
+struct Output {
+  Window root = 0;
+  RRCrtc crtc = 0;
+  RRMode mode = 0;
+  int x = 0, y = 0;
+  unsigned width = 0, height = 0;
+  Rotation rotation = 0;
+  std::vector<RROutput> connectors;
+  Gamma saved{nullptr, XRRFreeGamma};
+
+  bool SameLayout(const Output& other) const {
+    return std::tie(root, crtc, mode, x, y, width, height, rotation,
+                    connectors) == std::tie(other.root, other.crtc, other.mode,
+                                            other.x, other.y, other.width,
+                                            other.height, other.rotation,
+                                            other.connectors);
+  }
+};
+
+struct Device {
+  int id = 0, use = 0, attachment = 0;
+  bool keyboard = false, touch = false;
+  std::string name;
+
+  bool operator==(const Device& other) const {
+    return std::tie(id, use, attachment, keyboard, touch, name) ==
+           std::tie(other.id, other.use, other.attachment, other.keyboard,
+                    other.touch, other.name);
+  }
+};
+
+bool IsBlack(const XRRCrtcGamma* gamma) {
+  if (!gamma || gamma->size <= 0) return false;
+  for (int i = 0; i < gamma->size; ++i)
+    if (gamma->red[i] || gamma->green[i] || gamma->blue[i]) return false;
+  return true;
+}
+
+// This class lives only in the exec'd guard process. Its Xlib error handler is
+// isolated from the GUI and capture threads' process-global error handlers.
+class NativePrivacy {
+ public:
+  ~NativePrivacy() {
+    Recover();
+    if (display_) XCloseDisplay(display_);
+  }
+
+  void Query() {
+    reply_.supported = reply_.input_supported = false;
+    std::string error;
+    if (!Initialize(error)) {
+      SetText(reply_.capability_reason, error);
+      return;
+    }
+    std::vector<Output> outputs;
+    std::vector<Device> devices;
+    if (!ReadOutputs(outputs, true, error) || !ReadDevices(devices, error)) {
+      SetText(reply_.capability_reason, error);
+      return;
+    }
+    const bool keyboard = std::any_of(devices.begin(), devices.end(),
+                                      [](const auto& d) { return d.keyboard; });
+    if (!keyboard) {
+      SetText(reply_.capability_reason,
+              "No local keyboard available for privacy recovery");
+      return;
+    }
+    reply_.supported = true;
+    // XIGrabDevice does not suppress XI 2.2 touch delivery. Do not advertise
+    // input protection for touchscreens without a separate touch grab.
+    reply_.input_supported = std::none_of(
+        devices.begin(), devices.end(), [](const auto& d) { return d.touch; });
+    SetText(reply_.capability_reason,
+            reply_.input_supported
+                ? "X11 privacy black screen available; local recovery: "
+                  "Ctrl+Alt+Shift+F12"
+                : "X11 privacy black screen available; touchscreen input "
+                  "blocking is unavailable");
+  }
+
+  void Enable(bool block_input) {
+    ++reply_.generation;
+    reply_.failure[0] = '\0';
+    reply_.emergency = false;
+    if (!reply_.recovered) {
+      Fail("Linux privacy resources are still in use");
+      return;
+    }
+    Query();
+    if (!reply_.supported || (block_input && !reply_.input_supported)) {
+      Fail(reply_.capability_reason);
+      return;
+    }
+    std::string error;
+    keys_.clear();
+    if (!Acquire(error) || !ReadOutputs(outputs_, true, error) ||
+        !ReadDevices(devices_, error) || !ProtectInput(block_input, error)) {
+      Fail(error);
+      return;
+    }
+    // No display ramp is changed until every original ramp has been saved.
+    // Gamma is applied at scanout, after XGetImage/DRM framebuffer capture.
+    // There is deliberately no cover window to contaminate remote frames.
+    x_error = 0;
+    for (const auto& output : outputs_) {
+      Gamma black(XRRAllocGamma(output.saved->size), XRRFreeGamma);
+      if (!black) {
+        Fail("Cannot allocate Linux privacy display ramp");
+        return;
+      }
+      std::fill_n(black->red, black->size, 0);
+      std::fill_n(black->green, black->size, 0);
+      std::fill_n(black->blue, black->size, 0);
+      XRRSetCrtcGamma(display_, output.crtc, black.get());
+    }
+    for (int i = 0; i < ScreenCount(display_); ++i) {
+      XFixesHideCursor(display_, RootWindow(display_, i));
+      hidden_roots_.push_back(RootWindow(display_, i));
+    }
+    XSync(display_, False);
+    if (x_error) {
+      Fail("Cannot blank Linux displays or hide the local cursor");
+      return;
+    }
+    // Active slave grabs temporarily detach devices. Snapshot after grabbing,
+    // and monitor subsequent hardware/hierarchy changes during protection.
+    if (!ReadDevices(devices_, error)) {
+      Fail(error);
+      return;
+    }
+    reply_.active = true;
+    Check();
+  }
+
+  void Recover() {
+    reply_.active = false;
+    if (!display_) {
+      reply_.recovered = true;
+      return;
+    }
+    for (int id : grabbed_) XIUngrabDevice(display_, id, CurrentTime);
+    grabbed_.clear();
+    for (Window root : hidden_roots_) XFixesShowCursor(display_, root);
+    hidden_roots_.clear();
+    // Keep failed restorations for retry. Removed CRTCs no longer own a local
+    // output; all still-present CRTCs must acknowledge the original ramp.
+    for (auto it = outputs_.begin(); it != outputs_.end();) {
+      x_error = 0;
+      Resources resources(XRRGetScreenResourcesCurrent(display_, it->root),
+                          XRRFreeScreenResources);
+      if (!resources) {
+        ++it;
+        continue;
+      }
+      const bool exists =
+          std::find(resources->crtcs, resources->crtcs + resources->ncrtc,
+                    it->crtc) != resources->crtcs + resources->ncrtc;
+      if (exists && it->saved) {
+        XRRSetCrtcGamma(display_, it->crtc, it->saved.get());
+        XSync(display_, False);
+        if (x_error) {
+          ++it;
+          continue;
+        }
+      }
+      it = outputs_.erase(it);
+    }
+    keys_.clear();
+    if (outputs_.empty() && owner_) {
+      XDestroyWindow(display_, owner_);
+      owner_ = 0;
+    }
+    XSync(display_, False);
+    reply_.recovered = outputs_.empty() && !owner_;
+  }
+
+  void Fail(const std::string& reason) {
+    SetText(reply_.failure, reason);
+    Recover();
+  }
+
+  void Poll() {
+    if (!display_) return;
+    while (XPending(display_)) {
+      XEvent event{};
+      XNextEvent(display_, &event);
+      if (event.type != GenericEvent || event.xcookie.extension != xi_opcode_ ||
+          !XGetEventData(display_, &event.xcookie))
+        continue;
+      if (reply_.active) {
+        const int type = event.xcookie.evtype;
+        if (type == XI_KeyPress || type == XI_KeyRelease) {
+          const auto* key = static_cast<XIDeviceEvent*>(event.xcookie.data);
+          Key(key->sourceid, key->detail, type == XI_KeyPress);
+        } else if (!blocking_ &&
+                   (type == XI_RawKeyPress || type == XI_RawKeyRelease)) {
+          const auto* key = static_cast<XIRawEvent*>(event.xcookie.data);
+          Key(key->sourceid, key->detail, type == XI_RawKeyPress);
+        }
+      }
+      XFreeEventData(display_, &event.xcookie);
+    }
+    if (reply_.active &&
+        Clock::now() - checked_ >= std::chrono::milliseconds(100))
+      Check();
+    if (!reply_.active && !reply_.recovered) Recover();
+  }
+
+  const LinuxPrivacyReply& Reply() const { return reply_; }
+  int Connection() const { return display_ ? ConnectionNumber(display_) : -1; }
+  void AcknowledgeEmergency() { reply_.emergency = false; }
+
+ private:
+  bool Initialize(std::string& error) {
+    if (initialized_) return true;
+    const char* session = std::getenv("XDG_SESSION_TYPE");
+    const char* wayland = std::getenv("WAYLAND_DISPLAY");
+    if ((session && std::strcmp(session, "wayland") == 0) ||
+        (wayland && *wayland)) {
+      error =
+          "Linux privacy screen requires an X11 session; Wayland is "
+          "unsupported";
+      return false;
+    }
+    const char* address = std::getenv("DISPLAY");
+    if (!address ||
+        (*address != ':' && std::strncmp(address, "unix:", 5) != 0)) {
+      error = "Linux privacy screen requires a local X11 display";
+      return false;
+    }
+    if (!display_) display_ = XOpenDisplay(nullptr);
+    if (!display_) {
+      error = "Cannot open the local X11 display";
+      return false;
+    }
+    int event = 0, code = 0, opcode = 0;
+    int major = 1, minor = 3;
+    if (XQueryExtension(display_, "XWAYLAND", &opcode, &event, &code)) {
+      error = "XWayland cannot protect native Wayland displays";
+      return false;
+    }
+    if (!XRRQueryExtension(display_, &event, &code) ||
+        !XRRQueryVersion(display_, &major, &minor) || major < 1 ||
+        (major == 1 && minor < 3)) {
+      error = "Linux privacy screen requires RandR 1.3 display gamma control";
+      return false;
+    }
+    major = 4;
+    minor = 0;
+    if (!XFixesQueryExtension(display_, &event, &code) ||
+        !XFixesQueryVersion(display_, &major, &minor) || major < 4) {
+      error = "Linux privacy screen requires XFixes 4 cursor hiding";
+      return false;
+    }
+    major = 2;
+    minor = 2;
+    if (!XQueryExtension(display_, "XInputExtension", &xi_opcode_, &event,
+                         &code) ||
+        XIQueryVersion(display_, &major, &minor) != Success || major < 2) {
+      error = "Linux privacy screen requires XInput 2 local input monitoring";
+      return false;
+    }
+    xtest_property_ = XInternAtom(display_, "XTEST Device", True);
+    if (!xtest_property_ ||
+        !XTestQueryExtension(display_, &event, &code, &major, &minor)) {
+      error = "Cannot identify X11 remote input devices";
+      return false;
+    }
+    selection_ = XInternAtom(display_, "_CROSSDESK_PRIVACY_GUARD", False);
+    std::array<unsigned char, XIMaskLen(XI_LASTEVENT)> bits{};
+    XISetMask(bits.data(), XI_RawKeyPress);
+    XISetMask(bits.data(), XI_RawKeyRelease);
+    XIEventMask mask{XIAllDevices, static_cast<int>(bits.size()), bits.data()};
+    x_error = 0;
+    for (int i = 0; i < ScreenCount(display_); ++i)
+      XISelectEvents(display_, RootWindow(display_, i), &mask, 1);
+    XSync(display_, False);
+    if (x_error) {
+      error = "Cannot monitor the local privacy recovery shortcut";
+      return false;
+    }
+    initialized_ = true;
+    return true;
+  }
+
+  bool ReadOutputs(std::vector<Output>& outputs, bool save,
+                   std::string& error) {
+    outputs.clear();
+    x_error = 0;
+    for (int screen = 0; screen < ScreenCount(display_); ++screen) {
+      const Window root = RootWindow(display_, screen);
+      Resources resources(XRRGetScreenResourcesCurrent(display_, root),
+                          XRRFreeScreenResources);
+      if (!resources) {
+        error = "Cannot enumerate Linux display outputs";
+        return false;
+      }
+      for (int i = 0; i < resources->ncrtc; ++i) {
+        CrtcInfo info(
+            XRRGetCrtcInfo(display_, resources.get(), resources->crtcs[i]),
+            XRRFreeCrtcInfo);
+        if (!info) {
+          error = "Cannot inspect Linux display controller";
+          return false;
+        }
+        if (!info->mode || !info->noutput) continue;
+        Output output;
+        output.root = root;
+        output.crtc = resources->crtcs[i];
+        output.mode = info->mode;
+        output.x = info->x;
+        output.y = info->y;
+        output.width = info->width;
+        output.height = info->height;
+        output.rotation = info->rotation;
+        output.connectors.assign(info->outputs, info->outputs + info->noutput);
+        std::sort(output.connectors.begin(), output.connectors.end());
+        if (save) {
+          output.saved.reset(XRRGetCrtcGamma(display_, output.crtc));
+          if (!output.saved || output.saved->size <= 0 ||
+              IsBlack(output.saved.get())) {
+            error =
+                "Display gamma control is unavailable or the display is "
+                "already blank";
+            return false;
+          }
+        }
+        outputs.push_back(std::move(output));
+      }
+    }
+    XSync(display_, False);
+    if (x_error || outputs.empty()) {
+      error = "No controllable Linux display outputs";
+      return false;
+    }
+    return true;
+  }
+
+  bool ReadDevices(std::vector<Device>& devices, std::string& error) {
+    devices.clear();
+    x_error = 0;
+    int count = 0;
+    XIDeviceInfo* info = XIQueryDevice(display_, XIAllDevices, &count);
+    if (!info) {
+      error = "Cannot enumerate local X11 input devices";
+      return false;
+    }
+    for (int i = 0; i < count; ++i) {
+      const auto& d = info[i];
+      if (!d.enabled || d.use == XIMasterPointer || d.use == XIMasterKeyboard)
+        continue;
+      Atom type = None;
+      int format = 0;
+      unsigned long items = 0, remaining = 0;
+      unsigned char* value = nullptr;
+      const int result =
+          XIGetProperty(display_, d.deviceid, xtest_property_, 0, 1, False,
+                        XA_INTEGER, &type, &format, &items, &remaining, &value);
+      const bool injected = result == Success && type == XA_INTEGER &&
+                            format == 8 && items == 1 && value && value[0] == 1;
+      if (value) XFree(value);
+      if (injected) continue;
+      Device device;
+      device.id = d.deviceid;
+      device.use = d.use;
+      device.attachment = d.attachment;
+      device.name = d.name ? d.name : "";
+      for (int c = 0; c < d.num_classes; ++c) {
+        device.keyboard |= d.classes[c]->type == XIKeyClass;
+        device.touch |= d.classes[c]->type == XITouchClass;
+      }
+      devices.push_back(std::move(device));
+    }
+    XIFreeDeviceInfo(info);
+    XSync(display_, False);
+    if (x_error) {
+      error = "Cannot verify local X11 input devices";
+      return false;
+    }
+    return true;
+  }
+
+  bool Acquire(std::string& error) {
+    // A second instance must not save the first instance's black ramps as its
+    // originals. Selection ownership and creation are atomic on this server.
+    XGrabServer(display_);
+    if (XGetSelectionOwner(display_, selection_) == None) {
+      owner_ = XCreateSimpleWindow(display_, DefaultRootWindow(display_), 0, 0,
+                                   1, 1, 0, 0, 0);
+      XSetSelectionOwner(display_, selection_, owner_, CurrentTime);
+    }
+    XUngrabServer(display_);
+    XSync(display_, False);
+    if (!owner_ || XGetSelectionOwner(display_, selection_) != owner_) {
+      error = "Another CrossDesk instance owns Linux privacy protection";
+      return false;
+    }
+    reply_.recovered = false;
+    return true;
+  }
+
+  bool ProtectInput(bool block_input, std::string& error) {
+    blocking_ = block_input;
+    if (!block_input) return true;
+    for (const auto& device : devices_) {
+      if (device.touch) {
+        error = "Touchscreen privacy input blocking is unavailable";
+        return false;
+      }
+      if (device.keyboard) {
+        // Preserve held local modifiers for the emergency chord independently
+        // of the releases sent to the master keyboard below.
+        XDevice* keyboard = XOpenDevice(display_, device.id);
+        XDeviceState* state =
+            keyboard ? XQueryDeviceState(display_, keyboard) : nullptr;
+        if (!state) {
+          if (keyboard) XCloseDevice(display_, keyboard);
+          error = "Cannot inspect held local keyboard input";
+          return false;
+        }
+        XInputClass* input = state->data;
+        for (int i = 0; i < state->num_classes; ++i) {
+          if (input->c_class == KeyClass) {
+            const auto* keys = reinterpret_cast<XKeyState*>(input);
+            for (int key = 0; key < 256; ++key)
+              keys_[device.id][key] = keys->keys[key / 8] & (1 << (key % 8));
+          }
+          input = reinterpret_cast<XInputClass*>(
+              reinterpret_cast<char*>(input) + input->length);
+        }
+        XFreeDeviceState(state);
+        XCloseDevice(display_, keyboard);
+      }
+      std::array<unsigned char, XIMaskLen(XI_LASTEVENT)> bits{};
+      for (int type : {XI_KeyPress, XI_KeyRelease, XI_ButtonPress,
+                       XI_ButtonRelease, XI_Motion})
+        XISetMask(bits.data(), type);
+      XIEventMask mask{device.id, static_cast<int>(bits.size()), bits.data()};
+      const int result = XIGrabDevice(
+          display_, device.id, DefaultRootWindow(display_), CurrentTime, None,
+          GrabModeAsync, GrabModeAsync, False, &mask);
+      if (result != GrabSuccess) {
+        error = "Cannot grab every local X11 input device";
+        return false;
+      }
+      grabbed_.push_back(device.id);
+    }
+    return ReleaseHeldInput(error);
+  }
+
+  bool ReleaseHeldInput(std::string& error) {
+    // Slave grabs float physical devices, but their previous presses can
+    // remain on the master. Release them after all grabs are installed so a
+    // held local Ctrl/button cannot alter the remote controller's next input.
+    int original_pointer = 0, count = 0;
+    XIGetClientPointer(display_, None, &original_pointer);
+    XIDeviceInfo* masters = XIQueryDevice(display_, XIAllMasterDevices, &count);
+    if (!masters) {
+      error = "Cannot inspect held X11 input";
+      return false;
+    }
+    x_error = 0;
+    bool ok = true;
+    for (int i = 0; i < count; ++i) {
+      if (masters[i].use != XIMasterPointer || !masters[i].enabled) continue;
+      XISetClientPointer(display_, None, masters[i].deviceid);
+      char keys[32]{};
+      XQueryKeymap(display_, keys);
+      for (int key = 8; key < 256; ++key)
+        if (keys[key / 8] & (1 << (key % 8)))
+          ok &= XTestFakeKeyEvent(display_, key, False, CurrentTime) != 0;
+      Window root = None, child = None;
+      double root_x = 0, root_y = 0, win_x = 0, win_y = 0;
+      XIButtonState buttons{};
+      XIModifierState modifiers{};
+      XIGroupState group{};
+      XIQueryPointer(display_, masters[i].deviceid, DefaultRootWindow(display_),
+                     &root, &child, &root_x, &root_y, &win_x, &win_y, &buttons,
+                     &modifiers, &group);
+      for (int button = 1; button < buttons.mask_len * 8; ++button)
+        if (XIMaskIsSet(buttons.mask, button))
+          ok &= XTestFakeButtonEvent(display_, button, False, CurrentTime) != 0;
+      if (buttons.mask) XFree(buttons.mask);
+      XSync(display_, False);
+      XQueryKeymap(display_, keys);
+      for (char pressed : keys) ok &= pressed == 0;
+      buttons = {};
+      XIQueryPointer(display_, masters[i].deviceid, DefaultRootWindow(display_),
+                     &root, &child, &root_x, &root_y, &win_x, &win_y, &buttons,
+                     &modifiers, &group);
+      for (int byte = 0; byte < buttons.mask_len; ++byte)
+        ok &= buttons.mask[byte] == 0;
+      if (buttons.mask) XFree(buttons.mask);
+    }
+    XIFreeDeviceInfo(masters);
+    if (original_pointer) XISetClientPointer(display_, None, original_pointer);
+    XSync(display_, False);
+    if (!ok || x_error) {
+      error = "Cannot release held X11 input for privacy";
+      return false;
+    }
+    return true;
+  }
+
+  void Key(int source, int keycode, bool down) {
+    if (keycode < 0 || keycode >= 256 ||
+        std::none_of(devices_.begin(), devices_.end(), [source](const auto& d) {
+          return d.id == source && d.keyboard;
+        }))
+      return;
+    keys_[source][keycode] = down;
+    bool ctrl = false, alt = false, shift = false;
+    for (const auto& [id, keys] : keys_) {
+      for (int code = 0; code < 256; ++code) {
+        if (!keys[code]) continue;
+        const KeySym symbol = XkbKeycodeToKeysym(display_, code, 0, 0);
+        ctrl |= symbol == XK_Control_L || symbol == XK_Control_R;
+        alt |= symbol == XK_Alt_L || symbol == XK_Alt_R;
+        shift |= symbol == XK_Shift_L || symbol == XK_Shift_R;
+      }
+    }
+    if (down && ctrl && alt && shift &&
+        XkbKeycodeToKeysym(display_, keycode, 0, 0) == XK_F12) {
+      reply_.emergency = true;
+      Recover();
+    }
+  }
+
+  void Check() {
+    checked_ = Clock::now();
+    std::string error;
+    std::vector<Output> current;
+    std::vector<Device> devices;
+    if (!ReadOutputs(current, false, error) || !ReadDevices(devices, error)) {
+      Fail(error);
+      return;
+    }
+    if (current.size() != outputs_.size() ||
+        !std::equal(
+            current.begin(), current.end(), outputs_.begin(),
+            [](const auto& a, const auto& b) { return a.SameLayout(b); })) {
+      Fail("Display topology changed; Linux privacy has been turned off");
+      return;
+    }
+    if (devices != devices_) {
+      Fail("Local input devices changed; Linux privacy has been turned off");
+      return;
+    }
+    x_error = 0;
+    for (const auto& output : outputs_) {
+      Gamma ramp(XRRGetCrtcGamma(display_, output.crtc), XRRFreeGamma);
+      if (!IsBlack(ramp.get())) {
+        Fail(
+            "Display gamma protection was changed; Linux privacy is "
+            "unavailable");
+        return;
+      }
+    }
+    XSync(display_, False);
+    if (x_error || XGetSelectionOwner(display_, selection_) != owner_)
+      Fail("Cannot verify Linux privacy protection");
+  }
+
+  Display* display_ = nullptr;
+  bool initialized_ = false;
+  bool blocking_ = false;
+  int xi_opcode_ = 0;
+  Atom xtest_property_ = None, selection_ = None;
+  Window owner_ = 0;
+  std::vector<Output> outputs_;
+  std::vector<Device> devices_;
+  std::vector<int> grabbed_;
+  std::vector<Window> hidden_roots_;
+  std::map<int, std::array<bool, 256>> keys_;
+  LinuxPrivacyReply reply_;
+  Clock::time_point checked_{};
+};
+}  // namespace
+
+int RunLinuxPrivacyGuard() {
+  const int socket = kLinuxPrivacyGuardSocket;
+  int type = 0;
+  socklen_t length = sizeof(type);
+  if (getsockopt(socket, SOL_SOCKET, SO_TYPE, &type, &length) != 0 ||
+      type != SOCK_SEQPACKET)
+    return 1;
+  fcntl(socket, F_SETFD, FD_CLOEXEC);
+  fcntl(socket, F_SETFL, O_NONBLOCK);
+  struct sigaction action {};
+  action.sa_handler = StopGuard;
+  sigemptyset(&action.sa_mask);
+  sigaction(SIGTERM, &action, nullptr);
+  sigaction(SIGINT, &action, nullptr);
+  sigaction(SIGHUP, &action, nullptr);
+  XSetErrorHandler(OnXError);
+  NativePrivacy privacy;
+  auto heartbeat = Clock::now();
+  bool connected = true;
+  bool dirty = false;
+  while (connected && !stopping) {
+    pollfd fds[] = {{socket, POLLIN, 0}, {privacy.Connection(), POLLIN, 0}};
+    poll(fds, 2, privacy.Reply().active ? 25 : 250);
+    if (fds[0].revents & (POLLERR | POLLHUP | POLLNVAL)) break;
+    for (int i = 0; i < 64; ++i) {
+      LinuxPrivacyCommand command;
+      const auto bytes = recv(socket, &command, sizeof(command), 0);
+      if (bytes < 0 &&
+          (errno == EAGAIN || errno == EWOULDBLOCK || errno == EINTR))
+        break;
+      if (bytes != sizeof(command)) {
+        connected = false;
+        break;
+      }
+      heartbeat = Clock::now();
+      switch (command) {
+        case LinuxPrivacyCommand::query:
+          if (!privacy.Reply().active) privacy.Query();
+          break;
+        case LinuxPrivacyCommand::enable:
+          privacy.Enable(false);
+          break;
+        case LinuxPrivacyCommand::enable_blocking:
+          privacy.Enable(true);
+          break;
+        case LinuxPrivacyCommand::recover:
+          privacy.Recover();
+          break;
+        case LinuxPrivacyCommand::heartbeat:
+          break;
+        default:
+          connected = false;
+          break;
+      }
+      dirty = true;
+    }
+    if (!connected || stopping) break;
+    const auto before = privacy.Reply();
+    privacy.Poll();
+    if (privacy.Reply().active &&
+        Clock::now() - heartbeat > std::chrono::seconds(3))
+      privacy.Fail(
+          "Privacy controller stopped responding; local desktop and input "
+          "restored");
+    const auto& after = privacy.Reply();
+    dirty |= before.active != after.active ||
+             before.recovered != after.recovered ||
+             before.emergency != after.emergency ||
+             std::strcmp(before.failure, after.failure) != 0;
+    if (dirty) {
+      const auto& reply = privacy.Reply();
+      if (send(socket, &reply, sizeof(reply), MSG_NOSIGNAL) == sizeof(reply)) {
+        dirty = false;
+        privacy.AcknowledgeEmergency();
+      } else if (errno != EAGAIN && errno != EWOULDBLOCK && errno != EINTR)
+        break;
+    }
+  }
+  // Keep trying if the X server temporarily rejected restoration, even after
+  // the parent exited. Disconnecting releases XI grabs and cursor hiding too.
+  do {
+    privacy.Recover();
+    if (!privacy.Reply().recovered) poll(nullptr, 0, 250);
+  } while (!privacy.Reply().recovered);
+  const auto& reply = privacy.Reply();
+  const auto ignored = send(socket, &reply, sizeof(reply), MSG_NOSIGNAL);
+  (void)ignored;
+  close(socket);
+  return 0;
+}
+}  // namespace crossdesk

apps/desktop/src/platform/linux/privacy/privacy_guard.h

@@ -0,0 +1,42 @@
+/*
+ * @Author: DI JUNKUN
+ * @Date: 2026-09-13
+ * Copyright (c) 2026 by DI JUNKUN, All Rights Reserved.
+ */
+
+#ifndef _PRIVACY_GUARD_H_
+#define _PRIVACY_GUARD_H_
+
+#include <cstdint>
+
+namespace crossdesk {
+
+inline constexpr char kLinuxPrivacyGuardArgument[] = "--linux-privacy-guard";
+inline constexpr int kLinuxPrivacyGuardSocket = 3;
+
+// Private protocol over an inherited SOCK_SEQPACKET socket. No listening
+// socket, shell, elevated privileges or separately installed helper is needed.
+enum class LinuxPrivacyCommand : uint8_t {
+  query,
+  enable,
+  enable_blocking,
+  recover,
+  heartbeat,
+};
+
+struct LinuxPrivacyReply {
+  uint64_t generation = 0;
+  bool supported = false;
+  bool input_supported = false;
+  bool active = false;
+  bool recovered = true;
+  bool emergency = false;
+  char capability_reason[256]{};
+  char failure[256]{};
+};
+
+int RunLinuxPrivacyGuard();
+
+}  // namespace crossdesk
+
+#endif

apps/desktop/src/platform/linux/screen_capturer/screen_capturer_drm.cpp

@@ -429,7 +429,7 @@ bool ScreenCapturerDrm::CaptureOutputFrame(const DrmOutput& output,
 
   if (emit_callback && callback_) {
     callback_(nv12.data(), static_cast<int>(nv12.size()), capture_width,
-              capture_height, output.stream_id.c_str());
+              capture_height, output.stream_id.c_str(), nullptr);
   }
 
   UnmapFramebuffer(mapped_ptr, mapped_size, prime_fd);

apps/desktop/src/platform/linux/screen_capturer/screen_capturer_linux.cpp

@@ -8,6 +8,7 @@
 
 #include <display_stream_id.h>
 #include "platform.h"
+#include "privacy_controller.h"
 #include "rd_log.h"
 #if defined(CROSSDESK_HAS_DRM) && CROSSDESK_HAS_DRM
 #include "screen_capturer_drm.h"
@@ -50,7 +51,8 @@ int ScreenCapturerLinux::Init(const int fps, cb_desktop_data cb) {
   fps_ = fps;
   callback_orig_ = std::move(cb);
   callback_ = [this](unsigned char* data, int size, int width, int height,
-                     const char* reported_stream_id) {
+                     const char* reported_stream_id,
+                     const MiniRtcNativeVideoFrame* native_frame) {
     const std::string mapped_stream_id = MapStreamId(reported_stream_id);
     if (mapped_stream_id.empty()) {
       if (!invalid_stream_id_logged_.exchange(true,
@@ -63,8 +65,16 @@ int ScreenCapturerLinux::Init(const int fps, cb_desktop_data cb) {
       return;
     }
     invalid_stream_id_logged_.store(false, std::memory_order_relaxed);
+    {
+      std::lock_guard lock(privacy_mutex_);
+      if (privacy_ && !capture_paused_ && !capture_announced_) {
+        capture_announced_ = true;
+        privacy_->CaptureChanged(true);
+      }
+    }
     if (callback_orig_) {
-      callback_orig_(data, size, width, height, mapped_stream_id.c_str());
+      callback_orig_(data, size, width, height, mapped_stream_id.c_str(),
+                     native_frame);
     }
   };
 
@@ -143,6 +153,7 @@ int ScreenCapturerLinux::Init(const int fps, cb_desktop_data cb) {
 }
 
 int ScreenCapturerLinux::Destroy() {
+  Stop();
   if (impl_) {
     impl_->Destroy();
     impl_.reset();
@@ -167,6 +178,11 @@ int ScreenCapturerLinux::Start(bool show_cursor) {
     return -1;
   }
 
+  {
+    std::lock_guard lock(privacy_mutex_);
+    capture_paused_ = false;
+  }
+
   // X11 output names, DRM connectors and Wayland stream handles may all change
   // after an HDMI hotplug, so rebuild the current backend before each session.
   const int refresh_ret = RefreshCurrentBackend();
@@ -224,6 +240,11 @@ int ScreenCapturerLinux::Stop() {
     return 0;
   }
   const int ret = impl_->Stop();
+  {
+    std::lock_guard lock(privacy_mutex_);
+    capture_announced_ = false;
+    if (privacy_) privacy_->CaptureChanged(false);
+  }
   UpdateAliasesFromBackend(impl_.get());
   return ret;
 }
@@ -232,13 +253,25 @@ int ScreenCapturerLinux::Pause(int monitor_index) {
   if (!impl_) {
     return -1;
   }
-  return impl_->Pause(monitor_index);
+  const int ret = impl_->Pause(monitor_index);
+  {
+    // An in-flight frame must not announce running again after a pause.
+    std::lock_guard lock(privacy_mutex_);
+    capture_paused_ = true;
+    capture_announced_ = false;
+    if (privacy_) privacy_->CaptureChanged(false);
+  }
+  return ret;
 }
 
 int ScreenCapturerLinux::Resume(int monitor_index) {
   if (!impl_) {
     return -1;
   }
+  {
+    std::lock_guard lock(privacy_mutex_);
+    capture_paused_ = false;
+  }
   return impl_->Resume(monitor_index);
 }
 

apps/desktop/src/platform/linux/screen_capturer/screen_capturer_linux.h

@@ -25,6 +25,7 @@ class ScreenCapturerLinux : public ScreenCapturer {
 
  public:
   int Init(const int fps, cb_desktop_data cb) override;
+  void SetPrivacyController(PrivacyController* privacy) override { privacy_ = privacy; }
   int Destroy() override;
   int Start(bool show_cursor) override;
   int Stop() override;
@@ -53,6 +54,10 @@ class ScreenCapturerLinux : public ScreenCapturer {
 
  private:
   std::unique_ptr<ScreenCapturer> impl_;
+  PrivacyController* privacy_ = nullptr;
+  std::mutex privacy_mutex_;
+  bool capture_announced_ = false;
+  bool capture_paused_ = false;
   BackendType backend_ = BackendType::kNone;
   int fps_ = 60;
   cb_desktop_data callback_;

apps/desktop/src/platform/linux/screen_capturer/screen_capturer_wayland_pipewire.cpp

@@ -1047,7 +1047,7 @@ void ScreenCapturerWayland::HandlePipeWireBuffer() {
   if (callback_) {
     const std::string stream_id = MakeDisplayStreamId(0);
     callback_(nv12.data(), static_cast<int>(nv12.size()), even_width,
-              even_height, stream_id.c_str());
+              even_height, stream_id.c_str(), nullptr);
   }
   pipewire_last_frame_ms_.store(NowMs());
 

apps/desktop/src/platform/linux/screen_capturer/screen_capturer_x11.cpp

@@ -321,7 +321,7 @@ void ScreenCapturerX11::OnFrame() {
   if (callback_) {
     const std::string stream_id = MakeDisplayStreamId(monitor_index);
     callback_(nv12.data(), width_ * height_ * 3 / 2, width_, height_,
-              stream_id.c_str());
+              stream_id.c_str(), nullptr);
   }
 
   XDestroyImage(image);

apps/desktop/src/platform/linux/speaker_capturer/speaker_capturer_linux.cpp

@@ -3,269 +3,240 @@
 #include <pulse/error.h>
 #include <pulse/introspect.h>
 
-#include <condition_variable>
-#include <iostream>
-#include <thread>
+#include <string>
+#include <utility>
 
 #include "rd_log.h"
 
 namespace crossdesk {
-
-constexpr int kSampleRate = 48000;
-constexpr pa_sample_format_t kFormat = PA_SAMPLE_S16LE;
-constexpr int kChannels = 1;
+namespace {
 constexpr size_t kFrameSizeBytes = 480 * sizeof(int16_t);
+constexpr auto kStartupTimeout = std::chrono::seconds(2);
+constexpr auto kPollInterval = std::chrono::milliseconds(5);
 
-SpeakerCapturerLinux::SpeakerCapturerLinux()
-    : inited_(false), paused_(false), stop_flag_(false) {}
-SpeakerCapturerLinux::~SpeakerCapturerLinux() {
-  Stop();
-  Destroy();
+void ReleaseOperation(pa_operation* operation) {
+  if (!operation) return;
+  if (pa_operation_get_state(operation) == PA_OPERATION_RUNNING)
+    pa_operation_cancel(operation);
+  pa_operation_unref(operation);
 }
+}  // namespace
+
+SpeakerCapturerLinux::~SpeakerCapturerLinux() { Destroy(); }
 
 int SpeakerCapturerLinux::Init(speaker_data_cb cb) {
   if (inited_) return 0;
-  cb_ = cb;
+  cb_ = std::move(cb);
   inited_ = true;
   return 0;
 }
 
-int SpeakerCapturerLinux::Destroy() {
-  inited_ = false;
-  return 0;
+// Use nonblocking iterations instead of pa_threaded_mainloop_wait(): a server
+// that never replies, disappears, or never reaches STREAM_READY must not leave
+// startup/Stop waiting for a signal that will never be delivered.
+bool SpeakerCapturerLinux::PumpUntil(
+    const std::function<bool()>& ready,
+    std::chrono::steady_clock::time_point deadline) {
+  while (!stop_flag_) {
+    if (ready()) return true;
+    if (std::chrono::steady_clock::now() >= deadline ||
+        !PA_CONTEXT_IS_GOOD(pa_context_get_state(context_)))
+      return false;
+    if (pa_mainloop_iterate(mainloop_, 0, nullptr) < 0) return false;
+    std::this_thread::sleep_for(kPollInterval);
+  }
+  return false;
 }
 
-std::string SpeakerCapturerLinux::GetDefaultMonitorSourceName() {
-  std::string monitor_name;
-  std::mutex mtx;
-  std::condition_variable cv;
-  bool ready = false;
+bool SpeakerCapturerLinux::Prepare() {
+  const auto deadline = std::chrono::steady_clock::now() + kStartupTimeout;
+  mainloop_ = pa_mainloop_new();
+  if (!mainloop_) return false;
+  context_ =
+      pa_context_new(pa_mainloop_get_api(mainloop_), "CrossDesk system audio");
+  if (!context_ ||
+      pa_context_connect(context_, nullptr, PA_CONTEXT_NOFLAGS, nullptr) < 0)
+    return false;
+  if (!PumpUntil(
+          [&] { return pa_context_get_state(context_) == PA_CONTEXT_READY; },
+          deadline))
+    return false;
 
-  pa_mainloop* mainloop = pa_mainloop_new();
-  pa_mainloop_api* api = pa_mainloop_get_api(mainloop);
-  pa_context* context = pa_context_new(api, "GetMonitor");
-
-  struct CallbackState {
-    std::string* name;
-    std::mutex* mtx;
-    std::condition_variable* cv;
-    bool* ready;
-  } state{&monitor_name, &mtx, &cv, &ready};
-
-  pa_context_set_state_callback(
-      context,
-      [](pa_context* c, void* userdata) {
-        auto* state = static_cast<CallbackState*>(userdata);
-        if (pa_context_get_state(c) == PA_CONTEXT_READY) {
-          pa_operation* operation = pa_context_get_server_info(
-              c,
-              [](pa_context*, const pa_server_info* info, void* userdata) {
-                auto* state = static_cast<CallbackState*>(userdata);
-                if (info && info->default_sink_name) {
-                  *(state->name) =
-                      std::string(info->default_sink_name) + ".monitor";
-                }
-                {
-                  std::lock_guard<std::mutex> lock(*(state->mtx));
-                  *(state->ready) = true;
-                }
-                state->cv->notify_one();
-              },
-              userdata);
-          if (operation) {
-            pa_operation_unref(operation);
-          }
-        }
+  struct ServerResult {
+    bool done = false;
+    std::string sink;
+  } server;
+  pa_operation* operation = pa_context_get_server_info(
+      context_,
+      [](pa_context*, const pa_server_info* info, void* data) {
+        auto& result = *static_cast<ServerResult*>(data);
+        if (info && info->default_sink_name)
+          result.sink = info->default_sink_name;
+        result.done = true;
       },
-      &state);
+      &server);
+  const bool got_server =
+      operation && PumpUntil([&] { return server.done; }, deadline);
+  ReleaseOperation(operation);
+  if (!got_server || server.sink.empty()) return false;
 
-  pa_context_connect(context, nullptr, PA_CONTEXT_NOFLAGS, nullptr);
+  // Query the actual monitor name; a changed/default device need not follow
+  // the "<sink>.monitor" naming convention.
+  struct SinkResult {
+    bool done = false;
+    std::string monitor;
+  } sink;
+  operation = pa_context_get_sink_info_by_name(
+      context_, server.sink.c_str(),
+      [](pa_context*, const pa_sink_info* info, int eol, void* data) {
+        auto& result = *static_cast<SinkResult*>(data);
+        if (info && info->monitor_source_name)
+          result.monitor = info->monitor_source_name;
+        if (eol != 0) result.done = true;
+      },
+      &sink);
+  const bool got_sink =
+      operation && PumpUntil([&] { return sink.done; }, deadline);
+  ReleaseOperation(operation);
+  if (!got_sink || sink.monitor.empty()) return false;
 
-  std::thread loop_thread([&]() {
-    int ret = 0;
-    pa_mainloop_run(mainloop, &ret);
-  });
+  const pa_sample_spec spec{PA_SAMPLE_S16LE, 48000, 1};
+  stream_ = pa_stream_new(context_, "System audio", &spec, nullptr);
+  if (!stream_) return false;
+  pa_stream_set_read_callback(
+      stream_,
+      [](pa_stream* stream, size_t, void* data) {
+        static_cast<SpeakerCapturerLinux*>(data)->ReadAudio(stream);
+      },
+      this);
+  pa_buffer_attr attr{};
+  attr.maxlength = static_cast<uint32_t>(-1);
+  attr.fragsize = static_cast<uint32_t>(kFrameSizeBytes);
+  if (pa_stream_connect_record(stream_, sink.monitor.c_str(), &attr,
+                               PA_STREAM_ADJUST_LATENCY) < 0)
+    return false;
+  if (!PumpUntil(
+          [&] {
+            const auto state = pa_stream_get_state(stream_);
+            return state == PA_STREAM_READY || !PA_STREAM_IS_GOOD(state);
+          },
+          deadline) ||
+      pa_stream_get_state(stream_) != PA_STREAM_READY)
+    return false;
+  LOG_INFO("System audio monitor ready: {}", sink.monitor);
+  return true;
+}
 
+void SpeakerCapturerLinux::Run() {
+  const bool ready = Prepare();
+  running_ = ready && !stop_flag_;
   {
-    std::unique_lock<std::mutex> lock(mtx);
-    cv.wait_for(lock, std::chrono::seconds(2), [&] { return ready; });
+    std::lock_guard<std::mutex> lock(state_mtx_);
+    startup_success_ = running_;
+    startup_done_ = true;
   }
-
-  pa_context_disconnect(context);
-  pa_context_unref(context);
-  pa_mainloop_quit(mainloop, 0);
-  loop_thread.join();
-  pa_mainloop_free(mainloop);
-
-  return monitor_name;
+  startup_wake_.notify_one();
+  if (!ready && !stop_flag_) {
+    LOG_ERROR(
+        "PulseAudio capture startup failed or timed out: {}",
+        context_ ? pa_strerror(pa_context_errno(context_)) : "no context");
+  }
+  while (running_ && !stop_flag_) {
+    if (pa_mainloop_iterate(mainloop_, 0, nullptr) < 0 ||
+        pa_context_get_state(context_) != PA_CONTEXT_READY ||
+        pa_stream_get_state(stream_) != PA_STREAM_READY)
+      break;
+    std::this_thread::sleep_for(kPollInterval);
+  }
+  running_ = false;
+  Cleanup();
 }
 
 int SpeakerCapturerLinux::Start() {
-  if (!inited_ || mainloop_thread_.joinable()) return -1;
+  if (!inited_) return -1;
+  if (IsRunning()) return 0;
+  Stop();
   stop_flag_ = false;
-
-  mainloop_thread_ = std::thread([this]() {
-    std::string monitor_name = GetDefaultMonitorSourceName();
-    if (monitor_name.empty()) {
-      LOG_ERROR("Failed to get monitor source");
-      return;
-    }
-
-    mainloop_ = pa_threaded_mainloop_new();
-    pa_mainloop_api* api = pa_threaded_mainloop_get_api(mainloop_);
-    context_ = pa_context_new(api, "SpeakerCapturer");
-
-    pa_context_set_state_callback(
-        context_,
-        [](pa_context* c, void* userdata) {
-          auto self = static_cast<SpeakerCapturerLinux*>(userdata);
-          pa_context_state_t state = pa_context_get_state(c);
-          if (state == PA_CONTEXT_READY || state == PA_CONTEXT_FAILED ||
-              state == PA_CONTEXT_TERMINATED) {
-            pa_threaded_mainloop_signal(self->mainloop_, 0);
-          }
-        },
-        this);
-
-    if (pa_threaded_mainloop_start(mainloop_) < 0) {
-      LOG_ERROR("Failed to start mainloop");
-      Cleanup();
-      return;
-    }
-
-    pa_threaded_mainloop_lock(mainloop_);
-
-    if (pa_context_connect(context_, nullptr, PA_CONTEXT_NOFLAGS, nullptr) <
-        0) {
-      LOG_ERROR("Failed to connect context");
-      pa_threaded_mainloop_unlock(mainloop_);
-      Cleanup();
-      return;
-    }
-
-    while (true) {
-      pa_context_state_t state = pa_context_get_state(context_);
-      if (state == PA_CONTEXT_READY) break;
-      if (!PA_CONTEXT_IS_GOOD(state) || stop_flag_) {
-        pa_threaded_mainloop_unlock(mainloop_);
-        Cleanup();
-        return;
-      }
-      pa_threaded_mainloop_wait(mainloop_);
-    }
-
-    pa_sample_spec ss = {kFormat, kSampleRate, kChannels};
-    stream_ = pa_stream_new(context_, "Capture", &ss, nullptr);
-
-    pa_stream_set_read_callback(
-        stream_,
-        [](pa_stream* s, size_t len, void* u) {
-          auto self = static_cast<SpeakerCapturerLinux*>(u);
-          if (self->paused_ || self->stop_flag_) return;
-
-          const void* data = nullptr;
-          if (pa_stream_peek(s, &data, &len) < 0 || !data) return;
-
-          const uint8_t* p = static_cast<const uint8_t*>(data);
-          self->frame_cache_.insert(self->frame_cache_.end(), p, p + len);
-
-          while (self->frame_cache_.size() >= kFrameSizeBytes) {
-            std::vector<uint8_t> temp_frame(
-                self->frame_cache_.begin(),
-                self->frame_cache_.begin() + kFrameSizeBytes);
-            self->cb_(temp_frame.data(), kFrameSizeBytes, "audio");
-            self->frame_cache_.erase(
-                self->frame_cache_.begin(),
-                self->frame_cache_.begin() + kFrameSizeBytes);
-          }
-
-          pa_stream_drop(s);
-        },
-        this);
-
-    pa_buffer_attr attr = {.maxlength = (uint32_t)-1,
-                           .tlength = 0,
-                           .prebuf = 0,
-                           .minreq = 0,
-                           .fragsize = (uint32_t)kFrameSizeBytes};
-
-    if (pa_stream_connect_record(stream_, monitor_name.c_str(), &attr,
-                                 PA_STREAM_ADJUST_LATENCY) < 0) {
-      LOG_ERROR("Failed to connect stream");
-      pa_threaded_mainloop_unlock(mainloop_);
-      Cleanup();
-      return;
-    }
-
-    while (true) {
-      pa_stream_state_t s = pa_stream_get_state(stream_);
-      if (s == PA_STREAM_READY) break;
-      if (!PA_STREAM_IS_GOOD(s) || stop_flag_) {
-        pa_threaded_mainloop_unlock(mainloop_);
-        Cleanup();
-        return;
-      }
-      pa_threaded_mainloop_wait(mainloop_);
-    }
-
-    pa_threaded_mainloop_unlock(mainloop_);
-
-    while (!stop_flag_)
-      std::this_thread::sleep_for(std::chrono::milliseconds(100));
-  });
-
+  paused_ = false;
+  {
+    std::lock_guard<std::mutex> lock(state_mtx_);
+    startup_done_ = false;
+    startup_success_ = false;
+  }
+  mainloop_thread_ = std::thread([this] { Run(); });
+  std::unique_lock<std::mutex> lock(state_mtx_);
+  const bool started =
+      startup_wake_.wait_for(lock, kStartupTimeout + std::chrono::seconds(1),
+                             [&] { return startup_done_; }) &&
+      startup_success_;
+  lock.unlock();
+  if (!started) {
+    Stop();
+    return -1;
+  }
   return 0;
 }
 
 int SpeakerCapturerLinux::Stop() {
   stop_flag_ = true;
-
-  if (mainloop_) {
-    pa_threaded_mainloop_lock(mainloop_);
-    pa_threaded_mainloop_signal(mainloop_, 0);
-    pa_threaded_mainloop_unlock(mainloop_);
-  }
-
-  if (mainloop_thread_.joinable()) {
-    mainloop_thread_.join();
-  }
-
-  Cleanup();
+  if (mainloop_thread_.joinable()) mainloop_thread_.join();
+  running_ = false;
   return 0;
 }
 
+int SpeakerCapturerLinux::Destroy() {
+  Stop();
+  cb_ = nullptr;
+  inited_ = false;
+  return 0;
+}
+
+void SpeakerCapturerLinux::ReadAudio(pa_stream* stream) {
+  const void* data = nullptr;
+  size_t size = 0;
+  if (pa_stream_peek(stream, &data, &size) < 0 || size == 0) return;
+  if (data && !paused_ && !stop_flag_ && cb_) {
+    const auto* bytes = static_cast<const uint8_t*>(data);
+    frame_cache_.insert(frame_cache_.end(), bytes, bytes + size);
+    size_t consumed = 0;
+    while (!stop_flag_ && frame_cache_.size() - consumed >= kFrameSizeBytes) {
+      cb_(frame_cache_.data() + consumed, kFrameSizeBytes, "audio");
+      consumed += kFrameSizeBytes;
+    }
+    frame_cache_.erase(frame_cache_.begin(), frame_cache_.begin() + consumed);
+  } else {
+    frame_cache_.clear();
+  }
+  // Drop holes and paused data too, otherwise the read queue cannot advance.
+  pa_stream_drop(stream);
+}
+
 void SpeakerCapturerLinux::Cleanup() {
+  if (stream_) {
+    pa_stream_set_read_callback(stream_, nullptr, nullptr);
+    pa_stream_disconnect(stream_);
+    pa_stream_unref(stream_);
+    stream_ = nullptr;
+  }
+  if (context_) {
+    pa_context_disconnect(context_);
+    pa_context_unref(context_);
+    context_ = nullptr;
+  }
   if (mainloop_) {
-    pa_threaded_mainloop_stop(mainloop_);
-    pa_threaded_mainloop_lock(mainloop_);
-
-    if (stream_) {
-      pa_stream_disconnect(stream_);
-      pa_stream_unref(stream_);
-      stream_ = nullptr;
-    }
-
-    if (context_) {
-      pa_context_disconnect(context_);
-      pa_context_unref(context_);
-      context_ = nullptr;
-    }
-
-    pa_threaded_mainloop_unlock(mainloop_);
-    pa_threaded_mainloop_free(mainloop_);
+    pa_mainloop_free(mainloop_);
     mainloop_ = nullptr;
   }
-
   frame_cache_.clear();
 }
 
+bool SpeakerCapturerLinux::IsRunning() const { return running_; }
 int SpeakerCapturerLinux::Pause() {
   paused_ = true;
   return 0;
 }
-
 int SpeakerCapturerLinux::Resume() {
   paused_ = false;
   return 0;
 }
-}  // namespace crossdesk
+}  // namespace crossdesk

apps/desktop/src/platform/linux/speaker_capturer/speaker_capturer_linux.h

@@ -4,53 +4,59 @@
  * Copyright (c) 2025 by DI JUNKUN, All Rights Reserved.
  */
 
-#ifndef _SPEAKER_CAPTURER_LINUX_H_
-#define _SPEAKER_CAPTURER_LINUX_H_
+#ifndef CROSSDESK_SPEAKER_CAPTURER_LINUX_H_
+#define CROSSDESK_SPEAKER_CAPTURER_LINUX_H_
 
 #include <pulse/pulseaudio.h>
 
 #include <atomic>
+#include <chrono>
+#include <condition_variable>
 #include <functional>
 #include <mutex>
-#include <string>
 #include <thread>
 #include <vector>
 
 #include "speaker_capturer.h"
 
 namespace crossdesk {
-
 class SpeakerCapturerLinux : public SpeakerCapturer {
  public:
-  SpeakerCapturerLinux();
-  ~SpeakerCapturerLinux();
-
+  SpeakerCapturerLinux() = default;
+  ~SpeakerCapturerLinux() override;
   int Init(speaker_data_cb cb) override;
   int Destroy() override;
   int Start() override;
   int Stop() override;
-
+  bool IsRunning() const override;
   int Pause();
   int Resume();
 
  private:
-  std::string GetDefaultMonitorSourceName();
+  void Run();
+  bool Prepare();
+  bool PumpUntil(const std::function<bool()>& ready,
+                 std::chrono::steady_clock::time_point deadline);
   void Cleanup();
+  void ReadAudio(pa_stream* stream);
 
- private:
-  speaker_data_cb cb_ = nullptr;
-
-  std::atomic<bool> inited_;
-  std::atomic<bool> paused_;
-  std::atomic<bool> stop_flag_;
-
+  speaker_data_cb cb_;
+  bool inited_ = false;
+  std::atomic<bool> paused_{false};
+  std::atomic<bool> stop_flag_{false};
+  std::atomic<bool> running_{false};
   std::thread mainloop_thread_;
-  pa_threaded_mainloop* mainloop_ = nullptr;
+  std::mutex state_mtx_;
+  std::condition_variable startup_wake_;
+  bool startup_done_ = false;
+  bool startup_success_ = false;
+
+  // These objects are created, driven and freed exclusively by Run(). Stop
+  // only changes an atomic flag and joins, never races PulseAudio callbacks.
+  pa_mainloop* mainloop_ = nullptr;
   pa_context* context_ = nullptr;
   pa_stream* stream_ = nullptr;
-
-  std::mutex state_mtx_;
   std::vector<uint8_t> frame_cache_;
 };
 }  // namespace crossdesk
-#endif
+#endif

apps/desktop/src/platform/macos/gui/metal_video_renderer.h

@@ -12,11 +12,11 @@
 
 namespace crossdesk {
 
-// macOS video compositor used by CrossDesk only. MiniRTC continues to expose
-// tightly packed CPU NV12 frames; this renderer performs the single required
-// copy into shared Metal buffers and converts NV12 to RGB in the fragment
-// shader. AppKit attachment and rendering are main-thread operations, while
-// SubmitNv12() is safe to call from MiniRTC's decode callback thread.
+// macOS video compositor used by CrossDesk only. VideoToolbox CVPixelBuffers
+// are sampled directly through CVMetalTextureCache; packed CPU NV12 remains a
+// fallback for software decoding and cached snapshots. AppKit attachment and
+// rendering are main-thread operations, while frame submission is safe from
+// MiniRTC's decode callback thread.
 class MacMetalVideoRenderer final : public VideoRenderer {
  public:
   MacMetalVideoRenderer();
@@ -37,6 +37,11 @@ class MacMetalVideoRenderer final : public VideoRenderer {
   SubmitResult SubmitNv12(std::string_view remote_id, const uint8_t* data,
                           size_t size, int width, int height) override;
 
+  // Retains an IOSurface-backed VideoToolbox CVPixelBuffer until the Metal
+  // command buffer using it has completed.
+  SubmitResult SubmitNativeFrame(std::string_view remote_id,
+                                 const MiniRtcNativeVideoFrame& frame) override;
+
   // Seeds a newly selected stream from its retained CPU snapshot without
   // replacing a newer decoded frame that is already queued or rendering.
   SubmitResult SubmitCachedNv12(std::string_view remote_id,

apps/desktop/src/platform/macos/gui/metal_video_renderer.mm

@@ -1,6 +1,7 @@
 #include "platform/macos/gui/metal_video_renderer.h"
 
 #import <AppKit/AppKit.h>
+#import <CoreVideo/CVMetalTextureCache.h>
 #import <Metal/Metal.h>
 #import <QuartzCore/CAMetalLayer.h>
 
@@ -194,6 +195,74 @@ namespace {
 
 constexpr size_t kFrameSlotCount = 3;
 
+class NativeVideoFrameRef {
+ public:
+  NativeVideoFrameRef() = default;
+
+  explicit NativeVideoFrameRef(const MiniRtcNativeVideoFrame* frame) {
+    if (frame && frame->owner && frame->retain && frame->release) {
+      frame_ = *frame;
+      frame_.struct_size = sizeof(frame_);
+      frame_.retain(frame_.owner);
+      valid_ = true;
+    }
+  }
+
+  NativeVideoFrameRef(const NativeVideoFrameRef& other)
+      : NativeVideoFrameRef(other.Get()) {}
+
+  NativeVideoFrameRef(NativeVideoFrameRef&& other) noexcept
+      : frame_(other.frame_), valid_(std::exchange(other.valid_, false)) {
+    other.frame_ = {};
+  }
+
+  NativeVideoFrameRef& operator=(NativeVideoFrameRef other) noexcept {
+    Swap(other);
+    return *this;
+  }
+
+  ~NativeVideoFrameRef() { Reset(); }
+
+  void Reset() {
+    if (valid_ && frame_.owner && frame_.release) {
+      frame_.release(frame_.owner);
+    }
+    frame_ = {};
+    valid_ = false;
+  }
+
+  void Swap(NativeVideoFrameRef& other) noexcept {
+    std::swap(frame_, other.frame_);
+    std::swap(valid_, other.valid_);
+  }
+
+  const MiniRtcNativeVideoFrame* Get() const {
+    return valid_ ? &frame_ : nullptr;
+  }
+  explicit operator bool() const { return valid_; }
+
+ private:
+  MiniRtcNativeVideoFrame frame_{};
+  bool valid_ = false;
+};
+
+const MiniRtcNativeVideoFrame* GetMacNativeFrame(
+    const MiniRtcNativeVideoFrame& frame) {
+  const MiniRtcNativeVideoFrame* native = &frame;
+  if (native->struct_size < static_cast<uint32_t>(sizeof(*native)) ||
+      native->type != MiniRtcNativeVideoFrameCVPixelBuffer ||
+      !native->payload.cv_pixel_buffer || !native->owner || !native->retain ||
+      !native->release || !native->copy_to_nv12 || native->width == 0 ||
+      native->height == 0 || (native->width & 1U) != 0 ||
+      (native->height & 1U) != 0 ||
+      native->width > static_cast<uint32_t>(std::numeric_limits<int>::max()) ||
+      native->height >
+          static_cast<uint32_t>(std::numeric_limits<int>::max())) {
+    return nullptr;
+  }
+  return native;
+}
+
 // Slint's winit backend creates AppKit windows with transparent backing so
 // transparent Slint items can be composited. Keep the content out of the
 // titlebar and choose whether AppKit's material or the semantic window color
@@ -262,6 +331,9 @@ struct FrameSlot {
   id<MTLBuffer> uv_buffer = nil;
   id<MTLTexture> y_texture = nil;
   id<MTLTexture> uv_texture = nil;
+  CVMetalTextureRef y_cv_texture = nullptr;
+  CVMetalTextureRef uv_cv_texture = nullptr;
+  NativeVideoFrameRef native_frame;
   size_t y_stride = 0;
   size_t uv_stride = 0;
   int width = 0;
@@ -274,6 +346,15 @@ struct FrameSlot {
   void ReleaseResources() {
     y_texture = nil;
     uv_texture = nil;
+    if (y_cv_texture) {
+      CFRelease(y_cv_texture);
+      y_cv_texture = nullptr;
+    }
+    if (uv_cv_texture) {
+      CFRelease(uv_cv_texture);
+      uv_cv_texture = nullptr;
+    }
+    native_frame.Reset();
     y_buffer = nil;
     uv_buffer = nil;
     y_stride = 0;
@@ -390,7 +471,7 @@ fragment half4 nv12_fragment(
                                 - 16.0 / 255.0);
   const float2 uv = uv_texture.sample(video_sampler, in.texcoord).rg - 0.5;
   // BT.601 limited-range NV12, matching the previous libyuv NV12ToABGR/RAW
-  // path. MiniRTC's current XVideoFrame API does not carry color metadata, so
+  // path. MiniRTC's current MiniRtcVideoFrame API does not carry color metadata, so
   // retaining the established matrix avoids a platform-only color change.
   const float3 rgb = float3(y + 1.59602678 * uv.y,
                             y - 0.39176229 * uv.x - 0.81296764 * uv.y,
@@ -406,6 +487,7 @@ struct MacMetalVideoRenderer::Impl {
   id<MTLDevice> device = nil;
   id<MTLCommandQueue> command_queue = nil;
   id<MTLRenderPipelineState> pipeline = nil;
+  CVMetalTextureCacheRef texture_cache = nullptr;
   std::shared_ptr<SharedFrameState> frames =
       std::make_shared<SharedFrameState>();
   NSView* slint_view = nil;
@@ -417,6 +499,8 @@ struct MacMetalVideoRenderer::Impl {
   uint64_t rendered_content_generation = 0;
   std::shared_ptr<std::atomic<bool>> native_surface_needs_redraw =
       std::make_shared<std::atomic<bool>>(true);
+  std::atomic<bool> native_path_logged{false};
+  std::atomic<bool> native_fallback_logged{false};
 
   Impl() {
     @autoreleasepool {
@@ -430,6 +514,12 @@ struct MacMetalVideoRenderer::Impl {
         LOG_ERROR("Metal video renderer unavailable: command queue creation failed");
         return;
       }
+      const CVReturn cache_status = CVMetalTextureCacheCreate(
+          kCFAllocatorDefault, nullptr, device, nullptr, &texture_cache);
+      if (cache_status != kCVReturnSuccess || !texture_cache) {
+        LOG_WARN("Metal video renderer could not create CV texture cache: {}",
+                 cache_status);
+      }
 
       NSError* library_error = nil;
       id<MTLLibrary> library =
@@ -466,6 +556,11 @@ struct MacMetalVideoRenderer::Impl {
   ~Impl() {
     DetachViews();
     frames.reset();
+    if (texture_cache) {
+      CVMetalTextureCacheFlush(texture_cache, 0);
+      CFRelease(texture_cache);
+      texture_cache = nullptr;
+    }
   }
 
   bool Ready() const {
@@ -655,6 +750,142 @@ MacMetalVideoRenderer::SubmitResult MacMetalVideoRenderer::SubmitNv12(
   return SubmitNv12Internal(remote_id, data, size, width, height, true);
 }
 
+MacMetalVideoRenderer::SubmitResult MacMetalVideoRenderer::SubmitNativeFrame(
+    std::string_view remote_id, const MiniRtcNativeVideoFrame& frame) {
+  if (!IsReady()) {
+    return SubmitResult::failed;
+  }
+  const MiniRtcNativeVideoFrame* native = GetMacNativeFrame(frame);
+  if (!native) {
+    return SubmitResult::failed;
+  }
+
+  {
+    std::lock_guard lock(impl_->frames->mutex);
+    if (impl_->frames->selected_stream != remote_id) {
+      return SubmitResult::not_selected;
+    }
+  }
+
+  const int width = static_cast<int>(native->width);
+  const int height = static_cast<int>(native->height);
+  const auto submit_cpu_fallback = [&]() {
+    if (!impl_->native_fallback_logged.exchange(true,
+                                                std::memory_order_acq_rel)) {
+      LOG_WARN("macOS native CVPixelBuffer upload unavailable; using CPU NV12 "
+               "fallback");
+    }
+    const size_t y_size = static_cast<size_t>(width) * height;
+    std::vector<unsigned char> packed_nv12(y_size + y_size / 2);
+    if (native->copy_to_nv12(native->owner, packed_nv12.data(),
+                             packed_nv12.size()) != 0) {
+      return SubmitResult::failed;
+    }
+    return SubmitNv12(remote_id, packed_nv12.data(), packed_nv12.size(), width,
+                      height);
+  };
+
+  CVPixelBufferRef pixel_buffer =
+      static_cast<CVPixelBufferRef>(native->payload.cv_pixel_buffer);
+  const OSType pixel_format = CVPixelBufferGetPixelFormatType(pixel_buffer);
+  if (!CVPixelBufferIsPlanar(pixel_buffer) ||
+      CVPixelBufferGetPlaneCount(pixel_buffer) < 2 ||
+      CVPixelBufferGetWidth(pixel_buffer) != native->width ||
+      CVPixelBufferGetHeight(pixel_buffer) != native->height ||
+      (pixel_format != kCVPixelFormatType_420YpCbCr8BiPlanarVideoRange &&
+       pixel_format != kCVPixelFormatType_420YpCbCr8BiPlanarFullRange)) {
+    return submit_cpu_fallback();
+  }
+
+  NativeVideoFrameRef retained(native);
+  if (!retained || !impl_->texture_cache) {
+    return submit_cpu_fallback();
+  }
+
+  CVMetalTextureRef y_cv_texture = nullptr;
+  CVReturn y_status = CVMetalTextureCacheCreateTextureFromImage(
+      kCFAllocatorDefault, impl_->texture_cache, pixel_buffer, nullptr,
+      MTLPixelFormatR8Unorm, native->width, native->height, 0,
+      &y_cv_texture);
+  if (y_status != kCVReturnSuccess || !y_cv_texture) {
+    return submit_cpu_fallback();
+  }
+
+  CVMetalTextureRef uv_cv_texture = nullptr;
+  CVReturn uv_status = CVMetalTextureCacheCreateTextureFromImage(
+      kCFAllocatorDefault, impl_->texture_cache, pixel_buffer, nullptr,
+      MTLPixelFormatRG8Unorm, native->width / 2U, native->height / 2U, 1,
+      &uv_cv_texture);
+  if (uv_status != kCVReturnSuccess || !uv_cv_texture) {
+    CFRelease(y_cv_texture);
+    return submit_cpu_fallback();
+  }
+
+  id<MTLTexture> y_texture = CVMetalTextureGetTexture(y_cv_texture);
+  id<MTLTexture> uv_texture = CVMetalTextureGetTexture(uv_cv_texture);
+  if (y_texture == nil || uv_texture == nil) {
+    CFRelease(y_cv_texture);
+    CFRelease(uv_cv_texture);
+    return submit_cpu_fallback();
+  }
+
+  auto& frames = *impl_->frames;
+  std::lock_guard lock(frames.mutex);
+  if (frames.selected_stream != remote_id) {
+    CFRelease(y_cv_texture);
+    CFRelease(uv_cv_texture);
+    return SubmitResult::not_selected;
+  }
+
+  // Latest-frame-only queue: replace an unconsumed decoded frame to bound
+  // latency, while never recycling a frame still referenced by the GPU.
+  FrameSlot* target = nullptr;
+  for (auto& slot : frames.slots) {
+    if (slot.use == SlotUse::pending) {
+      target = &slot;
+      break;
+    }
+  }
+  if (!target) {
+    uint64_t oldest_sequence = std::numeric_limits<uint64_t>::max();
+    for (auto& slot : frames.slots) {
+      if (slot.use != SlotUse::available) {
+        continue;
+      }
+      if (!slot.valid) {
+        target = &slot;
+        break;
+      }
+      if (slot.sequence < oldest_sequence) {
+        oldest_sequence = slot.sequence;
+        target = &slot;
+      }
+    }
+  }
+  if (!target) {
+    CFRelease(y_cv_texture);
+    CFRelease(uv_cv_texture);
+    return SubmitResult::dropped;
+  }
+
+  target->ReleaseResources();
+  target->y_cv_texture = y_cv_texture;
+  target->uv_cv_texture = uv_cv_texture;
+  target->y_texture = y_texture;
+  target->uv_texture = uv_texture;
+  target->native_frame = std::move(retained);
+  target->width = width;
+  target->height = height;
+  target->remote_id.assign(remote_id);
+  target->sequence = frames.next_sequence++;
+  target->use = SlotUse::pending;
+  target->valid = true;
+  if (!impl_->native_path_logged.exchange(true, std::memory_order_acq_rel)) {
+    LOG_INFO("macOS VideoToolbox-to-Metal native NV12 path enabled");
+  }
+  return SubmitResult::submitted;
+}
+
 MacMetalVideoRenderer::SubmitResult MacMetalVideoRenderer::SubmitCachedNv12(
     std::string_view remote_id, const uint8_t* data, size_t size, int width,
     int height) {
@@ -1045,40 +1276,57 @@ bool MacMetalVideoRenderer::CopyLatestNv12(
     return false;
   }
 
-  std::lock_guard lock(impl_->frames->mutex);
-  const FrameSlot* newest = nullptr;
-  for (const auto& slot : impl_->frames->slots) {
-    if (!slot.valid || slot.remote_id != remote_id || slot.y_buffer == nil ||
-        slot.uv_buffer == nil || slot.sequence == 0) {
-      continue;
+  NativeVideoFrameRef native_frame;
+  {
+    std::lock_guard lock(impl_->frames->mutex);
+    const FrameSlot* newest = nullptr;
+    for (const auto& slot : impl_->frames->slots) {
+      if (!slot.valid || slot.remote_id != remote_id || slot.sequence == 0 ||
+          (!slot.native_frame &&
+           (slot.y_buffer == nil || slot.uv_buffer == nil))) {
+        continue;
+      }
+      if (newest == nullptr || slot.sequence > newest->sequence) {
+        newest = &slot;
+      }
     }
-    if (newest == nullptr || slot.sequence > newest->sequence) {
-      newest = &slot;
+    if (newest == nullptr || newest->width <= 0 || newest->height <= 0) {
+      return false;
+    }
+
+    *width = newest->width;
+    *height = newest->height;
+    native_frame = newest->native_frame;
+    if (!native_frame) {
+      const size_t y_size =
+          static_cast<size_t>(newest->width) * newest->height;
+      output->resize(y_size + y_size / 2);
+      auto* y_source =
+          static_cast<const uint8_t*>(newest->y_buffer.contents);
+      auto* uv_source =
+          static_cast<const uint8_t*>(newest->uv_buffer.contents);
+      for (int row = 0; row < newest->height; ++row) {
+        std::memcpy(output->data() +
+                        static_cast<size_t>(row) * newest->width,
+                    y_source + static_cast<size_t>(row) * newest->y_stride,
+                    newest->width);
+      }
+      uint8_t* uv_destination = output->data() + y_size;
+      for (int row = 0; row < newest->height / 2; ++row) {
+        std::memcpy(uv_destination +
+                        static_cast<size_t>(row) * newest->width,
+                    uv_source + static_cast<size_t>(row) * newest->uv_stride,
+                    newest->width);
+      }
+      return true;
     }
-  }
-  if (newest == nullptr || newest->width <= 0 || newest->height <= 0) {
-    return false;
   }
 
-  const size_t y_size =
-      static_cast<size_t>(newest->width) * newest->height;
+  const MiniRtcNativeVideoFrame* native = native_frame.Get();
+  const size_t y_size = static_cast<size_t>(native->width) * native->height;
   output->resize(y_size + y_size / 2);
-  auto* y_source = static_cast<const uint8_t*>(newest->y_buffer.contents);
-  auto* uv_source = static_cast<const uint8_t*>(newest->uv_buffer.contents);
-  for (int row = 0; row < newest->height; ++row) {
-    std::memcpy(output->data() + static_cast<size_t>(row) * newest->width,
-                y_source + static_cast<size_t>(row) * newest->y_stride,
-                newest->width);
-  }
-  uint8_t* uv_destination = output->data() + y_size;
-  for (int row = 0; row < newest->height / 2; ++row) {
-    std::memcpy(uv_destination + static_cast<size_t>(row) * newest->width,
-                uv_source + static_cast<size_t>(row) * newest->uv_stride,
-                newest->width);
-  }
-  *width = newest->width;
-  *height = newest->height;
-  return true;
+  return native->copy_to_nv12(native->owner, output->data(), output->size()) ==
+         0;
 }
 
 }  // namespace crossdesk

apps/desktop/src/platform/macos/gui/runtime/cursor_state_provider_mac.mm

@@ -11,6 +11,7 @@
 #include <vector>
 
 #include "runtime/cursor_position.h"
+#include "../../privacy/privacy_cursor_mac.h"
 
 namespace crossdesk {
 namespace {
@@ -94,7 +95,7 @@ void AddKnownCursor(std::vector<KnownCursor>* cursors, NSCursor* cursor,
 
 std::vector<KnownCursor> BuildKnownCursors() {
   std::vector<KnownCursor> cursors;
-  cursors.reserve(16);
+  cursors.reserve(40);
 
 #pragma clang diagnostic push
 #pragma clang diagnostic ignored "-Wdeprecated-declarations"
@@ -128,6 +129,55 @@ std::vector<KnownCursor> BuildKnownCursors() {
                  RemoteCursorShape::w_resize);
 #pragma clang diagnostic pop
 
+#if __MAC_OS_X_VERSION_MAX_ALLOWED >= 150000
+  if (@available(macOS 15.0, *)) {
+    // Window-frame resize artwork differs from the legacy divider cursors
+    // above. Include every edge/corner and both one-way variants. Inward
+    // arrows point toward the frame's center; outward arrows point away.
+    struct FrameResizeCursorMapping {
+      NSCursorFrameResizePosition position;
+      RemoteCursorShape bidirectional;
+      RemoteCursorShape inward;
+      RemoteCursorShape outward;
+    };
+    constexpr FrameResizeCursorMapping mappings[] = {
+        {NSCursorFrameResizePositionTop, RemoteCursorShape::ns_resize,
+         RemoteCursorShape::s_resize, RemoteCursorShape::n_resize},
+        {NSCursorFrameResizePositionLeft, RemoteCursorShape::ew_resize,
+         RemoteCursorShape::e_resize, RemoteCursorShape::w_resize},
+        {NSCursorFrameResizePositionBottom, RemoteCursorShape::ns_resize,
+         RemoteCursorShape::n_resize, RemoteCursorShape::s_resize},
+        {NSCursorFrameResizePositionRight, RemoteCursorShape::ew_resize,
+         RemoteCursorShape::w_resize, RemoteCursorShape::e_resize},
+        {NSCursorFrameResizePositionTopLeft, RemoteCursorShape::nwse_resize,
+         RemoteCursorShape::se_resize, RemoteCursorShape::nw_resize},
+        {NSCursorFrameResizePositionTopRight, RemoteCursorShape::nesw_resize,
+         RemoteCursorShape::sw_resize, RemoteCursorShape::ne_resize},
+        {NSCursorFrameResizePositionBottomLeft, RemoteCursorShape::nesw_resize,
+         RemoteCursorShape::ne_resize, RemoteCursorShape::sw_resize},
+        {NSCursorFrameResizePositionBottomRight, RemoteCursorShape::nwse_resize,
+         RemoteCursorShape::nw_resize, RemoteCursorShape::se_resize},
+    };
+    for (const FrameResizeCursorMapping& mapping : mappings) {
+      AddKnownCursor(
+          &cursors,
+          [NSCursor frameResizeCursorFromPosition:mapping.position
+                                    inDirections:NSCursorFrameResizeDirectionsAll],
+          mapping.bidirectional);
+      AddKnownCursor(
+          &cursors,
+          [NSCursor frameResizeCursorFromPosition:mapping.position
+                                    inDirections:NSCursorFrameResizeDirectionsInward],
+          mapping.inward);
+      AddKnownCursor(
+          &cursors,
+          [NSCursor frameResizeCursorFromPosition:mapping.position
+                                    inDirections:NSCursorFrameResizeDirectionsOutward],
+          mapping.outward);
+    }
+  }
+#endif
+
   return cursors;
 }
 
@@ -161,7 +211,9 @@ bool CursorStateProvider::Sample(const std::vector<DisplayInfo>& displays,
 #pragma clang diagnostic push
 #pragma clang diagnostic ignored "-Wdeprecated-declarations"
   NSCursor* cursor = NSCursor.currentSystemCursor;
-  const bool visible = CGCursorIsVisible();
+  const bool privacy_hidden = IsMacPrivacyCursorHidden();
+  const bool visible = CGCursorIsVisible() || privacy_hidden;
+  if (!cursor && privacy_hidden) cursor = NSCursor.arrowCursor;
 #pragma clang diagnostic pop
 
   state->seq = 0;

apps/desktop/src/platform/macos/gui/tray/mac_tray.h

@@ -17,6 +17,9 @@ namespace crossdesk {
 
 struct MacTrayImpl;
 
+// Activates the app and focuses the restored Slint window's current NSView.
+void MacActivateWindow(void* appkit_view);
+
 class MacTray {
  public:
   MacTray(::SDL_Window* app_window, const std::string& tooltip,

apps/desktop/src/platform/macos/gui/tray/mac_tray.mm

@@ -57,6 +57,8 @@ struct MacTrayImpl {
     } else if (app_window) {
       SDL_HideWindow(app_window);
     }
+    // Keep running through the menu-bar tray without a Dock application icon.
+    [NSApp setActivationPolicy:NSApplicationActivationPolicyAccessory];
   }
 
   void RemoveTrayIcon() {
@@ -69,6 +71,8 @@ struct MacTrayImpl {
   }
 
   void ShowWindow() {
+    // Restore normal application behavior before showing or focusing a window.
+    [NSApp setActivationPolicy:NSApplicationActivationPolicyRegular];
     if (show_window) {
       show_window();
     } else if (app_window) {
@@ -142,6 +146,7 @@ struct MacTrayImpl {
   }
 
   void OpenSettings() {
+    [NSApp setActivationPolicy:NSApplicationActivationPolicyRegular];
     if (open_settings) {
       open_settings();
     } else {
@@ -279,6 +284,13 @@ MacTray::MacTray(std::function<void()> show_window,
 
 MacTray::~MacTray() = default;
 
+void MacActivateWindow(void *appkit_view) {
+  NSView *view = (__bridge NSView *)appkit_view;
+  NSWindow *window = [view window];
+  [NSApp activateIgnoringOtherApps:YES];
+  [window makeKeyAndOrderFront:nil];
+}
+
 void MacTray::MinimizeToTray() { impl_->MinimizeToTray(); }
 
 void MacTray::RemoveTrayIcon() { impl_->RemoveTrayIcon(); }

apps/desktop/src/platform/macos/input/keyboard/keyboard_capturer.cpp

@@ -4,6 +4,7 @@
 #include <unordered_map>
 
 #include "keyboard_converter.h"
+#include "../mac_injected_event.h"
 #include "rd_log.h"
 
 namespace crossdesk {
@@ -11,7 +12,6 @@ namespace crossdesk {
 static OnKeyAction g_on_key_action = nullptr;
 static void* g_user_ptr = nullptr;
 static std::unordered_map<int, int> g_unmapped_keycode_to_vk;
-constexpr int64_t kCrossDeskInjectedKeyboardEvent = 0x43524f5353444553;
 
 static int VkCodeFromUnicode(UniChar ch) {
   if (ch >= 'a' && ch <= 'z') {
@@ -106,7 +106,7 @@ CGEventRef eventCallback(CGEventTapProxy proxy, CGEventType type,
                          CGEventRef event, void* userInfo) {
   (void)proxy;
   if (CGEventGetIntegerValueField(event, kCGEventSourceUserData) ==
-      kCrossDeskInjectedKeyboardEvent) {
+      kCrossDeskInjectedEvent) {
     return event;
   }
   if (!g_on_key_action) {
@@ -309,7 +309,7 @@ int PlatformKeyboardCapturer::SendKeyboardCommand(int key_code, bool is_down,
 
     CGEventSetFlags(event, ToCGEventFlags(injected_flags));
     CGEventSetIntegerValueField(event, kCGEventSourceUserData,
-                               kCrossDeskInjectedKeyboardEvent);
+                               kCrossDeskInjectedEvent);
     CGEventPost(kCGHIDEventTap, event);
     CFRelease(event);
 
@@ -323,7 +323,7 @@ int PlatformKeyboardCapturer::SendKeyboardCommand(int key_code, bool is_down,
         return -1;
       }
       CGEventSetIntegerValueField(fn_release_event, kCGEventSourceUserData,
-                                 kCrossDeskInjectedKeyboardEvent);
+                                 kCrossDeskInjectedEvent);
       CGEventPost(kCGHIDEventTap, fn_release_event);
       CFRelease(fn_release_event);
     }

apps/desktop/src/platform/macos/input/mac_injected_event.h

@@ -0,0 +1,17 @@
+/*
+ * @Author: DI JUNKUN
+ * @Date: 2026-09-13
+ * Copyright (c) 2026 by DI JUNKUN, All Rights Reserved.
+ */
+
+#ifndef _MAC_INJECTED_EVENT_H_
+#define _MAC_INJECTED_EVENT_H_
+
+#include <cstdint>
+
+namespace crossdesk {
+// Shared by the keyboard/mouse injectors and the privacy input tap.
+inline constexpr int64_t kCrossDeskInjectedEvent = 0x43524f5353444553;
+}
+
+#endif

apps/desktop/src/platform/macos/input/mouse/mouse_controller.cpp

@@ -1,4 +1,5 @@
 #include "mouse_controller.h"
+#include "../mac_injected_event.h"
 
 #include <remote_action.h>
 
@@ -210,6 +211,8 @@ int PlatformMouseController::SendMouseCommand(RemoteAction remote_action,
   }
 
   if (mouse_event) {
+    CGEventSetIntegerValueField(mouse_event, kCGEventSourceUserData,
+                                kCrossDeskInjectedEvent);
     CGEventPost(kCGHIDEventTap, mouse_event);
     CFRelease(mouse_event);
   }

apps/desktop/src/platform/macos/privacy/privacy_backend_mac.mm

@@ -0,0 +1,400 @@
+/* Copyright (c) 2026 by DI JUNKUN, All Rights Reserved. */
+
+#import <AppKit/AppKit.h>
+#import <ApplicationServices/ApplicationServices.h>
+
+#include <algorithm>
+#include <chrono>
+#include <deque>
+#include <functional>
+#include <cstdlib>
+#include <libproc.h>
+#include <mutex>
+#include <utility>
+#include <unistd.h>
+
+#include "privacy_backend.h"
+#include "privacy_capture_state.h"
+#include "privacy_cover_view.h"
+#include "privacy_cursor_mac.h"
+#include "rd_log.h"
+#include "../input/mac_injected_event.h"
+
+// These windows never take keyboard focus. Remote clicks pass through them;
+// physical input is intercepted independently on the controller's run loop.
+@interface CrossDeskPrivacyPanel : NSPanel
+@end
+@implementation CrossDeskPrivacyPanel
+- (BOOL)canBecomeKeyWindow { return NO; }
+- (BOOL)canBecomeMainWindow { return NO; }
+@end
+
+namespace crossdesk {
+namespace {
+using Clock = std::chrono::steady_clock;
+std::mutex tasks_mutex;
+std::deque<std::function<void()>> tasks;
+std::mutex capture_mutex;
+MacPrivacyCaptureState capture_state;
+
+void OnMain(std::function<void()> task) {
+  {
+    std::lock_guard lock(tasks_mutex);
+    tasks.push_back(std::move(task));
+  }
+  dispatch_async(dispatch_get_main_queue(), ^{ FlushMacPrivacyTasks(); });
+}
+
+void PublishCovers(std::vector<uint32_t> windows, uint32_t cursor_window = 0) {
+  {
+    std::lock_guard lock(capture_mutex);
+    capture_state.excluded_windows = std::move(windows);
+    capture_state.cursor_window = cursor_window;
+    ++capture_state.revision;
+  }
+  dispatch_async(dispatch_get_main_queue(), ^{
+    [NSNotificationCenter.defaultCenter postNotificationName:@"CrossDeskPrivacyCoversChanged"
+                                                     object:nil];
+  });
+}
+
+struct Monitor {
+  CGDirectDisplayID id = 0;
+  CGRect bounds{};  // CoreGraphics desktop coordinates (points).
+  NSRect frame{};   // AppKit desktop coordinates (bottom left).
+  CrossDeskPrivacyPanel* __strong cover = nil;
+};
+struct WindowState {
+  std::mutex mutex;
+  std::vector<Monitor> monitors;
+  bool recovered = true;
+  bool recovering = false;
+  bool covers_shown = false;
+  bool check_queued = false;
+  MacPrivacyCursor cursor;
+  std::string failure;
+  Clock::time_point checked = Clock::now();
+};
+
+CrossDeskPrivacyPanel* MakePanel(NSRect frame, NSInteger level) {
+  auto* panel = [[CrossDeskPrivacyPanel alloc]
+      initWithContentRect:frame
+                styleMask:NSWindowStyleMaskBorderless | NSWindowStyleMaskNonactivatingPanel
+                  backing:NSBackingStoreBuffered defer:NO];
+  panel.releasedWhenClosed = NO;
+  panel.hidesOnDeactivate = NO;
+  panel.opaque = YES;
+  panel.backgroundColor = NSColor.blackColor;
+  panel.hasShadow = NO;
+  panel.ignoresMouseEvents = YES;
+  panel.level = level;
+  panel.animationBehavior = NSWindowAnimationBehaviorNone;
+  panel.collectionBehavior = NSWindowCollectionBehaviorCanJoinAllSpaces |
+      NSWindowCollectionBehaviorFullScreenAuxiliary |
+      NSWindowCollectionBehaviorStationary |
+      NSWindowCollectionBehaviorIgnoresCycle;
+  // Exclusion is explicit in ScreenCaptureKit. SharingNone alone does not
+  // exclude windows on recent macOS releases, and can hide them from discovery.
+  panel.sharingType = NSWindowSharingReadOnly;
+  return panel;
+}
+
+bool IsSystemCursorPlane(NSDictionary* info, CGRect bounds) {
+  const auto layer = [info[(__bridge NSString*)kCGWindowLayer] intValue];
+  // WindowServer's cursor plane also carries small recording indicators.
+  // Validate both its geometry and executable identity before ignoring it.
+  if (layer != CGWindowLevelForKey(kCGCursorWindowLevelKey) ||
+      bounds.size.width <= 0 || bounds.size.height <= 0 ||
+      bounds.size.width > 512 || bounds.size.height > 512)
+    return false;
+  char executable[PROC_PIDPATHINFO_MAXSIZE]{};
+  const auto pid = [info[(__bridge NSString*)kCGWindowOwnerPID] intValue];
+  static const std::string system_executable = [] {
+    char resolved[PROC_PIDPATHINFO_MAXSIZE]{};
+    return realpath("/System/Library/PrivateFrameworks/SkyLight.framework/Resources/WindowServer",
+                    resolved) ? std::string(resolved) : std::string();
+  }();
+  return proc_pidpath(pid, executable, sizeof(executable)) > 0 &&
+      !system_executable.empty() && system_executable == executable;
+}
+
+std::string CoverageFailure(const std::vector<Monitor>& monitors) {
+  uint32_t count = 0;
+  if (CGGetActiveDisplayList(0, nullptr, &count) != kCGErrorSuccess || !count)
+    return "No active macOS desktop; privacy screen unavailable";
+  std::vector<CGDirectDisplayID> displays(count);
+  if (CGGetActiveDisplayList(count, displays.data(), &count) != kCGErrorSuccess ||
+      count != monitors.size())
+    return "Display topology changed; turn privacy off to recover";
+  for (const auto& m : monitors) {
+    if (std::find(displays.begin(), displays.end(), m.id) == displays.end() ||
+        !CGRectEqualToRect(CGDisplayBounds(m.id), m.bounds) ||
+        !m.cover.visible || !m.cover.isOnActiveSpace ||
+        !NSEqualRects(m.cover.frame, m.frame) || m.cover.alphaValue != 1.0)
+      return "Privacy cover or display geometry changed; privacy screen unavailable";
+  }
+  NSDictionary* session = CFBridgingRelease(CGSessionCopyCurrentDictionary());
+  if (!session || ![session[(__bridge NSString*)kCGSessionOnConsoleKey] boolValue])
+    return "macOS session is not on console; privacy screen unavailable";
+
+  NSArray* windows = CFBridgingRelease(CGWindowListCopyWindowInfo(
+      kCGWindowListOptionOnScreenOnly | kCGWindowListExcludeDesktopElements,
+      kCGNullWindowID));
+  if (!windows) return "Unable to verify macOS privacy window order";
+  for (const auto& m : monitors) {
+    bool found = false;
+    for (NSDictionary* info in windows) {
+      const auto window = [info[(__bridge NSString*)kCGWindowNumber] unsignedIntValue];
+      if (window == m.cover.windowNumber) { found = true; break; }
+      if ([info[(__bridge NSString*)kCGWindowAlpha] doubleValue] <= 0) continue;
+      CGRect bounds{};
+      if (!CGRectMakeWithDictionaryRepresentation(
+              (__bridge CFDictionaryRef)info[(__bridge NSString*)kCGWindowBounds], &bounds))
+        return "Unable to verify a window above the privacy cover";
+      if (CGRectIntersectsRect(bounds, m.bounds)) {
+        if (IsSystemCursorPlane(info, bounds)) continue;
+        LOG_WARN("macOS privacy overlap: window={}, pid={}, layer={}, alpha={}, "
+                 "bounds=({}, {}, {}, {}), cover={}, cover_level={}",
+                 window,
+                 [info[(__bridge NSString*)kCGWindowOwnerPID] intValue],
+                 [info[(__bridge NSString*)kCGWindowLayer] intValue],
+                 [info[(__bridge NSString*)kCGWindowAlpha] doubleValue],
+                 bounds.origin.x, bounds.origin.y, bounds.size.width, bounds.size.height,
+                 m.cover.windowNumber, m.cover.level);
+        return "A system or application window overlaps the privacy cover; privacy screen unavailable";
+      }
+    }
+    if (!found) return "Privacy cover disappeared; privacy screen unavailable";
+  }
+  return {};
+}
+
+class MacPrivacyBackend final : public PrivacyBackend {
+ public:
+  MacPrivacyBackend() : state_(std::make_shared<WindowState>()) {
+    loop_ = CFRunLoopGetCurrent();
+    CFRetain(loop_);
+    CFRunLoopSourceContext context{};
+    wake_source_ = CFRunLoopSourceCreate(nullptr, 0, &context);
+    CFRunLoopAddSource(loop_, wake_source_, kCFRunLoopDefaultMode);
+  }
+  ~MacPrivacyBackend() override {
+    Recover();
+    CFRunLoopRemoveSource(loop_, wake_source_, kCFRunLoopDefaultMode);
+    CFRelease(wake_source_);
+    CFRelease(loop_);
+  }
+  PrivacyCapabilities Query() override {
+    if (@available(macOS 14.0, *)) {
+      if (!CGPreflightScreenCaptureAccess())
+        return {false, false, "Grant Screen Recording permission to use privacy screen"};
+      if (!AXIsProcessTrusted())
+        return {false, false, "Grant Accessibility permission to protect local input and enable local recovery"};
+      if (!MacPrivacyCursor::Supported())
+        return {false, false, "Background cursor control unavailable on this macOS version"};
+      return {true, true, "macOS privacy screen available (ScreenCaptureKit)"};
+    }
+    return {false, false, "Privacy screen requires macOS 14 or newer"};
+  }
+  bool Enable(bool block_input, const PrivacyScreenText& text, std::string& error) override {
+    const auto caps = Query();
+    if (!caps.overlay) { error = caps.reason; return false; }
+    block_input_ = block_input;
+    emergency_ = false;
+    tap_failed_ = false;
+    CGEventMask mask = CGEventMaskBit(kCGEventKeyDown) | CGEventMaskBit(kCGEventKeyUp) |
+        CGEventMaskBit(kCGEventFlagsChanged) | CGEventMaskBit(kCGEventLeftMouseDown) |
+        CGEventMaskBit(kCGEventLeftMouseUp) | CGEventMaskBit(kCGEventRightMouseDown) |
+        CGEventMaskBit(kCGEventRightMouseUp) | CGEventMaskBit(kCGEventMouseMoved) |
+        CGEventMaskBit(kCGEventLeftMouseDragged) | CGEventMaskBit(kCGEventRightMouseDragged) |
+        CGEventMaskBit(kCGEventOtherMouseDown) | CGEventMaskBit(kCGEventOtherMouseUp) |
+        CGEventMaskBit(kCGEventOtherMouseDragged) | CGEventMaskBit(kCGEventScrollWheel) |
+        CGEventMaskBit(14); // NX_SYSDEFINED: media/brightness keys.
+    tap_ = CGEventTapCreate(kCGHIDEventTap, kCGHeadInsertEventTap,
+                           kCGEventTapOptionDefault, mask, Input, this);
+    if (!tap_) { error = "Cannot install macOS privacy input tap"; return false; }
+    tap_source_ = CFMachPortCreateRunLoopSource(nullptr, tap_, 0);
+    if (!tap_source_) { error = "Cannot create macOS privacy input run loop"; return false; }
+    CFRunLoopAddSource(loop_, tap_source_, kCFRunLoopDefaultMode);
+    CGEventTapEnable(tap_, true);
+    {
+      std::lock_guard lock(state_->mutex);
+      state_->recovered = false;
+      state_->failure.clear();
+      state_->checked = Clock::now();
+    }
+    auto state = state_;
+    OnMain([state, text] {
+      @autoreleasepool {
+        std::lock_guard lock(state->mutex);
+        if (!state->cursor.Prepare()) {
+          state->failure = "Cannot prepare the privacy cursor";
+          return;
+        }
+        std::vector<uint32_t> covers;
+        for (NSScreen* screen in NSScreen.screens) {
+          Monitor m;
+          m.id = [screen.deviceDescription[@"NSScreenNumber"] unsignedIntValue];
+          m.bounds = CGDisplayBounds(m.id);
+          m.frame = screen.frame;
+          NSView* content = CreateMacPrivacyCoverView(
+              NSMakeRect(0, 0, m.frame.size.width, m.frame.size.height),
+              [NSString stringWithUTF8String:text.unlock_hint.c_str()]);
+          if (!content) {
+            state->failure = "Could not load the CrossDesk privacy screen logo";
+            break;
+          }
+          m.cover = MakePanel(m.frame, CGWindowLevelForKey(kCGScreenSaverWindowLevelKey) + 1);
+          m.cover.contentView = content;
+          // Register transparent windows first. Make them opaque only after
+          // SCK has acknowledged exclusion, avoiding a black remote frame.
+          m.cover.alphaValue = 0;
+          [m.cover orderFrontRegardless];
+          covers.push_back(static_cast<uint32_t>(m.cover.windowNumber));
+          state->monitors.push_back(std::move(m));
+        }
+        PublishCovers(std::move(covers), state->cursor.WindowId());
+        if (state->monitors.empty()) state->failure = "No active macOS desktop";
+        state->checked = Clock::now();
+      }
+    });
+    return true;
+  }
+  void Recover() override {
+    if (tap_) { CGEventTapEnable(tap_, false); CFMachPortInvalidate(tap_); }
+    if (tap_source_) {
+      CFRunLoopRemoveSource(loop_, tap_source_, kCFRunLoopDefaultMode);
+      CFRelease(tap_source_); tap_source_ = nullptr;
+    }
+    if (tap_) { CFRelease(tap_); tap_ = nullptr; }
+    {
+      std::lock_guard lock(state_->mutex);
+      if (state_->recovered || state_->recovering) return;
+      state_->recovering = true;
+    }
+    auto state = state_;
+    OnMain([state] {
+      std::lock_guard lock(state->mutex);
+      for (auto& m : state->monitors) {
+        [m.cover orderOut:nil]; [m.cover close]; m.cover = nil;
+      }
+      state->monitors.clear();
+      state->covers_shown = false;
+      state->cursor.Restore();
+      PublishCovers({});
+      state->failure.clear();
+      state->recovering = false;
+      state->recovered = true;
+    });
+  }
+  bool IsRecovered() const override {
+    std::lock_guard lock(state_->mutex);
+    return state_->recovered && !tap_;
+  }
+  bool RecoveryPending() const override {
+    std::lock_guard lock(state_->mutex);
+    return state_->recovering;
+  }
+  PrivacyHealth Poll() override {
+    if (emergency_) { emergency_ = false; return {{}, true}; }
+    if (tap_ && (tap_failed_ || !CGEventTapIsEnabled(tap_) || !AXIsProcessTrusted()))
+      return {"Local input protection interrupted; privacy screen unavailable", false};
+    auto state = state_;
+    std::lock_guard lock(state->mutex);
+    if (state->recovered || state->recovering) return {};
+    if (!state->failure.empty()) return {state->failure, false};
+    const auto age = Clock::now() - state->checked;
+    if (age > std::chrono::seconds(1))
+      return {"macOS privacy window checks stopped responding; privacy screen unavailable", false};
+    if (!state->check_queued && age > std::chrono::milliseconds(100)) {
+      state->check_queued = true;
+      OnMain([state] {
+        std::lock_guard lock(state->mutex);
+        if (!state->recovered && !state->recovering && state->failure.empty()) {
+          const auto capture = GetMacPrivacyCaptureState();
+          if (!state->covers_shown && !state->monitors.empty() &&
+              capture.revision == capture.applied_revision) {
+            if (!state->cursor.Hide()) {
+              state->failure = "Cannot hide the local privacy cursor";
+              state->checked = Clock::now();
+              state->check_queued = false;
+              return;
+            }
+            for (auto& m : state->monitors) {
+              m.cover.alphaValue = 1;
+              [m.cover displayIfNeeded];
+              [m.cover orderFrontRegardless];
+            }
+            state->covers_shown = true;
+          }
+          if (state->covers_shown) {
+            state->failure = state->cursor.Healthy() ? CoverageFailure(state->monitors)
+                : "Cannot keep the local privacy cursor hidden";
+          }
+        }
+        state->checked = Clock::now();
+        state->check_queued = false;
+      });
+    }
+    const auto capture = GetMacPrivacyCaptureState();
+    return {{}, false, state->covers_shown &&
+                       capture.revision == capture.applied_revision};
+  }
+  void WaitForEvents(unsigned timeout_ms) override {
+    @autoreleasepool {
+      CFRunLoopRunInMode(kCFRunLoopDefaultMode, timeout_ms / 1000.0, true);
+    }
+  }
+  void Wake() override { CFRunLoopSourceSignal(wake_source_); CFRunLoopWakeUp(loop_); }
+ private:
+  static CGEventRef Input(CGEventTapProxy, CGEventType type, CGEventRef event, void* context) {
+    auto* self = static_cast<MacPrivacyBackend*>(context);
+    if (type == kCGEventTapDisabledByTimeout || type == kCGEventTapDisabledByUserInput) {
+      self->tap_failed_ = true;
+      CGEventTapEnable(self->tap_, true); // Keep the local recovery chord usable.
+      return event;
+    }
+    if (!event) return event;
+    if (CGEventGetIntegerValueField(event, kCGEventSourceUserData) == kCrossDeskInjectedEvent &&
+        CGEventGetIntegerValueField(event, kCGEventSourceUnixProcessID) == getpid()) return event;
+    const auto flags = CGEventGetFlags(event);
+    const auto chord = kCGEventFlagMaskControl | kCGEventFlagMaskAlternate | kCGEventFlagMaskShift;
+    if (type == kCGEventKeyDown && (flags & chord) == chord &&
+        CGEventGetIntegerValueField(event, kCGKeyboardEventKeycode) == 53) {
+      self->emergency_ = true;
+      return nullptr;
+    }
+    return self->block_input_ ? nullptr : event;
+  }
+  std::shared_ptr<WindowState> state_;
+  CFRunLoopRef loop_ = nullptr;
+  CFRunLoopSourceRef wake_source_ = nullptr;
+  CFMachPortRef tap_ = nullptr;
+  CFRunLoopSourceRef tap_source_ = nullptr;
+  bool block_input_ = false;
+  bool emergency_ = false;
+  bool tap_failed_ = false;
+};
+}  // namespace
+
+void FlushMacPrivacyTasks() {
+  if (![NSThread isMainThread]) return;
+  std::deque<std::function<void()>> pending;
+  {
+    std::lock_guard lock(tasks_mutex);
+    pending.swap(tasks);
+  }
+  @autoreleasepool { for (auto& task : pending) task(); }
+}
+MacPrivacyCaptureState GetMacPrivacyCaptureState() {
+  std::lock_guard lock(capture_mutex);
+  return capture_state;
+}
+void AcknowledgeMacPrivacyCapture(uint64_t revision) {
+  std::lock_guard lock(capture_mutex);
+  if (revision == capture_state.revision) capture_state.applied_revision = revision;
+}
+std::unique_ptr<PrivacyBackend> CreateMacPrivacyBackend() {
+  return std::make_unique<MacPrivacyBackend>();
+}
+}  // namespace crossdesk

apps/desktop/src/platform/macos/privacy/privacy_capture_state.h

@@ -0,0 +1,23 @@
+/*
+ * @Author: DI JUNKUN
+ * @Date: 2026-09-13
+ * Copyright (c) 2026 by DI JUNKUN, All Rights Reserved.
+ */
+#ifndef _PRIVACY_CAPTURE_STATE_H_
+#define _PRIVACY_CAPTURE_STATE_H_
+
+#include <cstdint>
+#include <vector>
+
+namespace crossdesk {
+struct MacPrivacyCaptureState {
+  uint64_t revision = 0;
+  uint64_t applied_revision = 0;
+  std::vector<uint32_t> excluded_windows;
+  uint32_t cursor_window = 0;
+};
+MacPrivacyCaptureState GetMacPrivacyCaptureState();
+void AcknowledgeMacPrivacyCapture(uint64_t revision);
+}
+
+#endif

apps/desktop/src/platform/macos/privacy/privacy_cover_view.h

@@ -0,0 +1,17 @@
+/*
+ * @Author: DI JUNKUN
+ * @Date: 2026-09-13
+ * Copyright (c) 2026 by DI JUNKUN, All Rights Reserved.
+ */
+
+#ifndef _PRIVACY_COVER_VIEW_H_
+#define _PRIVACY_COVER_VIEW_H_
+
+#import <AppKit/AppKit.h>
+
+namespace crossdesk {
+// Returns nil if the CrossDesk icon resource cannot be loaded.
+NSView* CreateMacPrivacyCoverView(NSRect frame, NSString* unlock_hint);
+}
+
+#endif

apps/desktop/src/platform/macos/privacy/privacy_cover_view.mm

@@ -0,0 +1,106 @@
+/* Copyright (c) 2026 by DI JUNKUN, All Rights Reserved. */
+
+#include "privacy_cover_view.h"
+
+#include <algorithm>
+#include <cmath>
+
+namespace {
+NSImage* LoadPrivacyLogo() {
+  // The macOS installer currently packages the icon as "crossedesk.icns".
+  for (NSString* name in @[@"crossdesk", @"crossedesk"]) {
+    NSString* path = [NSBundle.mainBundle pathForResource:name ofType:@"icns"];
+    if (path) {
+      NSImage* image = [[NSImage alloc] initWithContentsOfFile:path];
+      if (image.valid) return image;
+    }
+  }
+  // Support unbundled development builds, including launches from outside
+  // the repository. No source-tree path is embedded in the executable.
+  NSString* resource = @"apps/desktop/resources/macos/crossdesk.icns";
+  NSString* directory = NSBundle.mainBundle.executablePath.stringByDeletingLastPathComponent;
+  NSMutableArray<NSString*>* paths = [NSMutableArray arrayWithObject:
+      [NSFileManager.defaultManager.currentDirectoryPath stringByAppendingPathComponent:resource]];
+  for (int depth = 0; directory.length && depth <= 4; ++depth) {
+    [paths addObject:[directory stringByAppendingPathComponent:resource]];
+    directory = directory.stringByDeletingLastPathComponent;
+  }
+  for (NSString* path in paths) {
+    NSImage* image = [[NSImage alloc] initWithContentsOfFile:path.stringByStandardizingPath];
+    if (image.valid) return image;
+  }
+  return nil;
+}
+
+NSAttributedString* Text(NSString* value, CGFloat size, NSFontWeight weight, NSColor* color) {
+  NSMutableParagraphStyle* paragraph = [[NSMutableParagraphStyle alloc] init];
+  paragraph.lineBreakMode = NSLineBreakByWordWrapping;
+  return [[NSAttributedString alloc] initWithString:value attributes:@{
+      NSFontAttributeName: [NSFont systemFontOfSize:size weight:weight],
+      NSForegroundColorAttributeName: color,
+      NSParagraphStyleAttributeName: paragraph}];
+}
+constexpr NSStringDrawingOptions kTextOptions =
+    NSStringDrawingUsesLineFragmentOrigin | NSStringDrawingUsesFontLeading;
+
+CGFloat TextHeight(NSAttributedString* text, CGFloat width) {
+  return std::ceil([text boundingRectWithSize:NSMakeSize(width, CGFLOAT_MAX)
+                                    options:kTextOptions].size.height);
+}
+}
+
+@interface CrossDeskPrivacyCoverView : NSView
+@property(nonatomic, strong) NSImage* logo;
+@property(nonatomic, copy) NSString* unlockHint;
+@end
+
+@implementation CrossDeskPrivacyCoverView
+- (BOOL)isOpaque { return YES; }
+- (BOOL)isFlipped { return YES; }
+- (void)drawRect:(NSRect)dirtyRect {
+  [NSColor.blackColor setFill];
+  NSRectFill(self.bounds);
+  const CGFloat width = NSWidth(self.bounds), height = NSHeight(self.bounds);
+  if (width <= 0 || height <= 0) return;
+  // Match the Windows cover's sizes, colors and bottom-left alignment.
+  // AppKit coordinates are points; Retina backing scale is applied by AppKit.
+  const CGFloat scale = std::min({CGFloat(1), width / 640, height / 200});
+  const CGFloat margin = 32 * scale, text_width = 398 * scale;
+  NSColor* foreground = [NSColor colorWithSRGBRed:245.0 / 255 green:247.0 / 255
+                                           blue:250.0 / 255 alpha:1];
+  NSColor* muted = [NSColor colorWithSRGBRed:181.0 / 255 green:190.0 / 255
+                                      blue:204.0 / 255 alpha:1];
+  NSAttributedString* brand = Text(@"CrossDesk", 14 * scale, NSFontWeightSemibold, foreground);
+  NSAttributedString* hint = Text(self.unlockHint, 16 * scale, NSFontWeightRegular, muted);
+  NSAttributedString* shortcut = Text(@"Control + Option + Shift + Esc", 24 * scale,
+                                      NSFontWeightSemibold, foreground);
+  const CGFloat logo_size = std::ceil(brand.size.width);
+  const CGFloat brand_height = TextHeight(brand, logo_size);
+  const CGFloat hint_height = TextHeight(hint, text_width);
+  const CGFloat shortcut_height = TextHeight(shortcut, text_width);
+  const CGFloat bottom = height - margin;
+  const CGFloat logo_top = bottom - brand_height - 6 * scale - logo_size;
+  [self.logo drawInRect:NSMakeRect(margin, logo_top, logo_size, logo_size)
+              fromRect:NSZeroRect operation:NSCompositingOperationSourceOver
+              fraction:1 respectFlipped:YES hints:@{NSImageHintInterpolation: @(NSImageInterpolationHigh)}];
+  [brand drawWithRect:NSMakeRect(margin, bottom - brand_height, logo_size, brand_height)
+             options:kTextOptions];
+  const CGFloat text_left = margin + logo_size + 24 * scale;
+  [hint drawWithRect:NSMakeRect(text_left, bottom - shortcut_height - 12 * scale - hint_height,
+                               text_width, hint_height) options:kTextOptions];
+  [shortcut drawWithRect:NSMakeRect(text_left, bottom - shortcut_height,
+                                   text_width, shortcut_height) options:kTextOptions];
+}
+@end
+
+namespace crossdesk {
+NSView* CreateMacPrivacyCoverView(NSRect frame, NSString* unlock_hint) {
+  NSImage* logo = LoadPrivacyLogo();
+  if (!logo) return nil;
+  auto* view = [[CrossDeskPrivacyCoverView alloc] initWithFrame:frame];
+  view.logo = logo;
+  view.unlockHint = unlock_hint ?: @"To turn off the privacy screen, press";
+  view.autoresizingMask = NSViewWidthSizable | NSViewHeightSizable;
+  return view;
+}
+}

apps/desktop/src/platform/macos/privacy/privacy_cursor_mac.h

@@ -0,0 +1,35 @@
+/*
+ * @Author: DI JUNKUN
+ * @Date: 2026-09-13
+ * Copyright (c) 2026 by DI JUNKUN, All Rights Reserved.
+ */
+
+#ifndef _PRIVACY_CURSOR_MAC_H_
+#define _PRIVACY_CURSOR_MAC_H_
+
+#include <memory>
+#include <cstdint>
+
+namespace crossdesk {
+// Main-thread resource. Hides only for the lifetime of a local privacy cover;
+// does not take focus, move the pointer, or suppress remote input.
+class MacPrivacyCursor {
+ public:
+  MacPrivacyCursor();
+  ~MacPrivacyCursor();
+  static bool Supported();
+  bool Prepare();
+  bool Hide();
+  bool Healthy() const;
+  uint32_t WindowId() const;
+  void Restore();
+ private:
+  struct Impl;
+  std::unique_ptr<Impl> impl_;
+};
+
+// Local hiding must not be reported as an invisible cursor to controllers.
+bool IsMacPrivacyCursorHidden();
+}
+
+#endif