refact(oidc): login with api domain (#15710 )

Signed-off-by: fufesou <linlong1266@gmail.com>
fix ci
2026-09-16 01:11:03 +03:00 · 2026-07-30 18:23:48 +08:00 · 2026-07-30 16:40:56 +08:00 · 2026-07-30 16:40:27 +08:00 · 2026-07-30 15:28:39 +08:00 · 2026-07-30 14:19:05 +08:00
177 changed files with 7916 additions and 1395 deletions
--- a/.github/workflows/flutter-build.yml
+++ b/.github/workflows/flutter-build.yml
@@ -44,7 +44,7 @@ env:
  # 2. Update the `VCPKG_COMMIT_ID` in `ci.yml` and `playground.yml`.
  VCPKG_COMMIT_ID: "120deac3062162151622ca4860575a33844ba10b"
  ARMV7_VCPKG_COMMIT_ID: "6f29f12e82a8293156836ad81cc9bf5af41fe836" # 2025.01.13, got "/opt/artifacts/vcpkg/vcpkg: No such file or directory" with latest version
-  VERSION: "1.4.8"
+  VERSION: "1.4.9"
  NDK_VERSION: "r28c"
  #signing keys env variable checks
  ANDROID_SIGNING_KEY: "${{ secrets.ANDROID_SIGNING_KEY }}"
@@ -1984,6 +1984,7 @@ jobs:
          sudo apt-get install -y libarchive-tools libfuse2
          # set-up appimage-builder
          # https://github.com/AppImage/AppImageKit/issues/1395
+          sudo pip3 install "setuptools_scm<10"
          sudo pip3 install git+https://github.com/rustdesk-org/appimage-builder.git
          # run appimage-builder
          pushd appimage
--- a/.github/workflows/playground.yml
+++ b/.github/workflows/playground.yml
@@ -17,7 +17,7 @@ env:
  TAG_NAME: "nightly"
  VCPKG_BINARY_SOURCES: "clear;x-gha,readwrite"
  VCPKG_COMMIT_ID: "120deac3062162151622ca4860575a33844ba10b"
-  VERSION: "1.4.8"
+  VERSION: "1.4.9"
  NDK_VERSION: "r26d"
  #signing keys env variable checks
  ANDROID_SIGNING_KEY: "${{ secrets.ANDROID_SIGNING_KEY }}"
--- a/.github/workflows/wf-cliprdr-ci.yml
+++ b/.github/workflows/wf-cliprdr-ci.yml
@@ -1,85 +0,0 @@
-name: wf-cliprdr CI
-
-on:
-  workflow_dispatch:
-  pull_request:
-    paths:
-      - "libs/clipboard/src/windows/**"
-      - "tests/test_invariant_wf_cliprdr.c"
-      - ".github/workflows/wf-cliprdr-ci.yml"
-  push:
-    branches:
-      - master
-    paths:
-      - "libs/clipboard/src/windows/**"
-      - "tests/test_invariant_wf_cliprdr.c"
-      - ".github/workflows/wf-cliprdr-ci.yml"
-
-permissions:
-  contents: read
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.ref }}
-  cancel-in-progress: true
-
-jobs:
-  test:
-    name: wf_cliprdr invariant test
-    runs-on: windows-2022
-
-    steps:
-      - name: Checkout source code
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
-        with:
-          persist-credentials: false
-
-      - name: Set up MSVC
-        uses: ilammy/msvc-dev-cmd@0b201ec74fa43914dc39ae48a89fd1d8cb592756
-        with:
-          arch: x64
-
-      - name: Setup vcpkg with GitHub Actions binary cache
-        uses: lukka/run-vcpkg@b1a0dd252f06b9e25b3c022a9a03bd7a427fb6a2 # v11
-        with:
-          vcpkgDirectory: C:\vcpkg
-          doNotCache: false
-
-      - name: Install vcpkg dependency
-        shell: pwsh
-        run: |
-          & "$env:VCPKG_ROOT\vcpkg.exe" install check:x64-windows --classic --x-install-root="$env:VCPKG_ROOT\installed"
-
-      - name: Build test
-        shell: pwsh
-        run: |
-          $testRoot = Join-Path $env:GITHUB_WORKSPACE 'build\wf-cliprdr'
-          New-Item -ItemType Directory -Force $testRoot | Out-Null
-
-          $testSource = (($env:GITHUB_WORKSPACE -replace '\\', '/') + '/tests/test_invariant_wf_cliprdr.c')
-          $cmakeLists = @(
-            'cmake_minimum_required(VERSION 3.20)'
-            'project(test_invariant_wf_cliprdr C)'
-            ''
-            'set(CMAKE_C_STANDARD 11)'
-            'set(CMAKE_C_STANDARD_REQUIRED ON)'
-            'set(CMAKE_C_EXTENSIONS OFF)'
-            ''
-            'find_package(check CONFIG REQUIRED)'
-            ''
-            'add_executable(test_invariant_wf_cliprdr'
-            '  "TEST_SOURCE"'
-            ')'
-            ''
-            'target_link_libraries(test_invariant_wf_cliprdr PRIVATE'
-            '  $<$<TARGET_EXISTS:Check::check>:Check::check>'
-            '  $<$<NOT:$<TARGET_EXISTS:Check::check>>:Check::checkShared>'
-            ')'
-          ) -join [Environment]::NewLine
-          $cmakeLists.Replace('TEST_SOURCE', $testSource) | Set-Content -NoNewline (Join-Path $testRoot 'CMakeLists.txt')
-
-          cmake -S $testRoot -B (Join-Path $testRoot 'out') -G "Visual Studio 17 2022" -A x64 -DCMAKE_TOOLCHAIN_FILE="$env:VCPKG_ROOT\scripts\buildsystems\vcpkg.cmake" -DVCPKG_TARGET_TRIPLET=x64-windows
-          cmake --build (Join-Path $testRoot 'out') --config Release
-
-      - name: Run test
-        shell: pwsh
-        run: .\build\wf-cliprdr\out\Release\test_invariant_wf_cliprdr.exe
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -61,6 +61,12 @@
 * Do not make formatting-only changes.
 * Keep naming/style consistent with nearby code.

+### Be minimally invasive
+
+* Prefer purely additive changes: layer new (`#[cfg]`-gated) blocks or new functions around existing code instead of restructuring it. The ideal diff for a fix adds lines and modifies/deletes none.
+* Do not extract or reshape existing code just to enable your new code; look for a mechanism that leaves existing lines untouched (e.g. hide/show an existing object instead of refactoring its construction into a helper for rebuilding).
+* Put new logic in self-contained functions in the module it belongs to (platform-specific logic in `src/platform/`, with `use` inside the function body to avoid churning shared import blocks). Call sites in shared files (`src/tray.rs`, `src/core_main.rs`, `src/server/connection.rs`, …) should be thin one-line hooks.
+
 ## Localization (`src/lang/*.rs`)

 Each file is a `HashMap<key, translation>`. Layout:
@@ -84,3 +90,9 @@ Then translate that source into the file's target language (infer the language f
 * Preserve placeholders (`{}`) and escape sequences (`\n`, `\"`) exactly as in the source.
 * Do not translate brand or technical tokens: `RustDesk`, `Socks5`, `TLS`, `UAC`, `Wayland`, `X11`, `TCP`, `UDP`, `2FA`, `RDP`, `D3D`, etc.
 * Copy URL values (e.g. `doc_*` keys) verbatim from `en.rs`.
+
+### Adding new keys (feature work)
+
+* New English-text keys use sentence case, not Title Case: `Use ID whitelisting`, **not** `Use ID Whitelisting`. Acronyms (ID, IP, 2FA…) stay uppercase. Legacy Title-Case keys (e.g. `Use IP Whitelisting`) stay as-is — do not rename them.
+* Since the key itself is the English display text, a sentence-case key usually needs **no** `en.rs` entry; add one only when the display text must differ from the key (e.g. `*_tip` keys).
+* Append each new key to `template.rs` (with `""`) and to every `src/lang/*.rs` file (translated, or `""` if unsure), at the end of the list.
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -771,6 +771,26 @@ dependencies = [
 "syn 2.0.98",
 ]

+[[package]]
+name = "bindgen"
+version = "0.72.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "993776b509cfb49c750f11b8f07a46fa23e0a1386ffc01fb1e7d343efc387895"
+dependencies = [
+ "bitflags 2.9.1",
+ "cexpr",
+ "clang-sys",
+ "itertools 0.12.1",
+ "log",
+ "prettyplease",
+ "proc-macro2 1.0.93",
+ "quote 1.0.36",
+ "regex",
+ "rustc-hash 2.1.1",
+ "shlex",
+ "syn 2.0.98",
+]
+
 [[package]]
 name = "bit_field"
 version = "0.10.2"
@@ -1457,6 +1477,8 @@ dependencies = [
 "compression-core",
 "flate2",
 "memchr",
+ "zstd 0.13.1",
+ "zstd-safe 7.1.0",
 ]

 [[package]]
@@ -2329,7 +2351,7 @@ version = "0.5.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "330c60081dcc4c72131f8eb70510f1ac07223e5d4163db481a04a0befcffa412"
 dependencies = [
- "libloading 0.7.4",
+ "libloading 0.8.4",
 ]

 [[package]]
@@ -2694,7 +2716,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "39cab71617ae0d63f51a36d69f866391735b51691dbda63cf6f96d042b63efeb"
 dependencies = [
 "libc",
- "windows-sys 0.60.2",
+ "windows-sys 0.61.2",
 ]

 [[package]]
@@ -4494,7 +4516,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e310b3a6b5907f99202fcdb4960ff45b93735d7c7d96b760fcff8db2dc0e103d"
 dependencies = [
 "cfg-if 1.0.0",
- "windows-targets 0.48.5",
+ "windows-targets 0.52.6",
 ]

 [[package]]
@@ -6588,7 +6610,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "556af5f5c953a2ee13f45753e581a38f9778e6551bc3ccc56d90b14628fe59d8"
 dependencies = [
 "cfg-if 0.1.10",
- "rpassword 2.1.0",
+ "rpassword",
 "tempfile",
 "termios 0.3.3",
 "winapi 0.3.9",
@@ -6920,7 +6942,7 @@ dependencies = [
 [[package]]
 name = "rdev"
 version = "0.5.0-2"
-source = "git+https://github.com/rustdesk-org/rdev#871bf1c856d6a30af2f56ab8848396a025140855"
+source = "git+https://github.com/rustdesk-org/rdev#23e24dd6b35452a495dae0ae6d99395e9755ab0f"
 dependencies = [
 "cocoa 0.24.1",
 "core-foundation 0.9.4",
@@ -7152,17 +7174,6 @@ dependencies = [
 "winapi 0.2.8",
 ]

-[[package]]
-name = "rpassword"
-version = "7.3.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "80472be3c897911d0137b2d2b9055faf6eeac5b14e324073d83bc17b191d7e3f"
-dependencies = [
- "libc",
- "rtoolbox",
- "windows-sys 0.48.0",
-]
-
 [[package]]
 name = "rtcp"
 version = "0.14.0"
@@ -7174,16 +7185,6 @@ dependencies = [
 "webrtc-util",
 ]

-[[package]]
-name = "rtoolbox"
-version = "0.0.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c247d24e63230cdb56463ae328478bd5eac8b8faa8c69461a77e8e323afac90e"
-dependencies = [
- "libc",
- "windows-sys 0.48.0",
-]
-
 [[package]]
 name = "rtp"
 version = "0.14.0"
@@ -7270,7 +7271,7 @@ dependencies = [

 [[package]]
 name = "rustdesk"
-version = "1.4.8"
+version = "1.4.9"
 dependencies = [
 "android-wakelock",
 "android_logger",
@@ -7283,7 +7284,6 @@ dependencies = [
 "cfg-if 1.0.0",
 "chrono",
 "cidr-utils",
- "clap 4.5.53",
 "clipboard",
 "clipboard-master",
 "cocoa 0.24.1",
@@ -7341,7 +7341,6 @@ dependencies = [
 "repng",
 "reqwest",
 "ringbuf",
- "rpassword 7.3.1",
 "rubato",
 "runas",
 "rust-pulsectl",
@@ -7385,7 +7384,7 @@ dependencies = [

 [[package]]
 name = "rustdesk-portable-packer"
-version = "1.4.8"
+version = "1.4.9"
 dependencies = [
 "brotli",
 "dirs 5.0.1",
@@ -7457,7 +7456,7 @@ dependencies = [
 "errno",
 "libc",
 "linux-raw-sys 0.11.0",
- "windows-sys 0.60.2",
+ "windows-sys 0.61.2",
 ]

 [[package]]
@@ -7514,7 +7513,7 @@ dependencies = [
 "security-framework 3.5.1",
 "security-framework-sys",
 "webpki-root-certs",
- "windows-sys 0.60.2",
+ "windows-sys 0.61.2",
 ]

 [[package]]
@@ -7601,7 +7600,7 @@ name = "scrap"
 version = "0.5.0"
 dependencies = [
 "android_logger",
- "bindgen 0.65.1",
+ "bindgen 0.72.1",
 "block",
 "cfg-if 1.0.0",
 "dbus",
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "rustdesk"
-version = "1.4.8"
+version = "1.4.9"
 authors = ["rustdesk <info@rustdesk.com>"]
 edition = "2021"
 build= "build.rs"
@@ -22,7 +22,6 @@ path = "src/service.rs"

 [features]
 inline = []
-cli = []
 use_samplerate = ["samplerate"]
 use_rubato = ["rubato"]
 use_dasp = ["dasp"]
@@ -62,8 +61,6 @@ dasp = { version = "0.11", features = ["signal", "interpolate-linear", "interpol
 rubato = { version = "0.12", optional = true }
 samplerate = { version = "0.2", optional = true }
 uuid = { version = "1.3", features = ["v4"] }
-clap = "4.2"
-rpassword = "7.2"
 num_cpus = "1.15"
 bytes = { version = "1.4", features = ["serde"] }
 default-net = "0.14"
@@ -82,7 +79,7 @@ shutdown_hooks = "0.1"
 totp-rs = { version = "5.4", default-features = false, features = ["gen_secret", "otpauth"] }
 stunclient = "0.4"
 kcp-sys= { git = "https://github.com/rustdesk-org/kcp-sys"}
-reqwest = { version = "0.12", features = ["blocking", "socks", "json", "native-tls", "rustls-tls", "rustls-tls-native-roots", "gzip"], default-features=false }
+reqwest = { version = "0.12", features = ["blocking", "socks", "json", "native-tls", "rustls-tls", "rustls-tls-native-roots", "gzip", "zstd"], default-features=false }

 [target.'cfg(not(target_os = "linux"))'.dependencies]
 # https://github.com/rustdesk/rustdesk/discussions/10197, not use cpal on linux
@@ -213,7 +210,7 @@ exclude = ["vdi/host", "examples/custom_plugin"]
 libxdo-sys = { path = "libs/libxdo-sys-stub" }

 [package.metadata.winres]
-LegalCopyright = "Copyright © 2025 Purslane Ltd. All rights reserved."
+LegalCopyright = "Copyright © 2026 Purslane Tech Pte. Ltd. All rights reserved."
 ProductName = "RustDesk"
 FileDescription = "RustDesk Remote Desktop"
 OriginalFilename = "rustdesk.exe"
--- a/appimage/AppImageBuilder-aarch64.yml
+++ b/appimage/AppImageBuilder-aarch64.yml
@@ -18,7 +18,7 @@ AppDir:
    id: rustdesk
    name: rustdesk
    icon: rustdesk
-    version: 1.4.8
+    version: 1.4.9
    exec: usr/share/rustdesk/rustdesk
    exec_args: $@
  apt:
--- a/appimage/AppImageBuilder-x86_64.yml
+++ b/appimage/AppImageBuilder-x86_64.yml
@@ -18,7 +18,7 @@ AppDir:
    id: rustdesk
    name: rustdesk
    icon: rustdesk
-    version: 1.4.8
+    version: 1.4.9
    exec: usr/share/rustdesk/rustdesk
    exec_args: $@
  apt:
--- a/docs/CODE_OF_CONDUCT.md
+++ b/docs/CODE_OF_CONDUCT.md
@@ -107,7 +107,7 @@ Violating these terms may lead to a permanent ban.
 ### 4. Permanent Ban

 **Community Impact**: Demonstrating a pattern of violation of community
-standards, including sustained inappropriate behavior,  harassment of an
+standards, including sustained inappropriate behavior, harassment of an
 individual, or aggression toward or disparagement of classes of individuals.

 **Consequence**: A permanent ban from any sort of public interaction within
--- a/flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/InputService.kt
+++ b/flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/InputService.kt
@@ -8,6 +8,7 @@ package com.carriez.flutter_hbb

 import android.accessibilityservice.AccessibilityService
 import android.accessibilityservice.GestureDescription
+import android.content.Intent
 import android.graphics.Path
 import android.os.Build
 import android.os.Bundle
@@ -68,6 +69,16 @@ class InputService : AccessibilityService() {
            get() = ctx != null
    }

+    private fun notifyInputState() {
+        val inputState = isOpen.toString()
+        Handler(Looper.getMainLooper()).post {
+            MainActivity.flutterMethodChannel?.invokeMethod(
+                "on_state_changed",
+                mapOf("name" to "input", "value" to inputState)
+            )
+        }
+    }
+
    private val logTag = "input service"
    private var leftIsDown = false
    private var touchPath = Path()
@@ -716,6 +727,7 @@ class InputService : AccessibilityService() {
    override fun onServiceConnected() {
        super.onServiceConnected()
        ctx = this
+        notifyInputState()
        val info = AccessibilityServiceInfo()
        if (Build.VERSION.SDK_INT >= 33) {
            info.flags = FLAG_INPUT_METHOD_EDITOR or FLAG_RETRIEVE_INTERACTIVE_WINDOWS
@@ -734,8 +746,16 @@ class InputService : AccessibilityService() {

    override fun onDestroy() {
        ctx = null
+        // Keep this fallback even though onUnbind usually notifies first.
+        notifyInputState()
        super.onDestroy()
    }

+    override fun onUnbind(intent: Intent?): Boolean {
+        ctx = null
+        notifyInputState()
+        return super.onUnbind(intent)
+    }
+
    override fun onInterrupt() {}
 }
--- a/flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/MainActivity.kt
+++ b/flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/MainActivity.kt
@@ -200,12 +200,13 @@ class MainActivity : FlutterActivity() {
                "stop_input" -> {
                    if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.N) {
                        InputService.ctx?.disableSelf()
+                    } else {
+                        InputService.ctx = null
+                        Companion.flutterMethodChannel?.invokeMethod(
+                            "on_state_changed",
+                            mapOf("name" to "input", "value" to InputService.isOpen.toString())
+                        )
                    }
-                    InputService.ctx = null
-                    Companion.flutterMethodChannel?.invokeMethod(
-                        "on_state_changed",
-                        mapOf("name" to "input", "value" to InputService.isOpen.toString())
-                    )
                    result.success(true)
                }
                "cancel_notification" -> {
--- a/flutter/build_android_deps.sh
+++ b/flutter/build_android_deps.sh
@@ -6,83 +6,82 @@ ANDROID_ABI=$1

 # Build RustDesk dependencies for Android using vcpkg.json
 # Required:
-#   1. set VCPKG_ROOT / ANDROID_NDK path environment variables
+#   1. set VCPKG_ROOT / ANDROID_NDK_HOME path environment variables
 #   2. vcpkg initialized
 #   3. ndk, version: r25c or newer

-if [ -z "$ANDROID_NDK_HOME" ]; then
-  echo "Failed! Please set ANDROID_NDK_HOME"
-  exit 1
+if [ -z "${ANDROID_NDK_HOME}" ]; then
+	echo "ERROR: Please set ANDROID_NDK_HOME environment variable" 1>&2
+	exit 1
 fi

-if [ -z "$VCPKG_ROOT" ]; then
-  echo "Failed! Please set VCPKG_ROOT"
-  exit 1
+if [ -z "${VCPKG_ROOT}" ]; then
+	echo "ERROR: Please set VCPKG_ROOT environment variable" 1>&2
+	exit 1
 fi

-API_LEVEL="21"
+case "${ANDROID_ABI}" in
+arm64-v8a)
+	VCPKG_TARGET=arm64-android
+	;;
+armeabi-v7a)
+	VCPKG_TARGET=arm-neon-android
+	;;
+x86_64)
+	VCPKG_TARGET=x64-android
+	;;
+x86)
+	VCPKG_TARGET=x86-android
+	;;
+*)
+	echo "Usage: build_android_deps.sh <arm64-v8a|armeabi-v7a|x86_64|x86>" 1>&2
+	exit 1
+	;;
+esac

 # Get directory of this script

 SCRIPTDIR="$(readlink -f "$0")"
-SCRIPTDIR="$(dirname "$SCRIPTDIR")"
+SCRIPTDIR="$(dirname "${SCRIPTDIR}")"

 # Check if vcpkg.json is one level up - in root directory of RD

-if [ ! -f "$SCRIPTDIR/../vcpkg.json" ]; then
-  echo "Failed! Please check where vcpkg.json is!"
-  exit 1
+if [ ! -f "${SCRIPTDIR}/../vcpkg.json" ]; then
+	echo "ERROR: Can not find vcpkg.json in RustDesk top-level directory" 1>&2
+	exit 1
 fi

-# NDK llvm toolchain
+echo "INFO: Building and install vcpkg dependencies for Android ${ANDROID_ABI} ..."

-HOST_TAG="linux-x86_64" # current platform, set as `ls $ANDROID_NDK/toolchains/llvm/prebuilt/`
-TOOLCHAIN=$ANDROID_NDK/toolchains/llvm/prebuilt/$HOST_TAG
+pushd "${SCRIPTDIR}/.."

-function build {
-  ANDROID_ABI=$1
+"${VCPKG_ROOT}/vcpkg" install \
+	--triplet "${VCPKG_TARGET}" \
+	--x-install-root="${VCPKG_ROOT}/installed"

-  case "$ANDROID_ABI" in
-  arm64-v8a)
-     ABI=aarch64-linux-android$API_LEVEL
-     VCPKG_TARGET=arm64-android
-     ;;
-  armeabi-v7a)
-     ABI=armv7a-linux-androideabi$API_LEVEL
-     VCPKG_TARGET=arm-neon-android
-     ;;
-  x86_64)
-     ABI=x86_64-linux-android$API_LEVEL
-     VCPKG_TARGET=x64-android
-     ;;
-  x86)
-     ABI=i686-linux-android$API_LEVEL
-     VCPKG_TARGET=x86-android
-     ;;
-  *)
-     echo "ERROR: ANDROID_ABI must be one of: arm64-v8a, armeabi-v7a, x86_64, x86" >&2
-     return 1
-  esac
+popd

-  echo "*** [$ANDROID_ABI][Start] Build and install vcpkg dependencies"
-  pushd "$SCRIPTDIR/.."
-  $VCPKG_ROOT/vcpkg install --triplet $VCPKG_TARGET --x-install-root="$VCPKG_ROOT/installed"
-  popd
-  head -n 100 "${VCPKG_ROOT}/buildtrees/ffmpeg/build-$VCPKG_TARGET-rel-out.log" || true
-  echo "*** [$ANDROID_ABI][Finished] Build and install vcpkg dependencies"
+echo "INFO: Completed building vcpkg dependencies for Android ${ANDROID_ABI}"

-if [ -d "$VCPKG_ROOT/installed/arm-neon-android" ]; then
-  echo "*** [Start] Move arm-neon-android to arm-android"
+if [ "${ANDROID_ABI}" = 'armeabi-v7a' ]; then
+	# Symlink arm-neon-android to arm-android because cargo-ndk does not
+	# understand NEON suffix.

-  mv "$VCPKG_ROOT/installed/arm-neon-android" "$VCPKG_ROOT/installed/arm-android"
+	if [ -d "${VCPKG_ROOT}/installed/arm-neon-android" ]; then
+		echo 'INFO: Symlinking arm-neon-android to arm-android'

-  echo "*** [Finished] Move arm-neon-android to arm-android"
-fi
-}
-
-if [ ! -z "$ANDROID_ABI" ]; then
-  build "$ANDROID_ABI"
-else
-  echo "Usage: build-android-deps.sh <ANDROID-ABI>" >&2
-  exit 1
+		ln -sf \
+			"${VCPKG_ROOT}/installed/arm-neon-android" \
+			"${VCPKG_ROOT}/installed/arm-android"
+
+		echo 'INFO: Symlinked arm-neon-android to arm-android'
+	else
+		cat 0<<.a
+ERROR: 'vcpkg install' seem to complete successfully but
+directory '${VCPKG_ROOT}/installed/arm-neon-android' is missing!
+
+.a
+
+		exit 1
+	fi
 fi
--- a/flutter/lib/common.dart
+++ b/flutter/lib/common.dart
@@ -598,22 +598,6 @@ class MyTheme {
    }
  }

-  /// Applies [fallbacks] as fontFamilyFallback to every text style in both
-  /// themes. Called once at startup on ARM64 Linux after a CJK font has been
-  /// loaded via FontLoader (see flutter/flutter#139293).
-  static void applyFontFallback(List<String> fallbacks) {
-    lightTheme = lightTheme.copyWith(
-      textTheme: lightTheme.textTheme.apply(fontFamilyFallback: fallbacks),
-      primaryTextTheme:
-          lightTheme.primaryTextTheme.apply(fontFamilyFallback: fallbacks),
-    );
-    darkTheme = darkTheme.copyWith(
-      textTheme: darkTheme.textTheme.apply(fontFamilyFallback: fallbacks),
-      primaryTextTheme:
-          darkTheme.primaryTextTheme.apply(fontFamilyFallback: fallbacks),
-    );
-  }
-
  static ThemeMode currentThemeMode() {
    final preference = getThemeModePreference();
    if (preference == ThemeMode.system) {
@@ -1201,6 +1185,48 @@ void msgBox(SessionID sessionId, String type, String title, String text,
    VoidCallback? onSubmit,
    int? submitTimeout}) {
  dialogManager.dismissAll();
+  if (type.contains('insecure-connection')) {
+    Future<void> closeSession() async {
+      await bind.sessionSetCommon(
+        sessionId: sessionId,
+        key: 'continue-insecure-connection',
+        value: 'N',
+      );
+      dialogManager.dismissAll();
+      closeConnection();
+    }
+
+    void continueSession() {
+      unawaited(
+        bind.sessionSetCommon(
+          sessionId: sessionId,
+          key: 'continue-insecure-connection',
+          value: 'Y',
+        ),
+      );
+      dialogManager.dismissAll();
+    }
+
+    dialogManager.show(
+      (setState, close, context) => CustomAlertDialog(
+        title: null,
+        content: SelectionArea(child: msgboxContent(type, title, text)),
+        actions: [
+          dialogButton(
+            'Continue',
+            onPressed: continueSession,
+            isOutline: true,
+          ),
+          dialogButton('Disconnect', onPressed: closeSession),
+        ],
+        onSubmit: closeSession,
+        onCancel: closeSession,
+      ),
+      tag: '$sessionId-$type-$title-$text-$link',
+    );
+    return;
+  }
+
  List<Widget> buttons = [];
  bool hasOk = false;
  submit() {
@@ -3098,6 +3124,15 @@ void onCopyFingerprint(String value) {
  }
 }

+void onCopyId(String value) {
+  if (value.isNotEmpty) {
+    Clipboard.setData(ClipboardData(text: value));
+    showToast('$value\n${translate("Copied")}');
+  } else {
+    showToast(translate("Invalid ID"));
+  }
+}
+
 Future<bool> callMainCheckSuperUserPermission() async {
  bool checked = await bind.mainCheckSuperUserPermission();
  if (isMacOS) {
@@ -3366,7 +3401,12 @@ Future<List<Rect>> getScreenRectList() async {
 }

 openMonitorInTheSameTab(int i, FFI ffi, PeerInfo pi,
-    {bool updateCursorPos = true}) {
+    {bool updateCursorPos = true, bool recordSelection = true}) {
+  if (recordSelection) {
+    ffi.ffiModel.lastUserDisplay = i;
+    ffi.ffiModel.cancelPendingRestoreTimer();
+    ffi.ffiModel.pendingMonitorRestore = null;
+  }
  final displays = i == kAllDisplayValue
      ? List.generate(pi.displays.length, (index) => index)
      : [i];
@@ -3973,6 +4013,11 @@ bool whitelistNotEmpty() {
  return v != '' && v != ',';
 }

+bool idWhitelistNotEmpty() {
+  final v = bind.mainGetOptionSync(key: kOptionIdWhitelist);
+  return v != '' && v != ',';
+}
+
 // `setMovable()` is only supported on macOS.
 //
 // On macOS, the window can be dragged by the tab bar by default.
--- a/flutter/lib/common/widgets/dialog.dart
+++ b/flutter/lib/common/widgets/dialog.dart
@@ -205,6 +205,10 @@ void changeWhiteList({Function()? callback}) async {
          const SizedBox(
            height: 8.0,
          ),
+          Text(translate("whitelist_cidr_tip")),
+          const SizedBox(
+            height: 8.0,
+          ),
          Row(
            children: [
              Expanded(
@@ -282,6 +286,111 @@ void changeWhiteList({Function()? callback}) async {
  });
 }

+void changeIdWhiteList({Function()? callback}) async {
+  final curIdWhiteList = await bind.mainGetOption(key: kOptionIdWhitelist);
+  var newIdWhiteListField = curIdWhiteList == defaultOptionWhitelist
+      ? ''
+      : curIdWhiteList.split(',').join('\n');
+  var controller = TextEditingController(text: newIdWhiteListField);
+  var msg = "";
+  var isInProgress = false;
+  final isOptFixed = isOptionFixed(kOptionIdWhitelist);
+  gFFI.dialogManager.show((setState, close, context) {
+    return CustomAlertDialog(
+      title: Text(translate("ID whitelisting")),
+      content: Column(
+        crossAxisAlignment: CrossAxisAlignment.start,
+        children: [
+          Text(translate("whitelist_sep")),
+          const SizedBox(
+            height: 8.0,
+          ),
+          Text(translate("id_whitelist_wildcard_tip")),
+          const SizedBox(
+            height: 8.0,
+          ),
+          Text(translate("id_whitelist_caveat_tip")),
+          const SizedBox(
+            height: 8.0,
+          ),
+          Row(
+            children: [
+              Expanded(
+                child: TextField(
+                        maxLines: null,
+                        decoration: InputDecoration(
+                          errorText: msg.isEmpty ? null : translate(msg),
+                        ),
+                        controller: controller,
+                        enabled: !isOptFixed,
+                        autofocus: true)
+                    .workaroundFreezeLinuxMint(),
+              ),
+            ],
+          ),
+          const SizedBox(
+            height: 4.0,
+          ),
+          // NOT use Offstage to wrap LinearProgressIndicator
+          if (isInProgress) const LinearProgressIndicator(),
+        ],
+      ),
+      actions: [
+        dialogButton("Cancel", onPressed: close, isOutline: true),
+        if (!isOptFixed)
+          dialogButton("Clear", onPressed: () async {
+            await bind.mainSetOption(
+                key: kOptionIdWhitelist, value: defaultOptionWhitelist);
+            callback?.call();
+            close();
+          }, isOutline: true),
+        if (!isOptFixed)
+          dialogButton(
+            "OK",
+            onPressed: () async {
+              setState(() {
+                msg = "";
+                isInProgress = true;
+              });
+              newIdWhiteListField = controller.text.trim();
+              var newIdWhiteList = "";
+              if (newIdWhiteListField.isEmpty) {
+                // pass
+              } else {
+                final ids = newIdWhiteListField
+                    .trim()
+                    .split(RegExp(r"[\s,;\n]+"))
+                    .where((e) => e.isNotEmpty)
+                    .toList();
+                // Separators are handled above; allow all other Unicode characters.
+                for (final id in ids) {
+                  final hasControlCharacters = id.runes.any(
+                      (char) => char <= 0x1f || (char >= 0x7f && char <= 0x9f));
+                  if (hasControlCharacters) {
+                    msg = "${translate("Invalid ID")} $id";
+                    setState(() {
+                      isInProgress = false;
+                    });
+                    return;
+                  }
+                }
+                newIdWhiteList = ids.join(',');
+              }
+              if (newIdWhiteList.trim().isEmpty) {
+                newIdWhiteList = defaultOptionWhitelist;
+              }
+              await bind.mainSetOption(
+                  key: kOptionIdWhitelist, value: newIdWhiteList);
+              callback?.call();
+              close();
+            },
+          ),
+      ],
+      onCancel: close,
+    );
+  });
+}
+
 Future<String> changeDirectAccessPort(
    String currentIP, String currentPort) async {
  final controller = TextEditingController(text: currentPort);
--- a/flutter/lib/common/widgets/toolbar.dart
+++ b/flutter/lib/common/widgets/toolbar.dart
@@ -583,6 +583,7 @@ List<TTextMenu> toolbarControls(BuildContext context, String id, FFI ffi) {
  }
  // record
  if (!(isDesktop || isWeb) &&
+      bind.mainGetLocalOption(key: kOptionHideRecordingButton) != 'Y' &&
      (ffi.recordingModel.start || (perms["recording"] != false))) {
    v.add(TTextMenu(
        child: Row(
@@ -606,7 +607,7 @@ List<TTextMenu> toolbarControls(BuildContext context, String id, FFI ffi) {
  // to-do:
  // 1. Web desktop
  // 2. Mobile, copy the image to the clipboard
-  if (isDesktop) {
+  if ((isDefaultConn || ffi.connType == ConnType.viewCamera) && isDesktop) {
    final isScreenshotSupported = bind.sessionGetCommonSync(
        sessionId: sessionId, key: 'is_screenshot_supported', param: '');
    if ('true' == isScreenshotSupported) {
--- a/flutter/lib/consts.dart
+++ b/flutter/lib/consts.dart
@@ -95,6 +95,7 @@ const String kOptionForceAlwaysRelay = "force-always-relay";
 const String kOptionViewOnly = "view_only";
 const String kOptionEnableLanDiscovery = "enable-lan-discovery";
 const String kOptionWhitelist = "whitelist";
+const String kOptionIdWhitelist = "id-whitelist";
 const String kOptionEnableAbr = "enable-abr";
 const String kOptionEnableRecordSession = "enable-record-session";
 const String kOptionDirectServer = "direct-server";
@@ -104,6 +105,7 @@ const String kOptionAutoDisconnectTimeout = "auto-disconnect-timeout";
 const String kOptionEnableHwcodec = "enable-hwcodec";
 const String kOptionAllowAutoRecordIncoming = "allow-auto-record-incoming";
 const String kOptionAllowAutoRecordOutgoing = "allow-auto-record-outgoing";
+const String kOptionHideRecordingButton = "hide-recording-button";
 const String kOptionVideoSaveDirectory = "video-save-directory";
 const String kOptionAccessMode = "access-mode";
 const String kOptionEnableKeyboard = "enable-keyboard";
@@ -177,6 +179,7 @@ const String kOptionAllowAskForNoteAtEndOfConnection = "allow-ask-for-note";
 const String kOptionAllowMonitorSwitchMainToolbar = "allow-monitor-switch-main-toolbar";
 const String kOptionAllowMonitorSwitchMinToolbar = "allow-monitor-switch-min-toolbar";
 const String kOptionEnableShowTerminalExtraKeys = "enable-show-terminal-extra-keys";
+const String kOptionShowTerminalCtrlKeys = "show-terminal-extra-ctrl-keys";

 // network options
 const String kOptionAllowWebSocket = "allow-websocket";
--- a/flutter/lib/desktop/pages/desktop_setting_page.dart
+++ b/flutter/lib/desktop/pages/desktop_setting_page.dart
@@ -483,13 +483,16 @@ class _GeneralState extends State<_General> {
  }

  Widget other() {
-    final showAutoUpdate = isWindows && bind.mainIsInstalled();
+    final incomingOnly = bind.isIncomingOnly();
+    final outgoingOnly = bind.isOutgoingOnly();
+    final showAutoUpdate = (isWindows && bind.mainIsInstalled()) ||
+    (isMacOS && bind.mainIsInstalled() && bind.mainIsInstalledDaemon(prompt: false) && !bind.isCustomClient());
    final children = <Widget>[
-      if (!isWeb && !bind.isIncomingOnly())
+      if (!isWeb && !incomingOnly)
        _OptionCheckBox(context, 'Confirm before closing multiple tabs',
            kOptionEnableConfirmClosingTabs,
            isServer: false),
-      if (!bind.isIncomingOnly())
+      if (!incomingOnly)
        _OptionCheckBox(
          context,
          'allow-remote-toolbar-docking-any-edge',
@@ -499,9 +502,10 @@ class _GeneralState extends State<_General> {
            reloadAllWindows();
          },
        ),
-      _OptionCheckBox(context, 'Adaptive bitrate', kOptionEnableAbr),
+      if (!isWeb && !outgoingOnly)
+        _OptionCheckBox(context, 'Adaptive bitrate', kOptionEnableAbr),
      if (!isWeb) wallpaper(),
-      if (!isWeb && !bind.isIncomingOnly()) ...[
+      if (!isWeb && !incomingOnly) ...[
        _OptionCheckBox(
          context,
          'Open connection in new tab',
@@ -540,40 +544,40 @@ class _GeneralState extends State<_General> {
              isServer: false,
            ),
          ),
-        if (!isWeb && !bind.isCustomClient())
-          _OptionCheckBox(
-            context,
-            'Check for software update on startup',
-            kOptionEnableCheckUpdate,
-            isServer: false,
-          ),
-        if (showAutoUpdate)
-          _OptionCheckBox(
-            context,
-            'Auto update',
-            kOptionAllowAutoUpdate,
-            isServer: true,
-          ),
-        if (isWindows && !bind.isOutgoingOnly())
-          _OptionCheckBox(
-            context,
-            'Capture screen using DirectX',
-            kOptionDirectxCapture,
-          ),
-        if (!bind.isIncomingOnly()) ...[
-          _OptionCheckBox(
-            context,
-            'Enable UDP hole punching',
-            kOptionEnableUdpPunch,
-            isServer: false,
-          ),
-          _OptionCheckBox(
-            context,
-            'Enable IPv6 P2P connection',
-            kOptionEnableIpv6Punch,
-            isServer: false,
-          ),
-        ],
+      ],
+      if (!isWeb && !bind.isCustomClient())
+        _OptionCheckBox(
+          context,
+          'Check for software update on startup',
+          kOptionEnableCheckUpdate,
+          isServer: false,
+        ),
+      if (showAutoUpdate)
+        _OptionCheckBox(
+          context,
+          'Auto update',
+          kOptionAllowAutoUpdate,
+          isServer: true,
+        ),
+      if (isWindows && !outgoingOnly)
+        _OptionCheckBox(
+          context,
+          'Capture screen using DirectX',
+          kOptionDirectxCapture,
+        ),
+      if (!isWeb && !incomingOnly) ...[
+        _OptionCheckBox(
+          context,
+          'Enable UDP hole punching',
+          kOptionEnableUdpPunch,
+          isServer: false,
+        ),
+        _OptionCheckBox(
+          context,
+          'Enable IPv6 P2P connection',
+          kOptionEnableIpv6Punch,
+          isServer: false,
+        ),
      ],
    ];

@@ -1294,6 +1298,7 @@ class _SafetyState extends State<_Safety> with AutomaticKeepAliveClientMixin {
          reverse: true, enabled: enabled),
      ...directIp(context),
      whitelist(),
+      idWhitelist(),
      ...autoDisconnect(context),
      _OptionCheckBox(context, 'keep-awake-during-incoming-sessions-label',
          kOptionKeepAwakeDuringIncomingSessions,
@@ -1451,6 +1456,52 @@ class _SafetyState extends State<_Safety> with AutomaticKeepAliveClientMixin {
    return tmpWrapper();
  }

+  Widget idWhitelist() {
+    bool enabled = !locked;
+    RxBool hasIdWhitelist = idWhitelistNotEmpty().obs;
+    update() async {
+      hasIdWhitelist.value = idWhitelistNotEmpty();
+    }
+
+    onChanged(bool? checked) async {
+      changeIdWhiteList(callback: update);
+    }
+
+    final isOptFixed = isOptionFixed(kOptionIdWhitelist);
+    return GestureDetector(
+      child: Tooltip(
+        message: translate('id_whitelist_tip'),
+        child: Obx(() => Row(
+              children: [
+                Checkbox(
+                        value: hasIdWhitelist.value,
+                        onChanged: enabled && !isOptFixed ? onChanged : null)
+                    .marginOnly(right: 5),
+                Offstage(
+                  offstage: !hasIdWhitelist.value,
+                  child: MouseRegion(
+                    child: const Icon(Icons.warning_amber_rounded,
+                            color: Color.fromARGB(255, 255, 204, 0))
+                        .marginOnly(right: 5),
+                    cursor: SystemMouseCursors.click,
+                  ),
+                ),
+                Expanded(
+                    child: Text(
+                  translate('Use ID whitelisting'),
+                  style: TextStyle(color: disabledTextColor(context, enabled)),
+                ))
+              ],
+            )),
+      ),
+      onTap: enabled
+          ? () {
+              onChanged(!hasIdWhitelist.value);
+            }
+          : null,
+    ).marginOnly(left: _kCheckBoxLeftMargin);
+  }
+
  Widget hide_cm(bool enabled) {
    return ChangeNotifierProvider.value(
        value: gFFI.serverModel,
@@ -2411,17 +2462,20 @@ class _AboutState extends State<_About> {
      final version = await bind.mainGetVersion();
      final buildDate = await bind.mainGetBuildDate();
      final fingerprint = await bind.mainGetFingerprint();
+      final myId = await bind.mainGetMyId();
      return {
        'license': license,
        'version': version,
        'buildDate': buildDate,
-        'fingerprint': fingerprint
+        'fingerprint': fingerprint,
+        'myId': myId
      };
    }(), hasData: (data) {
      final license = data['license'].toString();
      final version = data['version'].toString();
      final buildDate = data['buildDate'].toString();
      final fingerprint = data['fingerprint'].toString();
+      final myId = data['myId'].toString();
      const linkStyle = TextStyle(decoration: TextDecoration.underline);
      final scrollController = ScrollController();
      return SingleChildScrollView(
@@ -2443,6 +2497,9 @@ class _AboutState extends State<_About> {
                SelectionArea(
                    child: Text('${translate('Fingerprint')}: $fingerprint')
                        .marginSymmetric(vertical: 4.0)),
+              SelectionArea(
+                  child: Text('${translate('ID')}: $myId')
+                      .marginSymmetric(vertical: 4.0)),
              InkWell(
                  onTap: () {
                    launchUrlString('https://rustdesk.com/privacy.html');
@@ -2471,7 +2528,7 @@ class _AboutState extends State<_About> {
                        crossAxisAlignment: CrossAxisAlignment.start,
                        children: [
                          Text(
-                            'Copyright © ${DateTime.now().toString().substring(0, 4)} Purslane Ltd.\n$license',
+                            'Copyright © ${DateTime.now().toString().substring(0, 4)} Purslane Tech Pte. Ltd.\n$license',
                            style: const TextStyle(color: Colors.white),
                          ),
                          Text(
--- a/flutter/lib/desktop/pages/macos_full_screen_focus_recovery.dart
+++ b/flutter/lib/desktop/pages/macos_full_screen_focus_recovery.dart
@@ -0,0 +1,24 @@
+class MacOSFullScreenFocusRecovery {
+  int _generation = 0;
+  int? _pendingGeneration;
+
+  int? get pendingGeneration => _pendingGeneration;
+
+  int queue() {
+    _generation += 1;
+    _pendingGeneration = _generation;
+    return _generation;
+  }
+
+  void cancel() {
+    _pendingGeneration = null;
+  }
+
+  bool isCurrent(int generation) => _pendingGeneration == generation;
+
+  bool consume(int generation) {
+    if (!isCurrent(generation)) return false;
+    _pendingGeneration = null;
+    return true;
+  }
+}
--- a/flutter/lib/desktop/pages/remote_page.dart
+++ b/flutter/lib/desktop/pages/remote_page.dart
@@ -22,6 +22,7 @@ import '../../utils/image.dart';
 import '../widgets/remote_toolbar.dart';
 import '../widgets/kb_layout_type_chooser.dart';
 import '../widgets/tabbar_widget.dart';
+import 'macos_full_screen_focus_recovery.dart';

 import 'package:flutter_hbb/native/custom_cursor.dart'
    if (dart.library.html) 'package:flutter_hbb/web/custom_cursor.dart';
@@ -64,6 +65,13 @@ class RemotePage extends StatefulWidget {

  FFI get ffi => (_lastState.value! as _RemotePageState)._ffi;

+  void releaseMacOSInputForTabTransfer() {
+    if (!isMacOS) return;
+    // Release before removing the source tab. Its delayed disposal must not
+    // disable a native keyboard hook already acquired by the destination page.
+    (_lastState.value! as _RemotePageState)._releaseMacOSRemoteInput();
+  }
+
  @override
  State<RemotePage> createState() {
    final state = _RemotePageState(id);
@@ -76,10 +84,28 @@ class _RemotePageState extends State<RemotePage>
    with
        AutomaticKeepAliveClientMixin,
        MultiWindowListener,
+        WidgetsBindingObserver,
        TickerProviderStateMixin {
  Timer? _timer;
  String keyboardMode = "legacy";
  bool _isWindowBlur = false;
+  // Known macOS remote-input trade-offs (kept simple intentionally):
+  // 1. Dialogs rely on FocusNode loss plus middleBlocked, not mirrored dialog
+  //    state. Reproduce: activate remote input, open a dialog, then type.
+  // 2. Delayed fullscreen recovery can race a local-control focus change; no
+  //    owner state is added. Reproduce: focus the toolbar during a Space switch.
+  // 3. Input-source switching releases native input without updating this
+  //    page's cache. Reproduce: switch sources, then type before and after
+  //    clicking the remote image; the click reasserts input.
+  // These latches compensate for out-of-order macOS focus events. Treat them
+  // as coupled when changing a transition or _syncMacOSKeyboardGrab().
+  AppLifecycleState? _macOSLifecycleState;
+  bool _macOSLocalFocusLost = false;
+  bool _macOSInputActive = false;
+  bool _macOSInputSuppressed = false;
+  final _macOSFullScreenFocusRecovery = MacOSFullScreenFocusRecovery();
+  bool _macOSExplicitFocusRequestPending = false;
+  StreamSubscription<DesktopTabState>? _tabStateSubscription;
  final _cursorOverImage = false.obs;
  late RxBool _showRemoteCursor;
  late RxBool _zoomCursor;
@@ -122,6 +148,13 @@ class _RemotePageState extends State<RemotePage>
  void initState() {
    super.initState();
    _ffi = FFI(widget.sessionId);
+    if (isMacOS) {
+      // SchedulerBinding.instance.lifecycleState is null in the first connection in a new window.
+      _macOSLifecycleState = SchedulerBinding.instance.lifecycleState;
+      WidgetsBinding.instance.addObserver(this);
+      _tabStateSubscription =
+          widget.tabController?.state.listen(_onMacOSTabStateChanged);
+    }
    Get.put<FFI>(_ffi, tag: widget.id);
    _ffi.imageModel.addCallbackOnFirstImage((String peerId) {
      _ffi.canvasModel.activateLocalCursor();
@@ -231,19 +264,224 @@ class _RemotePageState extends State<RemotePage>
    _pointerLockCenterDebounceTimer = null;
  }

+  bool get _isSelectedTab {
+    final controller = widget.tabController;
+    if (controller == null) return true;
+    final tabState = controller.state.value;
+    final selected = tabState.selected;
+    return selected >= 0 &&
+        selected < tabState.tabs.length &&
+        tabState.tabs[selected].key == widget.id;
+  }
+
+  bool get _isMacOSKeyboardContextActive {
+    return stateGlobal.isFocused.value && !_isWindowBlur && _isSelectedTab;
+  }
+
+  void _onMacOSTabStateChanged(DesktopTabState _) {
+    if (!_isSelectedTab) {
+      _macOSFullScreenFocusRecovery.cancel();
+      _syncMacOSKeyboardGrab();
+      return;
+    }
+    // Tab listeners run synchronously. Defer the selected page so the previous
+    // page releases first; a late leave from it can disable the new session.
+    scheduleMicrotask(() {
+      if (mounted) {
+        _syncMacOSKeyboardGrab(reassert: true);
+      }
+    });
+  }
+
+  void _releaseMacOSRemoteInput() {
+    _macOSFullScreenFocusRecovery.cancel();
+    _macOSExplicitFocusRequestPending = false;
+    _macOSInputSuppressed = true;
+    _macOSLocalFocusLost = true;
+    _ffi.inputModel.enterOrLeave(false);
+    _macOSInputActive = false;
+    _rawKeyFocusNode.unfocus();
+  }
+
+  void _onMacOSFocusChange() {
+    // requestFocus() notifies later; only a recorded explicit request may clear
+    // the local-focus-loss latch.
+    if (_rawKeyFocusNode.hasPrimaryFocus) {
+      final explicitRequest = _macOSExplicitFocusRequestPending;
+      _macOSExplicitFocusRequestPending = false;
+      if (explicitRequest && _isMacOSKeyboardContextActive) {
+        _macOSLocalFocusLost = false;
+      }
+      _syncMacOSKeyboardGrab(allowInactiveLifecycle: explicitRequest);
+    } else {
+      if (_macOSInputActive) {
+        _ffi.inputModel.enterOrLeave(false);
+        _macOSInputActive = false;
+      }
+      if (_isMacOSKeyboardContextActive) {
+        _macOSLocalFocusLost = true;
+      }
+    }
+  }
+
+  // 1. Sync the keyboard grab state with the current context.
+  // 2. Call enterOrLeave() to update the input state in the FFI layer.
+  // 3. Request or unfocus the raw key focus node based on the current context.
+  // Flutter focus and native input are separate; native input activates only
+  // after the FocusNode has primary focus.
+  void _syncMacOSKeyboardGrab({
+    bool reassert = false,
+    bool allowInactiveLifecycle = false,
+  }) {
+    if (!isMacOS) return;
+    // A secondary engine may stay hidden while its window is visible, so
+    // explicit pointer/fullscreen recovery must bypass the global lifecycle.
+    final lifecycleAllowsInput = allowInactiveLifecycle ||
+        _macOSLifecycleState == null ||
+        _macOSLifecycleState == AppLifecycleState.resumed;
+    // Input stays pointer-gated except for focused fullscreen recovery, which
+    // compensates when macOS omits PointerEnter during a Space switch.
+    final shouldFocus = lifecycleAllowsInput &&
+        _isMacOSKeyboardContextActive &&
+        !_macOSInputSuppressed &&
+        _blockableOverlayState.middleBlocked.isFalse &&
+        _cursorOverImage.value &&
+        !_macOSLocalFocusLost;
+    final hasFocus = _rawKeyFocusNode.hasPrimaryFocus;
+    final shouldActivateInput = shouldFocus && hasFocus;
+
+    if (shouldActivateInput != _macOSInputActive ||
+        (shouldActivateInput && reassert)) {
+      _ffi.inputModel.enterOrLeave(shouldActivateInput);
+    }
+    _macOSInputActive = shouldActivateInput;
+
+    if (!shouldFocus) {
+      _macOSExplicitFocusRequestPending = false;
+      if (hasFocus) _rawKeyFocusNode.unfocus();
+    } else if (!hasFocus) {
+      _macOSExplicitFocusRequestPending = allowInactiveLifecycle;
+      _rawKeyFocusNode.requestFocus();
+    } else {
+      _macOSExplicitFocusRequestPending = false;
+    }
+  }
+
+  void _restoreMacOSKeyboardAfterFullScreen({
+    required int generation,
+    bool allowHiddenLifecycle = false,
+  }) {
+    // Fullscreen callbacks preserve recovery while hidden. Native window focus
+    // may bypass a stale hidden lifecycle for the newly visible Space.
+    if (!_macOSFullScreenFocusRecovery.isCurrent(generation) ||
+        (!allowHiddenLifecycle &&
+            _macOSLifecycleState == AppLifecycleState.hidden)) {
+      return;
+    }
+    final contextActive =
+        stateGlobal.isFocused.value && !_isWindowBlur && _isSelectedTab;
+    // macOS can focus a fullscreen Space without sending PointerEnter. Native
+    // window focus is authoritative here; a later blur cancels this generation
+    // before an off-screen window can restore input.
+    final shouldInferPointerInside = !_cursorOverImage.value &&
+        allowHiddenLifecycle &&
+        stateGlobal.fullscreen.isTrue &&
+        contextActive;
+    final canRestore = contextActive &&
+        _blockableOverlayState.middleBlocked.isFalse &&
+        (_cursorOverImage.value || shouldInferPointerInside);
+    if (!_macOSFullScreenFocusRecovery.consume(generation)) return;
+    if (!canRestore) {
+      // Consuming recovery here requires a later pointer/window/tab event.
+      return;
+    }
+    if (shouldInferPointerInside) {
+      _cursorOverImage.value = true;
+    }
+    _macOSLocalFocusLost = false;
+    stateGlobal.getInputSource(force: true);
+    _syncMacOSKeyboardGrab(reassert: true, allowInactiveLifecycle: true);
+  }
+
+  void _scheduleMacOSKeyboardAfterFullScreen({
+    required int generation,
+    bool allowHiddenLifecycle = false,
+  }) {
+    // Fullscreen can deliver FocusNode loss after its callback; wait for frame
+    // completion and then advance one event-loop turn before restoring.
+    WidgetsBinding.instance.addPostFrameCallback((_) {
+      Timer.run(() {
+        if (mounted) {
+          _restoreMacOSKeyboardAfterFullScreen(
+            generation: generation,
+            allowHiddenLifecycle: allowHiddenLifecycle,
+          );
+        }
+      });
+    });
+    WidgetsBinding.instance.ensureVisualUpdate();
+  }
+
+  void _queueMacOSKeyboardAfterFullScreen({
+    bool allowHiddenLifecycle = false,
+  }) {
+    final generation = _macOSFullScreenFocusRecovery.queue();
+    if (_macOSLifecycleState == AppLifecycleState.paused ||
+        _macOSLifecycleState == AppLifecycleState.detached) {
+      _macOSFullScreenFocusRecovery.cancel();
+      return;
+    }
+    _scheduleMacOSKeyboardAfterFullScreen(
+      generation: generation,
+      allowHiddenLifecycle: allowHiddenLifecycle,
+    );
+  }
+
+  @override
+  void didChangeAppLifecycleState(AppLifecycleState state) {
+    super.didChangeAppLifecycleState(state);
+    if (!isMacOS || _macOSLifecycleState == state) return;
+    _macOSLifecycleState = state;
+    if (state == AppLifecycleState.resumed) {
+      _syncMacOSKeyboardGrab(reassert: true);
+    } else if (_macOSInputActive) {
+      _ffi.inputModel.enterOrLeave(false);
+      _macOSInputActive = false;
+    }
+
+    final generation = _macOSFullScreenFocusRecovery.pendingGeneration;
+    if (generation == null) return;
+    if (state == AppLifecycleState.inactive ||
+        state == AppLifecycleState.resumed) {
+      _scheduleMacOSKeyboardAfterFullScreen(generation: generation);
+    } else if (state == AppLifecycleState.paused ||
+        state == AppLifecycleState.detached) {
+      _macOSFullScreenFocusRecovery.cancel();
+    }
+  }
+
  @override
  void onWindowBlur() {
    super.onWindowBlur();
    // On windows, we use `focus` way to handle keyboard better.
    // Now on Linux, there's some rdev issues which will break the input.
-    // We disable the `focus` way for non-Windows temporarily.
-    if (isWindows) {
+    // We disable the `focus` way for Linux temporarily.
+    if (isWindows || isMacOS) {
      _isWindowBlur = true;
+    }
+    if (isMacOS) {
+      _macOSFullScreenFocusRecovery.cancel();
+      // A blur or Space switch may not emit PointerExit, so cursor state alone
+      // cannot prevent the old remote surface from reclaiming the keyboard.
+      _macOSLocalFocusLost = true;
+    }
+    if (isWindows) {
      // unfocus the primary-focus when the whole window is lost focus,
      // and let OS to handle events instead.
      _rawKeyFocusNode.unfocus();
    }
    stateGlobal.isFocused.value = false;
+    _syncMacOSKeyboardGrab();

    // When window loses focus, temporarily release relative mouse mode constraints
    // to allow user to interact with other applications normally.
@@ -257,16 +495,41 @@ class _RemotePageState extends State<RemotePage>
  void onWindowFocus() {
    super.onWindowFocus();
    // See [onWindowBlur].
-    if (isWindows) {
+    if (isWindows || isMacOS) {
      _isWindowBlur = false;
    }
+    if (isMacOS) stateGlobal.getInputSource(force: true);
    stateGlobal.isFocused.value = true;

+    // Normal macOS windows wait for PointerEnter or PointerDown. A focused
+    // fullscreen Space queues delayed recovery; if this window blurs again, the
+    // pending recovery is cancelled before native input can reactivate.
+    // Regression: switch directly between fullscreen remote Spaces without
+    // moving or clicking; only the newly focused session may receive input.
+    if (isMacOS &&
+        stateGlobal.fullscreen.isTrue &&
+        !_ffi.inputModel.relativeMouseMode.value) {
+      // Native window focus is authoritative when a secondary engine retains a
+      // stale hidden lifecycle state after its fullscreen Space becomes visible.
+      _queueMacOSKeyboardAfterFullScreen(allowHiddenLifecycle: true);
+    }
+
    // Restore relative mouse mode constraints when window regains focus.
    if (_ffi.inputModel.relativeMouseMode.value) {
-      _rawKeyFocusNode.requestFocus();
+      if (isMacOS) {
+        // Native relative mode retains pointer capture and does not emit
+        // PointerEnter after window focus returns. Restore both latches unless
+        // a local overlay still owns input.
+        if (_blockableOverlayState.middleBlocked.isFalse) {
+          _cursorOverImage.value = true;
+          _macOSLocalFocusLost = false;
+        }
+      } else {
+        _rawKeyFocusNode.requestFocus();
+      }
      _ffi.inputModel.onWindowFocus();
    }
+    _syncMacOSKeyboardGrab(reassert: true, allowInactiveLifecycle: true);
  }

  @override
@@ -327,6 +590,13 @@ class _RemotePageState extends State<RemotePage>
  void onWindowMinimize() {
    super.onWindowMinimize();
    WakelockManager.disable(_uniqueKey);
+    if (isMacOS) {
+      _macOSFullScreenFocusRecovery.cancel();
+      _isWindowBlur = true;
+      _cursorOverImage.value = false;
+      stateGlobal.isFocused.value = false;
+      _syncMacOSKeyboardGrab();
+    }
    // Release cursor constraints when minimized
    if (_ffi.inputModel.relativeMouseMode.value) {
      _ffi.inputModel.onWindowBlur();
@@ -338,6 +608,7 @@ class _RemotePageState extends State<RemotePage>
    super.onWindowEnterFullScreen();
    if (isMacOS) {
      stateGlobal.setFullscreen(true);
+      _queueMacOSKeyboardAfterFullScreen();
    }
  }

@@ -346,6 +617,7 @@ class _RemotePageState extends State<RemotePage>
    super.onWindowLeaveFullScreen();
    if (isMacOS) {
      stateGlobal.setFullscreen(false);
+      _queueMacOSKeyboardAfterFullScreen();
    }
  }

@@ -354,6 +626,14 @@ class _RemotePageState extends State<RemotePage>
    final closeSession = closeSessionOnDispose.remove(widget.id) ?? true;

    // https://github.com/flutter/flutter/issues/64935
+    if (isMacOS) {
+      // Tab moves release before transfer to avoid a late retained-session leave.
+      if (closeSession) {
+        _releaseMacOSRemoteInput();
+      }
+      _tabStateSubscription?.cancel();
+      WidgetsBinding.instance.removeObserver(this);
+    }
    super.dispose();
    debugPrint("REMOTE PAGE dispose session $sessionId ${widget.id}");

@@ -368,8 +648,9 @@ class _RemotePageState extends State<RemotePage>
    _ffi.inputModel.onRelativeMouseModeDisabled = null;
    // Relative mouse mode cleanup is centralized in FFI.close(closeSession: ...).
    _ffi.textureModel.onRemotePageDispose(closeSession);
-    if (closeSession) {
+    if (closeSession && !isMacOS) {
      // ensure we leave this session, this is a double check
+      // enterOrLeave() is already called previously in _releaseMacOSRemoteInput() for macOS.
      _ffi.inputModel.enterOrLeave(false);
    }
    DesktopMultiWindow.removeListener(this);
@@ -444,6 +725,8 @@ class _RemotePageState extends State<RemotePage>
                      } else {
                        _ffi.inputModel.enterOrLeave(false);
                      }
+                    } else if (isMacOS) {
+                      _onMacOSFocusChange();
                    }
                  },
                  inputModel: _ffi.inputModel,
@@ -549,7 +832,11 @@ class _RemotePageState extends State<RemotePage>
    }

    // See [onWindowBlur].
-    if (!isWindows) {
+    if (isMacOS) {
+      _macOSLocalFocusLost = false;
+      stateGlobal.getInputSource(force: true);
+      _syncMacOSKeyboardGrab(reassert: true, allowInactiveLifecycle: true);
+    } else if (!isWindows) {
      if (!_rawKeyFocusNode.hasFocus) {
        _rawKeyFocusNode.requestFocus();
      }
@@ -575,7 +862,9 @@ class _RemotePageState extends State<RemotePage>
    }

    // See [onWindowBlur].
-    if (!isWindows) {
+    if (isMacOS) {
+      _syncMacOSKeyboardGrab();
+    } else if (!isWindows) {
      _ffi.inputModel.enterOrLeave(false);
    }
  }
@@ -600,17 +889,29 @@ class _RemotePageState extends State<RemotePage>
      onEnter: onEnter,
      onExit: onExit,
      onPointerDown: (event) {
-        // A double check for blur status.
+        // A double check for blur status on Windows and macOS.
        // Note: If there's an `onPointerDown` event is triggered, `_isWindowBlur` is expected being false.
        // Sometimes the system does not send the necessary focus event to flutter. We should manually
        // handle this inconsistent status by setting `_isWindowBlur` to false. So we can
        // ensure the grab-key thread is running when our users are clicking the remote canvas.
-        if (_isWindowBlur) {
+        if ((isWindows || isMacOS) && _isWindowBlur) {
          debugPrint(
              "Unexpected status: onPointerDown is triggered while the remote window is in blur status");
          _isWindowBlur = false;
        }
-        if (!_rawKeyFocusNode.hasFocus) {
+        if (isMacOS) {
+          // Regions without matching enter/exit callbacks cannot safely own
+          // keyboard state.
+          if (onEnter == null || onExit == null) return;
+          if (!stateGlobal.isFocused.value) {
+            stateGlobal.isFocused.value = true;
+          }
+          _cursorOverImage.value = true;
+          _macOSLocalFocusLost = false;
+          stateGlobal.getInputSource(force: true);
+          _syncMacOSKeyboardGrab(
+              reassert: !isInputSourceFlutter, allowInactiveLifecycle: true);
+        } else if (!_rawKeyFocusNode.hasFocus) {
          _rawKeyFocusNode.requestFocus();
        }
      },
--- a/flutter/lib/desktop/pages/remote_tab_page.dart
+++ b/flutter/lib/desktop/pages/remote_tab_page.dart
@@ -513,15 +513,17 @@ class _ConnectionTabPageState extends State<ConnectionTabPage> {
      final args = jsonDecode(call.arguments);
      final id = args['id'];
      final close = args['close'];
+      RemotePage? remotePage;
      try {
-        final remotePage = tabController.state.value.tabs
+        remotePage = tabController.state.value.tabs
            .firstWhere((tab) => tab.key == id)
            .page as RemotePage;
        returnValue = remotePage.ffi.ffiModel.cachedPeerData.toString();
      } catch (e) {
        debugPrint('Failed to get cached session data: $e');
      }
-      if (close && returnValue != null) {
+      if (close && returnValue != null && remotePage != null) {
+        remotePage.releaseMacOSInputForTabTransfer();
        closeSessionOnDispose[id] = false;
        tabController.closeBy(id);
      }
--- a/flutter/lib/desktop/pages/server_page.dart
+++ b/flutter/lib/desktop/pages/server_page.dart
@@ -495,14 +495,14 @@ class _CmHeaderState extends State<_CmHeader>
                if (client.type_() == ClientType.file)
                  FittedBox(
                    child: Text(
-                      translate("File Transfer"),
+                      translate("Transfer file"),
                      style: TextStyle(color: Colors.white70, fontSize: 12),
                    ),
                  ),
                if (client.type_() == ClientType.camera)
                  FittedBox(
                    child: Text(
-                      translate("View Camera"),
+                      translate("View camera"),
                      style: TextStyle(color: Colors.white70, fontSize: 12),
                    ),
                  ),
--- a/flutter/lib/desktop/pages/terminal_page.dart
+++ b/flutter/lib/desktop/pages/terminal_page.dart
@@ -95,6 +95,13 @@ class _TerminalPageState extends State<TerminalPage>
    // Register this terminal model with FFI for event routing
    _ffi.registerTerminalModel(widget.terminalId, _terminalModel);

+    // Auto-close tab when shell exits
+    _terminalModel.onClosed = () {
+      if (mounted) {
+        widget.tabController.closeBy(widget.tabKey);
+      }
+    };
+
    // Initialize terminal connection
    WidgetsBinding.instance.addPostFrameCallback((_) {
      widget.tabController.onSelected?.call(widget.id);
--- a/flutter/lib/desktop/widgets/remote_toolbar.dart
+++ b/flutter/lib/desktop/widgets/remote_toolbar.dart
@@ -1167,8 +1167,8 @@ class _MonitorMenu extends StatelessWidget {
            tooltip: isMulti
                ? ''
                : isAllMonitors
-                    ? 'all monitors'
-                    : '#${i + 1} monitor',
+                    ? 'All monitors'
+                    : '#{${i + 1}} monitor',
            hMargin: isMulti ? null : 6,
            vMargin: isMulti ? null : 12,
            topLevel: false,
@@ -2484,6 +2484,8 @@ class _KeyboardMenu extends StatelessWidget {
            ? (v) async {
                if (v != null) {
                  await stateGlobal.setInputSource(ffi.sessionId, v);
+                  // Release native input; see the macOS trade-offs in RemotePage.
+                  if (isMacOS) ffi.inputModel.enterOrLeave(false);
                  await ffi.ffiModel.checkDesktopKeyboardMode();
                  await ffi.inputModel.updateKeyboardMode();
                }
@@ -2740,7 +2742,9 @@ class _RecordMenu extends StatelessWidget {
  Widget build(BuildContext context) {
    var ffi = Provider.of<FfiModel>(context);
    var recordingModel = Provider.of<RecordingModel>(context);
-    final visible =
+    final hideRecordingButton =
+        bind.mainGetLocalOption(key: kOptionHideRecordingButton) == 'Y';
+    final visible = !hideRecordingButton &&
        (recordingModel.start || ffi.permissions['recording'] != false);
    if (!visible) return Offstage();
    return _IconMenuButton(
@@ -2852,7 +2856,7 @@ class _IconMenuButtonState extends State<_IconMenuButton> {
        horizontal: widget.hMargin ?? _ToolbarTheme.buttonHMargin,
        vertical: widget.vMargin ?? _ToolbarTheme.buttonVMargin);
    button = Tooltip(
-      message: widget.tooltip,
+      message: translate(widget.tooltip),
      child: button,
    );
    if (widget.topLevel) {
--- a/flutter/lib/main.dart
+++ b/flutter/lib/main.dart
@@ -29,8 +29,6 @@ import 'mobile/pages/home_page.dart';
 import 'mobile/pages/server_page.dart';
 import 'mobile/widgets/deploy_dialog.dart';
 import 'models/platform_model.dart';
-import 'native/font_manager.dart'
-    if (dart.library.html) 'web/font_manager.dart';

 import 'package:flutter_hbb/plugin/handlers.dart'
    if (dart.library.html) 'package:flutter_hbb/web/plugin/handlers.dart';
@@ -39,15 +37,10 @@ import 'package:flutter_hbb/plugin/handlers.dart'
 int? kWindowId;
 WindowType? kWindowType;
 late List<String> kBootArgs;
-bool _cjkFontLoaded = false;

 Future<void> main(List<String> args) async {
  earlyAssert();
  WidgetsFlutterBinding.ensureInitialized();
-  _cjkFontLoaded = await loadSystemCJKFonts();
-  if (_cjkFontLoaded) {
-    MyTheme.applyFontFallback([kLinuxCjkFontFamily]);
-  }

  debugPrint("launch args: $args");
  kBootArgs = List.from(args);
@@ -390,7 +383,6 @@ void _runApp(
      builder: (context, child) {
        child = _keepScaleBuilder(context, child);
        child = botToastBuilder(context, child);
-        if (_cjkFontLoaded) child = _mergeCjkFallback(context, child);
        return child;
      },
    ),
@@ -541,7 +533,6 @@ class _AppState extends State<App> with WidgetsBindingObserver {
              : (context, child) {
                  child = _keepScaleBuilder(context, child);
                  child = botToastBuilder(context, child);
-                  if (_cjkFontLoaded) child = _mergeCjkFallback(context, child);
                  if ((isDesktop && desktopType == DesktopType.main) ||
                      isWebDesktop) {
                    child = keyListenerBuilder(context, child);
@@ -595,19 +586,6 @@ _registerEventHandler() {
  }
 }

-/// Merges the theme's fontFamilyFallback into [DefaultTextStyle] so that
-/// bare [Text] widgets (and those with inherit:true styles) also pick up the
-/// CJK fallback font loaded on ARM64 Linux.
-Widget _mergeCjkFallback(BuildContext context, Widget? child) {
-  final result = child ?? Container();
-  final fallback = Theme.of(context).textTheme.bodyMedium?.fontFamilyFallback;
-  if (fallback == null || fallback.isEmpty) return result;
-  return DefaultTextStyle.merge(
-    style: TextStyle(fontFamilyFallback: fallback),
-    child: result,
-  );
-}
-
 Widget keyListenerBuilder(BuildContext context, Widget? child) {
  return RawKeyboardListener(
    focusNode: FocusNode(),
--- a/flutter/lib/mobile/pages/settings_page.dart
+++ b/flutter/lib/mobile/pages/settings_page.dart
@@ -78,6 +78,7 @@ class _SettingsState extends State<SettingsPage> with WidgetsBindingObserver {
  var _enableAbr = false;
  var _denyLANDiscovery = false;
  var _onlyWhiteList = false;
+  var _onlyIdWhiteList = false;
  var _enableDirectIPAccess = false;
  var _enableRecordSession = false;
  var _enableHardwareCodec = false;
@@ -89,6 +90,7 @@ class _SettingsState extends State<SettingsPage> with WidgetsBindingObserver {
  var _directAccessPort = "";
  var _fingerprint = "";
  var _buildDate = "";
+  var _myId = "";
  var _autoDisconnectTimeout = "";
  var _hideServer = false;
  var _hideProxy = false;
@@ -109,6 +111,7 @@ class _SettingsState extends State<SettingsPage> with WidgetsBindingObserver {
    _denyLANDiscovery = !option2bool(kOptionEnableLanDiscovery,
        bind.mainGetOptionSync(key: kOptionEnableLanDiscovery));
    _onlyWhiteList = whitelistNotEmpty();
+    _onlyIdWhiteList = idWhitelistNotEmpty();
    _enableDirectIPAccess = option2bool(
        kOptionDirectServer, bind.mainGetOptionSync(key: kOptionDirectServer));
    _enableRecordSession = option2bool(kOptionEnableRecordSession,
@@ -217,6 +220,12 @@ class _SettingsState extends State<SettingsPage> with WidgetsBindingObserver {
        _buildDate = buildDate;
      }

+      final myId = await bind.mainGetMyId();
+      if (_myId != myId) {
+        update = true;
+        _myId = myId;
+      }
+
      final isUsingPublicServer = await bind.mainIsUsingPublicServer();
      if (_isUsingPublicServer != isUsingPublicServer) {
        update = true;
@@ -400,6 +409,29 @@ class _SettingsState extends State<SettingsPage> with WidgetsBindingObserver {
          changeWhiteList(callback: update);
        },
      ),
+      SettingsTile.switchTile(
+        title: Row(children: [
+          Expanded(child: Text(translate('Use ID whitelisting'))),
+          Offstage(
+                  offstage: !_onlyIdWhiteList,
+                  child: const Icon(Icons.warning_amber_rounded,
+                      color: Color.fromARGB(255, 255, 204, 0)))
+              .marginOnly(left: 5)
+        ]),
+        initialValue: _onlyIdWhiteList,
+        onToggle: (_) async {
+          update() async {
+            final onlyIdWhiteList = idWhitelistNotEmpty();
+            if (onlyIdWhiteList != _onlyIdWhiteList) {
+              setState(() {
+                _onlyIdWhiteList = onlyIdWhiteList;
+              });
+            }
+          }
+
+          changeIdWhiteList(callback: update);
+        },
+      ),
      SettingsTile.switchTile(
        title: Text(translate('Adaptive bitrate')),
        initialValue: _enableAbr,
@@ -982,6 +1014,14 @@ class _SettingsState extends State<SettingsPage> with WidgetsBindingObserver {
                    child: Text(_fingerprint),
                  ),
                  leading: Icon(Icons.fingerprint)),
+            SettingsTile(
+                onPressed: (context) => onCopyId(_myId),
+                title: Text(translate("ID")),
+                value: Padding(
+                  padding: EdgeInsets.symmetric(vertical: 8),
+                  child: Text(_myId),
+                ),
+                leading: Icon(Icons.perm_identity)),
            SettingsTile(
              title: Text(translate("Privacy Statement")),
              onPressed: (context) =>
--- a/flutter/lib/mobile/pages/terminal_page.dart
+++ b/flutter/lib/mobile/pages/terminal_page.dart
@@ -5,8 +5,11 @@ import 'package:flutter/material.dart';
 import 'package:flutter/services.dart';
 import 'package:flutter_hbb/common.dart';
 import 'package:flutter_hbb/common/widgets/dialog.dart';
+import 'package:flutter_hbb/models/input_modifier_utils.dart';
 import 'package:flutter_hbb/models/model.dart';
+import 'package:flutter_hbb/models/platform_model.dart';
 import 'package:flutter_hbb/models/terminal_model.dart';
+import 'package:flutter_hbb/mobile/terminal_keyboard_utils.dart';
 import 'package:google_fonts/google_fonts.dart';
 import 'package:xterm/xterm.dart';
 import '../../desktop/pages/terminal_connection_manager.dart';
@@ -42,6 +45,11 @@ class _TerminalPageState extends State<TerminalPage>
  final GlobalKey _keyboardKey = GlobalKey();
  double _keyboardHeight = 0;
  late bool _showTerminalExtraKeys;
+  // Ctrl lock state for virtual keyboard: active key presses are mapped to control codes
+  bool _ctrlLocked = false;
+  bool _altLocked = false;
+  // Row3 expand/collapse state for compact keyboard layout
+  bool _row3Expanded = false;
  // For iOS edge swipe gesture
  double _swipeStartX = 0;
  double _swipeCurrentX = 0;
@@ -83,10 +91,29 @@ class _TerminalPageState extends State<TerminalPage>
    // Register this terminal model with FFI for event routing
    _ffi.registerTerminalModel(widget.terminalId, _terminalModel);

+    // Auto-close connection when shell exits
+    _terminalModel.onClosed = () {
+      if (mounted) {
+        closeConnection(id: widget.id);
+      }
+    };
+
    // Web desktop users have full hardware keyboard access, so the on-screen
    // terminal extra keys bar is unnecessary and disabled.
    _showTerminalExtraKeys = !isWebDesktop &&
        mainGetLocalBoolOptionSync(kOptionEnableShowTerminalExtraKeys);
+    _terminalModel.isCtrlLocked = () => _ctrlLocked;
+    _terminalModel.clearCtrlLock = () {
+      if (_ctrlLocked) setState(() => _ctrlLocked = false);
+    };
+    _terminalModel.isAltLocked = () => _altLocked;
+    _terminalModel.clearAltLock = () {
+      if (_altLocked) setState(() => _altLocked = false);
+    };
+    // Load Row3 expand/collapse state from persistent storage. The raw option
+    // read keeps Row3 collapsed when no value has been saved yet.
+    _row3Expanded =
+        bind.mainGetLocalOption(key: kOptionShowTerminalCtrlKeys) == 'Y';
    // Initialize terminal connection
    WidgetsBinding.instance.addPostFrameCallback((_) {
      _ffi.dialogManager
@@ -141,6 +168,39 @@ class _TerminalPageState extends State<TerminalPage>
    return EdgeInsets.only(left: 5.0, right: 5.0, top: topBottom, bottom: topBottom + _sysKeyboardHeight + _keyboardHeight);
  }

+  /// Pastes clipboard text through TerminalModel so keyboard-only modifiers and
+  /// mobile Enter normalization never alter clipboard data.
+  Future<void> _pasteClipboardText() async {
+    final data = await Clipboard.getData(Clipboard.kTextPlain);
+    final text = data?.text;
+    if (text == null || !mounted) return;
+
+    await _terminalModel.pasteText(text);
+    if (mounted) {
+      _terminalModel.terminalController.clearSelection();
+    }
+  }
+
+  KeyEventResult _handleTerminalKeyEvent(FocusNode _, KeyEvent event) {
+    final hardwareKeyboard = HardwareKeyboard.instance;
+    final shouldPaste = shouldHandleTerminalPasteShortcut(
+      logicalKey: event.logicalKey,
+      isKeyDown: event is KeyDownEvent,
+      isKeyRepeat: event is KeyRepeatEvent,
+      controlPressed: hardwareKeyboard.isControlPressed,
+      metaPressed: hardwareKeyboard.isMetaPressed,
+      altPressed: hardwareKeyboard.isAltPressed,
+      shiftPressed: hardwareKeyboard.isShiftPressed,
+      modifierLockActive: _ctrlLocked || _altLocked,
+    );
+    if (!shouldPaste) return KeyEventResult.ignored;
+
+    // Only locked virtual modifiers need interception. Without a lock, keep
+    // xterm's default hardware paste behavior, including bracketed paste mode.
+    unawaited(_pasteClipboardText());
+    return KeyEventResult.handled;
+  }
+
  @override
  Widget build(BuildContext context) {
    super.build(context);
@@ -178,6 +238,7 @@ class _TerminalPageState extends State<TerminalPage>
                    //
                    // Android works fine without this workaround.
                    deleteDetection: isIOS,
+                    onKeyEvent: _handleTerminalKeyEvent,
                    padding: _calculatePadding(heightPx),
                    onSecondaryTapDown: (details, offset) async {
                      final selection = _terminalModel.terminalController.selection;
@@ -186,11 +247,7 @@ class _TerminalPageState extends State<TerminalPage>
                        _terminalModel.terminalController.clearSelection();
                        await Clipboard.setData(ClipboardData(text: text));
                      } else {
-                        final data = await Clipboard.getData('text/plain');
-                        final text = data?.text;
-                        if (text != null) {
-                          _terminalModel.terminal.paste(text);
-                        }
+                        await _pasteClipboardText();
                      }
                    },
                  );
@@ -317,66 +374,171 @@ class _TerminalPageState extends State<TerminalPage>
          mainAxisSize: MainAxisSize.min,
          mainAxisAlignment: MainAxisAlignment.center,
          children: [
+            // Row 1 follows the latest reviewed PR layout.
+            Row(
+              mainAxisAlignment: MainAxisAlignment.center,
+              children: _buildKeyboardKeyButtons(terminalKeyboardRow1Keys),
+            ),
+            // Row 2 ends with the full-width Row3 collapse/expand toggle.
            Row(
              mainAxisAlignment: MainAxisAlignment.center,
              children: [
-                _buildKeyButton('Esc'),
-                const SizedBox(width: 2),
-                _buildKeyButton('/'),
-                const SizedBox(width: 2),
-                _buildKeyButton('|'),
-                const SizedBox(width: 2),
-                _buildKeyButton('Home'),
-                const SizedBox(width: 2),
-                _buildKeyButton('↑'),
-                const SizedBox(width: 2),
-                _buildKeyButton('End'),
-                const SizedBox(width: 2),
-                _buildKeyButton('PgUp'),
-              ],
-            ),
-            Row(
-              mainAxisAlignment: MainAxisAlignment.center,
-              children: [
-                _buildKeyButton('Tab'),
-                const SizedBox(width: 2),
-                _buildKeyButton('Ctrl+C'),
-                const SizedBox(width: 2),
-                _buildKeyButton('~'),
-                const SizedBox(width: 2),
-                _buildKeyButton('←'),
-                const SizedBox(width: 2),
-                _buildKeyButton('↓'),
-                const SizedBox(width: 2),
-                _buildKeyButton('→'),
-                const SizedBox(width: 2),
-                _buildKeyButton('PgDn'),
+                ..._buildKeyboardKeyButtons(terminalKeyboardRow2Keys),
+                const SizedBox(width: terminalKeyboardKeySpacing),
+                _buildCollapseButton(),
              ],
            ),
+            // Row 3 restores paging keys and trailing alignment placeholders.
+            if (_row3Expanded)
+              Row(
+                mainAxisAlignment: MainAxisAlignment.center,
+                children: [
+                  ..._buildKeyboardKeyButtons(terminalKeyboardRow3Keys),
+                  for (var i = 0;
+                      i < terminalKeyboardRow3TrailingPlaceholderCount;
+                      i++) ...[
+                    const SizedBox(width: terminalKeyboardKeySpacing),
+                    const SizedBox(width: terminalKeyboardKeyWidth),
+                  ],
+                ],
+              ),
          ],
        ),
      ),
    );
  }

+  // Ctrl toggle button with highlighted locked state
+  Widget _buildCtrlKeyButton() {
+    return _buildModifierToggleButton(
+      text: 'Ctrl',
+      semanticsLabel: 'Ctrl',
+      isLocked: _ctrlLocked,
+      onPressed: () => setState(() => _ctrlLocked = !_ctrlLocked),
+    );
+  }
+
+  // Alt toggle button with highlighted locked state
+  Widget _buildAltKeyButton() {
+    return _buildModifierToggleButton(
+      text: 'Alt',
+      semanticsLabel: 'Alt',
+      isLocked: _altLocked,
+      onPressed: () => setState(() => _altLocked = !_altLocked),
+    );
+  }
+
+  // Collapse/expand toggle button for Row3
+  void _toggleRow3Expanded() {
+    final willExpand = !_row3Expanded;
+    final shouldClearModifiers = shouldClearTerminalModifiersWhenRow3Collapses(
+      wasExpanded: _row3Expanded,
+      willExpand: willExpand,
+      ctrlLocked: _ctrlLocked,
+      altLocked: _altLocked,
+    );
+    setState(() {
+      _row3Expanded = willExpand;
+      if (shouldClearModifiers) {
+        _ctrlLocked = false;
+        _altLocked = false;
+      }
+    });
+    mainSetLocalBoolOption(kOptionShowTerminalCtrlKeys, willExpand);
+
+    // The floating keyboard height changes after Row3 is inserted/removed.
+    // Re-measure on the next frame so terminal padding uses the new height.
+    WidgetsBinding.instance.addPostFrameCallback((_) {
+      if (!mounted || !_showTerminalExtraKeys) return;
+      setState(() {
+        _updateKeyboardHeight();
+      });
+    });
+  }
+
+  Widget _buildCollapseButton() {
+    return Semantics(
+      label: translate('Show terminal extra keys'),
+      toggled: _row3Expanded,
+      child: ElevatedButton(
+        onPressed: _toggleRow3Expanded,
+        child: Text(_row3Expanded ? '∧' : '∨'),
+        style: ElevatedButton.styleFrom(
+          minimumSize: const Size(terminalKeyboardKeyWidth, 32),
+          padding: EdgeInsets.zero,
+          textStyle: const TextStyle(fontSize: 12),
+          backgroundColor:
+              Theme.of(context).colorScheme.surfaceContainerHighest,
+          foregroundColor: Theme.of(context).colorScheme.onSurfaceVariant,
+        ),
+      ),
+    );
+  }
+
+  /// Builds a fixed-width key sequence with the reviewed 2dp spacing.
+  List<Widget> _buildKeyboardKeyButtons(List<String> labels) {
+    return [
+      for (var i = 0; i < labels.length; i++) ...[
+        _buildKeyButton(labels[i]),
+        if (i < labels.length - 1)
+          const SizedBox(width: terminalKeyboardKeySpacing),
+      ],
+    ];
+  }
+
+  /// Build a modifier toggle button (Ctrl/Alt) with one-shot behavior.
+  /// When [isLocked] is true, the button highlights in blue and the next
+  /// single-character input is mapped to its modified equivalent.
+  Widget _buildModifierToggleButton({
+    required String text,
+    required String semanticsLabel,
+    required bool isLocked,
+    required VoidCallback onPressed,
+  }) {
+    return Semantics(
+      // Ctrl and Alt are technical key names and intentionally stay unchanged.
+      label: semanticsLabel,
+      toggled: isLocked,
+      child: ElevatedButton(
+        onPressed: onPressed,
+        child: Text(text),
+        style: ElevatedButton.styleFrom(
+          minimumSize: const Size(terminalKeyboardKeyWidth, 32),
+          padding: EdgeInsets.zero,
+          textStyle: const TextStyle(fontSize: 12),
+          backgroundColor: isLocked
+              ? Colors.blue
+              : Theme.of(context).colorScheme.surfaceContainerHighest,
+          foregroundColor: isLocked
+              ? Colors.white
+              : Theme.of(context).colorScheme.onSurfaceVariant,
+        ),
+      ),
+    );
+  }
+
  Widget _buildKeyButton(String label) {
+    if (label == 'Ctrl') return _buildCtrlKeyButton();
+    if (label == 'Alt') return _buildAltKeyButton();
+
    return ElevatedButton(
      onPressed: () {
        _sendKeyToTerminal(label);
      },
      child: Text(label),
      style: ElevatedButton.styleFrom(
-        minimumSize: const Size(48, 32),
+        minimumSize: const Size(terminalKeyboardKeyWidth, 32),
        padding: EdgeInsets.zero,
        textStyle: const TextStyle(fontSize: 12),
-        backgroundColor: Theme.of(context).colorScheme.surfaceVariant,
+        backgroundColor:
+            Theme.of(context).colorScheme.surfaceContainerHighest,
        foregroundColor: Theme.of(context).colorScheme.onSurfaceVariant,
      ),
    );
  }

  void _sendKeyToTerminal(String key) {
-    String? send;
+    String send;

    switch (key) {
      case 'Esc':
@@ -420,9 +582,7 @@ class _TerminalPageState extends State<TerminalPage>
        break;
    }

-    if (send != null) {
-      _terminalModel.sendVirtualKey(send);
-    }
+    _terminalModel.sendVirtualKey(send);
  }

  // https://github.com/TerminalStudio/xterm.dart/issues/42#issuecomment-877495472
--- a/flutter/lib/mobile/terminal_keyboard_utils.dart
+++ b/flutter/lib/mobile/terminal_keyboard_utils.dart
@@ -0,0 +1,20 @@
+/// Reviewed mobile terminal keyboard layout from PR #15532.
+///
+/// Keeping the key order outside the widget makes the intended layout explicit
+/// and prevents behavior fixes from silently moving keys between rows.
+const terminalKeyboardRow1Keys = ['Esc', '/', '|', 'Home', '↑', 'End', r'\'];
+const terminalKeyboardRow2Keys = ['Tab', 'Ctrl+C', '~', '←', '↓', '→'];
+const terminalKeyboardRow3Keys = ['Ctrl', 'Alt', '-', 'PgUp', 'PgDn'];
+
+const terminalKeyboardKeyWidth = 48.0;
+const terminalKeyboardKeySpacing = 2.0;
+
+/// Empty 48dp slots keep expanded Row3 aligned with the two rows above it.
+const terminalKeyboardRow3TrailingPlaceholderCount = 2;
+
+/// Returns the fixed width occupied by a row of equally sized key slots.
+double terminalKeyboardRowWidth(int slotCount) {
+  if (slotCount <= 0) return 0;
+  return slotCount * terminalKeyboardKeyWidth +
+      (slotCount - 1) * terminalKeyboardKeySpacing;
+}
--- a/flutter/lib/models/file_model.dart
+++ b/flutter/lib/models/file_model.dart
@@ -142,12 +142,22 @@ class FileModel {
  }

  Future<void> postOverrideFileConfirm(Map<String, dynamic> evt) async {
+    final id = int.tryParse(evt['id']?.toString() ?? '');
+    if (id == null || !jobController.hasTransferConflictJob(id)) {
+      debugPrint("Ignore stale override confirm event: $evt");
+      return;
+    }
    evtLoop.pushEvent(
        _FileDialogEvent(WeakReference(this), FileDialogType.overwrite, evt));
  }

  Future<void> overrideFileConfirm(Map<String, dynamic> evt,
      {bool? overrideConfirm, bool skip = false}) async {
+    final id = int.tryParse(evt['id']?.toString() ?? '') ?? 0;
+    if (id == 0 || !jobController.hasTransferConflictJob(id)) {
+      debugPrint("Ignore override confirm for inactive job: $evt");
+      return;
+    }
    // If `skip == true`, it means to skip this file without showing dialog.
    // Because `resp` may be null after the user operation or the last remembered operation,
    // and we should distinguish them.
@@ -156,15 +166,12 @@ class FileModel {
            ? await showFileConfirmDialog(translate("Overwrite"),
                "${evt['read_path']}", true, evt['is_identical'] == "true")
            : null);
-    final id = int.tryParse(evt['id']) ?? 0;
+    if (!jobController.hasTransferConflictJob(id)) {
+      debugPrint("Ignore override confirm result for inactive job: $evt");
+      return;
+    }
    if (false == resp) {
-      final jobIndex = jobController.getJob(id);
-      if (jobIndex != -1) {
-        await jobController.cancelJob(id);
-        final job = jobController.jobTable[jobIndex];
-        job.state = JobState.done;
-        jobController.jobTable.refresh();
-      }
+      await jobController.cancelTransferConflictBatch(id);
    } else {
      var need_override = false;
      if (resp == null) {
@@ -176,6 +183,7 @@ class FileModel {
      }
      // Update the loop config.
      if (fileConfirmCheckboxRemember) {
+        jobController.rememberTransferConflictBatch(id, resp);
        evtLoop.setSkip(!need_override);
      }
      await bind.sessionSetConfirmOverrideFile(
@@ -285,6 +293,8 @@ class FileModel {
      final isWindows = otherSideData.options.isWindows;
      final showHidden = otherSideData.options.showHidden;
      final jobID = jobController.addTransferJob(entry, false);
+      jobController.registerTransferConflictBatch([jobID],
+          batchId: int.tryParse(obj['batchId']?.toString() ?? ''));
      webSendLocalFiles(
        handleIndex: handleIndex,
        actId: jobID,
@@ -570,8 +580,15 @@ class FileController {
    final toPath = otherSideData.directory.path;
    final isWindows = otherSideData.options.isWindows;
    final showHidden = otherSideData.options.showHidden;
+    final transferJobs = <(Entry, int)>[];
+    final transferJobIds = <int>[];
    for (var from in items.items) {
      final jobID = jobController.addTransferJob(from, isRemoteToLocal);
+      transferJobs.add((from, jobID));
+      transferJobIds.add(jobID);
+    }
+    jobController.registerTransferConflictBatch(transferJobIds);
+    for (final (from, jobID) in transferJobs) {
      bind.sessionSendFiles(
          sessionId: sessionId,
          actId: jobID,
@@ -917,6 +934,10 @@ class JobController {
  static final JobID jobID = JobID();
  final jobTable = List<JobProgress>.empty(growable: true).obs;
  final jobResultListener = JobResultListener<Map<String, dynamic>>();
+  int _nextTransferConflictBatchId = 1;
+  final Map<int, int> _transferConflictJobToBatch = {};
+  int? _transferConflictRememberBatchId;
+  bool? _transferConflictRememberOverrideConfirm;
  final GetSessionID getSessionID;
  final GetDialogManager getDialogManager;
  SessionID get sessionId => getSessionID();
@@ -929,6 +950,57 @@ class JobController {
    return jobTable.indexWhere((element) => element.id == id);
  }

+  void registerTransferConflictBatch(Iterable<int> jobIds, {int? batchId}) {
+    final ids = jobIds.toList(growable: false);
+    if (ids.isEmpty) {
+      return;
+    }
+    batchId ??= _nextTransferConflictBatchId++;
+    if (batchId >= _nextTransferConflictBatchId) {
+      _nextTransferConflictBatchId = batchId + 1;
+    }
+    for (final jobId in ids) {
+      _transferConflictJobToBatch[jobId] = batchId;
+    }
+  }
+
+  int? transferConflictBatchId(int jobId) {
+    return _transferConflictJobToBatch[jobId];
+  }
+
+  bool hasTransferConflictJob(int jobId) {
+    return transferConflictBatchId(jobId) != null;
+  }
+
+  bool isTransferConflictRememberBatch(int? batchId) {
+    return batchId != null && batchId == _transferConflictRememberBatchId;
+  }
+
+  bool? transferConflictRememberOverrideConfirm(int? batchId) {
+    if (!isTransferConflictRememberBatch(batchId)) {
+      return null;
+    }
+    return _transferConflictRememberOverrideConfirm;
+  }
+
+  void rememberTransferConflictBatch(int jobId, bool? overrideConfirm) {
+    _transferConflictRememberBatchId = _transferConflictJobToBatch[jobId];
+    _transferConflictRememberOverrideConfirm = overrideConfirm;
+  }
+
+  void unregisterTransferConflictJob(int jobId) {
+    final batchId = _transferConflictJobToBatch.remove(jobId);
+    if (batchId == null) {
+      return;
+    }
+    if (!_transferConflictJobToBatch.containsValue(batchId)) {
+      if (_transferConflictRememberBatchId == batchId) {
+        _transferConflictRememberBatchId = null;
+        _transferConflictRememberOverrideConfirm = null;
+      }
+    }
+  }
+
  // return jobID
  int addTransferJob(Entry from, bool isRemoteToLocal) {
    final jobID = JobController.jobID.next();
@@ -1000,7 +1072,10 @@ class JobController {
      id = int.parse(evt['id']);
    } catch (_) {}
    final jobIndex = getJob(id);
-    if (jobIndex == -1) return true;
+    if (jobIndex == -1) {
+      unregisterTransferConflictJob(id);
+      return true;
+    }
    final job = jobTable[jobIndex];
    job.recvJobRes = true;
    if (job.type == JobType.deleteFile) {
@@ -1026,6 +1101,9 @@ class JobController {
      job.state = JobState.done;
    }
    jobTable.refresh();
+    if (job.state == JobState.done || job.state == JobState.error) {
+      unregisterTransferConflictJob(id);
+    }
    if (job.type == JobType.deleteDir) {
      return job.state == JobState.done;
    } else {
@@ -1035,9 +1113,15 @@ class JobController {

  void jobError(Map<String, dynamic> evt) {
    final err = evt['err'].toString();
-    int jobIndex = getJob(int.parse(evt['id']));
+    final id = int.tryParse(evt['id']?.toString() ?? '');
+    if (id == null) {
+      debugPrint("Ignore job error with invalid id: $evt");
+      return;
+    }
+    int jobIndex = getJob(id);
    if (jobIndex != -1) {
      final job = jobTable[jobIndex];
+      if (job.state == JobState.done && job.err == "cancel") return;
      job.state = JobState.error;
      job.err = err;
      job.recvJobRes = true;
@@ -1060,6 +1144,11 @@ class JobController {
        }
      }
      jobTable.refresh();
+      if (job.state == JobState.done || job.state == JobState.error) {
+        unregisterTransferConflictJob(job.id);
+      }
+    } else {
+      unregisterTransferConflictJob(id);
    }
    if (err == _kOneWayFileTransferError) {
      if (DateTime.now().millisecondsSinceEpoch - _lastTimeShowMsgbox > 3000) {
@@ -1096,9 +1185,42 @@ class JobController {
  }

  Future<void> cancelJob(int id) async {
+    unregisterTransferConflictJob(id);
    await bind.sessionCancelJob(sessionId: sessionId, actId: id);
  }

+  Future<void> cancelTransferConflictBatch(int jobId) async {
+    final batchId = _transferConflictJobToBatch[jobId];
+    final batchJobIds = batchId == null ? [jobId] : <int>[];
+    if (batchId != null) {
+      for (final entry in _transferConflictJobToBatch.entries) {
+        if (entry.value == batchId) {
+          batchJobIds.add(entry.key);
+        }
+      }
+      for (final id in batchJobIds) {
+        unregisterTransferConflictJob(id);
+      }
+    }
+    final jobIdsToCancel = batchJobIds.toSet();
+    for (final job in jobTable) {
+      if (!jobIdsToCancel.contains(job.id) || job.state == JobState.done) {
+        continue;
+      }
+      job.state = JobState.done;
+      job.err = "cancel";
+      job.recvJobRes = true;
+    }
+    jobTable.refresh();
+    for (final id in batchJobIds) {
+      try {
+        await bind.sessionCancelJob(sessionId: sessionId, actId: id);
+      } catch (e) {
+        debugPrint("Failed to cancel transfer job $id in conflict batch: $e");
+      }
+    }
+  }
+
  Future<void> loadLastJob(Map<String, dynamic> evt) async {
    debugPrint("load last job: $evt");
    Map<String, dynamic> jobDetail = json.decode(evt['value']);
@@ -1145,7 +1267,7 @@ class JobController {
        ..state = JobState.paused;
      jobTable.add(jobProgress);
    }
-
+    registerTransferConflictBatch([currJobId]);
    await bind.sessionAddJob(
      sessionId: sessionId,
      isRemote: isRemote,
@@ -1193,6 +1315,9 @@ class JobController {

  void clear() {
    jobTable.clear();
+    _transferConflictJobToBatch.clear();
+    _transferConflictRememberBatchId = null;
+    _transferConflictRememberOverrideConfirm = null;
    jobResultListener.clear();
  }
 }
@@ -1535,6 +1660,9 @@ class JobProgress {

  String display() {
    if (type == JobType.transfer) {
+      if (state == JobState.done && err == "cancel") {
+        return translate("Cancel");
+      }
      if (state == JobState.done && err == "skipped") {
        return translate("Skipped");
      }
@@ -1844,21 +1972,44 @@ class _FileDialogEvent extends BaseEvent<FileDialogType, Map<String, dynamic>> {

 class FileDialogEventLoop
    extends BaseEventLoop<FileDialogType, Map<String, dynamic>> {
+  int? _batchId;
  bool? _overrideConfirm;
  bool _skip = false;

  @override
  Future<void> onPreConsume(
      BaseEvent<FileDialogType, Map<String, dynamic>> evt) async {
-    var event = evt as _FileDialogEvent;
+    final event = evt as _FileDialogEvent;
+    final model = event.fileModel.target;
+    final jobId = int.tryParse(evt.data['id']?.toString() ?? '');
+    final batchId = model == null || jobId == null
+        ? null
+        : model.jobController.transferConflictBatchId(jobId);
+    final keepRemembered = model != null &&
+        model.jobController.isTransferConflictRememberBatch(batchId);
+    // The loop only preloads the remembered batch choice. The model updates it
+    // after the user answers the current overwrite dialog.
+    if (_batchId != batchId && !keepRemembered) {
+      _batchId = batchId;
+      _overrideConfirm = null;
+      _skip = false;
+    } else {
+      _batchId = batchId;
+    }
+    if (keepRemembered) {
+      _overrideConfirm =
+          model.jobController.transferConflictRememberOverrideConfirm(batchId);
+      _skip = _overrideConfirm == null;
+    }
    event.setOverrideConfirm(_overrideConfirm);
    event.setSkip(_skip);
    debugPrint(
-        "FileDialogEventLoop: consuming<jobId: ${evt.data['id']} overrideConfirm: $_overrideConfirm, skip: $_skip>");
+        "FileDialogEventLoop: consuming<jobId: ${evt.data['id']} batchId: $_batchId overrideConfirm: $_overrideConfirm, skip: $_skip>");
  }

  @override
  Future<void> onEventsClear() {
+    _batchId = null;
    _overrideConfirm = null;
    _skip = false;
    return super.onEventsClear();
--- a/flutter/lib/models/input_modifier_utils.dart
+++ b/flutter/lib/models/input_modifier_utils.dart
@@ -1,4 +1,12 @@
 import 'package:flutter/services.dart';
+import 'package:flutter/widgets.dart';
+
+/// Identifies where terminal input originated so paste data can bypass all
+/// keyboard-only transformations.
+enum TerminalInputSource {
+  keyboard,
+  paste,
+}

 /// Returns true when a stale mobile one-shot Shift state should be released
 /// by replaying a tracked Shift key-down as a synthesized key-up.
@@ -36,3 +44,147 @@ bool shouldReleaseStaleMobileShift({
  }
  return true;
 }
+
+/// Applies the terminal Ctrl/Alt one-shot modifiers to a single input payload.
+///
+String applyTerminalInputModifiers(
+  String data, {
+  required bool ctrlLocked,
+  required bool altLocked,
+}) {
+  var result = data;
+  if (ctrlLocked) {
+    result = _applyTerminalCtrlModifier(result);
+  }
+  if (altLocked) {
+    result = '\x1B$result';
+  }
+  return result;
+}
+
+/// Builds the exact payload xterm sends for paste, without applying modifiers.
+String terminalPastePayload(String text, {required bool bracketedPasteMode}) {
+  if (!bracketedPasteMode) {
+    return text;
+  }
+  return '\x1B[200~$text\x1B[201~';
+}
+
+/// Returns whether one-shot Ctrl/Alt may transform and consume this input.
+///
+/// xterm emits terminal control keys as either one control byte or a longer
+/// escape sequence. Neither form is ordinary text input, so a pending modifier
+/// must survive until the user enters a printable character.
+bool shouldApplyTerminalInputModifiers(String data) {
+  if (data.characters.length != 1) return false;
+  final codeUnit = data.codeUnitAt(0);
+  return codeUnit >= 0x20 && codeUnit != 0x7F;
+}
+
+/// Builds the payload sent to the remote terminal for keyboard and paste input.
+///
+/// Keyboard input keeps the mobile Enter workaround and one-shot Ctrl/Alt
+/// mapping. Paste input deliberately bypasses both transformations so even a
+/// one-character clipboard payload is preserved exactly.
+String prepareTerminalInputPayload(
+  String data, {
+  required TerminalInputSource source,
+  required bool isMobileOrWebMobile,
+  required bool bracketedPasteMode,
+  required bool ctrlLocked,
+  required bool altLocked,
+}) {
+  if (source == TerminalInputSource.paste) {
+    return terminalPastePayload(
+      data,
+      bracketedPasteMode: bracketedPasteMode,
+    );
+  }
+
+  var result = data;
+  if (isMobileOrWebMobile && result == '\n') {
+    result = '\r';
+  }
+  if ((ctrlLocked || altLocked) && shouldApplyTerminalInputModifiers(result)) {
+    result = applyTerminalInputModifiers(
+      result,
+      ctrlLocked: ctrlLocked,
+      altLocked: altLocked,
+    );
+  }
+  return result;
+}
+
+/// Returns true when a hardware paste shortcut must bypass keyboard modifiers.
+///
+/// xterm already handles hardware Ctrl/Cmd+V correctly in the common case. Only
+/// intercept while a virtual Ctrl/Alt lock is active, because xterm can emit a
+/// one-character paste as normal text when bracketed paste mode is disabled.
+bool shouldHandleTerminalPasteShortcut({
+  required LogicalKeyboardKey logicalKey,
+  required bool isKeyDown,
+  required bool isKeyRepeat,
+  required bool controlPressed,
+  required bool metaPressed,
+  required bool altPressed,
+  required bool shiftPressed,
+  required bool modifierLockActive,
+}) {
+  if (!modifierLockActive) return false;
+  if (!isKeyDown && !isKeyRepeat) return false;
+  if (logicalKey != LogicalKeyboardKey.keyV) return false;
+  if (altPressed || shiftPressed) return false;
+  return controlPressed != metaPressed;
+}
+
+/// Returns true when collapsing Row3 should also clear hidden modifier state.
+bool shouldClearTerminalModifiersWhenRow3Collapses({
+  required bool wasExpanded,
+  required bool willExpand,
+  required bool ctrlLocked,
+  required bool altLocked,
+}) {
+  return wasExpanded && !willExpand && (ctrlLocked || altLocked);
+}
+
+String _applyTerminalCtrlModifier(String data) {
+  // Ctrl mappings are defined only for ASCII scalars. A visible character can
+  // be multiple scalars (for example, a decomposed accent), so leave those
+  // graphemes untouched instead of rewriting only their ASCII base letter.
+  final graphemes = data.characters.toList(growable: false);
+  if (graphemes.length != 1) {
+    return data;
+  }
+
+  final runes = graphemes.single.runes.toList(growable: false);
+  if (runes.length != 1) {
+    return data;
+  }
+
+  final code = runes.single;
+  if (code >= 0x61 && code <= 0x7A) {
+    return String.fromCharCode(code - 0x60);
+  }
+  if (code >= 0x41 && code <= 0x5A) {
+    return String.fromCharCode(code - 0x40);
+  }
+  if (code == 0x20) {
+    return String.fromCharCode(0);
+  }
+  if (code == 0x5B) {
+    return String.fromCharCode(27);
+  }
+  if (code == 0x5C) {
+    return String.fromCharCode(28);
+  }
+  if (code == 0x5D) {
+    return String.fromCharCode(29);
+  }
+  if (code == 0x5E) {
+    return String.fromCharCode(30);
+  }
+  if (code == 0x5F || code == 0x2F) {
+    return String.fromCharCode(31);
+  }
+  return data;
+}
--- a/flutter/lib/models/model.dart
+++ b/flutter/lib/models/model.dart
@@ -112,6 +112,9 @@ class CachedPeerData {
 class FfiModel with ChangeNotifier {
  CachedPeerData cachedPeerData = CachedPeerData();
  PeerInfo _pi = PeerInfo();
+  int? lastUserDisplay;
+  int? pendingMonitorRestore;
+  Timer? _pendingRestoreTimer;
  Rect? _rect;

  var _inputBlocked = false;
@@ -248,6 +251,8 @@ class FfiModel with ChangeNotifier {

  clear() {
    _pi = PeerInfo();
+    lastUserDisplay = null;
+    _cancelPendingMonitorRestore();
    _secure = null;
    _direct = null;
    _inputBlocked = false;
@@ -932,6 +937,7 @@ class FfiModel with ChangeNotifier {
      // frame briefly, then shows the Connecting overlay.
      if (_restartReconnectDelayTimer == null) {
        parent.target?.inputModel.setRelativeMouseMode(false);
+        _cancelPendingMonitorRestore();
        bind.sessionReconnect(sessionId: sessionId, forceRelay: false);
        clearPermissions();
        // Retry once more after the silent window so restart reconnect attempts
@@ -1084,10 +1090,22 @@ class FfiModel with ChangeNotifier {
    }
  }

+  void _cancelPendingMonitorRestore() {
+    _pendingRestoreTimer?.cancel();
+    _pendingRestoreTimer = null;
+    pendingMonitorRestore = null;
+  }
+
+  void cancelPendingRestoreTimer() {
+    _pendingRestoreTimer?.cancel();
+    _pendingRestoreTimer = null;
+  }
+
  void reconnect(OverlayDialogManager dialogManager, SessionID sessionId,
      bool forceRelay) {
    // Disable relative mouse mode before reconnecting to ensure cursor is released.
    parent.target?.inputModel.setRelativeMouseMode(false);
+    _cancelPendingMonitorRestore();
    bind.sessionReconnect(sessionId: sessionId, forceRelay: forceRelay);
    clearPermissions();
    dialogManager.dismissAll();
@@ -1401,6 +1419,25 @@ class FfiModel with ChangeNotifier {
        // now replaced to _updateCurDisplay
        updateCurDisplay(sessionId);
      }
+      // After reconnecting, restore the last selected monitor once the canvas is ready.
+      // Switching earlier can offset the view if the monitor sizes differ.
+      final last = lastUserDisplay;
+      pendingMonitorRestore = (!isCache &&
+              last != null &&
+              last != currentDisplay &&
+              bind.sessionGetUseAllMyDisplaysForTheRemoteSession(
+                      sessionId: sessionId) !=
+                  'Y' &&
+              ((last == kAllDisplayValue && _pi.displays.isNotEmpty) ||
+                  (last >= 0 && last < _pi.displays.length)))
+          ? last
+          : null;
+      // Fallback if the first image event never reaches this tab (multi-UI).
+      _pendingRestoreTimer?.cancel();
+      if (pendingMonitorRestore != null) {
+        _pendingRestoreTimer = Timer(const Duration(milliseconds: 1500),
+            () => parent.target?._applyPendingMonitorRestore());
+      }
      if (displays.isNotEmpty) {
        _reconnects = 1;
        _offlineReconnectStartTime = null;
@@ -3911,17 +3948,35 @@ class FFI {
    }
    if (ffiModel.waitForFirstImage.value == true) {
      ffiModel.waitForFirstImage.value = false;
+      ffiModel.cancelPendingRestoreTimer();
      ffiModel.resetRestartReconnectState();
      dialogManager.dismissAll();
-      await canvasModel.updateViewStyle();
-      await canvasModel.updateScrollStyle();
-      await canvasModel.initializeEdgeScrollEdgeThickness();
-      for (final cb in imageModel.callbacksOnFirstImage) {
-        cb(id);
+      try {
+        await canvasModel.updateViewStyle();
+        await canvasModel.updateScrollStyle();
+        await canvasModel.initializeEdgeScrollEdgeThickness();
+        for (final cb in imageModel.callbacksOnFirstImage) {
+          cb(id);
+        }
+      } finally {
+        _applyPendingMonitorRestore();
      }
    }
  }

+  void _applyPendingMonitorRestore() {
+    final restore = ffiModel.pendingMonitorRestore;
+    ffiModel._cancelPendingMonitorRestore();
+    if (restore == null || closed) return;
+    // The display list may have changed since the restore was queued.
+    final displays = ffiModel.pi.displays;
+    if ((restore == kAllDisplayValue && displays.isNotEmpty) ||
+        (restore >= 0 && restore < displays.length)) {
+      openMonitorInTheSameTab(restore, this, ffiModel.pi,
+          recordSelection: false, updateCursorPos: false);
+    }
+  }
+
  /// Login with [password], choose if the client should [remember] it.
  void login(String osUsername, String osPassword, SessionID sessionId,
      String password, bool remember) {
--- a/flutter/lib/models/native_model.dart
+++ b/flutter/lib/models/native_model.dart
@@ -25,6 +25,23 @@ typedef F3 = Pointer<Uint8> Function(Pointer<Utf8>, int);
 typedef F3Dart = Pointer<Uint8> Function(Pointer<Utf8>, Int32);
 typedef HandleEvent = Future<void> Function(Map<String, dynamic> evt);

+/// The Linux bundle keeps the core library at lib/librustdesk.so next to the
+/// executable. Prefer that copy, mirroring flutter/linux/main.cc: the plain
+/// name relies on the loader search path, which repackaged installs may not
+/// cover. https://github.com/rustdesk/rustdesk/discussions/14407
+DynamicLibrary _openLinuxCoreLib() {
+  final bundled =
+      '${File(Platform.resolvedExecutable).parent.path}/lib/librustdesk.so';
+  try {
+    if (File(bundled).existsSync()) {
+      return DynamicLibrary.open(bundled);
+    }
+  } catch (e) {
+    debugPrint("Failed to load '$bundled': $e");
+  }
+  return DynamicLibrary.open('librustdesk.so');
+}
+
 /// FFI wrapper around the native Rust core.
 /// Hides the platform differences.
 class PlatformFFI {
@@ -120,7 +137,7 @@ class PlatformFFI {
    final dylib = isAndroid
        ? DynamicLibrary.open('librustdesk.so')
        : isLinux
-            ? DynamicLibrary.open('librustdesk.so')
+            ? _openLinuxCoreLib()
            : isWindows
                ? DynamicLibrary.open('librustdesk.dll')
                :
--- a/flutter/lib/models/terminal_model.dart
+++ b/flutter/lib/models/terminal_model.dart
@@ -1,13 +1,13 @@
 import 'dart:async';
 import 'dart:convert';
 import 'package:desktop_multi_window/desktop_multi_window.dart';
-import 'package:flutter/foundation.dart';
 import 'package:flutter/material.dart';
 import 'package:flutter_hbb/common.dart';
 import 'package:flutter_hbb/consts.dart';
 import 'package:flutter_hbb/main.dart';
 import 'package:xterm/xterm.dart';

+import 'input_modifier_utils.dart';
 import 'model.dart';
 import 'platform_model.dart';

@@ -23,7 +23,25 @@ class TerminalModel with ChangeNotifier {

  bool _disposed = false;

+  /// Callback to check whether Ctrl modifier lock is currently active.
+  /// When active, keyboard input is mapped to control codes (e.g. 'b' → \x02).
+  bool Function()? isCtrlLocked;
+
+  /// Callback to clear Ctrl lock after a key is pressed (one-shot mode).
+  void Function()? clearCtrlLock;
+
+  /// Callback to check whether Alt modifier lock is currently active.
+  bool Function()? isAltLocked;
+
+  /// Callback to clear Alt lock after a key is pressed (one-shot mode).
+  void Function()? clearAltLock;
+
  final _inputBuffer = <String>[];
+
+  /// Exposes buffered input only for lifecycle regression tests.
+  @visibleForTesting
+  int get debugBufferedInputCount => _inputBuffer.length;
+
  // Buffer for output data received before terminal view has valid dimensions.
  // This prevents NaN errors when writing to terminal before layout is complete.
  final _pendingOutputChunks = <String>[];
@@ -38,7 +56,15 @@ class TerminalModel with ChangeNotifier {

  void Function(int w, int h, int pw, int ph)? onResizeExternal;

+  /// Called when the terminal session ends (shell exits).
+  /// The listener (typically TerminalPage) can use this to auto-close the tab/page.
+  VoidCallback? onClosed;
+
  Future<void> _handleInput(String data) async {
+    // xterm can complete asynchronous input after the Flutter page has gone
+    // away. Stop before reading or clearing widget-owned modifier state.
+    if (_disposed) return;
+
    // Soft keyboards (notably iOS) emit '\n' when Enter is pressed, while a
    // real keyboard's Enter sends '\r'. Some Android keyboards also emit '\n'.
    // - Peer Windows: '\r' works, '\n' is just a newline.
@@ -46,13 +72,44 @@ class TerminalModel with ChangeNotifier {
    //   (readline, prompt_toolkit, vim, TUI frameworks) expect '\r'.
    // - Peer macOS: same as Linux, raw-mode apps expect '\r'
    //   (https://github.com/rustdesk/rustdesk/issues/14907).
-    // So on mobile / web-mobile, always normalize a lone '\n' to '\r'.
-    // We deliberately do not touch multi-character payloads (e.g. pasted text)
-    // so embedded newlines in pasted content are preserved.
-    final isMobileOrWebMobile = (isMobile || (isWeb && !isWebDesktop));
-    if (isMobileOrWebMobile && data == '\n') {
-      data = '\r';
+    // So on mobile / web-mobile, normalize the original lone '\n' to '\r'
+    // before modifier mappings. This keeps Ctrl+J mapped to LF instead of
+    // having the generated control code rewritten to CR afterward.
+    // Multi-character keyboard payloads, such as terminal escape sequences,
+    // remain unchanged. Paste input follows a separate preprocessing path.
+    final ctrlLocked = isCtrlLocked?.call() ?? false;
+    final altLocked = isAltLocked?.call() ?? false;
+    final modifiersActive = ctrlLocked || altLocked;
+    // Use the same predicate for transformation and consumption. Control keys
+    // and escape sequences must not silently consume a pending one-shot lock.
+    final shouldConsumeModifiers =
+        modifiersActive && shouldApplyTerminalInputModifiers(data);
+    data = prepareTerminalInputPayload(
+      data,
+      // IME soft-keyboard paste prompts currently arrive from xterm as normal
+      // text input with no paste-origin metadata. Keep them on the keyboard path;
+      // clipboard-content heuristics can misclassify ordinary typing.
+      source: TerminalInputSource.keyboard,
+      isMobileOrWebMobile: isMobile || (isWeb && !isWebDesktop),
+      bracketedPasteMode: terminal.bracketedPasteMode,
+      ctrlLocked: ctrlLocked,
+      altLocked: altLocked,
+    );
+    if (shouldConsumeModifiers) {
+      if (ctrlLocked) clearCtrlLock?.call();
+      if (altLocked) clearAltLock?.call();
    }
+    return _sendInputPayload(data);
+  }
+
+  /// Sends an already prepared payload without applying keyboard semantics.
+  /// Both normal input and paste use this transport path after their source-
+  /// specific preprocessing has completed.
+  Future<void> _sendInputPayload(String data) async {
+    // Clipboard reads and native sends may complete after the terminal page has
+    // closed. Never send or re-buffer input once this model is disposed.
+    if (_disposed) return;
+
    if (_terminalOpened) {
      // Send user input to remote terminal
      try {
@@ -173,6 +230,18 @@ class TerminalModel with ChangeNotifier {
    return _handleInput(data);
  }

+  Future<void> pasteText(String data) async {
+    final payload = prepareTerminalInputPayload(
+      data,
+      source: TerminalInputSource.paste,
+      isMobileOrWebMobile: false,
+      bracketedPasteMode: terminal.bracketedPasteMode,
+      ctrlLocked: false,
+      altLocked: false,
+    );
+    return _sendInputPayload(payload);
+  }
+
  Future<void> closeTerminal() async {
    if (_terminalOpened) {
      try {
@@ -247,6 +316,33 @@ class TerminalModel with ChangeNotifier {
    }
  }

+  static int getExitCodeFromEvt(Map<String, dynamic> evt) {
+    if (evt.containsKey('exit_code')) {
+      final v = evt['exit_code'];
+      if (v is int) {
+        // Desktop and mobile send exit_code as an int
+        return v;
+      } else if (v is String) {
+        // Web sends exit_code as a string
+        final parsed = int.tryParse(v);
+        if (parsed != null) {
+          return parsed;
+        } else {
+          debugPrint(
+              '[TerminalModel] Failed to parse exit_code as integer: $v. Expected a numeric string.');
+          return 0;
+        }
+      } else {
+        debugPrint(
+            '[TerminalModel] Unexpected exit_code type: ${v.runtimeType}, value: $v. Expected int or String.');
+        return 0;
+      }
+    } else {
+      debugPrint('[TerminalModel] Event does not contain exit_code');
+      return 0;
+    }
+  }
+
  void handleTerminalResponse(Map<String, dynamic> evt) {
    final String? type = evt['type'];
    final int evtTerminalId = getTerminalIdFromEvt(evt);
@@ -469,10 +565,12 @@ class TerminalModel with ChangeNotifier {
  }

  void _handleTerminalClosed(Map<String, dynamic> evt) {
-    final int exitCode = evt['exit_code'] ?? 0;
+    final int exitCode = getExitCodeFromEvt(evt);
    _writeToTerminal('\r\nTerminal closed with exit code: $exitCode\r\n');
    _terminalOpened = false;
    notifyListeners();
+    // Auto-close the tab/page
+    onClosed?.call();
  }

  void _handleTerminalError(Map<String, dynamic> evt) {
@@ -484,6 +582,14 @@ class TerminalModel with ChangeNotifier {
  void dispose() {
    if (_disposed) return;
    _disposed = true;
+    terminal.onOutput = null;
+    terminal.onResize = null;
+    isCtrlLocked = null;
+    clearCtrlLock = null;
+    isAltLocked = null;
+    clearAltLock = null;
+    onResizeExternal = null;
+    onClosed = null;
    // Clear buffers to free memory
    _inputBuffer.clear();
    _pendingOutputChunks.clear();
--- a/flutter/lib/native/font_manager.dart
+++ b/flutter/lib/native/font_manager.dart
@@ -1,109 +0,0 @@
-import 'dart:ffi' show Abi;
-import 'dart:io';
-import 'dart:typed_data';
-
-import 'package:flutter/foundation.dart';
-import 'package:flutter/services.dart';
-
-/// Font family name registered with [FontLoader] when a system CJK font is
-/// successfully loaded on ARM64 Linux.
-const kLinuxCjkFontFamily = 'SystemCJK';
-
-const _kFontSearchPaths = [
-  // Debian / Ubuntu (noto-fonts / fonts-noto-cjk)
-  '/usr/share/fonts/opentype/noto/NotoSansCJK-Regular.ttc',
-  '/usr/share/fonts/truetype/noto/NotoSansCJK-Regular.ttc',
-  '/usr/share/fonts/opentype/noto/NotoSansCJKsc-Regular.otf',
-  // Fedora / RHEL / Rocky (google-noto-sans-cjk-fonts)
-  '/usr/share/fonts/google-noto-cjk/NotoSansCJK-Regular.ttc',
-  '/usr/share/fonts/google-noto-sans-cjk-fonts/NotoSansCJK-Regular.ttc',
-  // Arch Linux (noto-fonts-cjk)
-  '/usr/share/fonts/noto-cjk/NotoSansCJK-Regular.ttc',
-  '/usr/share/fonts/noto-cjk/NotoSansCJKsc-Regular.otf',
-  // Generic fallback paths
-  '/usr/share/fonts/noto/NotoSansCJK-Regular.ttc',
-  '/usr/share/fonts/noto/NotoSansCJKsc-Regular.otf',
-  // WenQuanYi — commonly pre-installed on CJK-locale systems
-  '/usr/share/fonts/truetype/wqy/wqy-microhei.ttc',
-  '/usr/share/fonts/truetype/wqy/wqy-zenhei.ttc',
-  '/usr/share/fonts/wqy-microhei/wqy-microhei.ttc',
-  '/usr/share/fonts/wqy-zenhei/wqy-zenhei.ttc',
-];
-
-/// Loads a system CJK font on ARM64 Linux into Flutter's font registry via
-/// [FontLoader], working around the missing fontconfig support in the
-/// flutter-elinux engine (https://github.com/flutter/flutter/issues/139293).
-///
-/// Returns true if a CJK font was successfully loaded; false otherwise.
-/// On all other platforms this is a no-op and returns false immediately.
-Future<bool> loadSystemCJKFonts() async {
-  if (Abi.current() != Abi.linuxArm64) return false;
-
-  final path = await _findCjkFontPath();
-  if (path == null) {
-    debugPrint('ARM64 Linux: no CJK font found; CJK text may not render');
-    return false;
-  }
-
-  try {
-    final loader = FontLoader(kLinuxCjkFontFamily);
-    final bytes = await File(path).readAsBytes();
-    loader.addFont(Future.value(ByteData.view(bytes.buffer, bytes.offsetInBytes, bytes.lengthInBytes)));
-    await loader.load();
-    debugPrint('ARM64 Linux: loaded CJK font from $path');
-    return true;
-  } catch (e) {
-    debugPrint('ARM64 Linux: failed to load CJK font: $e');
-    return false;
-  }
-}
-
-Future<String?> _findCjkFontPath() async {
-  // Query fc-list for each CJK script separately.  Fonts present in all three
-  // sets (zh ∩ ja ∩ ko) are true pan-CJK fonts; prefer them so we don't
-  // accidentally pick a Chinese-only font that lacks Japanese kana or Korean
-  // hangul glyphs.  fc-list is a fontconfig CLI tool available on most Linux
-  // systems independent of whether the Flutter engine was built with fontconfig.
-  final byLang = <String, Set<String>>{};
-  for (final lang in const ['zh', 'ja', 'ko']) {
-    final paths = <String>{};
-    try {
-      final r =
-          await Process.run('fc-list', [':lang=$lang', '--format=%{file}\n']);
-      if (r.exitCode == 0) {
-        for (final line in r.stdout.toString().split('\n')) {
-          final p = line.trim();
-          if (p.isNotEmpty && File(p).existsSync()) paths.add(p);
-        }
-      }
-    } catch (e) {
-      debugPrint('ARM64 Linux: fc-list failed for lang=$lang: $e');
-    }
-    byLang[lang] = paths;
-  }
-
-  final panCjk = byLang['zh']!
-      .intersection(byLang['ja']!)
-      .intersection(byLang['ko']!);
-  final anyCjk =
-      byLang.values.fold(<String>{}, (acc, s) => acc..addAll(s));
-
-  // Among candidates, prefer well-known pan-CJK font families.
-  String? pick(Iterable<String> pool) {
-    const preferred = ['notosanscjk', 'sourcehansans', 'sourcehanserif'];
-    for (final name in preferred) {
-      for (final p in pool) {
-        if (p.toLowerCase().contains(name)) return p;
-      }
-    }
-    return pool.isNotEmpty ? pool.first : null;
-  }
-
-  final found = pick(panCjk) ?? pick(anyCjk);
-  if (found != null) return found;
-
-  for (final p in _kFontSearchPaths) {
-    if (File(p).existsSync()) return p;
-  }
-  return null;
-}
--- a/flutter/lib/web/bridge.dart
+++ b/flutter/lib/web/bridge.dart
@@ -1914,6 +1914,15 @@ class RustdeskImpl {
    throw UnimplementedError("sessionHandleScreenshot");
  }

+  Future<void> sessionSetCommon(
+      {required UuidValue sessionId, required String key, required String value, dynamic hint}) {
+      js.context.callMethod('setByName', [
+        'common',
+        jsonEncode({'name': key, 'value': value})
+      ]);
+      return Future.value();
+  }
+
  String? sessionGetCommonSync(
      {required UuidValue sessionId,
      required String key,
--- a/flutter/lib/web/font_manager.dart
+++ b/flutter/lib/web/font_manager.dart
@@ -1,8 +0,0 @@
-/// Web stub for `native/font_manager.dart`.
-///
-/// The native implementation depends on `dart:io` (Process/File/Platform) to
-/// load a system CJK font on ARM64 Linux, which cannot compile for the web
-/// target. The web build has no such fontconfig limitation, so this is a no-op.
-const kLinuxCjkFontFamily = 'SystemCJK';
-
-Future<bool> loadSystemCJKFonts() async => false;
--- a/flutter/linux/main.cc
+++ b/flutter/linux/main.cc
@@ -1,4 +1,8 @@
 #include <dlfcn.h>
+#include <limits.h>
+#include <stdio.h>
+#include <string.h>
+#include <unistd.h>
 #include "my_application.h"

 #define RUSTDESK_LIB_PATH "librustdesk.so"
@@ -7,8 +11,36 @@ bool gIsConnectionManager = false;

 void print_help_install_pkg(const char* so);

+// The bundle keeps the core library at lib/librustdesk.so next to the
+// executable. Resolve that path explicitly instead of relying on the
+// runner's RPATH, which repackaged installs may strip.
+// https://github.com/rustdesk/rustdesk/discussions/14407
+static void* dlopen_bundled_lib() {
+  char exe_path[PATH_MAX];
+  ssize_t len = readlink("/proc/self/exe", exe_path, sizeof(exe_path) - 1);
+  if (len <= 0 || len >= (ssize_t)(sizeof(exe_path) - 1)) return nullptr;
+  exe_path[len] = '\0';
+  char* last_slash = strrchr(exe_path, '/');
+  if (last_slash == nullptr) return nullptr;
+  *last_slash = '\0';
+  char lib_path[PATH_MAX + sizeof("/lib/" RUSTDESK_LIB_PATH)];
+  snprintf(lib_path, sizeof(lib_path), "%s/lib/%s", exe_path, RUSTDESK_LIB_PATH);
+  if (access(lib_path, F_OK) != 0) return nullptr;
+  void* librustdesk = dlopen(lib_path, RTLD_LAZY);
+  if (!librustdesk) {
+    char* error = dlerror();
+    if (error != nullptr) {
+      fprintf(stderr, "Failed to load \"%s\": %s\n", lib_path, error);
+    }
+  }
+  return librustdesk;
+}
+
 bool flutter_rustdesk_core_main() {
-   void* librustdesk = dlopen(RUSTDESK_LIB_PATH, RTLD_LAZY);
+   void* librustdesk = dlopen_bundled_lib();
+   if (!librustdesk) {
+      librustdesk = dlopen(RUSTDESK_LIB_PATH, RTLD_LAZY);
+   }
   if (!librustdesk) {
      fprintf(stderr,"Failed to load \"librustdesk.so\"\n");
      char* error;
--- a/flutter/macos/Runner/Configs/AppInfo.xcconfig
+++ b/flutter/macos/Runner/Configs/AppInfo.xcconfig
@@ -11,4 +11,4 @@ PRODUCT_NAME = RustDesk
 PRODUCT_BUNDLE_IDENTIFIER = com.carriez.flutterHbb

 // The copyright displayed in application information
-PRODUCT_COPYRIGHT = Copyright © 2025 Purslane Ltd. All rights reserved.
+PRODUCT_COPYRIGHT = Copyright © 2026 Purslane Tech Pte. Ltd. All rights reserved.
--- a/flutter/pubspec.lock
+++ b/flutter/pubspec.lock
@@ -340,7 +340,7 @@ packages:
    description:
      path: "."
      ref: HEAD
-      resolved-ref: b47e8385e5a75d38319ad706a64b0ead3108b093
+      resolved-ref: 533883bcb0ffe91a9afdb13b8bac9b14b3e054ba
      url: "https://github.com/rustdesk-org/rustdesk_desktop_multi_window"
    source: git
    version: "0.1.0"
@@ -1589,7 +1589,7 @@ packages:
    description:
      path: "."
      ref: HEAD
-      resolved-ref: "85789bfe6e4cfaf4ecc00c52857467fdb7f26879"
+      resolved-ref: cf4aef0512092fad9344a27ffe1c47ad83269dfc
      url: "https://github.com/rustdesk-org/window_manager"
    source: git
    version: "0.3.6"
--- a/flutter/pubspec.yaml
+++ b/flutter/pubspec.yaml
@@ -16,7 +16,7 @@ publish_to: "none" # Remove this line if you wish to publish to pub.dev
 # Read more about iOS versioning at
 # https://developer.apple.com/library/archive/documentation/General/Reference/InfoPlistKeyReference/Articles/CoreFoundationKeys.html
 # 1.1.9-1 works for android, but for ios it becomes 1.1.91, need to set it to 1.1.9-a.1 for iOS, will get 1.1.9.1, but iOS store not allow 4 numbers
-version: 1.4.8+66
+version: 1.4.9+67

 environment:
  sdk: '^3.1.0'
--- a/flutter/test/input_modifier_utils_test.dart
+++ b/flutter/test/input_modifier_utils_test.dart
@@ -122,4 +122,394 @@ void main() {
      );
    });
  });
+
+  group('shouldApplyTerminalInputModifiers', () {
+    test('accepts ordinary single-character keyboard input', () {
+      expect(shouldApplyTerminalInputModifiers('a'), isTrue);
+      expect(shouldApplyTerminalInputModifiers(' '), isTrue);
+      expect(shouldApplyTerminalInputModifiers('/'), isTrue);
+    });
+
+    test('accepts supplementary-plane single-character keyboard input', () {
+      expect(shouldApplyTerminalInputModifiers('😀'), isTrue);
+    });
+
+    test('rejects terminal control bytes and multi-character sequences', () {
+      for (final input in ['\x00', '\x03', '\t', '\n', '\r', '\x1B', '\x7F']) {
+        expect(
+          shouldApplyTerminalInputModifiers(input),
+          isFalse,
+          reason: '${input.codeUnits} must not consume a one-shot modifier',
+        );
+      }
+      expect(shouldApplyTerminalInputModifiers('\x1B[A'), isFalse);
+    });
+  });
+
+  group('applyTerminalInputModifiers', () {
+    test('keeps decomposed graphemes intact under Ctrl', () {
+      const decomposedEAcute = 'e\u0301';
+
+      expect(
+        applyTerminalInputModifiers(
+          decomposedEAcute,
+          ctrlLocked: true,
+          altLocked: false,
+        ),
+        decomposedEAcute,
+      );
+    });
+
+    test('keeps non-ASCII graphemes intact under Ctrl', () {
+      for (final input in ['é', '😀']) {
+        expect(
+          applyTerminalInputModifiers(
+            input,
+            ctrlLocked: true,
+            altLocked: false,
+          ),
+          input,
+        );
+      }
+    });
+
+    test('maps Ctrl underscore to unit separator', () {
+      expect(
+        applyTerminalInputModifiers(
+          '_',
+          ctrlLocked: true,
+          altLocked: false,
+        ),
+        '\x1F',
+      );
+    });
+
+    test('maps the complete Ctrl symbol range', () {
+      const mappings = {
+        '[': '\x1B',
+        r'\': '\x1C',
+        ']': '\x1D',
+        '^': '\x1E',
+        '_': '\x1F',
+        '/': '\x1F',
+      };
+
+      for (final entry in mappings.entries) {
+        expect(
+          applyTerminalInputModifiers(
+            entry.key,
+            ctrlLocked: true,
+            altLocked: false,
+          ),
+          entry.value,
+          reason: 'Ctrl+${entry.key} should map to ${entry.value.codeUnits}',
+        );
+      }
+    });
+
+    test('applies Ctrl before Alt for combined modifiers', () {
+      expect(
+        applyTerminalInputModifiers(
+          'b',
+          ctrlLocked: true,
+          altLocked: true,
+        ),
+        '\x1B\x02',
+      );
+    });
+  });
+
+  group('terminalPastePayload', () {
+    test('wraps paste text when bracketed paste mode is active', () {
+      expect(
+        terminalPastePayload('d', bracketedPasteMode: true),
+        '\x1B[200~d\x1B[201~',
+      );
+    });
+
+    test('keeps a lone newline unchanged when bracketed paste is disabled', () {
+      expect(
+        terminalPastePayload('\n', bracketedPasteMode: false),
+        '\n',
+      );
+    });
+  });
+
+  group('prepareTerminalInputPayload', () {
+    test('normalizes a mobile keyboard Enter to carriage return', () {
+      expect(
+        prepareTerminalInputPayload(
+          '\n',
+          source: TerminalInputSource.keyboard,
+          isMobileOrWebMobile: true,
+          bracketedPasteMode: false,
+          ctrlLocked: false,
+          altLocked: false,
+        ),
+        '\r',
+      );
+    });
+
+    test('keeps Ctrl+J as line feed on mobile', () {
+      expect(
+        prepareTerminalInputPayload(
+          'j',
+          source: TerminalInputSource.keyboard,
+          isMobileOrWebMobile: true,
+          bracketedPasteMode: false,
+          ctrlLocked: true,
+          altLocked: false,
+        ),
+        '\n',
+      );
+    });
+
+    test('does not apply Alt to a terminal control byte', () {
+      expect(
+        prepareTerminalInputPayload(
+          '\x1B',
+          source: TerminalInputSource.keyboard,
+          isMobileOrWebMobile: true,
+          bracketedPasteMode: false,
+          ctrlLocked: false,
+          altLocked: true,
+        ),
+        '\x1B',
+      );
+    });
+
+    test('keeps large keyboard payloads unchanged when modifiers are inactive',
+        () {
+      final payload = 'd' * (1024 * 1024);
+
+      expect(
+        prepareTerminalInputPayload(
+          payload,
+          source: TerminalInputSource.keyboard,
+          isMobileOrWebMobile: false,
+          bracketedPasteMode: false,
+          ctrlLocked: false,
+          altLocked: false,
+        ),
+        payload,
+      );
+    });
+
+    test('keeps decomposed graphemes intact with locked keyboard modifiers',
+        () {
+      const decomposedEAcute = 'e\u0301';
+
+      expect(
+        prepareTerminalInputPayload(
+          decomposedEAcute,
+          source: TerminalInputSource.keyboard,
+          isMobileOrWebMobile: true,
+          bracketedPasteMode: false,
+          ctrlLocked: true,
+          altLocked: false,
+        ),
+        decomposedEAcute,
+      );
+    });
+
+    test('preserves a lone pasted newline when modifiers are locked', () {
+      expect(
+        prepareTerminalInputPayload(
+          '\n',
+          source: TerminalInputSource.paste,
+          isMobileOrWebMobile: true,
+          bracketedPasteMode: false,
+          ctrlLocked: true,
+          altLocked: true,
+        ),
+        '\n',
+      );
+    });
+
+    test('wraps paste without applying locked modifiers', () {
+      expect(
+        prepareTerminalInputPayload(
+          'd',
+          source: TerminalInputSource.paste,
+          isMobileOrWebMobile: true,
+          bracketedPasteMode: true,
+          ctrlLocked: true,
+          altLocked: true,
+        ),
+        '\x1B[200~d\x1B[201~',
+      );
+    });
+  });
+
+  group('shouldHandleTerminalPasteShortcut', () {
+    test(
+        'keeps default xterm paste behavior when virtual modifiers are inactive',
+        () {
+      expect(
+        shouldHandleTerminalPasteShortcut(
+          logicalKey: LogicalKeyboardKey.keyV,
+          isKeyDown: true,
+          isKeyRepeat: false,
+          controlPressed: true,
+          metaPressed: false,
+          altPressed: false,
+          shiftPressed: false,
+          modifierLockActive: false,
+        ),
+        isFalse,
+      );
+    });
+
+    test('handles Ctrl+V and Meta+V when a virtual modifier lock is active',
+        () {
+      expect(
+        shouldHandleTerminalPasteShortcut(
+          logicalKey: LogicalKeyboardKey.keyV,
+          isKeyDown: true,
+          isKeyRepeat: false,
+          controlPressed: true,
+          metaPressed: false,
+          altPressed: false,
+          shiftPressed: false,
+          modifierLockActive: true,
+        ),
+        isTrue,
+      );
+      expect(
+        shouldHandleTerminalPasteShortcut(
+          logicalKey: LogicalKeyboardKey.keyV,
+          isKeyDown: true,
+          isKeyRepeat: false,
+          controlPressed: false,
+          metaPressed: true,
+          altPressed: false,
+          shiftPressed: false,
+          modifierLockActive: true,
+        ),
+        isTrue,
+      );
+    });
+
+    test('handles paste shortcut repeats while a virtual lock is active', () {
+      expect(
+        shouldHandleTerminalPasteShortcut(
+          logicalKey: LogicalKeyboardKey.keyV,
+          isKeyDown: false,
+          isKeyRepeat: true,
+          controlPressed: true,
+          metaPressed: false,
+          altPressed: false,
+          shiftPressed: false,
+          modifierLockActive: true,
+        ),
+        isTrue,
+      );
+    });
+
+    test('ignores key-up and unmodified V events', () {
+      expect(
+        shouldHandleTerminalPasteShortcut(
+          logicalKey: LogicalKeyboardKey.keyV,
+          isKeyDown: false,
+          isKeyRepeat: false,
+          controlPressed: true,
+          metaPressed: false,
+          altPressed: false,
+          shiftPressed: false,
+          modifierLockActive: true,
+        ),
+        isFalse,
+      );
+      expect(
+        shouldHandleTerminalPasteShortcut(
+          logicalKey: LogicalKeyboardKey.keyV,
+          isKeyDown: true,
+          isKeyRepeat: false,
+          controlPressed: false,
+          metaPressed: false,
+          altPressed: false,
+          shiftPressed: false,
+          modifierLockActive: true,
+        ),
+        isFalse,
+      );
+    });
+
+    test('ignores paste shortcuts with extra modifiers', () {
+      for (final state in [
+        (control: true, meta: false, alt: true, shift: false),
+        (control: true, meta: false, alt: false, shift: true),
+        (control: false, meta: true, alt: false, shift: true),
+        (control: true, meta: true, alt: false, shift: false),
+      ]) {
+        expect(
+          shouldHandleTerminalPasteShortcut(
+            logicalKey: LogicalKeyboardKey.keyV,
+            isKeyDown: true,
+            isKeyRepeat: false,
+            controlPressed: state.control,
+            metaPressed: state.meta,
+            altPressed: state.alt,
+            shiftPressed: state.shift,
+            modifierLockActive: true,
+          ),
+          isFalse,
+        );
+      }
+    });
+
+    test('ignores non-V key events', () {
+      expect(
+        shouldHandleTerminalPasteShortcut(
+          logicalKey: LogicalKeyboardKey.keyC,
+          isKeyDown: true,
+          isKeyRepeat: false,
+          controlPressed: true,
+          metaPressed: false,
+          altPressed: false,
+          shiftPressed: false,
+          modifierLockActive: true,
+        ),
+        isFalse,
+      );
+    });
+  });
+
+  group('shouldClearTerminalModifiersWhenRow3Collapses', () {
+    test('clears visible modifier state when expanded row is collapsed', () {
+      expect(
+        shouldClearTerminalModifiersWhenRow3Collapses(
+          wasExpanded: true,
+          willExpand: false,
+          ctrlLocked: true,
+          altLocked: false,
+        ),
+        isTrue,
+      );
+    });
+
+    test('does not clear modifiers when row expands', () {
+      expect(
+        shouldClearTerminalModifiersWhenRow3Collapses(
+          wasExpanded: false,
+          willExpand: true,
+          ctrlLocked: true,
+          altLocked: true,
+        ),
+        isFalse,
+      );
+    });
+
+    test('clears Alt state when expanded row is collapsed', () {
+      expect(
+        shouldClearTerminalModifiersWhenRow3Collapses(
+          wasExpanded: true,
+          willExpand: false,
+          ctrlLocked: false,
+          altLocked: true,
+        ),
+        isTrue,
+      );
+    });
+  });
 }
--- a/flutter/test/terminal_keyboard_utils_test.dart
+++ b/flutter/test/terminal_keyboard_utils_test.dart
@@ -0,0 +1,40 @@
+import 'package:flutter_hbb/mobile/terminal_keyboard_utils.dart';
+import 'package:flutter_test/flutter_test.dart';
+
+void main() {
+  group('mobile terminal keyboard layout', () {
+    test('keeps the latest key order from the reviewed PR layout', () {
+      expect(
+        terminalKeyboardRow1Keys,
+        ['Esc', '/', '|', 'Home', '↑', 'End', r'\'],
+      );
+      expect(
+        terminalKeyboardRow2Keys,
+        ['Tab', 'Ctrl+C', '~', '←', '↓', '→'],
+      );
+      expect(
+        terminalKeyboardRow3Keys,
+        ['Ctrl', 'Alt', '-', 'PgUp', 'PgDn'],
+      );
+    });
+
+    test('keeps two trailing Row3 placeholders for row alignment', () {
+      expect(terminalKeyboardRow3TrailingPlaceholderCount, 2);
+    });
+
+    test('keeps every expanded row aligned at 348dp', () {
+      final rowWidths = [
+        terminalKeyboardRowWidth(terminalKeyboardRow1Keys.length),
+        terminalKeyboardRowWidth(terminalKeyboardRow2Keys.length + 1),
+        terminalKeyboardRowWidth(
+          terminalKeyboardRow3Keys.length +
+              terminalKeyboardRow3TrailingPlaceholderCount,
+        ),
+      ];
+
+      expect(terminalKeyboardKeyWidth, 48);
+      expect(terminalKeyboardKeySpacing, 2);
+      expect(rowWidths, everyElement(348));
+    });
+  });
+}
--- a/flutter/test/terminal_model_lifecycle_test.dart
+++ b/flutter/test/terminal_model_lifecycle_test.dart
@@ -0,0 +1,51 @@
+import 'dart:async';
+
+import 'package:flutter_hbb/models/model.dart';
+import 'package:flutter_hbb/models/terminal_model.dart';
+import 'package:flutter_test/flutter_test.dart';
+
+class _FakeFFI implements FFI {
+  @override
+  String id = 'test-peer';
+
+  @override
+  dynamic noSuchMethod(Invocation invocation) => super.noSuchMethod(invocation);
+}
+
+void main() {
+  test('ignores paste that completes after the terminal model is disposed',
+      () async {
+    final model = TerminalModel(_FakeFFI());
+    final delayedClipboardText = Completer<String>();
+
+    // This mirrors Ctrl/Cmd+V: clipboard access starts first, then the page and
+    // model are disposed before the asynchronous read supplies its text.
+    final paste = delayedClipboardText.future.then(model.pasteText);
+    model.dispose();
+    delayedClipboardText.complete('late clipboard text');
+    await paste;
+
+    expect(model.debugBufferedInputCount, 0);
+  });
+
+  test('ignores terminal text input after the terminal model is disposed', () {
+    final model = TerminalModel(_FakeFFI());
+    var checkedCtrlLock = false;
+    var clearedCtrlLock = false;
+
+    model.isCtrlLocked = () {
+      checkedCtrlLock = true;
+      return true;
+    };
+    model.clearCtrlLock = () {
+      clearedCtrlLock = true;
+    };
+
+    model.dispose();
+    model.terminal.textInput('d');
+
+    expect(checkedCtrlLock, isFalse);
+    expect(clearedCtrlLock, isFalse);
+    expect(model.debugBufferedInputCount, 0);
+  });
+}
--- a/flutter/windows/runner/Runner.rc
+++ b/flutter/windows/runner/Runner.rc
@@ -89,11 +89,11 @@ BEGIN
    BEGIN
        BLOCK "040904e4"
        BEGIN
-            VALUE "CompanyName", "Purslane Ltd" "\0"
+            VALUE "CompanyName", "Purslane Tech Pte. Ltd." "\0"
            VALUE "FileDescription", "RustDesk Remote Desktop" "\0"
            VALUE "FileVersion", VERSION_AS_STRING "\0"
            VALUE "InternalName", "rustdesk" "\0"
-            VALUE "LegalCopyright", "Copyright © 2025 Purslane Ltd. All rights reserved." "\0"
+            VALUE "LegalCopyright", "Copyright © 2026 Purslane Tech Pte. Ltd. All rights reserved." "\0"
            VALUE "OriginalFilename", "rustdesk.exe" "\0"
            VALUE "ProductName", "RustDesk" "\0"
            VALUE "ProductVersion", VERSION_AS_STRING "\0"
--- a/flutter/windows/runner/flutter_window.cpp
+++ b/flutter/windows/runner/flutter_window.cpp
@@ -19,6 +19,66 @@

 #include "win32_desktop.h"

+namespace {
+
+// If the window is resized between the creation of the Flutter surface and the
+// present of the first frame - which is what the PowerToys FancyZones option
+// "Move newly created windows to their last known zone" does - the embedder's
+// resize synchronization enters kResizeStarted and from then on only presents
+// frames that match the new size. A frame already generated for the old size
+// is rejected, nothing schedules a matching one, and the window stays white
+// until a real resize re-enters OnWindowSizeChanged, which resets the resize
+// target and resends the window metrics. That is why minimize/restore heals
+// it; ForceChildRefresh() below does the same programmatically.
+// https://github.com/rustdesk/rustdesk/issues/6756
+// https://github.com/flutter/flutter/issues/159630
+//
+// The timer below drives that recovery. Two subtleties, verified against the
+// embedder sources (identical in 3.24.5 and 3.44.0):
+// - FlutterViewController::ForceRedraw() only schedules a frame when NO resize
+//   is pending (resize_status_ == kDone), so it cannot heal the wedge above.
+//   It is kept as a cheap first kick for the case it was designed for: a
+//   window created hidden and shown later, with nothing scheduling a frame.
+// - The SetNextFrameCallback used to detect the first frame fires when a frame
+//   is GENERATED (raster thread), even if the resize gate then rejects its
+//   present. So it must not be the only stop condition: one final
+//   ForceChildRefresh() is issued to guarantee a present at the current size.
+//   Note this premise is not load-bearing, and the redundancy is deliberate:
+//   if the callback in fact only fired on a successful present, then
+//   first_frame_rendered_ would stay false and the timer below would keep
+//   nudging until it healed.
+// This also relies on HandleTopLevelWindowProc not consuming WM_TIMER (no
+// plugin registers a delegate for it today).
+constexpr UINT_PTR kForceRedrawTimerId = 0xFB15;
+constexpr UINT kForceRedrawIntervalMs = 200;
+// Give up eventually (with a log), so a genuinely stuck engine doesn't keep a
+// timer alive forever. 25 * 200ms covers slow starts comfortably.
+constexpr UINT kForceRedrawMaxTries = 25;
+// The first ticks use the cheap ForceRedraw(); later ticks use
+// ForceChildRefresh(), which may block the platform thread for up to 2x100ms
+// per call (each nudge re-enters the 100ms resize wait).
+constexpr UINT kForceRedrawCheapTries = 2;
+
+// Re-enters the embedder's OnWindowSizeChanged by nudging the Flutter child
+// window by 1px and back: this resets the resize target and resends the window
+// metrics. Same as BaseFlutterWindow::ForceChildRefresh() on the
+// rustdesk_desktop_multi_window side.
+void ForceChildRefresh(HWND child) {
+  if (!child) {
+    return;
+  }
+  RECT rect;
+  GetWindowRect(child, &rect);
+  LONG width = rect.right - rect.left;
+  LONG height = rect.bottom - rect.top;
+  SetWindowPos(child, nullptr, 0, 0, width + 1, height,
+               SWP_NOZORDER | SWP_NOOWNERZORDER | SWP_NOMOVE | SWP_FRAMECHANGED);
+  SetWindowPos(child, nullptr, 0, 0, width, height,
+               SWP_NOZORDER | SWP_NOOWNERZORDER | SWP_NOMOVE | SWP_FRAMECHANGED);
+}
+
+}  // namespace
+
 FlutterWindow::FlutterWindow(const flutter::DartProject& project)
    : project_(project) {}

@@ -92,10 +152,17 @@ bool FlutterWindow::OnCreate() {
        registry->GetRegistrarForPlugin("FlutterGpuTextureRendererPluginCApi"));
  });
  SetChildContent(flutter_controller_->view()->GetNativeWindow());
+
+  // See the comment on kForceRedrawTimerId above.
+  flutter_controller_->engine()->SetNextFrameCallback(
+      [this]() { first_frame_rendered_ = true; });
+  SetTimer(GetHandle(), kForceRedrawTimerId, kForceRedrawIntervalMs, nullptr);
+
  return true;
 }

 void FlutterWindow::OnDestroy() {
+  KillTimer(GetHandle(), kForceRedrawTimerId);
  if (flutter_controller_) {
    flutter_controller_ = nullptr;
  }
@@ -121,6 +188,48 @@ FlutterWindow::MessageHandler(HWND hwnd, UINT const message,
    case WM_FONTCHANGE:
      flutter_controller_->engine()->ReloadSystemFonts();
      break;
+    case WM_TIMER:
+      if (wparam == kForceRedrawTimerId) {
+        if (!flutter_controller_) {
+          KillTimer(hwnd, kForceRedrawTimerId);
+        } else if (first_frame_rendered_) {
+          // A frame was generated, which does not mean it was presented: if a
+          // resize was pending, the gate rejected it (see the comment on
+          // kForceRedrawTimerId). One child refresh guarantees a present at the
+          // current size. Unconditional because gating it bought nothing: the
+          // WM_SIZE that CreateWindow() sends already arrives before the first
+          // frame, so the flag this used to check was always set by the time we
+          // got here. Doing it unconditionally is safe either way - at worst it
+          // is one extra nudge, and it is cheap once the engine is running.
+          ForceChildRefresh(flutter_controller_->view()->GetNativeWindow());
+          KillTimer(hwnd, kForceRedrawTimerId);
+        } else if (++force_redraw_tries_ > kForceRedrawMaxTries) {
+          // Not std::cerr: the runner only attaches a console when started from
+          // one or under a debugger (see main.cpp), and this fires on end-user
+          // machines. OutputDebugString is readable with DebugView there.
+          OutputDebugStringA(
+              "rustdesk: Flutter window did not render its first frame, "
+              "giving up.\n");
+          KillTimer(hwnd, kForceRedrawTimerId);
+        } else if (force_redraw_tries_ <= kForceRedrawCheapTries) {
+          flutter_controller_->ForceRedraw();
+        } else {
+          ForceChildRefresh(flutter_controller_->view()->GetNativeWindow());
+        }
+        return 0;
+      }
+      break;
+    case WM_SHOWWINDOW:
+      // A window created hidden (e.g. the connection manager) may be shown
+      // long after the creation-time force-redraw timer has given up, and
+      // FancyZones moves windows exactly when they are shown. Re-arm the
+      // protection if the first frame still hasn't been rendered by now (see
+      // kForceRedrawTimerId).
+      if (wparam == TRUE && !first_frame_rendered_ && flutter_controller_) {
+        force_redraw_tries_ = 0;
+        SetTimer(hwnd, kForceRedrawTimerId, kForceRedrawIntervalMs, nullptr);
+      }
+      break;
  }

  return Win32Window::MessageHandler(hwnd, message, wparam, lparam);
--- a/flutter/windows/runner/flutter_window.h
+++ b/flutter/windows/runner/flutter_window.h
@@ -28,6 +28,14 @@ class FlutterWindow : public Win32Window {

  // The Flutter instance hosted by this window.
  std::unique_ptr<flutter::FlutterViewController> flutter_controller_;
+
+  // Whether the engine has generated its first frame. Note that a generated
+  // frame is not necessarily presented: the resize synchronization may reject
+  // it (see kForceRedrawTimerId in the .cpp file).
+  bool first_frame_rendered_ = false;
+
+  // Number of force-redraw attempts made so far.
+  UINT force_redraw_tries_ = 0;
 };

 #endif  // RUNNER_FLUTTER_WINDOW_H_
--- a/flutter/windows/runner/main.cpp
+++ b/flutter/windows/runner/main.cpp
@@ -14,6 +14,7 @@
 typedef char** (*FUNC_RUSTDESK_CORE_MAIN)(int*);
 typedef void (*FUNC_RUSTDESK_FREE_ARGS)( char**, int);
 typedef int (*FUNC_RUSTDESK_GET_APP_NAME)(wchar_t*, int);
+typedef int (*FUNC_RUSTDESK_IS_DISABLE_INSTALLATION)();
 /// Note: `--server`, `--service` are already handled in [core_main.rs].
 const std::vector<std::string> parameters_white_list = {"--install", "--cm"};

@@ -62,6 +63,22 @@ int APIENTRY wWinMain(_In_ HINSTANCE instance, _In_opt_ HINSTANCE prev,
  }
  std::vector<std::string> rust_args(c_args, c_args + args_len);
  free_c_args(c_args, args_len);
+  FUNC_RUSTDESK_IS_DISABLE_INSTALLATION rustdesk_is_disable_installation =
+      (FUNC_RUSTDESK_IS_DISABLE_INSTALLATION)GetProcAddress(hInstance, "rustdesk_is_disable_installation");
+  bool is_disable_installation =
+      rustdesk_is_disable_installation && rustdesk_is_disable_installation() != 0;
+  const auto installParam = std::string("--install");
+  // Flutter reads the original process command line, not only rust_args, so
+  // remove the `--install` injected by the portable wrapper here as well. This
+  // also lets `no-install.exe` continue as a portable app when installation is
+  // disabled. See: https://github.com/rustdesk/rustdesk-server-pro/issues/991#issuecomment-4978376890
+  if (is_disable_installation) {
+    command_line_arguments.erase(
+        std::remove(command_line_arguments.begin(),
+                    command_line_arguments.end(),
+                    installParam),
+        command_line_arguments.end());
+  }

  std::wstring app_name = L"RustDesk";
  FUNC_RUSTDESK_GET_APP_NAME get_rustdesk_app_name = (FUNC_RUSTDESK_GET_APP_NAME)GetProcAddress(hInstance, "get_rustdesk_app_name");
@@ -118,7 +135,6 @@ int APIENTRY wWinMain(_In_ HINSTANCE instance, _In_opt_ HINSTANCE prev,
    is_cm_page = true;
  }
  bool is_install_page = false;
-  auto installParam = std::string("--install");
  if (!command_line_arguments.empty() && command_line_arguments.front().compare(0, installParam.size(), installParam.c_str()) == 0) {
    is_install_page = true;
  }
--- a/libs/clipboard/README.md
+++ b/libs/clipboard/README.md
@@ -1,7 +1,7 @@
 # clipboard

 Copy files and text through network.
-Main lowlevel logic from [FreeRDP](https://github.com/FreeRDP/FreeRDP).
+Main low-level logic from [FreeRDP](https://github.com/FreeRDP/FreeRDP).

 To enjoy file copy and paste feature on Linux/OSX,
 please build with `unix-file-copy-paste` feature.
@@ -151,7 +151,7 @@ the FUSE server will figure out the file system tree and rearrange its content.
 - you may notice
  the mountpoint is still occupied after the application quits.
  That's because the FUSE server was not mounted with `AUTO_UNMOUNT`.
-  - It's hard to implement gressful shutdown for a multi-processed program
+  - It's hard to implement graceful shutdown for a multi-processed program
  - `AUTO_UNMOUNT` was not enabled by default and requires enable
    `user_allow_other` in configure. Letting users edit such global
    configuration to use this feature might not be a good idea.
--- a/libs/clipboard/src/platform/unix/fuse/cs.rs
+++ b/libs/clipboard/src/platform/unix/fuse/cs.rs
@@ -533,7 +533,7 @@ impl FuseServer {
        offset: i64,
        size: u32,
    ) -> Result<Vec<u8>, std::io::Error> {
-        // todo: async and concurrent read, generate stream_id per request
+        let request_stream_id = rand::random();
        let cb_requested = unsafe {
            // convert `size` from u32 to i32
            // yet with same bit representation
@@ -543,7 +543,7 @@ impl FuseServer {
        let (n_position_high, n_position_low) =
            ((offset >> 32) as i32, (offset & (u32::MAX as i64)) as i32);
        let request = ClipboardFile::FileContentsRequest {
-            stream_id: node.stream_id,
+            stream_id: request_stream_id,
            list_index: node.index as i32,
            dw_flags: 2,
            n_position_low,
@@ -573,7 +573,7 @@ impl FuseServer {
                    stream_id,
                    requested_data,
                } => {
-                    if stream_id != node.stream_id {
+                    if stream_id != request_stream_id {
                        log::debug!("stream id mismatch, ignore");
                        continue;
                    }
@@ -611,11 +611,6 @@ struct FuseNode {
    /// connection id
    pub conn_id: i32,

-    // todo: use stream_id to identify a FileContents request-reply
-    // instead of a whole file
-    /// stream id
-    pub stream_id: i32,
-
    /// file index in peer's file list
    /// NOTE:
    /// it is NOT the same as inode, this is the index in the file list
@@ -639,7 +634,6 @@ impl FuseNode {
    pub fn from_description(inode: Inode, desc: FileDescription) -> Self {
        Self {
            conn_id: desc.conn_id,
-            stream_id: rand::random(),
            index: inode as usize - 2,
            name: desc
                .name
@@ -656,7 +650,6 @@ impl FuseNode {
    pub fn new_root() -> Self {
        Self {
            conn_id: 0,
-            stream_id: rand::random(),
            index: 0,
            name: String::from("/"),
            parent: None,
--- a/libs/clipboard/src/platform/unix/fuse/mod.rs
+++ b/libs/clipboard/src/platform/unix/fuse/mod.rs
@@ -4,23 +4,24 @@ use super::filetype::FileDescription;
 use crate::{ClipboardFile, CliprdrError};
 use cs::FuseServer;
 use fuser::MountOption;
-use hbb_common::{config::APP_NAME, log};
+use hbb_common::{config::Config, log};
 use parking_lot::Mutex;
 use std::{
-    path::PathBuf,
+    io,
+    path::{Path, PathBuf},
    sync::{mpsc::Sender, Arc},
    time::Duration,
 };

 lazy_static::lazy_static! {
    static ref FUSE_MOUNT_POINT_CLIENT: Arc<String> = {
-        let mnt_path = format!("/tmp/{}/{}", APP_NAME.read().unwrap(), "cliprdr-client");
+        let mnt_path = fuse_mount_point("cliprdr-client");
        // No need to run `canonicalize()` here.
        Arc::new(mnt_path)
    };

    static ref FUSE_MOUNT_POINT_SERVER: Arc<String> = {
-        let mnt_path = format!("/tmp/{}/{}", APP_NAME.read().unwrap(), "cliprdr-server");
+        let mnt_path = fuse_mount_point("cliprdr-server");
        // No need to run `canonicalize()` here.
        Arc::new(mnt_path)
    };
@@ -31,6 +32,21 @@ lazy_static::lazy_static! {

 static FUSE_TIMEOUT: Duration = Duration::from_secs(3);

+#[derive(Debug, PartialEq, Eq)]
+enum MountPointState {
+    HealthyMount,
+    NotMounted,
+    StaleMount,
+    Unknown,
+}
+
+fn fuse_mount_point(name: &str) -> String {
+    let mut path = PathBuf::from(Config::ipc_path(""));
+    path.pop();
+    path.push(name);
+    path.to_string_lossy().to_string()
+}
+
 pub fn get_exclude_paths(is_client: bool) -> Arc<String> {
    if is_client {
        FUSE_MOUNT_POINT_CLIENT.clone()
@@ -53,8 +69,27 @@ pub fn init_fuse_context(is_client: bool) -> Result<(), CliprdrError> {
    } else {
        FUSE_CONTEXT_SERVER.lock()
    };
-    if fuse_context_lock.is_some() {
-        return Ok(());
+    if let Some(ctx) = fuse_context_lock.as_ref() {
+        match inspect_mount_point_state(&ctx.mount_point) {
+            MountPointState::HealthyMount => return Ok(()),
+            MountPointState::StaleMount | MountPointState::NotMounted => {
+                log::warn!(
+                    "clipboard FUSE mount {} is disconnected, remounting",
+                    ctx.mount_point.display()
+                );
+                let stale_context = fuse_context_lock.take();
+                drop(fuse_context_lock);
+                drop(stale_context);
+                return init_fuse_context(is_client);
+            }
+            MountPointState::Unknown => {
+                log::warn!(
+                    "failed to verify clipboard FUSE mount {}",
+                    ctx.mount_point.display()
+                );
+                return Err(CliprdrError::CliprdrInit);
+            }
+        }
    }
    let mount_point = if is_client {
        FUSE_MOUNT_POINT_CLIENT.clone()
@@ -63,10 +98,32 @@ pub fn init_fuse_context(is_client: bool) -> Result<(), CliprdrError> {
    };

    let mount_point = std::path::PathBuf::from(&*mount_point);
+    match inspect_mount_point_state(&mount_point) {
+        MountPointState::HealthyMount => {
+            log::warn!(
+                "clipboard FUSE mount {} is already active in another context",
+                mount_point.display()
+            );
+            return Err(CliprdrError::ClipboardOccupied);
+        }
+        MountPointState::StaleMount => {
+            log::warn!(
+                "clipboard FUSE mount {} is stale, cleaning up before remount",
+                mount_point.display()
+            );
+            unmount_fuse_mount_point(&mount_point);
+            validate_mount_state_after_stale_cleanup(
+                &mount_point,
+                inspect_mount_point_state(&mount_point),
+            )?;
+        }
+        MountPointState::Unknown => return Err(CliprdrError::CliprdrInit),
+        MountPointState::NotMounted => {}
+    }
    let (server, tx) = FuseServer::new(FUSE_TIMEOUT);
    let server = Arc::new(Mutex::new(server));

-    prepare_fuse_mount_point(&mount_point);
+    prepare_fuse_mount_point(&mount_point)?;
    let mnt_opts = [
        MountOption::FSName("rustdesk-cliprdr-fs".to_string()),
        MountOption::NoAtime,
@@ -159,35 +216,246 @@ struct FuseContext {
 }

 // this function must be called after the main IPC is up
-fn prepare_fuse_mount_point(mount_point: &PathBuf) {
+fn prepare_fuse_mount_point(mount_point: &PathBuf) -> Result<(), CliprdrError> {
    use std::{
        fs::{self, Permissions},
        os::unix::prelude::PermissionsExt,
    };

-    fs::create_dir(mount_point).ok();
-    fs::set_permissions(mount_point, Permissions::from_mode(0o777)).ok();
+    if let Some(parent) = mount_point.parent() {
+        reject_symlink_path(parent)?;
+        if let Err(e) = fs::create_dir_all(parent) {
+            log::warn!("failed to create FUSE mount parent {:?}: {:?}", parent, e);
+            return Err(CliprdrError::CliprdrInit);
+        }
+    }

-    if let Err(e) = std::process::Command::new("umount")
-        .arg(mount_point)
-        .status()
-    {
-        log::warn!("umount {:?} may fail: {:?}", mount_point, e);
+    reject_symlink_path(mount_point)?;
+
+    let recovered_stale_mount = if let Err(e) = fs::create_dir_all(mount_point) {
+        log::warn!(
+            "failed to create clipboard FUSE mount point {}, trying stale mount cleanup: {:?}",
+            mount_point.display(),
+            e
+        );
+        unmount_fuse_mount_point(mount_point);
+        fs::create_dir_all(mount_point).map_err(|e| {
+            log::error!(
+                "failed to create clipboard FUSE mount point {} after cleanup: {:?}",
+                mount_point.display(),
+                e
+            );
+            CliprdrError::CliprdrInit
+        })?;
+        true
+    } else {
+        false
+    };
+    if let Err(e) = fs::set_permissions(mount_point, Permissions::from_mode(0o777)) {
+        log::warn!(
+            "failed to set clipboard FUSE mount point permissions {}: {:?}",
+            mount_point.display(),
+            e
+        );
+    }
+
+    if !recovered_stale_mount {
+        unmount_fuse_mount_point(mount_point);
+    }
+    Ok(())
+}
+
+fn inspect_mount_point_state(mount_point: &Path) -> MountPointState {
+    if ensure_mount_point_path_is_safe(mount_point).is_err() {
+        return MountPointState::Unknown;
+    }
+    inspect_mount_point_state_with(
+        mount_point,
+        std::fs::metadata(mount_point),
+        std::fs::read_to_string("/proc/self/mountinfo"),
+    )
+}
+
+fn validate_mount_state_after_stale_cleanup(
+    mount_point: &Path,
+    mount_state: MountPointState,
+) -> Result<(), CliprdrError> {
+    match mount_state {
+        MountPointState::NotMounted => Ok(()),
+        MountPointState::HealthyMount => {
+            log::warn!(
+                "clipboard FUSE mount {} is still active after stale cleanup",
+                mount_point.display()
+            );
+            Err(CliprdrError::ClipboardOccupied)
+        }
+        MountPointState::StaleMount => {
+            log::warn!(
+                "clipboard FUSE mount {} is still stale after cleanup",
+                mount_point.display()
+            );
+            Err(CliprdrError::CliprdrInit)
+        }
+        MountPointState::Unknown => {
+            log::warn!(
+                "failed to verify clipboard FUSE mount {} after cleanup",
+                mount_point.display()
+            );
+            Err(CliprdrError::CliprdrInit)
+        }
    }
 }

-fn uninit_fuse_context_(is_client: bool) {
-    if is_client {
-        let _ = FUSE_CONTEXT_CLIENT.lock().take();
-    } else {
-        let _ = FUSE_CONTEXT_SERVER.lock().take();
+fn inspect_mount_point_state_with<T>(
+    mount_point: &Path,
+    metadata_result: io::Result<T>,
+    mountinfo_result: io::Result<String>,
+) -> MountPointState {
+    match metadata_result {
+        Ok(_) => match mountinfo_result {
+            Ok(mountinfo) => {
+                if is_mount_point_listed_in_mountinfo(mount_point, &mountinfo) {
+                    MountPointState::HealthyMount
+                } else {
+                    MountPointState::NotMounted
+                }
+            }
+            Err(e) => {
+                log::warn!("failed to read mountinfo for {:?}: {:?}", mount_point, e);
+                MountPointState::Unknown
+            }
+        },
+        Err(e) if e.raw_os_error() == Some(libc::ENOTCONN) => MountPointState::StaleMount,
+        Err(e) if e.kind() == io::ErrorKind::NotFound => MountPointState::NotMounted,
+        Err(e) => {
+            log::warn!("failed to inspect FUSE mount {:?}: {:?}", mount_point, e);
+            MountPointState::Unknown
+        }
    }
 }

+fn is_mount_point_listed_in_mountinfo(mount_point: &Path, mountinfo: &str) -> bool {
+    let mount_point = mount_point.to_string_lossy();
+    mountinfo.lines().any(|line| {
+        let mut fields = line.split_whitespace();
+        let _mount_id = fields.next();
+        let _parent_id = fields.next();
+        let _major_minor = fields.next();
+        let _root = fields.next();
+        let mount_path = fields.next();
+        mount_path == Some(mount_point.as_ref())
+    })
+}
+
+fn reject_symlink_metadata_result(
+    path: &Path,
+    metadata_result: io::Result<std::fs::Metadata>,
+    allow_disconnected_mount: bool,
+) -> Result<(), CliprdrError> {
+    match metadata_result {
+        Ok(metadata) if metadata.file_type().is_symlink() => {
+            log::warn!("refusing to use symlinked FUSE path {:?}", path);
+            Err(CliprdrError::CliprdrInit)
+        }
+        Ok(_) => Ok(()),
+        Err(e) if allow_disconnected_mount && e.raw_os_error() == Some(libc::ENOTCONN) => Ok(()),
+        Err(e) if e.kind() == io::ErrorKind::NotFound => Ok(()),
+        Err(e) => {
+            log::warn!("failed to inspect FUSE path {:?}: {:?}", path, e);
+            Err(CliprdrError::CliprdrInit)
+        }
+    }
+}
+
+fn reject_symlink_path(path: &Path) -> Result<(), CliprdrError> {
+    reject_symlink_metadata_result(path, std::fs::symlink_metadata(path), false)
+}
+
+fn ensure_mount_point_path_is_safe(mount_point: &Path) -> Result<(), CliprdrError> {
+    if let Some(parent) = mount_point.parent() {
+        reject_symlink_path(parent)?;
+    }
+    reject_symlink_metadata_result(mount_point, std::fs::symlink_metadata(mount_point), true)
+}
+
+fn unmount_fuse_mount_point(mount_point: &Path) {
+    if ensure_mount_point_path_is_safe(mount_point).is_err() {
+        log::warn!(
+            "refusing to unmount unsafe clipboard FUSE mount point {:?}",
+            mount_point
+        );
+        return;
+    }
+    if inspect_mount_point_state_with(
+        mount_point,
+        std::fs::metadata(mount_point),
+        std::fs::read_to_string("/proc/self/mountinfo"),
+    ) == MountPointState::NotMounted
+    {
+        return;
+    }
+    for (program, args) in unmount_command_candidates() {
+        if run_unmount_command(program, args, mount_point) {
+            return;
+        }
+    }
+    log::warn!(
+        "failed to unmount clipboard FUSE mount point {:?}",
+        mount_point
+    );
+}
+
+fn unmount_command_candidates() -> [(&'static str, &'static [&'static str]); 3] {
+    [
+        ("fusermount3", &["-uz"]),
+        ("fusermount", &["-uz"]),
+        ("umount", &["-l"]),
+    ]
+}
+
+fn run_unmount_command(program: &str, args: &[&str], mount_point: &Path) -> bool {
+    match std::process::Command::new(program)
+        .args(args)
+        .arg(mount_point)
+        .status()
+    {
+        Ok(status) if status.success() => {}
+        Ok(status) => {
+            log::debug!(
+                "{} {:?} exited with status {:?}",
+                program,
+                mount_point,
+                status.code()
+            );
+            return false;
+        }
+        Err(e) => {
+            log::debug!("failed to run {} for {:?}: {:?}", program, mount_point, e);
+            return false;
+        }
+    }
+    true
+}
+
+fn uninit_fuse_context_(is_client: bool) {
+    let ctx = {
+        let mut fuse_context_lock = if is_client {
+            FUSE_CONTEXT_CLIENT.lock()
+        } else {
+            FUSE_CONTEXT_SERVER.lock()
+        };
+        fuse_context_lock.take()
+    };
+    drop(ctx);
+}
+
 impl Drop for FuseContext {
    fn drop(&mut self) {
        self.session.lock().take().map(|s| s.join());
-        log::info!("unmounting clipboard FUSE from {}", self.mount_point.display());
+        log::info!(
+            "unmounting clipboard FUSE from {}",
+            self.mount_point.display()
+        );
    }
 }

@@ -223,3 +491,66 @@ impl FuseContext {
            .collect())
    }
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use std::{fs, io};
+
+    #[cfg(target_family = "unix")]
+    use std::os::unix::fs::symlink;
+
+    #[test]
+    fn classifies_mount_point_state_from_metadata_and_mountinfo() {
+        let mount_point = std::env::temp_dir().join(format!(
+            "rustdesk-fuse-mount-state-test-{}-{}",
+            std::process::id(),
+            line!()
+        ));
+        let mountinfo = format!(
+            "123 1 0:45 / {} rw,nosuid,nodev - fuse.rustdesk rustdesk rw\n",
+            mount_point.display()
+        );
+
+        assert_eq!(
+            inspect_mount_point_state_with(&mount_point, Ok(()), Ok(mountinfo)),
+            MountPointState::HealthyMount
+        );
+        assert_eq!(
+            inspect_mount_point_state_with(&mount_point, Ok(()), Ok(String::new())),
+            MountPointState::NotMounted
+        );
+
+        let disconnected_metadata: io::Result<()> =
+            Err(io::Error::from_raw_os_error(libc::ENOTCONN));
+        assert_eq!(
+            inspect_mount_point_state_with(&mount_point, disconnected_metadata, Ok(String::new())),
+            MountPointState::StaleMount
+        );
+    }
+
+    #[test]
+    #[cfg(target_family = "unix")]
+    fn rejects_symlink_mount_point() {
+        let base = std::env::temp_dir().join(format!(
+            "rustdesk-fuse-symlink-test-{}-{}",
+            std::process::id(),
+            line!()
+        ));
+        let mount_parent = base.join("parent");
+        let mount_point = mount_parent.join("cliprdr-client");
+        let symlink_target = base.join("symlink-target");
+        let _ = fs::remove_dir_all(&base);
+        fs::create_dir_all(&base).unwrap();
+        fs::create_dir_all(&mount_parent).unwrap();
+        fs::create_dir_all(&symlink_target).unwrap();
+        symlink(&symlink_target, &mount_point).unwrap();
+
+        assert!(matches!(
+            prepare_fuse_mount_point(&mount_point),
+            Err(CliprdrError::CliprdrInit)
+        ));
+
+        let _ = fs::remove_dir_all(&base);
+    }
+}
--- a/libs/clipboard/src/platform/unix/local_file.rs
+++ b/libs/clipboard/src/platform/unix/local_file.rs
@@ -192,20 +192,16 @@ impl LocalFile {
            });
        };

-        if offset != self.offset.load(Ordering::Relaxed) {
+        let read_result = if offset != self.offset.load(Ordering::Relaxed) {
            handle
                .seek(std::io::SeekFrom::Start(offset))
-                .map_err(|e| CliprdrError::FileError {
-                    path: self.path.to_string_lossy().to_string(),
-                    err: e,
-                })?;
+                .and_then(|_| handle.read_exact(buf))
+        } else {
+            handle.read_exact(buf)
+        };
+        if let Err(e) = read_result {
+            return Err(self.invalidate_handle(e));
        }
-        handle
-            .read_exact(buf)
-            .map_err(|e| CliprdrError::FileError {
-                path: self.path.to_string_lossy().to_string(),
-                err: e,
-            })?;
        let new_offset = offset + (buf.len() as u64);
        self.offset.store(new_offset, Ordering::Relaxed);

@@ -217,6 +213,15 @@ impl LocalFile {

        Ok(())
    }
+
+    fn invalidate_handle(&mut self, err: std::io::Error) -> CliprdrError {
+        self.offset.store(0, Ordering::Relaxed);
+        self.handle = None;
+        CliprdrError::FileError {
+            path: self.path.to_string_lossy().to_string(),
+            err,
+        }
+    }
 }

 pub(super) fn construct_file_list(paths: &[PathBuf]) -> Result<Vec<LocalFile>, CliprdrError> {
@@ -278,7 +283,10 @@ pub(super) fn construct_file_list(paths: &[PathBuf]) -> Result<Vec<LocalFile>, C

 #[cfg(test)]
 mod file_list_test {
-    use std::{path::PathBuf, sync::atomic::AtomicU64};
+    use std::{
+        path::PathBuf,
+        sync::atomic::{AtomicU64, Ordering},
+    };

    use hbb_common::bytes::{BufMut, BytesMut};

@@ -384,4 +392,30 @@ mod file_list_test {
        as_bin_parse_test("/test")?;
        Ok(())
    }
+
+    #[test]
+    fn read_exact_at_reopens_after_read_failure() -> Result<(), Box<dyn std::error::Error>> {
+        let file_path = std::env::temp_dir().join(format!(
+            "rustdesk-clipboard-local-file-{}",
+            std::process::id()
+        ));
+        std::fs::write(&file_path, b"")?;
+
+        let mut file = LocalFile::try_open(&std::env::temp_dir(), &file_path)?;
+        file.size = 1;
+
+        let mut buf = [0u8; 1];
+        assert!(file.read_exact_at(&mut buf, 0).is_err());
+        assert!(file.handle.is_none());
+        assert_eq!(file.offset.load(Ordering::Relaxed), 0);
+
+        std::fs::write(&file_path, [42u8])?;
+
+        file.read_exact_at(&mut buf, 0)?;
+        assert_eq!(buf, [42u8]);
+        assert!(file.handle.is_none());
+
+        std::fs::remove_file(file_path)?;
+        Ok(())
+    }
 }
--- a/libs/clipboard/src/platform/unix/serv_files.rs
+++ b/libs/clipboard/src/platform/unix/serv_files.rs
@@ -5,7 +5,7 @@ use hbb_common::{
    log,
 };
 use parking_lot::Mutex;
-use std::{path::PathBuf, sync::Arc, usize};
+use std::{path::PathBuf, sync::Arc, time::SystemTime, usize};

 lazy_static::lazy_static! {
    // local files are cached, this value should not be changed when copying files
@@ -30,9 +30,35 @@ enum FileContentsRequest {
    },
 }

+// Cheap fingerprint of one top-level selected entry. A change in size/mtime --
+// or a directory in the selection -- forces sync_files() to rebuild (see below).
+#[derive(Debug, Default, Clone, PartialEq, Eq)]
+struct FileSig {
+    size: u64,
+    mtime: Option<SystemTime>,
+    is_dir: bool,
+}
+
+// Stat the top-level selected paths only (no recursion), same order as `files`.
+fn fingerprint(files: &[String]) -> Vec<FileSig> {
+    files
+        .iter()
+        .map(|s| match std::fs::metadata(s) {
+            Ok(mt) => FileSig {
+                size: mt.len(),
+                mtime: mt.modified().ok(),
+                is_dir: mt.is_dir(),
+            },
+            Err(_) => FileSig::default(),
+        })
+        .collect()
+}
+
 #[derive(Default)]
 struct ClipFiles {
    files: Vec<String>,
+    // Fingerprint of `files` (same len/order); detects in-place edits on re-copy.
+    sigs: Vec<FileSig>,
    file_list: Vec<LocalFile>,
    first_file_index: usize,
    files_pdu: Vec<u8>,
@@ -41,12 +67,17 @@ struct ClipFiles {
 impl ClipFiles {
    fn clear(&mut self) {
        self.files.clear();
+        self.sigs.clear();
        self.file_list.clear();
        self.first_file_index = usize::MAX;
        self.files_pdu.clear();
    }

-    fn sync_files(&mut self, clipboard_files: &[String]) -> Result<(), CliprdrError> {
+    fn sync_files(
+        &mut self,
+        clipboard_files: &[String],
+        sigs: Vec<FileSig>,
+    ) -> Result<(), CliprdrError> {
        let clipboard_paths = clipboard_files
            .iter()
            .map(|s| PathBuf::from(s))
@@ -58,6 +89,7 @@ impl ClipFiles {
            .position(|f| !f.path.is_dir())
            .unwrap_or(usize::MAX);
        self.files = clipboard_files.to_vec();
+        self.sigs = sigs;
        Ok(())
    }

@@ -258,14 +290,128 @@ pub fn read_file_contents(
 }

 pub fn sync_files(files: &[String]) -> Result<(), CliprdrError> {
+    // Dedup: skip the rebuild only when paths + sizes + mtimes match and no dir is
+    // selected (a dir's own mtime doesn't change when a file inside it is edited).
+    let current = fingerprint(files);
    let mut files_lock = CLIP_FILES.lock();
-    if files_lock.files == files {
+    if files_lock.files == files
+        && files_lock.sigs == current
+        && !current.iter().any(|sig| sig.is_dir)
+    {
        return Ok(());
    }
-    files_lock.sync_files(files)?;
+    files_lock.sync_files(files, current)?;
    Ok(files_lock.build_file_list_pdu())
 }

 pub fn get_file_list_pdu() -> Vec<u8> {
    CLIP_FILES.lock().files_pdu.clone()
 }
+
+#[cfg(test)]
+mod sig_test {
+    use super::*;
+    use std::fs;
+    use std::path::PathBuf;
+    use std::time::{SystemTime, UNIX_EPOCH};
+
+    // Unique temp dir under the system temp dir; removed on drop (no dev-dep).
+    struct TmpDir(PathBuf);
+    impl TmpDir {
+        fn new(tag: &str) -> Self {
+            let nanos = SystemTime::now()
+                .duration_since(UNIX_EPOCH)
+                .map(|d| d.as_nanos())
+                .unwrap_or(0);
+            let mut dir = std::env::temp_dir();
+            dir.push(format!("rustdesk_sig_test_{}_{}", tag, nanos));
+            fs::create_dir_all(&dir).unwrap();
+            TmpDir(dir)
+        }
+        fn join(&self, name: &str) -> PathBuf {
+            self.0.join(name)
+        }
+    }
+    impl Drop for TmpDir {
+        fn drop(&mut self) {
+            let _ = fs::remove_dir_all(&self.0);
+        }
+    }
+
+    fn path_str(p: &PathBuf) -> String {
+        p.to_string_lossy().to_string()
+    }
+
+    #[test]
+    fn fingerprint_missing_path_is_default() {
+        let tmp = TmpDir::new("missing");
+        let missing = path_str(&tmp.join("does_not_exist.bin"));
+        let sigs = fingerprint(&[missing]);
+        assert_eq!(sigs.len(), 1);
+        // A path that can't be stat'd -> default sig, which forces a rebuild.
+        assert_eq!(sigs[0], FileSig::default());
+        assert_eq!(sigs[0].mtime, None);
+    }
+
+    #[test]
+    fn fingerprint_detects_inplace_edit() {
+        let tmp = TmpDir::new("edit");
+        let file = tmp.join("a.bin");
+        fs::write(&file, b"small").unwrap();
+        let p = path_str(&file);
+
+        let before = fingerprint(&[p.clone()]);
+        // Same content, same path: fingerprint must be stable.
+        let again = fingerprint(&[p.clone()]);
+        assert_eq!(before, again);
+        assert_eq!(before[0].size, 5);
+        assert!(!before[0].is_dir);
+
+        // Edit in place so the file grows.
+        fs::write(&file, b"much larger contents than before").unwrap();
+        let after = fingerprint(&[p]);
+        assert_ne!(before, after);
+        assert!(after[0].size > before[0].size);
+    }
+
+    #[test]
+    fn fingerprint_flags_directory() {
+        let tmp = TmpDir::new("dir");
+        let sub = tmp.join("subdir");
+        fs::create_dir_all(&sub).unwrap();
+        let sigs = fingerprint(&[path_str(&sub)]);
+        assert_eq!(sigs.len(), 1);
+        assert!(sigs[0].is_dir);
+    }
+
+    #[test]
+    fn recopy_after_edit_refreshes_cached_size() {
+        let tmp = TmpDir::new("recopy");
+        let file = tmp.join("doc.bin");
+        fs::write(&file, b"v1").unwrap(); // 2 bytes
+        let files = vec![path_str(&file)];
+
+        // Drive the public, guarded `sync_files` over the global CLIP_FILES;
+        // reset first (this is the only test that touches the global).
+        clear_files();
+
+        sync_files(&files).unwrap();
+        {
+            let cache = CLIP_FILES.lock();
+            let idx = cache.first_file_index;
+            assert_eq!(cache.file_list[idx].size, 2);
+        }
+
+        // In-place edit grows the file; the re-copy must rebuild. Pre-fix the
+        // path-only guard early-returned and left the cached size stale at 2.
+        fs::write(&file, b"v2 is bigger").unwrap(); // 12 bytes
+        sync_files(&files).unwrap();
+        {
+            let cache = CLIP_FILES.lock();
+            let idx = cache.first_file_index;
+            assert_eq!(cache.file_list[idx].size, 12);
+        }
+
+        clear_files(); // leave the global clean for other tests
+    }
+}
--- a/libs/clipboard/src/windows/wf_cliprdr.c
+++ b/libs/clipboard/src/windows/wf_cliprdr.c
@@ -41,6 +41,14 @@

 /* Maximum number of clipboard streams accepted from a remote peer (integer overflow / DoS guard) */
 #define WF_CLIPRDR_MAX_STREAMS 16384
+/* Registered clipboard formats use IDs 0xC000 through 0xFFFF.
+ * https://learn.microsoft.com/en-us/windows/win32/api/winuser/nf-winuser-registerclipboardformatw */
+#define WF_CLIPRDR_MAX_FORMATS 0x4000u
+/* Registered format names are string atoms; cap the converted WCHAR name.
+ * https://learn.microsoft.com/en-us/windows/win32/dataxchg/about-atom-tables */
+#define WF_CLIPRDR_MAX_FORMAT_NAME_WCHARS 255u
+/* Bound the peer-provided UTF-8 scan separately from the converted Windows name. */
+#define WF_CLIPRDR_MAX_FORMAT_NAME_UTF8_BYTES (WF_CLIPRDR_MAX_FORMAT_NAME_WCHARS * 4u)

 /* Validates the remote descriptor array size after cItems has been read safely. */
 static BOOL wf_cliprdr_file_group_descriptor_size_valid(SIZE_T size, UINT count)
@@ -61,6 +69,25 @@ static BOOL wf_cliprdr_file_group_descriptor_size_valid(SIZE_T size, UINT count)
 	return size >= descriptors_size;
 }

+static BOOL wf_cliprdr_bounded_strlen(const char *value, size_t max_len, size_t *len)
+{
+	size_t i;
+
+	if (!value || !len)
+		return FALSE;
+
+	for (i = 0; i <= max_len; i++)
+	{
+		if (value[i] == '\0')
+		{
+			*len = i;
+			return TRUE;
+		}
+	}
+
+	return FALSE;
+}
+
 /**
 * Clipboard Formats
 */
@@ -205,6 +232,7 @@ struct _CliprdrStream
 	FILEDESCRIPTORW m_Dsc;
 	void *m_pData;
 	UINT32 m_connID;
+	UINT32 m_streamId;   // unique CLIPRDR streamId; avoids leaking a heap pointer
 };
 typedef struct _CliprdrStream CliprdrStream;

@@ -258,6 +286,9 @@ struct wf_clipboard
 	char *req_fdata;
 	HANDLE req_fevent;
 	BOOL req_f_received;
+	UINT32 req_f_conn_id_expected;     // connID of the outstanding request
+	UINT32 req_f_stream_id_expected;   // streamId of the outstanding request; responses for another are dropped
+	LONG req_f_stream_id_seq;          // source of unique per-stream ids

 	size_t nFiles;
 	size_t file_array_size;
@@ -288,7 +319,7 @@ static UINT32 get_remote_format_id(wfClipboard *clipboard, UINT32 local_format);
 static UINT cliprdr_send_data_request(UINT32 connID, wfClipboard *clipboard, UINT32 format);
 static UINT cliprdr_send_lock(wfClipboard *clipboard);
 static UINT cliprdr_send_unlock(wfClipboard *clipboard);
-static UINT cliprdr_send_request_filecontents(wfClipboard *clipboard, UINT32 connID, const void *streamid,
+static UINT cliprdr_send_request_filecontents(wfClipboard *clipboard, UINT32 connID, UINT32 streamId,
 											  ULONG index, UINT32 flag, DWORD positionhigh,
 											  DWORD positionlow, ULONG request);

@@ -371,7 +402,7 @@ static ULONG STDMETHODCALLTYPE CliprdrStream_Release(IStream *This)
 static HRESULT STDMETHODCALLTYPE CliprdrStream_Read(IStream *This, void *pv, ULONG cb,
 													ULONG *pcbRead)
 {
-	int ret;
+	UINT ret;
 	CliprdrStream *instance = (CliprdrStream *)This;
 	wfClipboard *clipboard;

@@ -384,12 +415,23 @@ static HRESULT STDMETHODCALLTYPE CliprdrStream_Read(IStream *This, void *pv, ULO
 	if (instance->m_lOffset.QuadPart >= instance->m_lSize.QuadPart)
 		return S_FALSE;

-	ret = cliprdr_send_request_filecontents(clipboard, instance->m_connID, (void *)This, instance->m_lIndex,
+	ret = cliprdr_send_request_filecontents(clipboard, instance->m_connID, instance->m_streamId, instance->m_lIndex,
 											FILECONTENTS_RANGE, instance->m_lOffset.HighPart,
 											instance->m_lOffset.LowPart, cb);

-	if (ret < 0)
+	if (ret != CHANNEL_RC_OK)
+	{
+		free(clipboard->req_fdata);
+		clipboard->req_fdata = NULL;
 		return E_FAIL;
+	}
+
+	if (clipboard->req_fsize > cb)
+	{
+		free(clipboard->req_fdata);
+		clipboard->req_fdata = NULL;
+		return STG_E_READFAULT;
+	}

 	if (clipboard->req_fdata)
 	{
@@ -601,6 +643,7 @@ static CliprdrStream *CliprdrStream_New(UINT32 connID, ULONG index, void *pData,
 			instance->m_pData = pData;
 			instance->m_lOffset.QuadPart = 0;
 			instance->m_connID = connID;
+			instance->m_streamId = (UINT32)InterlockedIncrement(&clipboard->req_f_stream_id_seq);

 			if (instance->m_Dsc.dwFlags & FD_ATTRIBUTES)
 			{
@@ -611,16 +654,28 @@ static CliprdrStream *CliprdrStream_New(UINT32 connID, ULONG index, void *pData,
 			if (((instance->m_Dsc.dwFlags & FD_FILESIZE) == 0) && !isDir)
 			{
 				/* get content size of this stream */
-				if (cliprdr_send_request_filecontents(clipboard, instance->m_connID, (void *)instance,
+				if (cliprdr_send_request_filecontents(clipboard, instance->m_connID, instance->m_streamId,
 													  instance->m_lIndex, FILECONTENTS_SIZE, 0, 0,
 													  8) == CHANNEL_RC_OK)
 				{
 					success = TRUE;
 				}

-				if (clipboard->req_fdata != NULL)
+				if (clipboard->req_fdata != NULL && clipboard->req_fsize >= sizeof(LONGLONG))
+				{
+					LONGLONG sz = 0;
+					CopyMemory(&sz, clipboard->req_fdata, sizeof(sz));
+					if (sz < 0)
+						success = FALSE;
+					else
+						instance->m_lSize.QuadPart = sz;
+				}
+				else
+				{
+					success = FALSE;
+				}
+				if (clipboard->req_fdata)
 				{
-					instance->m_lSize.QuadPart = *((LONGLONG *)clipboard->req_fdata);
 					free(clipboard->req_fdata);
 					clipboard->req_fdata = NULL;
 				}
@@ -1406,25 +1461,35 @@ static UINT32 get_remote_format_id(wfClipboard *clipboard, UINT32 local_format)
 	return local_format;
 }

-static void map_ensure_capacity(wfClipboard *clipboard)
+static BOOL map_ensure_capacity(wfClipboard *clipboard, size_t capacity)
 {
+	size_t old_size;
+	formatMapping *new_map;
+
 	if (!clipboard)
-		return;
+		return FALSE;

-	if (clipboard->map_size >= clipboard->map_capacity)
-	{
-		size_t new_size;
-		formatMapping *new_map;
-		new_size = clipboard->map_capacity * 2;
-		new_map =
-			(formatMapping *)realloc(clipboard->format_mappings, sizeof(formatMapping) * new_size);
+	if (!clipboard->format_mappings)
+		return FALSE;

-		if (!new_map)
-			return;
+	if (capacity <= clipboard->map_capacity)
+		return TRUE;

-		clipboard->format_mappings = new_map;
-		clipboard->map_capacity = new_size;
-	}
+	if (capacity > WF_CLIPRDR_MAX_FORMATS ||
+	    capacity > ((size_t)-1) / sizeof(formatMapping))
+		return FALSE;
+
+	old_size = clipboard->map_capacity;
+	new_map =
+		(formatMapping *)realloc(clipboard->format_mappings, sizeof(formatMapping) * capacity);
+
+	if (!new_map)
+		return FALSE;
+
+	memset(new_map + old_size, 0, sizeof(formatMapping) * (capacity - old_size));
+	clipboard->format_mappings = new_map;
+	clipboard->map_capacity = capacity;
+	return TRUE;
 }

 static BOOL clear_format_map(wfClipboard *clipboard)
@@ -1451,6 +1516,13 @@ static BOOL clear_format_map(wfClipboard *clipboard)
 	return TRUE;
 }

+static UINT wf_cliprdr_server_format_list_fail(wfClipboard *clipboard)
+{
+	clear_format_map(clipboard);
+	clipboard->copied = FALSE;
+	return ERROR_INTERNAL_ERROR;
+}
+
 static UINT cliprdr_send_tempdir(wfClipboard *clipboard)
 {
 	CLIPRDR_TEMP_DIRECTORY tempDirectory;
@@ -1729,12 +1801,12 @@ static UINT cliprdr_send_data_request(UINT32 connID, wfClipboard *clipboard, UIN
 	return wait_response_event(connID, clipboard, clipboard->formatDataRespEvent, &clipboard->formatDataRespReceived, &clipboard->hmem);
 }

-UINT cliprdr_send_request_filecontents(wfClipboard *clipboard, UINT32 connID, const void *streamid, ULONG index,
+static UINT cliprdr_send_request_filecontents(wfClipboard *clipboard, UINT32 connID, UINT32 streamId, ULONG index,
 									   UINT32 flag, DWORD positionhigh, DWORD positionlow,
 									   ULONG nreq)
 {
 	UINT rc;
-	CLIPRDR_FILE_CONTENTS_REQUEST fileContentsRequest;
+	CLIPRDR_FILE_CONTENTS_REQUEST fileContentsRequest = { 0 };

 	if (!clipboard || !clipboard->context || !clipboard->context->ClientFileContentsRequest)
 		return ERROR_INTERNAL_ERROR;
@@ -1745,12 +1817,11 @@ UINT cliprdr_send_request_filecontents(wfClipboard *clipboard, UINT32 connID, co
 		return rc;
 	}
 	clipboard->req_f_received = FALSE;
+	clipboard->req_f_conn_id_expected = connID;
+	clipboard->req_f_stream_id_expected = streamId;

 	fileContentsRequest.connID = connID;
-	// streamId is `IStream*` pointer, though it is not very good on a 64-bit system.
-	// But it is OK, because it is only used to check if the stream is the same in
-	// `wf_cliprdr_server_file_contents_request()` function.
-	fileContentsRequest.streamId = (UINT32)(ULONG_PTR)streamid;
+	fileContentsRequest.streamId = streamId;
 	fileContentsRequest.listIndex = index;
 	fileContentsRequest.dwFlags = flag;
 	fileContentsRequest.nPositionLow = positionlow;
@@ -2443,6 +2514,16 @@ static UINT wf_cliprdr_server_format_list(CliprdrClientContext *context,

 	if (!clear_format_map(clipboard))
 		return ERROR_INTERNAL_ERROR;
+	clipboard->copied = FALSE;
+
+	if (formatList->numFormats > WF_CLIPRDR_MAX_FORMATS)
+		return ERROR_INTERNAL_ERROR;
+
+	if (formatList->numFormats > 0 && !formatList->formats)
+		return ERROR_INTERNAL_ERROR;
+
+	if (!map_ensure_capacity(clipboard, formatList->numFormats))
+		return ERROR_INTERNAL_ERROR;

 	clipboard->copied = TRUE;

@@ -2450,19 +2531,58 @@ static UINT wf_cliprdr_server_format_list(CliprdrClientContext *context,
 	{
 		format = &(formatList->formats[i]);
 		mapping = &(clipboard->format_mappings[i]);
+		/* Do not validate the peer-provided formatId as a Windows registered format.
+		 * It is only a remote protocol ID used when requesting data from the peer.
+		 * For named formats, RegisterClipboardFormatW creates the local Windows
+		 * clipboard ID below, and that local ID is checked before publishing. */
 		mapping->remote_format_id = format->formatId;

 		if (format->formatName)
 		{
-			int size = MultiByteToWideChar(CP_UTF8, 0, format->formatName,
-										   strlen(format->formatName), NULL, 0);
-			mapping->name = calloc(size + 1, sizeof(WCHAR));
+			size_t name_len;
+			int size;

-			if (mapping->name)
+			if (!wf_cliprdr_bounded_strlen(format->formatName,
+			                               WF_CLIPRDR_MAX_FORMAT_NAME_UTF8_BYTES, &name_len))
 			{
-				MultiByteToWideChar(CP_UTF8, 0, format->formatName, strlen(format->formatName),
-									mapping->name, size);
-				mapping->local_format_id = RegisterClipboardFormatW((LPWSTR)mapping->name);
+				return wf_cliprdr_server_format_list_fail(clipboard);
+			}
+
+			if (name_len == 0)
+			{
+				return wf_cliprdr_server_format_list_fail(clipboard);
+			}
+
+			size = MultiByteToWideChar(CP_UTF8, 0, format->formatName, (int)name_len,
+			                           NULL, 0);
+			if (size <= 0)
+			{
+				return wf_cliprdr_server_format_list_fail(clipboard);
+			}
+
+			if ((UINT)size > WF_CLIPRDR_MAX_FORMAT_NAME_WCHARS)
+			{
+				return wf_cliprdr_server_format_list_fail(clipboard);
+			}
+
+			mapping->name = calloc((size_t)size + 1, sizeof(WCHAR));
+			if (!mapping->name)
+			{
+				return wf_cliprdr_server_format_list_fail(clipboard);
+			}
+
+			if (MultiByteToWideChar(CP_UTF8, 0, format->formatName, (int)name_len,
+			                        mapping->name, size) != size)
+			{
+				free(mapping->name);
+				mapping->name = NULL;
+				return wf_cliprdr_server_format_list_fail(clipboard);
+			}
+
+			mapping->local_format_id = RegisterClipboardFormatW((LPWSTR)mapping->name);
+			if (mapping->local_format_id == 0)
+			{
+				return wf_cliprdr_server_format_list_fail(clipboard);
 			}
 		}
 		else
@@ -2472,7 +2592,6 @@ static UINT wf_cliprdr_server_format_list(CliprdrClientContext *context,
 		}

 		clipboard->map_size++;
-		map_ensure_capacity(clipboard);
 	}

 	if (file_transferring(clipboard))
@@ -2923,6 +3042,7 @@ wf_cliprdr_server_file_contents_request(CliprdrClientContext *context,
 	BOOL bIsStreamFile = TRUE;
 	static LPSTREAM pStreamStc = NULL;
 	static UINT32 uStreamIdStc = 0;
+	static UINT32 uConnIdStc = 0;
 	wfClipboard *clipboard;
 	UINT rc = ERROR_INTERNAL_ERROR;
 	UINT sRc;
@@ -2996,7 +3116,8 @@ wf_cliprdr_server_file_contents_request(CliprdrClientContext *context,
 	vFormatEtc.lindex = fileContentsRequest->listIndex;
 	vFormatEtc.ptd = NULL;

-	if ((uStreamIdStc != fileContentsRequest->streamId) || !pStreamStc)
+	if ((uStreamIdStc != fileContentsRequest->streamId) ||
+		(uConnIdStc != fileContentsRequest->connID) || !pStreamStc)
 	{
 		LPENUMFORMATETC pEnumFormatEtc;
 		ULONG CeltFetched;
@@ -3027,6 +3148,7 @@ wf_cliprdr_server_file_contents_request(CliprdrClientContext *context,
 						{
 							pStreamStc = vStgMedium.pstm;
 							uStreamIdStc = fileContentsRequest->streamId;
+							uConnIdStc = fileContentsRequest->connID;
 							bIsStreamFile = TRUE;
 						}

@@ -3190,6 +3312,9 @@ wf_cliprdr_server_file_contents_response(CliprdrClientContext *context,
 			rc = ERROR_INTERNAL_ERROR;
 			break;
 		}
+		if (fileContentsResponse->connID != clipboard->req_f_conn_id_expected ||
+			fileContentsResponse->streamId != clipboard->req_f_stream_id_expected)
+			return CHANNEL_RC_OK;
 		clipboard->req_fsize = 0;
 		clipboard->req_fdata = NULL;

@@ -3200,6 +3325,13 @@ wf_cliprdr_server_file_contents_response(CliprdrClientContext *context,
 		}

 		clipboard->req_fsize = fileContentsResponse->cbRequested;
+		/*
+		 * Keep the zero-size allocation: supported Windows builds use the Microsoft
+		 * CRT, where malloc(0) returns a valid pointer. wait_response_event() also
+		 * uses a non-NULL req_fdata to recognize a successful zero-byte response.
+		 * The Rust FFI derives requestedData and cbRequested from the same Vec, so a
+		 * nonzero length cannot have a NULL data pointer on the normal call path.
+		 */
 		clipboard->req_fdata = (char *)malloc(fileContentsResponse->cbRequested);
 		if (!clipboard->req_fdata)
 		{
--- a/libs/enigo/src/lib.rs
+++ b/libs/enigo/src/lib.rs
@@ -113,11 +113,11 @@ pub enum MouseButton {

    /// Scroll up button
    ScrollUp,
-    /// Left right button
+    /// Scroll down button
    ScrollDown,
-    /// Left right button
+    /// Scroll left button
    ScrollLeft,
-    /// Left right button
+    /// Scroll right button
    ScrollRight,
 }

--- a/libs/enigo/src/win/win_impl.rs
+++ b/libs/enigo/src/win/win_impl.rs
@@ -223,7 +223,7 @@ impl KeyboardControllable for Enigo {
            // Windows uses uft-16 encoding. We need to check
            // for variable length characters. As such some
            // characters can be 32 bit long and those are
-            // encoded in such called hight and low surrogates
+            // encoded in so-called high and low surrogates
            // each 16 bit wide that needs to be send after
            // another to the SendInput function without
            // being interrupted by "keyup"
--- a/libs/hbb_common
+++ b/libs/hbb_common
--- a/libs/portable/Cargo.toml
+++ b/libs/portable/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "rustdesk-portable-packer"
-version = "1.4.8"
+version = "1.4.9"
 edition = "2021"
 description = "RustDesk Remote Desktop"

@@ -26,7 +26,7 @@ windows = { version = "0.61", features = [
 native-windows-gui = {version = "1.0", default-features = false, features = ["animation-timer", "image-decoder"]}

 [package.metadata.winres]
-LegalCopyright = "Copyright © 2025 Purslane Ltd. All rights reserved."
+LegalCopyright = "Copyright © 2026 Purslane Tech Pte. Ltd. All rights reserved."
 ProductName = "RustDesk"
 OriginalFilename = "rustdesk.exe"
 FileDescription = "RustDesk Remote Desktop"
--- a/libs/scrap/Cargo.toml
+++ b/libs/scrap/Cargo.toml
@@ -48,7 +48,7 @@ quest = "0.3"

 [build-dependencies]
 target_build_utils = "0.3"
-bindgen = "0.65"
+bindgen = "0.72.1"
 pkg-config = { version = "0.3.27", optional = true }

 [target.'cfg(target_os = "linux")'.dependencies]
--- a/libs/scrap/src/common/aom.rs
+++ b/libs/scrap/src/common/aom.rs
@@ -79,6 +79,10 @@ mod webrtc {
        }
    }

+    fn tile_log2(threads: u32) -> std::os::raw::c_uint {
+        (threads as f64).log2().ceil() as _
+    }
+
    fn get_super_block_size(width: u32, height: u32, threads: u32) -> aom_superblock_size_t {
        use aom_superblock_size::*;
        let resolution = width * height;
@@ -160,8 +164,7 @@ mod webrtc {
        } else {
            AV1E_SET_TILE_COLUMNS
        };
-        // Failed on android
-        call_ctl!(ctx, tile_set, (cfg.g_threads as f64 * 1.0f64).log2().ceil());
+        call_ctl!(ctx, tile_set, tile_log2(cfg.g_threads));
        call_ctl!(ctx, AV1E_SET_ROW_MT, 1);
        call_ctl!(ctx, AV1E_SET_ENABLE_OBMC, 0);
        call_ctl!(ctx, AV1E_SET_NOISE_SENSITIVITY, 0);
@@ -197,6 +200,23 @@ mod webrtc {

        Ok(())
    }
+
+    #[cfg(test)]
+    mod tests {
+        use super::*;
+        use std::os::raw::c_uint;
+
+        #[test]
+        fn tile_log2_uses_c_uint_and_rounds_up() {
+            let one_thread: c_uint = tile_log2(1);
+            let three_threads: c_uint = tile_log2(3);
+            let max_threads: c_uint = tile_log2(64);
+
+            assert_eq!(one_thread, 0);
+            assert_eq!(three_threads, 2);
+            assert_eq!(max_threads, 6);
+        }
+    }
 }

 impl EncoderApi for AomEncoder {
--- a/libs/scrap/src/common/record.rs
+++ b/libs/scrap/src/common/record.rs
@@ -20,6 +20,22 @@ use webm::mux::{self, Segment, Track, VideoTrack, Writer};

 const MIN_SECS: u64 = 1;

+// Replace characters that are invalid in Windows filename components so recordings remain portable.
+// Control characters are also replaced because they can make filenames invalid
+// on Windows or invisible and difficult to handle on Linux and macOS.
+fn sanitize_filename_component(value: &str) -> String {
+    value
+        .chars()
+        .map(|c| {
+            if c.is_control() || matches!(c, '<' | '>' | ':' | '"' | '/' | '\\' | '|' | '?' | '*') {
+                '_'
+            } else {
+                c
+            }
+        })
+        .collect()
+}
+
 #[derive(Debug, Clone)]
 pub struct RecorderContext {
    pub server: bool,
@@ -45,7 +61,7 @@ impl RecorderContext2 {
        }
        let file = if ctx.server { "incoming" } else { "outgoing" }.to_string()
            + "_"
-            + &ctx.id.clone()
+            + &sanitize_filename_component(&ctx.id)
            + &chrono::Local::now().format("_%Y%m%d%H%M%S%3f_").to_string()
            + &format!(
                "{}{}_",
@@ -421,3 +437,24 @@ impl Drop for HwRecorder {
        self.ctx.tx.as_ref().map(|tx| tx.send(state));
    }
 }
+
+#[cfg(test)]
+mod tests {
+    use super::sanitize_filename_component;
+
+    #[test]
+    fn sanitize_recording_filename_component() {
+        assert_eq!(
+            sanitize_filename_component("192.168.1.2:21118"),
+            "192.168.1.2_21118"
+        );
+        assert_eq!(
+            sanitize_filename_component("[2001:db8::1]:21118"),
+            "[2001_db8__1]_21118"
+        );
+        assert_eq!(
+            sanitize_filename_component("peer/name\\with?bad\nchars"),
+            "peer_name_with_bad_chars"
+        );
+    }
+}
--- a/libs/scrap/src/wayland/display.rs
+++ b/libs/scrap/src/wayland/display.rs
@@ -14,6 +14,9 @@ lazy_static! {
    static ref DISPLAYS: Mutex<Option<Arc<Displays>>> = Mutex::new(None);
 }

+static MISSING_LOGICAL_SIZE_WARNED: std::sync::atomic::AtomicBool =
+    std::sync::atomic::AtomicBool::new(false);
+
 const COMMAND_TIMEOUT: Duration = Duration::from_millis(1000);

 pub struct Displays {
@@ -217,7 +220,26 @@ pub fn clear_wayland_displays_cache() {
 // Return (min_x, max_x, min_y, max_y)
 pub fn get_desktop_rect_for_uinput() -> Option<(i32, i32, i32, i32)> {
    let wayland_displays = get_displays();
-    let displays = &wayland_displays.displays;
+    desktop_rect_of(&wayland_displays.displays)
+}
+
+// The desktop rect and per-display logical rects, always read live from the
+// compositor in a single roundtrip. Skips the displays cache and the primary-monitor
+// detection (which may spawn external commands), so it is cheap enough to poll for
+// layout changes. https://github.com/rustdesk/rustdesk/issues/15601
+pub fn get_layout_for_uinput_live() -> Option<((i32, i32, i32, i32), Vec<DisplayRect>)> {
+    match get_wayland_displays() {
+        Ok(displays) => {
+            desktop_rect_of(&displays).map(|rect| (rect, logical_rects_of(&displays)))
+        }
+        Err(err) => {
+            warn!("Failed to get wayland displays: {}", err);
+            None
+        }
+    }
+}
+
+fn desktop_rect_of(displays: &[WaylandDisplayInfo]) -> Option<(i32, i32, i32, i32)> {
    if displays.is_empty() {
        return None;
    }
@@ -243,10 +265,13 @@ pub fn get_desktop_rect_for_uinput() -> Option<(i32, i32, i32, i32)> {
            // This may occur if the Wayland compositor does not provide logical size information,
            // or if display information is incomplete. We fall back to physical size, which provides
            // usable dimensions, but may not always be correct depending on compositor behavior.
-            warn!(
+            // Warn only once, the live path polls this while a session is active.
+            if !MISSING_LOGICAL_SIZE_WARNED.swap(true, std::sync::atomic::Ordering::Relaxed) {
+                warn!(
                    "Display at ({}, {}) is missing logical_size; falling back to physical size ({}, {}).",
                    d.x, d.y, d.width, d.height
                );
+            }
            (d.width, d.height)
        };
        max_x = max_x.max(d.x + size.0);
@@ -254,3 +279,289 @@ pub fn get_desktop_rect_for_uinput() -> Option<(i32, i32, i32, i32)> {
    }
    Some((min_x, max_x, min_y, max_y))
 }
+
+/// One display's logical rectangle in the desktop coordinate space the client uses:
+/// logical origin plus logical size, falling back to physical size when the compositor
+/// reports no logical size (matching `desktop_rect_of`).
+#[derive(Clone, Debug, PartialEq)]
+pub struct DisplayRect {
+    pub name: String,
+    pub x: i32,
+    pub y: i32,
+    pub w: i32,
+    pub h: i32,
+}
+
+fn logical_rects_of(displays: &[WaylandDisplayInfo]) -> Vec<DisplayRect> {
+    // Match `desktop_rect_of`: a single display uses its physical size (its scale is
+    // reported as 1.0 to the client), multiple displays use logical size. This keeps a
+    // single display a no-op for the remap (its origin never shifts) and keeps the rects
+    // in the same coordinate space the client's coordinates are expressed in.
+    let single = displays.len() == 1;
+    displays
+        .iter()
+        .map(|d| {
+            let (w, h) = if single {
+                (d.width, d.height)
+            } else {
+                d.logical_size.unwrap_or((d.width, d.height))
+            };
+            DisplayRect {
+                name: d.name.clone(),
+                x: d.x,
+                y: d.y,
+                w,
+                h,
+            }
+        })
+        .collect()
+}
+
+// Per-display logical rects from the cached init snapshot. The client's injected
+// coordinates are `local + origin` in this layout, so it is the baseline to map from.
+pub fn get_display_rects_for_uinput() -> Vec<DisplayRect> {
+    logical_rects_of(&get_displays().displays)
+}
+
+/// Remap an injected coordinate from the layout the client still believes in
+/// (`baseline`, captured at session init) to the current compositor layout (`live`).
+///
+/// A single-display client sends whole-desktop coordinates: `local + baseline_origin[d]`
+/// for whichever display `d` it is following. If that display's origin or logical size
+/// has since changed (e.g. another monitor was rescaled, shifting this one), the
+/// coordinate lands offset. We find the baseline display the point falls in, then map
+/// the point into the same display's live rectangle, matched by connector name (or, when
+/// the compositor reports no names, by index while the display count is unchanged).
+///
+/// Returns the input unchanged when the point is outside every baseline display or the
+/// matched display is gone, so a failed match never moves the cursor further off than
+/// leaving it alone. https://github.com/rustdesk/rustdesk/issues/15601
+pub fn remap_to_live_layout(
+    x: i32,
+    y: i32,
+    baseline: &[DisplayRect],
+    live: &[DisplayRect],
+) -> (i32, i32) {
+    let Some((bi, b)) = baseline
+        .iter()
+        .enumerate()
+        .find(|(_, r)| x >= r.x && x < r.x + r.w && y >= r.y && y < r.y + r.h)
+    else {
+        return (x, y);
+    };
+    let matched = if b.name.is_empty() {
+        // Nameless compositor: index-match, but only while the count is unchanged. A
+        // named display that is simply gone from the live layout must fall through to
+        // "unchanged" below, not get index-matched to whatever now sits at its index.
+        if baseline.len() == live.len() {
+            live.get(bi)
+        } else {
+            None
+        }
+    } else {
+        live.iter().find(|r| r.name == b.name)
+    };
+    let Some(l) = matched else {
+        return (x, y);
+    };
+    // Map the point into the live rectangle, preserving position within the display so a
+    // scale change on the followed display itself is corrected too, not only a shift.
+    // Scale by (extent - 1) so both endpoints land exactly: the client clamps its
+    // coordinate to `[origin, origin + w - 1]`, and mapping that span to the live span's
+    // `[0, w' - 1]` keeps the far edge reachable (hot corners) in both directions, and
+    // stays an exact shift when the size is unchanged.
+    let nx = map_axis(x, b.x, b.w, l.x, l.w);
+    let ny = map_axis(y, b.y, b.h, l.y, l.h);
+    (nx, ny)
+}
+
+fn map_axis(v: i32, base_origin: i32, base_extent: i32, live_origin: i32, live_extent: i32) -> i32 {
+    if base_extent <= 1 || live_extent <= 1 {
+        return live_origin;
+    }
+    live_origin + ((v - base_origin) as i64 * (live_extent - 1) as i64 / (base_extent - 1) as i64) as i32
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn display(
+        x: i32,
+        y: i32,
+        width: i32,
+        height: i32,
+        logical_size: Option<(i32, i32)>,
+    ) -> WaylandDisplayInfo {
+        WaylandDisplayInfo {
+            name: "".to_owned(),
+            x,
+            y,
+            width,
+            height,
+            logical_size,
+            refresh_rate: 60,
+        }
+    }
+
+    #[test]
+    fn test_desktop_rect_empty() {
+        assert_eq!(desktop_rect_of(&[]), None);
+    }
+
+    #[test]
+    fn test_desktop_rect_single_display_uses_physical_size() {
+        let displays = [display(0, 0, 2880, 1800, Some((1859, 1162)))];
+        assert_eq!(desktop_rect_of(&displays), Some((0, 2880, 0, 1800)));
+    }
+
+    #[test]
+    fn test_desktop_rect_multi_display_uses_logical_size() {
+        // Laptop panel at 155% below two stacked externals at 100%.
+        let displays = [
+            display(0, 718, 2880, 1800, Some((1859, 1162))),
+            display(1859, 0, 1920, 1080, Some((1920, 1080))),
+            display(1859, 1080, 1920, 1080, Some((1920, 1080))),
+        ];
+        assert_eq!(desktop_rect_of(&displays), Some((0, 3779, 0, 2160)));
+    }
+
+    #[test]
+    fn test_desktop_rect_missing_logical_size_falls_back_to_physical() {
+        let displays = [
+            display(0, 0, 2560, 1440, None),
+            display(2560, 0, 2560, 1440, Some((2560, 1440))),
+        ];
+        assert_eq!(desktop_rect_of(&displays), Some((0, 5120, 0, 1440)));
+    }
+
+    fn rect(name: &str, x: i32, y: i32, w: i32, h: i32) -> DisplayRect {
+        DisplayRect {
+            name: name.to_owned(),
+            x,
+            y,
+            w,
+            h,
+        }
+    }
+
+    // The reported failure: connect to the second display, rescale the primary.
+    // Baseline: two 2560-wide displays side by side, both at 100%.
+    // Live: the primary (DP-1) rescaled to 125% -> 2048 logical wide, so the second
+    // display (DP-2) shifts left from x=2560 to x=2048. A client following DP-2 keeps
+    // sending coordinates offset by DP-2's old origin (2560).
+    #[test]
+    fn test_remap_primary_rescale_shifts_second_display() {
+        let baseline = [
+            rect("DP-1", 0, 0, 2560, 1440),
+            rect("DP-2", 2560, 0, 2560, 1440),
+        ];
+        let live = [
+            rect("DP-1", 0, 0, 2048, 1440),
+            rect("DP-2", 2048, 0, 2560, 1440),
+        ];
+        // Top-left of DP-2: client sends (2560, 0), should land at live DP-2 origin.
+        assert_eq!(remap_to_live_layout(2560, 0, &baseline, &live), (2048, 0));
+        // Middle of DP-2 keeps its fractional position.
+        assert_eq!(
+            remap_to_live_layout(3840, 720, &baseline, &live),
+            (3328, 720)
+        );
+    }
+
+    // A point on the rescaled display itself is squeezed to its new logical width.
+    #[test]
+    fn test_remap_scales_within_resized_display() {
+        let baseline = [rect("DP-1", 0, 0, 2560, 1440), rect("DP-2", 2560, 0, 2560, 1440)];
+        let live = [rect("DP-1", 0, 0, 2048, 1440), rect("DP-2", 2048, 0, 2560, 1440)];
+        // x=1280 across the 2560-wide baseline DP-1 -> proportionally across the 2048-wide
+        // live DP-1 (endpoint-preserving scale, so ~1px off the naive midpoint).
+        assert_eq!(remap_to_live_layout(1280, 500, &baseline, &live), (1023, 500));
+    }
+
+    // The far edge of the followed display stays reachable when it is enlarged, so hot
+    // corners keep working. Baseline DP-1 is 2048 wide, live DP-1 is 2560 wide; the
+    // client's last column (2047) must map to the live last column (2559), not 2558.
+    #[test]
+    fn test_remap_enlarged_display_reaches_far_edge() {
+        let baseline = [rect("DP-1", 0, 0, 2048, 1440), rect("DP-2", 2048, 0, 1920, 1080)];
+        let live = [rect("DP-1", 0, 0, 2560, 1440), rect("DP-2", 2560, 0, 1920, 1080)];
+        assert_eq!(remap_to_live_layout(2047, 0, &baseline, &live), (2559, 0));
+        assert_eq!(remap_to_live_layout(0, 0, &baseline, &live), (0, 0));
+    }
+
+    // No drift: identical layouts map every point to itself.
+    #[test]
+    fn test_remap_identity_when_unchanged() {
+        let layout = [rect("DP-1", 0, 0, 2560, 1440), rect("DP-2", 2560, 0, 2560, 1440)];
+        assert_eq!(remap_to_live_layout(3000, 700, &layout, &layout), (3000, 700));
+    }
+
+    // Point outside every baseline display is left untouched.
+    #[test]
+    fn test_remap_point_outside_all_displays_unchanged() {
+        let baseline = [rect("DP-1", 0, 0, 2560, 1440)];
+        let live = [rect("DP-1", 0, 0, 2048, 1440)];
+        assert_eq!(remap_to_live_layout(9000, 9000, &baseline, &live), (9000, 9000));
+    }
+
+    // Matched display gone from the live layout (e.g. unplugged): leave the point be
+    // rather than mapping it somewhere wrong.
+    #[test]
+    fn test_remap_display_removed_unchanged() {
+        let baseline = [rect("DP-1", 0, 0, 2560, 1440), rect("DP-2", 2560, 0, 2560, 1440)];
+        let live = [rect("DP-1", 0, 0, 2560, 1440)];
+        assert_eq!(remap_to_live_layout(2600, 100, &baseline, &live), (2600, 100));
+    }
+
+    // Nameless compositor: fall back to index matching while the count is unchanged.
+    #[test]
+    fn test_remap_nameless_index_fallback() {
+        let baseline = [rect("", 0, 0, 2560, 1440), rect("", 2560, 0, 2560, 1440)];
+        let live = [rect("", 0, 0, 2048, 1440), rect("", 2048, 0, 2560, 1440)];
+        assert_eq!(remap_to_live_layout(2560, 0, &baseline, &live), (2048, 0));
+    }
+
+    // Nameless compositor with a changed count: cannot index-match safely, so no-op.
+    #[test]
+    fn test_remap_nameless_count_changed_unchanged() {
+        let baseline = [rect("", 0, 0, 2560, 1440), rect("", 2560, 0, 2560, 1440)];
+        let live = [rect("", 0, 0, 2048, 1440)];
+        assert_eq!(remap_to_live_layout(2560, 0, &baseline, &live), (2560, 0));
+    }
+
+    // A named display absent from the live layout, but the count is unchanged (e.g. a
+    // monitor was swapped for a different one at the same index): the index fallback is
+    // for nameless layouts only, so a named miss stays unchanged rather than mapping to
+    // whatever now occupies that index.
+    #[test]
+    fn test_remap_named_miss_equal_count_unchanged() {
+        let baseline = [rect("DP-1", 0, 0, 2560, 1440), rect("DP-2", 2560, 0, 2560, 1440)];
+        let live = [rect("DP-1", 0, 0, 2048, 1440), rect("HDMI-1", 2048, 0, 1920, 1080)];
+        assert_eq!(remap_to_live_layout(2600, 100, &baseline, &live), (2600, 100));
+    }
+
+    // A single display uses physical size in both baseline and live (scale reported as
+    // 1.0), so it never drifts and the remap is a no-op even across a rescale.
+    #[test]
+    fn test_logical_rects_single_display_uses_physical() {
+        let displays = [display(0, 0, 2560, 1440, Some((2048, 1152)))];
+        assert_eq!(
+            logical_rects_of(&displays),
+            vec![rect("", 0, 0, 2560, 1440)]
+        );
+    }
+
+    // Multiple displays use logical size, falling back to physical when absent.
+    #[test]
+    fn test_logical_rects_multi_display_uses_logical() {
+        let displays = [
+            display(0, 0, 2560, 1440, Some((2048, 1152))),
+            display(2048, 0, 1920, 1080, None),
+        ];
+        assert_eq!(
+            logical_rects_of(&displays),
+            vec![rect("", 0, 0, 2048, 1152), rect("", 2048, 0, 1920, 1080)]
+        );
+    }
+}
--- a/res/PKGBUILD
+++ b/res/PKGBUILD
@@ -1,5 +1,5 @@
 pkgname=rustdesk
-pkgver=1.4.8
+pkgver=1.4.9
 pkgrel=0
 epoch=
 pkgdesc=""
--- a/res/msi/Package/License.rtf
+++ b/res/msi/Package/License.rtf
@@ -79,7 +79,7 @@ heading 1;}{\s2\ql \li0\ri0\nowidctlpar\wrapdefault\faauto\outlinelevel1\rin0\li
 \ab\af1 \ltrch\fcs0 \b\ul\cf2\lang1033\langfe2052\langnp1033\insrsid1917520 
 \par }\pard \ltrpar\s2\qj \li0\ri0\sb100\sa100\nowidctlpar\wrapdefault\faauto\outlinelevel1\rin0\lin0\itap0\pararsid8979511 {\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \fs18\lang1033\langfe2052\langnp1033\insrsid8979511\charrsid8979511 \hich\af1\dbch\af31505\loch\f1 
 \hich\f1 This Privacy Policy (hereinafter the \'93}{\rtlch\fcs1 \ab\af1\afs21 \ltrch\fcs0 \b\fs21\lang1033\langfe2052\langnp1033\insrsid8979511\charrsid1523795 \hich\af1\dbch\af31505\loch\f1 Policy}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 
-\fs18\lang1033\langfe2052\langnp1033\insrsid8979511\charrsid8979511 \loch\af1\dbch\af31505\hich\f1 \'94\loch\f1 \hich\f1 ) governs the terms and conditions under which Purslane Ltd. (hereinafter \'93}{\rtlch\fcs1 \ab\af1\afs21 \ltrch\fcs0 
+\fs18\lang1033\langfe2052\langnp1033\insrsid8979511\charrsid8979511 \loch\af1\dbch\af31505\hich\f1 \'94\loch\f1 \hich\f1 ) governs the terms and conditions under which Purslane Tech Pte. Ltd. (hereinafter \'93}{\rtlch\fcs1 \ab\af1\afs21 \ltrch\fcs0 
 \b\fs21\lang1033\langfe2052\langnp1033\insrsid8979511\charrsid1523795 \hich\af1\dbch\af31505\loch\f1 us}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \fs18\lang1033\langfe2052\langnp1033\insrsid8979511\charrsid8979511 \loch\af1\dbch\af31505\hich\f1 \'94\loch\f1 
 \hich\f1  or \'93}{\rtlch\fcs1 \ab\af1\afs21 \ltrch\fcs0 \b\fs21\lang1033\langfe2052\langnp1033\insrsid8979511\charrsid1523795 \hich\af1\dbch\af31505\loch\f1 we}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 
 \fs18\lang1033\langfe2052\langnp1033\insrsid8979511\charrsid8979511 \loch\af1\dbch\af31505\hich\f1 \'94\loch\f1 \hich\f1 
@@ -300,4 +300,4 @@ b060828e6f37ed1567914b284d262452282e3198720e274a939cd08a54f980ae38a38f56e422a3a6
 \lsdpriority49 \lsdlocked0 List Table 4 Accent 5;\lsdpriority50 \lsdlocked0 List Table 5 Dark Accent 5;\lsdpriority51 \lsdlocked0 List Table 6 Colorful Accent 5;\lsdpriority52 \lsdlocked0 List Table 7 Colorful Accent 5;
 \lsdpriority46 \lsdlocked0 List Table 1 Light Accent 6;\lsdpriority47 \lsdlocked0 List Table 2 Accent 6;\lsdpriority48 \lsdlocked0 List Table 3 Accent 6;\lsdpriority49 \lsdlocked0 List Table 4 Accent 6;
 \lsdpriority50 \lsdlocked0 List Table 5 Dark Accent 6;\lsdpriority51 \lsdlocked0 List Table 6 Colorful Accent 6;\lsdpriority52 \lsdlocked0 List Table 7 Colorful Accent 6;\lsdsemihidden1 \lsdunhideused1 \lsdlocked0 Mention;
-\lsdsemihidden1 \lsdunhideused1 \lsdlocked0 Smart Hyperlink;\lsdsemihidden1 \lsdunhideused1 \lsdlocked0 Hashtag;\lsdsemihidden1 \lsdunhideused1 \lsdlocked0 Unresolved Mention;\lsdsemihidden1 \lsdunhideused1 \lsdlocked0 Smart Link;}}}
+\lsdsemihidden1 \lsdunhideused1 \lsdlocked0 Smart Hyperlink;\lsdsemihidden1 \lsdunhideused1 \lsdlocked0 Hashtag;\lsdsemihidden1 \lsdunhideused1 \lsdlocked0 Unresolved Mention;\lsdsemihidden1 \lsdunhideused1 \lsdlocked0 Smart Link;}}}
--- a/res/msi/preprocess.py
+++ b/res/msi/preprocess.py
@@ -85,7 +85,7 @@ def make_parser():
        "-m",
        "--manufacturer",
        type=str,
-        default="PURSLANE",
+        default="Purslane Tech Pte. Ltd.",
        help="The app manufacturer.",
    )
    return parser
@@ -499,7 +499,7 @@ def update_license_file(app_name):
        license_content = f.read()
    license_content = license_content.replace("website rustdesk.com and other ", "")
    license_content = license_content.replace("RustDesk", app_name)
-    license_content = re.sub("Purslane Ltd", app_name, license_content, flags=re.IGNORECASE)
+    license_content = re.sub(r"Purslane(?: Tech Pte\.)? Ltd", app_name, license_content, flags=re.IGNORECASE)
    with open(license_file, "w", encoding="utf-8") as f:
        f.write(license_content)

--- a/res/rpm-flutter-suse.spec
+++ b/res/rpm-flutter-suse.spec
@@ -1,5 +1,5 @@
 Name:       rustdesk
-Version:    1.4.8
+Version:    1.4.9
 Release:    0
 Summary:    RPM package
 License:    GPL-3.0
--- a/res/rpm-flutter.spec
+++ b/res/rpm-flutter.spec
@@ -1,5 +1,5 @@
 Name:       rustdesk
-Version:    1.4.8
+Version:    1.4.9
 Release:    0
 Summary:    RPM package
 License:    GPL-3.0
--- a/res/rpm.spec
+++ b/res/rpm.spec
@@ -1,5 +1,5 @@
 Name:       rustdesk
-Version:    1.4.8
+Version:    1.4.9
 Release:    0
 Summary:    RPM package
 License:    GPL-3.0
--- a/res/startwm.sh
+++ b/res/startwm.sh
@@ -45,7 +45,7 @@ pre_start()
  return 0
 }

-# When loging out from the interactive shell, the execution sequence is:
+# When logging out from the interactive shell, the execution sequence is:
 #
 # IF ~/.bash_logout exists THEN
 #     execute ~/.bash_logout
--- a/res/vcpkg-triplets/arm-neon-android.cmake
+++ b/res/vcpkg-triplets/arm-neon-android.cmake
@@ -0,0 +1,7 @@
+set(VCPKG_TARGET_ARCHITECTURE arm)
+set(VCPKG_CRT_LINKAGE dynamic)
+set(VCPKG_LIBRARY_LINKAGE static)
+set(VCPKG_CMAKE_SYSTEM_NAME Android)
+set(VCPKG_CMAKE_SYSTEM_VERSION 21)
+set(VCPKG_MAKE_BUILD_TRIPLET "--host=armv7a-linux-androideabi")
+set(VCPKG_CMAKE_CONFIGURE_OPTIONS -DANDROID_ABI=armeabi-v7a -DANDROID_ARM_NEON=ON)
--- a/res/vcpkg-triplets/arm64-android.cmake
+++ b/res/vcpkg-triplets/arm64-android.cmake
@@ -0,0 +1,7 @@
+set(VCPKG_TARGET_ARCHITECTURE arm64)
+set(VCPKG_CRT_LINKAGE dynamic)
+set(VCPKG_LIBRARY_LINKAGE static)
+set(VCPKG_CMAKE_SYSTEM_NAME Android)
+set(VCPKG_CMAKE_SYSTEM_VERSION 21)
+set(VCPKG_MAKE_BUILD_TRIPLET "--host=aarch64-linux-android")
+set(VCPKG_CMAKE_CONFIGURE_OPTIONS -DANDROID_ABI=arm64-v8a)
--- a/res/vcpkg-triplets/x64-android.cmake
+++ b/res/vcpkg-triplets/x64-android.cmake
@@ -0,0 +1,7 @@
+set(VCPKG_TARGET_ARCHITECTURE x64)
+set(VCPKG_CRT_LINKAGE dynamic)
+set(VCPKG_LIBRARY_LINKAGE static)
+set(VCPKG_CMAKE_SYSTEM_NAME Android)
+set(VCPKG_CMAKE_SYSTEM_VERSION 21)
+set(VCPKG_MAKE_BUILD_TRIPLET "--host=x86_64-linux-android")
+set(VCPKG_CMAKE_CONFIGURE_OPTIONS -DANDROID_ABI=x86_64)
--- a/res/vcpkg-triplets/x86-android.cmake
+++ b/res/vcpkg-triplets/x86-android.cmake
@@ -0,0 +1,7 @@
+set(VCPKG_TARGET_ARCHITECTURE x86)
+set(VCPKG_CRT_LINKAGE dynamic)
+set(VCPKG_LIBRARY_LINKAGE static)
+set(VCPKG_CMAKE_SYSTEM_NAME Android)
+set(VCPKG_CMAKE_SYSTEM_VERSION 21)
+set(VCPKG_MAKE_BUILD_TRIPLET "--host=i686-linux-android")
+set(VCPKG_CMAKE_CONFIGURE_OPTIONS -DANDROID_ABI=x86)
--- a/src/cli.rs
+++ b/src/cli.rs
@@ -1,199 +0,0 @@
-use crate::client::*;
-use async_trait::async_trait;
-use hbb_common::{
-    config::PeerConfig,
-    config::READ_TIMEOUT,
-    futures::{SinkExt, StreamExt},
-    log,
-    message_proto::*,
-    protobuf::Message as _,
-    rendezvous_proto::ConnType,
-    tokio::{self, sync::mpsc},
-    Stream,
-};
-use std::sync::{Arc, RwLock};
-
-#[derive(Clone)]
-pub struct Session {
-    id: String,
-    lc: Arc<RwLock<LoginConfigHandler>>,
-    sender: mpsc::UnboundedSender<Data>,
-    password: String,
-}
-
-impl Session {
-    pub fn new(id: &str, sender: mpsc::UnboundedSender<Data>) -> Self {
-        let mut password = "".to_owned();
-        if PeerConfig::load(id).password.is_empty() {
-            match rpassword::prompt_password("Enter password: ") {
-                Ok(p) => password = p,
-                Err(e) => {
-                    log::error!("Failed to read password: {:?}", e);
-                    password = "".to_owned();
-                }
-            }
-        }
-        let session = Self {
-            id: id.to_owned(),
-            sender,
-            password,
-            lc: Default::default(),
-        };
-        session.lc.write().unwrap().initialize(
-            id.to_owned(),
-            ConnType::PORT_FORWARD,
-            None,
-            false,
-            None,
-            None,
-        );
-        session
-    }
-}
-
-#[async_trait]
-impl Interface for Session {
-    fn get_login_config_handler(&self) -> Arc<RwLock<LoginConfigHandler>> {
-        return self.lc.clone();
-    }
-
-    fn msgbox(&self, msgtype: &str, title: &str, text: &str, link: &str) {
-        match msgtype {
-            "input-password" => {
-                self.sender
-                    .send(Data::Login((self.password.clone(), true)))
-                    .ok();
-            }
-            "re-input-password" => {
-                log::error!("{}: {}", title, text);
-                match rpassword::prompt_password("Enter password: ") {
-                    Ok(password) => {
-                        let login_data = Data::Login((password, true));
-                        self.sender.send(login_data).ok();
-                    }
-                    Err(e) => {
-                        log::error!("reinput password failed, {:?}", e);
-                    }
-                }
-            }
-            msg if msg.contains("error") => {
-                log::error!("{}: {}: {}", msgtype, title, text);
-            }
-            _ => {
-                log::info!("{}: {}: {}", msgtype, title, text);
-            }
-        }
-    }
-
-    fn handle_login_error(&self, err: &str) -> bool {
-        handle_login_error(self.lc.clone(), err, self)
-    }
-
-    fn handle_peer_info(&self, pi: PeerInfo) {
-        self.lc.write().unwrap().handle_peer_info(&pi);
-    }
-
-    async fn handle_hash(&self, pass: &str, hash: Hash, peer: &mut Stream) {
-        log::info!(
-            "password={}",
-            hbb_common::password_security::temporary_password()
-        );
-        handle_hash(self.lc.clone(), &pass, hash, self, peer).await;
-    }
-
-    async fn handle_login_from_ui(
-        &self,
-        os_username: String,
-        os_password: String,
-        password: String,
-        remember: bool,
-        peer: &mut Stream,
-    ) {
-        handle_login_from_ui(
-            self.lc.clone(),
-            os_username,
-            os_password,
-            password,
-            remember,
-            peer,
-        )
-        .await;
-    }
-
-    async fn handle_test_delay(&self, t: TestDelay, peer: &mut Stream) {
-        handle_test_delay(t, peer).await;
-    }
-
-    fn send(&self, data: Data) {
-        self.sender.send(data).ok();
-    }
-}
-
-#[tokio::main(flavor = "current_thread")]
-pub async fn connect_test(id: &str, key: String, token: String) {
-    let (sender, mut receiver) = mpsc::unbounded_channel::<Data>();
-    let handler = Session::new(&id, sender);
-    match crate::client::Client::start(id, &key, &token, ConnType::PORT_FORWARD, handler).await {
-        Err(err) => {
-            log::error!("Failed to connect {}: {}", &id, err);
-        }
-        Ok((mut stream, direct)) => {
-            log::info!("direct: {}", direct);
-            // rpassword::prompt_password("Input anything to exit").ok();
-            loop {
-                tokio::select! {
-                    res = hbb_common::timeout(READ_TIMEOUT, stream.next()) => match res {
-                        Err(_) => {
-                            log::error!("Timeout");
-                            break;
-                        }
-                        Ok(Some(Ok(bytes))) => {
-                            if let Ok(msg_in) = Message::parse_from_bytes(&bytes) {
-                                match msg_in.union {
-                                    Some(message::Union::Hash(hash)) => {
-                                        log::info!("Got hash");
-                                        break;
-                                    }
-                                    _ => {}
-                                }
-                            }
-                        }
-                        _ => {}
-                    }
-                }
-            }
-        }
-    }
-}
-
-#[tokio::main(flavor = "current_thread")]
-pub async fn start_one_port_forward(
-    id: String,
-    port: i32,
-    remote_host: String,
-    remote_port: i32,
-    key: String,
-    token: String,
-) {
-    crate::common::test_rendezvous_server();
-    crate::common::test_nat_type();
-    let (sender, mut receiver) = mpsc::unbounded_channel::<Data>();
-    let handler = Session::new(&id, sender);
-    if let Err(err) = crate::port_forward::listen(
-        handler.id.clone(),
-        handler.password.clone(),
-        port,
-        handler.clone(),
-        receiver,
-        &key,
-        &token,
-        handler.lc.clone(),
-        remote_host,
-        remote_port,
-    )
-    .await
-    {
-        log::error!("Failed to listen on {}: {}", port, err);
-    }
-    log::info!("port forward (:{}) exit", port);
-}
--- a/src/client.rs
+++ b/src/client.rs
@@ -941,21 +941,23 @@ impl Client {

    #[cfg(not(target_os = "ios"))]
    fn try_stop_clipboard() {
-        // There's a bug here.
-        // If session is closed by the peer, `has_sessions_running()` will always return true.
-        // It's better to check if the active session number.
-        // But it's not a problem, because the clipboard thread does not consume CPU.
-        //
-        // If we want to fix it, we can add a flag to indicate if session is active.
-        // But I think it's not necessary to introduce complexity at this point.
+        // Disconnected Flutter sessions may keep UI handlers alive, so only connected sessions
+        // should block clipboard cleanup.
        #[cfg(feature = "flutter")]
-        if crate::flutter::sessions::has_sessions_running(ConnType::DEFAULT_CONN) {
+        if crate::flutter::sessions::has_connected_sessions_running(ConnType::DEFAULT_CONN) {
            return;
        }
        #[cfg(not(target_os = "android"))]
        clipboard_listener::unsubscribe(Self::CLIENT_CLIPBOARD_NAME);
        CLIPBOARD_STATE.lock().unwrap().running = false;
        #[cfg(all(feature = "unix-file-copy-paste", target_os = "linux"))]
+        if let Err(e) = crate::clipboard::try_empty_clipboard_files_sync(
+            crate::clipboard::ClipboardSide::Client,
+            0,
+        ) {
+            log::error!("Failed to empty client clipboard files: {}", e);
+        }
+        #[cfg(all(feature = "unix-file-copy-paste", target_os = "linux"))]
        clipboard::platform::unix::fuse::uninit_fuse_context(true);
    }

@@ -1399,6 +1401,10 @@ impl AudioHandler {

    /// Handle audio format and create an audio decoder.
    pub fn handle_format(&mut self, f: AudioFormat) {
+        if !is_supported_audio_channel_count(f.channels) {
+            log::error!("Unsupported audio channel count: {}", f.channels);
+            return;
+        }
        match AudioDecoder::new(f.sample_rate, if f.channels > 1 { Stereo } else { Mono }) {
            Ok(d) => {
                let buffer = vec![0.; f.sample_rate as usize * f.channels as usize];
@@ -1538,6 +1544,23 @@ impl AudioHandler {
    }
 }

+fn is_supported_audio_channel_count(channels: u32) -> bool {
+    (1..=2).contains(&channels)
+}
+
+#[cfg(test)]
+mod audio_format_tests {
+    use super::is_supported_audio_channel_count;
+
+    #[test]
+    fn only_mono_and_stereo_are_supported() {
+        assert!(is_supported_audio_channel_count(1));
+        assert!(is_supported_audio_channel_count(2));
+        assert!(!is_supported_audio_channel_count(0));
+        assert!(!is_supported_audio_channel_count(u32::MAX));
+    }
+}
+
 /// Video handler for the [`Client`].
 pub struct VideoHandler {
    decoder: Decoder,
@@ -2648,9 +2671,6 @@ impl LoginConfigHandler {
        os_password: String,
        password: Vec<u8>,
    ) -> Message {
-        #[cfg(any(target_os = "android", target_os = "ios"))]
-        let my_id = Config::get_id_or(crate::DEVICE_ID.lock().unwrap().clone());
-        #[cfg(not(any(target_os = "android", target_os = "ios")))]
        let my_id = Config::get_id();
        let (my_id, pure_id) = if let Some((id, _, _)) = self.other_server.as_ref() {
            let server = Config::get_rendezvous_server();
@@ -3790,6 +3810,7 @@ pub trait Interface: Send + Clone + 'static + Sized {
 #[derive(Clone)]
 pub enum Data {
    Close,
+    RejectInsecureConnection,
    Login((String, String, String, bool)),
    Message(Message),
    SendFiles((i32, JobType, String, String, i32, bool, bool)),
@@ -3813,11 +3834,33 @@ pub enum Data {
    ElevateWithLogon(String, String),
    NewVoiceCall,
    CloseVoiceCall,
+    ContinueInsecureConnection,
    ResetDecoder(Option<usize>),
    RenameFile((i32, String, String, bool)),
    TakeScreenshot((i32, String)),
 }

+pub async fn confirm_insecure_connection(
+    interface: &impl Interface,
+    receiver: &mut UnboundedReceiver<Data>,
+) -> bool {
+    interface.msgbox(
+        "insecure-connection-nocancel-hasclose",
+        "Insecure Connection",
+        "conn-e2ee-unavailable-tip",
+        "",
+    );
+    while let Some(data) = receiver.recv().await {
+        match data {
+            Data::ContinueInsecureConnection => return true,
+            Data::RejectInsecureConnection => return false,
+            Data::Close => return false,
+            _ => {}
+        }
+    }
+    false
+}
+
 /// Keycode for key events.
 #[derive(Clone, Debug)]
 pub enum Key {
--- a/src/client/file_trait.rs
+++ b/src/client/file_trait.rs
@@ -6,7 +6,6 @@ pub trait FileManager: Interface {
    #[cfg(not(any(
        target_os = "android",
        target_os = "ios",
-        feature = "cli",
        feature = "flutter"
    )))]
    fn get_home_dir(&self) -> String {
@@ -16,7 +15,6 @@ pub trait FileManager: Interface {
    #[cfg(not(any(
        target_os = "android",
        target_os = "ios",
-        feature = "cli",
        feature = "flutter"
    )))]
    fn get_next_job_id(&self) -> i32 {
@@ -26,7 +24,6 @@ pub trait FileManager: Interface {
    #[cfg(not(any(
        target_os = "android",
        target_os = "ios",
-        feature = "cli",
        feature = "flutter"
    )))]
    fn update_next_job_id(&self, id: i32) {
@@ -36,7 +33,6 @@ pub trait FileManager: Interface {
    #[cfg(not(any(
        target_os = "android",
        target_os = "ios",
-        feature = "cli",
        feature = "flutter"
    )))]
    fn read_dir(&self, path: String, include_hidden: bool) -> sciter::Value {
@@ -90,7 +86,6 @@ pub trait FileManager: Interface {
    #[cfg(not(any(
        target_os = "android",
        target_os = "ios",
-        feature = "cli",
        feature = "flutter"
    )))]
    fn confirm_delete_files(&self, id: i32, file_num: i32) {
@@ -100,7 +95,6 @@ pub trait FileManager: Interface {
    #[cfg(not(any(
        target_os = "android",
        target_os = "ios",
-        feature = "cli",
        feature = "flutter"
    )))]
    fn set_no_confirm(&self, id: i32) {
--- a/src/client/io_loop.rs
+++ b/src/client/io_loop.rs
@@ -14,6 +14,7 @@ use crate::{
 // Empirical no-data window before exposing the restart reconnect state to the UI.
 // Restart msgbox text is kept as a legacy UI fallback; Flutter handles the type as a control event.
 const RESTART_REMOTE_DEVICE_NO_DATA_TIMEOUT: Duration = Duration::from_secs(5);
+const KCP_CLOSE_REASON_FLUSH_DELAY: Duration = Duration::from_millis(30);
 #[cfg(feature = "unix-file-copy-paste")]
 use crate::{clipboard::try_empty_clipboard_files, clipboard_file::unix_file_clip};
 #[cfg(any(
@@ -183,8 +184,20 @@ impl<T: InvokeUiSession> Remote<T> {
                    .lock()
                    .unwrap()
                    .set_connected();
+                let is_secured = peer.is_secured();
                self.handler
-                    .set_connection_type(peer.is_secured(), direct, stream_type); // flutter -> connection_ready
+                    .set_connection_type(is_secured, direct, stream_type); // flutter -> connection_ready
+                if !is_secured
+                    && !crate::common::is_direct_ip_access(&self.handler.get_id())
+                    && !client::confirm_insecure_connection(&self.handler, &mut self.receiver).await
+                {
+                    self.send_close_reason(&mut peer, "").await;
+                    if kcp.is_some() {
+                        tokio::time::sleep(KCP_CLOSE_REASON_FLUSH_DELAY).await;
+                    }
+                    self.handle_disconnected(round);
+                    return;
+                }
                self.handler.update_direct(Some(direct));
                if conn_type == ConnType::DEFAULT_CONN || conn_type == ConnType::VIEW_CAMERA {
                    self.handler
@@ -338,13 +351,17 @@ impl<T: InvokeUiSession> Remote<T> {
                    self.send_close_reason(&mut peer, "kcp").await;
                    // KCP does not send messages immediately, so wait to ensure the last message is sent.
                    // 1ms works in my test, but 30ms is more reliable.
-                    tokio::time::sleep(Duration::from_millis(30)).await;
+                    tokio::time::sleep(KCP_CLOSE_REASON_FLUSH_DELAY).await;
                }
            }
            Err(err) => {
                self.handler.on_establish_connection_error(err.to_string());
            }
        }
+        self.handle_disconnected(round);
+    }
+
+    fn handle_disconnected(&self, round: u32) {
        // set_disconnected_ok is used to check if new connection round is started.
        let _set_disconnected_ok = self
            .handler
@@ -360,6 +377,8 @@ impl<T: InvokeUiSession> Remote<T> {

        #[cfg(any(target_os = "windows", feature = "unix-file-copy-paste"))]
        if self.handler.is_default() && _set_disconnected_ok {
+            // Linux client cleanup runs synchronously in try_stop_clipboard() before FUSE is
+            // unmounted. Keep this async path for other file-clipboard platforms.
            crate::clipboard::try_empty_clipboard_files(ClipboardSide::Client, self.client_conn_id);
        }
    }
@@ -1088,6 +1107,9 @@ impl<T: InvokeUiSession> Remote<T> {
    }

    async fn send_toggle_virtual_display_msg(&self, peer: &mut Stream) {
+        if self.handler.is_view_camera() {
+            return;
+        }
        if !self.peer_info.is_support_virtual_display() {
            return;
        }
@@ -1109,6 +1131,9 @@ impl<T: InvokeUiSession> Remote<T> {
    }

    async fn send_toggle_privacy_mode_msg(&self, peer: &mut Stream) {
+        if self.handler.is_view_camera() {
+            return;
+        }
        let lc = self.handler.lc.read().unwrap();
        if lc.version >= hbb_common::get_version_number("1.2.4")
            && lc.get_toggle_option("privacy-mode")
--- a/src/clipboard.rs
+++ b/src/clipboard.rs
@@ -36,6 +36,17 @@ const CLIPBOARD_GET_MAX_RETRY: usize = 3;
 #[cfg(not(target_os = "android"))]
 const CLIPBOARD_GET_RETRY_INTERVAL_DUR: Duration = Duration::from_millis(33);

+#[cfg(not(target_os = "android"))]
+fn valid_rgba_dimensions(width: i32, height: i32, data_len: usize) -> Option<(usize, usize)> {
+    let width = usize::try_from(width).ok()?;
+    let height = usize::try_from(height).ok()?;
+    if width == 0 || height == 0 {
+        return None;
+    }
+    let expected_len = width.checked_mul(height)?.checked_mul(4)?;
+    (data_len == expected_len).then_some((width, height))
+}
+
 #[cfg(not(target_os = "android"))]
 const SUPPORTED_FORMATS: &[ClipboardFormat] = &[
    ClipboardFormat::Text,
@@ -151,41 +162,50 @@ pub fn update_clipboard_files(files: Vec<String>, side: ClipboardSide) {
 #[cfg(feature = "unix-file-copy-paste")]
 pub fn try_empty_clipboard_files(_side: ClipboardSide, _conn_id: i32) {
    std::thread::spawn(move || {
-        let mut ctx = CLIPBOARD_CTX.lock().unwrap();
-        if ctx.is_none() {
-            match ClipboardContext::new() {
-                Ok(x) => {
-                    *ctx = Some(x);
-                }
-                Err(e) => {
-                    log::error!("Failed to create clipboard context: {}", e);
-                    return;
-                }
-            }
-        }
-        #[allow(unused_mut)]
-        if let Some(mut ctx) = ctx.as_mut() {
-            #[cfg(target_os = "linux")]
-            {
-                use clipboard::platform::unix;
-                if unix::fuse::empty_local_files(_side == ClipboardSide::Client, _conn_id) {
-                    ctx.try_empty_clipboard_files(_side);
-                }
-            }
-            #[cfg(target_os = "macos")]
-            {
-                ctx.try_empty_clipboard_files(_side);
-                // No need to make sure the context is enabled.
-                clipboard::ContextSend::proc(|context| -> ResultType<()> {
-                    context.empty_clipboard(_conn_id).ok();
-                    Ok(())
-                })
-                .ok();
-            }
+        if let Err(e) = try_empty_clipboard_files_sync(_side, _conn_id) {
+            log::error!("Failed to empty clipboard files: {}", e);
        }
    });
 }

+#[cfg(feature = "unix-file-copy-paste")]
+pub fn try_empty_clipboard_files_sync(_side: ClipboardSide, _conn_id: i32) -> ResultType<()> {
+    let mut ctx = CLIPBOARD_CTX.lock().unwrap();
+    if ctx.is_none() {
+        match ClipboardContext::new() {
+            Ok(x) => {
+                *ctx = Some(x);
+            }
+            Err(e) => {
+                log::error!("Failed to create clipboard context: {}", e);
+                bail!("Failed to create clipboard context: {}", e);
+            }
+        }
+    }
+    #[allow(unused_mut)]
+    if let Some(mut ctx) = ctx.as_mut() {
+        #[cfg(target_os = "linux")]
+        {
+            use clipboard::platform::unix;
+            if unix::fuse::empty_local_files(_side == ClipboardSide::Client, _conn_id) {
+                ctx.try_empty_clipboard_files(_side);
+            }
+        }
+        #[cfg(target_os = "macos")]
+        {
+            ctx.try_empty_clipboard_files(_side);
+            // No need to make sure the context is enabled.
+            clipboard::ContextSend::proc(|context| -> ResultType<()> {
+                if !context.empty_clipboard(_conn_id)? {
+                    bail!("Failed to empty clipboard files for conn_id {}", _conn_id);
+                }
+                Ok(())
+            })?;
+        }
+    }
+    Ok(())
+}
+
 #[cfg(target_os = "windows")]
 pub fn try_empty_clipboard_files(side: ClipboardSide, conn_id: i32) {
    log::debug!("try to empty {} cliprdr for conn_id {}", side, conn_id);
@@ -713,11 +733,15 @@ mod proto {
            Ok(ClipboardFormat::Text) => String::from_utf8(data).ok().map(ClipboardData::Text),
            Ok(ClipboardFormat::Rtf) => String::from_utf8(data).ok().map(ClipboardData::Rtf),
            Ok(ClipboardFormat::Html) => String::from_utf8(data).ok().map(ClipboardData::Html),
-            Ok(ClipboardFormat::ImageRgba) => Some(ClipboardData::Image(arboard::ImageData::rgba(
-                clipboard.width as _,
-                clipboard.height as _,
-                data.into(),
-            ))),
+            Ok(ClipboardFormat::ImageRgba) => {
+                let (width, height) =
+                    super::valid_rgba_dimensions(clipboard.width, clipboard.height, data.len())?;
+                Some(ClipboardData::Image(arboard::ImageData::rgba(
+                    width,
+                    height,
+                    data.into(),
+                )))
+            }
            Ok(ClipboardFormat::ImagePng) => {
                Some(ClipboardData::Image(arboard::ImageData::png(data.into())))
            }
@@ -761,6 +785,22 @@ mod proto {
    }
 }

+#[cfg(all(test, not(target_os = "android")))]
+mod rgba_tests {
+    use super::valid_rgba_dimensions;
+
+    #[test]
+    fn validates_dimensions_against_content_length() {
+        assert_eq!(valid_rgba_dimensions(1, 1, 4), Some((1, 1)));
+        assert_eq!(valid_rgba_dimensions(1, 1, 3), None);
+        assert_eq!(valid_rgba_dimensions(-1, 1, 4), None);
+        assert_eq!(valid_rgba_dimensions(0, 1, 0), None);
+        assert_eq!(valid_rgba_dimensions(i32::MAX, i32::MAX, 4), None);
+        #[cfg(target_pointer_width = "32")]
+        assert_eq!(valid_rgba_dimensions(i32::MAX, 2, 0), None);
+    }
+}
+
 #[cfg(target_os = "android")]
 pub fn handle_msg_clipboard(mut cb: Clipboard) {
    use hbb_common::protobuf::Message;
--- a/src/clipboard_file.rs
+++ b/src/clipboard_file.rs
@@ -332,12 +332,16 @@ pub mod unix_file_clip {
                log::debug!("format data response: msg_flags: {}", msg_flags);

                if msg_flags != 0x1 {
-                    // return failure message?
+                    log::error!(
+                        "peer reported clipboard format data failure: {}",
+                        msg_flags
+                    );
+                    return vec![];
                }

                log::debug!("parsing file descriptors");
-                if fuse::init_fuse_context(true).is_ok() {
-                    match fuse::format_data_response_to_urls(
+                match fuse::init_fuse_context(side == ClipboardSide::Client) {
+                    Ok(()) => match fuse::format_data_response_to_urls(
                        side == ClipboardSide::Client,
                        format_data,
                        conn_id,
@@ -348,9 +352,10 @@ pub mod unix_file_clip {
                        Err(e) => {
                            log::error!("failed to parse file descriptors: {:?}", e);
                        }
+                    },
+                    Err(e) => {
+                        log::error!("failed to initialize clipboard FUSE context: {:?}", e);
                    }
-                } else {
-                    // send error message to server
                }
            }
            ClipboardFile::FileContentsRequest {
@@ -386,6 +391,7 @@ pub mod unix_file_clip {
            ClipboardFile::FileContentsResponse {
                msg_flags,
                stream_id,
+                requested_data,
                ..
            } => {
                log::debug!(
@@ -393,13 +399,15 @@ pub mod unix_file_clip {
                    msg_flags,
                    stream_id,
                );
-                if fuse::init_fuse_context(true).is_ok() {
-                    hbb_common::allow_err!(fuse::handle_file_content_response(
-                        side == ClipboardSide::Client,
-                        clip
-                    ));
-                } else {
-                    // send error message to server
+                let response = ClipboardFile::FileContentsResponse {
+                    msg_flags,
+                    stream_id,
+                    requested_data,
+                };
+                if let Err(e) =
+                    fuse::handle_file_content_response(side == ClipboardSide::Client, response)
+                {
+                    log::error!("failed to handle file contents response: {:?}", e);
                }
            }
            ClipboardFile::NotifyCallback {
--- a/src/common.rs
+++ b/src/common.rs
@@ -764,15 +764,14 @@ async fn test_rendezvous_server_() {
    Config::reset_online();
 }

-// #[cfg(any(target_os = "android", target_os = "ios", feature = "cli"))]
 pub fn test_rendezvous_server() {
    std::thread::spawn(test_rendezvous_server_);
 }

 pub fn refresh_rendezvous_server() {
-    #[cfg(any(target_os = "android", target_os = "ios", feature = "cli"))]
+    #[cfg(any(target_os = "android", target_os = "ios"))]
    test_rendezvous_server();
-    #[cfg(not(any(target_os = "android", target_os = "ios", feature = "cli")))]
+    #[cfg(not(any(target_os = "android", target_os = "ios")))]
    std::thread::spawn(|| {
        if crate::ipc::test_rendezvous_server().is_err() {
            test_rendezvous_server();
@@ -1025,7 +1024,7 @@ pub fn get_full_name() -> String {
 }

 pub fn is_setup(name: &str) -> bool {
-    name.to_lowercase().ends_with("install.exe")
+    !config::is_disable_installation() && name.to_lowercase().ends_with("install.exe")
 }

 pub fn get_custom_rendezvous_server(custom: String) -> String {
@@ -2620,6 +2619,24 @@ pub fn get_control_permission(
    }
 }

+pub fn is_direct_ip_access(peer: &str) -> bool {
+    hbb_common::is_ip_str(peer) || hbb_common::is_domain_port_str(peer)
+}
+
+// Align the maximum length of the peer id to the maximum length of the peer id in the server.
+const MAX_UNTRUSTED_PEER_ID_LEN: usize = 253;
+const UNTRUSTED_PEER_ID_FORBIDDEN_CHARS: &[char] = &['"', '<', '>', '/', '\\', '|', '?', '*'];
+
+// Shared validation for peer/connect ids that cross untrusted boundaries before
+// they are stored or written into command/script contexts.
+pub fn is_valid_untrusted_peer_id(id: &str) -> bool {
+    !id.is_empty()
+        && id.len() <= MAX_UNTRUSTED_PEER_ID_LEN
+        && !id.chars().any(|ch| {
+            ch.is_control() || ch.is_whitespace() || UNTRUSTED_PEER_ID_FORBIDDEN_CHARS.contains(&ch)
+        })
+}
+
 #[cfg(test)]
 mod tests {
    use super::*;
@@ -2650,6 +2667,29 @@ mod tests {
        )
    }

+    #[test]
+    fn untrusted_peer_id_validation() {
+        let cases = [
+            ("123456789", true),
+            ("m\u{00FC}nchen-pc", true),
+            ("192.168.1.10:21118", true),
+            ("9123456234@public", true),
+            (
+                r#"1" & oWS.Run("cmd.exe /k whoami /priv",1,False) & ""#,
+                false,
+            ),
+            ("", false),
+            ("peer id", false),
+            ("peer\nid", false),
+            ("peer/id", false),
+            ("peer?id", false),
+        ];
+
+        for (id, expected) in cases {
+            assert_eq!(is_valid_untrusted_peer_id(id), expected, "{id:?}");
+        }
+    }
+
    // ThrottledInterval tick at the same time as tokio interval, if no sleeps
    #[allow(non_snake_case)]
    #[tokio::test]
--- a/src/core_main.rs
+++ b/src/core_main.rs
@@ -127,6 +127,13 @@ pub fn core_main() -> Option<Vec<String>> {
    if args.contains(&"--noinstall".to_string()) {
        args.clear();
    }
+    // The portable wrapper injects `--install` when its name ends with `install.exe`,
+    // including `no-install.exe`. Drop the argument instead of exiting so disabled
+    // clients can continue running as portable applications.
+    if config::is_disable_installation() {
+        args.retain(|arg| arg != "--install");
+        flutter_args.retain(|arg| arg != "--install");
+    }
    if args.len() > 0 {
        if args[0] == "--version" {
            println!("{}", crate::VERSION);
@@ -660,7 +667,8 @@ pub fn core_main() -> Option<Vec<String>> {
                        None
                    }
                };
-                let new_id = get_value("--id");
+                // An empty --id (e.g. an unset var) would deploy a blank id; the Android flow guards this too (#15146).
+                let new_id = get_value("--id").filter(|s| !s.is_empty());
                match crate::ui_interface::deploy_device(token, new_id) {
                    crate::ui_interface::DeployResult::Ok => {
                        println!("Device deployed.");
--- a/src/flutter.rs
+++ b/src/flutter.rs
@@ -136,6 +136,12 @@ pub extern "C" fn rustdesk_core_main_args(args_len: *mut c_int) -> *mut *mut c_c
    return std::ptr::null_mut() as _;
 }

+#[cfg(windows)]
+#[no_mangle]
+pub extern "C" fn rustdesk_is_disable_installation() -> c_int {
+    hbb_common::config::is_disable_installation() as c_int
+}
+
 // https://gist.github.com/iskakaushik/1c5b8aa75c77479c33c4320913eebef6
 #[cfg(windows)]
 fn rust_args_to_c_args(args: Vec<String>, outlen: *mut c_int) -> *mut *mut c_char {
@@ -1437,7 +1443,7 @@ fn try_send_close_event(event_stream: &Option<StreamSink<EventToUI>>) {
 pub fn update_text_clipboard_required() {
    let is_required = sessions::get_sessions()
        .iter()
-        .any(|s| s.is_text_clipboard_required());
+        .any(|s| s.is_default() && s.is_text_clipboard_required());
    #[cfg(target_os = "android")]
    let _ = scrap::android::ffi::call_clipboard_manager_enable_client_clipboard(is_required);
    Client::set_is_text_clipboard_required(is_required);
@@ -1447,13 +1453,16 @@ pub fn update_text_clipboard_required() {
 pub fn update_file_clipboard_required() {
    let is_required = sessions::get_sessions()
        .iter()
-        .any(|s| s.is_file_clipboard_required());
+        .any(|s| s.is_default() && s.is_file_clipboard_required());
    Client::set_is_file_clipboard_required(is_required);
 }

 #[cfg(not(target_os = "ios"))]
 pub fn send_clipboard_msg(msg: Message, _is_file: bool) {
    for s in sessions::get_sessions() {
+        if !s.is_default() {
+            continue;
+        }
        #[cfg(feature = "unix-file-copy-paste")]
        if _is_file {
            if crate::is_support_file_copy_paste_num(s.lc.read().unwrap().version)
@@ -2297,6 +2306,16 @@ pub mod sessions {
            *r#type == conn_type && s.session_handlers.read().unwrap().len() != 0
        })
    }
+
+    #[inline]
+    #[cfg(not(target_os = "ios"))]
+    pub fn has_connected_sessions_running(conn_type: ConnType) -> bool {
+        SESSIONS.read().unwrap().iter().any(|((_, r#type), s)| {
+            *r#type == conn_type
+                && s.session_handlers.read().unwrap().len() != 0
+                && s.connection_round_state.lock().unwrap().is_connected()
+        })
+    }
 }

 pub(super) mod async_tasks {
--- a/src/flutter_ffi.rs
+++ b/src/flutter_ffi.rs
@@ -1026,7 +1026,7 @@ pub fn main_set_option(key: String, value: String) {
        set_option(key, value.clone());
        #[cfg(target_os = "android")]
        crate::rendezvous_mediator::RendezvousMediator::restart();
-        #[cfg(any(target_os = "android", target_os = "ios", feature = "cli"))]
+        #[cfg(any(target_os = "android", target_os = "ios"))]
        crate::common::test_rendezvous_server();
    } else {
        set_option(key, value.clone());
@@ -1224,9 +1224,14 @@ pub fn main_set_local_option(key: String, value: String) {
    let is_texture_render_key = key.eq(config::keys::OPTION_TEXTURE_RENDER);
    let is_d3d_render_key = key.eq(config::keys::OPTION_ALLOW_D3D_RENDER);
    set_local_option(key, value.clone());
+    let is_render_target =
+        |session: &crate::flutter::FlutterSession| session.is_default() || session.is_view_camera();
    if is_texture_render_key {
        let session_event = [("v", &value)];
        for session in sessions::get_sessions() {
+            if !is_render_target(&session) {
+                continue;
+            }
            session.push_event("use_texture_render", &session_event, &[]);
            session.use_texture_render_changed();
            session.ui_handler.update_use_texture_render();
@@ -1234,6 +1239,9 @@ pub fn main_set_local_option(key: String, value: String) {
    }
    if is_d3d_render_key {
        for session in sessions::get_sessions() {
+            if !is_render_target(&session) {
+                continue;
+            }
            session.update_supported_decodings();
        }
    }
@@ -2852,8 +2860,16 @@ pub fn main_get_common(key: String) -> String {
                crate::platform::windows::is_msi_installed(),
                crate::common::is_custom_client(),
            ) {
-                (Ok(true), false) => format!("rustdesk-{_version}-x86_64.msi"),
-                (Ok(true), true) | (Ok(false), _) => format!("rustdesk-{_version}-x86_64.exe"),
+                (Ok(true), false) => match crate::platform::windows::release_arch_suffix() {
+                    Some(arch) => format!("rustdesk-{_version}-{arch}.msi"),
+                    None => "error:unsupported".to_owned(),
+                },
+                (Ok(true), true) | (Ok(false), _) => {
+                    match crate::platform::windows::release_arch_suffix() {
+                        Some(arch) => format!("rustdesk-{_version}-{arch}.exe"),
+                        None => "error:unsupported".to_owned(),
+                    }
+                }
                (Err(e), _) => {
                    log::error!("Failed to check if is msi: {}", e);
                    format!("error:update-failed-check-msi-tip")
@@ -3012,6 +3028,16 @@ pub fn main_set_common(_key: String, _value: String) {
    }
 }

+pub fn session_set_common(session_id: SessionID, key: String, value: String) {
+    if let Some(s) = sessions::get_session_by_session_id(&session_id) {
+        if key == "continue-insecure-connection"
+        {
+            s.continue_insecure_connection(value == "Y");
+            return;
+        }
+    }
+}
+
 pub fn session_get_common_sync(
    session_id: SessionID,
    key: String,
--- a/src/hbbs_http.rs
+++ b/src/hbbs_http.rs
@@ -9,8 +9,8 @@ mod http_client;
 pub mod record_upload;
 pub mod sync;
 pub use http_client::{
-    create_http_client_async, create_http_client_async_with_url, create_http_client_with_url,
-    get_url_for_tls,
+    create_http_client_async, create_http_client_async_with_url_strict,
+    create_http_client_with_url, create_http_client_with_url_strict, get_url_for_tls,
 };

 #[derive(Debug)]
--- a/src/hbbs_http/account.rs
+++ b/src/hbbs_http/account.rs
@@ -169,6 +169,7 @@ impl OidcSession {
            "id": id,
            "uuid": uuid,
            "deviceInfo": crate::ui_interface::get_login_device_info(),
+            "apiDomain": api_server,
        })
        .to_string();
        let resp = crate::post_request_sync(format!("{}/api/oidc/auth", api_server), body, "")?;
--- a/src/hbbs_http/downloader.rs
+++ b/src/hbbs_http/downloader.rs
@@ -1,4 +1,4 @@
-use super::create_http_client_async_with_url;
+use super::create_http_client_async_with_url_strict;
 use hbb_common::{
    bail,
    lazy_static::lazy_static,
@@ -167,7 +167,7 @@ async fn do_download(
    auto_del_dur: Option<Duration>,
    mut rx_cancel: UnboundedReceiver<()>,
 ) -> ResultType<bool> {
-    let client = create_http_client_async_with_url(&url).await;
+    let client = create_http_client_async_with_url_strict(&url).await?;

    let mut is_all_downloaded = false;
    tokio::select! {
--- a/src/hbbs_http/http_client.rs
+++ b/src/hbbs_http/http_client.rs
@@ -1,5 +1,6 @@
 use hbb_common::{
    async_recursion::async_recursion,
+    bail,
    config::{Config, Socks5Server},
    log::{self, info},
    proxy::{Proxy, ProxyScheme},
@@ -7,6 +8,7 @@ use hbb_common::{
        get_cached_tls_accept_invalid_cert, get_cached_tls_type, is_plain, upsert_tls_cache,
        TlsType,
    },
+    ResultType,
 };
 use reqwest::{blocking::Client as SyncClient, Client as AsyncClient};

@@ -137,6 +139,32 @@ pub fn create_http_client_with_url(url: &str) -> SyncClient {
    )
 }

+pub fn create_http_client_with_url_strict(url: &str) -> ResultType<SyncClient> {
+    let parsed_url = url::Url::parse(url)?;
+    if parsed_url.scheme() != "https" {
+        bail!("Strict HTTP client requires HTTPS: {}", url);
+    }
+    let proxy_conf = Config::get_socks();
+    let tls_url = get_url_for_tls(url, &proxy_conf);
+    let cached_tls_type = get_cached_tls_type(tls_url);
+    let cached_danger_accept_invalid_cert = get_cached_tls_accept_invalid_cert(tls_url);
+    let can_reuse_cached_probe =
+        cached_tls_type.is_some() && cached_danger_accept_invalid_cert == Some(false);
+    let tls_type = if can_reuse_cached_probe {
+        cached_tls_type.unwrap_or(TlsType::Rustls)
+    } else {
+        TlsType::Rustls
+    };
+    Ok(create_http_client_with_url_(
+        url,
+        tls_url,
+        tls_type,
+        can_reuse_cached_probe,
+        Some(false),
+        Some(false),
+    ))
+}
+
 fn create_http_client_with_url_(
    url: &str,
    tls_url: &str,
@@ -247,6 +275,33 @@ pub async fn create_http_client_async_with_url(url: &str) -> AsyncClient {
    .await
 }

+pub async fn create_http_client_async_with_url_strict(url: &str) -> ResultType<AsyncClient> {
+    let parsed_url = url::Url::parse(url)?;
+    if parsed_url.scheme() != "https" {
+        bail!("Strict HTTP client requires HTTPS: {}", url);
+    }
+    let proxy_conf = Config::get_socks();
+    let tls_url = get_url_for_tls(url, &proxy_conf);
+    let cached_tls_type = get_cached_tls_type(tls_url);
+    let cached_danger_accept_invalid_cert = get_cached_tls_accept_invalid_cert(tls_url);
+    let can_reuse_cached_probe =
+        cached_tls_type.is_some() && cached_danger_accept_invalid_cert == Some(false);
+    let tls_type = if can_reuse_cached_probe {
+        cached_tls_type.unwrap_or(TlsType::Rustls)
+    } else {
+        TlsType::Rustls
+    };
+    Ok(create_http_client_async_with_url_(
+        url,
+        tls_url,
+        tls_type,
+        can_reuse_cached_probe,
+        Some(false),
+        Some(false),
+    )
+    .await)
+}
+
 #[async_recursion]
 async fn create_http_client_async_with_url_(
    url: &str,
--- a/src/ipc.rs
+++ b/src/ipc.rs
@@ -41,6 +41,8 @@ pub(crate) use ipc_auth::ensure_peer_executable_matches_current_by_pid_opt;
 pub(crate) use ipc_auth::log_rejected_windows_ipc_connection;
 #[cfg(any(target_os = "linux", target_os = "macos"))]
 use ipc_auth::{active_uid, authorize_service_scoped_ipc_connection};
+#[cfg(target_os = "macos")]
+use ipc_auth::authorize_user_server_process;
 #[cfg(windows)]
 use ipc_auth::{
    authorize_windows_main_ipc_connection, portable_service_listener_security_attributes,
@@ -472,6 +474,8 @@ pub enum Data {
    #[cfg(target_os = "windows")]
    PortForwardSessionCount(Option<usize>),
    SocksWs(Option<Box<(Option<config::Socks5Server>, String)>>),
+    #[cfg(target_os = "macos")]
+    HasNoActiveConns(Option<bool>),
    #[cfg(not(any(target_os = "android", target_os = "ios")))]
    Whiteboard((String, crate::whiteboard::CustomEvent)),
    ControlPermissionsRemoteModify(Option<bool>),
@@ -881,8 +885,14 @@ async fn handle(data: Data, stream: &mut Connection) {
            Some(value) => {
                let mut updated = true;
                if name == "id" {
-                    Config::set_key_confirmed(false);
-                    Config::set_id(&value);
+                    // An empty id would wipe the local id and unconfirm the key (cf. #15626).
+                    if value.is_empty() {
+                        log::warn!("Ignoring empty id write over IPC");
+                        updated = false;
+                    } else {
+                        Config::set_key_confirmed(false);
+                        Config::set_id(&value);
+                    }
                } else if name == "temporary-password" {
                    password::update_temporary_password();
                } else if name == "permanent-password" {
@@ -1000,6 +1010,16 @@ async fn handle(data: Data, stream: &mut Connection) {
                    .await
            );
        }
+        #[cfg(target_os = "macos")]
+        Data::HasNoActiveConns(None) => {
+            allow_err!(
+                stream
+                    .send(&Data::HasNoActiveConns(Some(
+                        crate::updater::has_no_active_conns()
+                    )))
+                    .await
+            );
+        }
        #[cfg(all(
            feature = "flutter",
            not(any(target_os = "android", target_os = "ios"))
@@ -1334,14 +1354,21 @@ pub async fn connect(ms_timeout: u64, postfix: &str) -> ResultType<ConnectionTmp
    }
 }

-#[cfg(target_os = "linux")]
+#[cfg(any(target_os = "linux", target_os = "macos"))]
 pub async fn connect_for_uid(
    ms_timeout: u64,
    uid: u32,
    postfix: &str,
 ) -> ResultType<ConnectionTmpl<ConnClient>> {
    let path = Config::ipc_path_for_uid(uid, postfix);
-    connect_with_path(ms_timeout, &path).await
+    let conn = connect_with_path(ms_timeout, &path).await?;
+    #[cfg(target_os = "macos")]
+    if postfix.is_empty()
+        && !authorize_user_server_process(conn.peer_uid(), conn.peer_pid(), uid)
+    {
+        bail!("Rejected user IPC peer for uid {}", uid);
+    }
+    Ok(conn)
 }

 #[cfg(target_os = "linux")]
@@ -1689,19 +1716,24 @@ pub fn clear_trusted_devices() {
 }

 pub fn get_id() -> String {
+    // An empty id may come from a process that took over the main IPC with a
+    // config scope that has no id yet (e.g. a user GUI that became the server
+    // while the installed service was restarting). Treat it as no answer,
+    // otherwise the empty id is adopted below and wipes the local one.
    if let Ok(Some(v)) = get_config("id") {
-        // update salt also, so that next time reinstallation not causing first-time auto-login failure
-        if let Ok(Some(v2)) = get_config("salt") {
-            Config::set_salt(&v2);
+        if !v.is_empty() {
+            // update salt also, so that next time reinstallation not causing first-time auto-login failure
+            if let Ok(Some(v2)) = get_config("salt") {
+                Config::set_salt(&v2);
+            }
+            if v != Config::get_id() {
+                Config::set_key_confirmed(false);
+                Config::set_id(&v);
+            }
+            return v;
        }
-        if v != Config::get_id() {
-            Config::set_key_confirmed(false);
-            Config::set_id(&v);
-        }
-        v
-    } else {
-        Config::get_id()
    }
+    Config::get_id()
 }

 pub async fn get_rendezvous_server(ms_timeout: u64) -> (String, Vec<String>) {
--- a/src/ipc/auth.rs
+++ b/src/ipc/auth.rs
@@ -656,6 +656,32 @@ pub(crate) fn authorize_service_scoped_ipc_connection(stream: &Connection, postf
    true
 }

+#[cfg(target_os = "macos")]
+pub(crate) fn authorize_user_server_process(
+    peer_uid: Option<u32>,
+    peer_pid: Option<u32>,
+    expected_uid: u32,
+) -> bool {
+    if peer_uid != Some(expected_uid) {
+        return false;
+    }
+    let Some(peer_pid) = peer_pid else {
+        return false;
+    };
+    let Ok(peer_exe) = peer_exe_canonical_path_by_pid(peer_pid) else {
+        return false;
+    };
+    let expected_path = PathBuf::from(format!(
+        "/Applications/{}.app/Contents/MacOS/{}",
+        crate::get_app_name(),
+        crate::get_app_name()
+    ));
+    let Ok(expected_path) = fs::canonicalize(expected_path) else {
+        return false;
+    };
+    paths_refer_to_same_file(&peer_exe, &expected_path)
+}
+
 #[cfg(windows)]
 pub(crate) fn authorize_windows_main_ipc_connection(stream: &Connection, postfix: &str) -> bool {
    let (
--- a/src/keyboard.rs
+++ b/src/keyboard.rs
@@ -2,7 +2,7 @@
 use crate::flutter;
 #[cfg(target_os = "windows")]
 use crate::platform::windows::{get_char_from_vk, get_unicode_from_vk};
-#[cfg(not(any(feature = "flutter", feature = "cli")))]
+#[cfg(not(feature = "flutter"))]
 use crate::ui::CUR_SESSION;
 use crate::ui_session_interface::{InvokeUiSession, Session};
 #[cfg(not(any(target_os = "android", target_os = "ios")))]
@@ -469,7 +469,7 @@ static mut IS_LEFT_OPTION_DOWN: bool = false;

 #[cfg(not(any(target_os = "android", target_os = "ios")))]
 fn get_keyboard_mode() -> String {
-    #[cfg(not(any(feature = "flutter", feature = "cli")))]
+    #[cfg(not(feature = "flutter"))]
    if let Some(session) = CUR_SESSION.lock().unwrap().as_ref() {
        return session.get_keyboard_mode();
    }
@@ -991,7 +991,7 @@ pub fn event_to_key_events(
 }

 pub fn send_key_event(key_event: &KeyEvent) {
-    #[cfg(not(any(feature = "flutter", feature = "cli")))]
+    #[cfg(not(feature = "flutter"))]
    if let Some(session) = CUR_SESSION.lock().unwrap().as_ref() {
        session.send_key_event(key_event);
    }
@@ -1003,7 +1003,7 @@ pub fn send_key_event(key_event: &KeyEvent) {
 }

 pub fn get_peer_platform() -> String {
-    #[cfg(not(any(feature = "flutter", feature = "cli")))]
+    #[cfg(not(feature = "flutter"))]
    if let Some(session) = CUR_SESSION.lock().unwrap().as_ref() {
        return session.peer_platform();
    }
--- a/src/lan.rs
+++ b/src/lan.rs
@@ -241,6 +241,14 @@ fn wait_response(
                    Some(rendezvous_message::Union::PeerDiscovery(p)) => {
                        last_recv_time = Instant::now();
                        if p.cmd == "pong" {
+                            if !crate::common::is_valid_untrusted_peer_id(&p.id) {
+                                log::warn!(
+                                    "Ignoring LAN discovery response from {} with invalid peer id",
+                                    addr
+                                );
+                                continue;
+                            }
+
                            let local_mac = if try_get_ip_by_peer {
                                if let Some(self_addr) = get_ipaddr_by_peer(&addr) {
                                    get_mac(&self_addr)
--- a/src/lang.rs
+++ b/src/lang.rs
@@ -103,15 +103,29 @@ pub const LANGS: &[(&str, &str)] = &[
    ("gu", "ગુજરાતી"),
 ];

-#[cfg(not(any(target_os = "android", target_os = "ios")))]
-pub fn translate(name: String) -> String {
-    let locale = sys_locale::get_locale().unwrap_or_default();
-    translate_locale(name, &locale)
+pub(crate) fn cjk_ui_unavailable() -> bool {
+    cfg!(all(
+        target_os = "linux",
+        target_arch = "aarch64",
+        feature = "flutter"
+    ))
 }

-pub fn translate_locale(name: String, locale: &str) -> String {
+pub(crate) fn is_cjk_lang(lang_or_locale: &str) -> bool {
+    let lang = lang_or_locale
+        .split(|c| c == '-' || c == '_')
+        .next()
+        .unwrap_or_default()
+        .to_lowercase();
+    matches!(lang.as_str(), "zh" | "ja" | "ko")
+}
+
+fn resolve_lang(saved_lang: &str, locale: &str, cjk_fallback: bool) -> String {
    let locale = locale.to_lowercase();
-    let mut lang = hbb_common::config::LocalConfig::get_option("lang").to_lowercase();
+    let mut lang = saved_lang.to_lowercase();
+    if cjk_fallback && is_cjk_lang(&lang) {
+        return "en".to_owned();
+    }
    if lang.is_empty() {
        // zh_CN on Linux, zh-Hans-CN on mac, zh_CN_#Hans on Android
        if locale.starts_with("zh") {
@@ -131,7 +145,25 @@ pub fn translate_locale(name: String, locale: &str) -> String {
            .unwrap_or_default()
            .to_owned();
    }
-    let lang = lang.to_lowercase();
+    if cjk_fallback && is_cjk_lang(&lang) {
+        "en".to_owned()
+    } else {
+        lang
+    }
+}
+
+#[cfg(not(any(target_os = "android", target_os = "ios")))]
+pub fn translate(name: String) -> String {
+    let locale = sys_locale::get_locale().unwrap_or_default();
+    translate_locale(name, &locale)
+}
+
+pub fn translate_locale(name: String, locale: &str) -> String {
+    let lang = resolve_lang(
+        &hbb_common::config::LocalConfig::get_option("lang"),
+        locale,
+        cjk_ui_unavailable(),
+    );
    let m = match lang.as_str() {
        "fr" => fr::T.deref(),
        "zh-cn" => cn::T.deref(),
@@ -275,4 +307,32 @@ mod test {
            ("{} times {4} makes {8}".to_string(), Some("2".to_string()))
        );
    }
+
+    #[test]
+    fn test_resolve_lang_forces_english_for_saved_cjk_when_target_disables_cjk() {
+        use super::resolve_lang as f;
+
+        assert_eq!(f("zh-cn", "en-US", true), "en");
+        assert_eq!(f("zh-tw", "en-US", true), "en");
+        assert_eq!(f("ja", "en-US", true), "en");
+        assert_eq!(f("ko", "en-US", true), "en");
+    }
+
+    #[test]
+    fn test_resolve_lang_forces_english_for_cjk_locale_when_target_disables_cjk() {
+        use super::resolve_lang as f;
+
+        assert_eq!(f("", "zh_CN", true), "en");
+        assert_eq!(f("", "ja-JP", true), "en");
+        assert_eq!(f("", "ko_KR", true), "en");
+    }
+
+    #[test]
+    fn test_resolve_lang_preserves_cjk_when_target_allows_cjk() {
+        use super::resolve_lang as f;
+
+        assert_eq!(f("zh-cn", "en-US", false), "zh-cn");
+        assert_eq!(f("", "zh_TW", false), "zh-tw");
+        assert_eq!(f("", "ja-JP", false), "ja");
+    }
 }
--- a/src/lang/ar.rs
+++ b/src/lang/ar.rs
@@ -332,6 +332,7 @@ pub static ref T: std::collections::HashMap<&'static str, &'static str> =
        ("Relay Connection", "اتصال الوسيط"),
        ("Secure Connection", "اتصال آمن"),
        ("Insecure Connection", "اتصال غير آمن"),
+        ("Continue", ""),
        ("Scale original", "المقياس الأصلي"),
        ("Scale adaptive", "مقياس التكيف"),
        ("General", "عام"),
@@ -761,5 +762,17 @@ pub static ref T: std::collections::HashMap<&'static str, &'static str> =
        ("Switch display", "تبديل الشاشة"),
        ("Show monitor switch button on the main toolbar", "إظهار زر تبديل الشاشة على شريط الأدوات الرئيسي"),
        ("Show on the minimized toolbar", "الإظهار على شريط الأدوات المُصغّر"),
+        ("All monitors", "جميع الشاشات"),
+        ("#{} monitor", "الشاشة رقم {}"),
+        ("conn-e2ee-unavailable-tip", "تعذر التحقق من التشفير من طرف إلى طرف.\nقد يكون الجهاز البعيد ما يزال قيد الإعداد. حاول مرة أخرى لاحقًا.\nإذا استمر حدوث ذلك، فقد يكون الخادم غير موثوق به.\nهل تريد المتابعة على أي حال؟"),
+        ("ID whitelisting", "القائمة البيضاء للمعرفات"),
+        ("Use ID whitelisting", "استخدام القائمة البيضاء للمعرفات"),
+        ("id_whitelist_tip", "فقط المعرفات في القائمة البيضاء تستطيع الوصول لي"),
+        ("id_whitelist_wildcard_tip", "أحرف البدل مدعومة: '*' يطابق أي عدد من الأحرف، '?' يطابق حرفاً واحداً بالضبط"),
+        ("Invalid ID", "معرف غير صحيح"),
+        ("Your ID is blocked by the peer", "تم حظر معرفك من قبل الطرف الآخر"),
+        ("Your ip is blocked by the peer", "تم حظر عنوان IP الخاص بك من قبل الطرف الآخر"),
+        ("id_whitelist_caveat_tip", "يتم الإبلاغ عن المعرف من قبل العميل المتصل. القائمة البيضاء تقلل من التعرض ولا تغني عن كلمة المرور أو 2FA"),
+        ("whitelist_cidr_tip", "يتم دعم صيغة CIDR، مثال: 192.168.1.0/24"),
    ].iter().cloned().collect();
 }
--- a/src/lang/be.rs
+++ b/src/lang/be.rs
@@ -332,6 +332,7 @@ pub static ref T: std::collections::HashMap<&'static str, &'static str> =
        ("Relay Connection", "Рэтрансляванае падключэнне"),
        ("Secure Connection", "Бяспечнае падключэнне"),
        ("Insecure Connection", "Нябяспечнае падключэнне"),
+        ("Continue", ""),
        ("Scale original", "Арыгінальны маштаб"),
        ("Scale adaptive", "Адаптыўны маштаб"),
        ("General", "Агульныя"),
@@ -761,5 +762,17 @@ pub static ref T: std::collections::HashMap<&'static str, &'static str> =
        ("Switch display", "Пераключыць дысплэй"),
        ("Show monitor switch button on the main toolbar", "Паказваць кнопку пераключэння манітора на галоўнай панэлі інструментаў"),
        ("Show on the minimized toolbar", "Паказваць на згорнутай панэлі інструментаў"),
+        ("All monitors", "Усе манітори"),
+        ("#{} monitor", "Манітор {}"),
+        ("conn-e2ee-unavailable-tip", "Не ўдалося праверыць скразное шыфраванне.\nАддаленая прылада, магчыма, яшчэ наладжваецца. Паспрабуйце пазней.\nКалі гэта будзе паўтарацца, сервер можа быць ненадзейным.\nУсё роўна працягнуць?"),
+        ("ID whitelisting", "Спіс дазволеных ID"),
+        ("Use ID whitelisting", "Выкарыстоўваць белы спіс ID"),
+        ("id_whitelist_tip", "Атрымліваць доступ да маёй прылады могуць толькі ID з белага спісу."),
+        ("id_whitelist_wildcard_tip", "Падтрымліваюцца падстаноўныя знакі: '*' адпавядае любой колькасці сімвалаў, '?' — роўна аднаму сімвалу"),
+        ("Invalid ID", "Няправільны ID"),
+        ("Your ID is blocked by the peer", "Ваш ID заблакаваны аддаленай прыладай"),
+        ("Your ip is blocked by the peer", "Ваш IP-адрас заблакаваны аддаленай прыладай"),
+        ("id_whitelist_caveat_tip", "ID паведамляецца кліентам, які падключаецца. Белы спіс памяншае паверхню атакі і не замяняе пароль або 2FA"),
+        ("whitelist_cidr_tip", "Падтрымліваецца натацыя CIDR, напрыклад: 192.168.1.0/24"),
    ].iter().cloned().collect();
 }
--- a/src/lang/bg.rs
+++ b/src/lang/bg.rs
@@ -332,6 +332,7 @@ pub static ref T: std::collections::HashMap<&'static str, &'static str> =
        ("Relay Connection", "Релейна връзка"),
        ("Secure Connection", "Сигурна връзка"),
        ("Insecure Connection", "Несигурна връзка"),
+        ("Continue", ""),
        ("Scale original", "Оригинален мащаб"),
        ("Scale adaptive", "Приспособимо мащабиране"),
        ("General", "Основен"),
@@ -761,5 +762,17 @@ pub static ref T: std::collections::HashMap<&'static str, &'static str> =
        ("Switch display", "Превключване на дисплея"),
        ("Show monitor switch button on the main toolbar", "Показване на бутона за превключване на монитора в главната лента с инструменти"),
        ("Show on the minimized toolbar", "Показване в минимизираната лента с инструменти"),
+        ("All monitors", "Всички монитори"),
+        ("#{} monitor", "Монитор {}"),
+        ("conn-e2ee-unavailable-tip", "Шифроването от край до край не може да бъде проверено.\nОтдалеченото устройство може все още да се настройва. Опитайте отново по-късно.\nАко това продължи, сървърът може да не е надежден.\nДа се продължи ли въпреки това?"),
+        ("ID whitelisting", "Позволени ID"),
+        ("Use ID whitelisting", "Използване бял списък с ID"),
+        ("id_whitelist_tip", "Само ID от белия списък имат достъп до мен"),
+        ("id_whitelist_wildcard_tip", "Поддържат се заместващи символи: '*' съответства на произволен брой знаци, '?' — на точно един знак"),
+        ("Invalid ID", "Невалидно ID"),
+        ("Your ID is blocked by the peer", "Вашето ID е блокирано от отсрещната страна"),
+        ("Your ip is blocked by the peer", "Вашият IP адрес е блокиран от отсрещната страна"),
+        ("id_whitelist_caveat_tip", "ID се съобщава от свързващия се клиент. Белият списък намалява изложеността и не замества паролата или 2FA"),
+        ("whitelist_cidr_tip", "Поддържа се CIDR нотация, например: 192.168.1.0/24"),
    ].iter().cloned().collect();
 }
--- a/src/lang/ca.rs
+++ b/src/lang/ca.rs
@@ -332,6 +332,7 @@ pub static ref T: std::collections::HashMap<&'static str, &'static str> =
        ("Relay Connection", "Connexió amb repetidor"),
        ("Secure Connection", "Connexió segura"),
        ("Insecure Connection", "Connexió no segura"),
+        ("Continue", ""),
        ("Scale original", "Escala original"),
        ("Scale adaptive", "Escala adaptativa"),
        ("General", "General"),
@@ -761,5 +762,17 @@ pub static ref T: std::collections::HashMap<&'static str, &'static str> =
        ("Switch display", "Canvia de pantalla"),
        ("Show monitor switch button on the main toolbar", "Mostra el botó de canvi de monitor a la barra d’eines principal"),
        ("Show on the minimized toolbar", "Mostra a la barra d’eines minimitzada"),
+        ("All monitors", "Tots els monitors"),
+        ("#{} monitor", "Monitor {}"),
+        ("conn-e2ee-unavailable-tip", "No s'ha pogut verificar el xifratge d'extrem a extrem.\nEl dispositiu remot encara es pot estar configurant. Torneu-ho a provar més tard.\nSi això continua passant, el servidor pot no ser de confiança.\nVoleu continuar igualment?"),
+        ("ID whitelisting", "ID admesos"),
+        ("Use ID whitelisting", "Utilitza un llistat d'ID admesos"),
+        ("id_whitelist_tip", "Només els ID admesos es podran connectar"),
+        ("id_whitelist_wildcard_tip", "S'admeten comodins: '*' coincideix amb qualsevol nombre de caràcters, '?' amb un sol caràcter"),
+        ("Invalid ID", "ID no vàlid"),
+        ("Your ID is blocked by the peer", "El vostre ID està bloquejat per l'altre extrem"),
+        ("Your ip is blocked by the peer", "La vostra IP està bloquejada per l'altre extrem"),
+        ("id_whitelist_caveat_tip", "L'ID és informat pel client que es connecta. Aquesta llista blanca redueix l'exposició i no substitueix la contrasenya ni la 2FA"),
+        ("whitelist_cidr_tip", "S'admet la notació CIDR, per exemple 192.168.1.0/24"),
    ].iter().cloned().collect();
 }
--- a/src/lang/cn.rs
+++ b/src/lang/cn.rs
@@ -332,6 +332,7 @@ pub static ref T: std::collections::HashMap<&'static str, &'static str> =
        ("Relay Connection", "中继连接"),
        ("Secure Connection", "安全连接"),
        ("Insecure Connection", "非安全连接"),
+        ("Continue", "继续"),
        ("Scale original", "原始尺寸"),
        ("Scale adaptive", "适应窗口"),
        ("General", "常规"),
@@ -761,5 +762,17 @@ pub static ref T: std::collections::HashMap<&'static str, &'static str> =
        ("Switch display", "切换显示器"),
        ("Show monitor switch button on the main toolbar", "在主工具栏上显示显示器切换按钮"),
        ("Show on the minimized toolbar", "在最小化工具栏上显示"),
+        ("All monitors", "所有显示器"),
+        ("#{} monitor", "{}号显示器"),
+        ("conn-e2ee-unavailable-tip", "无法验证端到端加密。\n远程设备可能仍在准备中，请稍后重试。\n如果此问题持续出现，服务器可能不受信任。\n仍要继续吗？"),
+        ("ID whitelisting", "ID 白名单"),
+        ("Use ID whitelisting", "只允许白名单上的 ID 访问"),
+        ("id_whitelist_tip", "只有白名单里的 ID 才能访问本机"),
+        ("id_whitelist_wildcard_tip", "支持通配符：'*' 匹配任意数量的字符，'?' 匹配单个字符"),
+        ("Invalid ID", "无效 ID"),
+        ("Your ID is blocked by the peer", "你的 ID 已被对方阻止"),
+        ("Your ip is blocked by the peer", "你的 IP 已被对方阻止"),
+        ("id_whitelist_caveat_tip", "ID 由对端客户端上报，白名单用于减少暴露面，不能替代密码或 2FA"),
+        ("whitelist_cidr_tip", "支持 CIDR 写法，例如 192.168.1.0/24"),
    ].iter().cloned().collect();
 }
--- a/src/lang/cs.rs
+++ b/src/lang/cs.rs
@@ -332,6 +332,7 @@ pub static ref T: std::collections::HashMap<&'static str, &'static str> =
        ("Relay Connection", "Připojení předávací server"),
        ("Secure Connection", "Zabezpečené připojení"),
        ("Insecure Connection", "Nezabezpečené připojení"),
+        ("Continue", ""),
        ("Scale original", "Originální měřítko"),
        ("Scale adaptive", "Adaptivní měřítko"),
        ("General", "Obecné"),
@@ -761,5 +762,17 @@ pub static ref T: std::collections::HashMap<&'static str, &'static str> =
        ("Switch display", "Přepnout obrazovku"),
        ("Show monitor switch button on the main toolbar", "Zobrazit tlačítko přepnutí monitoru na hlavním panelu nástrojů"),
        ("Show on the minimized toolbar", "Zobrazit na minimalizovaném panelu nástrojů"),
+        ("All monitors", "Všechny monitory"),
+        ("#{} monitor", "Monitor č. {}"),
+        ("conn-e2ee-unavailable-tip", "Nepodařilo se ověřit koncové šifrování.\nVzdálené zařízení se možná stále nastavuje. Zkuste to znovu později.\nPokud se to bude opakovat, server nemusí být důvěryhodný.\nPřesto pokračovat?"),
+        ("ID whitelisting", "Povolování pouze z daných ID"),
+        ("Use ID whitelisting", "Použít bílou listinu ID"),
+        ("id_whitelist_tip", "Přístup je umožněn pouze z ID, nacházejících se na seznamu povolených"),
+        ("id_whitelist_wildcard_tip", "Jsou podporovány zástupné znaky: '*' odpovídá libovolnému počtu znaků, '?' právě jednomu znaku"),
+        ("Invalid ID", "Neplatné ID"),
+        ("Your ID is blocked by the peer", "Vaše ID je protistranou blokováno"),
+        ("Your ip is blocked by the peer", "Vaše IP adresa je protistranou blokována"),
+        ("id_whitelist_caveat_tip", "ID je hlášeno připojujícím se klientem. Tento seznam snižuje vystavení a nenahrazuje heslo ani 2FA"),
+        ("whitelist_cidr_tip", "Je podporován zápis CIDR, například 192.168.1.0/24"),
    ].iter().cloned().collect();
 }
--- a/src/lang/da.rs
+++ b/src/lang/da.rs
@@ -332,6 +332,7 @@ pub static ref T: std::collections::HashMap<&'static str, &'static str> =
        ("Relay Connection", "Viderestillingsforbindelse"),
        ("Secure Connection", "Sikker forbindelse"),
        ("Insecure Connection", "Usikker forbindelse"),
+        ("Continue", ""),
        ("Scale original", "Original skalering"),
        ("Scale adaptive", "Adaptiv skalering"),
        ("General", "Generelt"),
@@ -761,5 +762,17 @@ pub static ref T: std::collections::HashMap<&'static str, &'static str> =
        ("Switch display", "Skift skærm"),
        ("Show monitor switch button on the main toolbar", "Vis knap til skærmskift på hovedværktøjslinjen"),
        ("Show on the minimized toolbar", "Vis på den minimerede værktøjslinje"),
+        ("All monitors", "Alle skærme"),
+        ("#{} monitor", "Skærm {}"),
+        ("conn-e2ee-unavailable-tip", "End-to-end-kryptering kunne ikke bekræftes.\nDen eksterne enhed er muligvis stadig ved at blive konfigureret. Prøv igen senere.\nHvis dette fortsætter, er serveren muligvis ikke pålidelig.\nFortsæt alligevel?"),
+        ("ID whitelisting", "ID whitelisting"),
+        ("Use ID whitelisting", "Brug ID whitelisting"),
+        ("id_whitelist_tip", "Kun ID'er på whitelisten kan få adgang til mig"),
+        ("id_whitelist_wildcard_tip", "Jokertegn understøttes: '*' matcher et vilkårligt antal tegn, '?' matcher præcist ét tegn"),
+        ("Invalid ID", "Ugyldigt ID"),
+        ("Your ID is blocked by the peer", "Dit ID er blokeret af modparten"),
+        ("Your ip is blocked by the peer", "Din IP-adresse er blokeret af modparten"),
+        ("id_whitelist_caveat_tip", "ID'et rapporteres af den klient, der opretter forbindelse. Whitelisten reducerer eksponeringen og erstatter ikke adgangskode eller 2FA"),
+        ("whitelist_cidr_tip", "CIDR-notation understøttes, f.eks. 192.168.1.0/24"),
    ].iter().cloned().collect();
 }
--- a/src/lang/de.rs
+++ b/src/lang/de.rs
@@ -332,6 +332,7 @@ pub static ref T: std::collections::HashMap<&'static str, &'static str> =
        ("Relay Connection", "Relay-Verbindung"),
        ("Secure Connection", "Sichere Verbindung"),
        ("Insecure Connection", "Unsichere Verbindung"),
+        ("Continue", ""),
        ("Scale original", "Keine Skalierung"),
        ("Scale adaptive", "Anpassbare Skalierung"),
        ("General", "Allgemein"),
@@ -761,5 +762,17 @@ pub static ref T: std::collections::HashMap<&'static str, &'static str> =
        ("Switch display", "Anzeige wechseln"),
        ("Show monitor switch button on the main toolbar", "Schaltfläche zum Monitorwechsel in der Haupt-Symbolleiste anzeigen"),
        ("Show on the minimized toolbar", "In der minimierten Symbolleiste anzeigen"),
+        ("All monitors", "Alle Bildschirme"),
+        ("#{} monitor", "Bildschirm {}"),
+        ("conn-e2ee-unavailable-tip", "Ende-zu-Ende-Verschlüsselung konnte nicht verifiziert werden.\nDas entfernte Gerät wird möglicherweise noch eingerichtet. Versuchen Sie es später erneut.\nWenn dies weiterhin auftritt, ist der Server möglicherweise nicht vertrauenswürdig.\nTrotzdem fortfahren?"),
+        ("ID whitelisting", "ID-Whitelist"),
+        ("Use ID whitelisting", "ID-Whitelist verwenden"),
+        ("id_whitelist_tip", "Nur IDs auf der Whitelist können zugreifen."),
+        ("id_whitelist_wildcard_tip", "Platzhalter werden unterstützt: '*' steht für beliebig viele Zeichen, '?' für genau ein Zeichen"),
+        ("Invalid ID", "Ungültige ID"),
+        ("Your ID is blocked by the peer", "Ihre ID wird von der Gegenstelle blockiert"),
+        ("Your ip is blocked by the peer", "Ihre IP-Adresse wird von der Gegenstelle blockiert"),
+        ("id_whitelist_caveat_tip", "Die ID wird vom verbindenden Client gemeldet. Die Whitelist verringert die Angriffsfläche und ersetzt weder Passwort noch 2FA"),
+        ("whitelist_cidr_tip", "Die CIDR-Notation wird unterstützt, z. B. 192.168.1.0/24"),
    ].iter().cloned().collect();
 }
--- a/src/lang/el.rs
+++ b/src/lang/el.rs
@@ -332,6 +332,7 @@ pub static ref T: std::collections::HashMap<&'static str, &'static str> =
        ("Relay Connection", "Αναμεταδιδόμενη σύνδεση"),
        ("Secure Connection", "Ασφαλής σύνδεση"),
        ("Insecure Connection", "Μη ασφαλής σύνδεση"),
+        ("Continue", ""),
        ("Scale original", "Κλιμάκωση πρωτότυπου"),
        ("Scale adaptive", "Προσαρμοσμένη κλίμακα"),
        ("General", "Γενικά"),
@@ -761,5 +762,17 @@ pub static ref T: std::collections::HashMap<&'static str, &'static str> =
        ("Switch display", "Εναλλαγή οθόνης"),
        ("Show monitor switch button on the main toolbar", "Εμφάνιση κουμπιού εναλλαγής οθόνης στην κύρια γραμμή εργαλείων"),
        ("Show on the minimized toolbar", "Εμφάνιση στην ελαχιστοποιημένη γραμμή εργαλείων"),
+        ("All monitors", "Όλες οι οθόνες"),
+        ("#{} monitor", "Οθόνη {}"),
+        ("conn-e2ee-unavailable-tip", "Δεν ήταν δυνατή η επαλήθευση της κρυπτογράφησης από άκρο σε άκρο.\nΗ απομακρυσμένη συσκευή μπορεί να ρυθμίζεται ακόμα. Δοκιμάστε ξανά αργότερα.\nΑν αυτό συνεχιστεί, ο διακομιστής μπορεί να μην είναι αξιόπιστος.\nΣυνέχεια παρ' όλα αυτά;"),
+        ("ID whitelisting", "Λίστα επιτρεπόμενων ID"),
+        ("Use ID whitelisting", "Χρήση λίστας επιτρεπόμενων ID"),
+        ("id_whitelist_tip", "Μόνο τα ID της λίστας επιτρεπόμενων έχουν πρόσβαση σε εμένα"),
+        ("id_whitelist_wildcard_tip", "Υποστηρίζονται χαρακτήρες μπαλαντέρ: το '*' αντιστοιχεί σε οποιονδήποτε αριθμό χαρακτήρων, το '?' σε έναν ακριβώς χαρακτήρα"),
+        ("Invalid ID", "Μη έγκυρο ID"),
+        ("Your ID is blocked by the peer", "Το ID σας έχει αποκλειστεί από τον απομακρυσμένο υπολογιστή"),
+        ("Your ip is blocked by the peer", "Η διεύθυνση IP σας έχει αποκλειστεί από τον απομακρυσμένο υπολογιστή"),
+        ("id_whitelist_caveat_tip", "Το ID αναφέρεται από τον πελάτη που συνδέεται. Η λίστα επιτρεπόμενων μειώνει την έκθεση και δεν αντικαθιστά τον κωδικό πρόσβασης ή το 2FA"),
+        ("whitelist_cidr_tip", "Υποστηρίζεται η σημειογραφία CIDR, π.χ. 192.168.1.0/24"),
    ].iter().cloned().collect();
 }
--- a/src/lang/en.rs
+++ b/src/lang/en.rs
@@ -279,5 +279,11 @@ pub static ref T: std::collections::HashMap<&'static str, &'static str> =
        ("wayland-soft-keyboard-input-label", "Soft keyboard input"),
        ("wayland-keyboard-input-reset-choice-tip", "Reset keyboard input choice"),
        ("remember-wayland-keyboard-choice-tip", "Don't ask again for this remote computer"),
+        ("conn-e2ee-unavailable-tip", "Could not verify end-to-end encryption.\nThe remote device may still be setting up. Try again later.\nIf this keeps happening, the server may be untrusted.\nContinue anyway?"),
+        ("id_whitelist_tip", "Only whitelisted IDs can access me"),
+        ("id_whitelist_wildcard_tip", "Wildcards are supported: '*' matches any number of characters, '?' matches exactly one character"),
+        ("id_whitelist_caveat_tip", "The ID is reported by the connecting client. This whitelist reduces exposure and does not replace the password or 2FA."),
+        ("whitelist_cidr_tip", "CIDR notation is supported, e.g. 192.168.1.0/24"),
+        ("Your ip is blocked by the peer", "Your IP is blocked by the peer"),
    ].iter().cloned().collect();
 }
--- a/Show More
+++ b/Show More