fix(keyboard): iPad, icon

Signed-off-by: fufesou <linlong1266@gmail.com>

.cargo/config.toml

@@ -2,8 +2,6 @@
 rustflags = ["-Ctarget-feature=+crt-static"]
 [target.i686-pc-windows-msvc]
 rustflags = ["-C", "target-feature=+crt-static", "-C", "link-args=/NODEFAULTLIB:MSVCRT"]
-[target.aarch64-pc-windows-msvc]
-rustflags = ["-Ctarget-feature=+crt-static"]
 [target.'cfg(target_os="macos")']
 rustflags = [
     "-C", "link-args=-sectcreate __CGPreLoginApp __cgpreloginapp /dev/null",

.github/dependabot.yml

@@ -0,0 +1,11 @@
+version: 2
+updates:
+  - package-ecosystem: "gitsubmodule"
+    directory: "/"
+    target-branch: "master"
+    schedule:
+      interval: "daily"
+    commit-message:
+      prefix: "Git submodule"
+    labels:
+      - "dependencies"

.github/patches/apply_flutter_3.44_source_patches.sh

@@ -1,140 +0,0 @@
-#!/usr/bin/env bash
-# Applies the Flutter 3.44-only source/pubspec changes on the fly, in CI only.
-#
-# Windows arm64 needs Flutter >= 3.44 (the first stable release shipping an arm64 Dart SDK +
-# engine), which renamed DialogTheme/TabBarTheme -> *Data and needs newer extended_text/
-# google_fonts. Every other platform is still on Flutter 3.24.5, where the old names/versions
-# are required, so these changes are kept OUT of the committed sources and applied here instead.
-#
-# Used by BOTH the Windows arm64 build (flutter-build.yml) and its dedicated bridge artifact
-# (bridge.yml) so they share an identical 3.44 source state -- the generated *.freezed.dart must
-# compile against the same Flutter/freezed version the arm64 build resolves.
-#
-# Remove this script (and commit the changes) once upstream bumps Flutter across the board.
-#
-# Run from the repository root. sed is used (not a git-apply patch) because the checked-out
-# sources are CRLF on the windows-11-arm runner; the substitutions below are anchor-free and
-# therefore CRLF-safe.
-set -euo pipefail
-
-readonly NO_MATCHES=0
-readonly SINGLE_MATCH=1
-readonly THEME_MATCHES=2
-
-has_exact_count() {
-  local -r expected_count="$1"
-  local -r pattern="$2"
-  local -r file="$3"
-  local actual_count
-  [[ -r "$file" ]] || return 1
-  actual_count="$(grep -cF "$pattern" "$file" || true)"
-  [[ "$actual_count" -eq "$expected_count" ]]
-}
-
-# The target background-color line must directly follow DialogThemeData in the selected range.
-has_dialog_background_in_theme_range() {
-  local -r start_pattern="$1"
-  local -r end_pattern="$2"
-  local -r target_pattern="$3"
-  local -r file="$4"
-  awk -v start_pattern="$start_pattern" \
-    -v end_pattern="$end_pattern" \
-    -v target_pattern="$target_pattern" '
-      index($0, start_pattern) {
-        in_theme = 1
-        next
-      }
-      in_theme && index($0, end_pattern) {
-        exit
-      }
-      in_theme && index($0, "dialogTheme: DialogThemeData(") {
-        if (getline > 0) {
-          line = $0
-          sub(/\r$/, "", line)
-          sub(/^[[:space:]]+/, "", line)
-          matched = line == target_pattern
-        }
-        exit
-      }
-      END {
-        exit matched ? 0 : 1
-      }
-    ' "$file"
-}
-
-validate_patch_inputs() {
-  if [[ ! -f flutter/lib/common.dart || ! -r flutter/lib/common.dart ]]; then
-    echo "Flutter 3.44 source patch input is missing or unreadable: flutter/lib/common.dart" >&2
-    return 1
-  fi
-  if [[ ! -f flutter/pubspec.yaml || ! -r flutter/pubspec.yaml ]]; then
-    echo "Flutter 3.44 source patch input is missing or unreadable: flutter/pubspec.yaml" >&2
-    return 1
-  fi
-}
-
-is_complete_patch_state() {
-  has_exact_count "$THEME_MATCHES" 'dialogTheme: DialogThemeData(' flutter/lib/common.dart &&
-    has_exact_count "$THEME_MATCHES" 'tabBarTheme: const TabBarThemeData(' flutter/lib/common.dart &&
-    has_exact_count "$SINGLE_MATCH" 'backgroundColor: Colors.white,' flutter/lib/common.dart &&
-    has_exact_count "$SINGLE_MATCH" 'backgroundColor: Color(0xFF18191E),' flutter/lib/common.dart &&
-    has_exact_count "$SINGLE_MATCH" 'extended_text: 15.0.2' flutter/pubspec.yaml &&
-    has_exact_count "$SINGLE_MATCH" 'google_fonts: ^8.1.0' flutter/pubspec.yaml &&
-    has_exact_count "$NO_MATCHES" 'dialogTheme: DialogTheme(' flutter/lib/common.dart &&
-    has_exact_count "$NO_MATCHES" 'tabBarTheme: const TabBarTheme(' flutter/lib/common.dart &&
-    has_exact_count "$NO_MATCHES" 'extended_text: 14.0.0' flutter/pubspec.yaml &&
-    has_exact_count "$NO_MATCHES" 'google_fonts: ^6.2.1' flutter/pubspec.yaml &&
-    has_dialog_background_in_theme_range 'static ThemeData lightTheme = ThemeData(' \
-      'static ThemeData darkTheme = ThemeData(' 'backgroundColor: Colors.white,' \
-      flutter/lib/common.dart &&
-    has_dialog_background_in_theme_range 'static ThemeData darkTheme = ThemeData(' \
-      'scrollbarTheme: scrollbarThemeDark,' 'backgroundColor: Color(0xFF18191E),' \
-      flutter/lib/common.dart
-}
-
-is_unpatched_state() {
-  has_exact_count "$THEME_MATCHES" 'dialogTheme: DialogTheme(' flutter/lib/common.dart &&
-    has_exact_count "$THEME_MATCHES" 'tabBarTheme: const TabBarTheme(' flutter/lib/common.dart &&
-    has_exact_count "$SINGLE_MATCH" 'extended_text: 14.0.0' flutter/pubspec.yaml &&
-    has_exact_count "$SINGLE_MATCH" 'google_fonts: ^6.2.1' flutter/pubspec.yaml &&
-    has_exact_count "$NO_MATCHES" 'dialogTheme: DialogThemeData(' flutter/lib/common.dart &&
-    has_exact_count "$NO_MATCHES" 'tabBarTheme: const TabBarThemeData(' flutter/lib/common.dart &&
-    has_exact_count "$NO_MATCHES" 'backgroundColor: Colors.white,' flutter/lib/common.dart &&
-    has_exact_count "$NO_MATCHES" 'backgroundColor: Color(0xFF18191E),' flutter/lib/common.dart &&
-    has_exact_count "$NO_MATCHES" 'extended_text: 15.0.2' flutter/pubspec.yaml &&
-    has_exact_count "$NO_MATCHES" 'google_fonts: ^8.1.0' flutter/pubspec.yaml
-}
-
-if ! validate_patch_inputs; then
-  exit 1
-fi
-
-if is_complete_patch_state; then
-  echo "Flutter 3.44 source patches already applied."
-  git --no-pager diff -- flutter/lib/common.dart flutter/pubspec.yaml
-  exit 0
-fi
-
-if ! is_unpatched_state; then
-  echo "Flutter 3.44 source patches are partially applied or their anchors have drifted." >&2
-  exit 1
-fi
-
-# ThemeData API renames (Flutter 3.27+):
-sed -i 's/dialogTheme: DialogTheme(/dialogTheme: DialogThemeData(/g' flutter/lib/common.dart
-sed -i 's/tabBarTheme: const TabBarTheme(/tabBarTheme: const TabBarThemeData(/g' flutter/lib/common.dart
-sed -i '/static ThemeData lightTheme = ThemeData(/,/static ThemeData darkTheme = ThemeData(/s/dialogTheme: DialogThemeData(/dialogTheme: DialogThemeData(\
-      backgroundColor: Colors.white,/' flutter/lib/common.dart
-sed -i '/static ThemeData darkTheme = ThemeData(/,/scrollbarTheme: scrollbarThemeDark,/s/dialogTheme: DialogThemeData(/dialogTheme: DialogThemeData(\
-      backgroundColor: Color(0xFF18191E),/' flutter/lib/common.dart
-# Dependency bumps required by the newer Dart/Flutter:
-sed -i 's/extended_text: 14.0.0/extended_text: 15.0.2/' flutter/pubspec.yaml
-sed -i 's/google_fonts: \^6.2.1/google_fonts: ^8.1.0/' flutter/pubspec.yaml
-
-# Fail loudly if any expected substitution did not produce the complete state.
-if ! is_complete_patch_state; then
-  echo "Flutter 3.44 source patches did not produce the expected state." >&2
-  exit 1
-fi
-
-git --no-pager diff -- flutter/lib/common.dart flutter/pubspec.yaml

.github/patches/apply_flutter_3.44_web_patches.sh

@@ -1,51 +0,0 @@
-#!/usr/bin/env bash
-# Prepares a web build on Flutter 3.44.x. Companion to
-# apply_flutter_3.44_source_patches.sh (which it runs first): the web target
-# additionally needs qr_code_scanner's web implementation patched for the
-# dart:ui platformViewRegistry removal, and flutter/web/fonts refreshed with
-# the font paths the 3.44 engine requests for offline/air-gapped support
-# (rustdesk-server-pro#996; see flutter/web/fonts/sync_fonts.py).
-#
-# Run from the repository root with Flutter 3.44.x on PATH, then build:
-#   bash .github/patches/apply_flutter_3.44_web_patches.sh
-#   (cd flutter && flutter build web --release)   # or ./web/js/flutter_build.py
-#
-# Idempotent. To undo the source changes locally:
-#   git checkout -- flutter/lib/common.dart flutter/pubspec.yaml flutter/pubspec.lock
-set -euo pipefail
-
-flutter --version | grep -q "Flutter 3\.44\." || {
-  echo "Flutter 3.44.x must be on PATH; found:" >&2
-  flutter --version | grep "^Flutter" >&2 || true
-  exit 1
-}
-
-# Shared 3.44 source/pubspec patches own their complete-state validation.
-bash .github/patches/apply_flutter_3.44_source_patches.sh
-
-# Populate the pub cache with the 3.44 dependency resolution.
-(cd flutter && flutter pub get)
-
-# qr_code_scanner 1.0.1 (unmaintained) reads platformViewRegistry from
-# dart:ui, which Flutter 3.44 removed; point it at dart:ui_web instead. The
-# patched file also compiles on Flutter 3.24 (dart:ui_web exists there), so
-# mutating the shared pub cache is safe for other local builds.
-QR_WEB="${PUB_CACHE:-$HOME/.pub-cache}/hosted/pub.dev/qr_code_scanner-1.0.1/lib/src/web/flutter_qr_web.dart"
-if ! grep -qF "dart:ui_web" "$QR_WEB"; then
-  sed -i.bak "s|import 'dart:ui' as ui;|import 'dart:ui' as ui; import 'dart:ui_web' as ui_web;|" "$QR_WEB"
-  rm -f "$QR_WEB.bak"
-fi
-if grep -qF "ui.platformViewRegistry" "$QR_WEB"; then
-  sed -i.bak "s|ui\.platformViewRegistry|ui_web.platformViewRegistry|g" "$QR_WEB"
-  rm -f "$QR_WEB.bak"
-fi
-
-# Mirror the fonts this engine version requests into flutter/web/fonts.
-python3 flutter/web/fonts/sync_fonts.py
-
-# Fail loudly if any expected state is missing:
-grep -qF "import 'dart:ui' as ui; import 'dart:ui_web' as ui_web;" "$QR_WEB"
-grep -qF "ui_web.platformViewRegistry" "$QR_WEB"
-grep -qF 'google_fonts: ^8.1.0' flutter/pubspec.yaml
-
-echo "Flutter 3.44 web patches applied."

.github/workflows/bridge.yml

@@ -7,6 +7,7 @@ on:
 
 env:
   CARGO_EXPAND_VERSION: "1.0.95"
+  FLUTTER_VERSION: "3.22.3"
   FLUTTER_RUST_BRIDGE_VERSION: "1.80.1"
   RUST_VERSION: "1.75" # https://github.com/rustdesk/rustdesk/discussions/7503
 
@@ -17,25 +18,14 @@ jobs:
       fail-fast: false
       matrix:
         job:
-          # Default bridge for every platform still on Flutter 3.24.5 (generated with 3.22.3).
           - {
               target: x86_64-unknown-linux-gnu,
               os: ubuntu-22.04,
               extra-build-args: "",
-              flutter-version: "3.22.3",
-              artifact-name: "bridge-artifact",
-            }
-          # Dedicated bridge for the Windows arm64 build (Flutter 3.44); runs in parallel.
-          - {
-              target: x86_64-unknown-linux-gnu,
-              os: ubuntu-22.04,
-              extra-build-args: "",
-              flutter-version: "3.44.8",
-              artifact-name: "bridge-artifact-flutter-3.44",
             }
     steps:
       - name: Checkout source code
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        uses: actions/checkout@v4
         with:
           submodules: recursive
 
@@ -59,28 +49,28 @@ jobs:
             wget
 
       - name: Install Rust toolchain
-        uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9 # v1
+        uses: dtolnay/rust-toolchain@v1
         with:
           toolchain: ${{ env.RUST_VERSION }}
           targets: ${{ matrix.job.target }}
           components: "rustfmt"
 
-      - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
+      - uses: Swatinem/rust-cache@v2
         with:
           prefix-key: bridge-${{ matrix.job.os }}
 
       - name: Cache Bridge
         id: cache-bridge
-        uses: actions/cache@6f8efc29b200d32929f49075959781ed54ec270c # v3
+        uses: actions/cache@v3
         with:
           path: /tmp/flutter_rust_bridge
-          key: bridge-${{ matrix.job.flutter-version }}
+          key: vcpkg-${{ matrix.job.arch }}
 
       - name: Install flutter
-        uses: subosito/flutter-action@1a449444c387b1966244ae4d4f8c696479add0b2 # v2
+        uses: subosito/flutter-action@v2
         with:
           channel: "stable"
-          flutter-version: ${{ matrix.job.flutter-version }}
+          flutter-version: ${{ env.FLUTTER_VERSION }}
           cache: true
 
       - name: Install flutter rust bridge deps
@@ -88,15 +78,7 @@ jobs:
         run: |
           cargo install cargo-expand --version ${{ env.CARGO_EXPAND_VERSION }} --locked
           cargo install flutter_rust_bridge_codegen --version ${{ env.FLUTTER_RUST_BRIDGE_VERSION }} --features "uuid" --locked
-          if [[ "${{ matrix.job.flutter-version }}" == "3.22.3" ]]; then
-            # Default Flutter 3.22.3: extended_text 14 needs a newer Dart, so downgrade for resolution.
-            sed -i -e 's/extended_text: 14.0.0/extended_text: 13.0.0/g' flutter/pubspec.yaml
-          else
-            # Flutter 3.44 bridge for Windows arm64: match that build's source/pubspec state so the
-            # generated *.freezed.dart compiles against the same Flutter/freezed it resolves.
-            bash .github/patches/apply_flutter_3.44_source_patches.sh
-          fi
-          pushd flutter && flutter pub get && popd
+          pushd flutter && sed -i -e 's/extended_text: 14.0.0/extended_text: 13.0.0/g' pubspec.yaml && flutter pub get && popd
 
       - name: Run flutter rust bridge
         run: |
@@ -104,9 +86,9 @@ jobs:
           cp ./flutter/macos/Runner/bridge_generated.h ./flutter/ios/Runner/bridge_generated.h
 
       - name: Upload Artifact
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@master
         with:
-          name: ${{ matrix.job.artifact-name }}
+          name: bridge-artifact
           path: |
             ./src/bridge_generated.rs
             ./src/bridge_generated.io.rs

.github/workflows/ci.yml

@@ -5,7 +5,7 @@ env:
 #   CICD_INTERMEDIATES_DIR: "_cicd-intermediates"
   VCPKG_BINARY_SOURCES: "clear;x-gha,readwrite"
   # for multiarch gcc compatibility
-  VCPKG_COMMIT_ID: "9e593bb18ea69cc5095e012465dcd675a822ed0d"
+  VCPKG_COMMIT_ID: "120deac3062162151622ca4860575a33844ba10b"
 
 on:
   workflow_dispatch:
@@ -29,13 +29,13 @@ jobs:
   #   name: Ensure 'cargo fmt' has been run
   #   runs-on: ubuntu-20.04
   #   steps:
-  #   - uses: actions-rs/toolchain@16499b5e05bf2e26879000db0c1d13f7e13fa3af # v1
+  #   - uses: actions-rs/toolchain@v1
   #     with:
   #       toolchain: stable
   #       default: true
   #       profile: minimal
   #       components: rustfmt
-  #   - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3
+  #   - uses: actions/checkout@v3
   #   - run: cargo fmt -- --check
 
   # min_version:
@@ -43,24 +43,24 @@ jobs:
   #   runs-on: ubuntu-20.04
   #   steps:
   #   - name: Checkout source code
-  #     uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3
+  #     uses: actions/checkout@v3
   #     with:
   #       submodules: recursive
 
   #   - name: Install rust toolchain (v${{ env.MIN_SUPPORTED_RUST_VERSION }})
-  #     uses: actions-rs/toolchain@16499b5e05bf2e26879000db0c1d13f7e13fa3af # v1
+  #     uses: actions-rs/toolchain@v1
   #     with:
   #       toolchain: ${{ env.MIN_SUPPORTED_RUST_VERSION }}
   #       default: true
   #       profile: minimal # minimal component installation (ie, no documentation)
   #       components: clippy
   #   - name: Run clippy (on minimum supported rust version to prevent warnings we can't fix)
-  #     uses: actions-rs/cargo@844f36862e911db73fe0815f00a4a2602c279505 # v1
+  #     uses: actions-rs/cargo@v1
   #     with:
   #       command: clippy
   #       args: --locked --all-targets --all-features -- --allow clippy::unknown_clippy_lints
   #   - name: Run tests
-  #     uses: actions-rs/cargo@844f36862e911db73fe0815f00a4a2602c279505 # v1
+  #     uses: actions-rs/cargo@v1
   #     with:
   #       command: test
   #       args: --locked
@@ -81,15 +81,14 @@ jobs:
           # - { target: x86_64-apple-darwin         , os: macos-10.15                   }
           # - { target: x86_64-pc-windows-gnu       , os: windows-2022                  }
           # - { target: x86_64-pc-windows-msvc      , os: windows-2022                  }
-          # - { target: aarch64-pc-windows-msvc     , os: windows-11-arm                }
           - { target: x86_64-unknown-linux-gnu    , os: ubuntu-24.04                  }
           # - { target: x86_64-unknown-linux-musl   , os: ubuntu-20.04, use-cross: true }
     steps:
     - name: Free Disk Space (Ubuntu)
       if: runner.os == 'Linux'
-      # jlumbroso/free-disk-space@v1.3.1 is used in .github\workflows\flutter-build.yml
+      # jlumbroso/free-disk-space@main is used in .github\workflows\flutter-build.yml
       # But pinning to a specific version to avoid unexpected issues is preferred.
-      uses: jlumbroso/free-disk-space@54081f138730dfa15788a46383842cd2f914a1be # v1.3.1
+      uses: jlumbroso/free-disk-space@v1.3.1
       with:
         tool-cache: false
         android: true
@@ -100,14 +99,14 @@ jobs:
         swap-storage: false
 
     - name: Export GitHub Actions cache environment variables
-      uses: actions/github-script@d7906e4ad0b1822421a7e6a35d5ca353c962f410 # v6
+      uses: actions/github-script@v6
       with:
         script: |
           core.exportVariable('ACTIONS_CACHE_URL', process.env.ACTIONS_CACHE_URL || '');
           core.exportVariable('ACTIONS_RUNTIME_TOKEN', process.env.ACTIONS_RUNTIME_TOKEN || '');
 
     - name: Checkout source code
-      uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+      uses: actions/checkout@v4
       with:
         submodules: recursive
 
@@ -124,6 +123,7 @@ jobs:
                gcc \
                git \
                g++ \
+               libpam0g-dev \
                libasound2-dev \
                libunwind-dev \
                libgstreamer1.0-dev \
@@ -145,7 +145,7 @@ jobs:
         esac
 
     - name: Setup vcpkg with Github Actions binary cache
-      uses: lukka/run-vcpkg@b1a0dd252f06b9e25b3c022a9a03bd7a427fb6a2 # v11
+      uses: lukka/run-vcpkg@v11
       with:
         vcpkgDirectory: /opt/artifacts/vcpkg
         vcpkgGitCommitId: ${{ env.VCPKG_COMMIT_ID }}
@@ -156,7 +156,7 @@ jobs:
       shell: bash
 
     - name: Install Rust toolchain
-      uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9 # v1
+      uses: dtolnay/rust-toolchain@v1
       with:
         toolchain: stable
         targets: ${{ matrix.job.target }}
@@ -172,10 +172,10 @@ jobs:
         cargo -V
         rustc -V
 
-    - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
+    - uses: Swatinem/rust-cache@v2
 
     - name: Build
-      uses: actions-rs/cargo@844f36862e911db73fe0815f00a4a2602c279505 # v1
+      uses: actions-rs/cargo@v1
       with:
         use-cross: ${{ matrix.job.use-cross }}
         command: build
@@ -243,7 +243,7 @@ jobs:
         echo "CARGO_TEST_OPTIONS=${CARGO_TEST_OPTIONS}" >> $GITHUB_OUTPUT
 
     - name: Run tests
-      uses: actions-rs/cargo@844f36862e911db73fe0815f00a4a2602c279505 # v1
+      uses: actions-rs/cargo@v1
       with:
         use-cross: ${{ matrix.job.use-cross }}
         command: test

.github/workflows/clear-cache.yml

@@ -11,7 +11,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Clear cache
-        uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7
+        uses: actions/github-script@v7
         with:
           script: |
             console.log("About to clear")
@@ -30,7 +30,7 @@ jobs:
             console.log("Clear completed")
             
       - name: Purge cache # Above seems not clear thouroughly, so add this to double clear
-        uses: MyAlbum/purge-cache@881eb5957687193fa612bf74c0042adc78ea5e54 # v2
+        uses: MyAlbum/purge-cache@v2
         with:
           accessed: true # Purge caches by their last accessed time (default)
           created: false # Purge caches by their created time (default)

.github/workflows/fdroid.yml

@@ -31,7 +31,7 @@ jobs:
         shell: bash
 
       - name: Publish RustDesk version file
-        uses: softprops/action-gh-release@de2c0eb89ae2a093876385947365aca7b0e5f844 # v1
+        uses: softprops/action-gh-release@v1
         with:
           prerelease: true
           tag_name: "fdroid-version"

.github/workflows/playground.yml

@@ -16,8 +16,8 @@ env:
   FLUTTER_ELINUX_VERSION: "3.16.9"
   TAG_NAME: "nightly"
   VCPKG_BINARY_SOURCES: "clear;x-gha,readwrite"
-  VCPKG_COMMIT_ID: "9e593bb18ea69cc5095e012465dcd675a822ed0d"
-  VERSION: "1.5.0"
+  VCPKG_COMMIT_ID: "120deac3062162151622ca4860575a33844ba10b"
+  VERSION: "1.4.6"
   NDK_VERSION: "r26d"
   #signing keys env variable checks
   ANDROID_SIGNING_KEY: "${{ secrets.ANDROID_SIGNING_KEY }}"
@@ -79,21 +79,21 @@ jobs:
             }
     steps:
       - name: Export GitHub Actions cache environment variables
-        uses: actions/github-script@d7906e4ad0b1822421a7e6a35d5ca353c962f410 # v6
+        uses: actions/github-script@v6
         with:
           script: |
             core.exportVariable('ACTIONS_CACHE_URL', process.env.ACTIONS_CACHE_URL || '');
             core.exportVariable('ACTIONS_RUNTIME_TOKEN', process.env.ACTIONS_RUNTIME_TOKEN || '');
 
       - name: Checkout source code
-        uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3
+        uses: actions/checkout@v3
         with:
           ref: ${{ matrix.job.ref }}
           submodules: recursive
 
       - name: Import the codesign cert
         if: env.MACOS_P12_BASE64 != null
-        uses: apple-actions/import-codesign-certs@253ddeeac23f2bdad1646faac5c8c2832e800071 # v1
+        uses: apple-actions/import-codesign-certs@v1
         with:
           p12-file-base64: ${{ secrets.MACOS_P12_BASE64 }}
           p12-password: ${{ secrets.MACOS_P12_PASSWORD }}
@@ -107,7 +107,7 @@ jobs:
 
       - name: Import notarize key
         if: env.MACOS_P12_BASE64 != null
-        uses: timheuer/base64-to-file@adaa40c0c581f276132199d4cf60afa07ce60eac # v1.2
+        uses: timheuer/base64-to-file@v1.2
         with:
           # https://gregoryszorc.com/docs/apple-codesign/stable/apple_codesign_rcodesign.html#notarizing-and-stapling
           fileName: rustdesk.json
@@ -129,19 +129,19 @@ jobs:
           brew install llvm create-dmg nasm pkg-config
 
       - name: Install flutter
-        uses: subosito/flutter-action@1a449444c387b1966244ae4d4f8c696479add0b2 # v2
+        uses: subosito/flutter-action@v2
         with:
           channel: "stable"
           flutter-version: ${{ matrix.job.flutter }}
 
       - name: Install Rust toolchain
-        uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9 # v1
+        uses: dtolnay/rust-toolchain@v1
         with:
           toolchain: ${{ env.RUST_VERSION }}
           targets: ${{ matrix.job.target }}
           components: "rustfmt"
 
-      - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
+      - uses: Swatinem/rust-cache@v2
         with:
           prefix-key: ${{ matrix.job.os }}
 
@@ -156,7 +156,7 @@ jobs:
           ~/.cargo/bin/flutter_rust_bridge_codegen --rust-input ./src/flutter_ffi.rs --dart-output ./flutter/lib/generated_bridge.dart --c-output ./flutter/macos/Runner/bridge_generated.h
 
       - name: Setup vcpkg with Github Actions binary cache
-        uses: lukka/run-vcpkg@b1a0dd252f06b9e25b3c022a9a03bd7a427fb6a2 # v11
+        uses: lukka/run-vcpkg@v11
         with:
           vcpkgGitCommitId: ${{ env.VCPKG_COMMIT_ID }}
 
@@ -165,7 +165,7 @@ jobs:
           $VCPKG_ROOT/vcpkg install --x-install-root="$VCPKG_ROOT/installed"
           
       - name: Restore from cache and install vcpkg
-        uses: lukka/run-vcpkg@8a5116de2b552d6fc8894e9774aacaf2e5db4823 # v7 2026-05-26
+        uses: lukka/run-vcpkg@v7
         if: false
         with:
           setupOnly: true
@@ -222,7 +222,7 @@ jobs:
           done
 
       - name: Publish DMG package
-        uses: softprops/action-gh-release@de2c0eb89ae2a093876385947365aca7b0e5f844 # v1
+        uses: softprops/action-gh-release@v1
         with:
           prerelease: true
           tag_name: ${{ env.TAG_NAME }}
@@ -247,7 +247,7 @@ jobs:
             }
     steps:
       - name: Checkout source code
-        uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3
+        uses: actions/checkout@v3
         with:
           ref: ${{ matrix.job.ref }}
           submodules: recursive
@@ -271,6 +271,7 @@ jobs:
                libgstreamer1.0-dev \
                libgstreamer-plugins-base1.0-dev \
                libgtk-3-dev \
+               libpam0g-dev \
                libpulse-dev \
                libva-dev \
                libvdpau-dev \
@@ -283,19 +284,19 @@ jobs:
                nasm \
                yasm \
                ninja-build \
-               openjdk-17-jdk-headless \
+               openjdk-11-jdk-headless \
                pkg-config \
                tree \
                wget
 
       - name: Install flutter
-        uses: subosito/flutter-action@1a449444c387b1966244ae4d4f8c696479add0b2 # v2
+        uses: subosito/flutter-action@v2
         with:
           channel: "stable"
           flutter-version: ${{ env.FLUTTER_VERSION }}
 
       - name: Install Rust toolchain
-        uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9 # v1
+        uses: dtolnay/rust-toolchain@v1
         with:
           toolchain: ${{ env.RUST_VERSION }}
           components: "rustfmt"
@@ -309,14 +310,14 @@ jobs:
           pushd flutter ; flutter pub get ; popd
           ~/.cargo/bin/flutter_rust_bridge_codegen --rust-input ./src/flutter_ffi.rs --dart-output ./flutter/lib/generated_bridge.dart
 
-      - uses: nttld/setup-ndk@ed92fe6cadad69be94a966a7ee3271275e62f779 # v1
+      - uses: nttld/setup-ndk@v1
         id: setup-ndk
         with:
           ndk-version: ${{ env.NDK_VERSION }}
           add-to-path: true
 
       - name: Setup vcpkg with Github Actions binary cache
-        uses: lukka/run-vcpkg@b1a0dd252f06b9e25b3c022a9a03bd7a427fb6a2 # v11
+        uses: lukka/run-vcpkg@v11
         with:
           vcpkgDirectory: /opt/artifacts/vcpkg
           vcpkgGitCommitId: ${{ env.VCPKG_COMMIT_ID }}
@@ -365,9 +366,9 @@ jobs:
       - name: Build rustdesk
         shell: bash
         env:
-          JAVA_HOME: /usr/lib/jvm/java-17-openjdk-amd64
+          JAVA_HOME: /usr/lib/jvm/java-11-openjdk-amd64
         run: |
-          export PATH=/usr/lib/jvm/java-17-openjdk-amd64/bin:$PATH
+          export PATH=/usr/lib/jvm/java-11-openjdk-amd64/bin:$PATH
           # temporary use debug sign config
           sed -i "s/signingConfigs.release/signingConfigs.debug/g" ./flutter/android/app/build.gradle
           case ${{ matrix.job.target }} in
@@ -394,7 +395,7 @@ jobs:
           mkdir -p signed-apk; pushd signed-apk
           mv ../rustdesk-${{ env.VERSION }}-${{ matrix.job.arch }}.apk ./rustdesk-test-${{ matrix.job.ref }}-${{ matrix.job.ndk }}.apk
 
-      - uses: r0adkll/sign-android-release@349ebdef58775b1e0d8099458af0816dc79b6407 # v1
+      - uses: r0adkll/sign-android-release@v1
         name: Sign app APK
         if: env.ANDROID_SIGNING_KEY != null
         id: sign-rustdesk
@@ -409,7 +410,7 @@ jobs:
           BUILD_TOOLS_VERSION: "30.0.2"
 
       - name: Publish signed apk package
-        uses: softprops/action-gh-release@de2c0eb89ae2a093876385947365aca7b0e5f844 # v1
+        uses: softprops/action-gh-release@v1
         with:
           prerelease: true
           tag_name: ${{ env.TAG_NAME }}

.github/workflows/third-party-RustDeskTempTopMostWindow.yml

@@ -39,21 +39,22 @@ jobs:
       build_output_dir: RustDeskTempTopMostWindow/WindowInjection/${{ inputs.platform }}/${{ inputs.configuration }}
     steps:
       - name: Add MSBuild to PATH
-        uses: microsoft/setup-msbuild@6fb02220983dee41ce7ae257b6f4d8f9bf5ed4ce # v2
+        uses: microsoft/setup-msbuild@v2
 
       - name: Download the source code
         run: |
           git clone https://github.com/rustdesk-org/RustDeskTempTopMostWindow RustDeskTempTopMostWindow
 
+        # Build. commit 53b548a5398624f7149a382000397993542ad796 is tag v0.3
       - name: Build the project
         run: |
-          cd RustDeskTempTopMostWindow && git checkout ecd8d6a139eee76845ea66423fb739af450fda90
+          cd RustDeskTempTopMostWindow && git checkout 53b548a5398624f7149a382000397993542ad796
           msbuild ${{ env.project_path }} -p:Configuration=${{ inputs.configuration }} -p:Platform=${{ inputs.platform }} /p:TargetVersion=${{ inputs.target_version }}
 
       - name: Archive build artifacts
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@master
         if: ${{ inputs.upload-artifact }}
         with:
-            name: topmostwindow-artifacts-${{ inputs.platform }}
+            name: topmostwindow-artifacts
             path: |
               ./${{ env.build_output_dir }}/WindowInjection.dll

.github/workflows/update-webpki-roots.yml

@@ -1,75 +0,0 @@
-name: Update webpki-roots
-
-# Weekly refresh of the compiled-in TLS root certificates (the webpki-roots
-# crate, a snapshot of the Mozilla root store). Roots are otherwise frozen at
-# whatever Cargo.lock pins, so old builds miss newly added CAs and keep
-# removed (distrusted) ones. Changes go through a PR on purpose: added or
-# removed roots should be reviewed, not silently baked into releases.
-#
-# Note: PRs created with the default GITHUB_TOKEN do not trigger other
-# workflows (GitHub limitation). Close and reopen the PR, or push to its
-# branch, to run CI on it.
-
-on:
-  schedule:
-    - cron: "0 3 * * 1"
-  workflow_dispatch:
-
-# A manual dispatch overlapping the weekly run would race it force-pushing
-# the same branch; queue instead of overlapping, and never cancel a run
-# that may have already pushed.
-concurrency:
-  group: update-webpki-roots
-  cancel-in-progress: false
-
-jobs:
-  update:
-    runs-on: ubuntu-latest
-    permissions:
-      contents: write
-      pull-requests: write
-    env:
-      BRANCH: auto-update-webpki-roots
-    steps:
-      - name: Checkout source code
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
-        with:
-          # The root workspace lists libs/hbb_common as a member; without the
-          # submodule its manifest is missing and cargo cannot load the workspace.
-          submodules: recursive
-
-      - name: Update webpki-roots in all lockfiles
-        id: update
-        run: |
-          set -e
-          git ls-files -z '*Cargo.lock' | while IFS= read -r -d '' lock; do
-            dir=$(dirname "$lock")
-            for v in $(sed -n '/name = "webpki-roots"/{n;s/.*version = "\(.*\)"/\1/p;}' "$lock" | sort -u); do
-              echo "updating webpki-roots@$v in $dir"
-              (cd "$dir" && cargo update -p "webpki-roots@$v")
-            done
-          done
-          if git diff --quiet -- '*Cargo.lock'; then
-            echo "changed=0" >> "$GITHUB_OUTPUT"
-          else
-            echo "changed=1" >> "$GITHUB_OUTPUT"
-            git --no-pager diff -- '*Cargo.lock'
-          fi
-
-      - name: Create pull request
-        if: steps.update.outputs.changed == '1'
-        env:
-          GH_TOKEN: ${{ github.token }}
-        run: |
-          set -e
-          git config user.name "github-actions[bot]"
-          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
-          git checkout -B "$BRANCH"
-          git add -- '*Cargo.lock'
-          git commit -m "chore: update webpki-roots to latest Mozilla root store"
-          git push -f origin "$BRANCH"
-          if [ -z "$(gh pr list --head "$BRANCH" --state open --json number --jq '.[].number')" ]; then
-            gh pr create \
-              --title "chore: update webpki-roots to latest Mozilla root store" \
-              --body "Automated weekly refresh of the compiled-in TLS root certificates (webpki-roots). Please review the added/removed roots. CI does not run automatically on PRs created by GITHUB_TOKEN; close and reopen this PR to trigger it."
-          fi

.gitignore

@@ -56,5 +56,5 @@ vcpkg_installed
 flutter/lib/generated_plugin_registrant.dart
 libsciter.dylib
 flutter/web/
-# libdrmtap is cloned at build time by build.py (not a submodule)
-/third_party/libdrmtap/
+# Local git worktrees
+.worktrees/

AGENTS.md

@@ -53,6 +53,30 @@
 * Use `spawn_blocking` or dedicated threads for blocking work.
 * Do not use `std::thread::sleep()` in async code.
 
+## Flutter Rust Bridge
+
+* Do **not** run `flutter_rust_bridge_codegen` — it requires a specific pinned version that is not easy to set up locally.
+* When adding new FFI functions in `src/flutter_ffi.rs`, hand-write the corresponding Dart wrappers instead of regenerating.
+* Web bridge (committed): edit `flutter/lib/web/bridge.dart` directly. Follow the existing patterns there for `SyncReturn<T>` / `Future<T>` and the `dart:js` glue.
+* Native bridge (`flutter/lib/generated_bridge.dart`, `src/bridge_generated.rs`, `src/bridge_generated.io.rs`): these are gitignored and regenerated by the project's CI codegen. Manually editing them locally is fine for development testing, but those edits do not persist into commits.
+
+## Web (Flutter Web) Architecture
+
+Flutter Web in this repo is **not** "Dart compiled to JS via Flutter alone". The runtime is split:
+
+* **Native targets (Win/Mac/Linux/Android/iOS)**: Rust drives sessions via `flutter_rust_bridge`; Dart only renders UI.
+* **Web target**: Rust does **not** run. There is a separate hand-written TypeScript / JavaScript client at `flutter/web/js/` (gitignored — not present in this repo, lives in the maintainer's local tree). It owns connection, codec, keyboard, clipboard, etc. — basically a JS port of the Rust client. The Dart UI talks to it through `flutter/lib/web/bridge.dart`, which uses `dart:js` to call JS-side functions and to register Dart-side callbacks on `window.*`.
+
+Implications when adding any session-runtime feature (keyboard, clipboard, audio, …):
+
+* The Rust implementation in `src/` is for **native only**. Don't try to compile it to wasm.
+* The matching Web-side logic must be written in TS/JS under `flutter/web/js/src/`. It's a translation of the Rust logic, usually simpler — Web is single-window, so any per-session-id plumbing in Rust collapses to a single global on Web.
+* `flutter/lib/web/bridge.dart` is the only place where Dart sees JS. Other Dart code stays platform-agnostic and goes through `bind`. Don't sprinkle `if (isWeb)` runtime branches in shared Dart files to call Web-specific logic — put the platform divergence in the bridge.
+* For JS → Dart events (e.g., a Web matcher firing), the convention is: Dart sets `js.context['onFooBar'] = (...) {...}` once at startup (typically in `mainInit`); the JS side calls `window.onFooBar(...)`. See `onLoadAbFinished`, `onLoadGroupFinished` for reference.
+* The maintainer cannot easily run `flutter_rust_bridge_codegen`, so when a new FFI function lands in `src/flutter_ffi.rs`:
+  1. add the Web counterpart to `flutter/lib/web/bridge.dart` by hand;
+  2. note that on the Web target it may need to be a no-op or a JS bridge call rather than a real Rust invocation.
+
 ## Editing Hygiene
 
 * Change only what is required.
@@ -60,72 +84,3 @@
 * Do not refactor unrelated code.
 * Do not make formatting-only changes.
 * Keep naming/style consistent with nearby code.
-
-### Comments
-
-* Avoid comments unless they explain a non-obvious reason, constraint, or workaround.
-* Never restate what the code does; prefer clearer code instead.
-* If the code is self-explanatory, add no comment.
-
-### Be minimally invasive
-
-* Prefer purely additive changes: layer new (`#[cfg]`-gated) blocks or new functions around existing code instead of restructuring it. The ideal diff for a fix adds lines and modifies/deletes none.
-* Do not extract or reshape existing code just to enable your new code; look for a mechanism that leaves existing lines untouched (e.g. hide/show an existing object instead of refactoring its construction into a helper for rebuilding).
-* Accept a little duplication over a restructure. A new function that repeats a few lines of an existing one is a better diff than reshaping the original so both can share it.
-* Put new logic in self-contained functions in the module it belongs to (platform-specific logic in `src/platform/`, with `use` inside the function body to avoid churning shared import blocks). Call sites in shared files (`src/tray.rs`, `src/core_main.rs`, `src/server/connection.rs`, …) should be thin one-line hooks.
-
-### Scope check before touching shared code
-
-* Before changing a shared trait, a shared struct, or the signature of a widely used function, check whether the bug or feature is specific to one path. If it is, keep the change inside that path unless that is impossible, and say in the PR why it was.
-* If an unrelated caller needs `Default::default()`, `None`, or another placeholder solely to satisfy a signature you changed, the diff is too broad: stop and redesign.
-* The expected shape of a fix is a new function in the feature's own module, plus at most a new field or a thin hook in the shared code it needs. Feature-specific state belongs beside the feature's existing state, not in a new abstraction every caller has to learn.
-
-### Mandatory regression-surface check
-
-Before considering any implementation complete, perform a minimization pass over the final diff.
-
-* Inspect every modified existing file and every modified existing code path. Each must be strictly necessary for the requested change. Revert changes that are merely cleanup, refactoring, consistency improvements, or fixes for pre-existing issues.
-* For new features, preserve the existing implementation path when the feature is disabled or unsupported whenever practical. `feature off` should run the old code, not a rewritten equivalent.
-* Do not route existing behavior through a new abstraction merely to share code with the new feature. Prefer a parallel new function or a small amount of duplication over changing a proven existing path.
-* Keep new implementation logic in new or feature-specific modules. Changes to shared/core files should normally be thin hooks, capability checks, or protocol plumbing.
-* Do not fix unrelated pre-existing bugs in the same PR. Put them in a separate change unless they directly block correctness or security of the requested work.
-* For submodule bumps, inspect the exact commit range and ensure unrelated changes are not being pulled into the parent PR.
-* Before finalizing, explicitly report the regression surface: list the existing files and existing runtime paths whose behavior changed, and explain why each change is unavoidable.
-* During review, treat an unnecessarily modified legacy path as a review finding even if tests pass and the rewritten behavior appears equivalent.
-
-## Reviewing a PR
-
-* Review only what the diff introduces. Verify ownership with `gh pr diff` before reporting a finding — if the offending lines are untouched context, it is a pre-existing problem, not this PR's.
-* List pre-existing problems in a separate section at the end, or leave out the ones that are not fatal. Never mix them into the findings the author has to fix.
-* Before re-reviewing, read the author's reply comments. Do not re-raise items they declined on scope grounds.
-* State a finding's consequence exactly: distinguish "the value is lost" from "the shortcut is inert but the value still saves".
-
-## Localization (`src/lang/*.rs`)
-
-Each file is a `HashMap<key, translation>`. Layout:
-
-* `template.rs` is the master list of every key. **Never edit it** as part of translation work.
-* `en.rs` holds only the keys whose English display text differs from the key itself.
-* Every other file (`de.rs`, `fr.rs`, …) carries the full key set; an untranslated entry has an empty value: `("key", "")`.
-
-### Finding the English source for a key
-
-When filling an empty entry, determine the source English text with this rule:
-
-* If `key` exists in `en.rs` **with a non-empty value**, that value is the source text (look it up in `en.rs`).
-* Otherwise the **key string itself is the source text** (the key is already plain English).
-
-Then translate that source into the file's target language (infer the language from the file's existing non-empty entries / filename).
-
-### Translation hygiene
-
-* Only fill empty values. Never change keys, and never touch existing non-empty translations.
-* Preserve placeholders (`{}`) and escape sequences (`\n`, `\"`) exactly as in the source.
-* Do not translate brand or technical tokens: `RustDesk`, `Socks5`, `TLS`, `UAC`, `Wayland`, `X11`, `TCP`, `UDP`, `2FA`, `RDP`, `D3D`, etc.
-* Copy URL values (e.g. `doc_*` keys) verbatim from `en.rs`.
-
-### Adding new keys (feature work)
-
-* New English-text keys use sentence case, not Title Case: `Use ID whitelisting`, **not** `Use ID Whitelisting`. Acronyms (ID, IP, 2FA…) stay uppercase. Legacy Title-Case keys (e.g. `Use IP Whitelisting`) stay as-is — do not rename them.
-* Since the key itself is the English display text, a sentence-case key usually needs **no** `en.rs` entry; add one only when the display text must differ from the key (e.g. `*_tip` keys).
-* Append each new key to `template.rs` (with `""`) and to every `src/lang/*.rs` file (translated, or `""` if unsure), at the end of the list.

CLAUDE.md

@@ -1 +1 @@
-@AGENTS.md
+AGENTS.md

Cargo.lock

@@ -292,7 +292,7 @@ checksum = "e16d2d3311acee920a9eb8d33b8cbc1787ce4a264e85f964c2404b969bdcd487"
 [[package]]
 name = "arboard"
 version = "3.4.0"
-source = "git+https://github.com/rustdesk-org/arboard#c7d5781f563176df9efd8df6287e823fb1b9bed5"
+source = "git+https://github.com/rustdesk-org/arboard#85be1218668ff218a7b170c9d424fde73e069914"
 dependencies = [
  "clipboard-win",
  "core-graphics 0.23.2",
@@ -771,26 +771,6 @@ dependencies = [
  "syn 2.0.98",
 ]
 
-[[package]]
-name = "bindgen"
-version = "0.72.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "993776b509cfb49c750f11b8f07a46fa23e0a1386ffc01fb1e7d343efc387895"
-dependencies = [
- "bitflags 2.9.1",
- "cexpr",
- "clang-sys",
- "itertools 0.12.1",
- "log",
- "prettyplease",
- "proc-macro2 1.0.93",
- "quote 1.0.36",
- "regex",
- "rustc-hash 2.1.1",
- "shlex",
- "syn 2.0.98",
-]
-
 [[package]]
 name = "bit_field"
 version = "0.10.2"
@@ -986,6 +966,27 @@ dependencies = [
  "serde 1.0.228",
 ]
 
+[[package]]
+name = "bzip2"
+version = "0.4.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bdb116a6ef3f6c3698828873ad02c3014b3c85cadb88496095628e3ef1e347f8"
+dependencies = [
+ "bzip2-sys",
+ "libc",
+]
+
+[[package]]
+name = "bzip2-sys"
+version = "0.1.11+1.0.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "736a955f3fa7875102d57c82b8cac37ec45224a07fd32d58f9f7a186b6cd4cdc"
+dependencies = [
+ "cc",
+ "libc",
+ "pkg-config",
+]
+
 [[package]]
 name = "cacao"
 version = "0.4.0-beta2"
@@ -1323,7 +1324,7 @@ dependencies = [
 [[package]]
 name = "clipboard-master"
 version = "4.0.0-beta.6"
-source = "git+https://github.com/rustdesk-org/clipboard-master#7762d74e38db37cfeb6ded88c964b9cdbddfb6db"
+source = "git+https://github.com/rustdesk-org/clipboard-master#ddc39f00a6211959489ae683aa6ae6eedf03a809"
 dependencies = [
  "objc",
  "objc-foundation",
@@ -1456,8 +1457,6 @@ dependencies = [
  "compression-core",
  "flate2",
  "memchr",
- "zstd",
- "zstd-safe",
 ]
 
 [[package]]
@@ -1528,6 +1527,12 @@ dependencies = [
  "unicode-xid 0.2.4",
 ]
 
+[[package]]
+name = "constant_time_eq"
+version = "0.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "245097e9a4535ee1e3e3931fcfcd55a796a44c643e8596ff6566d68f09b87bbc"
+
 [[package]]
 name = "constant_time_eq"
 version = "0.2.6"
@@ -2689,7 +2694,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "39cab71617ae0d63f51a36d69f866391735b51691dbda63cf6f96d042b63efeb"
 dependencies = [
  "libc",
- "windows-sys 0.61.2",
+ "windows-sys 0.52.0",
 ]
 
 [[package]]
@@ -3047,8 +3052,9 @@ checksum = "e6d5a32815ae3f33302d95fdcb2ce17862f8c65363dcfd29360480ba1001fc9c"
 
 [[package]]
 name = "fuser"
-version = "0.16.0"
-source = "git+https://github.com/rustdesk-org/fuser?branch=refact/tag-0.16.0-cargo-1.75.0#a3c0babe4a533f8dbcff5bce59ae7f2424b8d877"
+version = "0.15.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "53274f494609e77794b627b1a3cddfe45d675a6b2e9ba9c0fdc8d8eee2184369"
 dependencies = [
  "libc",
  "log",
@@ -3791,14 +3797,14 @@ dependencies = [
  "toml 0.7.8",
  "tungstenite",
  "url",
- "users",
+ "users 0.11.0",
  "uuid",
- "webpki-roots 1.0.9",
+ "webpki-roots 1.0.4",
  "webrtc",
  "whoami",
  "winapi 0.3.9",
  "x11 2.21.0",
- "zstd",
+ "zstd 0.13.1",
 ]
 
 [[package]]
@@ -3946,7 +3952,7 @@ checksum = "9a3a5bfb195931eeb336b2a7b4d761daec841b97f947d34394601737a7bba5e4"
 [[package]]
 name = "hwcodec"
 version = "0.7.1"
-source = "git+https://github.com/rustdesk-org/hwcodec#778df1f99597722473b29443bac22ae6c23946fe"
+source = "git+https://github.com/rustdesk-org/hwcodec#398e5a8938dd8768ade0fcdc27ea80e8b4b38738"
 dependencies = [
  "bindgen 0.59.2",
  "cc",
@@ -3992,7 +3998,7 @@ dependencies = [
  "tokio",
  "tokio-rustls",
  "tower-service",
- "webpki-roots 1.0.9",
+ "webpki-roots 1.0.4",
 ]
 
 [[package]]
@@ -4689,7 +4695,7 @@ dependencies = [
 [[package]]
 name = "magnum-opus"
 version = "0.4.0"
-source = "git+https://github.com/rustdesk-org/magnum-opus#588c6e1f9ed50c3a01fa64f3bd3e7cdb0378a114"
+source = "git+https://github.com/rustdesk-org/magnum-opus#5cd2bf989c148662fa3a2d9d539a71d71fd1d256"
 dependencies = [
  "bindgen 0.59.2",
  "pkg-config",
@@ -5932,6 +5938,37 @@ dependencies = [
  "winapi 0.3.9",
 ]
 
+[[package]]
+name = "pam"
+version = "0.7.0"
+source = "git+https://github.com/rustdesk-org/pam#7bfd25510202cd269292cbdd7c71f3977a6fd762"
+dependencies = [
+ "libc",
+ "pam-macros",
+ "pam-sys",
+ "users 0.10.0",
+]
+
+[[package]]
+name = "pam-macros"
+version = "0.0.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c94f3b9b97df3c6d4e51a14916639b24e02c7d15d1dba686ce9b1118277cb811"
+dependencies = [
+ "proc-macro2 1.0.93",
+ "quote 1.0.36",
+ "syn 1.0.109",
+]
+
+[[package]]
+name = "pam-sys"
+version = "1.0.0-alpha4"
+source = "git+https://github.com/rustdesk-org/pam-sys?branch=fix/v1.0.0-alpha4_gnuc_va_list#3337c9bb9a9c68d7497ec8c93cad2368c26091b7"
+dependencies = [
+ "bindgen 0.59.2",
+ "libc",
+]
+
 [[package]]
 name = "pango"
 version = "0.18.3"
@@ -5959,8 +5996,8 @@ dependencies = [
 
 [[package]]
 name = "parity-tokio-ipc"
-version = "0.7.3-6"
-source = "git+https://github.com/rustdesk-org/parity-tokio-ipc#d0ae39bffe5d5a3e8d82a1b6bcb1ca5a9b2f1c01"
+version = "0.7.3-5"
+source = "git+https://github.com/rustdesk-org/parity-tokio-ipc#c8c8bbcbabf9be1201c53afb0269b92b9b02d291"
 dependencies = [
  "futures",
  "libc",
@@ -5999,12 +6036,35 @@ dependencies = [
  "windows-targets 0.52.6",
 ]
 
+[[package]]
+name = "password-hash"
+version = "0.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7676374caaee8a325c9e7a2ae557f216c5563a171d6997b0ef8a65af35147700"
+dependencies = [
+ "base64ct",
+ "rand_core 0.6.4",
+ "subtle",
+]
+
 [[package]]
 name = "paste"
 version = "1.0.15"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "57c0d7b74b563b49d38dae00a0c37d4d6de9b432382b2892f0574ddcae73fd0a"
 
+[[package]]
+name = "pbkdf2"
+version = "0.11.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "83a0692ec44e4cf1ef28ca317f14f8f07da2d95ec3fa01f86e4467b725e60917"
+dependencies = [
+ "digest",
+ "hmac",
+ "password-hash",
+ "sha2",
+]
+
 [[package]]
 name = "peeking_take_while"
 version = "0.1.2"
@@ -6528,7 +6588,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "556af5f5c953a2ee13f45753e581a38f9778e6551bc3ccc56d90b14628fe59d8"
 dependencies = [
  "cfg-if 0.1.10",
- "rpassword",
+ "rpassword 2.1.0",
  "tempfile",
  "termios 0.3.3",
  "winapi 0.3.9",
@@ -6613,7 +6673,7 @@ dependencies = [
  "once_cell",
  "socket2 0.5.10",
  "tracing",
- "windows-sys 0.60.2",
+ "windows-sys 0.52.0",
 ]
 
 [[package]]
@@ -6860,7 +6920,7 @@ dependencies = [
 [[package]]
 name = "rdev"
 version = "0.5.0-2"
-source = "git+https://github.com/rustdesk-org/rdev#23e24dd6b35452a495dae0ae6d99395e9755ab0f"
+source = "git+https://github.com/rustdesk-org/rdev#f9b60b1dd0f3300a1b797d7a74c116683cd232c8"
 dependencies = [
  "cocoa 0.24.1",
  "core-foundation 0.9.4",
@@ -7030,7 +7090,7 @@ dependencies = [
  "wasm-bindgen",
  "wasm-bindgen-futures",
  "web-sys",
- "webpki-roots 1.0.9",
+ "webpki-roots 1.0.4",
 ]
 
 [[package]]
@@ -7092,6 +7152,17 @@ dependencies = [
  "winapi 0.2.8",
 ]
 
+[[package]]
+name = "rpassword"
+version = "7.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "80472be3c897911d0137b2d2b9055faf6eeac5b14e324073d83bc17b191d7e3f"
+dependencies = [
+ "libc",
+ "rtoolbox",
+ "windows-sys 0.48.0",
+]
+
 [[package]]
 name = "rtcp"
 version = "0.14.0"
@@ -7103,6 +7174,16 @@ dependencies = [
  "webrtc-util",
 ]
 
+[[package]]
+name = "rtoolbox"
+version = "0.0.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c247d24e63230cdb56463ae328478bd5eac8b8faa8c69461a77e8e323afac90e"
+dependencies = [
+ "libc",
+ "windows-sys 0.48.0",
+]
+
 [[package]]
 name = "rtp"
 version = "0.14.0"
@@ -7130,6 +7211,18 @@ dependencies = [
  "realfft",
 ]
 
+[[package]]
+name = "runas"
+version = "1.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b96d6b6c505282b007a9b009f2aa38b2fd0359b81a0430ceacc60f69ade4c6a0"
+dependencies = [
+ "libc",
+ "security-framework-sys",
+ "which",
+ "windows-sys 0.48.0",
+]
+
 [[package]]
 name = "rust-ini"
 version = "0.18.0"
@@ -7177,7 +7270,7 @@ dependencies = [
 
 [[package]]
 name = "rustdesk"
-version = "1.5.0"
+version = "1.4.6"
 dependencies = [
  "android-wakelock",
  "android_logger",
@@ -7190,6 +7283,7 @@ dependencies = [
  "cfg-if 1.0.0",
  "chrono",
  "cidr-utils",
+ "clap 4.5.53",
  "clipboard",
  "clipboard-master",
  "cocoa 0.24.1",
@@ -7235,6 +7329,7 @@ dependencies = [
  "once_cell",
  "openssl",
  "os-version",
+ "pam",
  "parity-tokio-ipc",
  "percent-encoding",
  "piet",
@@ -7246,7 +7341,9 @@ dependencies = [
  "repng",
  "reqwest",
  "ringbuf",
+ "rpassword 7.3.1",
  "rubato",
+ "runas",
  "rust-pulsectl",
  "samplerate",
  "sciter-rs",
@@ -7283,11 +7380,12 @@ dependencies = [
  "wol-rs",
  "x11-clipboard 0.8.1",
  "x11rb 0.12.0",
+ "zip",
 ]
 
 [[package]]
 name = "rustdesk-portable-packer"
-version = "1.5.0"
+version = "1.4.6"
 dependencies = [
  "brotli",
  "dirs 5.0.1",
@@ -7359,7 +7457,7 @@ dependencies = [
  "errno",
  "libc",
  "linux-raw-sys 0.11.0",
- "windows-sys 0.61.2",
+ "windows-sys 0.52.0",
 ]
 
 [[package]]
@@ -7416,7 +7514,7 @@ dependencies = [
  "security-framework 3.5.1",
  "security-framework-sys",
  "webpki-root-certs",
- "windows-sys 0.61.2",
+ "windows-sys 0.52.0",
 ]
 
 [[package]]
@@ -7503,7 +7601,7 @@ name = "scrap"
 version = "0.5.0"
 dependencies = [
  "android_logger",
- "bindgen 0.72.1",
+ "bindgen 0.65.1",
  "block",
  "cfg-if 1.0.0",
  "dbus",
@@ -8729,7 +8827,7 @@ dependencies = [
  "tokio-native-tls",
  "tokio-rustls",
  "tungstenite",
- "webpki-roots 0.26.11",
+ "webpki-roots 0.26.9",
 ]
 
 [[package]]
@@ -8824,7 +8922,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "6c4ae9724c5888c0417d2396037ed3b60665925624766416e3e342b6ba5dbd3f"
 dependencies = [
  "base32",
- "constant_time_eq",
+ "constant_time_eq 0.2.6",
  "hmac",
  "rand 0.8.5",
  "sha1",
@@ -9043,7 +9141,7 @@ dependencies = [
  "sha1",
  "thiserror 2.0.17",
  "utf-8",
- "webpki-roots 0.26.11",
+ "webpki-roots 0.26.9",
 ]
 
 [[package]]
@@ -9269,6 +9367,16 @@ version = "2.1.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "daf8dba3b7eb870caf1ddeed7bc9d2a049f3cfdfae7cb521b087cc33ae4c49da"
 
+[[package]]
+name = "users"
+version = "0.10.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "aa4227e95324a443c9fcb06e03d4d85e91aabe9a5a02aa818688b6918b6af486"
+dependencies = [
+ "libc",
+ "log",
+]
+
 [[package]]
 name = "users"
 version = "0.11.0"
@@ -9625,9 +9733,9 @@ dependencies = [
 
 [[package]]
 name = "wayland-protocols-wlr"
-version = "0.3.9"
+version = "0.3.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "efd94963ed43cf9938a090ca4f7da58eb55325ec8200c3848963e98dc25b78ec"
+checksum = "fd993de54a40a40fbe5601d9f1fbcaef0aebcc5fda447d7dc8f6dcbaae4f8953"
 dependencies = [
  "bitflags 2.9.1",
  "wayland-backend",
@@ -9706,18 +9814,18 @@ dependencies = [
 
 [[package]]
 name = "webpki-roots"
-version = "0.26.11"
+version = "0.26.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "521bc38abb08001b01866da9f51eb7c5d647a19260e00054a8c7fd5f9e57f7a9"
+checksum = "29aad86cec885cafd03e8305fd727c418e970a521322c91688414d5b8efba16b"
 dependencies = [
- "webpki-roots 1.0.9",
+ "rustls-pki-types",
 ]
 
 [[package]]
 name = "webpki-roots"
-version = "1.0.9"
+version = "1.0.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7dcd9d09a39985f5344844e66b0c530a33843579125f23e21e9f0f220850f22a"
+checksum = "b2878ef029c47c6e8cf779119f20fcf52bde7ad42a731b2a304bc221df17571e"
 dependencies = [
  "rustls-pki-types",
 ]
@@ -10730,15 +10838,16 @@ dependencies = [
 
 [[package]]
 name = "wl-clipboard-rs"
-version = "0.9.3"
+version = "0.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e9651471a32e87d96ef3a127715382b2d11cc7c8bb9822ded8a7cc94072eb0a3"
+checksum = "4de22eebb1d1e2bad2d970086e96da0e12cde0b411321e5b0f7b2a1f876aa26f"
 dependencies = [
  "libc",
  "log",
  "os_pipe",
- "rustix 1.1.2",
- "thiserror 2.0.17",
+ "rustix 0.38.34",
+ "tempfile",
+ "thiserror 1.0.61",
  "tree_magic_mini",
  "wayland-backend",
  "wayland-client",
@@ -11064,13 +11173,52 @@ dependencies = [
  "syn 2.0.98",
 ]
 
+[[package]]
+name = "zip"
+version = "0.6.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "760394e246e4c28189f19d488c058bf16f564016aefac5d32bb1f3b51d5e9261"
+dependencies = [
+ "aes",
+ "byteorder",
+ "bzip2",
+ "constant_time_eq 0.1.5",
+ "crc32fast",
+ "crossbeam-utils",
+ "flate2",
+ "hmac",
+ "pbkdf2",
+ "sha1",
+ "time 0.3.36",
+ "zstd 0.11.2+zstd.1.5.2",
+]
+
+[[package]]
+name = "zstd"
+version = "0.11.2+zstd.1.5.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "20cc960326ece64f010d2d2107537f26dc589a6573a316bd5b1dba685fa5fde4"
+dependencies = [
+ "zstd-safe 5.0.2+zstd.1.5.2",
+]
+
 [[package]]
 name = "zstd"
 version = "0.13.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "2d789b1514203a1120ad2429eae43a7bd32b90976a7bb8a05f7ec02fa88cc23a"
 dependencies = [
- "zstd-safe",
+ "zstd-safe 7.1.0",
+]
+
+[[package]]
+name = "zstd-safe"
+version = "5.0.2+zstd.1.5.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1d2a5585e04f9eea4b2a3d1eca508c4dee9592a89ef6f450c11719da0726f4db"
+dependencies = [
+ "libc",
+ "zstd-sys",
 ]
 
 [[package]]

Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "rustdesk"
-version = "1.5.0"
+version = "1.4.6"
 authors = ["rustdesk <info@rustdesk.com>"]
 edition = "2021"
 build= "build.rs"
@@ -22,6 +22,7 @@ path = "src/service.rs"
 
 [features]
 inline = []
+cli = []
 use_samplerate = ["samplerate"]
 use_rubato = ["rubato"]
 use_dasp = ["dasp"]
@@ -30,13 +31,7 @@ default = ["use_dasp"]
 hwcodec = ["scrap/hwcodec"]
 vram = ["scrap/vram"]
 mediacodec = ["scrap/mediacodec"]
-drm = ["scrap/drm"]
-# The display wake, as its OWN compile gate on top of `drm`. Everything else in the drm backend
-# READS (it captures a scanout); the wake WRITES, injecting one synthetic pointer event from the
-# root service so a compositor that idle-disabled its outputs re-enables them. That is a different
-# kind of operation and deserves a switch that can remove it from the binary entirely, without
-# giving up DRM capture: `--features drm` builds the capture path with no wake code compiled in.
-drm-wake = ["drm"]
+plugin_framework = []
 linux-pkg-config = ["magnum-opus/linux-pkg-config", "scrap/linux-pkg-config"]
 unix-file-copy-paste = [
     "dep:x11-clipboard",
@@ -67,6 +62,8 @@ dasp = { version = "0.11", features = ["signal", "interpolate-linear", "interpol
 rubato = { version = "0.12", optional = true }
 samplerate = { version = "0.2", optional = true }
 uuid = { version = "1.3", features = ["v4"] }
+clap = "4.2"
+rpassword = "7.2"
 num_cpus = "1.15"
 bytes = { version = "1.4", features = ["serde"] }
 default-net = "0.14"
@@ -80,11 +77,12 @@ hex = "0.4"
 chrono = "0.4"
 cidr-utils = "0.5"
 fon = "0.6"
+zip = "0.6"
 shutdown_hooks = "0.1"
 totp-rs = { version = "5.4", default-features = false, features = ["gen_secret", "otpauth"] }
 stunclient = "0.4"
 kcp-sys= { git = "https://github.com/rustdesk-org/kcp-sys"}
-reqwest = { version = "0.12", features = ["blocking", "socks", "json", "native-tls", "rustls-tls", "rustls-tls-native-roots", "gzip", "zstd"], default-features=false }
+reqwest = { version = "0.12", features = ["blocking", "socks", "json", "native-tls", "rustls-tls", "rustls-tls-native-roots", "gzip"], default-features=false }
 
 [target.'cfg(not(target_os = "linux"))'.dependencies]
 # https://github.com/rustdesk/rustdesk/discussions/10197, not use cpal on linux
@@ -129,18 +127,14 @@ windows = { version = "0.61", features = [
     "Win32_Security_Authorization",
     "Win32_Storage_FileSystem",
     "Win32_System",
-    "Win32_System_Com",
     "Win32_System_Diagnostics",
     "Win32_System_Diagnostics_ToolHelp",
     "Win32_System_Environment",
     "Win32_System_IO",
     "Win32_System_Memory",
     "Win32_System_Pipes",
-    "Win32_System_Registry",
-    "Win32_System_SystemInformation",
     "Win32_System_Threading",
     "Win32_UI_Shell",
-    "Win32_UI_WindowsAndMessaging",
 ] }
 winreg = "0.11"
 windows-service = "0.6"
@@ -149,6 +143,7 @@ remote_printer = { path = "libs/remote_printer" }
 impersonate_system = { git = "https://github.com/rustdesk-org/impersonate-system" }
 shared_memory = "0.12"
 tauri-winrt-notification = "0.1"
+runas = "1.2"
 
 [target.'cfg(target_os = "macos")'.dependencies]
 objc = "0.2"
@@ -189,6 +184,7 @@ async-process = "1.7"
 evdev = { git="https://github.com/rustdesk-org/evdev" }
 dbus = "0.9"
 dbus-crossroads = "0.5"
+pam = { git="https://github.com/rustdesk-org/pam" }
 x11-clipboard = {git="https://github.com/clslaid/x11-clipboard", branch = "feat/store-batch", optional = true}
 x11rb =  {version = "0.12", features = ["all-extensions"], optional = true}
 percent-encoding = {version = "2.3", optional = true}
@@ -209,7 +205,7 @@ android-wakelock = { git = "https://github.com/rustdesk-org/android-wakelock" }
 
 [workspace]
 members = ["libs/scrap", "libs/hbb_common", "libs/enigo", "libs/clipboard", "libs/virtual_display", "libs/virtual_display/dylib", "libs/portable", "libs/remote_printer"]
-exclude = ["vdi/host"]
+exclude = ["vdi/host", "examples/custom_plugin"]
 
 # Patch libxdo-sys to use a stub implementation that doesn't require libxdo
 # This allows building and running on systems without libxdo installed (e.g., Wayland-only)
@@ -217,7 +213,7 @@ exclude = ["vdi/host"]
 libxdo-sys = { path = "libs/libxdo-sys-stub" }
 
 [package.metadata.winres]
-LegalCopyright = "Copyright © 2026 Purslane Tech Pte. Ltd. All rights reserved."
+LegalCopyright = "Copyright © 2025 Purslane Ltd. All rights reserved."
 ProductName = "RustDesk"
 FileDescription = "RustDesk Remote Desktop"
 OriginalFilename = "rustdesk.exe"

Dockerfile

@@ -19,6 +19,7 @@ RUN apt update -y && \
         libxcb-shape0-dev \
         libxcb-xfixes0-dev \
         libasound2-dev \
+        libpam0g-dev \
         libpulse-dev \
         make \
         wget \

README.md

@@ -3,7 +3,7 @@
   <a href="#raw-steps-to-build">Build</a> •
   <a href="#how-to-build-with-docker">Docker</a> •
   <a href="#file-structure">Structure</a> •
-  <a href="#screenshots">Screenshots</a><br>
+  <a href="#snapshot">Snapshot</a><br>
   [<a href="docs/README-UA.md">Українська</a>] | [<a href="docs/README-CS.md">česky</a>] | [<a href="docs/README-ZH.md">中文</a>] | [<a href="docs/README-HU.md">Magyar</a>] | [<a href="docs/README-ES.md">Español</a>] | [<a href="docs/README-FA.md">فارسی</a>] | [<a href="docs/README-FR.md">Français</a>] | [<a href="docs/README-DE.md">Deutsch</a>] | [<a href="docs/README-PL.md">Polski</a>] | [<a href="docs/README-ID.md">Indonesian</a>] | [<a href="docs/README-FI.md">Suomi</a>] | [<a href="docs/README-ML.md">മലയാളം</a>] | [<a href="docs/README-JP.md">日本語</a>] | [<a href="docs/README-NL.md">Nederlands</a>] | [<a href="docs/README-IT.md">Italiano</a>] | [<a href="docs/README-RU.md">Русский</a>] | [<a href="docs/README-PTBR.md">Português (Brasil)</a>] | [<a href="docs/README-EO.md">Esperanto</a>] | [<a href="docs/README-KR.md">한국어</a>] | [<a href="docs/README-AR.md">العربي</a>] | [<a href="docs/README-VN.md">Tiếng Việt</a>] | [<a href="docs/README-DA.md">Dansk</a>] | [<a href="docs/README-GR.md">Ελληνικά</a>] | [<a href="docs/README-TR.md">Türkçe</a>] | [<a href="docs/README-NO.md">Norsk</a>] | [<a href="docs/README-RO.md">Română</a>]<br>
   <b>We need your help to translate this README, <a href="https://github.com/rustdesk/rustdesk/tree/master/src/lang">RustDesk UI</a> and <a href="https://github.com/rustdesk/doc.rustdesk.com">RustDesk Doc</a> to your native language</b>
 </p>
@@ -38,7 +38,7 @@ RustDesk welcomes contribution from everyone. See [CONTRIBUTING.md](docs/CONTRIB
 
 ## Dependencies
 
-Desktop versions use Flutter or Sciter (deprecated) for GUI. This tutorial is for Sciter only, since it is easier and more friendly to start. Check out our [CI](https://github.com/rustdesk/rustdesk/blob/master/.github/workflows/flutter-build.yml) for building the Flutter version.
+Desktop versions use Flutter or Sciter (deprecated) for GUI, this tutorial is for Sciter only, since it is easier and more friendly to start. Check out our [CI](https://github.com/rustdesk/rustdesk/blob/master/.github/workflows/flutter-build.yml) for building Flutter version.
 
 Please download Sciter dynamic library yourself.
 
@@ -66,19 +66,19 @@ Please download Sciter dynamic library yourself.
 ```sh
 sudo apt install -y zip g++ gcc git curl wget nasm yasm libgtk-3-dev clang libxcb-randr0-dev libxdo-dev \
         libxfixes-dev libxcb-shape0-dev libxcb-xfixes0-dev libasound2-dev libpulse-dev cmake make \
-        libclang-dev ninja-build libgstreamer1.0-dev libgstreamer-plugins-base1.0-dev
+        libclang-dev ninja-build libgstreamer1.0-dev libgstreamer-plugins-base1.0-dev libpam0g-dev
 ```
 
 ### openSUSE Tumbleweed
 
 ```sh
-sudo zypper install gcc-c++ git curl wget nasm yasm gcc gtk3-devel clang libxcb-devel libXfixes-devel cmake alsa-lib-devel gstreamer-devel gstreamer-plugins-base-devel xdotool-devel
+sudo zypper install gcc-c++ git curl wget nasm yasm gcc gtk3-devel clang libxcb-devel libXfixes-devel cmake alsa-lib-devel gstreamer-devel gstreamer-plugins-base-devel xdotool-devel pam-devel
 ```
 
 ### Fedora 28 (CentOS 8)
 
 ```sh
-sudo yum -y install gcc-c++ git curl wget nasm yasm gcc gtk3-devel clang libxcb-devel libxdo-devel libXfixes-devel pulseaudio-libs-devel cmake alsa-lib-devel gstreamer1-devel gstreamer1-plugins-base-devel
+sudo yum -y install gcc-c++ git curl wget nasm yasm gcc gtk3-devel clang libxcb-devel libxdo-devel libXfixes-devel pulseaudio-libs-devel cmake alsa-lib-devel gstreamer1-devel gstreamer1-plugins-base-devel pam-devel
 ```
 
 ### Arch (Manjaro)
@@ -168,6 +168,7 @@ Please ensure that you run these commands from the root of the RustDesk reposito
 - **[src/rendezvous_mediator.rs](https://github.com/rustdesk/rustdesk/tree/master/src/rendezvous_mediator.rs)**: Communicate with [rustdesk-server](https://github.com/rustdesk/rustdesk-server), wait for remote direct (TCP hole punching) or relayed connection
 - **[src/platform](https://github.com/rustdesk/rustdesk/tree/master/src/platform)**: platform specific code
 - **[flutter](https://github.com/rustdesk/rustdesk/tree/master/flutter)**: Flutter code for desktop and mobile
+- **[flutter/web/js](https://github.com/rustdesk/rustdesk/tree/master/flutter/web/v1/js)**: JavaScript for Flutter web client
 
 ## Screenshots
 

appimage/AppImageBuilder-aarch64.yml

@@ -18,7 +18,7 @@ AppDir:
     id: rustdesk
     name: rustdesk
     icon: rustdesk
-    version: 1.5.0
+    version: 1.4.6
     exec: usr/share/rustdesk/rustdesk
     exec_args: $@
   apt:
@@ -58,6 +58,7 @@ AppDir:
     - libpulse0
     - packagekit-gtk3-module
     - libcanberra-gtk3-module
+    - libpam0g
     - libdrm2
     exclude:
     - humanity-icon-theme
@@ -76,13 +77,6 @@ AppDir:
     env:
       GIO_MODULE_DIR: /lib64/gio/modules:/usr/lib/aarch64-linux-gnu/gio/modules:$APPDIR/usr/lib/aarch64-linux-gnu/gio/modules
       GDK_BACKEND: x11
-      # AppRun sets these to "$APPDIR/...:$XDG_DATA_DIRS", and setting them at all suppresses the XDG
-      # defaults, so a host that leaves them unset loses /usr/share and /etc/xdg. gdk-pixbuf 2.43+
-      # (Arch, Fedora) then finds no glycin loaders and every PNG decode fails, aborting on the first
-      # remote cursor. The host value goes last: unset it expands to an empty element, which GLib
-      # resolves against the CWD, and that must not outrank the defaults below.
-      XDG_DATA_DIRS: $APPDIR/usr/local/share:$APPDIR/usr/share:/usr/local/share:/usr/share:$XDG_DATA_DIRS
-      XDG_CONFIG_DIRS: $APPDIR/etc/xdg:/etc/xdg:$XDG_CONFIG_DIRS
       APPDIR_LIBRARY_PATH: /lib64:/usr/lib/aarch64-linux-gnu:$APPDIR/lib/aarch64-linux-gnu:$APPDIR/lib/aarch64-linux-gnu/security:$APPDIR/lib/systemd:$APPDIR/usr/lib/aarch64-linux-gnu:$APPDIR/usr/lib/aarch64-linux-gnu/gdk-pixbuf-2.0/2.10.0/loaders:$APPDIR/usr/lib/aarch64-linux-gnu/gstreamer-1.0:$APPDIR/usr/lib/aarch64-linux-gnu/gtk-3.0/3.0.0/immodules:$APPDIR/usr/lib/aarch64-linux-gnu/gtk-3.0/3.0.0/printbackends:$APPDIR/usr/lib/aarch64-linux-gnu/krb5/plugins/preauth:$APPDIR/usr/lib/aarch64-linux-gnu/libcanberra-0.30:$APPDIR/usr/lib/aarch64-linux-gnu/pulseaudio:$APPDIR/usr/lib/aarch64-linux-gnu/sasl2:$APPDIR/usr/lib/aarch64-linux-gnu/vdpau:$APPDIR/usr/share/rustdesk/lib:$APPDIR/lib/aarch64
       GST_PLUGIN_PATH: /lib64/gstreamer-1.0:/usr/lib/aarch64-linux-gnu/gstreamer-1.0:$APPDIR/usr/lib/aarch64-linux-gnu/gstreamer-1.0
       GST_PLUGIN_SYSTEM_PATH: /lib64/gstreamer-1.0:/usr/lib/aarch64-linux-gnu/gstreamer-1.0:$APPDIR/usr/lib/aarch64-linux-gnu/gstreamer-1.0

appimage/AppImageBuilder-x86_64.yml

@@ -18,7 +18,7 @@ AppDir:
     id: rustdesk
     name: rustdesk
     icon: rustdesk
-    version: 1.5.0
+    version: 1.4.6
     exec: usr/share/rustdesk/rustdesk
     exec_args: $@
   apt:
@@ -61,6 +61,7 @@ AppDir:
     - libpulse0
     - packagekit-gtk3-module
     - libcanberra-gtk3-module
+    - libpam0g
     - libdrm2
     exclude:
     - humanity-icon-theme
@@ -79,13 +80,6 @@ AppDir:
     env:
       GIO_MODULE_DIR: /lib64/gio/modules:/usr/lib/x86_64-linux-gnu/gio/modules:$APPDIR/usr/lib/x86_64-linux-gnu/gio/modules
       GDK_BACKEND: x11
-      # AppRun sets these to "$APPDIR/...:$XDG_DATA_DIRS", and setting them at all suppresses the XDG
-      # defaults, so a host that leaves them unset loses /usr/share and /etc/xdg. gdk-pixbuf 2.43+
-      # (Arch, Fedora) then finds no glycin loaders and every PNG decode fails, aborting on the first
-      # remote cursor. The host value goes last: unset it expands to an empty element, which GLib
-      # resolves against the CWD, and that must not outrank the defaults below.
-      XDG_DATA_DIRS: $APPDIR/usr/local/share:$APPDIR/usr/share:/usr/local/share:/usr/share:$XDG_DATA_DIRS
-      XDG_CONFIG_DIRS: $APPDIR/etc/xdg:/etc/xdg:$XDG_CONFIG_DIRS
       APPDIR_LIBRARY_PATH: /lib64:/usr/lib/x86_64-linux-gnu:$APPDIR/lib/x86_64-linux-gnu:$APPDIR/lib/x86_64-linux-gnu/security:$APPDIR/lib/systemd:$APPDIR/usr/lib/x86_64-linux-gnu:$APPDIR/usr/lib/x86_64-linux-gnu/gdk-pixbuf-2.0/2.10.0/loaders:$APPDIR/usr/lib/x86_64-linux-gnu/gstreamer-1.0:$APPDIR/usr/lib/x86_64-linux-gnu/gtk-3.0/3.0.0/immodules:$APPDIR/usr/lib/x86_64-linux-gnu/gtk-3.0/3.0.0/printbackends:$APPDIR/usr/lib/x86_64-linux-gnu/krb5/plugins/preauth:$APPDIR/usr/lib/x86_64-linux-gnu/libcanberra-0.30:$APPDIR/usr/lib/x86_64-linux-gnu/pulseaudio:$APPDIR/usr/lib/x86_64-linux-gnu/sasl2:$APPDIR/usr/lib/x86_64-linux-gnu/vdpau:$APPDIR/usr/share/rustdesk/lib:$APPDIR/lib/x86_64
       GST_PLUGIN_PATH: /lib64/gstreamer-1.0:/usr/lib/x86_64-linux-gnu/gstreamer-1.0:$APPDIR/usr/lib/x86_64-linux-gnu/gstreamer-1.0
       GST_PLUGIN_SYSTEM_PATH: /lib64/gstreamer-1.0:/usr/lib/x86_64-linux-gnu/gstreamer-1.0:$APPDIR/usr/lib/x86_64-linux-gnu/gstreamer-1.0

build.py

@@ -1,33 +1,23 @@
 #!/usr/bin/env python3
 
 import os
-import glob
-import contextlib
 import pathlib
 import platform
 import zipfile
 import urllib.request
 import shutil
 import hashlib
-import re
-import subprocess
 import argparse
 import sys
 from pathlib import Path
 
-# Captured at import, while cwd is still the repo root: before Python 3.9 the main script's __file__
-# stays relative (bpo-20443), so abspath() re-resolves it against the cwd -- and the ubuntu18.04
-# packaging container runs 3.6 and chdir's into flutter/ before it reaches the libdrmtap code.
-REPO_ROOT = os.path.dirname(os.path.abspath(__file__))
-
 windows = platform.platform().startswith('Windows')
 osx = platform.platform().startswith(
     'Darwin') or platform.platform().startswith("macOS")
 hbb_name = 'rustdesk' + ('.exe' if windows else '')
 exe_path = 'target/release/' + hbb_name
 if windows:
-    win_arch = 'arm64' if platform.machine().lower() in ('arm64', 'aarch64') else 'x64'
-    flutter_build_dir = f'build/windows/{win_arch}/runner/Release/'
+    flutter_build_dir = 'build/windows/x64/runner/Release/'
 elif osx:
     flutter_build_dir = 'build/macos/Build/Products/Release/'
 else:
@@ -139,19 +129,6 @@ def make_parser():
         action='store_true',
         help='Build with unix file copy paste feature'
     )
-    parser.add_argument(
-        '--drm',
-        action='store_true',
-        help='Linux only: build the DRM/KMS capture backend (bundles libdrmtap.so, '
-             'dlopen-ed in-process by the root service). Off by default.'
-    )
-    parser.add_argument(
-        '--print-features',
-        action='store_true',
-        help='Print the cargo feature list these flags select, and exit without building. For a '
-             'caller that runs its own cargo line and then packages with --skip-cargo: it can ask '
-             'for the list rather than repeat it, so the two cannot drift.'
-    )
     parser.add_argument(
         '--skip-cargo',
         action='store_true',
@@ -195,7 +172,7 @@ def generate_build_script_for_docker():
             # flutter_rust_bridge
             dart pub global activate ffigen --version 5.0.1
             pushd /tmp && git clone https://github.com/SoLongAndThanksForAllThePizza/flutter_rust_bridge --depth=1 && popd
-            pushd /tmp/flutter_rust_bridge/frb_codegen && cargo install --path . --locked && popd
+            pushd /tmp/flutter_rust_bridge/frb_codegen && cargo install --path . && popd
             pushd flutter && flutter pub get && popd
             ~/.cargo/bin/flutter_rust_bridge_codegen --rust-input ./src/flutter_ffi.rs --dart-output ./flutter/lib/generated_bridge.dart
             # install vcpkg
@@ -294,24 +271,6 @@ def external_resources(flutter, args, res_dir):
                 shutil.copytree(f, f'{flutter_build_dir_2}{f.stem}')
 
 
-def linux_packaging_branch():
-    """Which packaging path `main()` will take on THIS host.
-
-    MUST mirror the elif chain in main() (pacman / yum / zypper / else), and exists so `--drm` can
-    refuse a branch that is not drm-aware instead of silently producing a stock-named package with
-    the capture backend compiled in. Only the final `deb` branch reaches `build_flutter_deb`, which
-    is what bundles libdrmtap, renames the package, adds Conflicts/Provides and asserts the staged
-    binary really is a drm build.
-    """
-    if os.path.isfile('/usr/bin/pacman'):
-        return 'pacman'
-    if os.path.isfile('/usr/bin/yum'):
-        return 'yum'
-    if os.path.isfile('/usr/bin/zypper'):
-        return 'zypper'
-    return 'deb'
-
-
 def get_features(args):
     features = ['inline'] if not args.flutter else []
     if args.hwcodec:
@@ -322,30 +281,6 @@ def get_features(args):
         features.append('flutter')
     if args.unix_file_copy_paste:
         features.append('unix-file-copy-paste')
-    if args.drm:
-        # Say so rather than quietly handing back a stock build: the backend is Linux-only, so on
-        # any other host the flag cannot be honoured and the resulting binary would look like a
-        # DRM build without being one.
-        if windows or osx:
-            raise Exception('--drm is Linux only')
-        # And only on the deb branch. The other three Linux paths (pacman/yum/zypper) package
-        # straight from `target/release` without bundling libdrmtap, without the rename, without
-        # Conflicts/Provides and without assert_staged_binary_is_drm() -- so they would emit a
-        # package NAMED `rustdesk` carrying the consent-bypass backend and the root-side uinput
-        # injection. The separate package name is the informed consent this feature rests on, so
-        # refuse rather than ship a stock-named build of it.
-        branch = linux_packaging_branch()
-        if branch != 'deb':
-            raise Exception(
-                f'--drm is only supported on the deb packaging path; this host would package via '
-                f'{branch}, which cannot bundle libdrmtap or name the package distinctly')
-        features.append('drm')
-        # The display wake is its own compile gate on top of `drm`, and the unattended package is
-        # exactly where it belongs: that variant exists to reach a machine nobody is sitting at,
-        # and a machine whose screen went dark is the case it is for. Dropping `drm-wake` from
-        # this line builds the same capture backend with no wake code in the binary at all.
-        # It is ALSO switchable at runtime; see OPTION_ENABLE_DRM_DISPLAY_WAKE.
-        features.append('drm-wake')
     if osx:
         if args.screencapturekit:
             features.append('screencapturekit')
@@ -364,7 +299,7 @@ Version: %s
 Architecture: %s
 Maintainer: rustdesk <info@rustdesk.com>
 Homepage: https://rustdesk.com
-Depends: libgtk-3-0t64 | libgtk-3-0, libxcb-randr0, libxdo3 | libxdo4, libxfixes3, libxcb-shape0, libxcb-xfixes0, libasound2t64 | libasound2, libsystemd0, curl, libva2, libva-drm2, libva-x11-2, libgstreamer-plugins-base1.0-0, gstreamer1.0-pipewire%s
+Depends: libgtk-3-0, libxcb-randr0, libxdo3 | libxdo4, libxfixes3, libxcb-shape0, libxcb-xfixes0, libasound2, libsystemd0, curl, libva2, libva-drm2, libva-x11-2, libgstreamer-plugins-base1.0-0, libpam0g, gstreamer1.0-pipewire%s
 Recommends: libayatana-appindicator3-1
 Description: A remote control software.
 
@@ -380,330 +315,16 @@ def ffi_bindgen_function_refactor():
         'sed -i "s/ffi.NativeFunction<ffi.Bool Function(DartPort/ffi.NativeFunction<ffi.Uint8 Function(DartPort/g" flutter/lib/generated_bridge.dart')
 
 
-# libdrmtap is fetched at build time from the rustdesk-org fork at a pinned
-# commit — the same way rustdesk sources its other native build deps (vcpkg,
-# flutter_rust_bridge, ...), rather than carrying a git submodule. It is the ONLY
-# pin for the drm backend: rustdesk dlopens this .so at runtime and does not depend on
-# the libdrmtap-sys crate (whose build.rs would statically link the C tree, a helper and
-# libdrm/seccomp/cap). DRMTAP_REPO, DRMTAP_SHA and DRMTAP_PREBUILT_DIR override it for local testing
-# or another fork, and each requires DRMTAP_ALLOW_UNPINNED=1 alongside it (see below).
-# The commit is fetched directly by sha, so no branch or tag name takes part in the build: see
-# build_libdrmtap_so(). This is the SINGLE source of truth for the pin, deliberately not duplicated in
-# any workflow, so a bump is one edit here (plus the informational version comment in
-# libs/scrap/Cargo.toml). This commit is libdrmtap v0.5.4.
-LIBDRMTAP_REPO_PINNED = 'https://github.com/rustdesk-org/libdrmtap'
-LIBDRMTAP_SHA_PINNED = '5da68a3a368db569716d0d0f11cefacbb11b2290'
-LIBDRMTAP_REPO = os.environ.get('DRMTAP_REPO', LIBDRMTAP_REPO_PINNED)
-LIBDRMTAP_SHA = os.environ.get('DRMTAP_SHA', LIBDRMTAP_SHA_PINNED)
-# Every way of getting a different .so than the pin needs the same explicit opt-in. Otherwise the
-# claim this feature rests on -- that the privileged capture library is the reviewed object at
-# LIBDRMTAP_SHA_PINNED -- would hold only as long as nobody happened to have one of these set, and a
-# build that silently used something else would be indistinguishable from one that did not.
-# DRMTAP_PREBUILT_DIR is in the list because it is the widest of the three: it skips both the fetch
-# and the sha verification and hands over an object built from nothing this script can see.
-DRMTAP_UNPINNED_OK = os.environ.get('DRMTAP_ALLOW_UNPINNED') == '1'
-
-
-def _prebuilt_dir_is_the_pinned_checkout(prebuilt_dir):
-    # A .so built from this repo's own third_party/libdrmtap at the pinned sha is the pinned object,
-    # not an override, so it must not need the opt-in. This is how CI hands the library from a step
-    # that has meson to a packaging container that does not.
-    src = os.path.join(REPO_ROOT, 'third_party', 'libdrmtap')
-    try:
-        inside = os.path.commonpath([os.path.abspath(prebuilt_dir), src]) == src
-    except ValueError:
-        return False
-    if not inside or not os.path.isdir(os.path.join(src, '.git')):
-        return False
-    try:
-        head = subprocess.check_output(['git', '-C', src, 'rev-parse', 'HEAD']).decode().strip()
-    except (subprocess.SubprocessError, OSError):
-        return False
-    return head == LIBDRMTAP_SHA
-
-
-def _validate_libdrmtap_pin():
-    # Called from build_libdrmtap_so(), NOT at import: a stock (non --drm) build must stay
-    # byte-identical to upstream in behaviour too, and leftover DRMTAP_* variables in the
-    # environment (or a malformed sha) must not be able to fail a build that never touches
-    # libdrmtap.
-    # `or None` so an empty value reads as unset here exactly as it does in build_libdrmtap_so(),
-    # which tests it for truthiness.
-    prebuilt = os.environ.get('DRMTAP_PREBUILT_DIR') or None
-    if prebuilt and _prebuilt_dir_is_the_pinned_checkout(prebuilt):
-        prebuilt = None
-    overridden = [
-        name
-        for name, value, pinned in (
-            ('DRMTAP_REPO', LIBDRMTAP_REPO, LIBDRMTAP_REPO_PINNED),
-            ('DRMTAP_SHA', LIBDRMTAP_SHA, LIBDRMTAP_SHA_PINNED),
-            ('DRMTAP_PREBUILT_DIR', prebuilt, None),
-        )
-        if value != pinned
-    ]
-    if overridden and not DRMTAP_UNPINNED_OK:
-        raise Exception(
-            f'{", ".join(overridden)} would build libdrmtap from something other than the pinned '
-            f'{LIBDRMTAP_REPO_PINNED} at {LIBDRMTAP_SHA_PINNED}. That is supported for local work and '
-            'cross-builds, but it has to be deliberate: set DRMTAP_ALLOW_UNPINNED=1 as well.')
-    if overridden:
-        print(f'WARNING: libdrmtap is NOT the pinned build ({", ".join(overridden)} set)')
-    # Both are interpolated into shell commands below, and both are env-overridable, so validate
-    # their SHAPE before they get there. This is not only about a hostile environment: a truncated
-    # or abbreviated sha would otherwise reach `git fetch` and fail with something far less obvious
-    # than saying so here, and an abbreviated one would defeat the point of pinning.
-    if not re.fullmatch(r'[0-9a-f]{40}', LIBDRMTAP_SHA):
-        raise Exception(
-            f'DRMTAP_SHA must be a full 40-character commit sha, got {LIBDRMTAP_SHA!r}')
-    if not re.fullmatch(r'(https://|git@)[A-Za-z0-9._~:/@-]+', LIBDRMTAP_REPO):
-        raise Exception(f'DRMTAP_REPO does not look like a git remote url: {LIBDRMTAP_REPO!r}')
-
-
-def _single_real_so(paths, where):
-    # Return the one real libdrmtap.so.0.* object among `paths`, failing if there are zero or several.
-    # glob order is arbitrary, so silently taking [0] could ship a stale or wrong-arch object left
-    # over from an earlier build; a mismatch should fail the build loudly instead.
-    real = sorted(p for p in paths if os.path.isfile(p) and not os.path.islink(p))
-    if len(real) != 1:
-        raise Exception(
-            f'expected exactly one real libdrmtap.so.0.* in {where}, found {len(real)}: {real}')
-    return real[0]
-
-
-def build_libdrmtap_so():
-    # Build libdrmtap.so from the rustdesk-org fork, fetched at the pinned LIBDRMTAP_SHA. The
-    # pivot dlopen-s this .so in-process in the root service (which already holds
-    # CAP_SYS_ADMIN) — no setcap helper, no privileged child. Only the shared
-    # library target is built (the source also carries a helper binary we do not
-    # ship). Returns the path to the built versioned .so (e.g. libdrmtap.so.0.4.x).
-    _validate_libdrmtap_pin()
-    # Allow a caller (e.g. CI) to build the .so ahead of time and hand it in via
-    # DRMTAP_PREBUILT_DIR (must contain the real libdrmtap.so.0.* object).
-    prebuilt_dir = os.environ.get('DRMTAP_PREBUILT_DIR')
-    if prebuilt_dir:
-        # DRMTAP_PREBUILT_DIR explicitly names the artifact source, so honor it strictly: fail
-        # (rather than silently falling back to a source build) if it holds no single real .so.
-        prebuilt = glob.glob(os.path.join(prebuilt_dir, 'libdrmtap.so.0.*'))
-        so = _single_real_so(prebuilt, f'DRMTAP_PREBUILT_DIR={prebuilt_dir}')
-        # Check the stub case HERE too, not only on the source path below. This is the widest
-        # override of the three -- no fetch, no sha verification, an object built by something this
-        # script cannot see -- so it is the likeliest to hand over a CPU-only build, and skipping the
-        # assertion on exactly this path would leave the check guarding only the case that was
-        # already trustworthy.
-        _assert_so_has_egl(so)
-        return so
-    # Fetch the pinned source if it is not already present. third_party/libdrmtap is not a submodule
-    # anymore; it is git-ignored. The commit is fetched BY SHA rather than by cloning a branch:
-    # `clone --depth 1 --branch main` only ever fetches the tip, so the moment upstream pushes to
-    # `main` the pinned commit is not in the shallow clone at all and the build fails on an unreachable
-    # object. Fetching the sha needs no branch name, so it keeps working across every upstream push and
-    # is immune to a ref being moved or repointed.
-    src = os.path.join(REPO_ROOT, 'third_party', 'libdrmtap')
-    if not os.path.exists(os.path.join(src, 'meson.build')):
-        if os.path.isdir(src):
-            shutil.rmtree(src)
-        os.makedirs(src, exist_ok=True)
-        system2(f'git -C "{src}" init -q')
-        system2(f'git -C "{src}" remote add origin {LIBDRMTAP_REPO}')
-        system2(f'git -C "{src}" fetch --depth 1 origin {LIBDRMTAP_SHA}')
-        system2(f'git -C "{src}" checkout -q FETCH_HEAD')
-    # Verify the pin whenever the source is a GIT checkout. A fetch by sha cannot resolve to anything
-    # else, so this now guards the OTHER case: a reused checkout left by an earlier build at a
-    # different pin, which is what a bump leaves behind. Reject and remove it so the next run re-fetches
-    # cleanly. A NON-git tree placed here on purpose (a developer building unreleased local libdrmtap
-    # source) has nothing to verify and is used as-is.
-    if os.path.isdir(os.path.join(src, '.git')):
-        got_sha = subprocess.check_output(
-            ['git', '-C', src, 'rev-parse', 'HEAD']).decode().strip()
-        if got_sha != LIBDRMTAP_SHA:
-            shutil.rmtree(src, ignore_errors=True)
-            raise Exception(
-                f'libdrmtap at {src} is {got_sha}, expected {LIBDRMTAP_SHA} '
-                f'(stale checkout from a different pin; removed, re-run to re-fetch)')
-    build_dir = os.path.join(src, 'build-pkg')
-    if not os.path.exists(os.path.join(build_dir, 'build.ninja')):
-        system2(f'meson setup "{build_dir}" "{src}" --buildtype=release')
-    # Build only the shared library, not the bundled helper binary or the static archive. Since
-    # libdrmtap 0.4.11 the project is `both_libraries` (a version-scripted .so + a static .a), so the
-    # bare `drmtap` target is ambiguous ("drmtap:shared_library" vs "drmtap:static_library"); ask for
-    # the shared one explicitly (rustdesk dlopens the .so and never needs the archive).
-    system2(f'meson compile -C "{build_dir}" drmtap:shared_library')
-    sos = glob.glob(os.path.join(build_dir, 'libdrmtap.so.0.*'))
-    # keep the real object (libdrmtap.so.0.4.x), not the .so/.so.0 symlinks or meson's .p dir, and
-    # require exactly one so a stale object from an earlier build is never silently picked.
-    so = _single_real_so(sos, f'the libdrmtap meson build dir {build_dir}')
-    _assert_so_has_egl(so)
-    return so
-
-
-def _assert_so_has_egl(so_path):
-    # libdrmtap treats egl/glesv2 as OPTIONAL dependencies: without their headers and pkg-config
-    # files, meson silently builds a CPU-only stub. That stub still exports every symbol the loader
-    # checks for, so nothing downstream notices -- and the split architecture depends entirely on the
-    # unprivileged side EGL-detiling the scanout it receives. The result is a build where DRM capture
-    # quietly degrades to PipeWire on every tiled-scanout host, which is most of them.
-    #
-    # Assert on the ARTIFACT rather than passing an option that demands it: `-Degl=enabled` exists
-    # only in libdrmtap past 0.4.15, and checking what was actually produced also catches a stale or
-    # hand-substituted object, which a build flag cannot.
-    #
-    # EGL is reached by lazy dlopen, on purpose, so that the privileged service never links the GPU
-    # stack. That means there is no DT_NEEDED to look for and an ELF-level check reports "no EGL" on a
-    # perfectly good library; the dlopen name and an extension symbol are what a CPU-only stub really
-    # lacks.
-    try:
-        with open(so_path, 'rb') as f:
-            blob = f.read()
-    except OSError as err:
-        raise Exception(f'cannot read the built libdrmtap at {so_path}: {err}') from err
-    missing = [m for m in (b'libEGL.so.1', b'eglCreateImageKHR') if m not in blob]
-    if missing:
-        raise Exception(
-            f'{so_path} looks like a CPU-only libdrmtap stub (missing '
-            f'{", ".join(m.decode() for m in missing)}): the EGL detile path the split capture '
-            'depends on is not in it, and DRM capture would silently fall back to PipeWire. '
-            'Install the EGL development packages and rebuild (Debian/Ubuntu: libegl-dev '
-            'libgles2-mesa-dev; Arch: mesa libglvnd).')
-
-
-DRM_PACKAGE_NAME = 'rustdesk-unattended-wayland'
-
-
-def assert_so_satisfies_the_runtime_abi_gate(so_path):
-    """The .so we are about to ship must be one the RUNTIME will actually accept.
-
-    `abi_accepted` in libs/scrap/src/common/drmtap_dl.rs is the only place the pinned library's
-    version is ever validated, and it runs at dlopen time on the USER's machine. Nothing in the
-    build or in CI compared the two, so the pin and the gate could drift apart and every existing
-    assertion would still pass: the EGL check does not look at the version, the CI symbol contract
-    does not call drmtap_version(), and the deb-contents regex matches any `libdrmtap.so.0.X.Y`.
-    A green pipeline could therefore produce a deb in which DRM capture can never start, and the
-    only symptom on the host is one log line before it falls back to the portal.
-
-    So parse the gate out of the Rust and apply it here, to the object being staged. This is the
-    same rule, not a copy of the numbers: if someone bumps the constants, this reads the new ones.
-    """
-    m = re.search(r'libdrmtap\.so\.(\d+)\.(\d+)\.(\d+)', os.path.basename(so_path))
-    if not m:
-        # Not a versioned soname (a local dev build, say). The gate cannot be evaluated, and
-        # inventing a verdict would be worse than saying so.
-        print(f'[drm] cannot read a version out of {so_path}; skipping the ABI-gate cross-check')
-        return
-    so_ver = tuple(int(g) for g in m.groups())
-    # REPO_ROOT, not abspath(__file__): both callers have chdir'd into flutter/ by now.
-    gate_path = os.path.join(REPO_ROOT, 'libs', 'scrap', 'src', 'common', 'drmtap_dl.rs')
-    with open(gate_path) as f:
-        gate_src = f.read()
-
-    def _const(name):
-        mm = re.search(rf'const {name}: c_int = (\d+);', gate_src)
-        return int(mm.group(1)) if mm else None
-
-    major, minor = _const('DRMTAP_ABI_MAJOR'), _const('DRMTAP_ABI_MINOR')
-    mm = re.search(r'const DRMTAP_MIN_MINOR_PATCH: \(c_int, c_int\) = \((\d+), (\d+)\);', gate_src)
-    floor = (int(mm.group(1)), int(mm.group(2))) if mm else None
-    if major is None or minor is None or floor is None:
-        raise Exception(
-            'could not parse the libdrmtap ABI gate out of drmtap_dl.rs (DRMTAP_ABI_MAJOR / '
-            'DRMTAP_ABI_MINOR / DRMTAP_MIN_MINOR_PATCH). The gate moved and this check did not; '
-            'fix the check rather than removing it, or the pin and the gate can drift silently.')
-    accepted = so_ver[0] == major and so_ver[1] == minor and (so_ver[1], so_ver[2]) >= floor
-    if not accepted:
-        raise Exception(
-            f'the libdrmtap being packaged is {so_ver[0]}.{so_ver[1]}.{so_ver[2]}, which the '
-            f'runtime loader would REFUSE: drmtap_dl.rs accepts exactly major {major}, minor '
-            f'{minor}, patch >= {floor[1]}. Shipping it produces a deb whose DRM capture can never '
-            'start. Move the build pin and the gate together, or fix whichever one is wrong.')
-    print(f'[drm] libdrmtap {so_ver[0]}.{so_ver[1]}.{so_ver[2]} satisfies the runtime ABI gate '
-          f'(major {major}, minor {minor}, patch >= {floor[1]})')
-
-
-def stage_libdrmtap_into_deb(so_path):
-    # Put the built libdrmtap object plus its soname symlink into the staged deb. Only the soname
-    # symlink is needed: libdrmtap is resolved by ABSOLUTE path (/usr/lib/rustdesk/libdrmtap.so.0) at
-    # the in-process dlopen site (drmtap_dl.rs), so the deb does NOT drop /usr/lib/rustdesk into the
-    # system-wide /etc/ld.so.conf.d search path, which would let this private library shadow a system
-    # library for every binary on the host (Debian Policy 10.2 forbids that). No ld.so.conf.d drop-in
-    # and no ldconfig trigger are shipped, so the stock postinst is used unchanged.
-    assert_so_satisfies_the_runtime_abi_gate(so_path)
-    so_basename = os.path.basename(so_path)
-    system2('mkdir -p tmpdeb/usr/lib/rustdesk')
-    # Quoted: so_path comes from the repo root or from DRMTAP_PREBUILT_DIR, either of which can
-    # contain a space, and an unquoted interpolation would split the argument and fail obscurely.
-    system2(f'cp "{so_path}" tmpdeb/usr/lib/rustdesk/')
-    system2(f'ln -sf "{so_basename}" tmpdeb/usr/lib/rustdesk/libdrmtap.so.0')
-
-
-def _max_glibc_minor(path):
-    # Read from .dynstr rather than via objdump so packaging needs no binutils; chunked because
-    # librustdesk.so is ~45 MB.
-    best = 0
-    with open(path, 'rb') as f:
-        tail = b''
-        while True:
-            chunk = f.read(1 << 20)
-            if not chunk:
-                return best
-            for m in re.finditer(rb'GLIBC_2\.(\d+)', tail + chunk):
-                best = max(best, int(m.group(1)))
-            tail = chunk[-16:]
-
-
-def measured_glibc_floor():
-    # libdrmtap is built on a newer base than the rest of the deb, so the floor is whichever staged
-    # object is higher -- and it moves whenever either base does.
-    paths = [p for p in glob.glob('tmpdeb/usr/lib/rustdesk/libdrmtap.so.0.*')
-             + glob.glob('tmpdeb/usr/share/rustdesk/lib/librustdesk.so')
-             + glob.glob('tmpdeb/usr/share/rustdesk/rustdesk')
-             if os.path.isfile(p) and not os.path.islink(p)]
-    minor = max((_max_glibc_minor(p) for p in paths), default=0)
-    if not minor:
-        raise Exception(
-            f'could not measure a GLIBC_2.x floor from any staged object ({paths or "none found"}); '
-            'refusing to ship the unattended-wayland variant with an undeclared libc6 floor, which '
-            'is what lets it install on a host where libdrmtap can never load')
-    return f'2.{minor}'
-
-
-def retarget_control_to_drm_variant():
-    # Rewrite the control file that generate_control_file just produced, instead of parameterizing that
-    # function: the stock packaging path stays exactly as upstream wrote it, and everything specific to
-    # this variant lives here. The variant installs the same files as the stock package, so it must
-    # conflict with and replace it: you install one or the other, never both. It also needs libdrmtap's
-    # own runtime deps, which the stock package has no reason to carry.
-    path = '../res/DEBIAN/control'
-    floor = measured_glibc_floor()
-    print(f'[drm] {DRM_PACKAGE_NAME} libc6 floor measured at {floor}')
-    with open(path) as f:
-        lines = f.readlines()
-    out = []
-    for line in lines:
-        if line.startswith('Package: rustdesk'):
-            out.append(f'Package: {DRM_PACKAGE_NAME}\n')
-            out.append('Conflicts: rustdesk\nReplaces: rustdesk\nProvides: rustdesk\n')
-        elif line.startswith('Depends:'):
-            # 2.4.101 is where drmModeGetFB2 landed; below it libdrmtap loads and can never capture.
-            out.append(line.rstrip('\n') + ', libdrm2 (>= 2.4.101), libegl1, libgles2, '
-                       f'libc6 (>= {floor})\n')
-        else:
-            out.append(line)
-    body = ''.join(out)
-    # Fail loudly rather than silently shipping a package that says `rustdesk`: a stock control file
-    # that stopped matching either anchor would otherwise produce a variant deb wearing the stock name.
-    if f'Package: {DRM_PACKAGE_NAME}\n' not in body or 'libegl1' not in body:
-        raise Exception(f'could not retarget {path} to the drm variant; upstream control layout changed')
-    with open(path, 'w') as f:
-        f.write(body)
-
-
 def build_flutter_deb(version, features):
     if not skip_cargo:
-        system2(f'cargo build --locked --features {features} --lib --release')
+        system2(f'cargo build --features {features} --lib --release')
         ffi_bindgen_function_refactor()
     os.chdir('flutter')
     system2('flutter build linux --release')
     system2('mkdir -p tmpdeb/usr/bin/')
     system2('mkdir -p tmpdeb/usr/share/rustdesk')
+    system2('mkdir -p tmpdeb/etc/rustdesk/')
+    system2('mkdir -p tmpdeb/etc/pam.d/')
     system2('mkdir -p tmpdeb/usr/share/rustdesk/files/systemd/')
     system2('mkdir -p tmpdeb/usr/share/icons/hicolor/256x256/apps/')
     system2('mkdir -p tmpdeb/usr/share/icons/hicolor/scalable/apps/')
@@ -722,24 +343,17 @@ def build_flutter_deb(version, features):
         'cp ../res/rustdesk.desktop tmpdeb/usr/share/applications/rustdesk.desktop')
     system2(
         'cp ../res/rustdesk-link.desktop tmpdeb/usr/share/applications/rustdesk-link.desktop')
+    system2(
+        'cp ../res/startwm.sh tmpdeb/etc/rustdesk/')
+    system2(
+        'cp ../res/xorg.conf tmpdeb/etc/rustdesk/')
+    system2(
+        'cp ../res/pam.d/rustdesk.debian tmpdeb/etc/pam.d/rustdesk')
     system2(
         "echo \"#!/bin/sh\" >> tmpdeb/usr/share/rustdesk/files/polkit && chmod a+x tmpdeb/usr/share/rustdesk/files/polkit")
-    # Bundle libdrmtap.so only when this build actually enabled the `drm` feature, so stock packages
-    # stay exactly what they were. The root service dlopens it in-process by absolute path.
-    # `features` is the comma-joined string, so split it: a bare substring test would also match any
-    # future feature merely containing "drm" (drm-lease, vaapi-drm) and rename the deb to the
-    # consent-bypass variant without --drm ever being passed.
-    ships_so = 'drm' in features.split(',')
-    if ships_so:
-        # Same artifact assertion as the --package path. Under --skip-cargo nothing here rebuilt the
-        # binary, so `features` says what was ASKED for while the staged bundle can be anything.
-        assert_staged_binary_is_drm()
-        stage_libdrmtap_into_deb(build_libdrmtap_so())
 
     system2('mkdir -p tmpdeb/DEBIAN')
     generate_control_file(version)
-    if ships_so:
-        retarget_control_to_drm_variant()
     system2('cp -a ../res/DEBIAN/* tmpdeb/DEBIAN/')
     md5_file_folder("tmpdeb/")
     system2('dpkg-deb -b tmpdeb rustdesk.deb;')
@@ -747,68 +361,10 @@ def build_flutter_deb(version, features):
     system2('/bin/rm -rf tmpdeb/')
     system2('/bin/rm -rf ../res/DEBIAN/control')
     os.rename('rustdesk.deb', '../rustdesk-%s.deb' % version)
-    if ships_so:
-        # Named apart from the stock package so installing the consent-free variant is a deliberate act.
-        os.rename('../rustdesk-%s.deb' % version, f'../{DRM_PACKAGE_NAME}-{version}.deb')
     os.chdir("..")
 
 
-DRMTAP_DLOPEN_MARKER = b'/usr/lib/rustdesk/libdrmtap.so.0'
-# Present only when `drm-wake` is compiled in: the runtime option constant is itself
-# #[cfg(feature = "drm-wake")] (src/ipc/drm.rs). The dlopen marker above cannot stand in for it -
-# `--features drm` alone produces a binary that carries the dlopen path and NO wake code, and that
-# is exactly the deb this assertion is here to refuse.
-DRMTAP_WAKE_MARKER = b'enable-drm-display-wake'
-
-
-def _carries_drmtap_marker(path, marker=DRMTAP_DLOPEN_MARKER):
-    # Chunked, with an overlap of len(marker)-1 so the marker cannot be missed at a chunk boundary:
-    # librustdesk.so is ~45 MB and there is no reason to hold it all in memory, and the `with`
-    # closes deterministically instead of relying on refcounting.
-    with open(path, 'rb') as f:
-        tail = b''
-        while True:
-            chunk = f.read(1 << 20)
-            if not chunk:
-                return False
-            if marker in tail + chunk:
-                return True
-            tail = chunk[-(len(marker) - 1):]
-
-
-def assert_staged_binary_is_drm():
-    """The staged BINARY must really be a drm build before it is named the unattended-wayland
-    variant. That package conflicts with and replaces the stock one, so shipping a stock binary
-    under that name produces something that can never capture and cannot be installed alongside
-    what it replaced. The marker is the absolute dlopen path from drmtap_dl.rs, present only when
-    the feature is compiled in -- assert what was produced, not what was asked for.
-
-    Called from BOTH packaging paths. It used to guard only one of them, and `--skip-cargo` (which
-    is how CI packages) reaches the other, where nothing had rebuilt the binary at all.
-    """
-    binaries = [p for p in glob.glob('tmpdeb/usr/share/rustdesk/lib/librustdesk.so')
-                + glob.glob('tmpdeb/usr/share/rustdesk/rustdesk') if os.path.isfile(p)]
-    if not any(_carries_drmtap_marker(p) for p in binaries):
-        raise Exception(
-            f'--drm was requested but the staged bundle does not look like a drm build (no '
-            f'{DRMTAP_DLOPEN_MARKER.decode()} dlopen path in {binaries or "any staged binary"}); '
-            'refusing to package it as the unattended-wayland variant, which conflicts with and '
-            'replaces the stock package but could never capture')
-    # And the WAKE half. `--drm` enables `drm-wake` too (see get_features), and the deb is named and
-    # documented as the variant that can reach a machine whose screen has gone dark. The dlopen
-    # marker above does not distinguish them: `--features drm` alone carries it and has no wake code
-    # at all. Asserting only the first half is how a deb can be named for a feature it does not have.
-    if not any(_carries_drmtap_marker(p, DRMTAP_WAKE_MARKER) for p in binaries):
-        raise Exception(
-            f'--drm was requested but the staged binary has no {DRMTAP_WAKE_MARKER.decode()} '
-            f'marker in {binaries or "any staged binary"}, so it was built without `drm-wake`; '
-            'refusing to package it as the unattended-wayland variant, which is named and '
-            'documented as the build that can wake an idle-disabled display. If this fired under '
-            '--skip-cargo, the cargo line that produced the bundle is missing the feature: '
-            '--features ...,drm,drm-wake')
-
-
-def build_deb_from_folder(version, binary_folder, want_drm=False):
+def build_deb_from_folder(version, binary_folder):
     os.chdir('flutter')
     system2('mkdir -p tmpdeb/usr/bin/')
     system2('mkdir -p tmpdeb/usr/share/rustdesk')
@@ -832,53 +388,9 @@ def build_deb_from_folder(version, binary_folder, want_drm=False):
         'cp ../res/rustdesk-link.desktop tmpdeb/usr/share/applications/rustdesk-link.desktop')
     system2(
         "echo \"#!/bin/sh\" >> tmpdeb/usr/share/rustdesk/files/polkit && chmod a+x tmpdeb/usr/share/rustdesk/files/polkit")
-    # Where the capture library comes from for a `--package <folder> --drm` build. Two shapes are
-    # supported, because two exist in practice: a bundle that already carries libdrmtap.so.0.*
-    # (someone staged it, e.g. a CI artifact), and a plain bundle, which is what every build path
-    # here actually produces -- the flutter deb builds the library straight into the staged deb, so
-    # nothing ever puts it inside the bundle folder. Demanding it in the bundle made this flag
-    # combination impossible to satisfy.
-    bundled_glob = glob.glob('tmpdeb/usr/share/rustdesk/libdrmtap.so.0.*')
-    bundle_carries_so = any(os.path.isfile(p) and not os.path.islink(p) for p in bundled_glob)
-    # The variant must be decided by the EXPLICIT --drm request, not merely by what happens to be
-    # staged: a bundle that carries the .so must NOT be shipped as the consent-bypass variant when
-    # --drm was never passed.
-    if bundle_carries_so and not want_drm:
-        raise Exception(
-            'the staged bundle carries libdrmtap.so.0.* but --drm was not passed; refusing '
-            'to silently ship the consent-bypass unattended-wayland variant (pass --drm to '
-            'build it deliberately)')
-    if want_drm:
-        # Whichever shape we are in, the staged BINARY must really be a drm build. This is the
-        # property the old presence-of-the-.so test stood in for, badly: a stock binary packaged as
-        # the unattended-wayland variant would carry the consent-bypass name, conflict with and
-        # replace the stock package, and never be able to capture. The marker is the absolute
-        # dlopen path from drmtap_dl.rs, present only when the feature is compiled in -- the same
-        # kind of artifact assertion as _assert_so_has_egl, and for the same reason: assert what
-        # was produced, not what was asked for.
-        assert_staged_binary_is_drm()
-        if bundle_carries_so:
-            so = _single_real_so(bundled_glob, 'the staged --drm bundle')
-            # The THIRD artifact source, and the last one that was missing the check: --package
-            # takes the .so straight out of a bundle somebody else produced, so it has the same
-            # exposure as DRMTAP_PREBUILT_DIR (see the comment on that branch). A CPU-only stub
-            # would ship, the loader would accept it, and capture would degrade to PipeWire
-            # without a word.
-            _assert_so_has_egl(so)
-            stage_libdrmtap_into_deb(so)
-            system2(f'rm -f "{so}"')
-            system2('rm -f tmpdeb/usr/share/rustdesk/libdrmtap.so tmpdeb/usr/share/rustdesk/libdrmtap.so.0')
-        else:
-            # Build it here, exactly as the flutter deb path does (build_libdrmtap_so asserts the
-            # EGL backend itself). The library is independent of the staged binary.
-            stage_libdrmtap_into_deb(build_libdrmtap_so())
 
     system2('mkdir -p tmpdeb/DEBIAN')
     generate_control_file(version)
-    # Keyed on the EXPLICIT request, not on what happened to be staged: by here a --drm build has
-    # its library in tmpdeb whichever of the two shapes it came from.
-    if want_drm:
-        retarget_control_to_drm_variant()
     system2('cp -a ../res/DEBIAN/* tmpdeb/DEBIAN/')
     md5_file_folder("tmpdeb/")
     system2('dpkg-deb -b tmpdeb rustdesk.deb;')
@@ -886,8 +398,6 @@ def build_deb_from_folder(version, binary_folder, want_drm=False):
     system2('/bin/rm -rf tmpdeb/')
     system2('/bin/rm -rf ../res/DEBIAN/control')
     os.rename('rustdesk.deb', '../rustdesk-%s.deb' % version)
-    if want_drm:
-        os.rename('../rustdesk-%s.deb' % version, f'../{DRM_PACKAGE_NAME}-{version}.deb')
     os.chdir("..")
 
 
@@ -895,17 +405,12 @@ def build_flutter_dmg(version, features):
     if not skip_cargo:
         # set minimum osx build target, now is 10.14, which is the same as the flutter xcode project
         system2(
-            f'MACOSX_DEPLOYMENT_TARGET=10.14 cargo build --locked --features {features} --release')
+            f'MACOSX_DEPLOYMENT_TARGET=10.14 cargo build --features {features} --release')
     # copy dylib
     system2(
         "cp target/release/liblibrustdesk.dylib target/release/librustdesk.dylib")
     os.chdir('flutter')
-    # cargo builds a single-arch dylib for the host; restrict Xcode to the same arch
-    # so the universal-by-default ARCHS_STANDARD doesn't try to link a missing slice.
-    # FLUTTER_XCODE_* env vars are forwarded to xcodebuild as build settings.
-    mac_arch = 'arm64' if platform.machine().lower() in ('arm64', 'aarch64') else 'x86_64'
-    system2(
-        f'FLUTTER_XCODE_ARCHS={mac_arch} FLUTTER_XCODE_ONLY_ACTIVE_ARCH=YES flutter build macos --release')
+    system2('flutter build macos --release')
     system2('cp -rf ../target/release/service ./build/macos/Build/Products/Release/RustDesk.app/Contents/MacOS/')
     '''
     system2(
@@ -917,7 +422,7 @@ def build_flutter_dmg(version, features):
 
 def build_flutter_arch_manjaro(version, features):
     if not skip_cargo:
-        system2(f'cargo build --locked --features {features} --lib --release')
+        system2(f'cargo build --features {features} --lib --release')
     ffi_bindgen_function_refactor()
     os.chdir('flutter')
     system2('flutter build linux --release')
@@ -928,7 +433,7 @@ def build_flutter_arch_manjaro(version, features):
 
 def build_flutter_windows(version, features, skip_portable_pack):
     if not skip_cargo:
-        system2(f'cargo build --locked --features {features} --lib --release')
+        system2(f'cargo build --features {features} --lib --release')
         if not os.path.exists("target/release/librustdesk.dll"):
             print("cargo build failed, please check rust source code.")
             exit(-1)
@@ -962,19 +467,6 @@ def main():
     parser = make_parser()
     args = parser.parse_args()
 
-    # Before anything with a side effect: this is a query, and a caller uses it to build the very
-    # binary it will then package. `get_features` stays the single definition of what a flag
-    # combination means; a caller that hardcodes the list instead is one edit away from compiling
-    # something other than what it ships.
-    if args.print_features:
-        # stdout carries the list and nothing else, so a caller can use it directly in a command
-        # substitution. `get_features` prints a human-readable line of its own; send that to stderr
-        # for this call rather than silencing it, which would change what every other path prints.
-        with contextlib.redirect_stdout(sys.stderr):
-            feats = ','.join(get_features(args))
-        print(feats)
-        return
-
     if os.path.exists(exe_path):
         os.unlink(exe_path)
     if os.path.isfile('/usr/bin/pacman'):
@@ -990,20 +482,20 @@ def main():
     portable = args.portable
     package = args.package
     if package:
-        build_deb_from_folder(version, package, args.drm)
+        build_deb_from_folder(version, package)
         return
     res_dir = 'resources'
     external_resources(flutter, args, res_dir)
     if windows:
         # build virtual display dynamic library
         os.chdir('libs/virtual_display/dylib')
-        system2('cargo build --locked --release')
+        system2('cargo build --release')
         os.chdir('../../..')
 
         if flutter:
             build_flutter_windows(version, features, args.skip_portable_pack)
             return
-        system2('cargo build --locked --release --features ' + features)
+        system2('cargo build --release --features ' + features)
         # system2('upx.exe target/release/rustdesk.exe')
         system2('mv target/release/rustdesk.exe target/release/RustDesk.exe')
         pa = os.environ.get('P')
@@ -1014,7 +506,6 @@ def main():
                 'target\\release\\rustdesk.exe')
         else:
             print('Not signed')
-        os.makedirs(res_dir, exist_ok=True)
         system2(
             f'cp -rf target/release/RustDesk.exe {res_dir}')
         os.chdir('libs/portable')
@@ -1028,7 +519,7 @@ def main():
         if flutter:
             build_flutter_arch_manjaro(version, features)
         else:
-            system2('cargo build --locked --release --features ' + features)
+            system2('cargo build --release --features ' + features)
             system2('git checkout src/ui/common.tis')
             system2('strip target/release/rustdesk')
             system2('ln -s res/pacman_install && ln -s res/PKGBUILD')
@@ -1037,7 +528,7 @@ def main():
             version, version))
         # pacman -U ./rustdesk.pkg.tar.zst
     elif os.path.isfile('/usr/bin/yum'):
-        system2('cargo build --locked --release --features ' + features)
+        system2('cargo build --release --features ' + features)
         system2('strip target/release/rustdesk')
         system2(
             "sed -i 's/Version:    .*/Version:    %s/g' res/rpm.spec" % version)
@@ -1047,7 +538,7 @@ def main():
                 version, version))
         # yum localinstall rustdesk.rpm
     elif os.path.isfile('/usr/bin/zypper'):
-        system2('cargo build --locked --release --features ' + features)
+        system2('cargo build --release --features ' + features)
         system2('strip target/release/rustdesk')
         system2(
             "sed -i 's/Version:    .*/Version:    %s/g' res/rpm-suse.spec" % version)
@@ -1066,7 +557,7 @@ def main():
                 #     'mv target/release/bundle/deb/rustdesk*.deb ./flutter/rustdesk.deb')
                 build_flutter_deb(version, features)
         else:
-            system2('cargo --locked bundle --release --features ' + features)
+            system2('cargo bundle --release --features ' + features)
             if osx:
                 system2(
                     'strip target/release/bundle/osx/RustDesk.app/Contents/MacOS/rustdesk')
@@ -1124,7 +615,13 @@ def main():
                     'cp res/rustdesk.desktop tmpdeb/usr/share/applications/rustdesk.desktop')
                 system2(
                     'cp res/rustdesk-link.desktop tmpdeb/usr/share/applications/rustdesk-link.desktop')
+                os.system('mkdir -p tmpdeb/etc/rustdesk/')
+                os.system('cp -a res/startwm.sh tmpdeb/etc/rustdesk/')
+                os.system('mkdir -p tmpdeb/etc/X11/rustdesk/')
+                os.system('cp res/xorg.conf tmpdeb/etc/X11/rustdesk/')
                 os.system('cp -a DEBIAN/* tmpdeb/DEBIAN/')
+                os.system('mkdir -p tmpdeb/etc/pam.d/')
+                os.system('cp pam.d/rustdesk.debian tmpdeb/etc/pam.d/rustdesk')
                 system2('strip tmpdeb/usr/bin/rustdesk')
                 system2('mkdir -p tmpdeb/usr/share/rustdesk')
                 system2('mv tmpdeb/usr/bin/rustdesk tmpdeb/usr/share/rustdesk/')

build.rs

@@ -72,6 +72,7 @@ fn install_android_deps() {
         path.join("lib").to_str().unwrap()
     );
     println!("cargo:rustc-link-lib=ndk_compat");
+    println!("cargo:rustc-link-lib=oboe");
     println!("cargo:rustc-link-lib=c++");
     println!("cargo:rustc-link-lib=OpenSLES");
 }

docs/CODE_OF_CONDUCT.md

@@ -107,7 +107,7 @@ Violating these terms may lead to a permanent ban.
 ### 4. Permanent Ban
 
 **Community Impact**: Demonstrating a pattern of violation of community
-standards, including sustained inappropriate behavior, harassment of an
+standards, including sustained inappropriate behavior,  harassment of an
 individual, or aggression toward or disparagement of classes of individuals.
 
 **Consequence**: A permanent ban from any sort of public interaction within

docs/CONTRIBUTING-ID.md

@@ -24,7 +24,7 @@ Untuk instruksi Git yang lebih lanjut, cek disini [GitHub workflow 101](https://
 
 ## Tindakan
 
-<https://github.com/rustdesk/rustdesk/blob/master/docs/CODE_OF_CONDUCT.md>
+<https://github.com/rustdesk/rustdesk/blob/master/docs/CODE_OF_CONDUCT-ID.md>
 
 ## Komunikasi
 

docs/CONTRIBUTING-IT.md

@@ -30,7 +30,7 @@ Per istruzioni specifiche su git, vedi [Workflow GitHub - 101](https://github.co
 
 ## Condotta
 
-https://github.com/rustdesk/rustdesk/blob/master/docs/CODE_OF_CONDUCT.md
+https://github.com/rustdesk/rustdesk/blob/master/docs/CODE_OF_CONDUCT-IT.md
 
 ## Comunicazioni
 

docs/CONTRIBUTING.md

@@ -1,6 +1,6 @@
 # Contributing to RustDesk
 
-RustDesk welcomes contributions from everyone. Here are the guidelines if you are
+RustDesk welcomes contribution from everyone. Here are the guidelines if you are
 thinking of helping us:
 
 ## Contributions

docs/README-AR.md

@@ -160,6 +160,7 @@ RustDesk يرجى التأكد من أنك تنفذ هذه الأوامر من
 - **[src/rendezvous_mediator.rs](https://github.com/rustdesk/rustdesk/tree/master/src/rendezvous_mediator.rs)**: أو المنقول عن بُعد (TCP hole punching) انتظر الاتصال المباشر [rustdesk-server](https://github.com/rustdesk/rustdesk-server) الإتصال ب
 - **[src/platform](https://github.com/rustdesk/rustdesk/tree/master/src/platform)**: رمز خاص بكل منصة
 - **[flutter](https://github.com/rustdesk/rustdesk/tree/master/flutter)**: رمز الهاتف المحمول
+- **[flutter/web/js](https://github.com/rustdesk/rustdesk/tree/master/flutter/web/js)**:Flutter  لعميل الويب الخاص ب Javascript
 
 ## لقطات
 

docs/README-CS.md

@@ -144,6 +144,7 @@ Ujistěte se, že tyto příkazy spouštíte z kořenového adresáře RustDesk,
 - **[src/rendezvous_mediator.rs](https://github.com/rustdesk/rustdesk/tree/master/src/rendezvous_mediator.rs)**: komunikace s [rustdesk-server](https://github.com/rustdesk/rustdesk-server), očekávání vzdálených příméhých („proděrováváním“ TCP) nebo předávaných (relay) spojení
 - **[src/platform](https://github.com/rustdesk/rustdesk/tree/master/src/platform)**: zdrojové kódy, specifické pro jednotlivé platformy
 - **[flutter](https://github.com/rustdesk/rustdesk/tree/master/flutter)**: zdrojové kódy pro použití s aplikačním rámcem (framework) Flutter pro mobilní platformy
+- **[flutter/web/js](https://github.com/rustdesk/rustdesk/tree/master/flutter/web/js)**: Javascript pro Flutter webový klient
 
 ## Ukázky
 

docs/README-DE.md

@@ -66,19 +66,19 @@ Bitte laden Sie die dynamische Bibliothek Sciter selbst herunter.
 ```sh
 sudo apt install -y zip g++ gcc git curl wget nasm yasm libgtk-3-dev clang libxcb-randr0-dev libxdo-dev \
         libxfixes-dev libxcb-shape0-dev libxcb-xfixes0-dev libasound2-dev libpulse-dev cmake make \
-        libclang-dev ninja-build libgstreamer1.0-dev libgstreamer-plugins-base1.0-dev
+        libclang-dev ninja-build libgstreamer1.0-dev libgstreamer-plugins-base1.0-dev libpam0g-dev
 ```
 
 ### openSUSE Tumbleweed
 
 ```sh
-sudo zypper install gcc-c++ git curl wget nasm yasm gcc gtk3-devel clang libxcb-devel libXfixes-devel cmake alsa-lib-devel gstreamer-devel gstreamer-plugins-base-devel xdotool-devel
+sudo zypper install gcc-c++ git curl wget nasm yasm gcc gtk3-devel clang libxcb-devel libXfixes-devel cmake alsa-lib-devel gstreamer-devel gstreamer-plugins-base-devel xdotool-devel pam-devel
 ```
 
 ### Fedora 28 (CentOS 8)
 
 ```sh
-sudo yum -y install gcc-c++ git curl wget nasm yasm gcc gtk3-devel clang libxcb-devel libxdo-devel libXfixes-devel pulseaudio-libs-devel cmake alsa-lib-devel gstreamer1-devel gstreamer1-plugins-base-devel
+sudo yum -y install gcc-c++ git curl wget nasm yasm gcc gtk3-devel clang libxcb-devel libxdo-devel libXfixes-devel pulseaudio-libs-devel cmake alsa-lib-devel gstreamer1-devel gstreamer1-plugins-base-devel pam-devel
 ```
 
 ### Arch (Manjaro)
@@ -168,6 +168,7 @@ Bitte stellen Sie sicher, dass Sie diese Befehle im Stammverzeichnis des RustDes
 - **[src/rendezvous_mediator.rs](https://github.com/rustdesk/rustdesk/tree/master/src/rendezvous_mediator.rs)**: Mit [rustdesk-server](https://github.com/rustdesk/rustdesk-server) kommunizieren, warten auf direkte (TCP hole punching) oder weitergeleitete Verbindung
 - **[src/platform](https://github.com/rustdesk/rustdesk/tree/master/src/platform)**: Plattformspezifischer Code
 - **[flutter](https://github.com/rustdesk/rustdesk/tree/master/flutter)**: Flutter-Code für Handys
+- **[flutter/web/js](https://github.com/rustdesk/rustdesk/tree/master/flutter/web/js)**: JavaScript für Flutter-Webclient
 
 ## Screenshots
 

docs/README-ES.md

@@ -62,19 +62,19 @@ Por favor descarga la librería dinámica de Sciter tú mismo.
 ```sh
 sudo apt install -y zip g++ gcc git curl wget nasm yasm libgtk-3-dev clang libxcb-randr0-dev libxdo-dev \
         libxfixes-dev libxcb-shape0-dev libxcb-xfixes0-dev libasound2-dev libpulse-dev cmake make \
-        libclang-dev ninja-build libgstreamer1.0-dev libgstreamer-plugins-base1.0-dev
+        libclang-dev ninja-build libgstreamer1.0-dev libgstreamer-plugins-base1.0-dev libpam0g-dev
 ```
 
 ### openSUSE Tumbleweed
 
 ```sh
-sudo zypper install gcc-c++ git curl wget nasm yasm gcc gtk3-devel clang libxcb-devel libXfixes-devel cmake alsa-lib-devel gstreamer-devel gstreamer-plugins-base-devel xdotool-devel
+sudo zypper install gcc-c++ git curl wget nasm yasm gcc gtk3-devel clang libxcb-devel libXfixes-devel cmake alsa-lib-devel gstreamer-devel gstreamer-plugins-base-devel xdotool-devel pam-devel
 ```
 
 ### Fedora 28 (CentOS 8)
 
 ```sh
-sudo yum -y install gcc-c++ git curl wget nasm yasm gcc gtk3-devel clang libxcb-devel libxdo-devel libXfixes-devel pulseaudio-libs-devel cmake alsa-lib-devel gstreamer1-devel gstreamer1-plugins-base-devel
+sudo yum -y install gcc-c++ git curl wget nasm yasm gcc gtk3-devel clang libxcb-devel libxdo-devel libXfixes-devel pulseaudio-libs-devel cmake alsa-lib-devel gstreamer1-devel gstreamer1-plugins-base-devel pam-devel
 ```
 
 ### Arch (Manjaro)
@@ -163,6 +163,7 @@ Por favor, asegurate de que estás ejecutando estos comandos desde la raíz del
 - **[src/rendezvous_mediator.rs](https://github.com/rustdesk/rustdesk/tree/master/src/rendezvous_mediator.rs)**: Comunicación con [rustdesk-server](https://github.com/rustdesk/rustdesk-server), esperar la conexión remota directa ("TCP hole punching") o conexión indirecta ("relayed")
 - **[src/platform](https://github.com/rustdesk/rustdesk/tree/master/src/platform)**: código específico de cada plataforma
 - **[flutter](https://github.com/rustdesk/rustdesk/tree/master/flutter)**: Flutter, código para moviles
+- **[flutter/web/js](https://github.com/rustdesk/rustdesk/tree/master/flutter/web/js)**: Javascript para el cliente web Flutter
 
 > [!Precaución]
 > **Descargo de responsabilidad por uso indebido:** <br>

docs/README-FA.md

@@ -146,6 +146,7 @@ target/release/rustdesk
 - **[src/rendezvous_mediator.rs](https://github.com/rustdesk/rustdesk/tree/master/src/rendezvous_mediator.rs)**: Communicate with [rustdesk-server](https://github.com/rustdesk/rustdesk-server), wait for remote direct (TCP hole punching) or relayed connection
 - **[src/platform](https://github.com/rustdesk/rustdesk/tree/master/src/platform)**: platform specific code
 - **[flutter](https://github.com/rustdesk/rustdesk/tree/master/flutter)**: Flutter code for mobile
+- **[flutter/web/js](https://github.com/rustdesk/rustdesk/tree/master/flutter/web/js)**: Javascript for Flutter web client
 
 ## تصاویر محیط نرم‌افزار
 

docs/README-GR.md

@@ -158,6 +158,7 @@ target/release/rustdesk
 - **[src/rendezvous_mediator.rs](https://github.com/rustdesk/rustdesk/tree/master/src/rendezvous_mediator.rs)**: Communicate with [rustdesk-server](https://github.com/rustdesk/rustdesk-server), wait for remote direct (TCP hole punching) or relayed connection
 - **[src/platform](https://github.com/rustdesk/rustdesk/tree/master/src/platform)**: platform specific code
 - **[flutter](https://github.com/rustdesk/rustdesk/tree/master/flutter)**: Flutter code for mobile
+- **[flutter/web/js](https://github.com/rustdesk/rustdesk/tree/master/flutter/web/js)**: JavaScript for Flutter web client
 
 ## Στιγμιότυπα
 

docs/README-HU.md

@@ -48,7 +48,7 @@ A telefonos verziók Flutter-t hasznának. Később lehetséges hogy Sciterről
 
 - Futtasd a `cargo run` parancsot
 
-## [Építés](https://rustdesk.com/docs/en/dev/build/)
+## [Építés](https://rustdesk.com/docs/hu/dev/build/)
 
 ## Hogyan építs Linuxon
 
@@ -150,6 +150,7 @@ Kérlek mindenképpen nézd meg hogy ezeket a parancsokat a root RustDesk mappá
 - **[src/rendezvous_mediator.rs](https://github.com/rustdesk/rustdesk/tree/master/src/rendezvous_mediator.rs)**: Communicate with [rustdesk-server](https://github.com/rustdesk/rustdesk-server), wait for remote direct (TCP hole punching) or relayed connection
 - **[src/platform](https://github.com/rustdesk/rustdesk/tree/master/src/platform)**: platform specific code
 - **[flutter](https://github.com/rustdesk/rustdesk/tree/master/flutter)**: Flutter code for mobile
+- **[flutter/web/js](https://github.com/rustdesk/rustdesk/tree/master/flutter/web/js)**: Javascript for Flutter web client
 
 ## Képernyőképek
 

docs/README-IT.md

@@ -162,6 +162,7 @@ Assicurati di eseguire questi comandi dalla radice del repository RustDesk, altr
 - **[src/rendezvous_mediator.rs](https://github.com/rustdesk/rustdesk/tree/master/src/rendezvous_mediator.rs)**: comunica con [rustdesk-server](https://github.com/rustdesk/rustdesk-server), attende la connessione remota diretta (TCP hole punching) oppure indiretta (relayed)
 - **[src/platform](https://github.com/rustdesk/rustdesk/tree/master/src/platform)**: codice specifico della piattaforma
 - **[flutter](https://github.com/rustdesk/rustdesk/tree/master/flutter)**: codice Flutter per desktop e mobile
+- **[flutter/web/js](https://github.com/rustdesk/rustdesk/tree/master/flutter/web/js)**: JavaScript per client web Flutter
 
 > [!Attenzione]
 > **Dichiarazione di non responsabilità per uso improprio:** <br>

docs/README-JP.md

@@ -166,6 +166,7 @@ target/release/rustdesk
 - **[src/rendezvous_mediator.rs](https://github.com/rustdesk/rustdesk/tree/master/src/rendezvous_mediator.rs)**: [rustdesk-server](https://github.com/rustdesk/rustdesk-server)と通信し、リモートの直接接続(TCPホールパンチング)や中継接続を担う。
 - **[src/platform](https://github.com/rustdesk/rustdesk/tree/master/src/platform)**: プラットフォーム固有のコード
 - **[flutter](https://github.com/rustdesk/rustdesk/tree/master/flutter)**: デスクトップとモバイル向けのFlutterコード
+- **[flutter/web/js](https://github.com/rustdesk/rustdesk/tree/master/flutter/web/js)**: Flutterウェブクライアント向けのJavaScript
 
 > [!注意]
 > **:不正使用に関する免責事項** <br>

docs/README-KR.md

@@ -1,10 +1,10 @@
 <p align="center">
   <img src="../res/logo-header.svg" alt="RustDesk - Your remote desktop"><br>
-  <a href="#빌드를_위한_원시_단계">빌드</a> •
-  <a href="#Docker로_빌드하는_방법">Docker</a> •
-  <a href="#파일_구조">구조</a> •
-  <a href="#스크린샷">스냅샷</a><br>
-  [<a href="../README.md">English</a>] | [<a href="README-UA.md">Українська</a>] | [<a href="README-CS.md">česky</a>] | [<a href="README-ZH.md">中文</a>] | [<a href="README-HU.md">Magyar</a>] | [<a href="README-ES.md">Español</a>] | [<a href="README-FA.md">فارسی</a>] | [<a href="README-FR.md">Français</a>] | [<a href="README-DE.md">Deutsch</a>] | [<a href="README-PL.md">Polski</a>] | [<a href="README-ID.md">Indonesian</a>] | [<a href="README-FI.md">Suomi</a>] | [<a href="README-ML.md">മലയാളം</a>] | [<a href="README-JP.md">日本語</a>] | [<a href="README-NL.md">Nederlands</a>] | [<a href="README-IT.md">Italiano</a>] | [<a href="README-RU.md">Русский</a>] | [<a href="README-PTBR.md">Português (Brasil)</a>] | [<a href="README-EO.md">Esperanto</a>] | [<a href="README-KR.md">한국어</a>] | [<a href="README-AR.md">العربي</a>] | [<a href="README-VN.md">Tiếng Việt</a>] | [<a href="README-DA.md">Dansk</a>] | [<a href="README-GR.md">Ελληνικά</a>] | [<a href="README-TR.md">Türkçe</a>] | [<a href="README-NO.md">Norsk</a>] | [<a href="README-RO.md">Română</a>]<br>
+  <a href="#빌드를 위한 원시 단계">빌드</a> •
+  <a href="#Docker로 빌드하는 방법">Docker</a> •
+  <a href="#파일 구조">구조</a> •
+  <a href="#스크린샷">스냇샷</a><br>
+  [<a href="../README.md">English</a>] | [<a href="README-UA.md">Українська</a>] | [<a href="README-CS.md">česky</a>] | [<a href="README-ZH.md">中文</a>] | [<a href="README-HU.md">Magyar</a>] | [<a href="README-ES.md">Español</a>] | [<a href="README-FA.md">فارسی</a>] | [<a href="README-FR.md">Français</a>] | [<a href="README-DE.md">Deutsch</a>] | [<a href="README-PL.md">Polski</a>] | [<a href="README-ID.md">Indonesian</a>] | [<a href="README-FI.md">Suomi</a>] | [<a href="README-ML.md">മലയാളം</a>] | [<a href="README-JP.md">日本語</a>] | [<a href="README-NL.md">Nederlands</a>] | [<a href="README-IT.md">Italiano</a>] | [<a href="README-RU.md">Русский</a>] | [<a href="README-PTBR.md">Português (Brasil)</a>] | [<a href="README-EO.md">Esperanto</a>] | [<a href="README-KR.md">한국어</a>] | [<a href="README-AR.md">العربي</a>] | [<a href="README-VN.md">Tiếng Việt</a>] | [<a href="README-DA.md">Dansk</a>] | [<a href="README-GR.md">Ελληνικά</a>] | [<a href="README-TR.md">Türkçe</a>] | [<a href="README-NO.md">Norsk</a>]<br>
   <b>이 README, <a href="https://github.com/rustdesk/rustdesk/tree/master/src/lang">RustDesk UI</a> 및 <a href="https://github.com/rustdesk/doc.rustdesk.com">RustDesk 문서</a>를 귀하의 모국어로 번역하는 데 도움이 필요합니다</b>
 </p>
 
@@ -46,9 +46,9 @@ Sciter 동적 라이브러리를 직접 다운로드하세요.
 [Linux](https://raw.githubusercontent.com/c-smile/sciter-sdk/master/bin.lnx/x64/libsciter-gtk.so) |
 [macOS](https://raw.githubusercontent.com/c-smile/sciter-sdk/master/bin.osx/libsciter.dylib)
 
-## 빌드를_위한_원시_단계
+## 빌드를 위한 원시 단계
 
-- Rust 개발 환경과 C++ 빌드 환경 준비
+- Rust 개발 환경과 C++ 빌드 환경을 준비합니다
 
 - [vcpkg](https://github.com/microsoft/vcpkg)를 설치하고 `VCPKG_ROOT` 환경 변수를 올바르게 설정합니다
 
@@ -66,19 +66,19 @@ Sciter 동적 라이브러리를 직접 다운로드하세요.
 ```sh
 sudo apt install -y zip g++ gcc git curl wget nasm yasm libgtk-3-dev clang libxcb-randr0-dev libxdo-dev \
         libxfixes-dev libxcb-shape0-dev libxcb-xfixes0-dev libasound2-dev libpulse-dev cmake make \
-        libclang-dev ninja-build libgstreamer1.0-dev libgstreamer-plugins-base1.0-dev
+        libclang-dev ninja-build libgstreamer1.0-dev libgstreamer-plugins-base1.0-dev libpam0g-dev
 ```
 
 ### openSUSE Tumbleweed
 
 ```sh
-sudo zypper install gcc-c++ git curl wget nasm yasm gcc gtk3-devel clang libxcb-devel libXfixes-devel cmake alsa-lib-devel gstreamer-devel gstreamer-plugins-base-devel xdotool-devel
+sudo zypper install gcc-c++ git curl wget nasm yasm gcc gtk3-devel clang libxcb-devel libXfixes-devel cmake alsa-lib-devel gstreamer-devel gstreamer-plugins-base-devel xdotool-devel pam-devel
 ```
 
 ### Fedora 28 (CentOS 8)
 
 ```sh
-sudo yum -y install gcc-c++ git curl wget nasm yasm gcc gtk3-devel clang libxcb-devel libxdo-devel libXfixes-devel pulseaudio-libs-devel cmake alsa-lib-devel gstreamer1-devel gstreamer1-plugins-base-devel
+sudo yum -y install gcc-c++ git curl wget nasm yasm gcc gtk3-devel clang libxcb-devel libxdo-devel libXfixes-devel pulseaudio-libs-devel cmake alsa-lib-devel gstreamer1-devel gstreamer1-plugins-base-devel pam-devel
 ```
 
 ### Arch (Manjaro)
@@ -125,7 +125,7 @@ mv libsciter-gtk.so target/debug
 VCPKG_ROOT=$HOME/vcpkg cargo run
 ```
 
-## Docker로_빌드하는_방법
+## Docker로 빌드하는 방법
 
 먼저 리포지토리를 복제하고 Docker 컨테이너를 빌드합니다:
 
@@ -156,7 +156,7 @@ target/release/rustdesk
 
 RustDesk 리포지토리의 루트에서 이러한 명령을 실행하고 있는지 확인하세요. 그렇지 않으면 응용 프로그램이 필요한 리소스를 찾지 못할 수 있습니다. 또한 `install` 또는 `run` 과 같은 다른 cargo 하위 명령은 호스트가 아닌 컨테이너 내부에 프로그램을 설치하거나 실행하므로 현재 이 방법을 통해 지원되지 않는다는 점에 유의하세요.
 
-## 파일_구조
+## 파일 구조
 
 - **[libs/hbb_common](https://github.com/rustdesk/rustdesk/tree/master/libs/hbb_common)**: 비디오 코덱, 구성, tcp/udp wrapper, protobuf, 파일 전송을 위한 fs 함수 및 기타 유틸리티 함수
 - **[libs/scrap](https://github.com/rustdesk/rustdesk/tree/master/libs/scrap)**: 화면 캡쳐
@@ -168,6 +168,7 @@ RustDesk 리포지토리의 루트에서 이러한 명령을 실행하고 있는
 - **[src/rendezvous_mediator.rs](https://github.com/rustdesk/rustdesk/tree/master/src/rendezvous_mediator.rs)**: [rustdesk-server](https://github.com/rustdesk/rustdesk-server)와 통신, 원격 다이렉트 (TCP 홀 펀칭) 또는 릴레이 연결 대기
 - **[src/platform](https://github.com/rustdesk/rustdesk/tree/master/src/platform)**: 플랫폼별 코드
 - **[flutter](https://github.com/rustdesk/rustdesk/tree/master/flutter)**: 데스크톱 및 모바일용 Flutter 코드
+- **[flutter/web/js](https://github.com/rustdesk/rustdesk/tree/master/flutter/web/v1/js)**: Flutter 웹 클라이언트용 JavaScript
 
 ## 스크린샷
 

docs/README-NO.md

@@ -62,19 +62,19 @@ Venligst last ned Sciters dynamiske bibliotek selv.
 ```sh
 sudo apt install -y zip g++ gcc git curl wget nasm yasm libgtk-3-dev clang libxcb-randr0-dev libxdo-dev \
         libxfixes-dev libxcb-shape0-dev libxcb-xfixes0-dev libasound2-dev libpulse-dev cmake make \
-        libclang-dev ninja-build libgstreamer1.0-dev libgstreamer-plugins-base1.0-dev
+        libclang-dev ninja-build libgstreamer1.0-dev libgstreamer-plugins-base1.0-dev libpam0g-dev
 ```
 
 ### openSUSE Tumbleweed
 
 ```sh
-sudo zypper install gcc-c++ git curl wget nasm yasm gcc gtk3-devel clang libxcb-devel libXfixes-devel cmake alsa-lib-devel gstreamer-devel gstreamer-plugins-base-devel xdotool-devel
+sudo zypper install gcc-c++ git curl wget nasm yasm gcc gtk3-devel clang libxcb-devel libXfixes-devel cmake alsa-lib-devel gstreamer-devel gstreamer-plugins-base-devel xdotool-devel pam-devel
 ```
 
 ### Fedora 28 (CentOS 8)
 
 ```sh
-sudo yum -y install gcc-c++ git curl wget nasm yasm gcc gtk3-devel clang libxcb-devel libxdo-devel libXfixes-devel pulseaudio-libs-devel cmake alsa-lib-devel gstreamer1-devel gstreamer1-plugins-base-devel
+sudo yum -y install gcc-c++ git curl wget nasm yasm gcc gtk3-devel clang libxcb-devel libxdo-devel libXfixes-devel pulseaudio-libs-devel cmake alsa-lib-devel gstreamer1-devel gstreamer1-plugins-base-devel pam-devel
 ```
 
 ### Arch (Manjaro)
@@ -163,6 +163,7 @@ Venligst pass på att du kjører disse kommandoene fra roten av RustDesk reposit
 - **[src/rendezvous_mediator.rs](https://github.com/rustdesk/rustdesk/tree/master/src/rendezvous_mediator.rs)**: Kommunikasjon med [rustdesk-server](https://github.com/rustdesk/rustdesk-server), vent på direkte fjernstyring (TCP hulling) eller vidresendt tilkobling
 - **[src/platform](https://github.com/rustdesk/rustdesk/tree/master/src/platform)**: platform spesefik kode
 - **[flutter](https://github.com/rustdesk/rustdesk/tree/master/flutter)**: Flutter kode for desktop og mobil
+- **[flutter/web/js](https://github.com/rustdesk/rustdesk/tree/master/flutter/web/js)**: JavaScript for Flutter nettsted klient
 
 ## Skjermbilder
 

docs/README-PL.md

@@ -155,6 +155,7 @@ Upewnij się, że uruchamiasz te polecenia z katalogu głównego repozytorium Ru
 - **[src/rendezvous_mediator.rs](https://github.com/rustdesk/rustdesk/tree/master/src/rendezvous_mediator.rs)**: Komunikacja z [rustdesk-server](https://github.com/rustdesk/rustdesk-server), czekanie na bezpośrednie (odpytywanie TCP) lub przekazywane połączenie
 - **[src/platform](https://github.com/rustdesk/rustdesk/tree/master/src/platform)**: kod specyficzny dla danej platformy
 - **[flutter](https://github.com/rustdesk/rustdesk/tree/master/flutter)**: kod Flutter dla urządzeń mobilnych
+- **[flutter/web/js](https://github.com/rustdesk/rustdesk/tree/master/flutter/web/js)**: JavaScript dla Flutter - klient web
 
 ## Zrzuty ekranu
 

docs/README-PTBR.md

@@ -1,82 +1,55 @@
 <p align="center">
   <img src="../res/logo-header.svg" alt="RustDesk - Seu desktop remoto"><br>
-  <a href="#compilar">Compilar</a> •
-  <a href="#como-compilar-com-o-docker">Docker</a> •
+  <a href="#servidores-públicos-grátis">Servidores</a> •
+  <a href="#compilação-crua">Compilar</a> •
+  <a href="#como-compilar-com-docker">Docker</a> •
   <a href="#estrutura-de-arquivos">Estrutura</a> •
-  <a href="#capturas-de-tela">Capturas de Tela</a><br>
-  [<a href="../README.md">Inglês</a>] | [<a href="docs/README-UA.md">Ucraniano</a>] | [<a href="docs/README-CS.md">Tcheco</a>] | [<a href="docs/README-ZH.md">Chinês</a>] | [<a href="docs/README-HU.md">Húngaro</a>] | [<a href="docs/README-ES.md">Espanhol</a>] | [<a href="docs/README-FA.md">Persa</a>] | [<a href="docs/README-FR.md">Francês</a>] | [<a href="docs/README-DE.md">Alemão</a>] | [<a href="docs/README-PL.md">Polonês</a>] | [<a href="docs/README-ID.md">Indonésio</a>] | [<a href="docs/README-FI.md">Finlandês</a>] | [<a href="docs/README-ML.md">Malaiala</a>] | [<a href="docs/README-JP.md">Japonês</a>] | [<a href="docs/README-NL.md">Holandês</a>] | [<a href="docs/README-IT.md">Italiano</a>] | [<a href="docs/README-RU.md">Russo</a>] | [<a href="docs/README-EO.md">Esperanto</a>] | [<a href="docs/README-KR.md">Coreano</a>] | [<a href="docs/README-AR.md">Árabe</a>] | [<a href="docs/README-VN.md">Vietnamita</a>] | [<a href="docs/README-DA.md">Dinamarquês</a>] | [<a href="docs/README-GR.md">Grego</a>] | [<a href="docs/README-TR.md">Turco</a>] | [<a href="docs/README-NO.md">Norueguês</a>] | [<a href="docs/README-RO.md">Romeno</a>]<br>
-  <b>Precisamos da sua ajuda para traduzir este README, a <a href="https://github.com/rustdesk/rustdesk/tree/master/src/lang">Interface do RustDesk</a> e a <a href="https://github.com/rustdesk/doc.rustdesk.com">Documentação do RustDesk</a> para o seu idioma nativo</b>
+  <a href="#screenshots">Screenshots</a><br>
+  [<a href="../README.md">English</a>] | [<a href="README-UA.md">Українська</a>] | [<a href="README-CS.md">česky</a>] | [<a href="README-ZH.md">中文</a>] | [<a href="README-HU.md">Magyar</a>] | [<a href="README-ES.md">Español</a>] | [<a href="README-FA.md">فارسی</a>] | [<a href="README-FR.md">Français</a>] | [<a href="README-DE.md">Deutsch</a>] | [<a href="README-PL.md">Polski</a>] | [<a href="README-ID.md">Indonesian</a>] | [<a href="README-FI.md">Suomi</a>] | [<a href="README-ML.md">മലയാളം</a>] | [<a href="README-JP.md">日本語</a>] | [<a href="README-NL.md">Nederlands</a>] | [<a href="README-IT.md">Italiano</a>] | [<a href="README-RU.md">Русский</a>] | [<a href="README-EO.md">Esperanto</a>] | [<a href="README-KR.md">한국어</a>] | [<a href="README-AR.md">العربي</a>] | [<a href="README-VN.md">Tiếng Việt</a>] | [<a href="README-GR.md">Ελληνικά</a>]<br>
+  <b>Precisamos de sua ajuda para traduzir este README e a <a href="https://github.com/rustdesk/rustdesk/tree/master/src/lang">UI do RustDesk</a> para sua língua nativa</b>
 </p>
 
-> [!Caution]
-> **Aviso de Isenção de Responsabilidade por Uso Indevido:** <br>
-> Os desenvolvedores do RustDesk não toleram ou apoiam qualquer uso antiético ou ilegal deste software. O uso indevido, como acesso não autorizado, controle ou invasão de privacidade, viola estritamente nossas diretrizes. Os autores não são responsáveis por qualquer uso indevido do aplicativo.
-
-
 Converse conosco: [Discord](https://discord.gg/nDceKgxnkV) | [Twitter](https://twitter.com/rustdesk) | [Reddit](https://www.reddit.com/r/rustdesk) | [YouTube](https://www.youtube.com/@rustdesk)
 
-[![RustDesk Server Pro](https://img.shields.io/badge/RustDesk%20Server%20Pro-Advanced%20Features-blue)](https://rustdesk.com/pricing.html)
+[![RustDesk Server Pro](https://img.shields.io/badge/RustDesk%20Server%20Pro-Recursos%20Avan%C3%A7ados-blue)](https://rustdesk.com/pricing.html)
 
-Mais uma solução de desktop remoto, escrita em Rust. Funciona imediatamente, sem necessidade de configuração. Você tem controle total dos seus dados, sem preocupações com segurança. Você pode usar nosso servidor de conexão/retransmissão (rendezvous/relay), [configurar o seu próprio](https://rustdesk.com/server) ou [escrever seu próprio servidor de conexão/retransmissão](https://github.com/rustdesk/rustdesk-server-demo).
+Mais um software de desktop remoto, escrito em Rust. Funciona por padrão, sem necessidade de configuração. Você tem completo controle de seus dados, sem se preocupar com segurança. Você pode usar nossos servidores de rendezvous/relay, [configurar seu próprio](https://rustdesk.com/server), ou [escrever seu próprio servidor de rendezvous/relay](https://github.com/rustdesk/rustdesk-server-demo).
 
-![image](https://user-images.githubusercontent.com/71636191/171661982-430285f0-2e12-4b1d-9957-4a58e375304d.png)
+RustDesk acolhe contribuições de todos. Leia [`docs/CONTRIBUTING.md`](CONTRIBUTING.md) para ver como começar.
 
-O RustDesk acolhe a contribuição de todos. Veja [CONTRIBUTING.md](docs/CONTRIBUTING.md) para ajuda em como começar.
-
-[**Perguntas Frequentes (FAQ)**](https://github.com/rustdesk/rustdesk/wiki/FAQ)
-
-[**DOWNLOAD DOS BINÁRIOS**](https://github.com/rustdesk/rustdesk/releases)
-
-[**VERSÕES NIGHTLY (EM DESENVOLVIMENTO)**](https://github.com/rustdesk/rustdesk/releases/tag/nightly)
-
-[<img src="https://f-droid.org/badge/get-it-on.png"
-    alt="Baixe no F-Droid"
-    height="80">](https://f-droid.org/en/packages/com.carriez.flutter_hbb)
-[<img src="https://flathub.org/api/badge?svg&locale=en"
-    alt="Baixe no Flathub"
-    height="80">](https://flathub.org/apps/com.rustdesk.RustDesk)
+[**DOWNLOAD DE BINÁRIOS**](https://github.com/rustdesk/rustdesk/releases)
 
 ## Dependências
 
-As versões de desktop usam Flutter ou Sciter (descontinuado) para a interface gráfica (GUI). Este tutorial é apenas para o Sciter, por ser mais fácil e amigável para começar. Verifique nosso [CI](https://github.com/rustdesk/rustdesk/blob/master/.github/workflows/flutter-build.yml) para instruções de compilação da versão em Flutter.
-
-Por favor, faça o download da biblioteca dinâmica do Sciter por conta própria.
+Versões de desktop utilizam [sciter](https://sciter.com/) para a GUI, por favor baixe a biblioteca dinâmica sciter por conta própria.
 
 [Windows](https://raw.githubusercontent.com/c-smile/sciter-sdk/master/bin.win/x64/sciter.dll) |
 [Linux](https://raw.githubusercontent.com/c-smile/sciter-sdk/master/bin.lnx/x64/libsciter-gtk.so) |
-[macOS](https://raw.githubusercontent.com/c-smile/sciter-sdk/master/bin.osx/libsciter.dylib)
+[MacOS](https://raw.githubusercontent.com/c-smile/sciter-sdk/master/bin.osx/libsciter.dylib)
 
-## Passos básicos para compilar
+## Compilação crua
 
-- Prepare seu ambiente de desenvolvimento Rust e o ambiente de compilação C++
+- Prepare seu ambiente de desenvolvimento Rust e ambiente de compilação C++
 
-- Instale o [vcpkg](https://github.com/microsoft/vcpkg) e configure a variável de ambiente `VCPKG_ROOT` corretamente
+- Instale [vcpkg](https://github.com/microsoft/vcpkg), e configure a variável de ambiente `VCPKG_ROOT` corretamente
 
-  - Windows: `vcpkg install libvpx:x64-windows-static libyuv:x64-windows-static opus:x64-windows-static aom:x64-windows-static`
-  - Linux/macOS: `vcpkg install libvpx libyuv opus aom`
+  - Windows: vcpkg install libvpx:x64-windows-static libyuv:x64-windows-static opus:x64-windows-static aom:x64-windows-static
+  - Linux/MacOS: vcpkg install libvpx libyuv opus aom
 
 - Execute `cargo run`
 
-## [Compilar](https://rustdesk.com/docs/en/dev/build/)
-
-## Como Compilar no Linux
+## Como compilar no Linux
 
 ### Ubuntu 18 (Debian 10)
 
 ```sh
-sudo apt install -y zip g++ gcc git curl wget nasm yasm libgtk-3-dev clang libxcb-randr0-dev libxdo-dev         libxfixes-dev libxcb-shape0-dev libxcb-xfixes0-dev libasound2-dev libpulse-dev cmake make         libclang-dev ninja-build libgstreamer1.0-dev libgstreamer-plugins-base1.0-dev
-```
-
-### openSUSE Tumbleweed
-
-```sh
-sudo zypper install gcc-c++ git curl wget nasm yasm gcc gtk3-devel clang libxcb-devel libXfixes-devel cmake alsa-lib-devel gstreamer-devel gstreamer-plugins-base-devel xdotool-devel
+sudo apt install -y g++ gcc git curl wget nasm yasm libgtk-3-dev clang libxcb-randr0-dev libxdo-dev libxfixes-dev libxcb-shape0-dev libxcb-xfixes0-dev libasound2-dev libpulse-dev cmake
 ```
 
 ### Fedora 28 (CentOS 8)
 
 ```sh
-sudo yum -y install gcc-c++ git curl wget nasm yasm gcc gtk3-devel clang libxcb-devel libxdo-devel libXfixes-devel pulseaudio-libs-devel cmake alsa-lib-devel gstreamer1-devel gstreamer1-plugins-base-devel
+sudo yum -y install gcc-c++ git curl wget nasm yasm gcc gtk3-devel clang libxcb-devel libxdo-devel libXfixes-devel pulseaudio-libs-devel cmake alsa-lib-devel
 ```
 
 ### Arch (Manjaro)
@@ -85,7 +58,7 @@ sudo yum -y install gcc-c++ git curl wget nasm yasm gcc gtk3-devel clang libxcb-
 sudo pacman -Syu --needed unzip git cmake gcc curl wget yasm nasm zip make pkg-config clang gtk3 xdotool libxcb libxfixes alsa-lib pipewire
 ```
 
-### Instalar o vcpkg
+### Instale vcpkg
 
 ```sh
 git clone https://github.com/microsoft/vcpkg
@@ -97,7 +70,7 @@ export VCPKG_ROOT=$HOME/vcpkg
 vcpkg/vcpkg install libvpx libyuv opus aom
 ```
 
-### Corrigir o libvpx (Para Fedora)
+### Conserte libvpx (Para o Fedora)
 
 ```sh
 cd vcpkg/buildtrees/libvpx/src
@@ -110,12 +83,12 @@ cp libvpx.a $HOME/vcpkg/installed/x64-linux/lib/
 cd
 ```
 
-### Compilar
+### Compile
 
 ```sh
 curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh
 source $HOME/.cargo/env
-git clone --recurse-submodules https://github.com/rustdesk/rustdesk
+git clone https://github.com/rustdesk/rustdesk
 cd rustdesk
 mkdir -p target/debug
 wget https://raw.githubusercontent.com/c-smile/sciter-sdk/master/bin.lnx/x64/libsciter-gtk.so
@@ -123,56 +96,57 @@ mv libsciter-gtk.so target/debug
 VCPKG_ROOT=$HOME/vcpkg cargo run
 ```
 
-## Como compilar com o Docker
+## Como compilar com Docker
 
-Comece clonando o repositório e construindo o contêiner Docker:
+Comece clonando o repositório e montando o container docker:
 
 ```sh
 git clone https://github.com/rustdesk/rustdesk
 cd rustdesk
-git submodule update --init --recursive
 docker build -t "rustdesk-builder" .
 ```
 
-Depois, cada vez que precisar compilar o aplicativo, execute o seguinte comando:
+Então, sempre que precisar compilar a aplicação, execute este comando:
 
 ```sh
 docker run --rm -it -v $PWD:/home/user/rustdesk -v rustdesk-git-cache:/home/user/.cargo/git -v rustdesk-registry-cache:/home/user/.cargo/registry -e PUID="$(id -u)" -e PGID="$(id -g)" rustdesk-builder
 ```
 
-Note que a primeira compilação pode demorar mais até que as dependências sejam armazenadas em cache; as compilações subsequentes serão mais rápidas. Além disso, se você precisar especificar argumentos diferentes para o comando de compilação, poderá fazê-lo ao final do comando na posição `<ARGUMENTOS-OPCIONAIS>`. Por exemplo, se você quiser compilar uma versão de lançamento (release) otimizada, executaria o comando acima seguido de `--release`. O executável resultante estará disponível na pasta `target` do seu sistema e pode ser executado com:
+Note que a primeira compilação pode demorar mais antes que as dependências sejam armazenadas em cache, as compilações subsequentes serão mais rápidas. Adicionalmente, se você precisar especificar argumentos diferentes para o comando de compilação, você pode fazê-lo ao final do comando na posição do `<OPTIONAL-ARGS>`. Por exemplo, se você gostaria de compilar uma versão de release otimizada, você executaria o comando acima seguido de `--release`. O executável gerado estará disponível no diretório alvo no seu sistema, e pode ser executado com:
 
 ```sh
 target/debug/rustdesk
 ```
 
-Ou, se estiver executando o executável de lançamento:
+Ou, se estiver rodando um executável de release:
 
 ```sh
 target/release/rustdesk
 ```
 
-Certifique-se de executar esses comandos a partir da raiz do repositório do RustDesk, do contrário o aplicativo pode não encontrar os recursos necessários. Note também que outros subcomandos do cargo, como `install` ou `run`, não são suportados atualmente por este método, pois instalariam ou executariam o programa dentro do contêiner em vez de no sistema hospedeiro.
+Por favor verifique que está executando estes comandos da raiz do repositório do RustDesk, senão a aplicação pode não encontrar os recursos necessários. Note também que outros subcomandos do cargo como `install` ou `run` não são suportados atualmente via este método, já que eles iriam instalar ou rodar o programa dentro do container ao invés do host.
 
-## Estrutura de Arquivos
+## Estrutura de arquivos
 
-- **[libs/hbb_common](https://github.com/rustdesk/rustdesk/tree/master/libs/hbb_common)**: codec de vídeo, configuração, encapsulador (wrapper) tcp/udp, protobuf, funções de sistema de arquivos para transferência de arquivos e algumas outras funções utilitárias.
-- **[libs/scrap](https://github.com/rustdesk/rustdesk/tree/master/libs/scrap)**: captura de tela.
-- **[libs/enigo](https://github.com/rustdesk/rustdesk/tree/master/libs/enigo)**: controle de teclado/mouse específico de cada plataforma.
-- **[libs/clipboard](https://github.com/rustdesk/rustdesk/tree/master/libs/clipboard)**: implementação de copiar e colar arquivos para Windows, Linux e macOS.
-- **[src/ui](https://github.com/rustdesk/rustdesk/tree/master/src/ui)**: interface Sciter antiga (descontinuada).
-- **[src/server](https://github.com/rustdesk/rustdesk/tree/master/src/server)**: serviços de áudio/área de transferência/entrada/vídeo e conexões de rede.
-- **[src/client.rs](https://github.com/rustdesk/rustdesk/tree/master/src/client.rs)**: inicia uma conexão direta (peer connection).
-- **[src/rendezvous_mediator.rs](https://github.com/rustdesk/rustdesk/tree/master/src/rendezvous_mediator.rs)**: Comunica-se com o [rustdesk-server](https://github.com/rustdesk/rustdesk-server), aguarda por conexão remota direta (perfuração de túnel TCP / hole punching) ou retransmitida.
-- **[src/platform](https://github.com/rustdesk/rustdesk/tree/master/src/platform)**: código específico de cada plataforma.
-- **[flutter](https://github.com/rustdesk/rustdesk/tree/master/flutter)**: código Flutter para desktop e dispositivos móveis.
+- **[libs/hbb_common](https://github.com/rustdesk/rustdesk/tree/master/libs/hbb_common)**: codec de vídeo, configurações, wrapper de tcp/udp, protobuf, funções de sistema de arquivos para transferência de arquivos, e outras funções utilitárias
+- **[libs/scrap](https://github.com/rustdesk/rustdesk/tree/master/libs/scrap)**: captura de tela
+- **[libs/enigo](https://github.com/rustdesk/rustdesk/tree/master/libs/enigo)**: controle de teclado/mouse específico a cada plataforma
+- **[src/ui](https://github.com/rustdesk/rustdesk/tree/master/src/ui)**: GUI
+- **[src/server](https://github.com/rustdesk/rustdesk/tree/master/src/server)**: serviços de áudio/área de transferência/entrada/vídeo, e conexões de rede
+- **[src/client.rs](https://github.com/rustdesk/rustdesk/tree/master/src/client.rs)**: iniciar uma conexão "peer to peer"
+- **[src/rendezvous_mediator.rs](https://github.com/rustdesk/rustdesk/tree/master/src/rendezvous_mediator.rs)**: Comunicação com [rustdesk-server](https://github.com/rustdesk/rustdesk-server), aguardar pela conexão remota direta (TCP hole punching) ou conexão indireta (relayed)
+- **[src/platform](https://github.com/rustdesk/rustdesk/tree/master/src/platform)**: código específico a cada plataforma
 
-## Capturas de Tela
+> [!Cuidadob]
+> **Aviso de uso indevido:** <br>
+> Os desenvolvedores do RustDesk não aprovam nem apoiam qualquer uso antiético ou ilegal deste software. O uso indevido, como acesso não autorizado, controle ou invasão de privacidade, é estritamente contra nossas diretrizes. Os autores não são responsáveis por qualquer uso indevido da aplicação.
 
-![Gerenciador de Conexões](https://github.com/rustdesk/rustdesk/assets/28412477/db82d4e7-c4bc-4823-8e6f-6af7eadf7651)
+## Screenshots
 
-![Conectado a um PC Windows](https://github.com/rustdesk/rustdesk/assets/28412477/9baa91e9-3362-4d06-aa1a-7518edcbd7ea)
+![image](https://user-images.githubusercontent.com/71636191/113112362-ae4deb80-923b-11eb-957d-ff88daad4f06.png)
 
-![Transferência de Arquivos](https://github.com/rustdesk/rustdesk/assets/28412477/39511ad3-aa9a-4f8c-8947-1cce286a46ad)
+![image](https://user-images.githubusercontent.com/71636191/113112619-f705a480-923b-11eb-911d-97e984ef52b6.png)
 
-![Tunelamento TCP](https://github.com/rustdesk/rustdesk/assets/28412477/78e8708f-e87e-4570-8373-1360033ea6c5)
+![image](https://user-images.githubusercontent.com/71636191/113112857-3fbd5d80-923c-11eb-9836-768325faf906.png)
+
+![image](https://user-images.githubusercontent.com/71636191/135385039-38fdbd72-379a-422d-b97f-33df71fb1cec.png)

docs/README-RO.md

@@ -66,19 +66,19 @@ Te rugăm să descarci singur librăria dinamică Sciter.
 ```sh
 sudo apt install -y zip g++ gcc git curl wget nasm yasm libgtk-3-dev clang libxcb-randr0-dev libxdo-dev \
         libxfixes-dev libxcb-shape0-dev libxcb-xfixes0-dev libasound2-dev libpulse-dev cmake make \
-        libclang-dev ninja-build libgstreamer1.0-dev libgstreamer-plugins-base1.0-dev
+        libclang-dev ninja-build libgstreamer1.0-dev libgstreamer-plugins-base1.0-dev libpam0g-dev
 ```
 
 ### openSUSE Tumbleweed
 
 ```sh
-sudo zypper install gcc-c++ git curl wget nasm yasm gcc gtk3-devel clang libxcb-devel libXfixes-devel cmake alsa-lib-devel gstreamer-devel gstreamer-plugins-base-devel xdotool-devel
+sudo zypper install gcc-c++ git curl wget nasm yasm gcc gtk3-devel clang libxcb-devel libXfixes-devel cmake alsa-lib-devel gstreamer-devel gstreamer-plugins-base-devel xdotool-devel pam-devel
 ```
 
 ### Fedora 28 (CentOS 8)
 
 ```sh
-sudo yum -y install gcc-c++ git curl wget nasm yasm gcc gtk3-devel clang libxcb-devel libxdo-devel libXfixes-devel pulseaudio-libs-devel cmake alsa-lib-devel gstreamer1-devel gstreamer1-plugins-base-devel
+sudo yum -y install gcc-c++ git curl wget nasm yasm gcc gtk3-devel clang libxcb-devel libxdo-devel libXfixes-devel pulseaudio-libs-devel cmake alsa-lib-devel gstreamer1-devel gstreamer1-plugins-base-devel pam-devel
 ```
 
 ### Arch (Manjaro)
@@ -168,6 +168,7 @@ Asigură-te că rulezi aceste comenzi din rădăcina repository-ului RustDesk, a
 - **[src/rendezvous_mediator.rs](https://github.com/rustdesk/rustdesk/tree/master/src/rendezvous_mediator.rs)**: comunică cu [rustdesk-server](https://github.com/rustdesk/rustdesk-server), așteaptă conexiune directă remote (TCP hole punching) sau prin relay
 - **[src/platform](https://github.com/rustdesk/rustdesk/tree/master/src/platform)**: cod specific platformei
 - **[flutter](https://github.com/rustdesk/rustdesk/tree/master/flutter)**: cod Flutter pentru desktop și mobil
+- **[flutter/web/js](https://github.com/rustdesk/rustdesk/tree/master/flutter/web/v1/js)**: JavaScript pentru clientul Flutter web
 
 ## Capturi de ecran
 

docs/README-RU.md

@@ -59,7 +59,7 @@ RustDesk приветствует вклад каждого. Ознакомьт
 
 - Выполните команду `cargo run`
 
-## [Сборка](https://rustdesk.com/docs/en/dev/build/)
+## [Сборка](https://rustdesk.com/docs/ru/dev/build/)
 
 ## Как собрать на Linux 
 
@@ -68,19 +68,19 @@ RustDesk приветствует вклад каждого. Ознакомьт
 ```sh
 sudo apt install -y zip g++ gcc git curl wget nasm yasm libgtk-3-dev clang libxcb-randr0-dev libxdo-dev \
         libxfixes-dev libxcb-shape0-dev libxcb-xfixes0-dev libasound2-dev libpulse-dev cmake make \
-        libclang-dev ninja-build libgstreamer1.0-dev libgstreamer-plugins-base1.0-dev
+        libclang-dev ninja-build libgstreamer1.0-dev libgstreamer-plugins-base1.0-dev libpam0g-dev
 ```
 
 ### openSUSE Tumbleweed
 
 ```sh
-sudo zypper install gcc-c++ git curl wget nasm yasm gcc gtk3-devel clang libxcb-devel libXfixes-devel cmake alsa-lib-devel gstreamer-devel gstreamer-plugins-base-devel xdotool-devel
+sudo zypper install gcc-c++ git curl wget nasm yasm gcc gtk3-devel clang libxcb-devel libXfixes-devel cmake alsa-lib-devel gstreamer-devel gstreamer-plugins-base-devel xdotool-devel pam-devel
 ```
 
 ### Fedora 28 (CentOS 8)
 
 ```sh
-sudo yum -y install gcc-c++ git curl wget nasm yasm gcc gtk3-devel clang libxcb-devel libxdo-devel libXfixes-devel pulseaudio-libs-devel cmake alsa-lib-devel gstreamer1-devel gstreamer1-plugins-base-devel
+sudo yum -y install gcc-c++ git curl wget nasm yasm gcc gtk3-devel clang libxcb-devel libxdo-devel libXfixes-devel pulseaudio-libs-devel cmake alsa-lib-devel gstreamer1-devel gstreamer1-plugins-base-devel pam-devel
 ```
 
 ### Arch (Manjaro)
@@ -170,6 +170,7 @@ target/release/rustdesk
 - **[src/rendezvous_mediator.rs](https://github.com/rustdesk/rustdesk/tree/master/src/rendezvous_mediator.rs)**: связь с [сервером RustDesk](https://github.com/rustdesk/rustdesk-server), ожидает удаленного прямого (через TCP hole punching) или ретранслируемого соединения
 - **[src/platform](https://github.com/rustdesk/rustdesk/tree/master/src/platform)**: специфичный для платформы код
 - **[flutter](https://github.com/rustdesk/rustdesk/tree/master/flutter)**: код Flutter для ПК-версии и мобильных устройств
+- **[flutter/web/js](https://github.com/rustdesk/rustdesk/tree/master/flutter/web/v1/js)**: JavaScript для Web-клиента Flutter
 
 ## Скриншоты
 
@@ -179,4 +180,4 @@ target/release/rustdesk
 
 ![Передача файлов](https://github.com/rustdesk/rustdesk/assets/28412477/39511ad3-aa9a-4f8c-8947-1cce286a46ad)
 
-![TCP-туннелирование](https://github.com/rustdesk/rustdesk/assets/28412477/78e8708f-e87e-4570-8373-1360033ea6c5)
+![TCP-туннелирование](https://github.com/rustdesk/rustdesk/assets/28412477/78e8708f-e87e-4570-8373-1360033ea6c5)

docs/README-TR.md

@@ -166,6 +166,7 @@ Lütfen bu komutları RustDesk reposunun root klasöründe çalıştırdığın
 - **[src/rendezvous_mediator.rs](https://github.com/rustdesk/rustdesk/tree/master/src/rendezvous_mediator.rs)**: [rustdesk-server](https://github.com/rustdesk/rustdesk-server) ile iletişime gir, remote direct(TCP delik açma) yada relay bağlantısı için bekle
 - **[src/platform](https://github.com/rustdesk/rustdesk/tree/master/src/platform)**: platforma özgü kod
 - **[flutter](https://github.com/rustdesk/rustdesk/tree/master/flutter)**: Masaüstü ve mobil için Flutter kodu
+- **[flutter/web/js](https://github.com/rustdesk/rustdesk/tree/master/flutter/web/v1/js)**: Flutter web istemcisi için JavaScript
 
 
 ## Ekran Görüntüleri

docs/README-UA.md

@@ -59,19 +59,19 @@ RustDesk вітає внесок кожного. Ознайомтеся з [CONT
 ```sh
 sudo apt install -y zip g++ gcc git curl wget nasm yasm libgtk-3-dev clang libxcb-randr0-dev libxdo-dev \
         libxfixes-dev libxcb-shape0-dev libxcb-xfixes0-dev libasound2-dev libpulse-dev cmake make \
-        libclang-dev ninja-build libgstreamer1.0-dev libgstreamer-plugins-base1.0-dev
+        libclang-dev ninja-build libgstreamer1.0-dev libgstreamer-plugins-base1.0-dev libpam0g-dev
 ```
 
 ### openSUSE Tumbleweed
 
 ```sh
-sudo zypper install gcc-c++ git curl wget nasm yasm gcc gtk3-devel clang libxcb-devel libXfixes-devel cmake alsa-lib-devel gstreamer-devel gstreamer-plugins-base-devel xdotool-devel
+sudo zypper install gcc-c++ git curl wget nasm yasm gcc gtk3-devel clang libxcb-devel libXfixes-devel cmake alsa-lib-devel gstreamer-devel gstreamer-plugins-base-devel xdotool-devel pam-devel
 ```
 
 ### Fedora 28 (CentOS 8)
 
 ```sh
-sudo yum -y install gcc-c++ git curl wget nasm yasm gcc gtk3-devel clang libxcb-devel libxdo-devel libXfixes-devel pulseaudio-libs-devel cmake alsa-lib-devel gstreamer1-devel gstreamer1-plugins-base-devel
+sudo yum -y install gcc-c++ git curl wget nasm yasm gcc gtk3-devel clang libxcb-devel libxdo-devel libXfixes-devel pulseaudio-libs-devel cmake alsa-lib-devel gstreamer1-devel gstreamer1-plugins-base-devel pam-devel
 ```
 
 ### Arch (Manjaro)
@@ -160,6 +160,7 @@ target/release/rustdesk
 - **[src/rendezvous_mediator.rs](https://github.com/rustdesk/rustdesk/tree/master/src/rendezvous_mediator.rs)**: комунікація з [rustdesk-server](https://github.com/rustdesk/rustdesk-server), очікування віддаленого прямого (обхід TCP NAT) або ретрансльованого зʼєднання
 - **[src/platform](https://github.com/rustdesk/rustdesk/tree/master/src/platform)**: специфічний для платформи код
 - **[flutter](https://github.com/rustdesk/rustdesk/tree/master/flutter)**: код Flutter для мобільних пристроїв 
+- **[flutter/web/js](https://github.com/rustdesk/rustdesk/tree/master/flutter/web/js)**: JavaScript для веб клієнта на Flutter
 
 ## Знімки екрана
 

docs/README-VN.md

@@ -148,6 +148,7 @@ Hãy đảm bảo rằng bạn đang chạy các lệnh này từ gốc của th
 - **[src/rendezvous_mediator.rs](https://github.com/rustdesk/rustdesk/tree/master/src/rendezvous_mediator.rs)**: giao tiếp với [rustdesk-server](https://github.com/rustdesk/rustdesk-server), đợi kết nối trực tiếp (TCP hole punching) hoặc kết nối được chuyển tiếp.
 - **[src/platform](https://github.com/rustdesk/rustdesk/tree/master/src/platform)**: mã nguồn riêng cho mỗi nền tảng
 - **[flutter](https://github.com/rustdesk/rustdesk/tree/master/flutter)**: Mã Flutter dành máy tính và điện thoại
+- **[flutter/web/js](https://github.com/rustdesk/rustdesk/tree/master/flutter/web/js)**: Mã JavaScript dành cho giao diện trên web bằng Flutter
 
 ## Snapshot
 

docs/README-ZH.md

@@ -220,6 +220,7 @@ target/release/rustdesk
 - **[src/rendezvous_mediator.rs](https://github.com/rustdesk/rustdesk/tree/master/src/rendezvous_mediator.rs)**: 与[rustdesk-server](https://github.com/rustdesk/rustdesk-server)保持UDP通讯, 等待远程连接（通过打洞直连或者中继）
 - **[src/platform](https://github.com/rustdesk/rustdesk/tree/master/src/platform)**: 平台服务相关代码
 - **[flutter](https://github.com/rustdesk/rustdesk/tree/master/flutter)**: 适用于桌面和移动设备的 Flutter 代码
+- **[flutter/web/js](https://github.com/rustdesk/rustdesk/tree/master/flutter/web/js)**: Flutter Web版本中的Javascript代码
 
 ## 截图
 

entrypoint.sh

@@ -33,4 +33,4 @@ if [ -z $release ]; then
 fi
 set -f
 #shellcheck disable=2086
-VCPKG_ROOT=/vcpkg cargo build --locked $argv
+VCPKG_ROOT=/vcpkg cargo build $argv

flatpak/rustdesk.json

@@ -21,6 +21,18 @@
         }
       ]
     },
+    {
+      "name": "pam",
+      "buildsystem": "autotools",
+      "config-opts": ["--disable-selinux"],
+      "sources": [
+        {
+          "type": "archive",
+          "url": "https://github.com/linux-pam/linux-pam/releases/download/v1.3.1/Linux-PAM-1.3.1.tar.xz",
+          "sha256": "eff47a4ecd833fbf18de9686632a70ee8d0794b79aecb217ebd0ce11db4cd0db"
+        }
+      ]
+    },
     {
       "name": "rustdesk",
       "buildsystem": "simple",
@@ -51,4 +63,4 @@
     "--socket=pulseaudio",
     "--talk-name=org.freedesktop.Flatpak"
   ]
-}
+}

flutter/android/app/build.gradle

@@ -82,8 +82,7 @@ protobuf {
 }
 
 android {
-    namespace "com.carriez.flutter_hbb"
-    compileSdkVersion 36
+    compileSdkVersion 34
     sourceSets {
         main.java.srcDirs += 'src/main/kotlin'
 
@@ -92,7 +91,6 @@ android {
     }
 
     compileOptions {
-        coreLibraryDesugaringEnabled true
         targetCompatibility JavaVersion.VERSION_1_8
         sourceCompatibility JavaVersion.VERSION_1_8
     }
@@ -101,7 +99,7 @@ android {
         // TODO: Specify your own unique Application ID (https://developer.android.com/studio/build/application-id.html).
         applicationId "com.carriez.flutter_hbb"
         minSdkVersion 22
-        targetSdkVersion 36
+        targetSdkVersion 33
         versionCode flutterVersionCode.toInteger()
         versionName flutterVersionName
     }
@@ -130,7 +128,6 @@ flutter {
 }
 
 dependencies {
-    coreLibraryDesugaring 'com.android.tools:desugar_jdk_libs:2.1.4'
     implementation 'com.google.protobuf:protobuf-javalite:3.20.1'
     implementation "androidx.media:media:1.6.0"
     implementation 'com.github.getActivity:XXPermissions:18.5'

flutter/android/app/src/main/AndroidManifest.xml

@@ -1,19 +1,15 @@
 <?xml version="1.0" encoding="utf-8"?>
 <manifest xmlns:android="http://schemas.android.com/apk/res/android"
-    xmlns:tools="http://schemas.android.com/tools"
     package="com.carriez.flutter_hbb">
 
-    <uses-permission android:name="android.permission.MANAGE_EXTERNAL_STORAGE" tools:node="remove" />
-    <uses-permission android:name="android.permission.READ_EXTERNAL_STORAGE" tools:node="remove" />
-    <uses-permission android:name="android.permission.WRITE_EXTERNAL_STORAGE" tools:node="remove" />
+    <uses-permission android:name="android.permission.MANAGE_EXTERNAL_STORAGE" />
     <uses-permission android:name="android.permission.POST_NOTIFICATIONS" />
     <uses-permission android:name="android.permission.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS" />
+    <uses-permission android:name="android.permission.READ_EXTERNAL_STORAGE" />
+    <uses-permission android:name="android.permission.WRITE_EXTERNAL_STORAGE" />
     <uses-permission android:name="android.permission.INTERNET" />
     <uses-permission android:name="android.permission.ACCESS_NETWORK_STATE" />
     <uses-permission android:name="android.permission.FOREGROUND_SERVICE" />
-    <uses-permission android:name="android.permission.FOREGROUND_SERVICE_MEDIA_PROJECTION" />
-    <uses-permission android:name="android.permission.FOREGROUND_SERVICE_MICROPHONE" />
-    <uses-permission android:name="android.permission.FOREGROUND_SERVICE_SPECIAL_USE" />
     <uses-permission android:name="android.permission.RECORD_AUDIO" />
     <uses-permission android:name="android.permission.WAKE_LOCK" />
     <uses-permission android:name="android.permission.RECEIVE_BOOT_COMPLETED" />
@@ -30,6 +26,7 @@
         android:name=".MainApplication"
         android:icon="@mipmap/ic_launcher"
         android:label="RustDesk"
+        android:requestLegacyExternalStorage="true"
         android:roundIcon="@mipmap/ic_launcher"
         android:supportsRtl="true">
 
@@ -91,12 +88,7 @@
         <service
             android:name=".MainService"
             android:enabled="true"
-            android:exported="false"
-            android:foregroundServiceType="specialUse|mediaProjection|microphone">
-            <property
-                android:name="android.app.PROPERTY_SPECIAL_USE_FGS_SUBTYPE"
-                android:value="@string/foreground_service_special_use_subtype" />
-        </service>
+            android:foregroundServiceType="mediaProjection" />
 
         <service
             android:name=".FloatingWindowService"

flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/AudioRecordHandle.kt

@@ -18,33 +18,7 @@ const val AUDIO_SAMPLE_RATE = 48000
 const val AUDIO_CHANNEL_MASK = AudioFormat.CHANNEL_IN_STEREO
 
 class AudioRecordHandle(private var context: Context, private var isVideoStart: ()->Boolean, private var isAudioStart: ()->Boolean) {
-    companion object {
-        private const val LOG_TAG = "LOG_AUDIO_RECORD_HANDLE"
-        private const val NO_ACTIVE_PUBLISHERS = 0
-        private var activeAudioFramePublishers = NO_ACTIVE_PUBLISHERS
-
-        @Synchronized
-        private fun acquireAudioFramePublisher() {
-            if (activeAudioFramePublishers == NO_ACTIVE_PUBLISHERS) {
-                FFI.setFrameRawEnable("audio", true)
-            }
-            activeAudioFramePublishers++
-        }
-
-        @Synchronized
-        private fun releaseAudioFramePublisher() {
-            if (activeAudioFramePublishers == NO_ACTIVE_PUBLISHERS) {
-                Log.e(LOG_TAG, "No active audio frame publisher to release")
-                return
-            }
-            activeAudioFramePublishers--
-            if (activeAudioFramePublishers == NO_ACTIVE_PUBLISHERS) {
-                FFI.setFrameRawEnable("audio", false)
-            }
-        }
-    }
-
-    private val logTag = LOG_TAG
+    private val logTag = "LOG_AUDIO_RECORD_HANDLE"
 
     private var audioRecorder: AudioRecord? = null
     private var audioReader: AudioReader? = null
@@ -105,94 +79,48 @@ class AudioRecordHandle(private var context: Context, private var isVideoStart:
             return
         }
         // read f32 to byte , length * 4
-        val bufferSize = 2 * 4 * AudioRecord.getMinBufferSize(
+        minBufferSize = 2 * 4 * AudioRecord.getMinBufferSize(
             AUDIO_SAMPLE_RATE,
             AUDIO_CHANNEL_MASK,
             AUDIO_ENCODING
         )
-        if (bufferSize <= 0) {
+        if (minBufferSize == 0) {
             Log.d(logTag, "get min buffer size fail!")
             return
         }
-        audioReader = AudioReader(bufferSize, 4)
-        minBufferSize = bufferSize
+        audioReader = AudioReader(minBufferSize, 4)
         Log.d(logTag, "init audioData len:$minBufferSize")
     }
 
-    private fun releaseRecorder(recorder: AudioRecord) {
-        try {
-            recorder.release()
-        } finally {
-            if (audioRecorder === recorder) {
-                audioRecorder = null
-            }
-        }
-    }
-
-    private fun captureAudio(reader: AudioReader, recorder: AudioRecord) {
-        try {
-            while (audioRecordStat) {
-                reader.readSync(recorder)?.let {
-                    FFI.onAudioFrameUpdate(it)
-                }
-            }
-        } finally {
-            minBufferSize = 0
-            try {
-                releaseRecorder(recorder)
-            } finally {
-                releaseAudioFramePublisher()
-                Log.d(logTag, "Exit audio thread")
-            }
-        }
-    }
-
     @RequiresApi(Build.VERSION_CODES.M)
-    fun startAudioRecorder(): Boolean {
-        val recorder = audioRecorder
-        if (recorder == null) {
-            Log.d(logTag, "startAudioRecorder fail")
-            return false
-        }
-        var audioFramePublisherAcquired = false
-        return try {
-            checkAudioReader()
-            val reader = audioReader
-            if (reader == null || minBufferSize == 0) {
-                releaseRecorder(recorder)
-                Log.d(logTag, "startAudioRecorder fail")
-                return false
-            }
-            recorder.startRecording()
-            if (recorder.recordingState != AudioRecord.RECORDSTATE_RECORDING) {
-                throw IllegalStateException("AudioRecord failed to enter recording state")
-            }
-            audioRecordStat = true
-            val captureThread = thread(start = false) { captureAudio(reader, recorder) }
-            acquireAudioFramePublisher()
-            audioFramePublisherAcquired = true
-            audioThread = captureThread
-            captureThread.start()
-            true
-        } catch (error: Exception) {
-            audioRecordStat = false
-            audioThread = null
-            Log.e(logTag, "startAudioRecorder fail", error)
+    fun startAudioRecorder() {
+        checkAudioReader()
+        if (audioReader != null && audioRecorder != null && minBufferSize != 0) {
             try {
-                releaseRecorder(recorder)
-            } finally {
-                if (audioFramePublisherAcquired) {
-                    releaseAudioFramePublisher()
+                FFI.setFrameRawEnable("audio", true)
+                audioRecorder!!.startRecording()
+                audioRecordStat = true
+                audioThread = thread {
+                    while (audioRecordStat) {
+                        audioReader!!.readSync(audioRecorder!!)?.let {
+                            FFI.onAudioFrameUpdate(it)
+                        }
+                    }
+                    // let's release here rather than onDestroy to avoid threading issue
+                    audioRecorder?.release()
+                    audioRecorder = null
+                    minBufferSize = 0
+                    FFI.setFrameRawEnable("audio", false)
+                    Log.d(logTag, "Exit audio thread")
                 }
+            } catch (e: Exception) {
+                Log.d(logTag, "startAudioRecorder fail:$e")
             }
-            false
+        } else {
+            Log.d(logTag, "startAudioRecorder fail")
         }
     }
 
-    fun isVoiceCallActive(): Boolean {
-        return audioRecorder?.audioSource == MediaRecorder.AudioSource.VOICE_COMMUNICATION
-    }
-
     fun onVoiceCallStarted(mediaProjection: MediaProjection?): Boolean {
         if (!isSupportVoiceCall()) {
             return false
@@ -209,9 +137,11 @@ class AudioRecordHandle(private var context: Context, private var isVideoStart:
         if (!isSupportVoiceCall()) {
             return true
         }
-        val switched = !isVideoStart() || switchOutVoiceCall(mediaProjection)
+        if (isVideoStart()) {
+            switchOutVoiceCall(mediaProjection)
+        }
         tryReleaseAudio()
-        return switched
+        return true
     }
 
     @RequiresApi(Build.VERSION_CODES.M)
@@ -229,7 +159,8 @@ class AudioRecordHandle(private var context: Context, private var isVideoStart:
             Log.e(logTag, "createAudioRecorder fail")
             return false
         }
-        return startAudioRecorder()
+        startAudioRecorder()
+        return true
     }
 
     @RequiresApi(Build.VERSION_CODES.M)
@@ -246,7 +177,8 @@ class AudioRecordHandle(private var context: Context, private var isVideoStart:
             Log.e(logTag, "createAudioRecorder fail")
             return false
         }
-        return startAudioRecorder()
+        startAudioRecorder()
+        return true
     }
 
     fun tryReleaseAudio() {

flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/InputService.kt

@@ -8,7 +8,6 @@ package com.carriez.flutter_hbb
 
 import android.accessibilityservice.AccessibilityService
 import android.accessibilityservice.GestureDescription
-import android.content.Intent
 import android.graphics.Path
 import android.os.Build
 import android.os.Bundle
@@ -69,16 +68,6 @@ class InputService : AccessibilityService() {
             get() = ctx != null
     }
 
-    private fun notifyInputState() {
-        val inputState = isOpen.toString()
-        Handler(Looper.getMainLooper()).post {
-            MainActivity.flutterMethodChannel?.invokeMethod(
-                "on_state_changed",
-                mapOf("name" to "input", "value" to inputState)
-            )
-        }
-    }
-
     private val logTag = "input service"
     private var leftIsDown = false
     private var touchPath = Path()
@@ -727,7 +716,6 @@ class InputService : AccessibilityService() {
     override fun onServiceConnected() {
         super.onServiceConnected()
         ctx = this
-        notifyInputState()
         val info = AccessibilityServiceInfo()
         if (Build.VERSION.SDK_INT >= 33) {
             info.flags = FLAG_INPUT_METHOD_EDITOR or FLAG_RETRIEVE_INTERACTIVE_WINDOWS
@@ -746,16 +734,8 @@ class InputService : AccessibilityService() {
 
     override fun onDestroy() {
         ctx = null
-        // Keep this fallback even though onUnbind usually notifies first.
-        notifyInputState()
         super.onDestroy()
     }
 
-    override fun onUnbind(intent: Intent?): Boolean {
-        ctx = null
-        notifyInputState()
-        return super.onUnbind(intent)
-    }
-
     override fun onInterrupt() {}
 }

flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/MainActivity.kt

@@ -9,7 +9,6 @@ package com.carriez.flutter_hbb
 
 import ffi.FFI
 
-import android.app.Activity
 import android.content.ComponentName
 import android.content.Context
 import android.content.Intent
@@ -25,10 +24,6 @@ import android.media.MediaCodecInfo.CodecCapabilities.COLOR_FormatSurface
 import android.media.MediaCodecInfo.CodecCapabilities.COLOR_FormatYUV420SemiPlanar
 import android.media.MediaCodecList
 import android.media.MediaFormat
-import android.net.Uri
-import android.provider.DocumentsContract
-import android.provider.OpenableColumns
-import android.webkit.MimeTypeMap
 import android.util.DisplayMetrics
 import androidx.annotation.RequiresApi
 import org.json.JSONArray
@@ -38,9 +33,6 @@ import io.flutter.embedding.android.FlutterActivity
 import io.flutter.embedding.engine.FlutterEngine
 import io.flutter.plugin.common.MethodChannel
 import kotlin.concurrent.thread
-import java.io.File
-import java.io.FileInputStream
-import java.io.FileOutputStream
 
 
 class MainActivity : FlutterActivity() {
@@ -54,23 +46,6 @@ class MainActivity : FlutterActivity() {
     private val channelTag = "mChannel"
     private val logTag = "mMainActivity"
     private var mainService: MainService? = null
-    private sealed class PendingPicker {
-        data class ImportFiles(val result: MethodChannel.Result) : PendingPicker()
-        data class ExportFile(val source: File, val result: MethodChannel.Result) : PendingPicker()
-        data class ImportDirectory(val result: MethodChannel.Result) : PendingPicker()
-        data class ExportFiles(
-            val sources: List<File>,
-            val rejected: Int,
-            val result: MethodChannel.Result
-        ) : PendingPicker()
-    }
-
-    private data class ExportSource(
-        val file: File,
-        val children: List<ExportSource>?
-    )
-
-    private var pendingPicker: PendingPicker? = null
 
     private var isAudioStart = false
     private val audioRecordHandle = AudioRecordHandle(this, { false }, { isAudioStart })
@@ -116,108 +91,6 @@ class MainActivity : FlutterActivity() {
 
     override fun onActivityResult(requestCode: Int, resultCode: Int, data: Intent?) {
         super.onActivityResult(requestCode, resultCode, data)
-        if (requestCode == REQ_IMPORT_FILES) {
-            val pending = pendingPicker as? PendingPicker.ImportFiles ?: return
-            pendingPicker = null
-            if (resultCode != Activity.RESULT_OK || data == null) {
-                pending.result.success(emptyList<Map<String, String>>())
-                return
-            }
-
-            val uris = linkedSetOf<Uri>()
-            data.data?.let { uris.add(it) }
-            data.clipData?.let { clipData ->
-                for (index in 0 until clipData.itemCount) {
-                    uris.add(clipData.getItemAt(index).uri)
-                }
-            }
-            thread {
-                val files = uris.map { uri ->
-                    mapOf(
-                        "uri" to uri.toString(),
-                        "name" to (displayName(uri) ?: uri.lastPathSegment.orEmpty())
-                    )
-                }
-                runOnUiThread { pending.result.success(files) }
-            }
-            return
-        }
-        if (requestCode == REQ_EXPORT_FILE) {
-            val pending = pendingPicker as? PendingPicker.ExportFile ?: return
-            pendingPicker = null
-            val destination = data?.data
-
-            if (resultCode != Activity.RESULT_OK || destination == null) {
-                pending.result.success(false)
-                return
-            }
-
-            thread {
-                try {
-                    FileInputStream(pending.source).use { input ->
-                        contentResolver.openOutputStream(destination, "wt")?.use { output ->
-                            input.copyTo(output)
-                        } ?: throw IllegalStateException("Unable to open the selected destination")
-                    }
-                    runOnUiThread { pending.result.success(true) }
-                } catch (e: Exception) {
-                    Log.e(logTag, "Failed to export file", e)
-                    runOnUiThread {
-                        pending.result.error("export_failed", e.message, null)
-                    }
-                }
-            }
-            return
-        }
-        if (requestCode == REQ_IMPORT_DIRECTORY) {
-            val pending = pendingPicker as? PendingPicker.ImportDirectory ?: return
-            pendingPicker = null
-            val treeUri = data?.data
-            if (resultCode != Activity.RESULT_OK || treeUri == null) {
-                pending.result.success(null)
-                return
-            }
-            thread {
-                val selected = mapOf(
-                    "uri" to treeUri.toString(),
-                    "name" to (treeDisplayName(treeUri) ?: "Imported")
-                )
-                runOnUiThread { pending.result.success(selected) }
-            }
-            return
-        }
-        if (requestCode == REQ_EXPORT_FILES) {
-            val pending = pendingPicker as? PendingPicker.ExportFiles ?: return
-            pendingPicker = null
-            val treeUri = data?.data
-            if (resultCode != Activity.RESULT_OK || treeUri == null) {
-                pending.result.success(null)
-                return
-            }
-            thread {
-                var exported = 0
-                var failed = pending.rejected
-                var processed = 0
-                try {
-                    val sources = pending.sources.map { snapshotExportSource(it) }
-                    val rootDocId = DocumentsContract.getTreeDocumentId(treeUri)
-                    sources.forEach { source ->
-                        val ok = source?.let {
-                            copyExportSourceToTree(treeUri, rootDocId, it)
-                        } ?: false
-                        if (ok) exported++ else failed++
-                        processed++
-                    }
-                } catch (e: Exception) {
-                    Log.e(logTag, "Failed to export selected files", e)
-                    failed += pending.sources.size - processed
-                }
-                runOnUiThread {
-                    pending.result.success(mapOf("exported" to exported, "failed" to failed))
-                }
-            }
-            return
-        }
         if (requestCode == REQ_INVOKE_PERMISSION_ACTIVITY_MEDIA_PROJECTION && resultCode == RES_FAILED) {
             flutterMethodChannel?.invokeMethod("on_media_projection_canceled", null)
         }
@@ -233,16 +106,6 @@ class MainActivity : FlutterActivity() {
 
     override fun onDestroy() {
         Log.e(logTag, "onDestroy")
-        // The process can outlive the UI whenever something keeps it alive:
-        // MainService, or the accessibility InputService on its own. Only the
-        // former gets onTaskRemoved, so close outgoing sessions here too,
-        // otherwise a session survives with no UI left to close it.
-        // `isFinishing` distinguishes the user really leaving from a destroy
-        // for recreation (configuration change, "don't keep activities"),
-        // which must not tear down a live session.
-        if (isFinishing) {
-            FFI.closeAllSessions()
-        }
         mainService?.let {
             unbindService(serviceConnection)
         }
@@ -337,13 +200,12 @@ class MainActivity : FlutterActivity() {
                 "stop_input" -> {
                     if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.N) {
                         InputService.ctx?.disableSelf()
-                    } else {
-                        InputService.ctx = null
-                        Companion.flutterMethodChannel?.invokeMethod(
-                            "on_state_changed",
-                            mapOf("name" to "input", "value" to InputService.isOpen.toString())
-                        )
                     }
+                    InputService.ctx = null
+                    Companion.flutterMethodChannel?.invokeMethod(
+                        "on_state_changed",
+                        mapOf("name" to "input", "value" to InputService.isOpen.toString())
+                    )
                     result.success(true)
                 }
                 "cancel_notification" -> {
@@ -394,242 +256,6 @@ class MainActivity : FlutterActivity() {
                         result.success(false)
                     }
                 }
-                PICK_IMPORT_FILES -> {
-                    if (pendingPicker != null) {
-                        result.error("picker_in_progress", "Another document picker is already open", null)
-                    } else {
-                        pendingPicker = PendingPicker.ImportFiles(result)
-                        try {
-                            startActivityForResult(
-                                Intent(Intent.ACTION_OPEN_DOCUMENT).apply {
-                                    addCategory(Intent.CATEGORY_OPENABLE)
-                                    type = "*/*"
-                                    putExtra(Intent.EXTRA_ALLOW_MULTIPLE, true)
-                                },
-                                REQ_IMPORT_FILES
-                            )
-                        } catch (e: Exception) {
-                            pendingPicker = null
-                            result.error("picker_unavailable", e.message, null)
-                        }
-                    }
-                }
-                IMPORT_FILE -> {
-                    val arguments = call.arguments as? Map<*, *>
-                    val uri = (arguments?.get("uri") as? String)?.let {
-                        runCatching { Uri.parse(it) }.getOrNull()
-                    }
-                    val path = arguments?.get("path") as? String
-                    val overwrite = arguments?.get("overwrite") as? Boolean ?: false
-                    val destination = path?.let { canonicalAppScopedFile(it) }
-
-                    if (uri?.scheme != "content") {
-                        result.error("invalid_uri", "The selected document URI is invalid", null)
-                    } else if (destination == null ||
-                        destination.isDirectory ||
-                        destination.parentFile?.isDirectory != true) {
-                        result.error("invalid_destination", "The destination is outside app-scoped storage", null)
-                    } else {
-                        thread {
-                            var temporary: File? = null
-                            var reservedDestination = false
-                            var errorCode = "import_failed"
-                            try {
-                                val temporaryFile = File.createTempFile(
-                                    ".rustdesk-import-",
-                                    ".tmp",
-                                    destination.parentFile
-                                )
-                                temporary = temporaryFile
-                                contentResolver.openInputStream(uri)?.use { input ->
-                                    FileOutputStream(temporaryFile).use { output ->
-                                        input.copyTo(output)
-                                    }
-                                } ?: throw IllegalStateException("Unable to open the selected document")
-                                if (!overwrite) {
-                                    reservedDestination = destination.createNewFile()
-                                    if (!reservedDestination) {
-                                        throw IllegalStateException("The destination already exists")
-                                    }
-                                }
-                                if (!temporaryFile.renameTo(destination)) {
-                                    if (reservedDestination) {
-                                        destination.delete()
-                                    }
-                                    errorCode = "rename_failed"
-                                    throw IllegalStateException("Unable to replace the destination")
-                                }
-                                runOnUiThread { result.success(true) }
-                            } catch (e: Exception) {
-                                Log.e(logTag, "Failed to import file", e)
-                                runOnUiThread {
-                                    result.error(errorCode, e.message, null)
-                                }
-                            } finally {
-                                temporary?.delete()
-                            }
-                        }
-                    }
-                }
-                EXPORT_FILE -> {
-                    val path = (call.arguments as? Map<*, *>)?.get("path") as? String
-                    val source = path?.let { canonicalExportSource(it) }
-
-                    if (source?.isFile != true) {
-                        result.error("invalid_source", "The file is outside app-scoped storage", null)
-                    } else if (pendingPicker != null) {
-                        result.error("picker_in_progress", "Another document picker is already open", null)
-                    } else {
-                        val mimeType = MimeTypeMap.getSingleton()
-                            .getMimeTypeFromExtension(source.extension.lowercase())
-                            ?: "application/octet-stream"
-                        pendingPicker = PendingPicker.ExportFile(source, result)
-                        try {
-                            startActivityForResult(
-                                Intent(Intent.ACTION_CREATE_DOCUMENT).apply {
-                                    addCategory(Intent.CATEGORY_OPENABLE)
-                                    type = mimeType
-                                    putExtra(Intent.EXTRA_TITLE, source.name)
-                                },
-                                REQ_EXPORT_FILE
-                            )
-                        } catch (e: Exception) {
-                            pendingPicker = null
-                            result.error("picker_unavailable", e.message, null)
-                        }
-                    }
-                }
-                PICK_IMPORT_DIRECTORY -> {
-                    if (pendingPicker != null) {
-                        result.error("picker_in_progress", "Another document picker is already open", null)
-                    } else {
-                        pendingPicker = PendingPicker.ImportDirectory(result)
-                        try {
-                            startActivityForResult(
-                                Intent(Intent.ACTION_OPEN_DOCUMENT_TREE).apply {
-                                    putExtra(Intent.EXTRA_TITLE, "Select the folder to import")
-                                },
-                                REQ_IMPORT_DIRECTORY
-                            )
-                        } catch (e: Exception) {
-                            pendingPicker = null
-                            result.error("picker_unavailable", e.message, null)
-                        }
-                    }
-                }
-                IMPORT_DIRECTORY -> {
-                    val arguments = call.arguments as? Map<*, *>
-                    val uri = (arguments?.get("uri") as? String)?.let {
-                        runCatching { Uri.parse(it) }.getOrNull()
-                    }
-                    val path = arguments?.get("path") as? String
-                    val overwrite = arguments?.get("overwrite") as? Boolean ?: false
-                    val destination = path?.let { canonicalAppScopedFile(it) }
-
-                    if (uri?.scheme != "content") {
-                        result.error("invalid_uri", "The selected document URI is invalid", null)
-                    } else if (destination == null ||
-                        destination.parentFile?.isDirectory != true ||
-                        (destination.exists() && !destination.isDirectory)) {
-                        result.error("invalid_destination", "The destination is outside app-scoped storage", null)
-                    } else {
-                        thread {
-                            var temporary: File? = null
-                            var backup: File? = null
-                            val ok = try {
-                                val parent = destination.parentFile
-                                    ?: throw IllegalStateException("The destination has no parent")
-                                temporary = File.createTempFile(
-                                    ".rustdesk-import-dir-",
-                                    ".tmp",
-                                    parent
-                                ).also {
-                                    if (!it.delete() || !it.mkdir()) {
-                                        throw IllegalStateException("Unable to create a temporary folder")
-                                    }
-                                }
-                                if (!copyDocumentTreeToFile(uri, temporary!!)) {
-                                    throw IllegalStateException("Unable to read all folder contents")
-                                }
-                                if (destination.exists()) {
-                                    if (!overwrite) {
-                                        throw IllegalStateException("The destination already exists")
-                                    }
-                                    val backupFile = File.createTempFile(
-                                        ".rustdesk-import-backup-",
-                                        ".tmp",
-                                        parent
-                                    )
-                                    if (!backupFile.delete()) {
-                                        throw IllegalStateException("Unable to prepare the destination backup")
-                                    }
-                                    backup = backupFile
-                                    if (!destination.renameTo(backupFile)) {
-                                        throw IllegalStateException("Unable to replace the destination")
-                                    }
-                                }
-                                if (!temporary!!.renameTo(destination)) {
-                                    val destinationBackup = backup
-                                    if (destinationBackup != null &&
-                                        !destinationBackup.renameTo(destination)
-                                    ) {
-                                        throw IllegalStateException(
-                                            "Unable to move the imported folder and restore " +
-                                                "the destination from $destinationBackup"
-                                        )
-                                    }
-                                    throw IllegalStateException("Unable to move the imported folder")
-                                }
-                                temporary = null
-                                val destinationBackup = backup
-                                if (destinationBackup != null &&
-                                    !destinationBackup.deleteRecursively()
-                                ) {
-                                    throw IllegalStateException(
-                                        "Unable to remove the destination backup: $destinationBackup"
-                                    )
-                                }
-                                backup = null
-                                true
-                            } catch (e: Exception) {
-                                Log.e(logTag, "Failed to import directory", e)
-                                false
-                            } finally {
-                                temporary?.deleteRecursively()
-                            }
-                            runOnUiThread { result.success(ok) }
-                        }
-                    }
-                }
-                EXPORT_FILES -> {
-                    val paths = (call.arguments as? Map<*, *>)?.get("paths") as? List<*>
-                    if (paths.isNullOrEmpty()) {
-                        result.error("invalid_source", "The selected files are outside app-scoped storage", null)
-                    } else {
-                        val sources = paths.mapNotNull {
-                            (it as? String)?.let(::canonicalExportSource)
-                        }
-                        val rejected = paths.size - sources.size
-                        if (sources.isEmpty()) {
-                            result.success(mapOf("exported" to 0, "failed" to rejected))
-                        } else if (pendingPicker != null) {
-                            result.error("picker_in_progress", "Another document picker is already open", null)
-                        } else {
-                            pendingPicker = PendingPicker.ExportFiles(sources, rejected, result)
-                            try {
-                                startActivityForResult(
-                                    Intent(Intent.ACTION_OPEN_DOCUMENT_TREE).apply {
-                                        putExtra(Intent.EXTRA_TITLE, "Select the destination folder")
-                                    },
-                                    REQ_EXPORT_FILES
-                                )
-                            } catch (e: Exception) {
-                                pendingPicker = null
-                                result.error("picker_unavailable", e.message, null)
-                            }
-                        }
-                    }
-                }
                 GET_VALUE -> {
                     if (call.arguments is String) {
                         if (call.arguments == KEY_IS_SUPPORT_VOICE_CALL) {
@@ -654,228 +280,6 @@ class MainActivity : FlutterActivity() {
         }
     }
 
-    private fun canonicalAppScopedFile(path: String): File? {
-        val file = runCatching { File(path).canonicalFile }.getOrNull() ?: return null
-        val allowedRoots = listOfNotNull(filesDir, getExternalFilesDir(null)).mapNotNull {
-            runCatching { it.canonicalFile }.getOrNull()
-        }
-        return file.takeIf { candidate ->
-            allowedRoots.any { root ->
-                candidate == root || candidate.path.startsWith(root.path + File.separator)
-            }
-        }
-    }
-
-    private fun canonicalExportSource(path: String): File? {
-        val original = File(path).absoluteFile
-        val canonical = canonicalAppScopedFile(path) ?: return null
-        return canonical.takeIf {
-            original.path == canonical.path && (canonical.isFile || canonical.isDirectory)
-        }
-    }
-
-    private fun snapshotExportSource(source: File): ExportSource? {
-        val safeSource = canonicalExportSource(source.path) ?: return null
-        if (safeSource.isFile) return ExportSource(safeSource, null)
-        val sourceChildren = safeSource.listFiles() ?: return null
-        val children = ArrayList<ExportSource>(sourceChildren.size)
-        for (child in sourceChildren) {
-            val snapshot = snapshotExportSource(child) ?: return null
-            children.add(snapshot)
-        }
-        return ExportSource(safeSource, children)
-    }
-
-    private fun copyExportSourceToTree(
-        treeUri: Uri,
-        parentDocId: String,
-        source: ExportSource
-    ): Boolean {
-        val children = source.children
-        return if (children == null) {
-            copyFileToTree(treeUri, parentDocId, source.file)
-        } else {
-            copyDirToTree(treeUri, parentDocId, source)
-        }
-    }
-
-    private fun treeDisplayName(treeUri: Uri): String? {
-        return try {
-            val rootDocId = DocumentsContract.getTreeDocumentId(treeUri)
-            val docUri = DocumentsContract.buildDocumentUriUsingTree(treeUri, rootDocId)
-            contentResolver.query(
-                docUri,
-                arrayOf(DocumentsContract.Document.COLUMN_DISPLAY_NAME),
-                null,
-                null,
-                null
-            )?.use { cursor -> if (cursor.moveToFirst()) cursor.getString(0) else null }
-        } catch (e: Exception) {
-            Log.w(logTag, "Failed to read selected folder name", e)
-            null
-        }
-    }
-
-    private fun copyDocumentTreeToFile(treeUri: Uri, destinationDir: File): Boolean {
-        val rootDocId = DocumentsContract.getTreeDocumentId(treeUri)
-        return copyChildrenToFile(treeUri, rootDocId, destinationDir)
-    }
-
-    private fun copyChildrenToFile(
-        treeUri: Uri,
-        parentDocId: String,
-        destinationDir: File
-    ): Boolean {
-        val childrenUri = DocumentsContract.buildChildDocumentsUriUsingTree(treeUri, parentDocId)
-        var ok = true
-        val destinationNames = HashSet<String>()
-        val cursor = contentResolver.query(childrenUri, childColumns, null, null, null)
-            ?: return false
-        cursor.use {
-            while (cursor.moveToNext()) {
-                val docId = cursor.getString(0)
-                val name = cursor.getString(1)
-                val mime = cursor.getString(2)
-                val docUri = DocumentsContract.buildDocumentUriUsingTree(treeUri, docId)
-                if (name != null && !destinationNames.add(name)) {
-                    ok = false
-                    continue
-                }
-                val destination = safeDestinationChild(destinationDir, name)
-                if (destination == null || destination.exists()) {
-                    ok = false
-                    continue
-                }
-                if (mime == DocumentsContract.Document.MIME_TYPE_DIR) {
-                    if (!destination.mkdirs() && !destination.isDirectory) {
-                        ok = false
-                        continue
-                    }
-                    if (!copyChildrenToFile(treeUri, docId, destination)) {
-                        ok = false
-                    }
-                } else if (!copyDocumentToFile(docUri, destination)) {
-                    ok = false
-                }
-            }
-        }
-        return ok
-    }
-
-    private fun safeDestinationChild(destinationDir: File, name: String?): File? {
-        if (name.isNullOrEmpty() || name == "." || name == ".." ||
-            name.indexOf('\u0000') >= 0 || name.contains('/') || name.contains('\\')) {
-            return null
-        }
-        val parent = runCatching { destinationDir.canonicalFile }.getOrNull() ?: return null
-        val child = runCatching { File(parent, name).canonicalFile }.getOrNull() ?: return null
-        return child.takeIf { it.path.startsWith(parent.path + File.separator) }
-    }
-
-    private fun copyDocumentToFile(uri: Uri, destination: File): Boolean {
-        return try {
-            destination.parentFile?.mkdirs()
-            if (destination.exists() && !destination.delete()) {
-                return false
-            }
-            contentResolver.openInputStream(uri)?.use { input ->
-                FileOutputStream(destination).use { output -> input.copyTo(output) }
-            } != null
-        } catch (e: Exception) {
-            Log.e(logTag, "Failed to copy document to $destination", e)
-            false
-        }
-    }
-
-    private fun copyFileToTree(treeUri: Uri, parentDocId: String, source: File): Boolean {
-        val safeSource = canonicalExportSource(source.path)?.takeIf { it.isFile } ?: return false
-        return try {
-            val mime = MimeTypeMap.getSingleton()
-                .getMimeTypeFromExtension(safeSource.extension.lowercase())
-                ?: "application/octet-stream"
-            val parentUri = DocumentsContract.buildDocumentUriUsingTree(treeUri, parentDocId)
-            val docUri = DocumentsContract.createDocument(
-                contentResolver,
-                parentUri,
-                mime,
-                safeSource.name
-            ) ?: return false
-            contentResolver.openOutputStream(docUri, "wt")?.use { output ->
-                FileInputStream(safeSource).use { input -> input.copyTo(output) }
-            } ?: return false
-            true
-        } catch (e: Exception) {
-            Log.e(logTag, "Failed to export file $safeSource", e)
-            false
-        }
-    }
-
-    private fun copyDirToTree(
-        treeUri: Uri,
-        parentDocId: String,
-        source: ExportSource
-    ): Boolean {
-        val children = source.children ?: return false
-        val safeSource = canonicalExportSource(source.file.path)?.takeIf { it.isDirectory }
-            ?: return false
-        val parentUri = DocumentsContract.buildDocumentUriUsingTree(treeUri, parentDocId)
-        var dirDocId = findChildDocId(treeUri, parentDocId, safeSource.name)
-        if (dirDocId == null) {
-            dirDocId = try {
-                DocumentsContract.createDocument(
-                    contentResolver,
-                    parentUri,
-                    DocumentsContract.Document.MIME_TYPE_DIR,
-                    safeSource.name
-                )?.let { DocumentsContract.getDocumentId(it) }
-            } catch (e: Exception) {
-                Log.e(logTag, "Failed to create folder ${safeSource.name}", e)
-                null
-            }
-        }
-        if (dirDocId == null) return false
-
-        var ok = true
-        children.forEach { child ->
-            val childOk = copyExportSourceToTree(treeUri, dirDocId, child)
-            if (!childOk) ok = false
-        }
-        return ok
-    }
-
-    private fun findChildDocId(treeUri: Uri, parentDocId: String, name: String): String? {
-        val childrenUri = DocumentsContract.buildChildDocumentsUriUsingTree(treeUri, parentDocId)
-        val cursor = contentResolver.query(childrenUri, childColumns, null, null, null)
-            ?: throw IllegalStateException("Unable to query destination folder")
-        cursor.use {
-            while (cursor.moveToNext()) {
-                if (cursor.getString(1) == name &&
-                    cursor.getString(2) == DocumentsContract.Document.MIME_TYPE_DIR
-                ) {
-                    return cursor.getString(0)
-                }
-            }
-        }
-        return null
-    }
-
-    private val childColumns = arrayOf(
-        DocumentsContract.Document.COLUMN_DOCUMENT_ID,
-        DocumentsContract.Document.COLUMN_DISPLAY_NAME,
-        DocumentsContract.Document.COLUMN_MIME_TYPE
-    )
-
-    private fun displayName(uri: Uri): String? {
-        return try {
-            contentResolver.query(uri, arrayOf(OpenableColumns.DISPLAY_NAME), null, null, null)?.use { cursor ->
-                if (cursor.moveToFirst()) cursor.getString(0) else null
-            }
-        } catch (e: Exception) {
-            Log.w(logTag, "Failed to read selected document name", e)
-            null
-        }
-    }
-
     private fun setCodecInfo() {
         val codecList = MediaCodecList(MediaCodecList.REGULAR_CODECS)
         val codecs = codecList.codecInfos

flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/MainService.kt

@@ -17,7 +17,6 @@ import android.app.PendingIntent.FLAG_UPDATE_CURRENT
 import android.content.Context
 import android.content.Intent
 import android.content.pm.PackageManager
-import android.content.pm.ServiceInfo
 import android.content.res.Configuration
 import android.content.res.Configuration.ORIENTATION_LANDSCAPE
 import android.graphics.Color
@@ -151,7 +150,7 @@ class MainService : Service() {
                         if (incomingVoiceCall) {
                             voiceCallRequestNotification(id, "Voice Call Request", username, peerId)
                         } else {
-                            if (!switchOutVoiceCall()) {
+                            if (!audioRecordHandle.switchOutVoiceCall(mediaProjection)) {
                                 Log.e(logTag, "switchOutVoiceCall fail")
                                 MainActivity.flutterMethodChannel?.invokeMethod("msgbox", mapOf(
                                     "type" to "custom-nook-nocancel-hasclose-error",
@@ -160,7 +159,7 @@ class MainService : Service() {
                             }
                         }
                     } else {
-                        if (!switchToVoiceCall()) {
+                        if (!audioRecordHandle.switchToVoiceCall(mediaProjection)) {
                             Log.e(logTag, "switchToVoiceCall fail")
                             MainActivity.flutterMethodChannel?.invokeMethod("msgbox", mapOf(
                                 "type" to "custom-nook-nocancel-hasclose-error",
@@ -215,19 +214,6 @@ class MainService : Service() {
 
     // video
     private var mediaProjection: MediaProjection? = null
-    private var mediaProjectionCallback: MediaProjection.Callback? = null
-    private var captureRestartPending = false
-    private var captureRestartInVoiceCall = false
-    private val mediaProjectionResultReceiver =
-        object : ResultReceiver(Handler(Looper.getMainLooper())) {
-            override fun onReceiveResult(resultCode: Int, resultData: Bundle?) {
-                if (resultCode == RES_FAILED) {
-                    cancelMediaProjectionRecovery()
-                }
-            }
-        }
-    private var mediaProjectionForegroundService = false
-    private var microphoneForegroundService = false
     private var surface: Surface? = null
     private val sendVP9Thread = Executors.newSingleThreadExecutor()
     private var videoEncoder: MediaCodec? = null
@@ -257,9 +243,7 @@ class MainService : Service() {
         // keep the config dir same with flutter
         val prefs = applicationContext.getSharedPreferences(KEY_SHARED_PREFERENCES, FlutterActivity.MODE_PRIVATE)
         val configPath = prefs.getString(KEY_APP_DIR_CONFIG_PATH, "") ?: ""
-        val homePath = applicationContext.getExternalFilesDir(null)?.absolutePath
-            ?: applicationContext.filesDir.absolutePath
-        FFI.startServer(configPath, homePath, "")
+        FFI.startServer(configPath, "")
 
         createForegroundNotification()
     }
@@ -270,16 +254,6 @@ class MainService : Service() {
         super.onDestroy()
     }
 
-    // Swiping the app away from recents destroys the UI but this service keeps
-    // the process alive, so outgoing sessions would stay connected with no way
-    // to close them. Incoming connections are unaffected: the service keeps
-    // running so the device stays reachable.
-    override fun onTaskRemoved(rootIntent: Intent?) {
-        Log.d(logTag, "onTaskRemoved, closing outgoing sessions")
-        FFI.closeAllSessions()
-        super.onTaskRemoved(rootIntent)
-    }
-
     private var isHalfScale: Boolean? = null;
     private fun updateScreenInfo(orientation: Int) {
         var w: Int
@@ -353,6 +327,8 @@ class MainService : Service() {
         Log.d("whichService", "this service: ${Thread.currentThread()}")
         super.onStartCommand(intent, flags, startId)
         if (intent?.action == ACT_INIT_MEDIA_PROJECTION_AND_SERVICE) {
+            createForegroundNotification()
+
             if (intent.getBooleanExtra(EXT_INIT_FROM_BOOT, false)) {
                 FFI.startService()
             }
@@ -361,7 +337,10 @@ class MainService : Service() {
                 getSystemService(MEDIA_PROJECTION_SERVICE) as MediaProjectionManager
 
             intent.getParcelableExtra<Intent>(EXT_MEDIA_PROJECTION_RES_INTENT)?.let {
-                replaceMediaProjection(mediaProjectionManager, it)
+                mediaProjection =
+                    mediaProjectionManager.getMediaProjection(Activity.RESULT_OK, it)
+                checkMediaPermission()
+                _isReady = true
             } ?: let {
                 Log.d(logTag, "getParcelableExtra intent null, invoke requestMediaProjection")
                 requestMediaProjection()
@@ -375,23 +354,14 @@ class MainService : Service() {
         updateScreenInfo(newConfig.orientation)
     }
 
-    private fun requestMediaProjection(recovery: Boolean = false) {
+    private fun requestMediaProjection() {
         val intent = Intent(this, PermissionRequestTransparentActivity::class.java).apply {
             action = ACT_REQUEST_MEDIA_PROJECTION
             flags = Intent.FLAG_ACTIVITY_NEW_TASK
-            if (recovery) {
-                putExtra(EXT_MEDIA_PROJECTION_RESULT_RECEIVER, mediaProjectionResultReceiver)
-            }
         }
         startActivity(intent)
     }
 
-    @Synchronized
-    private fun cancelMediaProjectionRecovery() {
-        captureRestartPending = false
-        captureRestartInVoiceCall = false
-    }
-
     @SuppressLint("WrongConstant")
     private fun createSurface(): Surface? {
         return if (useVP9) {
@@ -425,149 +395,15 @@ class MainService : Service() {
         }
     }
 
-    private fun releaseMediaProjection() {
-        val projection = mediaProjection
-        val callback = mediaProjectionCallback
-        mediaProjection = null
-        mediaProjectionCallback = null
-        if (projection != null && callback != null) {
-            projection.unregisterCallback(callback)
-        }
-        projection?.stop()
-    }
-
-    @Synchronized
-    private fun handleMediaProjectionStopped(stoppedProjection: MediaProjection) {
-        if (mediaProjection !== stoppedProjection) {
-            return
-        }
-        Log.d(logTag, "MediaProjection stopped")
-        setMediaProjectionForegroundService(false)
-        stopCapture()
-        virtualDisplay?.release()
-        virtualDisplay = null
-        mediaProjection = null
-        mediaProjectionCallback = null
-        _isReady = false
-        checkMediaPermission()
-    }
-
-    @Synchronized
-    private fun replaceMediaProjection(
-        mediaProjectionManager: MediaProjectionManager,
-        resultIntent: Intent,
-    ) {
-        val wasCapturing = isStart
-        val restartCapture = wasCapturing || captureRestartPending
-        val restartInVoiceCall = if (wasCapturing) {
-            audioRecordHandle.isVoiceCallActive()
-        } else {
-            captureRestartInVoiceCall
-        }
-        val hadProjection = mediaProjection != null
-        if (!setMediaProjectionForegroundService(true)) {
-            if (!hadProjection) {
-                cancelMediaProjectionRecovery()
-                _isReady = false
-                checkMediaPermission()
-            }
-            return
-        }
-        val projection =
-            mediaProjectionManager.getMediaProjection(Activity.RESULT_OK, resultIntent)
-        if (projection == null) {
-            if (!hadProjection) {
-                cancelMediaProjectionRecovery()
-                _isReady = false
-                setMediaProjectionForegroundService(false)
-                checkMediaPermission()
-            }
-            return
-        }
-        if (wasCapturing) {
-            stopCapture()
-        }
-        captureRestartPending = restartCapture
-        virtualDisplay?.release()
-        virtualDisplay = null
-        releaseMediaProjection()
-        val callback = object : MediaProjection.Callback() {
-            override fun onStop() {
-                handleMediaProjectionStopped(projection)
-            }
-        }
-        projection.registerCallback(callback, Handler(Looper.getMainLooper()))
-        mediaProjection = projection
-        mediaProjectionCallback = callback
-        _isReady = true
-        checkMediaPermission()
-        if (restartCapture) {
-            captureRestartPending = false
-            startCapture(restartInVoiceCall)
-        }
-    }
-
-    @Synchronized
-    private fun startMicrophoneCapture(startAudio: () -> Boolean): Boolean {
-        if (!setMicrophoneForegroundService(true)) {
-            return false
-        }
-        if (startAudio()) {
-            return true
-        }
-        setMicrophoneForegroundService(false)
-        return false
-    }
-
-    @Synchronized
-    private fun stopMicrophoneCapture(stopAudio: () -> Boolean): Boolean {
-        val stopped = stopAudio()
-        val foregroundServiceUpdated = setMicrophoneForegroundService(false)
-        return stopped && foregroundServiceUpdated
-    }
-
-    @Synchronized
-    private fun switchToVoiceCall(): Boolean {
-        if (captureRestartPending) {
-            captureRestartInVoiceCall = true
-        }
-        return startMicrophoneCapture {
-            audioRecordHandle.switchToVoiceCall(mediaProjection)
-        }
-    }
-
-    @Synchronized
-    private fun switchOutVoiceCall(): Boolean {
-        captureRestartInVoiceCall = false
-        val switched = audioRecordHandle.switchOutVoiceCall(mediaProjection)
-        val foregroundServiceUpdated = setMicrophoneForegroundService(false)
-        return switched && foregroundServiceUpdated
-    }
-
-    @Synchronized
     fun onVoiceCallStarted(): Boolean {
-        if (captureRestartPending) {
-            captureRestartInVoiceCall = true
-        }
-        return startMicrophoneCapture {
-            audioRecordHandle.onVoiceCallStarted(mediaProjection)
-        }
+        return audioRecordHandle.onVoiceCallStarted(mediaProjection)
     }
 
-    @Synchronized
     fun onVoiceCallClosed(): Boolean {
-        captureRestartInVoiceCall = false
-        return stopMicrophoneCapture {
-            audioRecordHandle.onVoiceCallClosed(mediaProjection)
-        }
+        return audioRecordHandle.onVoiceCallClosed(mediaProjection)
     }
 
     fun startCapture(): Boolean {
-        return startCapture(false)
-    }
-
-    @Synchronized
-    private fun startCapture(inVoiceCall: Boolean): Boolean {
         if (isStart) {
             return true
         }
@@ -575,35 +411,25 @@ class MainService : Service() {
             Log.w(logTag, "startCapture fail,mediaProjection is null")
             return false
         }
-        captureRestartInVoiceCall = inVoiceCall
         
         updateScreenInfo(resources.configuration.orientation)
         Log.d(logTag, "Start Capture")
         surface = createSurface()
 
-        val videoStarted = if (useVP9) {
+        if (useVP9) {
             startVP9VideoRecorder(mediaProjection!!)
         } else {
             startRawVideoRecorder(mediaProjection!!)
         }
-        if (!videoStarted) {
-            if (!captureRestartPending) {
-                captureRestartInVoiceCall = false
-            }
-            releaseFailedVideoCapture()
-            return false
-        }
 
         if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.R) {
-            val audioStarted = if (inVoiceCall) {
-                switchToVoiceCall()
+            if (!audioRecordHandle.createAudioRecorder(false, mediaProjection)) {
+                Log.d(logTag, "createAudioRecorder fail")
             } else {
-                audioRecordHandle.createAudioRecorder(false, mediaProjection) &&
-                        audioRecordHandle.startAudioRecorder()
+                Log.d(logTag, "audio recorder start")
+                audioRecordHandle.startAudioRecorder()
             }
-            Log.d(logTag, if (audioStarted) "audio recorder start" else "audio recorder start failed")
         }
-        captureRestartInVoiceCall = false
         checkMediaPermission()
         _isStart = true
         FFI.setFrameRawEnable("video",true)
@@ -611,24 +437,9 @@ class MainService : Service() {
         return true
     }
 
-    private fun releaseFailedVideoCapture() {
-        imageReader?.close()
-        imageReader = null
-        videoEncoder?.let {
-            it.signalEndOfInputStream()
-            it.stop()
-            it.release()
-        }
-        videoEncoder = null
-        surface?.release()
-        surface = null
-    }
-
     @Synchronized
     fun stopCapture() {
         Log.d(logTag, "Stop Capture")
-        captureRestartPending = false
-        captureRestartInVoiceCall = false
         FFI.setFrameRawEnable("video",false)
         _isStart = false
         MainActivity.rdClipboardManager?.setCaptureStarted(_isStart)
@@ -659,11 +470,8 @@ class MainService : Service() {
         surface?.release()
 
         // release audio
-        stopMicrophoneCapture {
-            _isAudioStart = false
-            audioRecordHandle.tryReleaseAudio()
-            true
-        }
+        _isAudioStart = false
+        audioRecordHandle.tryReleaseAudio()
     }
 
     fun destroy() {
@@ -678,9 +486,7 @@ class MainService : Service() {
             virtualDisplay = null
         }
 
-        releaseMediaProjection()
-        mediaProjectionForegroundService = false
-        microphoneForegroundService = false
+        mediaProjection = null
         checkMediaPermission()
         stopForeground(true)
         stopService(Intent(this, FloatingWindowService::class.java))
@@ -703,70 +509,49 @@ class MainService : Service() {
         return isReady
     }
 
-    private fun startRawVideoRecorder(mp: MediaProjection): Boolean {
+    private fun startRawVideoRecorder(mp: MediaProjection) {
         Log.d(logTag, "startRawVideoRecorder,screen info:$SCREEN_INFO")
-        val captureSurface = surface
-        if (captureSurface == null) {
+        if (surface == null) {
             Log.d(logTag, "startRawVideoRecorder failed,surface is null")
-            return false
+            return
         }
-        return createOrSetVirtualDisplay(mp, captureSurface)
+        createOrSetVirtualDisplay(mp, surface!!)
     }
 
-    private fun startVP9VideoRecorder(mp: MediaProjection): Boolean {
+    private fun startVP9VideoRecorder(mp: MediaProjection) {
         createMediaCodec()
-        val encoder = videoEncoder ?: return false
-        val inputSurface = encoder.createInputSurface()
-        surface = inputSurface
-        if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.R) {
-            inputSurface.setFrameRate(1F, FRAME_RATE_COMPATIBILITY_DEFAULT)
+        videoEncoder?.let {
+            surface = it.createInputSurface()
+            if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.R) {
+                surface!!.setFrameRate(1F, FRAME_RATE_COMPATIBILITY_DEFAULT)
+            }
+            it.setCallback(cb)
+            it.start()
+            createOrSetVirtualDisplay(mp, surface!!)
         }
-        encoder.setCallback(cb)
-        encoder.start()
-        return createOrSetVirtualDisplay(mp, inputSurface)
     }
 
     // https://github.com/bk138/droidVNC-NG/blob/b79af62db5a1c08ed94e6a91464859ffed6f4e97/app/src/main/java/net/christianbeier/droidvnc_ng/MediaProjectionService.java#L250
     // Reuse virtualDisplay if it exists, to avoid media projection confirmation dialog every connection.
-    private fun createOrSetVirtualDisplay(mp: MediaProjection, s: Surface): Boolean {
-        return try {
-            val existingDisplay = virtualDisplay
-            if (existingDisplay != null) {
-                existingDisplay.resize(SCREEN_INFO.width, SCREEN_INFO.height, SCREEN_INFO.dpi)
-                existingDisplay.setSurface(s)
-                true
-            } else {
-                val display = mp.createVirtualDisplay(
+    private fun createOrSetVirtualDisplay(mp: MediaProjection, s: Surface) {
+        try {
+            virtualDisplay?.let {
+                it.resize(SCREEN_INFO.width, SCREEN_INFO.height, SCREEN_INFO.dpi)
+                it.setSurface(s)
+            } ?: let {
+                virtualDisplay = mp.createVirtualDisplay(
                     "RustDeskVD",
                     SCREEN_INFO.width, SCREEN_INFO.height, SCREEN_INFO.dpi, VIRTUAL_DISPLAY_FLAG_AUTO_MIRROR,
                     s, null, null
                 )
-                if (display == null) {
-                    Log.e(logTag, "createOrSetVirtualDisplay failed")
-                    handleVirtualDisplayFailure()
-                } else {
-                    virtualDisplay = display
-                    true
-                }
             }
         } catch (e: SecurityException) {
-            Log.w(logTag, "createOrSetVirtualDisplay: got SecurityException", e)
-            handleVirtualDisplayFailure()
+            Log.w(logTag, "createOrSetVirtualDisplay: got SecurityException, re-requesting confirmation");
+            // This initiates a prompt dialog for the user to confirm screen projection.
+            requestMediaProjection()
         }
     }
 
-    private fun handleVirtualDisplayFailure(): Boolean {
-        captureRestartPending = true
-        virtualDisplay?.release()
-        virtualDisplay = null
-        releaseMediaProjection()
-        setMediaProjectionForegroundService(false)
-        _isReady = false
-        checkMediaPermission()
-        requestMediaProjection(true)
-        return false
-    }
-
     private val cb: MediaCodec.Callback = object : MediaCodec.Callback() {
         override fun onInputBufferAvailable(codec: MediaCodec, index: Int) {}
         override fun onOutputFormatChanged(codec: MediaCodec, format: MediaFormat) {}
@@ -857,63 +642,7 @@ class MainService : Service() {
             .setColor(ContextCompat.getColor(this, R.color.primary))
             .setWhen(System.currentTimeMillis())
             .build()
-        if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.Q) {
-            startForeground(DEFAULT_NOTIFY_ID, notification, foregroundServiceType())
-        } else {
-            startForeground(DEFAULT_NOTIFY_ID, notification)
-        }
-    }
-
-    @RequiresApi(Build.VERSION_CODES.Q)
-    private fun foregroundServiceType(): Int {
-        var serviceType = ServiceInfo.FOREGROUND_SERVICE_TYPE_NONE
-        if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.UPSIDE_DOWN_CAKE) {
-            // Keep a valid FGS type while the unattended host is idle and no capture type is active.
-            serviceType = serviceType or ServiceInfo.FOREGROUND_SERVICE_TYPE_SPECIAL_USE
-        }
-        if (mediaProjectionForegroundService) {
-            serviceType = serviceType or ServiceInfo.FOREGROUND_SERVICE_TYPE_MEDIA_PROJECTION
-        }
-        if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.R && microphoneForegroundService) {
-            serviceType = serviceType or ServiceInfo.FOREGROUND_SERVICE_TYPE_MICROPHONE
-        }
-        return serviceType
-    }
-
-    private fun setMediaProjectionForegroundService(enabled: Boolean): Boolean {
-        return updateForegroundServiceTypes(enabled, microphoneForegroundService)
-    }
-
-    private fun setMicrophoneForegroundService(enabled: Boolean): Boolean {
-        return updateForegroundServiceTypes(mediaProjectionForegroundService, enabled)
-    }
-
-    private fun updateForegroundServiceTypes(
-        mediaProjectionEnabled: Boolean,
-        microphoneEnabled: Boolean,
-    ): Boolean {
-        if (mediaProjectionForegroundService == mediaProjectionEnabled &&
-            microphoneForegroundService == microphoneEnabled) {
-            return true
-        }
-        val previousMediaProjection = mediaProjectionForegroundService
-        val previousMicrophone = microphoneForegroundService
-        mediaProjectionForegroundService = mediaProjectionEnabled
-        microphoneForegroundService = microphoneEnabled
-        return try {
-            createForegroundNotification()
-            true
-        } catch (error: SecurityException) {
-            mediaProjectionForegroundService = previousMediaProjection
-            microphoneForegroundService = previousMicrophone
-            Log.e(logTag, "Failed to update foreground service types", error)
-            false
-        } catch (error: IllegalStateException) {
-            mediaProjectionForegroundService = previousMediaProjection
-            microphoneForegroundService = previousMicrophone
-            Log.e(logTag, "Failed to update foreground service types", error)
-            false
-        }
+        startForeground(DEFAULT_NOTIFY_ID, notification)
     }
 
     private fun loginRequestNotification(

flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/PermissionRequestTransparentActivity.kt

@@ -5,7 +5,6 @@ import android.content.Intent
 import android.media.projection.MediaProjectionManager
 import android.os.Build
 import android.os.Bundle
-import android.os.ResultReceiver
 import android.util.Log
 
 class PermissionRequestTransparentActivity: Activity() {
@@ -32,13 +31,7 @@ class PermissionRequestTransparentActivity: Activity() {
             if (resultCode == RESULT_OK && data != null) {
                 launchService(data)
             } else {
-                val resultReceiver =
-                    intent.getParcelableExtra<ResultReceiver>(EXT_MEDIA_PROJECTION_RESULT_RECEIVER)
-                if (resultReceiver != null) {
-                    resultReceiver.send(RES_FAILED, null)
-                } else {
-                    setResult(RES_FAILED)
-                }
+                setResult(RES_FAILED)
             }
         }
 
@@ -58,4 +51,4 @@ class PermissionRequestTransparentActivity: Activity() {
         }
     }
 
-}
+}

flutter/android/app/src/main/kotlin/com/carriez/flutter_hbb/common.kt

@@ -33,16 +33,11 @@ const val ACT_INIT_MEDIA_PROJECTION_AND_SERVICE = "INIT_MEDIA_PROJECTION_AND_SER
 const val ACT_LOGIN_REQ_NOTIFY = "LOGIN_REQ_NOTIFY"
 const val EXT_INIT_FROM_BOOT = "EXT_INIT_FROM_BOOT"
 const val EXT_MEDIA_PROJECTION_RES_INTENT = "MEDIA_PROJECTION_RES_INTENT"
-const val EXT_MEDIA_PROJECTION_RESULT_RECEIVER = "MEDIA_PROJECTION_RESULT_RECEIVER"
 const val EXT_LOGIN_REQ_NOTIFY = "LOGIN_REQ_NOTIFY"
 
 // Activity requestCode
 const val REQ_INVOKE_PERMISSION_ACTIVITY_MEDIA_PROJECTION = 101
 const val REQ_REQUEST_MEDIA_PROJECTION = 201
-const val REQ_EXPORT_FILE = 301
-const val REQ_IMPORT_FILES = 302
-const val REQ_IMPORT_DIRECTORY = 303
-const val REQ_EXPORT_FILES = 304
 
 // Activity responseCode
 const val RES_FAILED = -100
@@ -52,12 +47,6 @@ const val START_ACTION = "start_action"
 const val GET_START_ON_BOOT_OPT = "get_start_on_boot_opt"
 const val SET_START_ON_BOOT_OPT = "set_start_on_boot_opt"
 const val SYNC_APP_DIR_CONFIG_PATH = "sync_app_dir"
-const val PICK_IMPORT_FILES = "pick_import_files"
-const val IMPORT_FILE = "import_file"
-const val EXPORT_FILE = "export_file"
-const val PICK_IMPORT_DIRECTORY = "pick_import_directory"
-const val IMPORT_DIRECTORY = "import_directory"
-const val EXPORT_FILES = "export_files"
 const val GET_VALUE = "get_value"
 
 const val KEY_IS_SUPPORT_VOICE_CALL = "KEY_IS_SUPPORT_VOICE_CALL"
@@ -165,4 +154,4 @@ fun getScreenSize(windowManager: WindowManager) : Pair<Int, Int>{
  fun translate(input: String): String {
     Log.d("common", "translate:$LOCAL_NAME")
     return FFI.translateLocale(LOCAL_NAME, input)
-}
+}

flutter/android/app/src/main/kotlin/ffi.kt

@@ -15,13 +15,12 @@ object FFI {
     external fun init(ctx: Context)
     external fun onAppStart(ctx: Context)
     external fun setClipboardManager(clipboardManager: RdClipboardManager)
-    external fun startServer(app_dir: String, home_dir: String, custom_client_config: String)
+    external fun startServer(app_dir: String, custom_client_config: String)
     external fun startService()
     external fun onVideoFrameUpdate(buf: ByteBuffer)
     external fun onAudioFrameUpdate(buf: ByteBuffer)
     external fun translateLocale(localeName: String, input: String): String
     external fun refreshScreen()
-    external fun closeAllSessions()
     external fun setFrameRawEnable(name: String, value: Boolean)
     external fun setCodecInfo(info: String)
     external fun getLocalOption(key: String): String

flutter/android/app/src/main/res/values/strings.xml

@@ -1,5 +1,4 @@
 <resources>
     <string name="app_name">RustDesk</string>
     <string name="accessibility_service_description">Allow other devices to control your phone using virtual touch, when RustDesk screen sharing is established</string>
-    <string name="foreground_service_special_use_subtype">Keeps the RustDesk remote desktop host available for authorized unattended connections and foreground notifications without starting screen capture before user approval.</string>
 </resources>

flutter/android/build.gradle

@@ -1,29 +1,3 @@
-def legacyPluginNamespaces = [
-    external_path: 'com.pinciat.external_path',
-    flutter_keyboard_visibility: 'com.jrai.flutter_keyboard_visibility',
-    qr_code_scanner: 'net.touchcapture.qr.flutterqr',
-    sqflite: 'com.tekartik.sqflite',
-    uni_links: 'name.avioli.unilinks',
-]
-
-def java8JvmTarget = JavaVersion.VERSION_1_8.toString()
-def java8KotlinJvmTargets = [
-    app: java8JvmTarget,
-    external_path: java8JvmTarget,
-    qr_code_scanner: java8JvmTarget,
-]
-
-def configureKotlinJvmTarget = { Project project, String kotlinJvmTarget ->
-    project.plugins.withId('kotlin-android') {
-        project.tasks.configureEach { task ->
-            if (!task.hasProperty('kotlinOptions')) {
-                return
-            }
-            task.kotlinOptions.jvmTarget = kotlinJvmTarget
-        }
-    }
-}
-
 allprojects {
     repositories {
         google()
@@ -35,16 +9,6 @@ allprojects {
 rootProject.buildDir = '../build'
 subprojects {
     project.buildDir = "${rootProject.buildDir}/${project.name}"
-    def legacyNamespace = legacyPluginNamespaces[project.name]
-    if (legacyNamespace != null) {
-        project.plugins.withId('com.android.library') {
-            project.android.namespace = legacyNamespace
-        }
-    }
-    def kotlinJvmTarget = java8KotlinJvmTargets[project.name]
-    if (kotlinJvmTarget != null) {
-        configureKotlinJvmTarget(project, kotlinJvmTarget)
-    }
 }
 subprojects {
     project.evaluationDependsOn(':app')

flutter/android/gradle/wrapper/gradle-wrapper.properties

@@ -3,4 +3,4 @@ distributionBase=GRADLE_USER_HOME
 distributionPath=wrapper/dists
 zipStoreBase=GRADLE_USER_HOME
 zipStorePath=wrapper/dists
-distributionUrl=https\://services.gradle.org/distributions/gradle-8.11.1-all.zip
+distributionUrl=https\://services.gradle.org/distributions/gradle-7.6.4-all.zip

flutter/android/settings.gradle

@@ -18,7 +18,7 @@ pluginManagement {
 
 plugins {
     id "dev.flutter.flutter-plugin-loader" version "1.0.0"
-    id "com.android.application" version "8.10.1" apply false
+    id "com.android.application" version "7.3.1" apply false
     id "org.jetbrains.kotlin.android" version "2.1.21" apply false
 }
 

flutter/assets/auth-azure.svg

@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="256" height="199"><path fill="#0089d6" d="M118.432 187.698c32.89-5.81 60.055-10.618 60.367-10.684l.568-.12-31.052-36.935c-17.078-20.314-31.051-37.014-31.051-37.11 0-.182 32.063-88.477 32.243-88.792.06-.105 21.88 37.567 52.893 91.32 29.035 50.323 52.973 91.815 53.195 92.203l.405.707-98.684-.012-98.684-.013 59.8-10.564zM0 176.435c0-.052 14.631-25.451 32.514-56.442l32.514-56.347 37.891-31.799C123.76 14.358 140.867.027 140.935.001c.069-.026-.205.664-.609 1.534s-18.919 40.582-41.145 88.25l-40.41 86.67-29.386.037c-16.162.02-29.385-.005-29.385-.057z"/></svg>

flutter/assets/display_switcher.svg

@@ -1,7 +0,0 @@
-<svg xmlns="http://www.w3.org/2000/svg" width="32" height="32" viewBox="0 0 32 32">
-  <g fill="#000000" fill-rule="evenodd">
-    <rect x="4" y="6" width="24" height="16" rx="3"/>
-    <rect x="14.5" y="22" width="3" height="2"/>
-    <rect x="9.5" y="24" width="13" height="2.5" rx="1.25"/>
-  </g>
-</svg>

flutter/build_android_deps.sh

@@ -6,82 +6,83 @@ ANDROID_ABI=$1
 
 # Build RustDesk dependencies for Android using vcpkg.json
 # Required:
-#   1. set VCPKG_ROOT / ANDROID_NDK_HOME path environment variables
+#   1. set VCPKG_ROOT / ANDROID_NDK path environment variables
 #   2. vcpkg initialized
 #   3. ndk, version: r25c or newer
 
-if [ -z "${ANDROID_NDK_HOME}" ]; then
-	echo "ERROR: Please set ANDROID_NDK_HOME environment variable" 1>&2
-	exit 1
+if [ -z "$ANDROID_NDK_HOME" ]; then
+  echo "Failed! Please set ANDROID_NDK_HOME"
+  exit 1
 fi
 
-if [ -z "${VCPKG_ROOT}" ]; then
-	echo "ERROR: Please set VCPKG_ROOT environment variable" 1>&2
-	exit 1
+if [ -z "$VCPKG_ROOT" ]; then
+  echo "Failed! Please set VCPKG_ROOT"
+  exit 1
 fi
 
-case "${ANDROID_ABI}" in
-arm64-v8a)
-	VCPKG_TARGET=arm64-android
-	;;
-armeabi-v7a)
-	VCPKG_TARGET=arm-neon-android
-	;;
-x86_64)
-	VCPKG_TARGET=x64-android
-	;;
-x86)
-	VCPKG_TARGET=x86-android
-	;;
-*)
-	echo "Usage: build_android_deps.sh <arm64-v8a|armeabi-v7a|x86_64|x86>" 1>&2
-	exit 1
-	;;
-esac
+API_LEVEL="21"
 
 # Get directory of this script
 
 SCRIPTDIR="$(readlink -f "$0")"
-SCRIPTDIR="$(dirname "${SCRIPTDIR}")"
+SCRIPTDIR="$(dirname "$SCRIPTDIR")"
 
 # Check if vcpkg.json is one level up - in root directory of RD
 
-if [ ! -f "${SCRIPTDIR}/../vcpkg.json" ]; then
-	echo "ERROR: Can not find vcpkg.json in RustDesk top-level directory" 1>&2
-	exit 1
+if [ ! -f "$SCRIPTDIR/../vcpkg.json" ]; then
+  echo "Failed! Please check where vcpkg.json is!"
+  exit 1
 fi
 
-echo "INFO: Building and install vcpkg dependencies for Android ${ANDROID_ABI} ..."
+# NDK llvm toolchain
 
-pushd "${SCRIPTDIR}/.."
+HOST_TAG="linux-x86_64" # current platform, set as `ls $ANDROID_NDK/toolchains/llvm/prebuilt/`
+TOOLCHAIN=$ANDROID_NDK/toolchains/llvm/prebuilt/$HOST_TAG
 
-"${VCPKG_ROOT}/vcpkg" install \
-	--triplet "${VCPKG_TARGET}" \
-	--x-install-root="${VCPKG_ROOT}/installed"
+function build {
+  ANDROID_ABI=$1
 
-popd
+  case "$ANDROID_ABI" in
+  arm64-v8a)
+     ABI=aarch64-linux-android$API_LEVEL
+     VCPKG_TARGET=arm64-android
+     ;;
+  armeabi-v7a)
+     ABI=armv7a-linux-androideabi$API_LEVEL
+     VCPKG_TARGET=arm-neon-android
+     ;;
+  x86_64)
+     ABI=x86_64-linux-android$API_LEVEL
+     VCPKG_TARGET=x64-android
+     ;;
+  x86)
+     ABI=i686-linux-android$API_LEVEL
+     VCPKG_TARGET=x86-android
+     ;;
+  *)
+     echo "ERROR: ANDROID_ABI must be one of: arm64-v8a, armeabi-v7a, x86_64, x86" >&2
+     return 1
+  esac
 
-echo "INFO: Completed building vcpkg dependencies for Android ${ANDROID_ABI}"
+  echo "*** [$ANDROID_ABI][Start] Build and install vcpkg dependencies"
+  pushd "$SCRIPTDIR/.."
+  $VCPKG_ROOT/vcpkg install --triplet $VCPKG_TARGET --x-install-root="$VCPKG_ROOT/installed"
+  popd
+  head -n 100 "${VCPKG_ROOT}/buildtrees/ffmpeg/build-$VCPKG_TARGET-rel-out.log" || true
+  echo "*** [$ANDROID_ABI][Finished] Build and install vcpkg dependencies"
 
-if [ "${ANDROID_ABI}" = 'armeabi-v7a' ]; then
-	# Symlink arm-neon-android to arm-android because cargo-ndk does not
-	# understand NEON suffix.
+if [ -d "$VCPKG_ROOT/installed/arm-neon-android" ]; then
+  echo "*** [Start] Move arm-neon-android to arm-android"
 
-	if [ -d "${VCPKG_ROOT}/installed/arm-neon-android" ]; then
-		echo 'INFO: Symlinking arm-neon-android to arm-android'
+  mv "$VCPKG_ROOT/installed/arm-neon-android" "$VCPKG_ROOT/installed/arm-android"
 
-		ln -sf \
-			"${VCPKG_ROOT}/installed/arm-neon-android" \
-			"${VCPKG_ROOT}/installed/arm-android"
-
-		echo 'INFO: Symlinked arm-neon-android to arm-android'
-	else
-		cat 0<<.a
-ERROR: 'vcpkg install' seem to complete successfully but
-directory '${VCPKG_ROOT}/installed/arm-neon-android' is missing!
-
-.a
-
-		exit 1
-	fi
+  echo "*** [Finished] Move arm-neon-android to arm-android"
+fi
+}
+
+if [ ! -z "$ANDROID_ABI" ]; then
+  build "$ANDROID_ABI"
+else
+  echo "Usage: build-android-deps.sh <ANDROID-ABI>" >&2
+  exit 1
 fi

flutter/build_fdroid.sh

@@ -460,7 +460,6 @@ build)
 		--target "${RUST_TARGET}" \
 		--bindgen \
 		build \
-		--locked \
 		--release \
 		--features "${RUSTDESK_FEATURES}"
 

flutter/ios/Runner/GoogleService-Info.plist

@@ -0,0 +1,36 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+	<key>CLIENT_ID</key>
+	<string>768133699366-k1rn3ls1u2n3nklmgd9t4cmpdob0c8bn.apps.googleusercontent.com</string>
+	<key>REVERSED_CLIENT_ID</key>
+	<string>com.googleusercontent.apps.768133699366-k1rn3ls1u2n3nklmgd9t4cmpdob0c8bn</string>
+	<key>API_KEY</key>
+	<string>AIzaSyCf57HjCwSokt91CqFI0Mwf8D--ek0jvfc</string>
+	<key>GCM_SENDER_ID</key>
+	<string>768133699366</string>
+	<key>PLIST_VERSION</key>
+	<string>1</string>
+	<key>BUNDLE_ID</key>
+	<string>com.carriez.flutterHbb</string>
+	<key>PROJECT_ID</key>
+	<string>rustdesk</string>
+	<key>STORAGE_BUCKET</key>
+	<string>rustdesk.appspot.com</string>
+	<key>IS_ADS_ENABLED</key>
+	<false></false>
+	<key>IS_ANALYTICS_ENABLED</key>
+	<false></false>
+	<key>IS_APPINVITE_ENABLED</key>
+	<true></true>
+	<key>IS_GCM_ENABLED</key>
+	<true></true>
+	<key>IS_SIGNIN_ENABLED</key>
+	<true></true>
+	<key>GOOGLE_APP_ID</key>
+	<string>1:768133699366:ios:c33078a6181b9d507993e7</string>
+	<key>DATABASE_URL</key>
+	<string>https://rustdesk.firebaseio.com</string>
+</dict>
+</plist>

flutter/ios_arm64.sh

@@ -1,2 +1,2 @@
 #!/usr/bin/env bash
-cargo build --locked --features flutter,hwcodec --release --target aarch64-apple-ios --lib
+cargo build --features flutter,hwcodec --release --target aarch64-apple-ios --lib

flutter/ios_x64.sh

@@ -1,2 +1,2 @@
 #!/usr/bin/env bash
-cargo build --locked --features flutter --release --target x86_64-apple-ios --lib
+cargo build --features flutter --release --target x86_64-apple-ios --lib

flutter/lib/common.dart

@@ -84,6 +84,8 @@ const double _kPositionEpsilon = 1e-6;
 bool get isMainDesktopWindow =>
     desktopType == DesktopType.main || desktopType == DesktopType.cm;
 
+String get screenInfo => screenInfo_;
+
 /// Check if the app is running with single view mode.
 bool isSingleViewApp() {
   return desktopType == DesktopType.cm;
@@ -714,17 +716,6 @@ closeConnection({String? id}) {
       stateGlobal.isInMainPage = true;
     } else {
       final controller = Get.find<DesktopTabController>();
-      if (controller.tabType == DesktopTabType.terminal &&
-          controller.onCloseWindow != null) {
-        // Terminal windows are scoped to one peer. The optional id passed to
-        // closeConnection() is that peer id, not a terminal tab key
-        // (${peerId}_${terminalId}). Closing from terminal dialogs should close
-        // the peer's whole terminal window, including all terminal tabs.
-        unawaited(controller.onCloseWindow!().catchError((e, _) {
-          debugPrint('[closeConnection] Failed to close terminal window: $e');
-        }));
-        return;
-      }
       controller.closeBy(id);
     }
   }
@@ -1183,48 +1174,6 @@ void msgBox(SessionID sessionId, String type, String title, String text,
     VoidCallback? onSubmit,
     int? submitTimeout}) {
   dialogManager.dismissAll();
-  if (type.contains('insecure-connection')) {
-    Future<void> closeSession() async {
-      await bind.sessionSetCommon(
-        sessionId: sessionId,
-        key: 'continue-insecure-connection',
-        value: 'N',
-      );
-      dialogManager.dismissAll();
-      closeConnection();
-    }
-
-    void continueSession() {
-      unawaited(
-        bind.sessionSetCommon(
-          sessionId: sessionId,
-          key: 'continue-insecure-connection',
-          value: 'Y',
-        ),
-      );
-      dialogManager.dismissAll();
-    }
-
-    dialogManager.show(
-      (setState, close, context) => CustomAlertDialog(
-        title: null,
-        content: SelectionArea(child: msgboxContent(type, title, text)),
-        actions: [
-          dialogButton(
-            'Continue',
-            onPressed: continueSession,
-            isOutline: true,
-          ),
-          dialogButton('Disconnect', onPressed: closeSession),
-        ],
-        onSubmit: closeSession,
-        onCancel: closeSession,
-      ),
-      tag: '$sessionId-$type-$title-$text-$link',
-    );
-    return;
-  }
-
   List<Widget> buttons = [];
   bool hasOk = false;
   submit() {
@@ -1519,6 +1468,13 @@ class AndroidPermissionManager {
   static Timer? _timer;
   static var _current = "";
 
+  static bool isWaitingFile() {
+    if (_completer != null) {
+      return !_completer!.isCompleted && _current == kManageExternalStorage;
+    }
+    return false;
+  }
+
   static Future<bool> check(String type) {
     if (isDesktop || isWeb) {
       return Future.value(true);
@@ -2627,6 +2583,13 @@ connect(BuildContext context, String id,
     }
   } else {
     if (isFileTransfer) {
+      if (isAndroid) {
+        if (!await AndroidPermissionManager.check(kManageExternalStorage)) {
+          if (!await AndroidPermissionManager.request(kManageExternalStorage)) {
+            return;
+          }
+        }
+      }
       if (isWeb) {
         Navigator.push(
           context,
@@ -3108,15 +3071,6 @@ void onCopyFingerprint(String value) {
   }
 }
 
-void onCopyId(String value) {
-  if (value.isNotEmpty) {
-    Clipboard.setData(ClipboardData(text: value));
-    showToast('$value\n${translate("Copied")}');
-  } else {
-    showToast(translate("Invalid ID"));
-  }
-}
-
 Future<bool> callMainCheckSuperUserPermission() async {
   bool checked = await bind.mainCheckSuperUserPermission();
   if (isMacOS) {
@@ -3385,12 +3339,7 @@ Future<List<Rect>> getScreenRectList() async {
 }
 
 openMonitorInTheSameTab(int i, FFI ffi, PeerInfo pi,
-    {bool updateCursorPos = true, bool recordSelection = true}) {
-  if (recordSelection) {
-    ffi.ffiModel.lastUserDisplay = i;
-    ffi.ffiModel.cancelPendingRestoreTimer();
-    ffi.ffiModel.pendingMonitorRestore = null;
-  }
+    {bool updateCursorPos = true}) {
   final displays = i == kAllDisplayValue
       ? List.generate(pi.displays.length, (index) => index)
       : [i];
@@ -3753,54 +3702,14 @@ Widget loadPowered(BuildContext context) {
   ).marginOnly(top: 6);
 }
 
-const _kDefaultLogoAsset = 'assets/logo.png';
-const _kLightLogoAsset = 'assets/logo_light.png';
-const _kDarkLogoAsset = 'assets/logo_dark.png';
-
-List<String> _logoAssetCandidatesForBrightness(Brightness brightness) {
-  return brightness == Brightness.dark
-      ? [_kDarkLogoAsset, _kDefaultLogoAsset]
-      : [_kLightLogoAsset, _kDefaultLogoAsset];
-}
-
-Future<String?> _resolveLogoAsset(Brightness brightness) async {
-  for (final asset in _logoAssetCandidatesForBrightness(brightness)) {
-    try {
-      await rootBundle.load(asset);
-      return asset;
-    } on FlutterError {
-      continue;
-    }
-  }
-  return null;
-}
-
-class _Logo extends StatefulWidget {
-  const _Logo();
-
-  @override
-  State<_Logo> createState() => _LogoState();
-}
-
-class _LogoState extends State<_Logo> {
-  final Map<Brightness, Future<String?>> _logoFutures = {};
-
-  Future<String?> _logoFutureFor(Brightness brightness) {
-    return _logoFutures.putIfAbsent(
-      brightness,
-      () => _resolveLogoAsset(brightness),
-    );
-  }
-
-  @override
-  Widget build(BuildContext context) {
-    return FutureBuilder<String?>(
-      future: _logoFutureFor(Theme.of(context).brightness),
-      builder: (BuildContext context, AsyncSnapshot<String?> snapshot) {
-        final asset = snapshot.data;
-        if (asset != null) {
+// max 300 x 60
+Widget loadLogo() {
+  return FutureBuilder<ByteData>(
+      future: rootBundle.load('assets/logo.png'),
+      builder: (BuildContext context, AsyncSnapshot<ByteData> snapshot) {
+        if (snapshot.hasData) {
           final image = Image.asset(
-            asset,
+            'assets/logo.png',
             fit: BoxFit.contain,
             errorBuilder: (ctx, error, stackTrace) {
               return Container();
@@ -3812,14 +3721,9 @@ class _LogoState extends State<_Logo> {
           ).marginOnly(left: 12, right: 12, top: 12);
         }
         return const Offstage();
-      },
-    );
-  }
+      });
 }
 
-// max 300 x 60
-Widget loadLogo() => const _Logo();
-
 Widget loadIcon(double size) {
   return Image.asset('assets/icon.png',
       width: size,
@@ -3997,11 +3901,6 @@ bool whitelistNotEmpty() {
   return v != '' && v != ',';
 }
 
-bool idWhitelistNotEmpty() {
-  final v = bind.mainGetOptionSync(key: kOptionIdWhitelist);
-  return v != '' && v != ',';
-}
-
 // `setMovable()` is only supported on macOS.
 //
 // On macOS, the window can be dragged by the tab bar by default.
@@ -4032,8 +3931,7 @@ Widget netWorkErrorWidget() {
     mainAxisAlignment: MainAxisAlignment.center,
     crossAxisAlignment: CrossAxisAlignment.center,
     children: [
-      if (!gFFI.userModel.networkErrorFromServer.value)
-        Text(translate("network_error_tip")),
+      Text(translate("network_error_tip")),
       ElevatedButton(
               onPressed: gFFI.userModel.refreshCurrentUser,
               child: Text(translate("Retry")))
@@ -4281,7 +4179,8 @@ Widget? buildAvatarWidget({
       width: size,
       height: size,
       fit: BoxFit.cover,
-      errorBuilder: (_, __, ___) => fallback ?? SizedBox.shrink(),
+      errorBuilder: (_, __, ___) =>
+          fallback ?? SizedBox.shrink(),
     ),
   );
 }

flutter/lib/common/widgets/autocomplete.dart

@@ -1,6 +1,3 @@
-import 'dart:async';
-
-import 'package:flutter/foundation.dart';
 import 'package:flutter/material.dart';
 import 'package:flutter_hbb/common/formatter/id_formatter.dart';
 import '../../../models/platform_model.dart';
@@ -8,136 +5,27 @@ import 'package:flutter_hbb/models/peer_model.dart';
 import 'package:flutter_hbb/common.dart';
 import 'package:flutter_hbb/common/widgets/peer_card.dart';
 
-@visibleForTesting
-List<Peer> mergeAutocompletePeers({
-  Iterable<Peer> addressBookPeers = const [],
-  Iterable<Peer> groupPeers = const [],
-  Iterable<Peer> lanPeers = const [],
-  Iterable<Peer> recentPeers = const [],
-  Iterable<String> restRecentPeerIds = const [],
-}) {
-  final combinedPeers = <String, Peer>{};
-
-  void addPeer(Peer peer) {
-    if (peer.id.isEmpty) {
-      return;
-    }
-    final existingPeer = combinedPeers[peer.id];
-    if (existingPeer == null) {
-      combinedPeers[peer.id] = Peer.copy(peer);
-    } else if (peer.online) {
-      existingPeer.online = true;
-    }
-  }
-
-  for (final peer in addressBookPeers) {
-    addPeer(peer);
-  }
-  for (final peer in groupPeers) {
-    addPeer(peer);
-  }
-  for (final peer in lanPeers) {
-    addPeer(peer);
-  }
-  for (final peer in recentPeers) {
-    addPeer(peer);
-  }
-  for (final id in restRecentPeerIds) {
-    if (id.isNotEmpty && !combinedPeers.containsKey(id)) {
-      combinedPeers[id] = Peer.fromJson({'id': id});
-    }
-  }
-
-  return combinedPeers.values.toList(growable: false);
-}
-
-@visibleForTesting
-bool updateAutocompletePeerOnlineStates(
-  List<Peer> peers, {
-  required Set<String> onlines,
-  required Set<String> offlines,
-}) {
-  var changed = false;
-  for (final peer in peers) {
-    if (onlines.contains(peer.id)) {
-      if (!peer.online) {
-        peer.online = true;
-        changed = true;
-      }
-    } else if (offlines.contains(peer.id)) {
-      if (peer.online) {
-        peer.online = false;
-        changed = true;
-      }
-    }
-  }
-  return changed;
-}
-
-@visibleForTesting
-List<String> autocompleteOnlineQueryIds(
-  Iterable<Peer> options, {
-  required int limit,
-}) {
-  final ids = <String>[];
-  final seenIds = <String>{};
-  for (final peer in options) {
-    if (peer.id.isEmpty || seenIds.contains(peer.id)) {
-      continue;
-    }
-    seenIds.add(peer.id);
-    ids.add(peer.id);
-    if (ids.length >= limit) {
-      break;
-    }
-  }
-  return ids;
-}
-
 class AllPeersLoader {
   List<Peer> peers = [];
 
   bool _isPeersLoading = false;
   bool _isPeersLoaded = false;
-  Set<String> _lastQueryOnlineIds = {};
-  DateTime _lastQueryOnlineTime = DateTime.fromMillisecondsSinceEpoch(0);
-  Timer? _queryOnlineTimer;
-  List<Peer> _lastQueryOnlineOptions = const [];
-  Set<String> _lastOnlineIds = {};
-  Set<String> _lastOfflineIds = {};
-  final Future<void> Function(List<String> ids) _queryOnlines;
-  final Duration _queryOnlineDebounce;
-  void Function(VoidCallback)? _setState;
-  bool _isCleared = false;
 
   final String _listenerKey = 'AllPeersLoader';
-  static const String _cbQueryOnlines = 'callback_query_onlines';
-  static const Duration _queryOnlineInterval = Duration(seconds: 5);
-  static const Duration _defaultQueryOnlineDebounce =
-      Duration(milliseconds: 300);
-  static const int _maxQueryOnlineOptions = 20;
+
+  late void Function(VoidCallback) setState;
 
   bool get needLoad => !_isPeersLoaded && !_isPeersLoading;
   bool get isPeersLoaded => _isPeersLoaded;
 
-  AllPeersLoader({
-    @visibleForTesting Future<void> Function(List<String> ids)? queryOnlines,
-    @visibleForTesting Duration? queryOnlineDebounce,
-  })  : _queryOnlines = queryOnlines ?? ((ids) => bind.queryOnlines(ids: ids)),
-        _queryOnlineDebounce =
-            queryOnlineDebounce ?? _defaultQueryOnlineDebounce;
+  AllPeersLoader();
 
   void init(void Function(VoidCallback) setState) {
-    _setState = setState;
-    _isCleared = false;
+    this.setState = setState;
     gFFI.recentPeersModel.addListener(_mergeAllPeers);
     gFFI.lanPeersModel.addListener(_mergeAllPeers);
     gFFI.abModel.addPeerUpdateListener(_listenerKey, _mergeAllPeers);
     gFFI.groupModel.addPeerUpdateListener(_listenerKey, _mergeAllPeers);
-    platformFFI.registerEventHandler(_cbQueryOnlines, _listenerKey,
-        (evt) async {
-      _updateOnlineState(evt);
-    });
   }
 
   void clear() {
@@ -145,11 +33,6 @@ class AllPeersLoader {
     gFFI.lanPeersModel.removeListener(_mergeAllPeers);
     gFFI.abModel.removePeerUpdateListener(_listenerKey);
     gFFI.groupModel.removePeerUpdateListener(_listenerKey);
-    platformFFI.unregisterEventHandler(_cbQueryOnlines, _listenerKey);
-    _queryOnlineTimer?.cancel();
-    _lastQueryOnlineOptions = const [];
-    _setState = null;
-    _isCleared = true;
   }
 
   Future<void> getAllPeers() async {
@@ -176,106 +59,50 @@ class AllPeersLoader {
   }
 
   void _mergeAllPeers() {
-    if (_isCleared) {
-      return;
+    Map<String, dynamic> combinedPeers = {};
+    for (var p in gFFI.abModel.allPeers()) {
+      if (!combinedPeers.containsKey(p.id)) {
+        combinedPeers[p.id] = p.toJson();
+      }
     }
-    peers = mergeAutocompletePeers(
-      addressBookPeers: gFFI.abModel.allPeers(),
-      groupPeers: gFFI.groupModel.peers,
-      lanPeers: gFFI.lanPeersModel.peers,
-      recentPeers: gFFI.recentPeersModel.peers,
-      restRecentPeerIds: gFFI.recentPeersModel.restPeerIds,
-    );
-    _applyLastOnlineState(peers);
-    _scheduleSetState(() {
+    for (var p in gFFI.groupModel.peers.map((e) => Peer.copy(e)).toList()) {
+      if (!combinedPeers.containsKey(p.id)) {
+        combinedPeers[p.id] = p.toJson();
+      }
+    }
+
+    List<Peer> parsedPeers = [];
+    for (var peer in combinedPeers.values) {
+      parsedPeers.add(Peer.fromJson(peer));
+    }
+
+    Set<String> peerIds = combinedPeers.keys.toSet();
+    for (final peer in gFFI.lanPeersModel.peers) {
+      if (!peerIds.contains(peer.id)) {
+        parsedPeers.add(peer);
+        peerIds.add(peer.id);
+      }
+    }
+
+    for (final peer in gFFI.recentPeersModel.peers) {
+      if (!peerIds.contains(peer.id)) {
+        parsedPeers.add(peer);
+        peerIds.add(peer.id);
+      }
+    }
+    for (final id in gFFI.recentPeersModel.restPeerIds) {
+      if (!peerIds.contains(id)) {
+        parsedPeers.add(Peer.fromJson({'id': id}));
+        peerIds.add(id);
+      }
+    }
+
+    peers = parsedPeers;
+    setState(() {
       _isPeersLoading = false;
       _isPeersLoaded = true;
     });
   }
-
-  void _updateOnlineState(Map<String, dynamic> evt) {
-    if (_isCleared) {
-      return;
-    }
-    _lastOnlineIds = _splitPeerIds(evt['onlines']);
-    _lastOfflineIds = _splitPeerIds(evt['offlines']);
-    final peersChanged = _applyLastOnlineState(peers);
-    final optionsChanged = _applyLastOnlineState(_lastQueryOnlineOptions);
-    if (peersChanged || optionsChanged) {
-      _scheduleSetState(() {});
-    }
-  }
-
-  void _scheduleSetState(VoidCallback callback) {
-    if (_isCleared) {
-      return;
-    }
-    final setState = _setState;
-    if (setState == null) {
-      callback();
-    } else {
-      setState(callback);
-    }
-  }
-
-  bool _applyLastOnlineState(List<Peer> peers) {
-    return updateAutocompletePeerOnlineStates(
-      peers,
-      onlines: _lastOnlineIds,
-      offlines: _lastOfflineIds,
-    );
-  }
-
-  Set<String> _splitPeerIds(dynamic ids) {
-    if (ids is! String || ids.isEmpty) {
-      return {};
-    }
-    return ids.split(',').where((id) => id.isNotEmpty).toSet();
-  }
-
-  void queryOnlines(Iterable<Peer> options) {
-    if (_isCleared) {
-      return;
-    }
-    _lastQueryOnlineOptions = options.toList(growable: false);
-    final ids = autocompleteOnlineQueryIds(
-      _lastQueryOnlineOptions,
-      limit: _maxQueryOnlineOptions,
-    ).toSet();
-    _queryOnlineTimer?.cancel();
-    _queryOnlineTimer = null;
-    if (ids.isEmpty) {
-      return;
-    }
-    final now = DateTime.now();
-    if (setEquals(ids, _lastQueryOnlineIds) &&
-        now.difference(_lastQueryOnlineTime) < _queryOnlineInterval) {
-      return;
-    }
-
-    _queryOnlineTimer = Timer(_queryOnlineDebounce, () async {
-      try {
-        await _queryOnlines(ids.toList(growable: false));
-        if (_isCleared) {
-          return;
-        }
-        _lastQueryOnlineIds = ids;
-        _lastQueryOnlineTime = DateTime.now();
-      } catch (e) {
-        debugPrint('query autocomplete online state failed: $e');
-      }
-    });
-  }
-
-  @visibleForTesting
-  void updateOnlineStateForTesting(Map<String, dynamic> evt) {
-    _updateOnlineState(evt);
-  }
-
-  @visibleForTesting
-  bool applyLastOnlineStateForTesting(List<Peer> peers) {
-    return _applyLastOnlineState(peers);
-  }
 }
 
 class AutocompletePeerTile extends StatefulWidget {

flutter/lib/common/widgets/dialog.dart

@@ -205,10 +205,6 @@ void changeWhiteList({Function()? callback}) async {
           const SizedBox(
             height: 8.0,
           ),
-          Text(translate("whitelist_cidr_tip")),
-          const SizedBox(
-            height: 8.0,
-          ),
           Row(
             children: [
               Expanded(
@@ -286,111 +282,6 @@ void changeWhiteList({Function()? callback}) async {
   });
 }
 
-void changeIdWhiteList({Function()? callback}) async {
-  final curIdWhiteList = await bind.mainGetOption(key: kOptionIdWhitelist);
-  var newIdWhiteListField = curIdWhiteList == defaultOptionWhitelist
-      ? ''
-      : curIdWhiteList.split(',').join('\n');
-  var controller = TextEditingController(text: newIdWhiteListField);
-  var msg = "";
-  var isInProgress = false;
-  final isOptFixed = isOptionFixed(kOptionIdWhitelist);
-  gFFI.dialogManager.show((setState, close, context) {
-    return CustomAlertDialog(
-      title: Text(translate("ID whitelisting")),
-      content: Column(
-        crossAxisAlignment: CrossAxisAlignment.start,
-        children: [
-          Text(translate("whitelist_sep")),
-          const SizedBox(
-            height: 8.0,
-          ),
-          Text(translate("id_whitelist_wildcard_tip")),
-          const SizedBox(
-            height: 8.0,
-          ),
-          Text(translate("id_whitelist_caveat_tip")),
-          const SizedBox(
-            height: 8.0,
-          ),
-          Row(
-            children: [
-              Expanded(
-                child: TextField(
-                        maxLines: null,
-                        decoration: InputDecoration(
-                          errorText: msg.isEmpty ? null : translate(msg),
-                        ),
-                        controller: controller,
-                        enabled: !isOptFixed,
-                        autofocus: true)
-                    .workaroundFreezeLinuxMint(),
-              ),
-            ],
-          ),
-          const SizedBox(
-            height: 4.0,
-          ),
-          // NOT use Offstage to wrap LinearProgressIndicator
-          if (isInProgress) const LinearProgressIndicator(),
-        ],
-      ),
-      actions: [
-        dialogButton("Cancel", onPressed: close, isOutline: true),
-        if (!isOptFixed)
-          dialogButton("Clear", onPressed: () async {
-            await bind.mainSetOption(
-                key: kOptionIdWhitelist, value: defaultOptionWhitelist);
-            callback?.call();
-            close();
-          }, isOutline: true),
-        if (!isOptFixed)
-          dialogButton(
-            "OK",
-            onPressed: () async {
-              setState(() {
-                msg = "";
-                isInProgress = true;
-              });
-              newIdWhiteListField = controller.text.trim();
-              var newIdWhiteList = "";
-              if (newIdWhiteListField.isEmpty) {
-                // pass
-              } else {
-                final ids = newIdWhiteListField
-                    .trim()
-                    .split(RegExp(r"[\s,;\n]+"))
-                    .where((e) => e.isNotEmpty)
-                    .toList();
-                // Separators are handled above; allow all other Unicode characters.
-                for (final id in ids) {
-                  final hasControlCharacters = id.runes.any(
-                      (char) => char <= 0x1f || (char >= 0x7f && char <= 0x9f));
-                  if (hasControlCharacters) {
-                    msg = "${translate("Invalid ID")} $id";
-                    setState(() {
-                      isInProgress = false;
-                    });
-                    return;
-                  }
-                }
-                newIdWhiteList = ids.join(',');
-              }
-              if (newIdWhiteList.trim().isEmpty) {
-                newIdWhiteList = defaultOptionWhitelist;
-              }
-              await bind.mainSetOption(
-                  key: kOptionIdWhitelist, value: newIdWhiteList);
-              callback?.call();
-              close();
-            },
-          ),
-      ],
-      onCancel: close,
-    );
-  });
-}
-
 Future<String> changeDirectAccessPort(
     String currentIP, String currentPort) async {
   final controller = TextEditingController(text: currentPort);
@@ -936,19 +827,26 @@ void enterPasswordDialog(
   );
 }
 
-void enterUserLoginDialog(SessionID sessionId,
-    OverlayDialogManager dialogManager, String osAccountDescTip) async {
+void enterUserLoginDialog(
+    SessionID sessionId,
+    OverlayDialogManager dialogManager,
+    String osAccountDescTip,
+    bool canRememberAccount) async {
   await _connectDialog(
     sessionId,
     dialogManager,
     osUsernameController: TextEditingController(),
     osPasswordController: TextEditingController(),
     osAccountDescTip: osAccountDescTip,
+    canRememberAccount: canRememberAccount,
   );
 }
 
-void enterUserLoginAndPasswordDialog(SessionID sessionId,
-    OverlayDialogManager dialogManager, String osAccountDescTip) async {
+void enterUserLoginAndPasswordDialog(
+    SessionID sessionId,
+    OverlayDialogManager dialogManager,
+    String osAccountDescTip,
+    bool canRememberAccount) async {
   await _connectDialog(
     sessionId,
     dialogManager,
@@ -956,6 +854,7 @@ void enterUserLoginAndPasswordDialog(SessionID sessionId,
     osPasswordController: TextEditingController(),
     passwordController: TextEditingController(),
     osAccountDescTip: osAccountDescTip,
+    canRememberAccount: canRememberAccount,
   );
 }
 
@@ -966,6 +865,7 @@ _connectDialog(
   TextEditingController? osPasswordController,
   TextEditingController? passwordController,
   String? osAccountDescTip,
+  bool canRememberAccount = true,
 }) async {
   final errUsername = ''.obs;
   var rememberPassword = false;
@@ -973,6 +873,11 @@ _connectDialog(
     rememberPassword =
         await bind.sessionGetRemember(sessionId: sessionId) ?? false;
   }
+  var rememberAccount = false;
+  if (canRememberAccount && osUsernameController != null) {
+    rememberAccount =
+        await bind.sessionGetRemember(sessionId: sessionId) ?? false;
+  }
   if (osUsernameController != null) {
     osUsernameController.addListener(() {
       if (errUsername.value.isNotEmpty) {
@@ -1000,6 +905,12 @@ _connectDialog(
       final osPassword = osPasswordController?.text.trim() ?? '';
       final password = passwordController?.text.trim() ?? '';
       if (passwordController != null && password.isEmpty) return;
+      if (rememberAccount) {
+        bind.sessionPeerOption(
+            sessionId: sessionId, name: 'os-username', value: osUsername);
+        bind.sessionPeerOption(
+            sessionId: sessionId, name: 'os-password', value: osPassword);
+      }
       gFFI.login(
         osUsername,
         osPassword,
@@ -1076,6 +987,16 @@ _connectDialog(
             controller: osPasswordController,
             autoFocus: false,
           ),
+          if (canRememberAccount)
+            rememberWidget(
+              translate('remember_account_tip'),
+              rememberAccount,
+              (v) {
+                if (v != null) {
+                  setState(() => rememberAccount = v);
+                }
+              },
+            ),
         ],
       );
     }
@@ -1512,6 +1433,91 @@ showSetOSPassword(
   });
 }
 
+showSetOSAccount(
+  SessionID sessionId,
+  OverlayDialogManager dialogManager,
+) async {
+  final usernameController = TextEditingController();
+  final passwdController = TextEditingController();
+  var username =
+      await bind.sessionGetOption(sessionId: sessionId, arg: 'os-username') ??
+          '';
+  var password =
+      await bind.sessionGetOption(sessionId: sessionId, arg: 'os-password') ??
+          '';
+  usernameController.text = username;
+  passwdController.text = password;
+  dialogManager.show((setState, close, context) {
+    submit() {
+      final username = usernameController.text.trim();
+      final password = usernameController.text.trim();
+      bind.sessionPeerOption(
+          sessionId: sessionId, name: 'os-username', value: username);
+      bind.sessionPeerOption(
+          sessionId: sessionId, name: 'os-password', value: password);
+      close();
+    }
+
+    descWidget(String text) {
+      return Column(
+        children: [
+          Align(
+            alignment: Alignment.centerLeft,
+            child: Text(
+              text,
+              maxLines: 3,
+              softWrap: true,
+              overflow: TextOverflow.ellipsis,
+              style: TextStyle(fontSize: 16),
+            ),
+          ),
+          Container(
+            height: 8,
+          ),
+        ],
+      );
+    }
+
+    return CustomAlertDialog(
+      title: Row(
+        mainAxisAlignment: MainAxisAlignment.center,
+        children: [
+          Icon(Icons.password_rounded, color: MyTheme.accent),
+          Text(translate('OS Account')).paddingOnly(left: 10),
+        ],
+      ),
+      content: Column(
+        mainAxisSize: MainAxisSize.min,
+        children: [
+          descWidget(translate("os_account_desk_tip")),
+          DialogTextField(
+            title: translate(DialogTextField.kUsernameTitle),
+            controller: usernameController,
+            prefixIcon: DialogTextField.kUsernameIcon,
+            errorText: null,
+          ),
+          PasswordWidget(controller: passwdController),
+        ],
+      ),
+      actions: [
+        dialogButton(
+          "Cancel",
+          icon: Icon(Icons.close_rounded),
+          onPressed: close,
+          isOutline: true,
+        ),
+        dialogButton(
+          "OK",
+          icon: Icon(Icons.done_rounded),
+          onPressed: submit,
+        ),
+      ],
+      onSubmit: submit,
+      onCancel: close,
+    );
+  });
+}
+
 Widget buildNoteTextField({
   required TextEditingController controller,
   required VoidCallback onEscape,
@@ -1899,110 +1905,26 @@ customImageQualityDialog(SessionID sessionId, String id, FFI ffi) async {
   msgBoxCommon(ffi.dialogManager, 'Custom Image Quality', content, [btnClose]);
 }
 
-int? _validateTrackpadSpeed(String text) {
-  final speed = int.tryParse(text);
-  if (speed == null || speed < kMinTrackpadSpeed || speed > kMaxTrackpadSpeed) {
-    BotToast.showText(
-      text:
-          '${translate('Invalid format')}: $kMinTrackpadSpeed-$kMaxTrackpadSpeed',
-      contentColor: Colors.red,
-    );
-    return null;
-  }
-  return speed;
-}
-
-Future<void> _saveTrackpadSpeed({
-  required SessionID sessionId,
-  required FFI ffi,
-  required int initSpeed,
-  required int speed,
-}) async {
-  if (speed == initSpeed) {
-    return;
-  }
-  await bind.sessionSetTrackpadSpeed(sessionId: sessionId, value: speed);
-  await ffi.inputModel.updateTrackpadSpeed();
-}
-
-void _showTrackpadSpeedSaveError(Object error, StackTrace stackTrace) {
-  debugPrint('Failed to save trackpad speed: $error');
-  debugPrintStack(stackTrace: stackTrace);
-  BotToast.showText(
-    text: translate('Failed'),
-    contentColor: Colors.red,
-  );
-}
-
-List<Widget> _trackpadSpeedDialogActions({
-  required bool isSubmitting,
-  required VoidCallback close,
-  required VoidCallback submit,
-}) {
-  return [
-    dialogButton(
-      'Cancel',
-      icon: Icon(Icons.close_rounded),
-      onPressed: isSubmitting ? null : close,
-      isOutline: true,
-    ),
-    dialogButton(
-      'OK',
-      icon: Icon(Icons.done_rounded),
-      onPressed: isSubmitting ? null : submit,
-    ),
-  ];
-}
-
-void trackpadSpeedDialog(SessionID sessionId, FFI ffi) {
-  final initSpeed = ffi.inputModel.trackpadSpeed;
+trackpadSpeedDialog(SessionID sessionId, FFI ffi) async {
+  int initSpeed = ffi.inputModel.trackpadSpeed;
   final curSpeed = SimpleWrapper(initSpeed);
-  var speedText = initSpeed.toString();
-  var isSubmitting = false;
-  ffi.dialogManager.show((setState, close, context) {
-    Future<void> submit([String? submittedText]) async {
-      if (isSubmitting) {
-        return;
-      }
-      speedText = submittedText ?? speedText;
-      final speed = _validateTrackpadSpeed(speedText);
-      if (speed == null) {
-        return;
-      }
-      setState(() => isSubmitting = true);
-      try {
-        await _saveTrackpadSpeed(
-          sessionId: sessionId,
-          ffi: ffi,
-          initSpeed: initSpeed,
-          speed: speed,
-        );
-        close();
-      } catch (error, stackTrace) {
-        _showTrackpadSpeedSaveError(error, stackTrace);
-        setState(() => isSubmitting = false);
-      }
+  final btnClose = dialogButton('Close', onPressed: () async {
+    if (curSpeed.value <= kMaxTrackpadSpeed &&
+        curSpeed.value >= kMinTrackpadSpeed &&
+        curSpeed.value != initSpeed) {
+      await bind.sessionSetTrackpadSpeed(
+          sessionId: sessionId, value: curSpeed.value);
+      await ffi.inputModel.updateTrackpadSpeed();
     }
-
-    return CustomAlertDialog(
-      title: Text(
-        translate('Trackpad speed'),
-        style: TextStyle(fontSize: 21),
-      ),
-      content: TrackpadSpeedWidget(
-        value: curSpeed,
-        onTextChanged: (text) => speedText = text,
-        onTextSubmitted: submit,
-      ),
-      actions: _trackpadSpeedDialogActions(
-        isSubmitting: isSubmitting,
-        close: close,
-        submit: submit,
-      ),
-      onSubmit: isSubmitting ? null : submit,
-      onCancel: isSubmitting ? null : close,
-    );
+    ffi.dialogManager.dismissAll();
   });
+  msgBoxCommon(
+      ffi.dialogManager,
+      'Trackpad speed',
+      TrackpadSpeedWidget(
+        value: curSpeed,
+      ),
+      [btnClose]);
 }
 
 void deleteConfirmDialog(Function onSubmit, String title) async {

flutter/lib/common/widgets/keyboard_shortcuts/display.dart

@@ -0,0 +1,111 @@
+// flutter/lib/common/widgets/keyboard_shortcuts/display.dart
+import 'dart:convert';
+import 'package:flutter/foundation.dart';
+import '../../../consts.dart';
+import '../../../models/platform_model.dart';
+import 'shortcut_utils.dart';
+
+/// Read the bindings JSON and produce a human-readable shortcut string for
+/// `actionId`, formatted for the current OS. Returns null if unbound, or —
+/// when [requireEnabled] is true (the default) — when the master toggle is
+/// off. The configuration page passes `requireEnabled: false` so users still
+/// see what they have bound while the feature is disabled.
+class ShortcutDisplay {
+  // Cache parsed JSON keyed by the raw string — called per visible action on
+  // every menu rebuild, so the jsonDecode is the real cost. Invalidation is
+  // automatic: a write changes the raw and we re-parse.
+  static String? _cachedRaw;
+  static Map<String, dynamic>? _cachedParsed;
+
+  @visibleForTesting
+  static void resetCache() {
+    _cachedRaw = null;
+    _cachedParsed = null;
+  }
+
+  static String? formatFor(String actionId, {bool requireEnabled = true}) {
+    final raw = bind.mainGetLocalOption(key: kShortcutLocalConfigKey);
+    if (raw.isEmpty) return null;
+    Map<String, dynamic>? parsed;
+    if (raw == _cachedRaw) {
+      parsed = _cachedParsed;
+    } else {
+      try {
+        parsed = jsonDecode(raw) as Map<String, dynamic>;
+      } catch (_) {
+        parsed = null;
+      }
+      _cachedRaw = raw;
+      _cachedParsed = parsed;
+    }
+    if (parsed == null) return null;
+    if (requireEnabled && parsed['enabled'] != true) return null;
+    // When pass-through is on, the matcher returns early on every keystroke.
+    // Showing the bound combo next to a menu item would lie to the user — they
+    // would press it expecting the local action and instead the keys would go
+    // to the remote. Treat as unbound for display purposes.
+    if (requireEnabled && parsed['pass_through'] == true) return null;
+    final list = shortcutBindingMapsFrom(parsed['bindings']);
+    final found = list.firstWhere(
+      (b) => b['action'] == actionId,
+      orElse: () => {},
+    );
+    if (found.isEmpty) return null;
+
+    // Guard against a hand-edited / corrupt config where `key` is missing or
+    // not a string — silently treat the binding as unbound rather than
+    // crashing the toolbar render.
+    final keyValue = found['key'];
+    if (keyValue is! String) return null;
+
+    final isMac = defaultTargetPlatform == TargetPlatform.macOS ||
+                  defaultTargetPlatform == TargetPlatform.iOS;
+    // `mods` similarly may be malformed; treat a non-list as no modifiers.
+    final modsRaw = found['mods'];
+    final mods = modsRaw is List
+        ? modsRaw.whereType<String>().toList()
+        : const <String>[];
+    // Plain-text labels (Cmd / Ctrl / Alt / Shift) instead of Unicode glyphs
+    // (⌘ ⌃ ⌥ ⇧). Flutter Web's CanvasKit bundled fonts don't always carry the
+    // macOS modifier symbols, which renders as garbled boxes on Mac browsers;
+    // text is portable and readable on every platform.
+    //
+    // Order matches the canonical macOS order (Cmd, Control, Option, Shift)
+    // so the rendered hint reads naturally. `ctrl` only ever appears in
+    // saved bindings on macOS — Win/Linux collapses Ctrl into `primary`.
+    final parts = <String>[];
+    for (final m in ['primary', 'ctrl', 'alt', 'shift']) {
+      if (!mods.contains(m)) continue;
+      switch (m) {
+        case 'primary': parts.add(isMac ? 'Cmd' : 'Ctrl'); break;
+        case 'ctrl':    parts.add(isMac ? 'Control' : 'Ctrl'); break;
+        case 'alt':     parts.add(isMac ? 'Option' : 'Alt'); break;
+        case 'shift':   parts.add('Shift'); break;
+      }
+    }
+    parts.add(_keyDisplay(keyValue));
+    return parts.join('+');
+  }
+
+  static String _keyDisplay(String key) {
+    switch (key) {
+      case 'delete':     return 'Del';
+      case 'backspace':  return 'Backspace';
+      case 'enter':      return 'Enter';
+      case 'tab':        return 'Tab';
+      case 'space':      return 'Space';
+      case 'arrow_left': return 'Left';
+      case 'arrow_right':return 'Right';
+      case 'arrow_up':   return 'Up';
+      case 'arrow_down': return 'Down';
+      case 'home':       return 'Home';
+      case 'end':        return 'End';
+      case 'page_up':    return 'PgUp';
+      case 'page_down':  return 'PgDn';
+      case 'insert':     return 'Ins';
+    }
+    if (key.startsWith('digit')) return key.substring(5);
+    // F-keys ("f1".."f12") and single letters fall through to uppercase.
+    return key.toUpperCase();
+  }
+}

flutter/lib/common/widgets/keyboard_shortcuts/page_body.dart

@@ -0,0 +1,481 @@
+// flutter/lib/common/widgets/keyboard_shortcuts/page_body.dart
+//
+// Shared body widget for the Keyboard Shortcuts configuration page. Both the
+// desktop (`desktop/pages/desktop_keyboard_shortcuts_page.dart`) and mobile
+// (`mobile/pages/mobile_keyboard_shortcuts_page.dart`) pages render this
+// widget inside their own platform-styled Scaffold + AppBar shell.
+//
+// The body owns:
+//   * the top-level enable/disable toggle (mirrors the General-tab toggle —
+//     same JSON key, same semantics);
+//   * a grouped list of actions, each with its current binding plus
+//     edit / clear icons;
+//   * the JSON read/write helpers under [kShortcutLocalConfigKey] in the
+//     canonical {enabled, bindings:[{action,mods,key}]} shape;
+//   * the recording-dialog round-trip and conflict-replace bookkeeping;
+//   * "Reset to defaults" (called from the platform AppBar).
+//
+// Platform shells supply only:
+//   * the AppBar (with a "Reset to defaults" action that calls
+//     [KeyboardShortcutsPageBodyState.resetToDefaultsWithConfirm]);
+//   * surrounding padding / list-tile vs. dense-row visuals via the
+//     [compact] flag.
+
+import 'dart:convert';
+
+import 'package:flutter/foundation.dart';
+import 'package:flutter/material.dart';
+
+import '../../../common.dart';
+import '../../../consts.dart';
+import '../../../models/platform_model.dart';
+import '../../../models/shortcut_model.dart';
+import 'display.dart';
+import 'recording_dialog.dart';
+import 'shortcut_actions.dart';
+import 'shortcut_utils.dart';
+
+/// The shared body widget. Render this inside a platform-styled Scaffold.
+///
+/// [compact] toggles the desktop dense-row layout (`true`) versus the mobile
+/// touch-friendly ListTile layout (`false`).
+///
+/// [editButtonHint] is shown as the tooltip on the Edit icon. Mobile shells
+/// use this to clarify that recording requires a physical keyboard.
+///
+/// [headerBanner] is an optional widget rendered above the toggle. Mobile
+/// uses this to show the "Recording requires a physical keyboard" hint.
+class KeyboardShortcutsPageBody extends StatefulWidget {
+  final bool compact;
+  final String? editButtonHint;
+  final Widget? headerBanner;
+
+  /// Whether to render the master Enable + Pass-through toggles inside the
+  /// body. Desktop shells set this to false because the General settings tab
+  /// already exposes both checkboxes (and is the only entry point to this
+  /// page on desktop). Mobile defaults to true: its entry point is a plain
+  /// nav tile in Settings, so this page is the only place the user can
+  /// flip the master switches.
+  final bool showMasterToggles;
+
+  const KeyboardShortcutsPageBody({
+    Key? key,
+    this.compact = true,
+    this.editButtonHint,
+    this.headerBanner,
+    this.showMasterToggles = true,
+  }) : super(key: key);
+
+  @override
+  State<KeyboardShortcutsPageBody> createState() =>
+      KeyboardShortcutsPageBodyState();
+}
+
+/// Public state so platform shells can call [resetToDefaultsWithConfirm] from
+/// their AppBar action.
+class KeyboardShortcutsPageBodyState extends State<KeyboardShortcutsPageBody> {
+  // ----- Persistence helpers -----
+
+  Map<String, dynamic> _readJson() {
+    final raw = bind.mainGetLocalOption(key: kShortcutLocalConfigKey);
+    if (raw.isEmpty) return {'enabled': false, 'bindings': <dynamic>[]};
+    try {
+      final parsed = jsonDecode(raw) as Map<String, dynamic>;
+      parsed['bindings'] ??= <dynamic>[];
+      parsed['enabled'] ??= false;
+      return parsed;
+    } catch (_) {
+      return {'enabled': false, 'bindings': <dynamic>[]};
+    }
+  }
+
+  Future<void> _writeJson(Map<String, dynamic> json) async {
+    await bind.mainSetLocalOption(
+        key: kShortcutLocalConfigKey, value: jsonEncode(json));
+    // Refresh the matcher cache so writes take effect immediately. On native
+    // this hits the Rust matcher; on Web the bridge forwards to the JS-side
+    // matcher in flutter/web/js/.
+    bind.mainReloadKeyboardShortcuts();
+    if (mounted) setState(() {});
+  }
+
+  /// Replace the bindings entry for [actionId] with [binding]. If [binding]
+  /// is null, removes the existing entry. If the user is replacing a
+  /// conflicting binding, [clearActionId] points at the action whose
+  /// (now-stale) binding should be removed in the same write.
+  Future<void> _setBinding(
+    String actionId, {
+    Map<String, dynamic>? binding,
+    String? clearActionId,
+  }) async {
+    final json = _readJson();
+    final list = shortcutBindingMapsFrom(json['bindings']);
+    list.removeWhere((b) {
+      final a = b['action'];
+      return a == actionId || (clearActionId != null && a == clearActionId);
+    });
+    if (binding != null) {
+      list.add(binding);
+    }
+    json['bindings'] = list;
+    await _writeJson(json);
+  }
+
+  Future<void> _setEnabled(bool v) async {
+    await ShortcutModel.setEnabled(v);
+    if (mounted) setState(() {});
+  }
+
+  Future<void> _setPassThrough(bool v) async {
+    await ShortcutModel.setPassThrough(v);
+    if (mounted) setState(() {});
+  }
+
+  Future<void> _resetToDefaults() async {
+    final json = _readJson();
+    // Single source of truth lives in `ShortcutModel.currentPlatformCapabilities`
+    // — the same helper feeds the first-enable seed pass, this Reset action,
+    // and the action-list filter below, so the three can never disagree on
+    // which actions belong on this platform.
+    json['bindings'] = filterDefaultBindingsForPlatform(
+      jsonDecode(bind.mainGetDefaultKeyboardShortcuts()) as List,
+      ShortcutModel.currentPlatformCapabilities(),
+    );
+    await _writeJson(json);
+  }
+
+  String _labelFor(String actionId) {
+    // Intentionally walks the unfiltered list (via the recursive helper, so
+    // both direct entries and subgroup entries are covered) — a stale
+    // cross-platform binding (e.g. Toggle Toolbar carried over from
+    // desktop) should still resolve to its human-readable label in conflict
+    // warnings.
+    for (final entry in allActionEntries(kKeyboardShortcutActionGroups)) {
+      if (entry.id == actionId) return translate(entry.labelKey);
+    }
+    return actionId;
+  }
+
+  /// Action groups visible on the current platform. Reads the same
+  /// capability set as the seed-defaults / reset-to-defaults paths from
+  /// `ShortcutModel.currentPlatformCapabilities`, so the UI lists exactly
+  /// the actions whose handlers the matcher can dispatch here.
+  List<KeyboardShortcutActionGroup> _groupsForCurrentPlatform() {
+    return filterKeyboardShortcutActionGroupsForPlatform(
+      ShortcutModel.currentPlatformCapabilities(),
+    );
+  }
+
+  // ----- UI handlers -----
+
+  Future<void> _onEdit(KeyboardShortcutActionEntry entry) async {
+    final json = _readJson();
+    final bindings = shortcutBindingMapsFrom(json['bindings']);
+    final result = await showRecordingDialog(
+      context: context,
+      actionId: entry.id,
+      actionLabel: translate(entry.labelKey),
+      existingBindings: bindings,
+      actionLabelLookup: _labelFor,
+    );
+    if (result == null) return;
+    await _setBinding(
+      entry.id,
+      binding: result.binding,
+      clearActionId: result.clearActionId,
+    );
+  }
+
+  Future<void> _onClear(KeyboardShortcutActionEntry entry) async {
+    await _setBinding(entry.id, binding: null);
+  }
+
+  /// Public — invoked from the platform AppBar action.
+  Future<void> resetToDefaultsWithConfirm() async {
+    final confirmed = await showDialog<bool>(
+      context: context,
+      builder: (ctx) => AlertDialog(
+        title: Text(translate('Reset to defaults')),
+        content: Text(translate('shortcut-reset-confirm-tip')),
+        actions: [
+          dialogButton('Cancel',
+              onPressed: () => Navigator.of(ctx).pop(false), isOutline: true),
+          dialogButton('OK', onPressed: () => Navigator.of(ctx).pop(true)),
+        ],
+      ),
+    );
+    if (confirmed == true) {
+      await _resetToDefaults();
+    }
+  }
+
+  // ----- Build -----
+
+  @override
+  Widget build(BuildContext context) {
+    final enabled = ShortcutModel.isEnabled();
+    final theme = Theme.of(context);
+
+    return ListView(
+      padding: const EdgeInsets.all(16),
+      children: [
+        if (widget.headerBanner != null) ...[
+          widget.headerBanner!,
+          const SizedBox(height: 12),
+        ],
+        if (widget.showMasterToggles) ...[
+          _toggleRow(
+            enabled,
+            'Enable keyboard shortcuts in remote session',
+            (v) => _setEnabled(v),
+          ),
+          if (enabled)
+            _toggleRow(
+              ShortcutModel.isPassThrough(),
+              'Pass-through to remote',
+              (v) => _setPassThrough(v),
+            ),
+        ],
+        const SizedBox(height: 8),
+        Padding(
+          padding: const EdgeInsets.symmetric(horizontal: 8),
+          child: Text(
+            translate('shortcut-page-description'),
+            style: TextStyle(color: theme.hintColor),
+          ),
+        ),
+        const SizedBox(height: 16),
+        // Bindings list and configuration entry only show when shortcuts are
+        // enabled — there is nothing to configure while the matcher is off.
+        if (enabled)
+          Column(
+            crossAxisAlignment: CrossAxisAlignment.start,
+            children: [
+              for (final group in _groupsForCurrentPlatform())
+                _buildGroup(context, group),
+            ],
+          ),
+      ],
+    );
+  }
+
+  Widget _toggleRow(
+      bool value, String labelKey, Future<void> Function(bool) onChanged,
+      {String? tooltipKey}) {
+    return Row(
+      children: [
+        Checkbox(
+          value: value,
+          onChanged: (v) async {
+            if (v == null) return;
+            await onChanged(v);
+          },
+        ),
+        const SizedBox(width: 4),
+        Expanded(
+          child: GestureDetector(
+            behavior: HitTestBehavior.opaque,
+            onTap: () => onChanged(!value),
+            child: Text(translate(labelKey)),
+          ),
+        ),
+        if (tooltipKey != null) InfoTooltipIcon(tipKey: tooltipKey),
+      ],
+    );
+  }
+
+  // One indent unit per nesting level. Both "top item under top heading"
+  // and "subgroup heading under top group" are *one* level deeper than the
+  // top heading, so they share this indent — meaning a top-level direct
+  // item and a sibling subgroup heading line up at exactly the same x.
+  // Subgroup items are *two* levels deeper.
+  static const double _kIndentStep = 16.0;
+
+  /// Top-level group: heading at zero indent, then walk `children` in
+  /// declaration order. Direct entries get [_kIndentStep] of indent so
+  /// they read as "items under this heading"; subgroup headings sit at
+  /// the same indent (a subgroup is a sibling of the direct items, just
+  /// with its own nested entries below).
+  Widget _buildGroup(BuildContext context, KeyboardShortcutActionGroup group) {
+    return Column(
+      crossAxisAlignment: CrossAxisAlignment.start,
+      children: [
+        const SizedBox(height: 12),
+        _buildHeading(context, group.titleKey, isSub: false),
+        const SizedBox(height: 4),
+        for (final child in group.children)
+          switch (child) {
+            KeyboardShortcutActionEntry() => Padding(
+                padding: const EdgeInsets.only(left: _kIndentStep),
+                child: _buildEntryRow(context, child),
+              ),
+            KeyboardShortcutActionSubgroup() =>
+              _buildSubgroup(context, child),
+          },
+      ],
+    );
+  }
+
+  Widget _buildSubgroup(
+      BuildContext context, KeyboardShortcutActionSubgroup subgroup) {
+    return Column(
+      crossAxisAlignment: CrossAxisAlignment.start,
+      children: [
+        const SizedBox(height: 8),
+        _buildHeading(context, subgroup.titleKey, isSub: true),
+        const SizedBox(height: 4),
+        for (final entry in subgroup.entries)
+          Padding(
+            // Two indent steps: one for "subgroup heading is nested under
+            // top heading" (matches the heading's own indent) and one for
+            // "this entry is under the subgroup heading".
+            padding: const EdgeInsets.only(left: _kIndentStep * 2),
+            child: _buildEntryRow(context, entry),
+          ),
+      ],
+    );
+  }
+
+  Widget _buildHeading(BuildContext context, String titleKey,
+      {required bool isSub}) {
+    // Subgroup heading nests one step under the top heading — same indent
+    // as a top-level direct item, so the two line up at the same x.
+    final indent = isSub ? _kIndentStep : 0.0;
+    return Padding(
+      padding: EdgeInsets.only(left: 8 + indent, right: 8),
+      child: Row(
+        children: [
+          Text(
+            translate(titleKey),
+            style: TextStyle(
+              fontWeight: isSub ? FontWeight.w500 : FontWeight.w600,
+              color: isSub
+                  ? Theme.of(context).hintColor
+                  : Theme.of(context).colorScheme.primary,
+            ),
+          ),
+          const SizedBox(width: 8),
+          Expanded(child: Divider(thickness: isSub ? 0.5 : 1)),
+        ],
+      ),
+    );
+  }
+
+  Widget _buildEntryRow(
+      BuildContext context, KeyboardShortcutActionEntry entry) {
+    return widget.compact
+        ? _buildCompactRow(context, entry)
+        : _buildTouchRow(context, entry);
+  }
+
+  /// Desktop dense row: label | shortcut | edit | clear, all in one Row.
+  Widget _buildCompactRow(
+      BuildContext context, KeyboardShortcutActionEntry entry) {
+    final shortcut = ShortcutDisplay.formatFor(entry.id, requireEnabled: false);
+    final hasBinding = shortcut != null;
+    return Padding(
+      padding: const EdgeInsets.symmetric(horizontal: 8, vertical: 6),
+      child: Row(
+        children: [
+          Expanded(
+            flex: 5,
+            child: Text(translate(entry.labelKey)),
+          ),
+          Expanded(
+            flex: 4,
+            child: Text(
+              shortcut ?? '—',
+              style: TextStyle(
+                fontFamily: defaultTargetPlatform == TargetPlatform.windows
+                    ? 'Consolas'
+                    : 'monospace',
+                color: hasBinding ? null : Theme.of(context).hintColor,
+              ),
+            ),
+          ),
+          IconButton(
+            tooltip: widget.editButtonHint ?? translate('Edit'),
+            onPressed: () => _onEdit(entry),
+            icon: const Icon(Icons.edit_outlined, size: 18),
+          ),
+          SizedBox(
+            width: 40,
+            child: hasBinding
+                ? IconButton(
+                    tooltip: translate('Clear'),
+                    onPressed: () => _onClear(entry),
+                    icon: const Icon(Icons.close, size: 18),
+                  )
+                : const SizedBox.shrink(),
+          ),
+        ],
+      ),
+    );
+  }
+
+  /// Mobile touch row: ListTile with title + subtitle + trailing icons.
+  Widget _buildTouchRow(
+      BuildContext context, KeyboardShortcutActionEntry entry) {
+    final shortcut = ShortcutDisplay.formatFor(entry.id, requireEnabled: false);
+    final hasBinding = shortcut != null;
+    return ListTile(
+      dense: false,
+      contentPadding: const EdgeInsets.symmetric(horizontal: 8),
+      title: Text(translate(entry.labelKey)),
+      subtitle: Text(
+        shortcut ?? '—',
+        style: TextStyle(
+          fontFamily: defaultTargetPlatform == TargetPlatform.windows
+              ? 'Consolas'
+              : 'monospace',
+          color: hasBinding ? null : Theme.of(context).hintColor,
+        ),
+      ),
+      trailing: Row(
+        mainAxisSize: MainAxisSize.min,
+        children: [
+          IconButton(
+            tooltip: widget.editButtonHint ?? translate('Edit'),
+            onPressed: () => _onEdit(entry),
+            icon: const Icon(Icons.edit_outlined),
+          ),
+          if (hasBinding)
+            IconButton(
+              tooltip: translate('Clear'),
+              onPressed: () => _onClear(entry),
+              icon: const Icon(Icons.close),
+            )
+          else
+            const SizedBox(width: 48),
+        ],
+      ),
+    );
+  }
+}
+
+/// Small help-icon tooltip used for inline explanations next to a checkbox /
+/// row. Triggers on hover (desktop) and tap (mobile). Public so the desktop
+/// General settings tab can reuse it.
+class InfoTooltipIcon extends StatelessWidget {
+  final String tipKey;
+  const InfoTooltipIcon({Key? key, required this.tipKey}) : super(key: key);
+
+  @override
+  Widget build(BuildContext context) {
+    return Tooltip(
+      message: translate(tipKey),
+      triggerMode: TooltipTriggerMode.tap,
+      preferBelow: false,
+      waitDuration: const Duration(milliseconds: 250),
+      showDuration: const Duration(seconds: 6),
+      child: Padding(
+        padding: const EdgeInsets.symmetric(horizontal: 6),
+        child: Icon(
+          Icons.help_outline,
+          size: 16,
+          color: Theme.of(context).hintColor,
+        ),
+      ),
+    );
+  }
+}

flutter/lib/common/widgets/keyboard_shortcuts/recording_dialog.dart

@@ -0,0 +1,399 @@
+// flutter/lib/common/widgets/keyboard_shortcuts/recording_dialog.dart
+//
+// Modal dialog used by the Keyboard Shortcuts settings page to capture a new
+// key combination for a given action. The dialog listens for KeyDown events,
+// extracts the modifier set + non-modifier key, validates that at least one
+// modifier is present, and reports any conflict with another already-bound
+// action.
+//
+// On Save, returns the new binding map ({action, mods, key}) plus the
+// optional id of the action whose binding should be cleared (the conflict
+// "Replace" path). On Cancel, returns null.
+
+import 'package:flutter/foundation.dart';
+import 'package:flutter/material.dart';
+import 'package:flutter/services.dart';
+
+import '../../../common.dart';
+import 'shortcut_utils.dart';
+
+/// Result of the recording dialog.
+class RecordingResult {
+  /// The new binding map to write: {action, mods, key}.
+  final Map<String, dynamic> binding;
+
+  /// If the chosen combo conflicted with another action, the user chose
+  /// "Replace" — the caller must clear this action's binding before writing
+  /// the new one.
+  final String? clearActionId;
+
+  RecordingResult(this.binding, this.clearActionId);
+}
+
+/// Show the recording dialog.
+///
+/// [actionId] is the action being edited (used for the title and to detect
+/// "binding to itself" — that's not a conflict).
+/// [actionLabel] is the translated, user-facing action name.
+/// [existingBindings] is the current bindings list (used for conflict detection).
+/// [actionLabelLookup] resolves an actionId to its translated label, used in
+/// the conflict warning.
+Future<RecordingResult?> showRecordingDialog({
+  required BuildContext context,
+  required String actionId,
+  required String actionLabel,
+  required List<Map<String, dynamic>> existingBindings,
+  required String Function(String) actionLabelLookup,
+}) {
+  return showDialog<RecordingResult>(
+    context: context,
+    barrierDismissible: false,
+    builder: (ctx) => _RecordingDialog(
+      actionId: actionId,
+      actionLabel: actionLabel,
+      existingBindings: existingBindings,
+      actionLabelLookup: actionLabelLookup,
+    ),
+  );
+}
+
+class _RecordingDialog extends StatefulWidget {
+  final String actionId;
+  final String actionLabel;
+  final List<Map<String, dynamic>> existingBindings;
+  final String Function(String) actionLabelLookup;
+
+  const _RecordingDialog({
+    required this.actionId,
+    required this.actionLabel,
+    required this.existingBindings,
+    required this.actionLabelLookup,
+  });
+
+  @override
+  State<_RecordingDialog> createState() => _RecordingDialogState();
+}
+
+class _RecordingDialogState extends State<_RecordingDialog> {
+  final FocusNode _focusNode = FocusNode();
+
+  // Captured combo. null until the user presses something with a non-modifier.
+  Set<String> _mods = {};
+  String? _key;
+
+  // Human-readable label for the most recent press that we couldn't bind to
+  // (e.g. F13, media keys). null when the last press was either supported or
+  // a modifier-only press. Cleared whenever a supported key arrives, so a
+  // user who hits an unsupported key after a valid capture sees the warning
+  // until they press something else. Distinct from `_key == null` so the
+  // status line can tell the user *why* their press was ignored instead of
+  // silently doing nothing.
+  String? _unsupportedKey;
+
+  // Modifier LogicalKeyboardKeys we should *not* treat as "unsupported" when
+  // they fail to map to a key name. A modifier-only press is normal during
+  // combo capture (the user is building up their combo) — only non-modifier
+  // unmapped keys deserve the warning.
+  static final _modifierKeys = <LogicalKeyboardKey>{
+    LogicalKeyboardKey.shift,
+    LogicalKeyboardKey.shiftLeft,
+    LogicalKeyboardKey.shiftRight,
+    LogicalKeyboardKey.control,
+    LogicalKeyboardKey.controlLeft,
+    LogicalKeyboardKey.controlRight,
+    LogicalKeyboardKey.alt,
+    LogicalKeyboardKey.altLeft,
+    LogicalKeyboardKey.altRight,
+    LogicalKeyboardKey.meta,
+    LogicalKeyboardKey.metaLeft,
+    LogicalKeyboardKey.metaRight,
+    LogicalKeyboardKey.capsLock,
+    LogicalKeyboardKey.numLock,
+    LogicalKeyboardKey.scrollLock,
+    LogicalKeyboardKey.fn,
+    LogicalKeyboardKey.fnLock,
+  };
+
+  @override
+  void initState() {
+    super.initState();
+    WidgetsBinding.instance.addPostFrameCallback((_) {
+      _focusNode.requestFocus();
+    });
+  }
+
+  @override
+  void dispose() {
+    _focusNode.dispose();
+    super.dispose();
+  }
+
+  bool get _isMac =>
+      defaultTargetPlatform == TargetPlatform.macOS ||
+      defaultTargetPlatform == TargetPlatform.iOS;
+
+  /// True when the captured combo includes at least one modifier. Lower bound
+  /// for any sensible binding — pure single-key bindings would swallow normal
+  /// typing the moment shortcuts are enabled. Beyond one mod the user is on
+  /// their own; the in-session pass-through toggle is the escape hatch when
+  /// a chosen combo collides with something needed on the remote.
+  bool get _hasRequiredPrefix => _mods.isNotEmpty;
+
+  /// Return the actionId that this combo currently conflicts with, or null.
+  /// The action being edited is not a conflict with itself.
+  String? get _conflictActionId {
+    if (_key == null || !_hasRequiredPrefix) return null;
+    for (final b in widget.existingBindings) {
+      final otherAction = b['action'] as String?;
+      if (otherAction == null || otherAction == widget.actionId) continue;
+      final otherKey = b['key'] as String?;
+      final otherMods = shortcutModSetFrom(b['mods']);
+      if (otherKey == _key &&
+          otherMods.length == _mods.length &&
+          otherMods.containsAll(_mods)) {
+        return otherAction;
+      }
+    }
+    return null;
+  }
+
+  KeyEventResult _onKeyEvent(FocusNode node, KeyEvent event) {
+    if (event is KeyDownEvent &&
+        event.logicalKey == LogicalKeyboardKey.escape) {
+      Navigator.of(context).pop();
+      return KeyEventResult.handled;
+    }
+    if (event is! KeyDownEvent) return KeyEventResult.handled;
+
+    // Ignore modifier-only KeyDowns: don't lock in a partial combo.
+    final logical = event.logicalKey;
+    final keyName = logicalKeyName(logical);
+
+    // Mirror of `normalize_modifiers` in src/keyboard/shortcuts.rs:
+    //   * macOS: Cmd → primary, Ctrl → ctrl (distinct).
+    //   * Win/Linux: Ctrl → primary, no separate Ctrl modifier.
+    // The two halves must agree on labels, otherwise saved bindings will not
+    // match the events the matcher sees at runtime.
+    final mods = <String>{};
+    if (HardwareKeyboard.instance.isAltPressed) mods.add('alt');
+    if (HardwareKeyboard.instance.isShiftPressed) mods.add('shift');
+    if (_isMac) {
+      if (HardwareKeyboard.instance.isMetaPressed) mods.add('primary');
+      if (HardwareKeyboard.instance.isControlPressed) mods.add('ctrl');
+    } else {
+      if (HardwareKeyboard.instance.isControlPressed) mods.add('primary');
+    }
+
+    setState(() {
+      _mods = mods;
+      // Only lock in the key when it's a non-modifier we recognize.
+      // Modifier-only KeyDowns (Shift, Ctrl, etc.) leave the captured key
+      // untouched, so the user can adjust modifiers after the fact.
+      if (keyName != null) {
+        _key = keyName;
+        _unsupportedKey = null;
+      } else if (!_modifierKeys.contains(logical)) {
+        // Non-modifier key we don't recognize (e.g. F13, media keys, IME
+        // compose keys). Surface a warning instead of silently dropping the
+        // press — the dialog otherwise looks unresponsive.
+        final label = logical.keyLabel.isNotEmpty
+            ? logical.keyLabel
+            : (logical.debugName ?? 'this key');
+        _unsupportedKey = label;
+      }
+    });
+    return KeyEventResult.handled;
+  }
+
+  void _onSave() {
+    if (_key == null || !_hasRequiredPrefix) return;
+    final ordered = canonicalShortcutModsForSave(_mods);
+    final binding = <String, dynamic>{
+      'action': widget.actionId,
+      'mods': ordered,
+      'key': _key!,
+    };
+    Navigator.of(context).pop(RecordingResult(binding, _conflictActionId));
+  }
+
+  String _formatPrefix() {
+    // Used in the "must include..." validation row; lists the modifier set
+    // a binding can pick from. Localised modifier glyphs aren't used here so
+    // the names stay greppable for users searching for "Option" / "Cmd".
+    if (_isMac) return 'Cmd / Control / Option / Shift';
+    return 'Ctrl / Alt / Shift';
+  }
+
+  String _formatCombo() {
+    // Plain-text labels (see same rationale in display.dart::_keyDisplay).
+    final parts = <String>[];
+    for (final m in ['primary', 'ctrl', 'alt', 'shift']) {
+      if (!_mods.contains(m)) continue;
+      switch (m) {
+        case 'primary':
+          parts.add(_isMac ? 'Cmd' : 'Ctrl');
+          break;
+        case 'ctrl':
+          parts.add(_isMac ? 'Control' : 'Ctrl');
+          break;
+        case 'alt':
+          parts.add(_isMac ? 'Option' : 'Alt');
+          break;
+        case 'shift':
+          parts.add('Shift');
+          break;
+      }
+    }
+    if (_key != null) {
+      parts.add(_keyDisplay(_key!));
+    }
+    if (parts.isEmpty) return translate('shortcut-recording-press-keys-tip');
+    return parts.join('+');
+  }
+
+  String _keyDisplay(String key) {
+    switch (key) {
+      case 'delete':     return 'Del';
+      case 'backspace':  return 'Backspace';
+      case 'enter':      return 'Enter';
+      case 'tab':        return 'Tab';
+      case 'space':      return 'Space';
+      case 'arrow_left': return 'Left';
+      case 'arrow_right':return 'Right';
+      case 'arrow_up':   return 'Up';
+      case 'arrow_down': return 'Down';
+      case 'home':       return 'Home';
+      case 'end':        return 'End';
+      case 'page_up':    return 'PgUp';
+      case 'page_down':  return 'PgDn';
+      case 'insert':     return 'Ins';
+    }
+    if (key.startsWith('digit')) return key.substring(5);
+    return key.toUpperCase();
+  }
+
+  @override
+  Widget build(BuildContext context) {
+    final hasKey = _key != null;
+    final conflictId = _conflictActionId;
+    final hasConflict = conflictId != null;
+    // The Save button still fires for the previously-captured combo even if
+    // the user just hit an unsupported key — the captured state is what gets
+    // saved, the warning is just feedback that the latest press was rejected.
+    final canSave = hasKey && _hasRequiredPrefix;
+
+    Widget statusLine;
+    if (_unsupportedKey != null) {
+      // Most recent press was unsupported. Take precedence over the
+      // captured-combo states so the user gets explicit feedback that their
+      // last keystroke was ignored, regardless of whether a previous combo
+      // is still captured.
+      statusLine = Row(
+        children: [
+          const Icon(Icons.close, size: 16, color: Colors.red),
+          const SizedBox(width: 6),
+          Flexible(
+            child: Text(
+              translate('shortcut-key-not-supported')
+                  .replaceAll('{}', _unsupportedKey!),
+              style: const TextStyle(color: Colors.red),
+            ),
+          ),
+        ],
+      );
+    } else if (!hasKey) {
+      statusLine = Text(
+        translate('shortcut-recording-press-keys-tip'),
+        style: TextStyle(color: Theme.of(context).hintColor),
+      );
+    } else if (!_hasRequiredPrefix) {
+      statusLine = Row(
+        children: [
+          Icon(Icons.close, size: 16, color: Colors.red),
+          const SizedBox(width: 6),
+          Flexible(
+            child: Text(
+              translate('shortcut-must-include-modifiers')
+                  .replaceAll('{}', _formatPrefix()),
+              style: const TextStyle(color: Colors.red),
+            ),
+          ),
+        ],
+      );
+    } else if (hasConflict) {
+      final otherLabel = widget.actionLabelLookup(conflictId);
+      statusLine = Row(
+        children: [
+          Icon(Icons.warning_amber_outlined,
+              size: 16, color: Colors.orange.shade700),
+          const SizedBox(width: 6),
+          Flexible(
+            child: Text(
+              '${translate('shortcut-already-bound-to')} "$otherLabel"',
+              style: TextStyle(color: Colors.orange.shade700),
+            ),
+          ),
+        ],
+      );
+    } else {
+      statusLine = Row(
+        children: [
+          const Icon(Icons.check, size: 16, color: Colors.green),
+          const SizedBox(width: 6),
+          Text(translate('Valid'), style: const TextStyle(color: Colors.green)),
+        ],
+      );
+    }
+
+    final saveLabel = hasConflict ? 'Replace' : 'Save';
+
+    return AlertDialog(
+      title: Text(
+        '${translate('Set Shortcut')}: ${widget.actionLabel}',
+      ),
+      content: Focus(
+        focusNode: _focusNode,
+        autofocus: true,
+        onKeyEvent: _onKeyEvent,
+        child: ConstrainedBox(
+          constraints: const BoxConstraints(minWidth: 380),
+          child: Column(
+            mainAxisSize: MainAxisSize.min,
+            crossAxisAlignment: CrossAxisAlignment.start,
+            children: [
+              Text(translate('shortcut-recording-instruction')),
+              const SizedBox(height: 12),
+              Container(
+                width: double.infinity,
+                padding:
+                    const EdgeInsets.symmetric(vertical: 18, horizontal: 12),
+                decoration: BoxDecoration(
+                  border: Border.all(color: Theme.of(context).dividerColor),
+                  borderRadius: BorderRadius.circular(4),
+                ),
+                child: Text(
+                  _formatCombo(),
+                  textAlign: TextAlign.center,
+                  style: TextStyle(
+                    fontSize: 18,
+                    fontWeight: FontWeight.w600,
+                    color: hasKey
+                        ? Theme.of(context).textTheme.titleLarge?.color
+                        : Theme.of(context).hintColor,
+                  ),
+                ),
+              ),
+              const SizedBox(height: 12),
+              statusLine,
+            ],
+          ),
+        ),
+      ),
+      actions: [
+        dialogButton('Cancel',
+            onPressed: () => Navigator.of(context).pop(), isOutline: true),
+        dialogButton(saveLabel, onPressed: canSave ? _onSave : null),
+      ],
+    );
+  }
+}

flutter/lib/common/widgets/keyboard_shortcuts/shortcut_actions.dart

@@ -0,0 +1,292 @@
+import 'shortcut_constants.dart';
+import 'shortcut_utils.dart';
+
+/// Marker for the union of [KeyboardShortcutActionEntry] /
+/// [KeyboardShortcutActionSubgroup] — anything a top-level
+/// [KeyboardShortcutActionGroup] can directly contain. Sealed so renderers
+/// and filters can `switch` on it without a default branch.
+sealed class KeyboardShortcutActionGroupChild {
+  const KeyboardShortcutActionGroupChild();
+}
+
+/// One configurable action — id + i18n key for its label.
+class KeyboardShortcutActionEntry extends KeyboardShortcutActionGroupChild {
+  final String id;
+  final String labelKey;
+  const KeyboardShortcutActionEntry(this.id, this.labelKey);
+}
+
+/// A nested subgroup (e.g. "View Mode" under "Display"). Renders with extra
+/// indent so its items are visually distinguished from the parent group's
+/// direct items.
+class KeyboardShortcutActionSubgroup extends KeyboardShortcutActionGroupChild {
+  final String titleKey;
+  final List<KeyboardShortcutActionEntry> entries;
+  const KeyboardShortcutActionSubgroup(this.titleKey, this.entries);
+}
+
+/// A top-level group ("Display", "Keyboard", "Chat", …). `children` is an
+/// *ordered* mix of direct entries and subgroups, so layouts like
+/// "subgroups first → direct items → trailing subgroup" — exactly the
+/// shape `_DisplayMenu` uses (Privacy mode lives after the cursor / display
+/// toggles direct items) — are first-class instead of needing a wrapper
+/// "Display Settings" subgroup just to insert the items.
+class KeyboardShortcutActionGroup {
+  final String titleKey;
+  final List<KeyboardShortcutActionGroupChild> children;
+  const KeyboardShortcutActionGroup(this.titleKey, this.children);
+}
+
+/// Canonical action group definitions used by both the desktop and mobile
+/// configuration pages. The order of groups, subgroups, and entries here
+/// is the order the user sees in the UI, and mirrors the corresponding
+/// toolbar submenu (`_DisplayMenu` / `_KeyboardMenu` in
+/// `desktop/widgets/remote_toolbar.dart`) child order — modulo entries
+/// without shortcut counterparts (e.g. `_screenAdjustor.adjustWindow`,
+/// `scrollStyle`, `_ResolutionsMenu`, `localKeyboardType`).
+final List<KeyboardShortcutActionGroup> kKeyboardShortcutActionGroups = [
+  KeyboardShortcutActionGroup('Monitor', [
+    KeyboardShortcutActionEntry(
+        kShortcutActionSwitchDisplayNext, 'Switch to next display'),
+    KeyboardShortcutActionEntry(
+        kShortcutActionSwitchDisplayPrev, 'Switch to previous display'),
+    KeyboardShortcutActionEntry(
+        kShortcutActionSwitchDisplayAll, 'All monitors'),
+  ]),
+  KeyboardShortcutActionGroup('Control Actions', [
+    KeyboardShortcutActionEntry(
+        kShortcutActionSendClipboardKeystrokes, 'Send clipboard keystrokes'),
+    KeyboardShortcutActionEntry(kShortcutActionResetCanvas, 'Reset canvas'),
+    KeyboardShortcutActionEntry(
+        kShortcutActionSendCtrlAltDel, 'Insert Ctrl + Alt + Del'),
+    KeyboardShortcutActionEntry(
+        kShortcutActionRestartRemote, 'Restart remote device'),
+    KeyboardShortcutActionEntry(kShortcutActionInsertLock, 'Insert Lock'),
+    KeyboardShortcutActionEntry(
+        kShortcutActionToggleBlockInput, 'Block user input'),
+    KeyboardShortcutActionEntry(kShortcutActionSwitchSides, 'Switch Sides'),
+    KeyboardShortcutActionEntry(kShortcutActionRefresh, 'Refresh'),
+    KeyboardShortcutActionEntry(
+        kShortcutActionToggleRecording, 'Toggle session recording'),
+    KeyboardShortcutActionEntry(kShortcutActionScreenshot, 'Take screenshot'),
+  ]),
+  // Display: subgroups (View Mode → Image Quality → Codec → Virtual display)
+  // first, then the direct items (cursor toggles + display toggles), then
+  // Privacy mode subgroup last — matching `_DisplayMenu.menuChildrenGetter`
+  // exactly. Rebalancing this order should also rebalance the toolbar.
+  KeyboardShortcutActionGroup('Display', [
+    KeyboardShortcutActionSubgroup('View Mode', [
+      KeyboardShortcutActionEntry(
+          kShortcutActionViewModeOriginal, 'Scale original'),
+      KeyboardShortcutActionEntry(
+          kShortcutActionViewModeAdaptive, 'Scale adaptive'),
+      KeyboardShortcutActionEntry(
+          kShortcutActionViewModeCustom, 'Scale custom'),
+    ]),
+    KeyboardShortcutActionSubgroup('Image Quality', [
+      KeyboardShortcutActionEntry(
+          kShortcutActionImageQualityBest, 'Good image quality'),
+      KeyboardShortcutActionEntry(
+          kShortcutActionImageQualityBalanced, 'Balanced'),
+      KeyboardShortcutActionEntry(
+          kShortcutActionImageQualityLow, 'Optimize reaction time'),
+    ]),
+    KeyboardShortcutActionSubgroup('Codec', [
+      KeyboardShortcutActionEntry(kShortcutActionCodecAuto, 'Auto'),
+      KeyboardShortcutActionEntry(kShortcutActionCodecVp8, 'VP8'),
+      KeyboardShortcutActionEntry(kShortcutActionCodecVp9, 'VP9'),
+      KeyboardShortcutActionEntry(kShortcutActionCodecAv1, 'AV1'),
+      KeyboardShortcutActionEntry(kShortcutActionCodecH264, 'H264'),
+      KeyboardShortcutActionEntry(kShortcutActionCodecH265, 'H265'),
+    ]),
+    KeyboardShortcutActionSubgroup('Virtual display', [
+      KeyboardShortcutActionEntry(
+          kShortcutActionPlugOutAllVirtualDisplays, 'Plug out all'),
+    ]),
+    // Direct items: cursorToggles + display toggles, in toolbar order.
+    KeyboardShortcutActionEntry(
+        kShortcutActionToggleShowRemoteCursor, 'Show remote cursor'),
+    KeyboardShortcutActionEntry(
+        kShortcutActionToggleFollowRemoteCursor, 'Follow remote cursor'),
+    KeyboardShortcutActionEntry(
+        kShortcutActionToggleFollowRemoteWindow, 'Follow remote window focus'),
+    KeyboardShortcutActionEntry(
+        kShortcutActionToggleZoomCursor, 'Zoom cursor'),
+    KeyboardShortcutActionEntry(
+        kShortcutActionToggleQualityMonitor, 'Show quality monitor'),
+    KeyboardShortcutActionEntry(kShortcutActionToggleMute, 'Mute'),
+    KeyboardShortcutActionEntry(
+        kShortcutActionToggleEnableFileCopyPaste, 'Enable file copy and paste'),
+    KeyboardShortcutActionEntry(
+        kShortcutActionToggleDisableClipboard, 'Disable clipboard'),
+    KeyboardShortcutActionEntry(
+        kShortcutActionToggleLockAfterSessionEnd, 'Lock after session end'),
+    KeyboardShortcutActionEntry(
+        kShortcutActionToggleTrueColor, 'True color (4:4:4)'),
+    // Privacy mode at the bottom — mirrors `_DisplayMenu` where it's the
+    // last submenu added (line ~1023 of remote_toolbar.dart, after toggles).
+    KeyboardShortcutActionSubgroup('Privacy mode', [
+      // Reuse toolbar's existing impl-name i18n keys. The handler at
+      // runtime matches `privacy_mode_impl_mag_tip` /
+      // `privacy_mode_impl_virtual_display_tip` against the peer's
+      // advertised impls — same logic the toolbar's `toolbarPrivacyMode`
+      // submenu uses.
+      KeyboardShortcutActionEntry(
+          kShortcutActionPrivacyMode1, 'privacy_mode_impl_mag_tip'),
+      KeyboardShortcutActionEntry(
+          kShortcutActionPrivacyMode2, 'privacy_mode_impl_virtual_display_tip'),
+    ]),
+  ]),
+  // Keyboard: Keyboard mode subgroup first, then direct items
+  // (inputSource → viewMode → showMyCursor → toolbarKeyboardToggles),
+  // matching `_KeyboardMenu.menuChildrenGetter`.
+  KeyboardShortcutActionGroup('Keyboard', [
+    KeyboardShortcutActionSubgroup('Keyboard mode', [
+      KeyboardShortcutActionEntry(
+          kShortcutActionKeyboardModeLegacy, 'Legacy mode'),
+      KeyboardShortcutActionEntry(kShortcutActionKeyboardModeMap, 'Map mode'),
+      KeyboardShortcutActionEntry(
+          kShortcutActionKeyboardModeTranslate, 'Translate mode'),
+    ]),
+    KeyboardShortcutActionEntry(
+        kShortcutActionToggleInputSource, 'Toggle input source'),
+    KeyboardShortcutActionEntry(kShortcutActionToggleViewOnly, 'View Mode'),
+    KeyboardShortcutActionEntry(
+        kShortcutActionToggleShowMyCursor, 'Show my cursor'),
+    KeyboardShortcutActionEntry(
+        kShortcutActionToggleSwapCtrlCmd, 'Swap control-command key'),
+    KeyboardShortcutActionEntry(
+        kShortcutActionToggleRelativeMouseMode, 'Relative mouse mode'),
+    KeyboardShortcutActionEntry(
+        kShortcutActionToggleReverseMouseWheel, 'Reverse mouse wheel'),
+    KeyboardShortcutActionEntry(
+        kShortcutActionToggleSwapLeftRightMouse, 'swap-left-right-mouse'),
+  ]),
+  KeyboardShortcutActionGroup('Chat', [
+    KeyboardShortcutActionEntry(kShortcutActionToggleChat, 'Text chat'),
+    KeyboardShortcutActionEntry(kShortcutActionToggleVoiceCall, 'Voice call'),
+  ]),
+  // "Other" collects single-icon toolbar buttons that have no dropdown
+  // (Pin, Close), plus actions with no toolbar entry at all (Fullscreen —
+  // driven by callback, not menu; Toggle Toolbar / tab navigation — tab
+  // right-click menu, not toolbar). Combined into one group rather than
+  // several 1-item groups for cleaner visual hierarchy.
+  KeyboardShortcutActionGroup('Other', [
+    KeyboardShortcutActionEntry(kShortcutActionPinToolbar, 'Pin Toolbar'),
+    KeyboardShortcutActionEntry(
+        kShortcutActionToggleFullscreen, 'Toggle fullscreen'),
+    KeyboardShortcutActionEntry(kShortcutActionToggleToolbar, 'Toggle toolbar'),
+    KeyboardShortcutActionEntry(kShortcutActionCloseTab, 'Close tab'),
+    KeyboardShortcutActionEntry(
+        kShortcutActionSwitchTabNext, 'Switch to next tab'),
+    KeyboardShortcutActionEntry(
+        kShortcutActionSwitchTabPrev, 'Switch to previous tab'),
+  ]),
+];
+
+/// Walk the (filtered or unfiltered) group tree and yield every
+/// [KeyboardShortcutActionEntry], regardless of whether it sits as a direct
+/// child of a top-level group or inside a subgroup. Useful for label
+/// lookups, ghost-action tests, and any consumer that just wants the flat
+/// list of action ids.
+Iterable<KeyboardShortcutActionEntry> allActionEntries(
+  Iterable<KeyboardShortcutActionGroup> groups,
+) sync* {
+  for (final group in groups) {
+    for (final child in group.children) {
+      switch (child) {
+        case KeyboardShortcutActionEntry():
+          yield child;
+        case KeyboardShortcutActionSubgroup():
+          yield* child.entries;
+      }
+    }
+  }
+}
+
+/// Return [kKeyboardShortcutActionGroups] with actions that aren't supported
+/// on the current platform stripped out. Subgroups whose every entry was
+/// filtered are dropped; top-level groups whose every child (direct entry
+/// or subgroup) was dropped are themselves dropped.
+///
+/// Mirrors the capability flags used by [filterDefaultBindingsForPlatform]
+/// so the configuration UI shows only what the matcher can actually
+/// dispatch on this platform.
+///
+/// Note: callers should still walk the unfiltered
+/// [kKeyboardShortcutActionGroups] for label lookups (e.g. conflict
+/// warnings about a stale cross-platform binding), so an action bound on
+/// desktop and carried over to mobile still has a human-readable name in
+/// dialogs.
+List<KeyboardShortcutActionGroup> filterKeyboardShortcutActionGroupsForPlatform(
+  ShortcutPlatformCapabilities cap,
+) {
+  bool allowed(String id) {
+    if (!cap.includeFullscreenShortcut &&
+        id == kShortcutActionToggleFullscreen) {
+      return false;
+    }
+    if (!cap.includeScreenshotShortcut && id == kShortcutActionScreenshot) {
+      return false;
+    }
+    if (!cap.includeScreenshotShortcut &&
+        id == kShortcutActionToggleRelativeMouseMode) {
+      return false;
+    }
+    if (!cap.includeTabShortcuts && isSwitchTabShortcutAction(id)) return false;
+    if (!cap.includeToolbarShortcut && id == kShortcutActionToggleToolbar) {
+      return false;
+    }
+    if (!cap.includeCloseTabShortcut && id == kShortcutActionCloseTab) {
+      return false;
+    }
+    if (!cap.includeSwitchSidesShortcut && id == kShortcutActionSwitchSides) {
+      return false;
+    }
+    if (!cap.includeRecordingShortcut && id == kShortcutActionToggleRecording) {
+      return false;
+    }
+    if (!cap.includeResetCanvasShortcut && id == kShortcutActionResetCanvas) {
+      return false;
+    }
+    if (!cap.includePinToolbarShortcut && id == kShortcutActionPinToolbar) {
+      return false;
+    }
+    if (!cap.includeViewModeShortcut &&
+        (id == kShortcutActionViewModeOriginal ||
+            id == kShortcutActionViewModeAdaptive ||
+            id == kShortcutActionViewModeCustom)) {
+      return false;
+    }
+    if (!cap.includeInputSourceShortcut &&
+        id == kShortcutActionToggleInputSource) {
+      return false;
+    }
+    if (!cap.includeVoiceCallShortcut && id == kShortcutActionToggleVoiceCall) {
+      return false;
+    }
+    return true;
+  }
+
+  final out = <KeyboardShortcutActionGroup>[];
+  for (final group in kKeyboardShortcutActionGroups) {
+    final filteredChildren = <KeyboardShortcutActionGroupChild>[];
+    for (final child in group.children) {
+      switch (child) {
+        case KeyboardShortcutActionEntry():
+          if (allowed(child.id)) filteredChildren.add(child);
+        case KeyboardShortcutActionSubgroup():
+          final entries =
+              child.entries.where((e) => allowed(e.id)).toList();
+          if (entries.isNotEmpty) {
+            filteredChildren.add(
+                KeyboardShortcutActionSubgroup(child.titleKey, entries));
+          }
+      }
+    }
+    if (filteredChildren.isNotEmpty) {
+      out.add(KeyboardShortcutActionGroup(group.titleKey, filteredChildren));
+    }
+  }
+  return out;
+}

flutter/lib/common/widgets/keyboard_shortcuts/shortcut_constants.dart

@@ -0,0 +1,104 @@
+/// Keyboard shortcut action IDs - must match
+/// src/keyboard/shortcuts.rs::action_id.
+const kShortcutActionSendCtrlAltDel = 'send_ctrl_alt_del';
+const kShortcutActionToggleFullscreen = 'toggle_fullscreen';
+const kShortcutActionSwitchDisplayNext = 'switch_display_next';
+const kShortcutActionSwitchDisplayPrev = 'switch_display_prev';
+const kShortcutActionSwitchDisplayAll = 'switch_display_all';
+const kShortcutActionScreenshot = 'screenshot';
+const kShortcutActionInsertLock = 'insert_lock';
+const kShortcutActionRefresh = 'refresh';
+const kShortcutActionToggleBlockInput = 'toggle_block_input';
+const kShortcutActionToggleRecording = 'toggle_recording';
+const kShortcutActionSwitchSides = 'switch_sides';
+const kShortcutActionCloseTab = 'close_tab';
+const kShortcutActionToggleToolbar = 'toggle_toolbar';
+const kShortcutActionRestartRemote = 'restart_remote';
+const kShortcutActionResetCanvas = 'reset_canvas';
+const kShortcutActionSwitchTabNext = 'switch_tab_next';
+const kShortcutActionSwitchTabPrev = 'switch_tab_prev';
+const kShortcutActionToggleMute = 'toggle_mute';
+const kShortcutActionPinToolbar = 'pin_toolbar';
+const kShortcutActionViewModeOriginal = 'view_mode_original';
+const kShortcutActionViewModeAdaptive = 'view_mode_adaptive';
+const kShortcutActionToggleChat = 'toggle_chat';
+const kShortcutActionToggleQualityMonitor = 'toggle_quality_monitor';
+const kShortcutActionToggleShowRemoteCursor = 'toggle_show_remote_cursor';
+const kShortcutActionToggleShowMyCursor = 'toggle_show_my_cursor';
+const kShortcutActionToggleDisableClipboard = 'toggle_disable_clipboard';
+const kShortcutActionPrivacyMode1 = 'privacy_mode_1';
+const kShortcutActionPrivacyMode2 = 'privacy_mode_2';
+// Keyboard mode (Map / Translate / Legacy).
+const kShortcutActionKeyboardModeMap = 'keyboard_mode_map';
+const kShortcutActionKeyboardModeTranslate = 'keyboard_mode_translate';
+const kShortcutActionKeyboardModeLegacy = 'keyboard_mode_legacy';
+// Codec preference (Auto + the four optional codecs the toolbar surfaces).
+const kShortcutActionCodecAuto = 'codec_auto';
+const kShortcutActionCodecVp8 = 'codec_vp8';
+const kShortcutActionCodecVp9 = 'codec_vp9';
+const kShortcutActionCodecAv1 = 'codec_av1';
+const kShortcutActionCodecH264 = 'codec_h264';
+const kShortcutActionCodecH265 = 'codec_h265';
+// Plug out every virtual display in one shot — toolbar exposes this in
+// both IDD modes (RustDesk and Amyuni). Per-index virtual-display toggles
+// (RustDesk IDD's 4 checkboxes) and the +/- count buttons (Amyuni-only)
+// are NOT exposed as shortcuts: per-index is too granular, and +/- has
+// no toolbar counterpart on RustDesk IDD peers.
+const kShortcutActionPlugOutAllVirtualDisplays =
+    'plug_out_all_virtual_displays';
+const kShortcutActionToggleRelativeMouseMode = 'toggle_relative_mouse_mode';
+const kShortcutActionToggleFollowRemoteCursor = 'toggle_follow_remote_cursor';
+const kShortcutActionToggleFollowRemoteWindow = 'toggle_follow_remote_window';
+const kShortcutActionToggleZoomCursor = 'toggle_zoom_cursor';
+const kShortcutActionToggleReverseMouseWheel = 'toggle_reverse_mouse_wheel';
+const kShortcutActionToggleSwapLeftRightMouse = 'toggle_swap_left_right_mouse';
+const kShortcutActionToggleLockAfterSessionEnd = 'toggle_lock_after_session_end';
+const kShortcutActionToggleTrueColor = 'toggle_true_color';
+const kShortcutActionToggleSwapCtrlCmd = 'toggle_swap_ctrl_cmd';
+const kShortcutActionToggleEnableFileCopyPaste = 'toggle_enable_file_copy_paste';
+const kShortcutActionViewModeCustom = 'view_mode_custom';
+const kShortcutActionImageQualityBest = 'image_quality_best';
+const kShortcutActionImageQualityBalanced = 'image_quality_balanced';
+const kShortcutActionImageQualityLow = 'image_quality_low';
+const kShortcutActionSendClipboardKeystrokes = 'send_clipboard_keystrokes';
+const kShortcutActionToggleInputSource = 'toggle_input_source';
+const kShortcutActionToggleVoiceCall = 'toggle_voice_call';
+const kShortcutActionToggleViewOnly = 'toggle_view_only';
+
+const kShortcutLocalConfigKey = 'keyboard-shortcuts';
+const kShortcutEventName = 'shortcut_triggered';
+
+/// Canonical default keyboard-shortcut bindings, mirroring Rust's
+/// `default_bindings()` in `src/keyboard/shortcuts.rs`. Used by:
+///   * the Web bridge (`flutter/lib/web/bridge.dart::mainGetDefaultKeyboardShortcuts`)
+///     — Web has no Rust at runtime, so the seed list is read from this Dart
+///     constant instead of going through FFI.
+///   * the configuration page when seeding defaults on first enable, after
+///     [filterDefaultBindingsForPlatform] has trimmed platform-specific
+///     entries.
+///
+/// Parity with Rust is unit-tested on both sides against
+/// `flutter/test/fixtures/default_keyboard_shortcuts.json` — see the
+/// `kDefaultShortcutBindings matches fixture` test in
+/// `flutter/test/keyboard_shortcuts_test.dart` and
+/// `default_bindings_match_fixture_json` in `src/keyboard/shortcuts.rs`.
+/// Any change here MUST also update the fixture and the Rust source, or CI
+/// will fail in the side that drifted.
+final List<Map<String, Object>> kDefaultShortcutBindings = [
+  for (final entry in <List<Object>>[
+    [kShortcutActionSendCtrlAltDel,         'delete'],
+    [kShortcutActionToggleFullscreen,       'enter'],
+    [kShortcutActionSwitchDisplayNext,      'arrow_right'],
+    [kShortcutActionSwitchDisplayPrev,      'arrow_left'],
+    [kShortcutActionScreenshot,             'p'],
+    [kShortcutActionToggleShowRemoteCursor, 'm'],
+    [kShortcutActionToggleMute,             's'],
+    [kShortcutActionToggleBlockInput,       'i'],
+    [kShortcutActionToggleChat,             'c'],
+  ])
+    {
+      'action': entry[0],
+      'mods': const ['primary', 'alt', 'shift'],
+      'key': entry[1],
+    },
+];

flutter/lib/common/widgets/keyboard_shortcuts/shortcut_utils.dart

@@ -0,0 +1,226 @@
+import 'package:flutter/services.dart';
+
+import 'shortcut_constants.dart';
+
+List<String> canonicalShortcutModsForSave(Set<String> mods) {
+  return <String>[
+    if (mods.contains('primary')) 'primary',
+    if (mods.contains('ctrl')) 'ctrl',
+    if (mods.contains('alt')) 'alt',
+    if (mods.contains('shift')) 'shift',
+  ];
+}
+
+List<Map<String, dynamic>> shortcutBindingMapsFrom(dynamic rawBindings) {
+  if (rawBindings is! Iterable) return <Map<String, dynamic>>[];
+  final bindings = <Map<String, dynamic>>[];
+  for (final raw in rawBindings) {
+    if (raw is! Map) continue;
+    final binding = <String, dynamic>{};
+    for (final entry in raw.entries) {
+      final key = entry.key;
+      if (key is String) {
+        binding[key] = entry.value;
+      }
+    }
+    if (binding.isNotEmpty) {
+      bindings.add(binding);
+    }
+  }
+  return bindings;
+}
+
+Set<String> shortcutModSetFrom(dynamic rawMods) {
+  if (rawMods is! Iterable) return <String>{};
+  return rawMods.whereType<String>().toSet();
+}
+
+bool isSwitchTabShortcutAction(String? actionId) {
+  return actionId == kShortcutActionSwitchTabNext ||
+      actionId == kShortcutActionSwitchTabPrev;
+}
+
+/// Map a [LogicalKeyboardKey] to the canonical key name used in saved
+/// bindings, or `null` for keys we don't accept as shortcuts.
+///
+/// Mirror of `event_to_key_name` in `src/keyboard/shortcuts.rs` and
+/// `logicalToKeyName` in `flutter/web/js/src/shortcut_matcher.ts` — keep
+/// the three in lockstep. Cross-language parity is enforced by:
+///   * `flutter/test/fixtures/supported_shortcut_keys.json` — the
+///     authoritative list of names this function must produce.
+///   * Dart `supported keys` test in `keyboard_shortcuts_test.dart` —
+///     asserts the (LogicalKeyboardKey → name) mapping covers the fixture.
+///   * Rust `supported_keys_match_fixture` test in `shortcuts.rs` — the
+///     Rust-side mirror against the same fixture.
+/// A drift in any of the three breaks one of the two tests.
+String? logicalKeyName(LogicalKeyboardKey k) {
+  // Singletons that map 1:1.
+  if (k == LogicalKeyboardKey.delete) return 'delete';
+  if (k == LogicalKeyboardKey.backspace) return 'backspace';
+  // Numpad Enter shares the "enter" name with the main Return key — matches
+  // the Rust matcher (`Return | KpReturn` → "enter") and matches user
+  // expectation that the two physical Enters are interchangeable.
+  if (k == LogicalKeyboardKey.enter || k == LogicalKeyboardKey.numpadEnter) {
+    return 'enter';
+  }
+  if (k == LogicalKeyboardKey.tab) return 'tab';
+  if (k == LogicalKeyboardKey.space) return 'space';
+  if (k == LogicalKeyboardKey.arrowLeft) return 'arrow_left';
+  if (k == LogicalKeyboardKey.arrowRight) return 'arrow_right';
+  if (k == LogicalKeyboardKey.arrowUp) return 'arrow_up';
+  if (k == LogicalKeyboardKey.arrowDown) return 'arrow_down';
+  if (k == LogicalKeyboardKey.home) return 'home';
+  if (k == LogicalKeyboardKey.end) return 'end';
+  if (k == LogicalKeyboardKey.pageUp) return 'page_up';
+  if (k == LogicalKeyboardKey.pageDown) return 'page_down';
+  if (k == LogicalKeyboardKey.insert) return 'insert';
+
+  // Letter / digit / F-key tables. `LogicalKeyboardKey` constants are
+  // `static final` (not `const`), so the maps can't be `const` — but they
+  // initialize once per process and the lookup is O(1).
+  final letters = <LogicalKeyboardKey, String>{
+    LogicalKeyboardKey.keyA: 'a', LogicalKeyboardKey.keyB: 'b',
+    LogicalKeyboardKey.keyC: 'c', LogicalKeyboardKey.keyD: 'd',
+    LogicalKeyboardKey.keyE: 'e', LogicalKeyboardKey.keyF: 'f',
+    LogicalKeyboardKey.keyG: 'g', LogicalKeyboardKey.keyH: 'h',
+    LogicalKeyboardKey.keyI: 'i', LogicalKeyboardKey.keyJ: 'j',
+    LogicalKeyboardKey.keyK: 'k', LogicalKeyboardKey.keyL: 'l',
+    LogicalKeyboardKey.keyM: 'm', LogicalKeyboardKey.keyN: 'n',
+    LogicalKeyboardKey.keyO: 'o', LogicalKeyboardKey.keyP: 'p',
+    LogicalKeyboardKey.keyQ: 'q', LogicalKeyboardKey.keyR: 'r',
+    LogicalKeyboardKey.keyS: 's', LogicalKeyboardKey.keyT: 't',
+    LogicalKeyboardKey.keyU: 'u', LogicalKeyboardKey.keyV: 'v',
+    LogicalKeyboardKey.keyW: 'w', LogicalKeyboardKey.keyX: 'x',
+    LogicalKeyboardKey.keyY: 'y', LogicalKeyboardKey.keyZ: 'z',
+  };
+  final letter = letters[k];
+  if (letter != null) return letter;
+
+  final digits = <LogicalKeyboardKey, String>{
+    LogicalKeyboardKey.digit0: 'digit0',
+    LogicalKeyboardKey.digit1: 'digit1',
+    LogicalKeyboardKey.digit2: 'digit2',
+    LogicalKeyboardKey.digit3: 'digit3',
+    LogicalKeyboardKey.digit4: 'digit4',
+    LogicalKeyboardKey.digit5: 'digit5',
+    LogicalKeyboardKey.digit6: 'digit6',
+    LogicalKeyboardKey.digit7: 'digit7',
+    LogicalKeyboardKey.digit8: 'digit8',
+    LogicalKeyboardKey.digit9: 'digit9',
+  };
+  final digit = digits[k];
+  if (digit != null) return digit;
+
+  final fkeys = <LogicalKeyboardKey, String>{
+    LogicalKeyboardKey.f1: 'f1', LogicalKeyboardKey.f2: 'f2',
+    LogicalKeyboardKey.f3: 'f3', LogicalKeyboardKey.f4: 'f4',
+    LogicalKeyboardKey.f5: 'f5', LogicalKeyboardKey.f6: 'f6',
+    LogicalKeyboardKey.f7: 'f7', LogicalKeyboardKey.f8: 'f8',
+    LogicalKeyboardKey.f9: 'f9', LogicalKeyboardKey.f10: 'f10',
+    LogicalKeyboardKey.f11: 'f11', LogicalKeyboardKey.f12: 'f12',
+  };
+  return fkeys[k];
+}
+
+/// Bundle of "is this shortcut available on the current platform" flags.
+///
+/// Production code reaches a single source of truth via
+/// [ShortcutModel.currentPlatformCapabilities] (which encodes the per-runtime
+/// rules in one place); tests construct one directly with whichever flags
+/// they want to exercise. Two filter functions consume this:
+/// [filterDefaultBindingsForPlatform] (for trimming default-binding JSON
+/// before it hits LocalConfig) and [filterKeyboardShortcutActionGroupsForPlatform]
+/// (for trimming the configuration UI's action list). Both must agree on the
+/// same capability set, otherwise a default binding could be seeded for an
+/// action the user has no UI to manage.
+class ShortcutPlatformCapabilities {
+  final bool includeFullscreenShortcut;
+  final bool includeScreenshotShortcut;
+  final bool includeTabShortcuts;
+  final bool includeToolbarShortcut;
+  final bool includeCloseTabShortcut;
+  final bool includeSwitchSidesShortcut;
+  final bool includeRecordingShortcut;
+  final bool includeResetCanvasShortcut;
+  final bool includePinToolbarShortcut;
+  final bool includeViewModeShortcut;
+  final bool includeInputSourceShortcut;
+  final bool includeVoiceCallShortcut;
+
+  const ShortcutPlatformCapabilities({
+    required this.includeFullscreenShortcut,
+    required this.includeScreenshotShortcut,
+    required this.includeTabShortcuts,
+    required this.includeToolbarShortcut,
+    required this.includeCloseTabShortcut,
+    required this.includeSwitchSidesShortcut,
+    required this.includeRecordingShortcut,
+    required this.includeResetCanvasShortcut,
+    required this.includePinToolbarShortcut,
+    required this.includeViewModeShortcut,
+    required this.includeInputSourceShortcut,
+    required this.includeVoiceCallShortcut,
+  });
+}
+
+List<Map<String, dynamic>> filterDefaultBindingsForPlatform(
+  Iterable<dynamic> bindings,
+  ShortcutPlatformCapabilities cap,
+) {
+  final filtered = <Map<String, dynamic>>[];
+  for (final binding in shortcutBindingMapsFrom(bindings)) {
+    final action = binding['action'] as String?;
+    if (!cap.includeFullscreenShortcut &&
+        action == kShortcutActionToggleFullscreen) {
+      continue;
+    }
+    if (!cap.includeScreenshotShortcut && action == kShortcutActionScreenshot) {
+      continue;
+    }
+    if (!cap.includeScreenshotShortcut &&
+        action == kShortcutActionToggleRelativeMouseMode) {
+      continue;
+    }
+    if (!cap.includeTabShortcuts && isSwitchTabShortcutAction(action)) {
+      continue;
+    }
+    if (!cap.includeToolbarShortcut &&
+        action == kShortcutActionToggleToolbar) {
+      continue;
+    }
+    if (!cap.includeCloseTabShortcut && action == kShortcutActionCloseTab) {
+      continue;
+    }
+    if (!cap.includeSwitchSidesShortcut &&
+        action == kShortcutActionSwitchSides) {
+      continue;
+    }
+    if (!cap.includeRecordingShortcut &&
+        action == kShortcutActionToggleRecording) {
+      continue;
+    }
+    if (!cap.includeResetCanvasShortcut &&
+        action == kShortcutActionResetCanvas) {
+      continue;
+    }
+    if (!cap.includePinToolbarShortcut && action == kShortcutActionPinToolbar) {
+      continue;
+    }
+    if (!cap.includeViewModeShortcut &&
+        (action == kShortcutActionViewModeOriginal ||
+            action == kShortcutActionViewModeAdaptive ||
+            action == kShortcutActionViewModeCustom)) {
+      continue;
+    }
+    if (!cap.includeInputSourceShortcut &&
+        action == kShortcutActionToggleInputSource) {
+      continue;
+    }
+    if (!cap.includeVoiceCallShortcut &&
+        action == kShortcutActionToggleVoiceCall) {
+      continue;
+    }
+    filtered.add(binding);
+  }
+  return filtered;
+}

flutter/lib/common/widgets/login.dart

@@ -2,7 +2,6 @@ import 'dart:async';
 import 'dart:convert';
 
 import 'package:flutter/material.dart';
-import 'package:flutter/services.dart';
 import 'package:flutter_hbb/common/hbbs/hbbs.dart';
 import 'package:flutter_hbb/models/platform_model.dart';
 import 'package:flutter_hbb/models/user_model.dart';
@@ -12,7 +11,6 @@ import 'package:url_launcher/url_launcher.dart';
 
 import '../../common.dart';
 import './dialog.dart';
-import './oidc_auth_status.dart';
 
 const kOpSvgList = [
   'github',
@@ -25,37 +23,6 @@ const kOpSvgList = [
   'auth0',
   'microsoft'
 ];
-const _requestingAccountAuth = 'Requesting account auth';
-const _waitingAccountAuth = 'Waiting account auth';
-
-class _OidcProviderBranding {
-  final String label;
-  final String iconKey;
-
-  const _OidcProviderBranding({
-    required this.label,
-    required this.iconKey,
-  });
-}
-
-_OidcProviderBranding _oidcProviderBranding(String op) {
-  switch (op.toLowerCase()) {
-    case 'azure':
-      return _OidcProviderBranding(
-        label: 'Microsoft',
-        iconKey: 'microsoft',
-      );
-    default:
-      return _OidcProviderBranding(
-        label: {
-              'github': 'GitHub',
-              'gitlab': 'GitLab',
-            }[op.toLowerCase()] ??
-            toCapitalized(op),
-        iconKey: op.toLowerCase(),
-      );
-  }
-}
 
 class _IconOP extends StatelessWidget {
   final String op;
@@ -94,7 +61,6 @@ class ButtonOP extends StatelessWidget {
   final Color primaryColor;
   final double height;
   final Function() onTap;
-  final bool Function() canStartAuth;
 
   const ButtonOP({
     Key? key,
@@ -104,29 +70,32 @@ class ButtonOP extends StatelessWidget {
     required this.primaryColor,
     required this.height,
     required this.onTap,
-    required this.canStartAuth,
   }) : super(key: key);
 
   @override
   Widget build(BuildContext context) {
-    final branding = _oidcProviderBranding(op);
-    final buttonLabel = translate("Continue with {${branding.label}}");
+    final opLabel = {
+          'github': 'GitHub',
+          'gitlab': 'GitLab'
+        }[op.toLowerCase()] ??
+        toCapitalized(op);
     return Row(children: [
       Container(
         height: height,
         width: 200,
         child: Obx(() => ElevatedButton(
             style: ElevatedButton.styleFrom(
-              backgroundColor: primaryColor,
+              backgroundColor: curOP.value.isEmpty || curOP.value == op
+                  ? primaryColor
+                  : Colors.grey,
             ).copyWith(elevation: ButtonStyleButton.allOrNull(0.0)),
-            onPressed:
-                curOP.value == 'rustdesk' || !canStartAuth() ? null : onTap,
+            onPressed: curOP.value.isEmpty || curOP.value == op ? onTap : null,
             child: Row(
               children: [
                 SizedBox(
                   width: 30,
                   child: _IconOP(
-                    op: branding.iconKey,
+                    op: op,
                     icon: icon,
                     margin: EdgeInsets.only(right: 5),
                   ),
@@ -134,7 +103,8 @@ class ButtonOP extends StatelessWidget {
                 Expanded(
                   child: FittedBox(
                     fit: BoxFit.scaleDown,
-                    child: Center(child: Text(buttonLabel)),
+                    child: Center(
+                        child: Text(translate("Continue with {$opLabel}"))),
                   ),
                 ),
               ],
@@ -150,120 +120,15 @@ class ConfigOP {
   ConfigOP({required this.op, required this.icon});
 }
 
-class _OidcAuthController {
-  final RxString curOP = ''.obs;
-  Future<void> _pendingOperation = Future<void>.value();
-  int _authAttempt = 0;
-  bool _closed = false;
-  final _cancelInProgress = false.obs;
-
-  bool _isCurrent(int authAttempt, String op) {
-    return !_closed && authAttempt == _authAttempt && curOP.value == op;
-  }
-
-  Future<bool> start(String op) {
-    if (!canStart()) {
-      return Future<bool>.value(false);
-    }
-    final authAttempt = ++_authAttempt;
-    curOP.value = op;
-    // Web auth must start during the original user gesture so popups are allowed.
-    if (isWeb) {
-      return _startWeb(authAttempt, op);
-    }
-    final completer = Completer<bool>();
-    _pendingOperation = _pendingOperation.then((_) async {
-      if (!_isCurrent(authAttempt, op)) {
-        completer.complete(false);
-        return;
-      }
-      try {
-        await bind.mainAccountAuthCancel();
-        if (!_isCurrent(authAttempt, op)) {
-          completer.complete(false);
-          return;
-        }
-        await bind.mainAccountAuth(op: op, rememberMe: true);
-        completer.complete(_isCurrent(authAttempt, op));
-      } catch (error, stackTrace) {
-        completer.completeError(error, stackTrace);
-      }
-    });
-    return completer.future;
-  }
-
-  Future<bool> _startWeb(int authAttempt, String op) async {
-    await bind.mainAccountAuth(op: op, rememberMe: true);
-    return _isCurrent(authAttempt, op);
-  }
-
-  bool canStart() {
-    return !_closed && !_cancelInProgress.value;
-  }
-
-  Future<bool> cancelCurrent(String op) {
-    if (!canStart() || curOP.value != op) {
-      return Future<bool>.value(false);
-    }
-    final authAttempt = ++_authAttempt;
-    final completer = Completer<bool>();
-    _cancelInProgress.value = true;
-    _pendingOperation = _pendingOperation.then((_) async {
-      try {
-        await bind.mainAccountAuthCancel();
-        completer.complete(_isCurrent(authAttempt, op));
-      } catch (error, stackTrace) {
-        completer.completeError(error, stackTrace);
-      } finally {
-        _cancelInProgress.value = false;
-      }
-    });
-    return completer.future;
-  }
-
-  Future<void> _cancelBackend() async {
-    try {
-      await bind.mainAccountAuthCancel();
-    } catch (error, stackTrace) {
-      debugPrint('Failed to cancel account authentication $error');
-      debugPrintStack(stackTrace: stackTrace);
-    }
-  }
-
-  Future<void> close() async {
-    if (_closed) {
-      return;
-    }
-    final hasActiveOidcAuth =
-        curOP.value.isNotEmpty && curOP.value != 'rustdesk';
-    _closed = true;
-    _authAttempt++;
-    curOP.value = '';
-    if (hasActiveOidcAuth) {
-      await _cancelBackend();
-    }
-    await _pendingOperation;
-    if (hasActiveOidcAuth) {
-      await _cancelBackend();
-    }
-  }
-}
-
 class WidgetOP extends StatefulWidget {
   final ConfigOP config;
   final RxString curOP;
   final Function(Map<String, dynamic>) cbLogin;
-  final Future<bool> Function(String) startAuth;
-  final Future<bool> Function(String) cancelAuth;
-  final bool Function() canStartAuth;
   const WidgetOP({
     Key? key,
     required this.config,
     required this.curOP,
     required this.cbLogin,
-    required this.startAuth,
-    required this.cancelAuth,
-    required this.canStartAuth,
   }) : super(key: key);
 
   @override
@@ -274,8 +139,6 @@ class WidgetOP extends StatefulWidget {
 
 class _WidgetOPState extends State<WidgetOP> {
   Timer? _updateTimer;
-  bool _isAuthStatusQueryInFlight = false;
-  int _authAttempt = 0;
   String _stateMsg = '';
   String _failedMsg = '';
   String _url = '';
@@ -286,180 +149,55 @@ class _WidgetOPState extends State<WidgetOP> {
     _updateTimer?.cancel();
   }
 
-  _beginQueryState(int authAttempt) {
-    _updateTimer?.cancel();
-    unawaited(_runAuthStatusQuery(() => _updateState(authAttempt)));
+  _beginQueryState() {
     _updateTimer = Timer.periodic(Duration(seconds: 1), (timer) {
-      unawaited(_runAuthStatusQuery(() => _updateState(authAttempt)));
+      _updateState();
     });
   }
 
-  Future<void> _runAuthStatusQuery(Future<void> Function() query) async {
-    if (_isAuthStatusQueryInFlight) {
-      return;
-    }
-    _isAuthStatusQueryInFlight = true;
-    try {
-      await query();
-    } finally {
-      _isAuthStatusQueryInFlight = false;
-    }
-  }
-
-  Future<void> _launchAuthUrl(String url) async {
-    try {
-      final launched = await launchUrl(
-        Uri.parse(url),
-        mode: LaunchMode.externalApplication,
-      );
-      if (!launched) {
-        debugPrint('Failed to open OIDC authentication URL');
-      }
-    } catch (error, stackTrace) {
-      debugPrint(
-          'Failed to open OIDC authentication URL (${error.runtimeType})');
-      debugPrintStack(stackTrace: stackTrace);
-    }
-  }
-
-  Future<void> _copyAuthUrl(String url) async {
-    try {
-      await Clipboard.setData(ClipboardData(text: url));
-      showToast(
-        translate('Copied'),
-      );
-    } catch (error, stackTrace) {
-      debugPrint(
-          'Failed to copy OIDC authentication URL (${error.runtimeType})');
-      debugPrintStack(stackTrace: stackTrace);
-      showToast(translate('Failed'));
-    }
-  }
-
-  void _runCurrentAuthUrlAction(
-    int authAttempt,
-    String authUrl,
-    Future<void> Function(String) action,
-  ) {
-    if (!mounted ||
-        authAttempt != _authAttempt ||
-        widget.curOP.value != widget.config.op ||
-        authUrl.isEmpty ||
-        _url != authUrl) {
-      return;
-    }
-    unawaited(action(authUrl));
-  }
-
-  void _invalidateAuthAttempt() {
-    _authAttempt++;
-    _url = '';
-  }
-
-  bool _isCurrentAuthAttempt(int authAttempt) {
-    return mounted &&
-        authAttempt == _authAttempt &&
-        widget.curOP.value == widget.config.op;
-  }
-
-  Future<void> _handleAuthFailure(
-    int authAttempt,
-    Object error,
-    String operation,
-  ) async {
-    debugPrint('Failed to $operation $error');
-    if (!_isCurrentAuthAttempt(authAttempt)) {
-      return;
-    }
-    _updateTimer?.cancel();
-    setState(() => _failedMsg = 'Failed');
-    try {
-      final canceled = await widget.cancelAuth(widget.config.op);
-      if (!canceled || !_isCurrentAuthAttempt(authAttempt)) {
-        return;
-      }
-    } catch (cancelError, stackTrace) {
-      debugPrint('Failed to cancel account authentication $cancelError');
-      debugPrintStack(stackTrace: stackTrace);
-      return;
-    }
-    setState(() {
-      _invalidateAuthAttempt();
-      widget.curOP.value = '';
-    });
-  }
-
-  Future<void> _updateState(int authAttempt) {
-    if (!mounted ||
-        authAttempt != _authAttempt ||
-        widget.curOP.value != widget.config.op) {
-      _updateTimer?.cancel();
-      return Future<void>.value();
-    }
-    return bind.mainAccountAuthResult().then<void>((result) {
-      if (!mounted ||
-          authAttempt != _authAttempt ||
-          widget.curOP.value != widget.config.op ||
-          result.isEmpty) {
+  _updateState() {
+    bind.mainAccountAuthResult().then((result) {
+      if (result.isEmpty) {
         return;
       }
       final resultMap = jsonDecode(result);
       if (resultMap == null) {
         return;
       }
-      final String backendStateMsg = resultMap['state_msg'];
+      final String stateMsg = resultMap['state_msg'];
       String failedMsg = resultMap['failed_msg'];
       final String? url = resultMap['url'];
-      final stateMsg = backendStateMsg == _requestingAccountAuth &&
-              (url == null || url.isEmpty)
-          ? _waitingAccountAuth
-          : backendStateMsg;
       final bool urlLaunched = (resultMap['url_launched'] as bool?) ?? false;
       final authBody = resultMap['auth_body'];
-      if (authBody != null) {
-        _updateTimer?.cancel();
-        _invalidateAuthAttempt();
-        widget.curOP.value = '';
-        widget.cbLogin(authBody as Map<String, dynamic>);
-        return;
-      }
-      final stateChanged = _stateMsg != stateMsg || _failedMsg != failedMsg;
-      final newUrl = _url.isEmpty && url != null && url.isNotEmpty ? url : null;
-      if (!stateChanged && newUrl == null) {
-        return;
-      }
-      setState(() {
-        _stateMsg = stateMsg;
-        _failedMsg = failedMsg;
-        if (newUrl != null) {
-          _url = newUrl;
+      if (_stateMsg != stateMsg || _failedMsg != failedMsg) {
+        if (_url.isEmpty && url != null && url.isNotEmpty) {
+          if (!urlLaunched) {
+            launchUrl(Uri.parse(url), mode: LaunchMode.externalApplication);
+          }
+          _url = url;
         }
-        if (failedMsg.isNotEmpty) {
-          _invalidateAuthAttempt();
-          widget.curOP.value = '';
+        if (authBody != null) {
           _updateTimer?.cancel();
+          widget.curOP.value = '';
+          widget.cbLogin(authBody as Map<String, dynamic>);
         }
-      });
-      if (newUrl != null && failedMsg.isEmpty && !urlLaunched) {
-        unawaited(_launchAuthUrl(newUrl));
+
+        setState(() {
+          _stateMsg = stateMsg;
+          _failedMsg = failedMsg;
+          if (failedMsg.isNotEmpty) {
+            widget.curOP.value = '';
+            _updateTimer?.cancel();
+          }
+        });
       }
-    }).catchError(
-      (e) => _handleAuthFailure(
-        authAttempt,
-        e,
-        'query account authentication',
-      ),
-    );
+    });
   }
 
-  int _resetState() {
-    _updateTimer?.cancel();
-    setState(() {
-      _invalidateAuthAttempt();
-      _stateMsg = _waitingAccountAuth;
-      _failedMsg = '';
-    });
-    return _authAttempt;
+  _resetState() {
+    _stateMsg = '';
+    _failedMsg = '';
+    _url = '';
   }
 
   @override
@@ -472,31 +210,11 @@ class _WidgetOPState extends State<WidgetOP> {
           icon: widget.config.icon,
           primaryColor: str2color(widget.config.op, 0x7f),
           height: 36,
-          canStartAuth: widget.canStartAuth,
           onTap: () async {
-            if (!widget.canStartAuth()) {
-              return;
-            }
-            final authAttempt = _resetState();
-            try {
-              final started = await widget.startAuth(widget.config.op);
-              if (!started) {
-                return;
-              }
-            } catch (e) {
-              await _handleAuthFailure(
-                authAttempt,
-                e,
-                'start account authentication',
-              );
-              return;
-            }
-            if (!mounted ||
-                authAttempt != _authAttempt ||
-                widget.curOP.value != widget.config.op) {
-              return;
-            }
-            _beginQueryState(authAttempt);
+            _resetState();
+            widget.curOP.value = widget.config.op;
+            await bind.mainAccountAuth(op: widget.config.op, rememberMe: true);
+            _beginQueryState();
           },
         ),
         Obx(() {
@@ -504,8 +222,6 @@ class _WidgetOPState extends State<WidgetOP> {
               widget.curOP.value != widget.config.op) {
             _failedMsg = '';
           }
-          final authAttempt = _authAttempt;
-          final authUrl = _url;
           return Offstage(
             offstage:
                 _failedMsg.isEmpty && widget.curOP.value != widget.config.op,
@@ -515,27 +231,19 @@ class _WidgetOPState extends State<WidgetOP> {
                 if (_stateMsg.isNotEmpty && _failedMsg.isEmpty)
                   Padding(
                     padding: const EdgeInsets.only(top: 8.0),
-                    child: OidcAuthStatus(
-                      message: translate(_stateMsg),
-                      browserFallbackPrompt: translate(
-                        "Browser didn't open? Use the url below to sign in.",
-                      ),
-                      authUrl: authUrl,
-                      copyLabel: translate('Copy to clipboard'),
-                      onCopy: authUrl.isEmpty
-                          ? null
-                          : () => _runCurrentAuthUrlAction(
-                                authAttempt,
-                                authUrl,
-                                _copyAuthUrl,
-                              ),
+                    child: SelectableText(
+                      translate(_stateMsg),
+                      style: DefaultTextStyle.of(context)
+                          .style
+                          .copyWith(fontSize: 12),
                     ),
                   ),
                 if (_failedMsg.isNotEmpty)
                   Padding(
                     padding: const EdgeInsets.only(top: 8.0),
                     child: Builder(builder: (context) {
-                      final errorColor = Theme.of(context).colorScheme.error;
+                      final errorColor =
+                          Theme.of(context).colorScheme.error;
                       final bgColor = Theme.of(context)
                           .colorScheme
                           .errorContainer
@@ -556,11 +264,12 @@ class _WidgetOPState extends State<WidgetOP> {
                             Flexible(
                               child: SelectableText(
                                 translate(_failedMsg),
-                                style:
-                                    DefaultTextStyle.of(context).style.copyWith(
-                                          fontSize: 13,
-                                          color: errorColor,
-                                        ),
+                                style: DefaultTextStyle.of(context)
+                                    .style
+                                    .copyWith(
+                                      fontSize: 13,
+                                      color: errorColor,
+                                    ),
                               ),
                             ),
                           ],
@@ -572,6 +281,34 @@ class _WidgetOPState extends State<WidgetOP> {
             ),
           );
         }),
+        Obx(
+          () => Offstage(
+            offstage: widget.curOP.value != widget.config.op,
+            child: const SizedBox(
+              height: 5.0,
+            ),
+          ),
+        ),
+        Obx(
+          () => Offstage(
+            offstage: widget.curOP.value != widget.config.op,
+            child: ConstrainedBox(
+              constraints: BoxConstraints(maxHeight: 20),
+              child: ElevatedButton(
+                onPressed: () {
+                  widget.curOP.value = '';
+                  _updateTimer?.cancel();
+                  _resetState();
+                  bind.mainAccountAuthCancel();
+                },
+                child: Text(
+                  translate('Cancel'),
+                  style: TextStyle(fontSize: 15),
+                ),
+              ),
+            ),
+          ),
+        ),
       ],
     );
   }
@@ -581,18 +318,12 @@ class LoginWidgetOP extends StatelessWidget {
   final List<ConfigOP> ops;
   final RxString curOP;
   final Function(Map<String, dynamic>) cbLogin;
-  final Future<bool> Function(String) startAuth;
-  final Future<bool> Function(String) cancelAuth;
-  final bool Function() canStartAuth;
 
   LoginWidgetOP({
     Key? key,
     required this.ops,
     required this.curOP,
     required this.cbLogin,
-    required this.startAuth,
-    required this.cancelAuth,
-    required this.canStartAuth,
   }) : super(key: key);
 
   @override
@@ -603,9 +334,6 @@ class LoginWidgetOP extends StatelessWidget {
                 config: op,
                 curOP: curOP,
                 cbLogin: cbLogin,
-                startAuth: startAuth,
-                cancelAuth: cancelAuth,
-                canStartAuth: canStartAuth,
               ),
               const Divider(
                 indent: 5,
@@ -683,11 +411,12 @@ class LoginWidgetUserPass extends StatelessWidget {
                         translate('Login'),
                         style: TextStyle(fontSize: 16),
                       ),
-                      onPressed: curOP.value.isEmpty && !isInProgress
-                          ? () {
-                              onLogin();
-                            }
-                          : null,
+                      onPressed:
+                          curOP.value.isEmpty || curOP.value == 'rustdesk'
+                              ? () {
+                                  onLogin();
+                                }
+                              : null,
                     )),
               ),
             ])),
@@ -698,28 +427,8 @@ class LoginWidgetUserPass extends StatelessWidget {
 
 const kAuthReqTypeOidc = 'oidc/';
 
-Future<bool?>? _activeLoginDialog;
-
 // call this directly
-Future<bool?> loginDialog() {
-  final activeDialog = _activeLoginDialog;
-  if (activeDialog != null) {
-    return activeDialog;
-  }
-  final dialog = _openLoginDialogOnce();
-  _activeLoginDialog = dialog;
-  return dialog;
-}
-
-Future<bool?> _openLoginDialogOnce() async {
-  try {
-    return await _openLoginDialog();
-  } finally {
-    _activeLoginDialog = null;
-  }
-}
-
-Future<bool?> _openLoginDialog() async {
+Future<bool?> loginDialog() async {
   var username =
       TextEditingController(text: UserModel.getLocalUserInfo()?['name'] ?? '');
   var password = TextEditingController();
@@ -729,28 +438,14 @@ Future<bool?> _openLoginDialog() async {
   String? usernameMsg;
   String? passwordMsg;
   var isInProgress = false;
-  final oidcAuth = _OidcAuthController();
-  final curOP = oidcAuth.curOP;
+  final RxString curOP = ''.obs;
   // Track hover state for the close icon
   bool isCloseHovered = false;
 
   final loginOptions = [].obs;
-  final loginOptionsError = Rxn<Object>();
-  final loginOptionsInProgress = false.obs;
-  fetchLoginOptions() async {
-    loginOptionsInProgress.value = true;
-    try {
-      loginOptions.value = await UserModel.queryOidcLoginOptions();
-      loginOptionsError.value = null;
-    } catch (e) {
-      debugPrint("queryOidcLoginOptions failed: $e");
-      loginOptionsError.value = e;
-    } finally {
-      loginOptionsInProgress.value = false;
-    }
-  }
-
-  Future.delayed(Duration.zero, fetchLoginOptions);
+  Future.delayed(Duration.zero, () async {
+    loginOptions.value = await UserModel.queryOidcLoginOptions();
+  });
 
   final res = await gFFI.dialogManager.show<bool>((setState, close, context) {
     username.addListener(() {
@@ -824,9 +519,6 @@ Future<bool?> _openLoginDialog() async {
     }
 
     onLogin() async {
-      if (curOP.value.isNotEmpty || isInProgress) {
-        return;
-      }
       // validate
       if (username.text.isEmpty) {
         setState(() => usernameMsg = translate('Username missed'));
@@ -857,36 +549,6 @@ Future<bool?> _openLoginDialog() async {
     }
 
     thirdAuthWidget() => Obx(() {
-          final error = loginOptionsError.value;
-          final inProgress = loginOptionsInProgress.value;
-          if (error != null) {
-            return Column(
-              children: [
-                const SizedBox(height: 8.0),
-                // NOT use Offstage to wrap LinearProgressIndicator
-                if (inProgress) const LinearProgressIndicator(),
-                if (!inProgress && error is! RequestException)
-                  Text(
-                    translate('network_error_tip'),
-                    style: const TextStyle(fontSize: 12),
-                    textAlign: TextAlign.center,
-                  ),
-                TextButton(
-                  style: TextButton.styleFrom(
-                    foregroundColor: Theme.of(context).colorScheme.primary,
-                  ),
-                  onPressed: inProgress ? null : fetchLoginOptions,
-                  child: Text(translate('Retry')),
-                ),
-                if (!inProgress)
-                  SelectableText(
-                    error.toString(),
-                    style: const TextStyle(fontSize: 11, color: Colors.red),
-                    textAlign: TextAlign.center,
-                  ),
-              ],
-            );
-          }
           return Offstage(
             offstage: loginOptions.isEmpty,
             child: Column(
@@ -907,9 +569,6 @@ Future<bool?> _openLoginDialog() async {
                       .map((e) => ConfigOP(op: e['name'], icon: e['icon']))
                       .toList(),
                   curOP: curOP,
-                  startAuth: oidcAuth.start,
-                  cancelAuth: oidcAuth.cancelCurrent,
-                  canStartAuth: oidcAuth.canStart,
                   cbLogin: (Map<String, dynamic> authBody) async {
                     LoginResponse? resp;
                     try {
@@ -991,7 +650,7 @@ Future<bool?> _openLoginDialog() async {
       onCancel: onDialogCancel,
       onSubmit: onLogin,
     );
-  }).whenComplete(oidcAuth.close);
+  });
 
   if (res != null) {
     await UserModel.updateOtherModels();

flutter/lib/common/widgets/oidc_auth_status.dart

@@ -1,157 +0,0 @@
-import 'package:flutter/material.dart';
-
-const _statusFontSize = 12.0;
-const _statusSpacing = 4.0;
-const _messageActionSpacing = 8.0;
-const _desktopActionSize = 28.0;
-const _touchPlatforms = <TargetPlatform>{
-  TargetPlatform.android,
-  TargetPlatform.iOS,
-  TargetPlatform.fuchsia,
-};
-
-class OidcAuthStatus extends StatelessWidget {
-  final String message;
-  final String browserFallbackPrompt;
-  final String authUrl;
-  final String copyLabel;
-  final VoidCallback? onCopy;
-
-  const OidcAuthStatus({
-    super.key,
-    required this.message,
-    required this.browserFallbackPrompt,
-    required this.authUrl,
-    required this.copyLabel,
-    this.onCopy,
-  });
-
-  @override
-  Widget build(BuildContext context) {
-    final messageStyle =
-        DefaultTextStyle.of(context).style.copyWith(fontSize: _statusFontSize);
-    return Column(
-      mainAxisSize: MainAxisSize.min,
-      children: [
-        SelectableText(message, style: messageStyle),
-        if (authUrl.isNotEmpty)
-          Padding(
-            padding: const EdgeInsets.only(top: _messageActionSpacing),
-            child: _OidcAuthFallback(
-              browserFallbackPrompt: browserFallbackPrompt,
-              authUrl: authUrl,
-              copyLabel: copyLabel,
-              onCopy: onCopy,
-            ),
-          ),
-      ],
-    );
-  }
-}
-
-class _OidcAuthFallback extends StatefulWidget {
-  final String browserFallbackPrompt;
-  final String authUrl;
-  final String copyLabel;
-  final VoidCallback? onCopy;
-
-  const _OidcAuthFallback({
-    required this.browserFallbackPrompt,
-    required this.authUrl,
-    required this.copyLabel,
-    required this.onCopy,
-  });
-
-  @override
-  State<_OidcAuthFallback> createState() => _OidcAuthFallbackState();
-}
-
-class _OidcAuthFallbackState extends State<_OidcAuthFallback> {
-  bool _expanded = false;
-
-  @override
-  void didUpdateWidget(covariant _OidcAuthFallback oldWidget) {
-    super.didUpdateWidget(oldWidget);
-    if (oldWidget.authUrl != widget.authUrl) {
-      _expanded = false;
-    }
-  }
-
-  @override
-  Widget build(BuildContext context) {
-    final theme = Theme.of(context);
-    final helperStyle = DefaultTextStyle.of(context).style.copyWith(
-          fontSize: _statusFontSize,
-          color: theme.colorScheme.onSurfaceVariant,
-        );
-    final linkColor = theme.brightness == Brightness.dark
-        ? Colors.blue.shade300
-        : Colors.blue.shade800;
-    final isTouchPlatform = _touchPlatforms.contains(theme.platform);
-    final actionSize =
-        isTouchPlatform ? kMinInteractiveDimension : _desktopActionSize;
-    final urlStyle =
-        DefaultTextStyle.of(context).style.copyWith(fontSize: _statusFontSize);
-    return Column(
-      mainAxisSize: MainAxisSize.min,
-      children: [
-        Text(
-          widget.browserFallbackPrompt,
-          style: helperStyle,
-          textAlign: TextAlign.center,
-        ),
-        Padding(
-          padding: const EdgeInsets.only(top: _statusSpacing),
-          child: _buildUrl(urlStyle, linkColor, actionSize),
-        ),
-      ],
-    );
-  }
-
-  void _copyAndExpand() {
-    setState(() => _expanded = true);
-    widget.onCopy?.call();
-  }
-
-  Widget _buildUrl(TextStyle urlStyle, Color linkColor, double actionSize) {
-    final collapsedUrl = SizedBox(
-      width: double.infinity,
-      child: TextButton(
-        style: TextButton.styleFrom(
-          foregroundColor: linkColor,
-          minimumSize: Size(0, actionSize),
-          padding: EdgeInsets.zero,
-          tapTargetSize: MaterialTapTargetSize.shrinkWrap,
-          visualDensity: VisualDensity.standard,
-        ),
-        onPressed: _copyAndExpand,
-        child: Text(
-          widget.authUrl,
-          maxLines: 1,
-          overflow: TextOverflow.ellipsis,
-          softWrap: false,
-          style: urlStyle.copyWith(
-            color: linkColor,
-            decoration: TextDecoration.underline,
-          ),
-        ),
-      ),
-    );
-    final collapsedChild = widget.onCopy == null
-        ? collapsedUrl
-        : Tooltip(message: widget.copyLabel, child: collapsedUrl);
-    return Container(
-      width: double.infinity,
-      constraints: BoxConstraints(minHeight: actionSize),
-      alignment: Alignment.centerLeft,
-      padding: const EdgeInsets.symmetric(horizontal: _messageActionSpacing),
-      decoration: BoxDecoration(
-        border: Border.all(color: Theme.of(context).dividerColor),
-        borderRadius: BorderRadius.circular(_statusSpacing),
-      ),
-      child: _expanded
-          ? SelectableText(widget.authUrl, style: urlStyle)
-          : collapsedChild,
-    );
-  }
-}

flutter/lib/common/widgets/remote_input.dart

@@ -115,7 +115,6 @@ class _RawTouchGestureDetectorRegionState
   InputModel get inputModel => widget.inputModel;
   bool get handleTouch => (isDesktop || isWebDesktop) || ffiModel.touchMode;
   SessionID get sessionId => ffi.sessionId;
-  bool get canvasLocked => isMobile && ffi.canvasModel.locked;
 
   @override
   Widget build(BuildContext context) {
@@ -472,8 +471,6 @@ class _RawTouchGestureDetectorRegionState
       return;
     }
 
-    if (canvasLocked) return;
-
     if ((isDesktop || isWebDesktop)) {
       final scale = ((d.scale - _scale) * 1000).toInt();
       _scale = d.scale;
@@ -535,7 +532,9 @@ class _RawTouchGestureDetectorRegionState
       // Official
       TapGestureRecognizer:
           GestureRecognizerFactoryWithHandlers<TapGestureRecognizer>(
-              () => TapGestureRecognizer(), (instance) {
+              () => TapGestureRecognizer(
+                    supportedDevices: kTouchBasedDeviceKinds,
+                  ), (instance) {
         instance
           ..onTapDown = onTapDown
           ..onTapUp = onTapUp
@@ -543,14 +542,18 @@ class _RawTouchGestureDetectorRegionState
       }),
       DoubleTapGestureRecognizer:
           GestureRecognizerFactoryWithHandlers<DoubleTapGestureRecognizer>(
-              () => DoubleTapGestureRecognizer(), (instance) {
+              () => DoubleTapGestureRecognizer(
+                    supportedDevices: kTouchBasedDeviceKinds,
+                  ), (instance) {
         instance
           ..onDoubleTapDown = onDoubleTapDown
           ..onDoubleTap = onDoubleTap;
       }),
       LongPressGestureRecognizer:
           GestureRecognizerFactoryWithHandlers<LongPressGestureRecognizer>(
-              () => LongPressGestureRecognizer(), (instance) {
+              () => LongPressGestureRecognizer(
+                    supportedDevices: kTouchBasedDeviceKinds,
+                  ), (instance) {
         instance
           ..onLongPressDown = onLongPressDown
           ..onLongPressUp = onLongPressUp
@@ -560,7 +563,9 @@ class _RawTouchGestureDetectorRegionState
       // Customized
       HoldTapMoveGestureRecognizer:
           GestureRecognizerFactoryWithHandlers<HoldTapMoveGestureRecognizer>(
-              () => HoldTapMoveGestureRecognizer(),
+              () => HoldTapMoveGestureRecognizer(
+                    supportedDevices: kTouchBasedDeviceKinds,
+                  ),
               (instance) => instance
                 ..onHoldDragStart = onHoldDragStart
                 ..onHoldDragUpdate = onHoldDragUpdate
@@ -568,14 +573,18 @@ class _RawTouchGestureDetectorRegionState
                 ..onHoldDragEnd = onHoldDragEnd),
       DoubleFinerTapGestureRecognizer:
           GestureRecognizerFactoryWithHandlers<DoubleFinerTapGestureRecognizer>(
-              () => DoubleFinerTapGestureRecognizer(), (instance) {
+              () => DoubleFinerTapGestureRecognizer(
+                    supportedDevices: kTouchBasedDeviceKinds,
+                  ), (instance) {
         instance
           ..onDoubleFinerTap = onDoubleFinerTap
           ..onDoubleFinerTapDown = onDoubleFinerTapDown;
       }),
       CustomTouchGestureRecognizer:
           GestureRecognizerFactoryWithHandlers<CustomTouchGestureRecognizer>(
-              () => CustomTouchGestureRecognizer(), (instance) {
+              () => CustomTouchGestureRecognizer(
+                    supportedDevices: kTouchBasedDeviceKinds,
+                  ), (instance) {
         instance.onOneFingerPanStart =
             (DragStartDetails d) => onOneFingerPanStart(context, d);
         instance

flutter/lib/common/widgets/setting_widgets.dart

@@ -244,54 +244,17 @@ List<(String, String)> otherDefaultSettings() {
         kKeyUseAllMyDisplaysForTheRemoteSession
       ),
     ('Keep terminal sessions on disconnect', kOptionTerminalPersistent),
-    (
-      'Allow terminal apps to copy to clipboard',
-      kOptionAllowTerminalClipboardWrite
-    ),
   ];
 
   return v;
 }
 
-String getOtherDefaultSettingOption(String key) {
-  if (key == kOptionAllowTerminalClipboardWrite) {
-    return bind.mainGetLocalOption(key: key);
-  }
-  return bind.mainGetUserDefaultOption(key: key);
-}
-
-Future<void> setOtherDefaultSettingOption(String key, String value) {
-  if (key == kOptionAllowTerminalClipboardWrite) {
-    return bind.mainSetLocalOption(
-      key: key,
-      value: value == kTerminalClipboardWriteAllowed
-          ? kTerminalClipboardWriteAllowed
-          : kTerminalClipboardWriteDenied,
-    );
-  }
-  return bind.mainSetUserDefaultOption(key: key, value: value);
-}
-
-bool isOtherDefaultSettingReadOnly(String key) =>
-    isOptionFixed(key) ||
-    (key == kOptionAllowTerminalClipboardWrite && bind.isDisableSettings());
-
 class TrackpadSpeedWidget extends StatefulWidget {
   final SimpleWrapper<int> value;
   // If null, no debouncer will be applied.
   final Function(int)? onDebouncer;
-  final ValueChanged<String>? onTextChanged;
-  // IME actions call TextField.onSubmitted without reaching the dialog's
-  // raw Enter handler, so the dialog needs a separate submission callback.
-  final ValueChanged<String>? onTextSubmitted;
 
-  TrackpadSpeedWidget({
-    Key? key,
-    required this.value,
-    this.onDebouncer,
-    this.onTextChanged,
-    this.onTextSubmitted,
-  });
+  TrackpadSpeedWidget({Key? key, required this.value, this.onDebouncer});
 
   @override
   TrackpadSpeedWidgetState createState() => TrackpadSpeedWidgetState();
@@ -313,34 +276,6 @@ class TrackpadSpeedWidgetState extends State<TrackpadSpeedWidget> {
         debouncerSpeed.setValue(value);
       }
     });
-    widget.onTextChanged?.call(_controller.text);
-  }
-
-  void updateTextValue(String text) {
-    widget.onTextChanged?.call(text);
-    final newValue = int.tryParse(text);
-    if (newValue == null ||
-        newValue < kMinTrackpadSpeed ||
-        newValue > kMaxTrackpadSpeed) {
-      return;
-    }
-    setState(() => value = newValue);
-  }
-
-  void submitTextValue(String text) {
-    final onTextSubmitted = widget.onTextSubmitted;
-    if (onTextSubmitted != null) {
-      onTextSubmitted(text);
-      return;
-    }
-    if (widget.onTextChanged != null) {
-      return;
-    }
-    final newValue = int.tryParse(text);
-    if (newValue == null) {
-      return;
-    }
-    updateValue(newValue);
   }
 
   @override
@@ -380,8 +315,12 @@ class TrackpadSpeedWidgetState extends State<TrackpadSpeedWidget> {
                     controller: _controller,
                     keyboardType: TextInputType.number,
                     textAlign: TextAlign.center,
-                    onChanged: updateTextValue,
-                    onSubmitted: submitTextValue,
+                    onSubmitted: (text) {
+                      int? v = int.tryParse(text);
+                      if (v != null) {
+                        updateValue(v);
+                      }
+                    },
                     style: const TextStyle(fontSize: 13),
                     decoration: InputDecoration(
                       contentPadding:

flutter/lib/common/widgets/toolbar.dart

@@ -11,97 +11,83 @@ import 'package:flutter_hbb/consts.dart';
 import 'package:flutter_hbb/desktop/widgets/remote_toolbar.dart';
 import 'package:flutter_hbb/models/model.dart';
 import 'package:flutter_hbb/models/platform_model.dart';
+import 'package:flutter_hbb/models/shortcut_model.dart';
 import 'package:flutter_hbb/utils/multi_window_manager.dart';
 import 'package:get/get.dart';
-import 'package:url_launcher/url_launcher.dart';
 
 bool isEditOsPassword = false;
-const String kPeerOptionAllowWaylandKeyboard = 'allow-wayland-keyboard';
-const String kWaylandKeyboardIssueUrl =
-    'https://github.com/rustdesk/rustdesk/issues/14586';
-final Set<String> _waylandKeyboardPromptSuppressedConnectionIds = <String>{};
 
-Future<bool> openWaylandKeyboardIssueUrl() {
-  return launchUrl(
-    Uri.parse(kWaylandKeyboardIssueUrl),
-    mode: LaunchMode.externalApplication,
-  );
-}
+/// Action IDs that `toolbarControls` is the sole registrar for. Wiped on
+/// every call so stale closures don't outlive the menu entry that owned
+/// them. Actions registered by `registerSessionShortcutActions` MUST NOT
+/// appear here. `kShortcutActionToggleRecording` is platform-conditional
+/// and handled separately in the unregister pass below.
+const _kToolbarOwnedActionIds = <String>[
+  kShortcutActionSendCtrlAltDel,
+  kShortcutActionRestartRemote,
+  kShortcutActionInsertLock,
+  kShortcutActionToggleBlockInput,
+  kShortcutActionSwitchSides,
+  kShortcutActionRefresh,
+  kShortcutActionScreenshot,
+  kShortcutActionResetCanvas,
+  kShortcutActionSendClipboardKeystrokes,
+];
 
-bool isWaylandKeyboardPromptSuppressedForConnection(String connectionId) {
-  return _waylandKeyboardPromptSuppressedConnectionIds.contains(connectionId);
-}
+const _kToolbarViewStyleActionIds = <String>[
+  kShortcutActionViewModeOriginal,
+  kShortcutActionViewModeAdaptive,
+  kShortcutActionViewModeCustom,
+];
 
-void setWaylandKeyboardPromptSuppressedForConnection(
-    String connectionId, bool suppressed) {
-  if (suppressed) {
-    _waylandKeyboardPromptSuppressedConnectionIds.add(connectionId);
-  } else {
-    _waylandKeyboardPromptSuppressedConnectionIds.remove(connectionId);
-  }
-}
+const _kToolbarImageQualityActionIds = <String>[
+  kShortcutActionImageQualityBest,
+  kShortcutActionImageQualityBalanced,
+  kShortcutActionImageQualityLow,
+];
 
-void clearWaylandKeyboardPromptSuppressedForConnection(String connectionId) {
-  _waylandKeyboardPromptSuppressedConnectionIds.remove(connectionId);
-}
+const _kToolbarCodecActionIds = <String>[
+  kShortcutActionCodecAuto,
+  kShortcutActionCodecVp8,
+  kShortcutActionCodecVp9,
+  kShortcutActionCodecAv1,
+  kShortcutActionCodecH264,
+  kShortcutActionCodecH265,
+];
 
-bool shouldShowWaylandKeyboardPrompt({
-  required String connectionId,
-  required bool isWaylandPeer,
-  required bool allowWaylandKeyboardRemembered,
-}) {
-  return isWaylandPeer &&
-      !allowWaylandKeyboardRemembered &&
-      !isWaylandKeyboardPromptSuppressedForConnection(connectionId);
-}
+const _kToolbarCursorActionIds = <String>[
+  kShortcutActionToggleShowRemoteCursor,
+  kShortcutActionToggleFollowRemoteCursor,
+  kShortcutActionToggleFollowRemoteWindow,
+  kShortcutActionToggleZoomCursor,
+];
 
-Widget waylandKeyboardScopeChip(BuildContext context, String text) {
-  final colorScheme = Theme.of(context).colorScheme;
-  return Container(
-    padding: const EdgeInsets.symmetric(horizontal: 8, vertical: 4),
-    decoration: BoxDecoration(
-      borderRadius: BorderRadius.circular(999),
-      border: Border.all(color: colorScheme.primary.withOpacity(0.35)),
-    ),
-    child: Text(
-      text,
-      style: Theme.of(
-        context,
-      ).textTheme.bodySmall?.copyWith(fontWeight: FontWeight.w600),
-    ),
-  );
-}
+const _kToolbarDisplayToggleActionIds = <String>[
+  kShortcutActionToggleQualityMonitor,
+  kShortcutActionToggleMute,
+  kShortcutActionToggleEnableFileCopyPaste,
+  kShortcutActionToggleDisableClipboard,
+  kShortcutActionToggleLockAfterSessionEnd,
+  kShortcutActionToggleTrueColor,
+];
 
-bool _isWindowsMode1PrivacyImpl(String privacyModeImpl) {
-  return privacyModeImpl == kPrivacyModeImplMag ||
-      privacyModeImpl == kPrivacyModeImplExcludeFromCapture;
-}
-
-// macOS privacy mode blacks out all online displays. Windows Mode 1 also
-// covers every local monitor with privacy overlay windows, so remote display
-// switching does not weaken local privacy protection.
-//
-// Keep this separate from the capture backend capability. The legacy Windows
-// magnifier capturer is not reliable for multi-monitor capture; WebRTC's
-// screen_capturer_win_magnifier also disables it when SM_CMONITORS != 1:
-// https://webrtc.googlesource.com/src/+/1845922d5a1bf9c27deeffb4a8c8daea124434c1/modules/desktop_capture/win/screen_capturer_win_magnifier.cc
-bool allowDisplaySwitchInPrivacyMode(PeerInfo pi, String privacyModeImpl) {
-  return pi.platform == kPeerPlatformMacOS ||
-      (pi.platform == kPeerPlatformWindows &&
-          _isWindowsMode1PrivacyImpl(privacyModeImpl) &&
-          versionCmp(pi.version, '1.4.8') >= 0);
-}
+const _kToolbarKeyboardToggleActionIds = <String>[
+  kShortcutActionToggleSwapCtrlCmd,
+  kShortcutActionToggleSwapLeftRightMouse,
+];
 
 class TTextMenu {
   final Widget child;
   final VoidCallback? onPressed;
   Widget? trailingIcon;
   bool divider;
+  final String? actionId;
   TTextMenu(
       {required this.child,
       required this.onPressed,
       this.trailingIcon,
-      this.divider = false});
+      this.divider = false,
+      this.actionId});
 
   Widget getChild() {
     if (trailingIcon != null) {
@@ -123,20 +109,73 @@ class TRadioMenu<T> {
   final T value;
   final T groupValue;
   final ValueChanged<T?>? onChanged;
+  final String? actionId;
 
   TRadioMenu(
       {required this.child,
       required this.value,
       required this.groupValue,
-      required this.onChanged});
+      required this.onChanged,
+      this.actionId});
 }
 
 class TToggleMenu {
   final Widget child;
   final bool value;
   final ValueChanged<bool?>? onChanged;
+  final String? actionId;
   TToggleMenu(
-      {required this.child, required this.value, required this.onChanged});
+      {required this.child,
+      required this.value,
+      required this.onChanged,
+      this.actionId});
+}
+
+/// Register each tagged entry's `onChanged` with the session [ShortcutModel].
+/// Passthrough — returns [menus] so a caller can wrap `return [...]` directly.
+List<TToggleMenu> _registerToggleMenuShortcuts(
+  FFI ffi,
+  List<TToggleMenu> menus, {
+  List<String> ownedActionIds = const [],
+}) {
+  for (final actionId in ownedActionIds) {
+    ffi.shortcutModel.unregister(actionId);
+  }
+  for (final menu in menus) {
+    final actionId = menu.actionId;
+    if (actionId == null) continue;
+    final onChanged = menu.onChanged;
+    if (onChanged == null) {
+      ffi.shortcutModel.unregister(actionId);
+    } else {
+      final value = menu.value;
+      ffi.shortcutModel.register(actionId, () => onChanged(!value));
+    }
+  }
+  return menus;
+}
+
+/// Radio variant of [_registerToggleMenuShortcuts].
+List<TRadioMenu<T>> _registerRadioMenuShortcuts<T>(
+  FFI ffi,
+  List<TRadioMenu<T>> menus, {
+  List<String> ownedActionIds = const [],
+}) {
+  for (final actionId in ownedActionIds) {
+    ffi.shortcutModel.unregister(actionId);
+  }
+  for (final menu in menus) {
+    final actionId = menu.actionId;
+    if (actionId == null) continue;
+    final onChanged = menu.onChanged;
+    if (onChanged == null) {
+      ffi.shortcutModel.unregister(actionId);
+    } else {
+      final value = menu.value;
+      ffi.shortcutModel.register(actionId, () => onChanged(value));
+    }
+  }
+  return menus;
 }
 
 handleOsPasswordEditIcon(
@@ -163,179 +202,23 @@ handleOsPasswordAction(
   }
 }
 
-void showWaylandKeyboardInputWarningDialog(
-    {required String id,
-    required String connectionId,
-    required FFI ffi,
-    required Future<void> Function() onEnable}) {
-  bool remember = false;
-  bool consentInProgress = false;
-  bool dialogClosed = false;
-
-  final dialogFuture = ffi.dialogManager.show((setState, close, context) {
-    void safeSetState(VoidCallback fn) {
-      if (dialogClosed) {
-        return;
-      }
-      try {
-        setState(fn);
-      } catch (e) {
-        debugPrint('Ignore setState after dialog disposal: $e');
-      }
-    }
-
-    void closeDialog() {
-      if (dialogClosed) {
-        return;
-      }
-      dialogClosed = true;
-      close();
-    }
-
-    Future<void> enableAndContinue() async {
-      if (consentInProgress || dialogClosed) {
-        return;
-      }
-      consentInProgress = true;
-      safeSetState(() {});
-      try {
-        await onEnable();
-      } catch (e, st) {
-        debugPrint('Failed to enable Wayland keyboard input consent: $e');
-        debugPrintStack(stackTrace: st);
-        consentInProgress = false;
-        safeSetState(() {});
-        return;
-      }
-
-      ffi.inputModel.keyboardInputAllowed = true;
-      var rememberPersisted = true;
-      if (remember) {
-        try {
-          await bind.mainSetPeerOption(
-              id: id,
-              key: kPeerOptionAllowWaylandKeyboard,
-              value: bool2option(kPeerOptionAllowWaylandKeyboard, true));
-        } catch (e) {
-          rememberPersisted = false;
-          debugPrint('Failed to persist Wayland keyboard input consent: $e');
-        }
-      }
-      // Always suppress prompt for current connection after explicit consent.
-      setWaylandKeyboardPromptSuppressedForConnection(connectionId, true);
-      closeDialog();
-      if (remember && !rememberPersisted) {
-        // It's a rare edge case that persisting the user's choice fails.
-        // Failed to persist the user's choice, but still allow keyboard input for current session.
-        showToast(translate('Failed'));
-      }
-    }
-
-    void cancel() {
-      if (consentInProgress) {
-        return;
-      }
-      closeDialog();
-    }
-
-    return CustomAlertDialog(
-      title: null,
-      content: Column(
-        mainAxisSize: MainAxisSize.min,
-        crossAxisAlignment: CrossAxisAlignment.start,
-        children: [
-          msgboxContent(
-            '',
-            'wayland-keyboard-input-disabled-tip',
-            'wayland-keyboard-input-consent-tip',
-          ),
-          SizedBox(height: isMobile ? 2 : 6),
-          if (isMobile) ...[
-            Text(
-              translate('wayland-keyboard-input-applies-to-tip'),
-              style: Theme.of(
-                context,
-              ).textTheme.bodyMedium?.copyWith(fontWeight: FontWeight.w600),
-            ).marginOnly(bottom: 6),
-            Wrap(
-              spacing: 6,
-              runSpacing: 6,
-              children: [
-                waylandKeyboardScopeChip(
-                    context, translate('Send clipboard keystrokes')),
-                waylandKeyboardScopeChip(
-                    context, translate('wayland-soft-keyboard-input-label')),
-              ],
-            ).marginOnly(bottom: 10),
-          ],
-          TextButton(
-            onPressed: consentInProgress
-                ? null
-                : () async {
-                    try {
-                      final opened = await openWaylandKeyboardIssueUrl();
-                      if (!opened) {
-                        // Opening this optional help link almost never fails in
-                        // normal desktop environments. Keep the result handled
-                        // for review hygiene, but avoid a low-value user toast.
-                        debugPrint('Failed to open Wayland keyboard issue URL');
-                      }
-                    } catch (e) {
-                      debugPrint(
-                          'Failed to open Wayland keyboard issue URL: $e');
-                    }
-                  },
-            style: TextButton.styleFrom(
-              foregroundColor: Colors.blue,
-              padding: EdgeInsets.zero,
-              minimumSize: Size.zero,
-              tapTargetSize: MaterialTapTargetSize.shrinkWrap,
-            ),
-            child: Text(
-              translate('Why this happens'),
-              style: const TextStyle(decoration: TextDecoration.underline),
-            ),
-          ).marginOnly(bottom: 6),
-          CheckboxListTile(
-            value: remember,
-            dense: true,
-            contentPadding: EdgeInsets.zero,
-            controlAffinity: ListTileControlAffinity.leading,
-            title: Text(translate('remember-wayland-keyboard-choice-tip')),
-            onChanged: consentInProgress
-                ? null
-                : (v) {
-                    safeSetState(() => remember = v == true);
-                  },
-          ),
-        ],
-      ),
-      actions: [
-        dialogButton(
-          'Cancel',
-          onPressed: consentInProgress ? null : cancel,
-          isOutline: true,
-        ),
-        dialogButton(
-          'OK',
-          onPressed:
-              consentInProgress ? null : () => unawaited(enableAndContinue()),
-        ),
-      ],
-      onCancel: consentInProgress ? null : cancel,
-      onSubmit: consentInProgress ? null : () => unawaited(enableAndContinue()),
-    );
-  }, clickMaskDismiss: false, backDismiss: false);
-  unawaited(dialogFuture.whenComplete(() => dialogClosed = true));
-}
-
 List<TTextMenu> toolbarControls(BuildContext context, String id, FFI ffi) {
   final ffiModel = ffi.ffiModel;
   final pi = ffiModel.pi;
   final perms = ffiModel.permissions;
   final sessionId = ffi.sessionId;
   final isDefaultConn = ffi.connType == ConnType.defaultConn;
-  final isWaylandPeer = pi.platform == kPeerPlatformLinux && pi.isWayland;
+
+  // Wipe stale registrations from previous menu builds before re-registering
+  // below; runs unconditionally so mid-session enable works without reconnect.
+  for (final actionId in _kToolbarOwnedActionIds) {
+    ffi.shortcutModel.unregister(actionId);
+  }
+  // toggle_recording is mobile-only here; desktop's registration is owned by
+  // `registerSessionShortcutActions` and must not be touched.
+  if (!(isDesktop || isWeb)) {
+    ffi.shortcutModel.unregister(kShortcutActionToggleRecording);
+  }
 
   List<TTextMenu> v = [];
   // elevation
@@ -349,12 +232,12 @@ List<TTextMenu> toolbarControls(BuildContext context, String id, FFI ffi) {
               showRequestElevationDialog(sessionId, ffi.dialogManager)),
     );
   }
-  // osPassword
+  // osAccount / osPassword
   if (isDefaultConn && perms['keyboard'] != false) {
     v.add(
       TTextMenu(
         child: Row(children: [
-          Text(translate('OS Password')),
+          Text(translate(pi.isHeadless ? 'OS Account' : 'OS Password')),
         ]),
         trailingIcon: Transform.scale(
           scale: (isDesktop || isWebDesktop) ? 0.8 : 1,
@@ -363,12 +246,18 @@ List<TTextMenu> toolbarControls(BuildContext context, String id, FFI ffi) {
               if (isMobile && Navigator.canPop(context)) {
                 Navigator.pop(context);
               }
-              handleOsPasswordEditIcon(sessionId, ffi.dialogManager);
+              if (pi.isHeadless) {
+                showSetOSAccount(sessionId, ffi.dialogManager);
+              } else {
+                handleOsPasswordEditIcon(sessionId, ffi.dialogManager);
+              }
             },
             icon: Icon(Icons.edit, color: isMobile ? MyTheme.accent : null),
           ),
         ),
-        onPressed: () => handleOsPasswordAction(sessionId, ffi.dialogManager),
+        onPressed: () => pi.isHeadless
+            ? showSetOSAccount(sessionId, ffi.dialogManager)
+            : handleOsPasswordAction(sessionId, ffi.dialogManager),
       ),
     );
   }
@@ -379,67 +268,20 @@ List<TTextMenu> toolbarControls(BuildContext context, String id, FFI ffi) {
     v.add(TTextMenu(
         child: Text(translate('Send clipboard keystrokes')),
         onPressed: () async {
-          Future<void> sendClipboardKeystrokes() async {
-            ClipboardData? data = await Clipboard.getData(Clipboard.kTextPlain);
-            if (data != null && data.text != null) {
-              bind.sessionInputString(
-                  sessionId: sessionId, value: data.text ?? "");
-            }
+          ClipboardData? data = await Clipboard.getData(Clipboard.kTextPlain);
+          if (data != null && data.text != null) {
+            bind.sessionInputString(
+                sessionId: sessionId, value: data.text ?? "");
           }
-
-          final allowWaylandKeyboard =
-              mainGetPeerBoolOptionSync(id, kPeerOptionAllowWaylandKeyboard);
-          if (shouldShowWaylandKeyboardPrompt(
-            connectionId: sessionId.toString(),
-            isWaylandPeer: isWaylandPeer,
-            allowWaylandKeyboardRemembered: allowWaylandKeyboard,
-          )) {
-            ffi.inputModel.keyboardInputAllowed = false;
-            showWaylandKeyboardInputWarningDialog(
-              id: id,
-              connectionId: sessionId.toString(),
-              ffi: ffi,
-              onEnable: sendClipboardKeystrokes,
-            );
-            return;
-          }
-          await sendClipboardKeystrokes();
-        }));
-  }
-  if (isDefaultConn &&
-      isWaylandPeer &&
-      (mainGetPeerBoolOptionSync(id, kPeerOptionAllowWaylandKeyboard) ||
-          isWaylandKeyboardPromptSuppressedForConnection(
-              sessionId.toString()))) {
-    v.add(TTextMenu(
-        child: Text(translate('wayland-keyboard-input-reset-choice-tip')),
-        onPressed: () async {
-          var persistedCleared = false;
-          try {
-            await bind.mainSetPeerOption(
-                id: id,
-                key: kPeerOptionAllowWaylandKeyboard,
-                value: bool2option(kPeerOptionAllowWaylandKeyboard, false));
-            persistedCleared = true;
-          } catch (e) {
-            debugPrint(
-                'Failed to clear persisted Wayland keyboard permission: $e');
-          } finally {
-            clearWaylandKeyboardPromptSuppressedForConnection(
-                sessionId.toString());
-            ffi.inputModel.keyboardInputAllowed = false;
-            if (isMobile) {
-              await ffi.invokeMethod("enable_soft_keyboard", false);
-            }
-          }
-          showToast(translate(persistedCleared ? 'Successful' : 'Failed'));
-        }));
+        },
+        actionId: kShortcutActionSendClipboardKeystrokes));
   }
   // reset canvas
   if (isDefaultConn && isMobile) {
     v.add(TTextMenu(
         child: Text(translate('Reset canvas')),
-        onPressed: () => ffi.cursorModel.reset()));
+        onPressed: () => ffi.cursorModel.reset(),
+        actionId: kShortcutActionResetCanvas));
   }
 
   // https://github.com/rustdesk/rustdesk/pull/9731
@@ -515,7 +357,8 @@ List<TTextMenu> toolbarControls(BuildContext context, String id, FFI ffi) {
     v.add(
       TTextMenu(
           child: Text('${translate("Insert Ctrl + Alt + Del")}'),
-          onPressed: () => bind.sessionCtrlAltDel(sessionId: sessionId)),
+          onPressed: () => bind.sessionCtrlAltDel(sessionId: sessionId),
+          actionId: kShortcutActionSendCtrlAltDel),
     );
   }
   // restart
@@ -528,7 +371,8 @@ List<TTextMenu> toolbarControls(BuildContext context, String id, FFI ffi) {
       TTextMenu(
           child: Text(translate('Restart remote device')),
           onPressed: () =>
-              showRestartRemoteDevice(pi, id, sessionId, ffi.dialogManager)),
+              showRestartRemoteDevice(pi, id, sessionId, ffi.dialogManager),
+          actionId: kShortcutActionRestartRemote),
     );
   }
   // insertLock
@@ -536,7 +380,8 @@ List<TTextMenu> toolbarControls(BuildContext context, String id, FFI ffi) {
     v.add(
       TTextMenu(
           child: Text(translate('Insert Lock')),
-          onPressed: () => bind.sessionLockScreen(sessionId: sessionId)),
+          onPressed: () => bind.sessionLockScreen(sessionId: sessionId),
+          actionId: kShortcutActionInsertLock),
     );
   }
   // blockUserInput
@@ -554,7 +399,8 @@ List<TTextMenu> toolbarControls(BuildContext context, String id, FFI ffi) {
               sessionId: sessionId,
               value: '${blockInput.value ? 'un' : ''}block-input');
           blockInput.value = !blockInput.value;
-        }));
+        },
+        actionId: kShortcutActionToggleBlockInput));
   }
   // switchSides
   if (isDefaultConn &&
@@ -566,18 +412,19 @@ List<TTextMenu> toolbarControls(BuildContext context, String id, FFI ffi) {
     v.add(TTextMenu(
         child: Text(translate('Switch Sides')),
         onPressed: () =>
-            showConfirmSwitchSidesDialog(sessionId, id, ffi.dialogManager)));
+            showConfirmSwitchSidesDialog(sessionId, id, ffi.dialogManager),
+        actionId: kShortcutActionSwitchSides));
   }
   // refresh
   if (pi.version.isNotEmpty) {
     v.add(TTextMenu(
       child: Text(translate('Refresh')),
       onPressed: () => sessionRefreshVideo(sessionId, pi),
+      actionId: kShortcutActionRefresh,
     ));
   }
   // record
   if (!(isDesktop || isWeb) &&
-      bind.mainGetLocalOption(key: kOptionHideRecordingButton) != 'Y' &&
       (ffi.recordingModel.start || (perms["recording"] != false))) {
     v.add(TTextMenu(
         child: Row(
@@ -595,13 +442,14 @@ List<TTextMenu> toolbarControls(BuildContext context, String id, FFI ffi) {
             )
           ],
         ),
-        onPressed: () => ffi.recordingModel.toggle()));
+        onPressed: () => ffi.recordingModel.toggle(),
+        actionId: kShortcutActionToggleRecording));
   }
 
   // to-do:
   // 1. Web desktop
   // 2. Mobile, copy the image to the clipboard
-  if ((isDefaultConn || ffi.connType == ConnType.viewCamera) && isDesktop) {
+  if (isDesktop) {
     final isScreenshotSupported = bind.sessionGetCommonSync(
         sessionId: sessionId, key: 'is_screenshot_supported', param: '');
     if ('true' == isScreenshotSupported) {
@@ -612,6 +460,14 @@ List<TTextMenu> toolbarControls(BuildContext context, String id, FFI ffi) {
         onPressed: ffi.ffiModel.timerScreenshot != null
             ? null
             : () {
+                // Live cooldown check: the menu rebuilds onPressed=null
+                // whenever toolbarControls runs and finds timerScreenshot
+                // != null, but the keyboard-shortcut callback holds onto
+                // the originally-enabled closure across cooldown periods
+                // (toolbarControls only re-runs on menu open). Without
+                // this guard the second shortcut press during the 30s
+                // cooldown still fires sessionTakeScreenshot.
+                if (ffi.ffiModel.timerScreenshot != null) return;
                 if (pi.currentDisplay == kAllDisplayValue) {
                   msgBox(
                       sessionId,
@@ -629,6 +485,7 @@ List<TTextMenu> toolbarControls(BuildContext context, String id, FFI ffi) {
                   });
                 }
               },
+        actionId: kShortcutActionScreenshot,
       ));
     }
   }
@@ -639,6 +496,17 @@ List<TTextMenu> toolbarControls(BuildContext context, String id, FFI ffi) {
       onPressed: () => onCopyFingerprint(FingerprintState.find(id).value),
     ));
   }
+  // Register tagged TTextMenu callbacks. The else-unregister is defense in
+  // depth for actionIds tagged but missing from `_kToolbarOwnedActionIds`.
+  for (final menu in v) {
+    final actionId = menu.actionId;
+    if (actionId == null) continue;
+    if (menu.onPressed != null) {
+      ffi.shortcutModel.register(actionId, menu.onPressed!);
+    } else {
+      ffi.shortcutModel.unregister(actionId);
+    }
+  }
   return v;
 }
 
@@ -653,23 +521,26 @@ Future<List<TRadioMenu<String>>> toolbarViewStyle(
         .then((_) => ffi.canvasModel.updateViewStyle());
   }
 
-  return [
+  return _registerRadioMenuShortcuts(ffi, [
     TRadioMenu<String>(
         child: Text(translate('Scale original')),
         value: kRemoteViewStyleOriginal,
         groupValue: groupValue,
-        onChanged: onChanged),
+        onChanged: onChanged,
+        actionId: kShortcutActionViewModeOriginal),
     TRadioMenu<String>(
         child: Text(translate('Scale adaptive')),
         value: kRemoteViewStyleAdaptive,
         groupValue: groupValue,
-        onChanged: onChanged),
+        onChanged: onChanged,
+        actionId: kShortcutActionViewModeAdaptive),
     TRadioMenu<String>(
         child: Text(translate('Scale custom')),
         value: kRemoteViewStyleCustom,
         groupValue: groupValue,
-        onChanged: onChanged)
-  ];
+        onChanged: onChanged,
+        actionId: kShortcutActionViewModeCustom)
+  ], ownedActionIds: _kToolbarViewStyleActionIds);
 }
 
 Future<List<TRadioMenu<String>>> toolbarImageQuality(
@@ -681,22 +552,25 @@ Future<List<TRadioMenu<String>>> toolbarImageQuality(
     await bind.sessionSetImageQuality(sessionId: ffi.sessionId, value: value);
   }
 
-  return [
+  return _registerRadioMenuShortcuts(ffi, [
     TRadioMenu<String>(
         child: Text(translate('Good image quality')),
         value: kRemoteImageQualityBest,
         groupValue: groupValue,
-        onChanged: onChanged),
+        onChanged: onChanged,
+        actionId: kShortcutActionImageQualityBest),
     TRadioMenu<String>(
         child: Text(translate('Balanced')),
         value: kRemoteImageQualityBalanced,
         groupValue: groupValue,
-        onChanged: onChanged),
+        onChanged: onChanged,
+        actionId: kShortcutActionImageQualityBalanced),
     TRadioMenu<String>(
         child: Text(translate('Optimize reaction time')),
         value: kRemoteImageQualityLow,
         groupValue: groupValue,
-        onChanged: onChanged),
+        onChanged: onChanged,
+        actionId: kShortcutActionImageQualityLow),
     TRadioMenu<String>(
       child: Text(translate('Custom')),
       value: kRemoteImageQualityCustom,
@@ -706,7 +580,7 @@ Future<List<TRadioMenu<String>>> toolbarImageQuality(
         customImageQualityDialog(ffi.sessionId, id, ffi);
       },
     ),
-  ];
+  ], ownedActionIds: _kToolbarImageQualityActionIds);
 }
 
 Future<List<TRadioMenu<String>>> toolbarCodec(
@@ -733,7 +607,10 @@ Future<List<TRadioMenu<String>>> toolbarCodec(
   }
   final visible =
       codecs.length == 4 && (codecs[0] || codecs[1] || codecs[2] || codecs[3]);
-  if (!visible) return [];
+  if (!visible) {
+    return _registerRadioMenuShortcuts<String>(ffi, [],
+        ownedActionIds: _kToolbarCodecActionIds);
+  }
   onChanged(String? value) async {
     if (value == null) return;
     await bind.sessionPeerOption(
@@ -741,12 +618,14 @@ Future<List<TRadioMenu<String>>> toolbarCodec(
     bind.sessionChangePreferCodec(sessionId: sessionId);
   }
 
-  TRadioMenu<String> radio(String label, String value, bool enabled) {
+  TRadioMenu<String> radio(
+      String label, String value, bool enabled, String actionId) {
     return TRadioMenu<String>(
         child: Text(label),
         value: value,
         groupValue: groupValue,
-        onChanged: enabled ? onChanged : null);
+        onChanged: enabled ? onChanged : null,
+        actionId: actionId);
   }
 
   var autoLabel = translate('Auto');
@@ -754,14 +633,14 @@ Future<List<TRadioMenu<String>>> toolbarCodec(
       ffi.qualityMonitorModel.data.codecFormat != null) {
     autoLabel = '$autoLabel (${ffi.qualityMonitorModel.data.codecFormat})';
   }
-  return [
-    radio(autoLabel, 'auto', true),
-    if (codecs[0]) radio('VP8', 'vp8', codecs[0]),
-    radio('VP9', 'vp9', true),
-    if (codecs[1]) radio('AV1', 'av1', codecs[1]),
-    if (codecs[2]) radio('H264', 'h264', codecs[2]),
-    if (codecs[3]) radio('H265', 'h265', codecs[3]),
-  ];
+  return _registerRadioMenuShortcuts(ffi, [
+    radio(autoLabel, 'auto', true, kShortcutActionCodecAuto),
+    if (codecs[0]) radio('VP8', 'vp8', codecs[0], kShortcutActionCodecVp8),
+    radio('VP9', 'vp9', true, kShortcutActionCodecVp9),
+    if (codecs[1]) radio('AV1', 'av1', codecs[1], kShortcutActionCodecAv1),
+    if (codecs[2]) radio('H264', 'h264', codecs[2], kShortcutActionCodecH264),
+    if (codecs[3]) radio('H265', 'h265', codecs[3], kShortcutActionCodecH265),
+  ], ownedActionIds: _kToolbarCodecActionIds);
 }
 
 Future<List<TToggleMenu>> toolbarCursor(
@@ -786,6 +665,7 @@ Future<List<TToggleMenu>> toolbarCursor(
     v.add(TToggleMenu(
         child: Text(translate('Show remote cursor')),
         value: state.value,
+        actionId: kShortcutActionToggleShowRemoteCursor,
         onChanged: enabled && !lockState.value
             ? (value) async {
                 if (value == null) return;
@@ -822,6 +702,7 @@ Future<List<TToggleMenu>> toolbarCursor(
     v.add(TToggleMenu(
         child: Text(translate('Follow remote cursor')),
         value: value,
+        actionId: kShortcutActionToggleFollowRemoteCursor,
         onChanged: (value) async {
           if (value == null) return;
           await bind.sessionToggleOption(sessionId: sessionId, value: option);
@@ -850,6 +731,7 @@ Future<List<TToggleMenu>> toolbarCursor(
     v.add(TToggleMenu(
         child: Text(translate('Follow remote window focus')),
         value: value,
+        actionId: kShortcutActionToggleFollowRemoteWindow,
         onChanged: (value) async {
           if (value == null) return;
           await bind.sessionToggleOption(sessionId: sessionId, value: option);
@@ -867,6 +749,7 @@ Future<List<TToggleMenu>> toolbarCursor(
     v.add(TToggleMenu(
       child: Text(translate('Zoom cursor')),
       value: peerState.value,
+      actionId: kShortcutActionToggleZoomCursor,
       onChanged: (value) async {
         if (value == null) return;
         await bind.sessionToggleOption(sessionId: sessionId, value: option);
@@ -875,7 +758,8 @@ Future<List<TToggleMenu>> toolbarCursor(
       },
     ));
   }
-  return v;
+  return _registerToggleMenuShortcuts(ffi, v,
+      ownedActionIds: _kToolbarCursorActionIds);
 }
 
 Future<List<TToggleMenu>> toolbarDisplayToggle(
@@ -891,6 +775,7 @@ Future<List<TToggleMenu>> toolbarDisplayToggle(
   final option = 'show-quality-monitor';
   v.add(TToggleMenu(
       value: bind.sessionGetToggleOptionSync(sessionId: sessionId, arg: option),
+      actionId: kShortcutActionToggleQualityMonitor,
       onChanged: (value) async {
         if (value == null) return;
         await bind.sessionToggleOption(sessionId: sessionId, value: option);
@@ -904,6 +789,7 @@ Future<List<TToggleMenu>> toolbarDisplayToggle(
         bind.sessionGetToggleOptionSync(sessionId: sessionId, arg: option);
     v.add(TToggleMenu(
         value: value,
+        actionId: kShortcutActionToggleMute,
         onChanged: (value) {
           if (value == null) return;
           bind.sessionToggleOption(sessionId: sessionId, value: option);
@@ -928,6 +814,7 @@ Future<List<TToggleMenu>> toolbarDisplayToggle(
         sessionId: sessionId, arg: kOptionEnableFileCopyPaste);
     v.add(TToggleMenu(
         value: value,
+        actionId: kShortcutActionToggleEnableFileCopyPaste,
         onChanged: enabled
             ? (value) {
                 if (value == null) return;
@@ -946,6 +833,7 @@ Future<List<TToggleMenu>> toolbarDisplayToggle(
     if (ffiModel.viewOnly) value = true;
     v.add(TToggleMenu(
         value: value,
+        actionId: kShortcutActionToggleDisableClipboard,
         onChanged: enabled
             ? (value) {
                 if (value == null) return;
@@ -962,6 +850,7 @@ Future<List<TToggleMenu>> toolbarDisplayToggle(
         bind.sessionGetToggleOptionSync(sessionId: sessionId, arg: option);
     v.add(TToggleMenu(
         value: value,
+        actionId: kShortcutActionToggleLockAfterSessionEnd,
         onChanged: enabled
             ? (value) {
                 if (value == null) return;
@@ -971,10 +860,8 @@ Future<List<TToggleMenu>> toolbarDisplayToggle(
         child: Text(translate('Lock after session end'))));
   }
 
-  final privacyModeState = PrivacyModeState.find(id);
   if (pi.isSupportMultiDisplay &&
-      (privacyModeState.isEmpty ||
-          allowDisplaySwitchInPrivacyMode(pi, privacyModeState.value)) &&
+      PrivacyModeState.find(id).isEmpty &&
       pi.displaysCount.value > 1 &&
       bind.mainGetUserDefaultOption(key: kKeyShowMonitorsToolbar) == 'Y') {
     final value =
@@ -1014,6 +901,7 @@ Future<List<TToggleMenu>> toolbarDisplayToggle(
         bind.sessionGetToggleOptionSync(sessionId: sessionId, arg: option);
     v.add(TToggleMenu(
         value: value,
+        actionId: kShortcutActionToggleTrueColor,
         onChanged: (value) async {
           if (value == null) return;
           await bind.sessionToggleOption(sessionId: sessionId, value: option);
@@ -1038,7 +926,8 @@ Future<List<TToggleMenu>> toolbarDisplayToggle(
         },
         child: Text(translate('View Mode'))));
   }
-  return v;
+  return _registerToggleMenuShortcuts(ffi, v,
+      ownedActionIds: _kToolbarDisplayToggleActionIds);
 }
 
 var togglePrivacyModeTime = DateTime.now().subtract(const Duration(hours: 1));
@@ -1048,38 +937,23 @@ List<TToggleMenu> toolbarPrivacyMode(
   final ffiModel = ffi.ffiModel;
   final pi = ffiModel.pi;
   final sessionId = ffi.sessionId;
-  final hasPrivacyModePermission =
-      ffiModel.permissions['privacy_mode'] != false;
 
-  // Backend revocation already attempts to turn privacy mode off.
-  // Still keep this menu when privacy mode is active, so users can turn it off
-  // if there is a sync delay, version mismatch, or off attempt failure.
-  if (!hasPrivacyModePermission && privacyModeState.isEmpty) {
-    return []; // No permission and not active, hide options.
-  }
-
-  bool checkDisplayAllowedForPrivacyMode(String targetImplKey, bool turnOn) {
-    if (!turnOn ||
-        allowDisplaySwitchInPrivacyMode(pi, targetImplKey) ||
-        (ffiModel.pi.currentDisplay == 0 &&
-            !bind.sessionIsMultiUiSession(sessionId: sessionId))) {
-      return true;
-    }
-    msgBox(sessionId, 'custom-nook-nocancel-hasclose', 'info',
-        'Please switch to Display 1 first', '', ffi.dialogManager);
-    return false;
-  }
-
-  getDefaultMenu(Future<void> Function(SessionID sid, String opt) toggleFunc,
-      String targetImplKey) {
-    final enabled = !ffiModel.viewOnly &&
-        (hasPrivacyModePermission || privacyModeState.isNotEmpty);
+  getDefaultMenu(Future<void> Function(SessionID sid, String opt) toggleFunc) {
+    final enabled = !ffi.ffiModel.viewOnly;
     return TToggleMenu(
         value: privacyModeState.isNotEmpty,
         onChanged: enabled
             ? (value) {
                 if (value == null) return;
-                if (!checkDisplayAllowedForPrivacyMode(targetImplKey, value)) {
+                if (ffiModel.pi.currentDisplay != 0 &&
+                    ffiModel.pi.currentDisplay != kAllDisplayValue) {
+                  msgBox(
+                      sessionId,
+                      'custom-nook-nocancel-hasclose',
+                      'info',
+                      'Please switch to Display 1 first',
+                      '',
+                      ffi.dialogManager);
                   return;
                 }
                 final option = 'privacy-mode';
@@ -1097,7 +971,7 @@ List<TToggleMenu> toolbarPrivacyMode(
       getDefaultMenu((sid, opt) async {
         bind.sessionToggleOption(sessionId: sid, value: opt);
         togglePrivacyModeTime = DateTime.now();
-      }, kPrivacyModeImplMag)
+      })
     ];
   }
   if (privacyModeImpls.isEmpty) {
@@ -1111,35 +985,21 @@ List<TToggleMenu> toolbarPrivacyMode(
         bind.sessionTogglePrivacyMode(
             sessionId: sid, implKey: implKey, on: privacyModeState.isEmpty);
         togglePrivacyModeTime = DateTime.now();
-      }, implKey)
+      })
     ];
   } else {
-    final visibleImpls = hasPrivacyModePermission
-        ? privacyModeImpls
-        : privacyModeImpls.where((e) {
-            final implKey = (e as List<dynamic>)[0] as String;
-            return privacyModeState.value == implKey;
-          }).toList();
-    return visibleImpls.map((e) {
+    return privacyModeImpls.map((e) {
       final implKey = (e as List<dynamic>)[0] as String;
       final implName = (e)[1] as String;
-      final enabled = !ffiModel.viewOnly &&
-          (hasPrivacyModePermission || privacyModeState.value == implKey);
       return TToggleMenu(
           child: Text(translate(implName)),
           value: privacyModeState.value == implKey,
-          onChanged: enabled
-              ? (value) {
-                  if (value == null) return;
-                  if (value && !hasPrivacyModePermission) return;
-                  if (!checkDisplayAllowedForPrivacyMode(implKey, value)) {
-                    return;
-                  }
-                  togglePrivacyModeTime = DateTime.now();
-                  bind.sessionTogglePrivacyMode(
-                      sessionId: sessionId, implKey: implKey, on: value);
-                }
-              : null);
+          onChanged: (value) {
+            if (value == null) return;
+            togglePrivacyModeTime = DateTime.now();
+            bind.sessionTogglePrivacyMode(
+                sessionId: sessionId, implKey: implKey, on: value);
+          });
     }).toList();
   }
 }
@@ -1166,6 +1026,7 @@ List<TToggleMenu> toolbarKeyboardToggles(FFI ffi) {
     final enabled = !ffi.ffiModel.viewOnly;
     v.add(TToggleMenu(
         value: value,
+        actionId: kShortcutActionToggleSwapCtrlCmd,
         onChanged: enabled ? onChanged : null,
         child: Text(translate('Swap control-command key'))));
   }
@@ -1231,10 +1092,27 @@ List<TToggleMenu> toolbarKeyboardToggles(FFI ffi) {
     final enabled = !ffi.ffiModel.viewOnly;
     v.add(TToggleMenu(
         value: value,
+        actionId: kShortcutActionToggleSwapLeftRightMouse,
         onChanged: enabled ? onChanged : null,
         child: Text(translate('swap-left-right-mouse'))));
   }
-  return v;
+  return _registerToggleMenuShortcuts(ffi, v,
+      ownedActionIds: _kToolbarKeyboardToggleActionIds);
+}
+
+/// Drive each toolbar helper for its registration side effect, so a shortcut
+/// fires from the first keystroke without needing the user to open the
+/// matching submenu. Mobile gets `toolbarKeyboardToggles` via
+/// `toolbarDisplayToggle`'s `isMobile` branch — calling it explicitly there
+/// would double-register.
+void registerToolbarShortcuts(BuildContext context, String id, FFI ffi) {
+  if (isDesktop) toolbarKeyboardToggles(ffi);
+  unawaited(toolbarCursor(context, id, ffi));
+  unawaited(toolbarDisplayToggle(context, id, ffi));
+  unawaited(toolbarViewStyle(context, id, ffi));
+  unawaited(toolbarImageQuality(context, id, ffi));
+  unawaited(toolbarCodec(context, id, ffi));
+  toolbarPrivacyMode(PrivacyModeState.find(id), context, id, ffi);
 }
 
 bool showVirtualDisplayMenu(FFI ffi) {

flutter/lib/consts.dart

@@ -4,6 +4,8 @@ import 'package:flutter_hbb/common.dart';
 import 'package:flutter_hbb/models/state_model.dart';
 import 'package:get/get.dart';
 
+export 'common/widgets/keyboard_shortcuts/shortcut_constants.dart';
+
 const int kMaxVirtualDisplayCount = 4;
 const int kAllVirtualDisplay = -1;
 
@@ -18,6 +20,7 @@ const kKeyMapMode = 'map';
 const kKeyTranslateMode = 'translate';
 
 const String kPlatformAdditionsIsWayland = "is_wayland";
+const String kPlatformAdditionsHeadless = "headless";
 const String kPlatformAdditionsIsInstalled = "is_installed";
 const String kPlatformAdditionsIddImpl = "idd_impl";
 const String kPlatformAdditionsRustDeskVirtualDisplays =
@@ -28,10 +31,6 @@ const String kPlatformAdditionsHasFileClipboard = "has_file_clipboard";
 const String kPlatformAdditionsSupportedPrivacyModeImpl =
     "supported_privacy_mode_impl";
 
-const String kPrivacyModeImplMag = 'privacy_mode_impl_mag';
-const String kPrivacyModeImplExcludeFromCapture =
-    'privacy_mode_impl_exclude_from_capture';
-
 const String kPeerPlatformWindows = "Windows";
 const String kPeerPlatformLinux = "Linux";
 const String kPeerPlatformMacOS = "Mac OS";
@@ -54,6 +53,7 @@ const String kAppTypeDesktopTerminal = "terminal";
 
 const String kWindowMainWindowOnTop = "main_window_on_top";
 const String kWindowRefreshCurrentUser = "refresh_current_user";
+const String kWindowGetWindowInfo = "get_window_info";
 const String kWindowGetScreenList = "get_screen_list";
 // This method is not used, maybe it can be removed.
 const String kWindowDisableGrabKeyboard = "disable_grab_keyboard";
@@ -93,7 +93,6 @@ const String kOptionForceAlwaysRelay = "force-always-relay";
 const String kOptionViewOnly = "view_only";
 const String kOptionEnableLanDiscovery = "enable-lan-discovery";
 const String kOptionWhitelist = "whitelist";
-const String kOptionIdWhitelist = "id-whitelist";
 const String kOptionEnableAbr = "enable-abr";
 const String kOptionEnableRecordSession = "enable-record-session";
 const String kOptionDirectServer = "direct-server";
@@ -103,7 +102,6 @@ const String kOptionAutoDisconnectTimeout = "auto-disconnect-timeout";
 const String kOptionEnableHwcodec = "enable-hwcodec";
 const String kOptionAllowAutoRecordIncoming = "allow-auto-record-incoming";
 const String kOptionAllowAutoRecordOutgoing = "allow-auto-record-outgoing";
-const String kOptionHideRecordingButton = "hide-recording-button";
 const String kOptionVideoSaveDirectory = "video-save-directory";
 const String kOptionAccessMode = "access-mode";
 const String kOptionEnableKeyboard = "enable-keyboard";
@@ -115,17 +113,9 @@ const String kOptionEnableAudio = "enable-audio";
 const String kOptionEnableCamera = "enable-camera";
 const String kOptionEnableTerminal = "enable-terminal";
 const String kOptionTerminalPersistent = "terminal-persistent";
-const String kOptionAllowTerminalClipboardWrite =
-    "allow-terminal-clipboard-write";
-const String kTerminalClipboardWriteUnconfigured = "";
-const String kTerminalClipboardWriteAllowed = "Y";
-const String kTerminalClipboardWriteDenied = "N";
 const String kOptionEnableTunnel = "enable-tunnel";
 const String kOptionEnableRemoteRestart = "enable-remote-restart";
 const String kOptionEnableBlockInput = "enable-block-input";
-const String kOptionEnablePrivacyMode = "enable-privacy-mode";
-const String kOptionEnablePermChangeInAcceptWindow =
-    "enable-perm-change-in-accept-window";
 const String kOptionAllowRemoteConfigModification =
     "allow-remote-config-modification";
 const String kOptionVerificationMethod = "verification-method";
@@ -151,10 +141,6 @@ const String kOptionSwapLeftRightMouse = "swap-left-right-mouse";
 const String kOptionCodecPreference = "codec-preference";
 const String kOptionRemoteMenubarDragLeft = "remote-menubar-drag-left";
 const String kOptionRemoteMenubarDragRight = "remote-menubar-drag-right";
-const String kOptionRemoteMenubarEdge = "remote-menubar-edge";
-const String kOptionRemoteMenubarFraction = "remote-menubar-frac";
-const String kOptionAllowMultiEdgeToolbarDock =
-    "allow-multi-edge-toolbar-dock";
 const String kOptionHideAbTagsPanel = "hideAbTagsPanel";
 const String kOptionRemoteMenubarState = "remoteMenubarState";
 const String kOptionPeerSorting = "peer-sorting";
@@ -164,27 +150,22 @@ const String kOptionPeerTabVisible = "peer-tab-visible";
 const String kOptionPeerCardUiType = "peer-card-ui-type";
 const String kOptionCurrentAbName = "current-ab-name";
 const String kOptionEnableConfirmClosingTabs = "enable-confirm-closing-tabs";
-const String kOptionEnablePortForwardMux = "enable-port-forward-mux";
 const String kOptionAllowAlwaysSoftwareRender = "allow-always-software-render";
 const String kOptionEnableCheckUpdate = "enable-check-update";
 const String kOptionAllowAutoUpdate = "allow-auto-update";
+const String kOptionAllowLinuxHeadless = "allow-linux-headless";
 const String kOptionAllowRemoveWallpaper = "allow-remove-wallpaper";
 const String kOptionStopService = "stop-service";
 const String kOptionDirectxCapture = "enable-directx-capture";
 const String kOptionAllowRemoteCmModification = "allow-remote-cm-modification";
 const String kOptionEnableUdpPunch = "enable-udp-punch";
 const String kOptionEnableIpv6Punch = "enable-ipv6-punch";
-const String kOptionAllowSyncClipboardBetweenSessions =
-    "allow-sync-clipboard-between-sessions";
 const String kOptionEnableTrustedDevices = "enable-trusted-devices";
 const String kOptionShowVirtualMouse = "show-virtual-mouse";
 const String kOptionVirtualMouseScale = "virtual-mouse-scale";
 const String kOptionShowVirtualJoystick = "show-virtual-joystick";
 const String kOptionAllowAskForNoteAtEndOfConnection = "allow-ask-for-note";
-const String kOptionAllowMonitorSwitchMainToolbar = "allow-monitor-switch-main-toolbar";
-const String kOptionAllowMonitorSwitchMinToolbar = "allow-monitor-switch-min-toolbar";
 const String kOptionEnableShowTerminalExtraKeys = "enable-show-terminal-extra-keys";
-const String kOptionShowTerminalCtrlKeys = "show-terminal-extra-ctrl-keys";
 
 // network options
 const String kOptionAllowWebSocket = "allow-websocket";
@@ -198,7 +179,6 @@ const String kOptionHideProxySetting = "hide-proxy-settings";
 const String kOptionHideWebSocketSetting = "hide-websocket-settings";
 const String kOptionHideStopService = "hide-stop-service";
 const String kOptionHideRemotePrinterSetting = "hide-remote-printer-settings";
-const String kOptionHideGeneralSetting = "hide-general-settings";
 const String kOptionHideSecuritySetting = "hide-security-settings";
 const String kOptionHideNetworkSetting = "hide-network-settings";
 const String kOptionRemovePresetPasswordWarning =
@@ -331,11 +311,10 @@ double kNewWindowOffset = isWindows
             ? 30.0
             : 50.0;
 
-const kDragToResizeAreaPaddingSize = 5.0;
 EdgeInsets get kDragToResizeAreaPadding => !kUseCompatibleUiMode && isLinux
     ? stateGlobal.fullscreen.isTrue || stateGlobal.isMaximized.value
         ? EdgeInsets.zero
-        : EdgeInsets.all(kDragToResizeAreaPaddingSize)
+        : EdgeInsets.all(5.0)
     : EdgeInsets.zero;
 // https://en.wikipedia.org/wiki/Non-breaking_space
 const int $nbsp = 0x00A0;
@@ -447,6 +426,7 @@ const kActionApplicationDetailsSettings =
 const kActionAccessibilitySettings = "android.settings.ACCESSIBILITY_SETTINGS";
 
 const kRecordAudio = "android.permission.RECORD_AUDIO";
+const kManageExternalStorage = "android.permission.MANAGE_EXTERNAL_STORAGE";
 const kRequestIgnoreBatteryOptimizations =
     "android.permission.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS";
 const kSystemAlertWindow = "android.permission.SYSTEM_ALERT_WINDOW";
@@ -458,12 +438,6 @@ class AndroidChannel {
   static final kGetStartOnBootOpt = "get_start_on_boot_opt";
   static final kSetStartOnBootOpt = "set_start_on_boot_opt";
   static final kSyncAppDirConfigPath = "sync_app_dir";
-  static final kPickImportFiles = "pick_import_files";
-  static final kImportFile = "import_file";
-  static final kExportFile = "export_file";
-  static final kPickImportDirectory = "pick_import_directory";
-  static final kImportDirectory = "import_directory";
-  static final kExportFiles = "export_files";
 }
 
 /// flutter/packages/flutter/lib/src/services/keyboard_key.dart -> _keyLabels

flutter/lib/desktop/pages/connection_page.dart

@@ -330,14 +330,12 @@ class _ConnectionPageState extends State<ConnectionPage>
   void onConnect(
       {bool isFileTransfer = false,
       bool isViewCamera = false,
-      bool isTerminal = false,
-      bool isTcpTunneling = false}) {
+      bool isTerminal = false}) {
     var id = _idController.id;
     connect(context, id,
         isFileTransfer: isFileTransfer,
         isViewCamera: isViewCamera,
-        isTerminal: isTerminal,
-        isTcpTunneling: isTcpTunneling);
+        isTerminal: isTerminal);
   }
 
   /// UI for the remote ID TextField.
@@ -400,7 +398,6 @@ class _ConnectionPageState extends State<ConnectionPage>
                                   .contains(textToFind) ||
                               peer.alias.toLowerCase().contains(textToFind))
                           .toList();
-                      _allPeersLoader.queryOnlines(_autocompleteOpts);
                     }
                     return _autocompleteOpts;
                   },
@@ -570,14 +567,6 @@ class _ConnectionPageState extends State<ConnectionPage>
                                       '${translate('Terminal')} (beta)',
                                       () => onConnect(isTerminal: true)
                                     ),
-                                    // `connect` routes this through the
-                                    // desktop path only; the peer card gates
-                                    // it the same way.
-                                    if (isDesktop)
-                                      (
-                                        'TCP tunneling',
-                                        () => onConnect(isTcpTunneling: true)
-                                      ),
                                   ]
                                       .map((e) => MenuEntryButton<String>(
                                             childBuilder: (TextStyle? style) =>

flutter/lib/desktop/pages/desktop_home_page.dart

@@ -16,6 +16,7 @@ import 'package:flutter_hbb/desktop/widgets/update_progress.dart';
 import 'package:flutter_hbb/models/platform_model.dart';
 import 'package:flutter_hbb/models/server_model.dart';
 import 'package:flutter_hbb/models/state_model.dart';
+import 'package:flutter_hbb/plugin/ui_manager.dart';
 import 'package:flutter_hbb/utils/multi_window_manager.dart';
 import 'package:flutter_hbb/utils/platform_channel.dart';
 import 'package:get/get.dart';
@@ -110,6 +111,7 @@ class _DesktopHomePageState extends State<DesktopHomePage>
           }
         },
       ),
+      buildPluginEntry(),
     ];
     if (isIncomingOnly) {
       children.addAll([
@@ -780,6 +782,13 @@ class _DesktopHomePageState extends State<DesktopHomePage>
         windowOnTop(null);
       } else if (call.method == kWindowRefreshCurrentUser) {
         gFFI.userModel.refreshCurrentUser();
+      } else if (call.method == kWindowGetWindowInfo) {
+        final screen = (await window_size.getWindowInfo()).screen;
+        if (screen == null) {
+          return '';
+        } else {
+          return jsonEncode(screenToMap(screen));
+        }
       } else if (call.method == kWindowGetScreenList) {
         return jsonEncode(
             (await window_size.getScreenList()).map(screenToMap).toList());
@@ -881,6 +890,21 @@ class _DesktopHomePageState extends State<DesktopHomePage>
       shouldBeBlocked(_block, canBeBlocked);
     }
   }
+
+  Widget buildPluginEntry() {
+    final entries = PluginUiManager.instance.entries.entries;
+    return Offstage(
+      offstage: entries.isEmpty,
+      child: Column(
+        crossAxisAlignment: CrossAxisAlignment.start,
+        children: [
+          ...entries.map((entry) {
+            return entry.value;
+          })
+        ],
+      ),
+    );
+  }
 }
 
 void setPasswordDialog({VoidCallback? notEmptyCallback}) async {

flutter/lib/desktop/pages/desktop_keyboard_shortcuts_page.dart

@@ -0,0 +1,66 @@
+// flutter/lib/desktop/pages/desktop_keyboard_shortcuts_page.dart
+//
+// Desktop shell for the Keyboard Shortcuts configuration page. Users land
+// here from the General settings tab. The page exposes:
+//   * A top-level enable/disable toggle (mirrors the General-tab toggle —
+//     same JSON key, same semantics).
+//   * A grouped, scrollable list of actions, each with a current binding and
+//     edit / clear icons.
+//   * An AppBar "Reset to defaults" action with a confirmation dialog.
+//
+// All edits write back to LocalConfig under [kShortcutLocalConfigKey] in the
+// canonical {enabled, bindings:[{action,mods,key}]} shape that the Rust and
+// Web matchers consume.
+//
+// The body — group definitions, JSON I/O, conflict-replace flow,
+// recording-dialog round-trip — lives in
+// `common/widgets/keyboard_shortcuts/page_body.dart` and is shared with the
+// mobile shell at `mobile/pages/mobile_keyboard_shortcuts_page.dart`.
+
+import 'package:flutter/material.dart';
+import 'package:get/get.dart';
+
+import '../../common.dart';
+import '../../common/widgets/keyboard_shortcuts/page_body.dart';
+
+class DesktopKeyboardShortcutsPage extends StatefulWidget {
+  const DesktopKeyboardShortcutsPage({Key? key}) : super(key: key);
+
+  @override
+  State<DesktopKeyboardShortcutsPage> createState() =>
+      _DesktopKeyboardShortcutsPageState();
+}
+
+class _DesktopKeyboardShortcutsPageState
+    extends State<DesktopKeyboardShortcutsPage> {
+  final GlobalKey<KeyboardShortcutsPageBodyState> _bodyKey = GlobalKey();
+
+  @override
+  Widget build(BuildContext context) {
+    final foregroundColor =
+        AppBarTheme.of(context).titleTextStyle?.color ?? Colors.white;
+    return Scaffold(
+      appBar: AppBar(
+        title: Text(translate('Keyboard Shortcuts')),
+        actions: [
+          TextButton.icon(
+            style: TextButton.styleFrom(foregroundColor: foregroundColor),
+            onPressed: () =>
+                _bodyKey.currentState?.resetToDefaultsWithConfirm(),
+            icon: const Icon(Icons.restore),
+            label: Text(translate('Reset to defaults')),
+          ).marginOnly(right: 12),
+        ],
+      ),
+      body: KeyboardShortcutsPageBody(
+        key: _bodyKey,
+        compact: true,
+        // Desktop's General settings tab already exposes the Enable +
+        // Pass-through checkboxes (it's the only entry point to this page),
+        // so we hide the duplicates here. Mobile shells keep the default
+        // (true) because their entry tile doesn't carry the toggles.
+        showMasterToggles: false,
+      ),
+    );
+  }
+}

flutter/lib/desktop/pages/desktop_setting_page.dart

@@ -10,13 +10,18 @@ import 'package:flutter_hbb/common/widgets/audio_input.dart';
 import 'package:flutter_hbb/common/widgets/setting_widgets.dart';
 import 'package:flutter_hbb/consts.dart';
 import 'package:flutter_hbb/desktop/pages/desktop_home_page.dart';
+import 'package:flutter_hbb/common/widgets/keyboard_shortcuts/page_body.dart';
+import 'package:flutter_hbb/desktop/pages/desktop_keyboard_shortcuts_page.dart';
 import 'package:flutter_hbb/desktop/pages/desktop_tab_page.dart';
 import 'package:flutter_hbb/desktop/widgets/remote_toolbar.dart';
 import 'package:flutter_hbb/mobile/widgets/dialog.dart';
 import 'package:flutter_hbb/models/platform_model.dart';
 import 'package:flutter_hbb/models/printer_model.dart';
 import 'package:flutter_hbb/models/server_model.dart';
+import 'package:flutter_hbb/models/shortcut_model.dart';
 import 'package:flutter_hbb/models/state_model.dart';
+import 'package:flutter_hbb/plugin/manager.dart';
+import 'package:flutter_hbb/plugin/widgets/desktop_settings.dart';
 import 'package:get/get.dart';
 import 'package:provider/provider.dart';
 import 'package:url_launcher/url_launcher.dart';
@@ -53,6 +58,7 @@ enum SettingsTabKey {
   safety,
   network,
   display,
+  plugin,
   account,
   printer,
   about,
@@ -61,8 +67,7 @@ enum SettingsTabKey {
 class DesktopSettingPage extends StatefulWidget {
   final SettingsTabKey initialTabkey;
   static final List<SettingsTabKey> tabKeys = [
-    if (bind.mainGetBuildinOption(key: kOptionHideGeneralSetting) != 'Y')
-      SettingsTabKey.general,
+    SettingsTabKey.general,
     if (!isWeb &&
         !bind.isOutgoingOnly() &&
         !bind.isDisableSettings() &&
@@ -72,9 +77,10 @@ class DesktopSettingPage extends StatefulWidget {
         bind.mainGetBuildinOption(key: kOptionHideNetworkSetting) != 'Y')
       SettingsTabKey.network,
     if (!bind.isIncomingOnly()) SettingsTabKey.display,
+    if (!isWeb && !bind.isIncomingOnly() && bind.pluginFeatureIsEnabled())
+      SettingsTabKey.plugin,
     if (!bind.isDisableAccount()) SettingsTabKey.account,
     if (isWindows &&
-        !bind.isDisableSettings() &&
         bind.mainGetBuildinOption(key: kOptionHideRemotePrinterSetting) != 'Y')
       SettingsTabKey.printer,
     SettingsTabKey.about,
@@ -92,8 +98,7 @@ class DesktopSettingPage extends StatefulWidget {
       if (index == -1) {
         return;
       }
-      if (Get.isRegistered<PageController>(tag: _kSettingPageControllerTag) &&
-          Get.isRegistered<Rx<SettingsTabKey>>(tag: _kSettingPageTabKeyTag)) {
+      if (Get.isRegistered<PageController>(tag: _kSettingPageControllerTag)) {
         DesktopTabPage.onAddSetting(initialPage: page);
         PageController controller =
             Get.find<PageController>(tag: _kSettingPageControllerTag);
@@ -161,23 +166,17 @@ class _DesktopSettingPageState extends State<DesktopSettingPage>
       if (!mounted) {
         return;
       }
-      final blocked = await canBeBlocked();
-      if (!mounted) {
-        return;
-      }
-      _canBeBlocked.value = blocked;
+      _canBeBlocked.value = await canBeBlocked();
     });
   }
 
   @override
   void dispose() {
-    _videoConnTimer?.cancel();
-    WidgetsBinding.instance.removeObserver(this);
-    Get.delete<PageController>(tag: _kSettingPageControllerTag);
-    Get.delete<Rx<SettingsTabKey>>(tag: _kSettingPageTabKeyTag);
-    // Get.delete does not dispose a plain ChangeNotifier.
-    controller.dispose();
     super.dispose();
+    Get.delete<PageController>(tag: _kSettingPageControllerTag);
+    Get.delete<RxInt>(tag: _kSettingPageTabKeyTag);
+    WidgetsBinding.instance.removeObserver(this);
+    _videoConnTimer?.cancel();
   }
 
   List<_TabInfo> _settingTabs() {
@@ -200,6 +199,10 @@ class _DesktopSettingPageState extends State<DesktopSettingPage>
           settingTabs.add(_TabInfo(tab, 'Display',
               Icons.desktop_windows_outlined, Icons.desktop_windows));
           break;
+        case SettingsTabKey.plugin:
+          settingTabs.add(_TabInfo(
+              tab, 'Plugin', Icons.extension_outlined, Icons.extension));
+          break;
         case SettingsTabKey.account:
           settingTabs.add(
               _TabInfo(tab, 'Account', Icons.person_outline, Icons.person));
@@ -233,6 +236,9 @@ class _DesktopSettingPageState extends State<DesktopSettingPage>
         case SettingsTabKey.display:
           children.add(const _Display());
           break;
+        case SettingsTabKey.plugin:
+          children.add(const _Plugin());
+          break;
         case SettingsTabKey.account:
           children.add(const _Account());
           break;
@@ -404,7 +410,6 @@ class _GeneralState extends State<_General> {
   final RxBool serviceStop =
       isWeb ? RxBool(false) : Get.find<RxBool>(tag: 'stop-service');
   RxBool serviceBtnEnabled = true.obs;
-  final GlobalKey _minToolbarOptionKey = GlobalKey();
 
   @override
   Widget build(BuildContext context) {
@@ -419,11 +424,50 @@ class _GeneralState extends State<_General> {
         if (!isWeb) audio(context),
         if (!isWeb) record(context),
         if (!isWeb) WaylandCard(),
-        other()
+        other(),
+        if (!bind.isIncomingOnly()) keyboardShortcuts(),
       ],
     ).marginOnly(bottom: _kListViewBottomMargin);
   }
 
+  Widget keyboardShortcuts() {
+    // The bindings JSON (LocalConfig key `keyboard-shortcuts`) holds three
+    // flags + the bindings list: {enabled, pass_through, bindings}. When the
+    // master is off, the pass-through toggle and the Configure entry are
+    // hidden — both are meaningless without an active matcher.
+    return StatefulBuilder(builder: (context, setLocalState) {
+      final enabled = ShortcutModel.isEnabled();
+      return _Card(title: 'Keyboard Shortcuts', children: [
+        _OptionCheckBox(
+          context,
+          'Enable keyboard shortcuts in remote session',
+          kShortcutLocalConfigKey,
+          isServer: false,
+          optGetter: ShortcutModel.isEnabled,
+          optSetter: (_, v) async {
+            await ShortcutModel.setEnabled(v);
+            setLocalState(() {});
+          },
+        ),
+        if (enabled) ...[
+          _OptionCheckBox(
+            context,
+            'Pass-through to remote',
+            kShortcutLocalConfigKey,
+            isServer: false,
+            optGetter: ShortcutModel.isPassThrough,
+            optSetter: (_, v) async {
+              await ShortcutModel.setPassThrough(v);
+              setLocalState(() {});
+            },
+            trailing: const InfoTooltipIcon(tipKey: 'shortcut-passthrough-tip'),
+          ),
+          _ShortcutsConfigureRow(),
+        ],
+      ]);
+    });
+  }
+
   Widget theme() {
     final current = MyTheme.getThemeModePreference().toShortString();
     onChanged(String value) async {
@@ -480,44 +524,21 @@ class _GeneralState extends State<_General> {
   }
 
   Widget other() {
-    final incomingOnly = bind.isIncomingOnly();
-    final outgoingOnly = bind.isOutgoingOnly();
-    final showAutoUpdate = (isWindows && bind.mainIsInstalled()) ||
-    (isMacOS && bind.mainIsInstalled() && bind.mainIsInstalledDaemon(prompt: false) && !bind.isCustomClient());
+    final showAutoUpdate = isWindows && bind.mainIsInstalled();
     final children = <Widget>[
-      if (!isWeb && !incomingOnly)
+      if (!isWeb && !bind.isIncomingOnly())
         _OptionCheckBox(context, 'Confirm before closing multiple tabs',
             kOptionEnableConfirmClosingTabs,
             isServer: false),
-      if (!incomingOnly)
-        _OptionCheckBox(
-          context,
-          'allow-remote-toolbar-docking-any-edge',
-          kOptionAllowMultiEdgeToolbarDock,
-          isServer: false,
-          update: (_) {
-            reloadAllWindows();
-          },
-        ),
-      if (!isWeb && !outgoingOnly)
-        _OptionCheckBox(context, 'Adaptive bitrate', kOptionEnableAbr),
+      _OptionCheckBox(context, 'Adaptive bitrate', kOptionEnableAbr),
       if (!isWeb) wallpaper(),
-      if (!isWeb && !incomingOnly) ...[
+      if (!isWeb && !bind.isIncomingOnly()) ...[
         _OptionCheckBox(
           context,
           'Open connection in new tab',
           kOptionOpenNewConnInTabs,
           isServer: false,
         ),
-        Tooltip(
-          message: translate('port-forward-mux-tip'),
-          child: _OptionCheckBox(
-            context,
-            'Reuse one connection for port forwarding',
-            kOptionEnablePortForwardMux,
-            isServer: false,
-          ),
-        ),
         // though this is related to GUI, but opengl problem affects all users, so put in config rather than local
         if (isLinux)
           Tooltip(
@@ -550,49 +571,40 @@ class _GeneralState extends State<_General> {
               isServer: false,
             ),
           ),
-      ],
-      if (!isWeb && !bind.isCustomClient())
-        _OptionCheckBox(
-          context,
-          'Check for software update on startup',
-          kOptionEnableCheckUpdate,
-          isServer: false,
-        ),
-      if (showAutoUpdate)
-        _OptionCheckBox(
-          context,
-          'Auto update',
-          kOptionAllowAutoUpdate,
-          isServer: true,
-        ),
-      if (isWindows && !outgoingOnly)
-        _OptionCheckBox(
-          context,
-          'Capture screen using DirectX',
-          kOptionDirectxCapture,
-        ),
-      if (!isWeb && !incomingOnly) ...[
-        _OptionCheckBox(
-          context,
-          'Enable UDP hole punching',
-          kOptionEnableUdpPunch,
-          isServer: false,
-        ),
-        _OptionCheckBox(
-          context,
-          'Enable IPv6 P2P connection',
-          kOptionEnableIpv6Punch,
-          isServer: false,
-        ),
-        Tooltip(
-          message: translate('sync-clipboard-between-sessions-tip'),
-          child: _OptionCheckBox(
+        if (!isWeb && !bind.isCustomClient())
+          _OptionCheckBox(
             context,
-            'Sync clipboard between sessions',
-            kOptionAllowSyncClipboardBetweenSessions,
+            'Check for software update on startup',
+            kOptionEnableCheckUpdate,
             isServer: false,
           ),
-        ),
+        if (showAutoUpdate)
+          _OptionCheckBox(
+            context,
+            'Auto update',
+            kOptionAllowAutoUpdate,
+            isServer: true,
+          ),
+        if (isWindows && !bind.isOutgoingOnly())
+          _OptionCheckBox(
+            context,
+            'Capture screen using DirectX',
+            kOptionDirectxCapture,
+          ),
+        if (!bind.isIncomingOnly()) ...[
+          _OptionCheckBox(
+            context,
+            'Enable UDP hole punching',
+            kOptionEnableUdpPunch,
+            isServer: false,
+          ),
+          _OptionCheckBox(
+            context,
+            'Enable IPv6 P2P connection',
+            kOptionEnableIpv6Punch,
+            isServer: false,
+          ),
+        ],
       ],
     ];
 
@@ -606,6 +618,10 @@ class _GeneralState extends State<_General> {
       ));
     }
 
+    if (!isWeb && bind.mainShowOption(key: kOptionAllowLinuxHeadless)) {
+      children.add(_OptionCheckBox(
+          context, 'Allow linux headless', kOptionAllowLinuxHeadless));
+    }
     if (!bind.isDisableAccount()) {
       children.add(_OptionCheckBox(
         context,
@@ -621,47 +637,6 @@ class _GeneralState extends State<_General> {
         },
       ));
     }
-    children.add(_OptionCheckBox(
-      context,
-      'Show monitor switch button on the main toolbar',
-      kOptionAllowMonitorSwitchMainToolbar,
-      isServer: false,
-      update: (enabled) async {
-        if (!enabled) {
-          await mainSetLocalBoolOption(
-              kOptionAllowMonitorSwitchMinToolbar, false);
-        }
-        if (mounted) setState(() {});
-        reloadAllWindows();
-        if (enabled) {
-          WidgetsBinding.instance.addPostFrameCallback((_) {
-            final ctx = _minToolbarOptionKey.currentContext;
-            if (ctx != null) {
-              Scrollable.ensureVisible(
-                ctx,
-                alignment: 0.5,
-                duration: const Duration(milliseconds: 250),
-                curve: Curves.easeInOut,
-              );
-            }
-          });
-        }
-      },
-    ));
-    if (mainGetLocalBoolOptionSync(kOptionAllowMonitorSwitchMainToolbar)) {
-      children.add(KeyedSubtree(
-        key: _minToolbarOptionKey,
-        child: _OptionCheckBox(
-          context,
-          'Show on the minimized toolbar',
-          kOptionAllowMonitorSwitchMinToolbar,
-          isServer: false,
-          update: (_) {
-            reloadAllWindows();
-          },
-        ).marginOnly(left: _kCheckBoxLeftMargin * 3),
-      ));
-    }
     return _Card(title: 'Other', children: children);
   }
 
@@ -1129,10 +1104,6 @@ class _SafetyState extends State<_Safety> with AutomaticKeepAliveClientMixin {
               _OptionCheckBox(context, 'Enable blocking user input',
                   kOptionEnableBlockInput,
                   enabled: enabled, fakeValue: fakeValue),
-            if (bind.mainSupportedPrivacyModeImpls() != '[]')
-              _OptionCheckBox(
-                  context, 'Enable privacy mode', kOptionEnablePrivacyMode,
-                  enabled: enabled, fakeValue: fakeValue),
             _OptionCheckBox(context, 'Enable remote configuration modification',
                 kOptionAllowRemoteConfigModification,
                 enabled: enabled, fakeValue: fakeValue),
@@ -1309,7 +1280,6 @@ class _SafetyState extends State<_Safety> with AutomaticKeepAliveClientMixin {
           reverse: true, enabled: enabled),
       ...directIp(context),
       whitelist(),
-      idWhitelist(),
       ...autoDisconnect(context),
       _OptionCheckBox(context, 'keep-awake-during-incoming-sessions-label',
           kOptionKeepAwakeDuringIncomingSessions,
@@ -1467,52 +1437,6 @@ class _SafetyState extends State<_Safety> with AutomaticKeepAliveClientMixin {
     return tmpWrapper();
   }
 
-  Widget idWhitelist() {
-    bool enabled = !locked;
-    RxBool hasIdWhitelist = idWhitelistNotEmpty().obs;
-    update() async {
-      hasIdWhitelist.value = idWhitelistNotEmpty();
-    }
-
-    onChanged(bool? checked) async {
-      changeIdWhiteList(callback: update);
-    }
-
-    final isOptFixed = isOptionFixed(kOptionIdWhitelist);
-    return GestureDetector(
-      child: Tooltip(
-        message: translate('id_whitelist_tip'),
-        child: Obx(() => Row(
-              children: [
-                Checkbox(
-                        value: hasIdWhitelist.value,
-                        onChanged: enabled && !isOptFixed ? onChanged : null)
-                    .marginOnly(right: 5),
-                Offstage(
-                  offstage: !hasIdWhitelist.value,
-                  child: MouseRegion(
-                    child: const Icon(Icons.warning_amber_rounded,
-                            color: Color.fromARGB(255, 255, 204, 0))
-                        .marginOnly(right: 5),
-                    cursor: SystemMouseCursors.click,
-                  ),
-                ),
-                Expanded(
-                    child: Text(
-                  translate('Use ID whitelisting'),
-                  style: TextStyle(color: disabledTextColor(context, enabled)),
-                ))
-              ],
-            )),
-      ),
-      onTap: enabled
-          ? () {
-              onChanged(!hasIdWhitelist.value);
-            }
-          : null,
-    ).marginOnly(left: _kCheckBoxLeftMargin);
-  }
-
   Widget hide_cm(bool enabled) {
     return ChangeNotifierProvider.value(
         value: gFFI.serverModel,
@@ -2089,13 +2013,14 @@ class _DisplayState extends State<_Display> {
   }
 
   Widget otherRow(String label, String key) {
-    final value = getOtherDefaultSettingOption(key) == 'Y';
-    final isOptFixed = isOtherDefaultSettingReadOnly(key);
+    final value = bind.mainGetUserDefaultOption(key: key) == 'Y';
+    final isOptFixed = isOptionFixed(key);
     onChanged(bool b) async {
-      await setOtherDefaultSettingOption(
-        key,
-        b ? 'Y' : (key == kOptionEnableFileCopyPaste ? 'N' : defaultOptionNo),
-      );
+      await bind.mainSetUserDefaultOption(
+          key: key,
+          value: b
+              ? 'Y'
+              : (key == kOptionEnableFileCopyPaste ? 'N' : defaultOptionNo));
       setState(() {});
     }
 
@@ -2265,6 +2190,51 @@ class _CheckboxState extends State<_Checkbox> {
   }
 }
 
+class _Plugin extends StatefulWidget {
+  const _Plugin({Key? key}) : super(key: key);
+
+  @override
+  State<_Plugin> createState() => _PluginState();
+}
+
+class _PluginState extends State<_Plugin> {
+  @override
+  Widget build(BuildContext context) {
+    bind.pluginListReload();
+    final scrollController = ScrollController();
+    return ChangeNotifierProvider.value(
+      value: pluginManager,
+      child: Consumer<PluginManager>(builder: (context, model, child) {
+        return ListView(
+          controller: scrollController,
+          children: model.plugins.map((entry) => pluginCard(entry)).toList(),
+        ).marginOnly(bottom: _kListViewBottomMargin);
+      }),
+    );
+  }
+
+  Widget pluginCard(PluginInfo plugin) {
+    return ChangeNotifierProvider.value(
+      value: plugin,
+      child: Consumer<PluginInfo>(
+        builder: (context, model, child) => DesktopSettingsCard(plugin: model),
+      ),
+    );
+  }
+
+  Widget accountAction() {
+    return Obx(() => _Button(
+        gFFI.userModel.userName.value.isEmpty
+            ? 'Login'
+            : '${translate('Logout')} (${gFFI.userModel.accountLabelWithHandle})',
+        () => {
+              gFFI.userModel.userName.value.isEmpty
+                  ? loginDialog()
+                  : logOutConfirmDialog()
+            }));
+  }
+}
+
 class _Printer extends StatefulWidget {
   const _Printer({super.key});
 
@@ -2427,20 +2397,17 @@ class _AboutState extends State<_About> {
       final version = await bind.mainGetVersion();
       final buildDate = await bind.mainGetBuildDate();
       final fingerprint = await bind.mainGetFingerprint();
-      final myId = await bind.mainGetMyId();
       return {
         'license': license,
         'version': version,
         'buildDate': buildDate,
-        'fingerprint': fingerprint,
-        'myId': myId
+        'fingerprint': fingerprint
       };
     }(), hasData: (data) {
       final license = data['license'].toString();
       final version = data['version'].toString();
       final buildDate = data['buildDate'].toString();
       final fingerprint = data['fingerprint'].toString();
-      final myId = data['myId'].toString();
       const linkStyle = TextStyle(decoration: TextDecoration.underline);
       final scrollController = ScrollController();
       return SingleChildScrollView(
@@ -2462,9 +2429,6 @@ class _AboutState extends State<_About> {
                 SelectionArea(
                     child: Text('${translate('Fingerprint')}: $fingerprint')
                         .marginSymmetric(vertical: 4.0)),
-              SelectionArea(
-                  child: Text('${translate('ID')}: $myId')
-                      .marginSymmetric(vertical: 4.0)),
               InkWell(
                   onTap: () {
                     launchUrlString('https://rustdesk.com/privacy.html');
@@ -2493,7 +2457,7 @@ class _AboutState extends State<_About> {
                         crossAxisAlignment: CrossAxisAlignment.start,
                         children: [
                           Text(
-                            'Copyright © ${DateTime.now().toString().substring(0, 4)} Purslane Tech Pte. Ltd.\n$license',
+                            'Copyright © ${DateTime.now().toString().substring(0, 4)} Purslane Ltd.\n$license',
                             style: const TextStyle(color: Colors.white),
                           ),
                           Text(
@@ -2570,6 +2534,8 @@ Widget _OptionCheckBox(
   bool isServer = true,
   bool Function()? optGetter,
   Future<void> Function(String, bool)? optSetter,
+  // Optional widget rendered between the label and the trailing space.
+  Widget? trailing,
 }) {
   getOpt() => optGetter != null
       ? optGetter()
@@ -2613,11 +2579,23 @@ Widget _OptionCheckBox(
             offstage: !ref.value || checkedIcon == null,
             child: checkedIcon?.marginOnly(right: 5),
           ),
-          Expanded(
+          // Without `trailing`, keep the original Expanded(Text) layout.
+          if (trailing == null)
+            Expanded(
+                child: Text(
+              translate(label),
+              style: TextStyle(color: disabledTextColor(context, enabled)),
+            ))
+          else ...[
+            Flexible(
               child: Text(
-            translate(label),
-            style: TextStyle(color: disabledTextColor(context, enabled)),
-          ))
+                translate(label),
+                style: TextStyle(color: disabledTextColor(context, enabled)),
+              ),
+            ),
+            trailing,
+            const Spacer(),
+          ],
         ],
       ),
     ).marginOnly(left: _kCheckBoxLeftMargin),
@@ -3024,6 +3002,37 @@ class _CountDownButtonState extends State<_CountDownButton> {
   }
 }
 
+// Tappable row that pushes the shortcut configuration page.
+class _ShortcutsConfigureRow extends StatelessWidget {
+  // ignore: unused_element
+  const _ShortcutsConfigureRow({Key? key}) : super(key: key);
+
+  @override
+  Widget build(BuildContext context) {
+    return InkWell(
+      onTap: () {
+        Navigator.of(context).push(MaterialPageRoute(
+          builder: (_) => const DesktopKeyboardShortcutsPage(),
+        ));
+      },
+      child: Row(
+        children: [
+          Expanded(
+            child: Text(translate('Configure shortcuts...')),
+          ),
+          Icon(Icons.arrow_forward_ios,
+                  size: 16, color: disabledTextColor(context, true))
+              .marginOnly(right: 4),
+        ],
+      ).marginOnly(
+        left: _kCheckBoxLeftMargin,
+        top: 6,
+        bottom: 6,
+      ),
+    );
+  }
+}
+
 //#endregion
 
 //#region dialogs

flutter/lib/desktop/pages/file_manager_page.dart

@@ -278,39 +278,7 @@ class _FileManagerPageState extends State<FileManagerPage>
                                     item.state != JobState.inProgress,
                                 child: LinearPercentIndicator(
                                   animateFromLastPercent: true,
-                                  center: SizedBox.expand(
-                                    child: ShaderMask(
-                                      blendMode: BlendMode.srcATop,
-                                      shaderCallback: (bounds) =>
-                                          LinearGradient(
-                                        colors: [
-                                          Colors.white,
-                                          Colors.transparent,
-                                        ],
-                                        stops: [item.percent, item.percent],
-                                      ).createShader(bounds),
-                                      child: FittedBox(
-                                        fit: BoxFit.scaleDown,
-                                        child: Text.rich(
-                                          TextSpan(
-                                            text: item.percentText,
-                                            children: [
-                                              if (item.recvJobRes)
-                                                TextSpan(
-                                                  text:
-                                                      ' ${readableFileSize(item.speed)}/s',
-                                                  style: TextStyle(
-                                                    fontSize: 12,
-                                                    fontWeight: FontWeight.w300,
-                                                    color: MyTheme.darkGray,
-                                                  ),
-                                                ),
-                                            ],
-                                          ),
-                                        ),
-                                      ),
-                                    ),
-                                  ),
+                                  center: Text(item.percentText),
                                   barRadius: Radius.circular(15),
                                   percent: item.percent,
                                   progressColor: MyTheme.accent,
@@ -1126,7 +1094,6 @@ class _FileManagerViewState extends State<FileManagerView> {
                 return element.name.contains(_searchText.value);
               }).toList(growable: false)
             : entries;
-        // Keep rows lazy so large directories only build visible list items.
         final rows = filteredEntries.map((entry) {
           final sizeStr =
               entry.isFile ? readableFileSize(entry.size.toDouble()) : "";
@@ -1309,7 +1276,7 @@ class _FileManagerViewState extends State<FileManagerView> {
                   ],
                 ))),
           );
-        });
+        }).toList(growable: false);
 
         return Column(
           children: [
@@ -1325,7 +1292,7 @@ class _FileManagerViewState extends State<FileManagerView> {
                 controller: scrollController,
                 itemExtent: kDesktopFileTransferRowHeight,
                 itemBuilder: (context, index) {
-                  return rows.elementAt(index);
+                  return rows[index];
                 },
                 itemCount: rows.length,
               ),

flutter/lib/desktop/pages/install_page.dart

@@ -65,7 +65,7 @@ class _InstallPageBodyState extends State<_InstallPageBody>
   late final TextEditingController controller;
   final RxBool startmenu = true.obs;
   final RxBool desktopicon = true.obs;
-  final RxBool printer = false.obs;
+  final RxBool printer = true.obs;
   final RxBool showProgress = false.obs;
   final RxBool btnEnabled = true.obs;
 
@@ -80,7 +80,7 @@ class _InstallPageBodyState extends State<_InstallPageBody>
     final installOptions = jsonDecode(bind.installInstallOptions());
     startmenu.value = installOptions['STARTMENUSHORTCUTS'] != '0';
     desktopicon.value = installOptions['DESKTOPSHORTCUTS'] != '0';
-    printer.value = installOptions['PRINTER'] == '1';
+    printer.value = installOptions['PRINTER'] != '0';
   }
 
   @override

flutter/lib/desktop/pages/macos_full_screen_focus_recovery.dart

@@ -1,24 +0,0 @@
-class MacOSFullScreenFocusRecovery {
-  int _generation = 0;
-  int? _pendingGeneration;
-
-  int? get pendingGeneration => _pendingGeneration;
-
-  int queue() {
-    _generation += 1;
-    _pendingGeneration = _generation;
-    return _generation;
-  }
-
-  void cancel() {
-    _pendingGeneration = null;
-  }
-
-  bool isCurrent(int generation) => _pendingGeneration == generation;
-
-  bool consume(int generation) {
-    if (!isCurrent(generation)) return false;
-    _pendingGeneration = null;
-    return true;
-  }
-}

flutter/lib/desktop/pages/remote_page.dart

@@ -17,12 +17,12 @@ import '../../common/widgets/toolbar.dart';
 import '../../models/model.dart';
 import '../../models/input_model.dart';
 import '../../models/platform_model.dart';
+import '../../models/shortcut_model.dart';
 import '../../common/shared_state.dart';
 import '../../utils/image.dart';
 import '../widgets/remote_toolbar.dart';
 import '../widgets/kb_layout_type_chooser.dart';
 import '../widgets/tabbar_widget.dart';
-import 'macos_full_screen_focus_recovery.dart';
 
 import 'package:flutter_hbb/native/custom_cursor.dart'
     if (dart.library.html) 'package:flutter_hbb/web/custom_cursor.dart';
@@ -65,13 +65,6 @@ class RemotePage extends StatefulWidget {
 
   FFI get ffi => (_lastState.value! as _RemotePageState)._ffi;
 
-  void releaseMacOSInputForTabTransfer() {
-    if (!isMacOS) return;
-    // Release before removing the source tab. Its delayed disposal must not
-    // disable a native keyboard hook already acquired by the destination page.
-    (_lastState.value! as _RemotePageState)._releaseMacOSRemoteInput();
-  }
-
   @override
   State<RemotePage> createState() {
     final state = _RemotePageState(id);
@@ -84,28 +77,10 @@ class _RemotePageState extends State<RemotePage>
     with
         AutomaticKeepAliveClientMixin,
         MultiWindowListener,
-        WidgetsBindingObserver,
         TickerProviderStateMixin {
   Timer? _timer;
   String keyboardMode = "legacy";
   bool _isWindowBlur = false;
-  // Known macOS remote-input trade-offs (kept simple intentionally):
-  // 1. Dialogs rely on FocusNode loss plus middleBlocked, not mirrored dialog
-  //    state. Reproduce: activate remote input, open a dialog, then type.
-  // 2. Delayed fullscreen recovery can race a local-control focus change; no
-  //    owner state is added. Reproduce: focus the toolbar during a Space switch.
-  // 3. Input-source switching releases native input without updating this
-  //    page's cache. Reproduce: switch sources, then type before and after
-  //    clicking the remote image; the click reasserts input.
-  // These latches compensate for out-of-order macOS focus events. Treat them
-  // as coupled when changing a transition or _syncMacOSKeyboardGrab().
-  AppLifecycleState? _macOSLifecycleState;
-  bool _macOSLocalFocusLost = false;
-  bool _macOSInputActive = false;
-  bool _macOSInputSuppressed = false;
-  final _macOSFullScreenFocusRecovery = MacOSFullScreenFocusRecovery();
-  bool _macOSExplicitFocusRequestPending = false;
-  StreamSubscription<DesktopTabState>? _tabStateSubscription;
   final _cursorOverImage = false.obs;
   late RxBool _showRemoteCursor;
   late RxBool _zoomCursor;
@@ -127,9 +102,6 @@ class _RemotePageState extends State<RemotePage>
   Function(bool)? _onEnterOrLeaveImage4Toolbar;
 
   late FFI _ffi;
-  Worker? _waylandKeyboardModeWorker;
-  bool _waylandKeyboardModeNormalized = false;
-  bool _waylandKeyboardModeNormalizing = false;
 
   SessionID get sessionId => _ffi.sessionId;
 
@@ -148,13 +120,6 @@ class _RemotePageState extends State<RemotePage>
   void initState() {
     super.initState();
     _ffi = FFI(widget.sessionId);
-    if (isMacOS) {
-      // SchedulerBinding.instance.lifecycleState is null in the first connection in a new window.
-      _macOSLifecycleState = SchedulerBinding.instance.lifecycleState;
-      WidgetsBinding.instance.addObserver(this);
-      _tabStateSubscription =
-          widget.tabController?.state.listen(_onMacOSTabStateChanged);
-    }
     Get.put<FFI>(_ffi, tag: widget.id);
     _ffi.imageModel.addCallbackOnFirstImage((String peerId) {
       _ffi.canvasModel.activateLocalCursor();
@@ -162,6 +127,18 @@ class _RemotePageState extends State<RemotePage>
           _ffi.ffiModel.pi.platform, _ffi.dialogManager);
       _ffi.recordingModel
           .updateStatus(bind.sessionGetIsRecording(sessionId: _ffi.sessionId));
+      // Seed shortcut action callbacks once the session is ready, so that
+      // global keyboard shortcuts work even if the user never opens the
+      // toolbar menu. The returned list is intentionally discarded — the
+      // side effect of registering callbacks (inside toolbarControls) is
+      // what we want here.
+      if (mounted) {
+        toolbarControls(context, widget.id, _ffi);
+        registerSessionShortcutActions(_ffi,
+            tabController: widget.tabController,
+            toolbarState: widget.toolbarState);
+        registerToolbarShortcuts(context, widget.id, _ffi);
+      }
     });
     _ffi.canvasModel.initializeEdgeScrollFallback(this);
     _ffi.start(
@@ -182,6 +159,7 @@ class _RemotePageState extends State<RemotePage>
     WakelockManager.enable(_uniqueKey);
 
     _ffi.ffiModel.updateEventListener(sessionId, widget.id);
+    if (!isWeb) bind.pluginSyncUi(syncTo: kAppTypeDesktopRemote);
     _ffi.qualityMonitorModel.checkShowQualityMonitor(sessionId);
     _ffi.dialogManager.loadMobileActionsOverlayVisible();
     WidgetsBinding.instance.addPostFrameCallback((_) {
@@ -213,48 +191,6 @@ class _RemotePageState extends State<RemotePage>
     // Register callback to cancel debounce timer when relative mouse mode is disabled
     _ffi.inputModel.onRelativeMouseModeDisabled =
         _cancelPointerLockCenterDebounceTimer;
-
-    _waylandKeyboardModeWorker = ever(_ffi.ffiModel.pi.isSet, (bool isSet) {
-      if (isSet) {
-        unawaited(_normalizeWaylandKeyboardModeIfNeeded());
-      }
-    });
-    if (_ffi.ffiModel.pi.isSet.value) {
-      unawaited(_normalizeWaylandKeyboardModeIfNeeded());
-    }
-  }
-
-  Future<void> _normalizeWaylandKeyboardModeIfNeeded() async {
-    if (!mounted ||
-        _waylandKeyboardModeNormalized ||
-        _waylandKeyboardModeNormalizing) {
-      return;
-    }
-    _waylandKeyboardModeNormalizing = true;
-    try {
-      final pi = _ffi.ffiModel.pi;
-      if (pi.platform != kPeerPlatformLinux || !pi.isWayland) return;
-      final mapSupported = bind.sessionIsKeyboardModeSupported(
-          sessionId: sessionId, mode: kKeyMapMode);
-      if (!mapSupported) return;
-      final current = await bind.sessionGetKeyboardMode(sessionId: sessionId);
-      if (!mounted) return;
-      if (current == kKeyMapMode) {
-        _waylandKeyboardModeNormalized = true;
-        return;
-      }
-      await bind.sessionSetKeyboardMode(
-          sessionId: sessionId, value: kKeyMapMode);
-      if (!mounted) return;
-      await _ffi.inputModel.updateKeyboardMode();
-      if (!mounted) return;
-      _waylandKeyboardModeNormalized = true;
-    } catch (e, st) {
-      debugPrint('Failed to normalize Wayland keyboard mode: $e');
-      debugPrintStack(stackTrace: st);
-    } finally {
-      _waylandKeyboardModeNormalizing = false;
-    }
   }
 
   /// Cancel the pointer lock center debounce timer
@@ -263,229 +199,19 @@ class _RemotePageState extends State<RemotePage>
     _pointerLockCenterDebounceTimer = null;
   }
 
-  bool get _isSelectedTab {
-    final controller = widget.tabController;
-    if (controller == null) return true;
-    final tabState = controller.state.value;
-    final selected = tabState.selected;
-    return selected >= 0 &&
-        selected < tabState.tabs.length &&
-        tabState.tabs[selected].key == widget.id;
-  }
-
-  // Every Windows requestFocus() must pass this, or a blocking dialog or an
-  // inactive tab could hand remote input to this page.
-  bool get _windowsCanFocusRemoteInput =>
-      _isSelectedTab && _blockableOverlayState.middleBlocked.isFalse;
-
-  bool get _isMacOSKeyboardContextActive {
-    return stateGlobal.isFocused.value && !_isWindowBlur && _isSelectedTab;
-  }
-
-  void _onMacOSTabStateChanged(DesktopTabState _) {
-    if (!_isSelectedTab) {
-      _macOSFullScreenFocusRecovery.cancel();
-      _syncMacOSKeyboardGrab();
-      return;
-    }
-    // Tab listeners run synchronously. Defer the selected page so the previous
-    // page releases first; a late leave from it can disable the new session.
-    scheduleMicrotask(() {
-      if (mounted) {
-        _syncMacOSKeyboardGrab(reassert: true);
-      }
-    });
-  }
-
-  void _releaseMacOSRemoteInput() {
-    _macOSFullScreenFocusRecovery.cancel();
-    _macOSExplicitFocusRequestPending = false;
-    _macOSInputSuppressed = true;
-    _macOSLocalFocusLost = true;
-    _ffi.inputModel.enterOrLeave(false);
-    _macOSInputActive = false;
-    _rawKeyFocusNode.unfocus();
-  }
-
-  void _onMacOSFocusChange() {
-    // requestFocus() notifies later; only a recorded explicit request may clear
-    // the local-focus-loss latch.
-    if (_rawKeyFocusNode.hasPrimaryFocus) {
-      final explicitRequest = _macOSExplicitFocusRequestPending;
-      _macOSExplicitFocusRequestPending = false;
-      if (explicitRequest && _isMacOSKeyboardContextActive) {
-        _macOSLocalFocusLost = false;
-      }
-      _syncMacOSKeyboardGrab(allowInactiveLifecycle: explicitRequest);
-    } else {
-      if (_macOSInputActive) {
-        _ffi.inputModel.enterOrLeave(false);
-        _macOSInputActive = false;
-      }
-      if (_isMacOSKeyboardContextActive) {
-        _macOSLocalFocusLost = true;
-      }
-    }
-  }
-
-  // 1. Sync the keyboard grab state with the current context.
-  // 2. Call enterOrLeave() to update the input state in the FFI layer.
-  // 3. Request or unfocus the raw key focus node based on the current context.
-  // Flutter focus and native input are separate; native input activates only
-  // after the FocusNode has primary focus.
-  void _syncMacOSKeyboardGrab({
-    bool reassert = false,
-    bool allowInactiveLifecycle = false,
-  }) {
-    if (!isMacOS) return;
-    // A secondary engine may stay hidden while its window is visible, so
-    // explicit pointer/fullscreen recovery must bypass the global lifecycle.
-    final lifecycleAllowsInput = allowInactiveLifecycle ||
-        _macOSLifecycleState == null ||
-        _macOSLifecycleState == AppLifecycleState.resumed;
-    // Input stays pointer-gated except for focused fullscreen recovery, which
-    // compensates when macOS omits PointerEnter during a Space switch.
-    final shouldFocus = lifecycleAllowsInput &&
-        _isMacOSKeyboardContextActive &&
-        !_macOSInputSuppressed &&
-        _blockableOverlayState.middleBlocked.isFalse &&
-        _cursorOverImage.value &&
-        !_macOSLocalFocusLost;
-    final hasFocus = _rawKeyFocusNode.hasPrimaryFocus;
-    final shouldActivateInput = shouldFocus && hasFocus;
-
-    if (shouldActivateInput != _macOSInputActive ||
-        (shouldActivateInput && reassert)) {
-      _ffi.inputModel.enterOrLeave(shouldActivateInput);
-    }
-    _macOSInputActive = shouldActivateInput;
-
-    if (!shouldFocus) {
-      _macOSExplicitFocusRequestPending = false;
-      if (hasFocus) _rawKeyFocusNode.unfocus();
-    } else if (!hasFocus) {
-      _macOSExplicitFocusRequestPending = allowInactiveLifecycle;
-      _rawKeyFocusNode.requestFocus();
-    } else {
-      _macOSExplicitFocusRequestPending = false;
-    }
-  }
-
-  void _restoreMacOSKeyboardAfterFullScreen({
-    required int generation,
-    bool allowHiddenLifecycle = false,
-  }) {
-    // Fullscreen callbacks preserve recovery while hidden. Native window focus
-    // may bypass a stale hidden lifecycle for the newly visible Space.
-    if (!_macOSFullScreenFocusRecovery.isCurrent(generation) ||
-        (!allowHiddenLifecycle &&
-            _macOSLifecycleState == AppLifecycleState.hidden)) {
-      return;
-    }
-    final contextActive =
-        stateGlobal.isFocused.value && !_isWindowBlur && _isSelectedTab;
-    // macOS can focus a fullscreen Space without sending PointerEnter. Native
-    // window focus is authoritative here; a later blur cancels this generation
-    // before an off-screen window can restore input.
-    final shouldInferPointerInside = !_cursorOverImage.value &&
-        allowHiddenLifecycle &&
-        stateGlobal.fullscreen.isTrue &&
-        contextActive;
-    final canRestore = contextActive &&
-        _blockableOverlayState.middleBlocked.isFalse &&
-        (_cursorOverImage.value || shouldInferPointerInside);
-    if (!_macOSFullScreenFocusRecovery.consume(generation)) return;
-    if (!canRestore) {
-      // Consuming recovery here requires a later pointer/window/tab event.
-      return;
-    }
-    if (shouldInferPointerInside) {
-      _cursorOverImage.value = true;
-    }
-    _macOSLocalFocusLost = false;
-    stateGlobal.getInputSource(force: true);
-    _syncMacOSKeyboardGrab(reassert: true, allowInactiveLifecycle: true);
-  }
-
-  void _scheduleMacOSKeyboardAfterFullScreen({
-    required int generation,
-    bool allowHiddenLifecycle = false,
-  }) {
-    // Fullscreen can deliver FocusNode loss after its callback; wait for frame
-    // completion and then advance one event-loop turn before restoring.
-    WidgetsBinding.instance.addPostFrameCallback((_) {
-      Timer.run(() {
-        if (mounted) {
-          _restoreMacOSKeyboardAfterFullScreen(
-            generation: generation,
-            allowHiddenLifecycle: allowHiddenLifecycle,
-          );
-        }
-      });
-    });
-    WidgetsBinding.instance.ensureVisualUpdate();
-  }
-
-  void _queueMacOSKeyboardAfterFullScreen({
-    bool allowHiddenLifecycle = false,
-  }) {
-    final generation = _macOSFullScreenFocusRecovery.queue();
-    if (_macOSLifecycleState == AppLifecycleState.paused ||
-        _macOSLifecycleState == AppLifecycleState.detached) {
-      _macOSFullScreenFocusRecovery.cancel();
-      return;
-    }
-    _scheduleMacOSKeyboardAfterFullScreen(
-      generation: generation,
-      allowHiddenLifecycle: allowHiddenLifecycle,
-    );
-  }
-
-  @override
-  void didChangeAppLifecycleState(AppLifecycleState state) {
-    super.didChangeAppLifecycleState(state);
-    if (!isMacOS || _macOSLifecycleState == state) return;
-    _macOSLifecycleState = state;
-    if (state == AppLifecycleState.resumed) {
-      _syncMacOSKeyboardGrab(reassert: true);
-    } else if (_macOSInputActive) {
-      _ffi.inputModel.enterOrLeave(false);
-      _macOSInputActive = false;
-    }
-
-    final generation = _macOSFullScreenFocusRecovery.pendingGeneration;
-    if (generation == null) return;
-    if (state == AppLifecycleState.inactive ||
-        state == AppLifecycleState.resumed) {
-      _scheduleMacOSKeyboardAfterFullScreen(generation: generation);
-    } else if (state == AppLifecycleState.paused ||
-        state == AppLifecycleState.detached) {
-      _macOSFullScreenFocusRecovery.cancel();
-    }
-  }
-
   @override
   void onWindowBlur() {
     super.onWindowBlur();
     // On windows, we use `focus` way to handle keyboard better.
     // Now on Linux, there's some rdev issues which will break the input.
-    // We disable the `focus` way for Linux temporarily.
-    if (isWindows || isMacOS) {
-      _isWindowBlur = true;
-    }
-    if (isMacOS) {
-      _macOSFullScreenFocusRecovery.cancel();
-      // A blur or Space switch may not emit PointerExit, so cursor state alone
-      // cannot prevent the old remote surface from reclaiming the keyboard.
-      _macOSLocalFocusLost = true;
-    }
+    // We disable the `focus` way for non-Windows temporarily.
     if (isWindows) {
+      _isWindowBlur = true;
       // unfocus the primary-focus when the whole window is lost focus,
       // and let OS to handle events instead.
       _rawKeyFocusNode.unfocus();
     }
     stateGlobal.isFocused.value = false;
-    _syncMacOSKeyboardGrab();
 
     // When window loses focus, temporarily release relative mouse mode constraints
     // to allow user to interact with other applications normally.
@@ -499,50 +225,16 @@ class _RemotePageState extends State<RemotePage>
   void onWindowFocus() {
     super.onWindowFocus();
     // See [onWindowBlur].
-    if (isWindows || isMacOS) {
+    if (isWindows) {
       _isWindowBlur = false;
     }
-    if (isMacOS) stateGlobal.getInputSource(force: true);
     stateGlobal.isFocused.value = true;
 
-    // Normal macOS windows wait for PointerEnter or PointerDown. A focused
-    // fullscreen Space queues delayed recovery; if this window blurs again, the
-    // pending recovery is cancelled before native input can reactivate.
-    // Regression: switch directly between fullscreen remote Spaces without
-    // moving or clicking; only the newly focused session may receive input.
-    if (isMacOS &&
-        stateGlobal.fullscreen.isTrue &&
-        !_ffi.inputModel.relativeMouseMode.value) {
-      // Native window focus is authoritative when a secondary engine retains a
-      // stale hidden lifecycle state after its fullscreen Space becomes visible.
-      _queueMacOSKeyboardAfterFullScreen(allowHiddenLifecycle: true);
-    }
-
-    // Refocus without PointerEnter: the cursor already hovers the image when
-    // focus returns (Alt+Tab, taskbar), so enterView() never fires again.
-    if (isWindows &&
-        _cursorOverImage.value &&
-        _windowsCanFocusRemoteInput &&
-        !_rawKeyFocusNode.hasFocus) {
-      _rawKeyFocusNode.requestFocus();
-    }
-
     // Restore relative mouse mode constraints when window regains focus.
     if (_ffi.inputModel.relativeMouseMode.value) {
-      if (isMacOS) {
-        // Native relative mode retains pointer capture and does not emit
-        // PointerEnter after window focus returns. Restore both latches unless
-        // a local overlay still owns input.
-        if (_blockableOverlayState.middleBlocked.isFalse) {
-          _cursorOverImage.value = true;
-          _macOSLocalFocusLost = false;
-        }
-      } else if (!isWindows || _windowsCanFocusRemoteInput) {
-        _rawKeyFocusNode.requestFocus();
-      }
+      _rawKeyFocusNode.requestFocus();
       _ffi.inputModel.onWindowFocus();
     }
-    _syncMacOSKeyboardGrab(reassert: true, allowInactiveLifecycle: true);
   }
 
   @override
@@ -603,13 +295,6 @@ class _RemotePageState extends State<RemotePage>
   void onWindowMinimize() {
     super.onWindowMinimize();
     WakelockManager.disable(_uniqueKey);
-    if (isMacOS) {
-      _macOSFullScreenFocusRecovery.cancel();
-      _isWindowBlur = true;
-      _cursorOverImage.value = false;
-      stateGlobal.isFocused.value = false;
-      _syncMacOSKeyboardGrab();
-    }
     // Release cursor constraints when minimized
     if (_ffi.inputModel.relativeMouseMode.value) {
       _ffi.inputModel.onWindowBlur();
@@ -621,7 +306,6 @@ class _RemotePageState extends State<RemotePage>
     super.onWindowEnterFullScreen();
     if (isMacOS) {
       stateGlobal.setFullscreen(true);
-      _queueMacOSKeyboardAfterFullScreen();
     }
   }
 
@@ -630,7 +314,6 @@ class _RemotePageState extends State<RemotePage>
     super.onWindowLeaveFullScreen();
     if (isMacOS) {
       stateGlobal.setFullscreen(false);
-      _queueMacOSKeyboardAfterFullScreen();
     }
   }
 
@@ -639,14 +322,6 @@ class _RemotePageState extends State<RemotePage>
     final closeSession = closeSessionOnDispose.remove(widget.id) ?? true;
 
     // https://github.com/flutter/flutter/issues/64935
-    if (isMacOS) {
-      // Tab moves release before transfer to avoid a late retained-session leave.
-      if (closeSession) {
-        _releaseMacOSRemoteInput();
-      }
-      _tabStateSubscription?.cancel();
-      WidgetsBinding.instance.removeObserver(this);
-    }
     super.dispose();
     debugPrint("REMOTE PAGE dispose session $sessionId ${widget.id}");
 
@@ -656,14 +331,12 @@ class _RemotePageState extends State<RemotePage>
 
     _pointerLockCenterDebounceTimer?.cancel();
     _pointerLockCenterDebounceTimer = null;
-    _waylandKeyboardModeWorker?.dispose();
     // Clear callback reference to prevent memory leaks and stale references
     _ffi.inputModel.onRelativeMouseModeDisabled = null;
     // Relative mouse mode cleanup is centralized in FFI.close(closeSession: ...).
     _ffi.textureModel.onRemotePageDispose(closeSession);
-    if (closeSession && !isMacOS) {
+    if (closeSession) {
       // ensure we leave this session, this is a double check
-      // enterOrLeave() is already called previously in _releaseMacOSRemoteInput() for macOS.
       _ffi.inputModel.enterOrLeave(false);
     }
     DesktopMultiWindow.removeListener(this);
@@ -671,9 +344,6 @@ class _RemotePageState extends State<RemotePage>
     _ffi.imageModel.disposeImage();
     _ffi.cursorModel.disposeImages();
     _rawKeyFocusNode.dispose();
-    if (closeSession) {
-      clearWaylandKeyboardPromptSuppressedForConnection(sessionId.toString());
-    }
     await _ffi.close(closeSession: closeSession);
     _timer?.cancel();
     _ffi.dialogManager.dismissAll();
@@ -738,8 +408,6 @@ class _RemotePageState extends State<RemotePage>
                       } else {
                         _ffi.inputModel.enterOrLeave(false);
                       }
-                    } else if (isMacOS) {
-                      _onMacOSFocusChange();
                     }
                   },
                   inputModel: _ffi.inputModel,
@@ -845,20 +513,7 @@ class _RemotePageState extends State<RemotePage>
     }
 
     // See [onWindowBlur].
-    if (isMacOS) {
-      _macOSLocalFocusLost = false;
-      stateGlobal.getInputSource(force: true);
-      _syncMacOSKeyboardGrab(reassert: true, allowInactiveLifecycle: true);
-    } else if (isWindows) {
-      // Blur unfocuses this node and nothing restores it, so the keyboard stayed
-      // dead until a click. Focus only while the window is really active, or a
-      // background window would grab system keys. onFocusChange does enterOrLeave.
-      if (!_isWindowBlur &&
-          _windowsCanFocusRemoteInput &&
-          !_rawKeyFocusNode.hasFocus) {
-        _rawKeyFocusNode.requestFocus();
-      }
-    } else {
+    if (!isWindows) {
       if (!_rawKeyFocusNode.hasFocus) {
         _rawKeyFocusNode.requestFocus();
       }
@@ -884,9 +539,7 @@ class _RemotePageState extends State<RemotePage>
     }
 
     // See [onWindowBlur].
-    if (isMacOS) {
-      _syncMacOSKeyboardGrab();
-    } else if (!isWindows) {
+    if (!isWindows) {
       _ffi.inputModel.enterOrLeave(false);
     }
   }
@@ -911,29 +564,17 @@ class _RemotePageState extends State<RemotePage>
       onEnter: onEnter,
       onExit: onExit,
       onPointerDown: (event) {
-        // A double check for blur status on Windows and macOS.
+        // A double check for blur status.
         // Note: If there's an `onPointerDown` event is triggered, `_isWindowBlur` is expected being false.
         // Sometimes the system does not send the necessary focus event to flutter. We should manually
         // handle this inconsistent status by setting `_isWindowBlur` to false. So we can
         // ensure the grab-key thread is running when our users are clicking the remote canvas.
-        if ((isWindows || isMacOS) && _isWindowBlur) {
+        if (_isWindowBlur) {
           debugPrint(
               "Unexpected status: onPointerDown is triggered while the remote window is in blur status");
           _isWindowBlur = false;
         }
-        if (isMacOS) {
-          // Regions without matching enter/exit callbacks cannot safely own
-          // keyboard state.
-          if (onEnter == null || onExit == null) return;
-          if (!stateGlobal.isFocused.value) {
-            stateGlobal.isFocused.value = true;
-          }
-          _cursorOverImage.value = true;
-          _macOSLocalFocusLost = false;
-          stateGlobal.getInputSource(force: true);
-          _syncMacOSKeyboardGrab(
-              reassert: !isInputSourceFlutter, allowInactiveLifecycle: true);
-        } else if (!_rawKeyFocusNode.hasFocus) {
+        if (!_rawKeyFocusNode.hasFocus) {
           _rawKeyFocusNode.requestFocus();
         }
       },

flutter/lib/desktop/pages/remote_tab_page.dart

@@ -513,17 +513,15 @@ class _ConnectionTabPageState extends State<ConnectionTabPage> {
       final args = jsonDecode(call.arguments);
       final id = args['id'];
       final close = args['close'];
-      RemotePage? remotePage;
       try {
-        remotePage = tabController.state.value.tabs
+        final remotePage = tabController.state.value.tabs
             .firstWhere((tab) => tab.key == id)
             .page as RemotePage;
         returnValue = remotePage.ffi.ffiModel.cachedPeerData.toString();
       } catch (e) {
         debugPrint('Failed to get cached session data: $e');
       }
-      if (close && returnValue != null && remotePage != null) {
-        remotePage.releaseMacOSInputForTabTransfer();
+      if (close && returnValue != null) {
         closeSessionOnDispose[id] = false;
         tabController.closeBy(id);
       }

flutter/lib/desktop/pages/server_page.dart

@@ -22,14 +22,6 @@ import '../../models/file_model.dart';
 import '../../models/platform_model.dart';
 import '../../models/server_model.dart';
 
-/// Set only by this window's own close control, and only once the user has confirmed. Any other
-/// way the window can go - a session logout closing every window, the window manager, a native
-/// title-bar button this app does not draw - leaves it false, which is the honest answer:
-/// nothing in that close says who asked for it. It lives at file scope because the control that
-/// sets it (`ConnectionManagerState`) and the handler that reads it (`_DesktopServerPageState`)
-/// are different widgets.
-bool _cmClosedByOperator = false;
-
 class DesktopServerPage extends StatefulWidget {
   const DesktopServerPage({Key? key}) : super(key: key);
 
@@ -63,10 +55,7 @@ class _DesktopServerPageState extends State<DesktopServerPage>
 
   @override
   void onWindowClose() {
-    // Other platforms keep the old behaviour exactly: the ambiguity this guards against is a
-    // Linux session logout, which closes every window in the session.
-    final byOperator = _cmClosedByOperator || !isLinux;
-    Future.wait([gFFI.serverModel.closeAll(byOperator: byOperator), gFFI.close()]).then((_) {
+    Future.wait([gFFI.serverModel.closeAll(), gFFI.close()]).then((_) {
       if (isMacOS) {
         RdPlatformChannel.instance.terminate();
       } else {
@@ -338,7 +327,6 @@ class ConnectionManagerState extends State<ConnectionManager>
     var tabController = gFFI.serverModel.tabController;
     final connLength = tabController.length;
     if (connLength <= 1) {
-      _cmClosedByOperator = true;
       windowManager.close();
       return true;
     } else {
@@ -350,9 +338,6 @@ class ConnectionManagerState extends State<ConnectionManager>
         res = await closeConfirmDialog();
       }
       if (res) {
-        // After the dialog, never before it: an external close while it is open must not
-        // inherit an intent the user had not expressed yet.
-        _cmClosedByOperator = true;
         windowManager.close();
       }
       return res;
@@ -510,14 +495,14 @@ class _CmHeaderState extends State<_CmHeader>
                 if (client.type_() == ClientType.file)
                   FittedBox(
                     child: Text(
-                      translate("Transfer file"),
+                      translate("File Transfer"),
                       style: TextStyle(color: Colors.white70, fontSize: 12),
                     ),
                   ),
                 if (client.type_() == ClientType.camera)
                   FittedBox(
                     child: Text(
-                      translate("View camera"),
+                      translate("View Camera"),
                       style: TextStyle(color: Colors.white70, fontSize: 12),
                     ),
                   ),
@@ -625,24 +610,19 @@ class _PrivilegeBoard extends StatefulWidget {
 class _PrivilegeBoardState extends State<_PrivilegeBoard> {
   late final client = widget.client;
   Widget buildPermissionIcon(bool enabled, IconData iconData,
-      Function(bool)? onTap, String tooltipText,
-      {required bool canModify}) {
+      Function(bool)? onTap, String tooltipText) {
     return Tooltip(
       message: "$tooltipText: ${enabled ? "ON" : "OFF"}",
       waitDuration: Duration.zero,
       child: Container(
         decoration: BoxDecoration(
-          color: enabled
-              ? (canModify ? MyTheme.accent : MyTheme.accent.withOpacity(0.6))
-              : Colors.grey[700],
+          color: enabled ? MyTheme.accent : Colors.grey[700],
           borderRadius: BorderRadius.circular(10.0),
         ),
         padding: EdgeInsets.all(8.0),
         child: InkWell(
-          onTap: canModify
-              ? () =>
-                  checkClickTime(widget.client.id, () => onTap?.call(!enabled))
-              : null,
+          onTap: () =>
+              checkClickTime(widget.client.id, () => onTap?.call(!enabled)),
           child: Column(
             mainAxisAlignment: MainAxisAlignment.spaceAround,
             children: [
@@ -663,9 +643,6 @@ class _PrivilegeBoardState extends State<_PrivilegeBoard> {
   Widget build(BuildContext context) {
     final crossAxisCount = 4;
     final spacing = 10.0;
-    final canModifyPermission =
-        bind.mainGetBuildinOption(key: kOptionEnablePermChangeInAcceptWindow) !=
-            'N';
     return Container(
       width: double.infinity,
       height: 160.0,
@@ -712,7 +689,6 @@ class _PrivilegeBoardState extends State<_PrivilegeBoard> {
                           });
                         },
                         translate('Enable audio'),
-                        canModify: canModifyPermission,
                       ),
                       buildPermissionIcon(
                         client.recording,
@@ -727,7 +703,6 @@ class _PrivilegeBoardState extends State<_PrivilegeBoard> {
                           });
                         },
                         translate('Enable recording session'),
-                        canModify: canModifyPermission,
                       ),
                     ]
                   : [
@@ -744,7 +719,6 @@ class _PrivilegeBoardState extends State<_PrivilegeBoard> {
                           });
                         },
                         translate('Enable keyboard/mouse'),
-                        canModify: canModifyPermission,
                       ),
                       buildPermissionIcon(
                         client.clipboard,
@@ -759,7 +733,6 @@ class _PrivilegeBoardState extends State<_PrivilegeBoard> {
                           });
                         },
                         translate('Enable clipboard'),
-                        canModify: canModifyPermission,
                       ),
                       buildPermissionIcon(
                         client.audio,
@@ -774,7 +747,6 @@ class _PrivilegeBoardState extends State<_PrivilegeBoard> {
                           });
                         },
                         translate('Enable audio'),
-                        canModify: canModifyPermission,
                       ),
                       buildPermissionIcon(
                         client.file,
@@ -789,7 +761,6 @@ class _PrivilegeBoardState extends State<_PrivilegeBoard> {
                           });
                         },
                         translate('Enable file copy and paste'),
-                        canModify: canModifyPermission,
                       ),
                       buildPermissionIcon(
                         client.restart,
@@ -804,7 +775,6 @@ class _PrivilegeBoardState extends State<_PrivilegeBoard> {
                           });
                         },
                         translate('Enable remote restart'),
-                        canModify: canModifyPermission,
                       ),
                       buildPermissionIcon(
                         client.recording,
@@ -819,7 +789,6 @@ class _PrivilegeBoardState extends State<_PrivilegeBoard> {
                           });
                         },
                         translate('Enable recording session'),
-                        canModify: canModifyPermission,
                       ),
                       // only windows support block input
                       if (isWindows)
@@ -836,23 +805,6 @@ class _PrivilegeBoardState extends State<_PrivilegeBoard> {
                             });
                           },
                           translate('Enable blocking user input'),
-                          canModify: canModifyPermission,
-                        ),
-                      if (bind.mainSupportedPrivacyModeImpls() != '[]')
-                        buildPermissionIcon(
-                          client.privacyMode,
-                          Icons.visibility_off,
-                          (enabled) {
-                            bind.cmSwitchPermission(
-                                connId: client.id,
-                                name: "privacy_mode",
-                                enabled: enabled);
-                            setState(() {
-                              client.privacyMode = enabled;
-                            });
-                          },
-                          translate('Enable privacy mode'),
-                          canModify: canModifyPermission,
                         )
                     ],
             ),

flutter/lib/desktop/pages/terminal_page.dart

@@ -5,7 +5,7 @@ import 'package:flutter_hbb/common.dart';
 import 'package:flutter_hbb/desktop/widgets/tabbar_widget.dart';
 import 'package:flutter_hbb/models/model.dart';
 import 'package:flutter_hbb/models/terminal_model.dart';
-import 'package:flutter_hbb/models/terminal_mouse_handler.dart';
+import 'package:xterm/xterm.dart';
 import 'terminal_connection_manager.dart';
 
 class TerminalPage extends StatefulWidget {
@@ -19,8 +19,6 @@ class TerminalPage extends StatefulWidget {
     required this.tabKey,
     this.forceRelay,
     this.connToken,
-    this.onClipboardWriteBlocked,
-    this.onClipboardWriteSucceeded,
   }) : super(key: key);
   final String id;
   final String? password;
@@ -28,10 +26,7 @@ class TerminalPage extends StatefulWidget {
   final bool? forceRelay;
   final bool? isSharedPassword;
   final String? connToken;
-  final ValueChanged<String>? onClipboardWriteBlocked;
-  final ValueChanged<String>? onClipboardWriteSucceeded;
   final int terminalId;
-
   /// Tab key for focus management, passed from parent to avoid duplicate construction
   final String tabKey;
   final SimpleWrapper<State<TerminalPage>?> _lastState = SimpleWrapper(null);
@@ -48,9 +43,6 @@ class TerminalPage extends StatefulWidget {
 
 class _TerminalPageState extends State<TerminalPage>
     with AutomaticKeepAliveClientMixin {
-  static const EdgeInsets _defaultTerminalPadding =
-      EdgeInsets.symmetric(horizontal: 5.0, vertical: 2.0);
-
   late FFI _ffi;
   late TerminalModel _terminalModel;
   double? _cellHeight;
@@ -75,8 +67,6 @@ class _TerminalPageState extends State<TerminalPage>
 
     // Create terminal model with specific terminal ID
     _terminalModel = TerminalModel(_ffi, widget.terminalId);
-    _terminalModel.onClipboardWriteBlocked = widget.onClipboardWriteBlocked;
-    _terminalModel.onClipboardWriteSucceeded = widget.onClipboardWriteSucceeded;
     debugPrint(
         '[TerminalPage] Terminal model created for terminal ${widget.terminalId}');
 
@@ -101,13 +91,6 @@ class _TerminalPageState extends State<TerminalPage>
     // Register this terminal model with FFI for event routing
     _ffi.registerTerminalModel(widget.terminalId, _terminalModel);
 
-    // Auto-close tab when shell exits
-    _terminalModel.onClosed = () {
-      if (mounted) {
-        widget.tabController.closeBy(widget.tabKey);
-      }
-    };
-
     // Initialize terminal connection
     WidgetsBinding.instance.addPostFrameCallback((_) {
       widget.tabController.onSelected?.call(widget.id);
@@ -172,27 +155,13 @@ class _TerminalPageState extends State<TerminalPage>
   // extra space left after dividing the available height by the height of a single
   // terminal row (`_cellHeight`) and distributing it evenly as top and bottom padding.
   EdgeInsets _calculatePadding(double heightPx) {
-    final cellHeight = _cellHeight;
-    if (!heightPx.isFinite ||
-        heightPx <= 0 ||
-        cellHeight == null ||
-        !cellHeight.isFinite ||
-        cellHeight <= 0) {
-      return _defaultTerminalPadding;
-    }
-    final rows = (heightPx / cellHeight).floor();
-    if (rows <= 0) {
-      return _defaultTerminalPadding;
-    }
-    final extraSpace = heightPx - rows * cellHeight;
-    if (!extraSpace.isFinite || extraSpace < 0) {
-      return _defaultTerminalPadding;
+    if (_cellHeight == null) {
+      return const EdgeInsets.symmetric(horizontal: 5.0, vertical: 2.0);
     }
+    final rows = (heightPx / _cellHeight!).floor();
+    final extraSpace = heightPx - rows * _cellHeight!;
     final topBottom = extraSpace / 2.0;
-    return EdgeInsets.symmetric(
-      horizontal: _defaultTerminalPadding.horizontal / 2,
-      vertical: topBottom,
-    );
+    return EdgeInsets.symmetric(horizontal: 5.0, vertical: topBottom);
   }
 
   @override
@@ -203,7 +172,7 @@ class _TerminalPageState extends State<TerminalPage>
       body: LayoutBuilder(
         builder: (context, constraints) {
           final heightPx = constraints.maxHeight;
-          return TerminalMouseInteraction(
+          return TerminalView(
             _terminalModel.terminal,
             controller: _terminalModel.terminalController,
             focusNode: _terminalFocusNode,

flutter/lib/desktop/pages/terminal_tab_page.dart

@@ -1,4 +1,3 @@
-import 'dart:async';
 import 'dart:convert';
 
 import 'package:desktop_multi_window/desktop_multi_window.dart';
@@ -11,8 +10,6 @@ import 'package:flutter_hbb/models/state_model.dart';
 import 'package:flutter_hbb/desktop/widgets/tabbar_widget.dart';
 import 'package:flutter_hbb/utils/multi_window_manager.dart';
 import 'package:flutter_hbb/models/model.dart';
-import 'package:flutter_hbb/models/terminal_copy_shortcut.dart';
-import 'package:flutter_hbb/models/terminal_model.dart';
 import 'package:get/get.dart';
 
 import '../../models/platform_model.dart';
@@ -22,12 +19,6 @@ import '../widgets/material_mod_popup_menu.dart' as mod_menu;
 import '../widgets/popup_menu.dart';
 import 'package:bot_toast/bot_toast.dart';
 
-typedef _TerminalClipboardSource = ({
-  String peerId,
-  int terminalId,
-  String tabKey,
-});
-
 class TerminalTabPage extends StatefulWidget {
   final Map<String, dynamic> params;
 
@@ -39,18 +30,6 @@ class TerminalTabPage extends StatefulWidget {
 
 class _TerminalTabPageState extends State<TerminalTabPage> {
   DesktopTabController get tabController => Get.find<DesktopTabController>();
-  bool get _canConfigureTerminalClipboardPermission =>
-      canConfigureTerminalClipboardPermission(
-        settingsDisabled: bind.isDisableSettings(),
-        optionFixed: isOptionFixed(kOptionAllowTerminalClipboardWrite),
-      );
-  bool get _canHandleTerminalClipboardWriteRequest =>
-      canHandleTerminalClipboardWriteRequest(
-        localOption: bind.mainGetLocalOption(
-          key: kOptionAllowTerminalClipboardWrite,
-        ),
-        canConfigurePermission: _canConfigureTerminalClipboardPermission,
-      );
 
   static const IconData selectedIcon = Icons.terminal;
   static const IconData unselectedIcon = Icons.terminal_outlined;
@@ -59,9 +38,6 @@ class _TerminalTabPageState extends State<TerminalTabPage> {
   final Set<String> _closingTabs = {};
   // When true, all session cleanup should persist (window-level close in progress)
   bool _windowClosing = false;
-  CancelFunc? _terminalClipboardNoticeCancel;
-  final _terminalClipboardNotice =
-      TerminalClipboardNoticeCoordinator<_TerminalClipboardSource>();
 
   _TerminalTabPageState(Map<String, dynamic> params) {
     Get.put(DesktopTabController(tabType: DesktopTabType.terminal));
@@ -69,11 +45,7 @@ class _TerminalTabPageState extends State<TerminalTabPage> {
       WindowController.fromWindowId(windowId())
           .setTitle(getWindowNameWithId(id));
     };
-    tabController.onRemoved = (_, id) {
-      _closeTerminalClipboardNoticeForTab(id);
-      onRemoveId(id);
-    };
-    tabController.onCloseWindow = _closeWindowFromConnection;
+    tabController.onRemoved = (_, id) => onRemoveId(id);
     final terminalId = params['terminalId'] ?? _nextTerminalId++;
     tabController.add(_createTerminalTab(
       peerId: params['id'],
@@ -97,11 +69,6 @@ class _TerminalTabPageState extends State<TerminalTabPage> {
     final alias = bind.mainGetPeerOptionSync(id: peerId, key: 'alias');
     final tabLabel =
         alias.isNotEmpty ? '$alias #$terminalId' : '$peerId #$terminalId';
-    final clipboardSource = (
-      peerId: peerId,
-      terminalId: terminalId,
-      tabKey: tabKey,
-    );
     return TabInfo(
       key: tabKey,
       label: tabLabel,
@@ -118,169 +85,10 @@ class _TerminalTabPageState extends State<TerminalTabPage> {
         tabController: tabController,
         forceRelay: forceRelay,
         connToken: connToken,
-        onClipboardWriteBlocked: _canHandleTerminalClipboardWriteRequest
-            ? (text) => _handleTerminalClipboardWriteBlocked(
-                  clipboardSource,
-                  text,
-                )
-            : null,
-        onClipboardWriteSucceeded: (_) {
-          _handleTerminalClipboardWriteSucceeded(clipboardSource);
-        },
       ),
     );
   }
 
-  void _handleTerminalClipboardWriteBlocked(
-    _TerminalClipboardSource source,
-    String clipboardText,
-  ) {
-    if (!mounted) return;
-    final option = bind.mainGetLocalOption(
-      key: kOptionAllowTerminalClipboardWrite,
-    );
-    final request = _terminalClipboardNotice.recordBlocked(
-      source: source,
-      text: clipboardText,
-      option: option,
-      canWrite: _canWriteTerminalClipboard,
-    );
-    if (request != null) _showTerminalClipboardNotice(request);
-  }
-
-  void _showTerminalClipboardNotice(
-    TerminalClipboardNoticeRequest<_TerminalClipboardSource> request,
-  ) {
-    _terminalClipboardNoticeCancel = BotToast.showCustomNotification(
-      duration: null,
-      enableSlideOff: false,
-      onlyOne: true,
-      onClose: _handleTerminalClipboardNoticeClosed,
-      toastBuilder: (_) => AnimatedBuilder(
-        animation: _terminalClipboardNotice,
-        builder: (_, __) => MaterialBanner(
-          leading: const Icon(Icons.content_copy_outlined),
-          content: Text(translate(kTerminalClipboardNoticeMessageKey)),
-          actions: [
-            TextButton(
-              onPressed: _terminalClipboardNotice.canClaimAction
-                  ? _handleTerminalClipboardNegativeAction
-                  : null,
-              child: Text(translate(request.negativeActionKey)),
-            ),
-            TextButton(
-              onPressed: _terminalClipboardNotice.canClaimAction
-                  ? _handleTerminalClipboardPositiveAction
-                  : null,
-              child: Text(translate(request.actionKey)),
-            ),
-          ],
-        ),
-      ),
-    );
-  }
-
-  void _handleTerminalClipboardNegativeAction() {
-    final request = _terminalClipboardNotice.claimCurrentAction();
-    if (request == null) return;
-    if (request.persistAllowed) {
-      unawaited(_declineTerminalClipboardWrite());
-    } else {
-      _closeTerminalClipboardNotice();
-    }
-  }
-
-  void _handleTerminalClipboardPositiveAction() {
-    final request = _terminalClipboardNotice.claimCurrentAction();
-    if (request == null) return;
-    unawaited(_completeTerminalClipboardWrite(request));
-  }
-
-  void _handleTerminalClipboardNoticeClosed() {
-    _terminalClipboardNoticeCancel = null;
-    _terminalClipboardNotice.noticeClosed();
-  }
-
-  bool _canWriteTerminalClipboard(
-    _TerminalClipboardSource source,
-  ) {
-    if (!_canHandleTerminalClipboardWriteRequest) return false;
-    final ffi = TerminalConnectionManager.getExistingConnection(source.peerId);
-    return ffi != null &&
-        !ffi.closed &&
-        ffi.ffiModel.permissions['clipboard'] != false &&
-        tabController.state.value.tabs.any((tab) => tab.key == source.tabKey) &&
-        ffi.terminalModels.containsKey(source.terminalId);
-  }
-
-  void _handleTerminalClipboardWriteSucceeded(
-    _TerminalClipboardSource source,
-  ) {
-    final request = _terminalClipboardNotice.currentForSource(source);
-    if (request == null) return;
-    _closeTerminalClipboardNotice();
-  }
-
-  Future<void> _declineTerminalClipboardWrite() async {
-    try {
-      await bind.mainSetLocalOption(
-        key: kOptionAllowTerminalClipboardWrite,
-        value: kTerminalClipboardWriteDenied,
-      );
-    } catch (error) {
-      debugPrint(
-          '[TerminalTabPage] Failed to save terminal clipboard permission: $error');
-      return;
-    } finally {
-      _terminalClipboardNotice.releaseAction();
-    }
-    _closeTerminalClipboardNotice();
-  }
-
-  Future<void> _completeTerminalClipboardWrite(
-    TerminalClipboardNoticeRequest<_TerminalClipboardSource> request,
-  ) async {
-    final source = request.source;
-    var completed = false;
-    try {
-      completed = await completeTerminalClipboardWrite(
-        clipboardText: request.text,
-        canWrite: () => _canWriteTerminalClipboard(source),
-        writeClipboard: writeTerminalClipboard,
-        persistAllowed: request.persistAllowed
-            ? () => bind.mainSetLocalOption(
-                  key: kOptionAllowTerminalClipboardWrite,
-                  value: kTerminalClipboardWriteAllowed,
-                )
-            : null,
-      );
-    } catch (error) {
-      debugPrint(
-          '[TerminalTabPage] Failed to complete terminal clipboard write: $error');
-    } finally {
-      _terminalClipboardNotice.releaseAction();
-    }
-    if (!completed) return;
-    _closeTerminalClipboardNotice();
-  }
-
-  void _closeTerminalClipboardNoticeForTab(String tabKey) {
-    final current = _terminalClipboardNotice.current;
-    if (current?.source.tabKey != tabKey) return;
-    _closeTerminalClipboardNotice();
-  }
-
-  void _closeTerminalClipboardNotice() {
-    if (!_terminalClipboardNotice.beginClose()) return;
-    final cancel = _terminalClipboardNoticeCancel;
-    if (cancel == null) {
-      debugPrint('[TerminalTabPage] Clipboard notice controller is missing');
-      _terminalClipboardNotice.noticeClosed();
-      return;
-    }
-    cancel();
-  }
-
   /// Unified tab close handler for all close paths (button, shortcut, programmatic).
   /// Shows audit dialog, cleans up session if not persistent, then removes the UI tab.
   Future<void> _closeTab(String tabKey) async {
@@ -336,10 +144,6 @@ class _TerminalTabPageState extends State<TerminalTabPage> {
     _windowClosing = true;
     final tabKeys = tabController.state.value.tabs.map((t) => t.key).toList();
     // Remove all UI tabs immediately (same instant behavior as the old tabController.clear())
-    // Keep the cleanup target lookup below synchronous before its first await:
-    // it relies on the current frame still retaining each TerminalPage's FFI/model.
-    _terminalClipboardNotice.clear();
-    _terminalClipboardNoticeCancel?.call();
     tabController.clear();
     // Run session cleanup in parallel with bounded timeout (closeTerminal() has internal 3s timeout).
     // Skip tabs already being closed by a concurrent _closeTab() to avoid duplicate FFI calls.
@@ -550,8 +354,6 @@ class _TerminalTabPageState extends State<TerminalTabPage> {
   @override
   void dispose() {
     HardwareKeyboard.instance.removeHandler(_handleKeyEvent);
-    _terminalClipboardNotice.clear();
-    _terminalClipboardNoticeCancel?.call();
     super.dispose();
   }
 
@@ -566,34 +368,8 @@ class _TerminalTabPageState extends State<TerminalTabPage> {
     final persistentSessions =
         args['persistent_sessions'] as List<dynamic>? ?? [];
     final sortedSessions = persistentSessions.whereType<int>().toList()..sort();
-    var peerId = args['peer_id'] as String? ?? '';
-    if (peerId.isEmpty) {
-      if (tabController.state.value.tabs.isEmpty ||
-          tabController.state.value.selected >=
-              tabController.state.value.tabs.length) {
-        debugPrint('[TerminalTabPage] Skip restore: no selected tab');
-        return;
-      }
-      final currentTab = tabController.state.value.selectedTabInfo;
-      final parsed = _parseTabKey(currentTab.key);
-      if (parsed == null) return;
-      peerId = parsed.$1;
-    }
-    final existingTerminalIds = tabController.state.value.tabs
-        .map((tab) => _parseTabKey(tab.key))
-        .where((parsed) => parsed != null && parsed.$1 == peerId)
-        .map((parsed) => parsed!.$2)
-        .toSet();
-    if (existingTerminalIds.isEmpty) {
-      debugPrint(
-          '[TerminalTabPage] Skip restore: no seed tab for peer $peerId');
-      return;
-    }
     for (final terminalId in sortedSessions) {
-      if (!existingTerminalIds.add(terminalId)) {
-        continue;
-      }
-      _addNewTerminal(peerId, terminalId: terminalId);
+      _addNewTerminalForCurrentPeer(terminalId: terminalId);
       // A delay is required to ensure the UI has sufficient time to update
       // before adding the next terminal. Without this delay, `_TerminalPageState::dispose()`
       // may be called prematurely while the tab widget is still in the tab controller.
@@ -770,11 +546,6 @@ class _TerminalTabPageState extends State<TerminalTabPage> {
     }
   }
 
-  Future<void> _closeWindowFromConnection() async {
-    await _closeAllTabs();
-    await WindowController.fromWindowId(windowId()).close();
-  }
-
   int windowId() {
     return widget.params["windowId"];
   }

flutter/lib/desktop/pages/view_camera_page.dart

@@ -127,6 +127,7 @@ class _ViewCameraPageState extends State<ViewCameraPage>
     WakelockManager.enable(_uniqueKey);
 
     _ffi.ffiModel.updateEventListener(sessionId, widget.id);
+    if (!isWeb) bind.pluginSyncUi(syncTo: kAppTypeDesktopRemote);
     _ffi.qualityMonitorModel.checkShowQualityMonitor(sessionId);
     _ffi.dialogManager.loadMobileActionsOverlayVisible();
     DesktopMultiWindow.addListener(this);

flutter/lib/desktop/widgets/tabbar_widget.dart

@@ -99,7 +99,6 @@ class DesktopTabController {
   /// index, key
   Function(int, String)? onRemoved;
   Function(String)? onSelected;
-  Future<void> Function()? onCloseWindow;
 
   DesktopTabController(
       {required this.tabType, this.onRemoved, this.onSelected});
@@ -593,13 +592,13 @@ class _DesktopTabState extends State<DesktopTab>
   }
 
   Widget _buildBar() {
-    final isIncomingHomePage = bind.isIncomingOnly() && isInHomePage();
     return Row(
       children: [
         Expanded(
             child: GestureDetector(
                 // custom double tap handler
-                onTap: !isIncomingHomePage && showMaximize
+                onTap: !(bind.isIncomingOnly() && isInHomePage()) &&
+                        showMaximize
                     ? () {
                         final current = DateTime.now().millisecondsSinceEpoch;
                         final elapsed = current - _lastClickTime;
@@ -610,7 +609,7 @@ class _DesktopTabState extends State<DesktopTab>
                               .then((value) => stateGlobal.setMaximized(value));
                         }
                       }
-                    : (isIncomingHomePage ? () {} : null), // Keep tap recognizer for Windows touch.
+                    : null,
                 onPanStart: (_) => startDragging(isMainWindow),
                 onPanCancel: () {
                   // We want to disable dragging of the tab area in the tab bar.

flutter/lib/main.dart

@@ -27,9 +27,11 @@ import 'common.dart';
 import 'consts.dart';
 import 'mobile/pages/home_page.dart';
 import 'mobile/pages/server_page.dart';
-import 'mobile/widgets/deploy_dialog.dart';
 import 'models/platform_model.dart';
 
+import 'package:flutter_hbb/plugin/handlers.dart'
+    if (dart.library.html) 'package:flutter_hbb/web/plugin/handlers.dart';
+
 /// Basic window and launch properties.
 int? kWindowId;
 WindowType? kWindowType;
@@ -138,6 +140,8 @@ void runMainApp(bool startService) async {
   await bind.mainCheckConnectStatus();
   if (startService) {
     gFFI.serverModel.startService();
+    bind.pluginSyncUi(syncTo: kAppTypeMain);
+    bind.pluginListReload();
   }
   await Future.wait([gFFI.abModel.loadCache(), gFFI.groupModel.loadCache()]);
   gFFI.userModel.refreshCurrentUser();
@@ -565,20 +569,17 @@ _registerEventHandler() {
       reloadAllWindows();
     });
   }
-  if (isAndroid) {
-    platformFFI.registerEventHandler(
-        'android_needs_deploy', 'android_needs_deploy', (_) async {
-      WidgetsBinding.instance.addPostFrameCallback((_) {
-        showDeployPromptDialog();
-      });
+  // Register native handlers.
+  if (isDesktop) {
+    platformFFI.registerEventHandler('native_ui', 'native_ui', (evt) async {
+      NativeUiHandler.instance.onEvent(evt);
     });
   }
 }
 
 Widget keyListenerBuilder(BuildContext context, Widget? child) {
   return RawKeyboardListener(
-    // `skipTraversal: isWeb` is to fix "Bad state: RenderBox was not laid out: minified:aeL#c19e4"
-    focusNode: FocusNode(skipTraversal: isWeb),
+    focusNode: FocusNode(),
     child: child ?? Container(),
     onKey: (RawKeyEvent event) {
       if (event.logicalKey == LogicalKeyboardKey.shiftLeft) {

flutter/lib/mobile/pages/connection_page.dart

@@ -207,7 +207,6 @@ class _ConnectionPageState extends State<ConnectionPage> {
                                     .contains(textToFind) ||
                                 peer.alias.toLowerCase().contains(textToFind))
                             .toList();
-                        _allPeersLoader.queryOnlines(_autocompleteOpts);
                       }
                       return _autocompleteOpts;
                     },