hbb_common

id whitelist
Translate 'Continue' to 'Continuar' in ptbr.rs (#15567 )
2026-07-14 19:41:45 +08:00 · 2026-07-14 14:54:11 +08:00 · 2026-07-14 14:39:33 +08:00 · 2026-07-13 18:56:41 +08:00 · 2026-07-11 21:43:04 +08:00 · 2026-07-11 17:18:12 +08:00
153 changed files with 5369 additions and 1187 deletions
@@ -2,6 +2,8 @@
 rustflags = ["-Ctarget-feature=+crt-static"]
 [target.i686-pc-windows-msvc]
 rustflags = ["-C", "target-feature=+crt-static", "-C", "link-args=/NODEFAULTLIB:MSVCRT"]
+[target.aarch64-pc-windows-msvc]
+rustflags = ["-Ctarget-feature=+crt-static"]
 [target.'cfg(target_os="macos")']
 rustflags = [
    "-C", "link-args=-sectcreate __CGPreLoginApp __cgpreloginapp /dev/null",
@@ -0,0 +1,39 @@
+#!/usr/bin/env bash
+# Applies the Flutter 3.44-only source/pubspec changes on the fly, in CI only.
+#
+# Windows arm64 needs Flutter >= 3.44 (the first stable release shipping an arm64 Dart SDK +
+# engine), which renamed DialogTheme/TabBarTheme -> *Data and needs newer extended_text/
+# google_fonts. Every other platform is still on Flutter 3.24.5, where the old names/versions
+# are required, so these changes are kept OUT of the committed sources and applied here instead.
+#
+# Used by BOTH the Windows arm64 build (flutter-build.yml) and its dedicated bridge artifact
+# (bridge.yml) so they share an identical 3.44 source state -- the generated *.freezed.dart must
+# compile against the same Flutter/freezed version the arm64 build resolves.
+#
+# Remove this script (and commit the changes) once upstream bumps Flutter across the board.
+#
+# Run from the repository root. sed is used (not a git-apply patch) because the checked-out
+# sources are CRLF on the windows-11-arm runner; the substitutions below are anchor-free and
+# therefore CRLF-safe.
+set -euo pipefail
+
+# ThemeData API renames (Flutter 3.27+):
+sed -i 's/dialogTheme: DialogTheme(/dialogTheme: DialogThemeData(/g' flutter/lib/common.dart
+sed -i 's/tabBarTheme: const TabBarTheme(/tabBarTheme: const TabBarThemeData(/g' flutter/lib/common.dart
+sed -i '/static ThemeData lightTheme = ThemeData(/,/static ThemeData darkTheme = ThemeData(/s/dialogTheme: DialogThemeData(/dialogTheme: DialogThemeData(\
+      backgroundColor: Colors.white,/' flutter/lib/common.dart
+sed -i '/static ThemeData darkTheme = ThemeData(/,/scrollbarTheme: scrollbarThemeDark,/s/dialogTheme: DialogThemeData(/dialogTheme: DialogThemeData(\
+      backgroundColor: Color(0xFF18191E),/' flutter/lib/common.dart
+# Dependency bumps required by the newer Dart/Flutter:
+sed -i 's/extended_text: 14.0.0/extended_text: 15.0.2/' flutter/pubspec.yaml
+sed -i 's/google_fonts: \^6.2.1/google_fonts: ^8.1.0/' flutter/pubspec.yaml
+
+# Fail loudly if any expected string drifted, so we never silently build unpatched:
+grep -qF 'dialogTheme: DialogThemeData(' flutter/lib/common.dart
+grep -qF 'tabBarTheme: const TabBarThemeData(' flutter/lib/common.dart
+grep -qF 'backgroundColor: Colors.white,' flutter/lib/common.dart
+grep -qF 'backgroundColor: Color(0xFF18191E),' flutter/lib/common.dart
+grep -qF 'extended_text: 15.0.2' flutter/pubspec.yaml
+grep -qF 'google_fonts: ^8.1.0' flutter/pubspec.yaml
+
+git --no-pager diff -- flutter/lib/common.dart flutter/pubspec.yaml
@@ -7,7 +7,6 @@ on:

 env:
  CARGO_EXPAND_VERSION: "1.0.95"
-  FLUTTER_VERSION: "3.22.3"
  FLUTTER_RUST_BRIDGE_VERSION: "1.80.1"
  RUST_VERSION: "1.75" # https://github.com/rustdesk/rustdesk/discussions/7503

@@ -18,10 +17,21 @@ jobs:
      fail-fast: false
      matrix:
        job:
+          # Default bridge for every platform still on Flutter 3.24.5 (generated with 3.22.3).
          - {
              target: x86_64-unknown-linux-gnu,
              os: ubuntu-22.04,
              extra-build-args: "",
+              flutter-version: "3.22.3",
+              artifact-name: "bridge-artifact",
+            }
+          # Dedicated bridge for the Windows arm64 build (Flutter 3.44); runs in parallel.
+          - {
+              target: x86_64-unknown-linux-gnu,
+              os: ubuntu-22.04,
+              extra-build-args: "",
+              flutter-version: "3.44.0",
+              artifact-name: "bridge-artifact-flutter-3.44",
            }
    steps:
      - name: Checkout source code
@@ -64,13 +74,13 @@ jobs:
        uses: actions/cache@6f8efc29b200d32929f49075959781ed54ec270c # v3
        with:
          path: /tmp/flutter_rust_bridge
-          key: vcpkg-${{ matrix.job.arch }}
+          key: bridge-${{ matrix.job.flutter-version }}

      - name: Install flutter
        uses: subosito/flutter-action@1a449444c387b1966244ae4d4f8c696479add0b2 # v2
        with:
          channel: "stable"
-          flutter-version: ${{ env.FLUTTER_VERSION }}
+          flutter-version: ${{ matrix.job.flutter-version }}
          cache: true

      - name: Install flutter rust bridge deps
@@ -78,7 +88,15 @@ jobs:
        run: |
          cargo install cargo-expand --version ${{ env.CARGO_EXPAND_VERSION }} --locked
          cargo install flutter_rust_bridge_codegen --version ${{ env.FLUTTER_RUST_BRIDGE_VERSION }} --features "uuid" --locked
-          pushd flutter && sed -i -e 's/extended_text: 14.0.0/extended_text: 13.0.0/g' pubspec.yaml && flutter pub get && popd
+          if [[ "${{ matrix.job.flutter-version }}" == "3.22.3" ]]; then
+            # Default Flutter 3.22.3: extended_text 14 needs a newer Dart, so downgrade for resolution.
+            sed -i -e 's/extended_text: 14.0.0/extended_text: 13.0.0/g' flutter/pubspec.yaml
+          else
+            # Flutter 3.44 bridge for Windows arm64: match that build's source/pubspec state so the
+            # generated *.freezed.dart compiles against the same Flutter/freezed it resolves.
+            bash .github/patches/apply_flutter_3.44_source_patches.sh
+          fi
+          pushd flutter && flutter pub get && popd

      - name: Run flutter rust bridge
        run: |
@@ -88,7 +106,7 @@ jobs:
      - name: Upload Artifact
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
-          name: bridge-artifact
+          name: ${{ matrix.job.artifact-name }}
          path: |
            ./src/bridge_generated.rs
            ./src/bridge_generated.io.rs
@@ -81,6 +81,7 @@ jobs:
          # - { target: x86_64-apple-darwin         , os: macos-10.15                   }
          # - { target: x86_64-pc-windows-gnu       , os: windows-2022                  }
          # - { target: x86_64-pc-windows-msvc      , os: windows-2022                  }
+          # - { target: aarch64-pc-windows-msvc     , os: windows-11-arm                }
          - { target: x86_64-unknown-linux-gnu    , os: ubuntu-24.04                  }
          # - { target: x86_64-unknown-linux-musl   , os: ubuntu-20.04, use-cross: true }
    steps:
@@ -27,6 +27,11 @@ env:
  LLVM_VERSION: "15.0.6"
  FLUTTER_VERSION: "3.24.5"
  ANDROID_FLUTTER_VERSION: "3.24.5"
+  # Windows arm64 only: the first stable Flutter to ship a native arm64 Windows Dart SDK +
+  # engine is 3.44. Every other platform stays on FLUTTER_VERSION (3.24.5) until Windows 7
+  # support is restored after the upstream-wide Flutter bump. The arm64 job patches the few
+  # 3.44-only source/pubspec changes on the fly (see "Patch RustDesk sources for Flutter 3.44").
+  FLUTTER_WINDOWS_ARM_VERSION: "3.44.0"
  # for arm64 linux because official Dart SDK does not work
  FLUTTER_ELINUX_VERSION: "3.16.9"
  TAG_NAME: "${{ inputs.upload-tag }}"
@@ -39,7 +44,7 @@ env:
  # 2. Update the `VCPKG_COMMIT_ID` in `ci.yml` and `playground.yml`.
  VCPKG_COMMIT_ID: "120deac3062162151622ca4860575a33844ba10b"
  ARMV7_VCPKG_COMMIT_ID: "6f29f12e82a8293156836ad81cc9bf5af41fe836" # 2025.01.13, got "/opt/artifacts/vcpkg/vcpkg: No such file or directory" with latest version
-  VERSION: "1.4.8"
+  VERSION: "1.4.9"
  NDK_VERSION: "r28c"
  #signing keys env variable checks
  ANDROID_SIGNING_KEY: "${{ secrets.ANDROID_SIGNING_KEY }}"
@@ -53,14 +58,24 @@ jobs:

  build-RustDeskTempTopMostWindow:
    uses: ./.github/workflows/third-party-RustDeskTempTopMostWindow.yml
-    with:
-      upload-artifact: ${{ inputs.upload-artifact }}
-      target: windows-2022
-      configuration: Release
-      platform: x64
-      target_version: Windows10
    strategy:
      fail-fast: false
+      matrix:
+        job:
+          - {
+              target: windows-2022,
+              platform: x64,
+            }
+          - {
+              target: windows-11-arm,
+              platform: ARM64,
+            }
+    with:
+      upload-artifact: ${{ inputs.upload-artifact }}
+      target: ${{ matrix.job.target }}
+      configuration: Release
+      platform: ${{ matrix.job.platform }}
+      target_version: Windows10

  build-for-windows-flutter:
    name: ${{ matrix.job.target }}
@@ -76,9 +91,20 @@ jobs:
              target: x86_64-pc-windows-msvc,
              os: windows-2022,
              arch: x86_64,
+              flutter-arch: x64,
              vcpkg-triplet: x64-windows-static,
+              build-args: "--vram",
+            }
+          - {
+              target: aarch64-pc-windows-msvc,
+              os: windows-11-arm,
+              arch: aarch64,
+              flutter-arch: arm64,
+              vcpkg-triplet: arm64-windows-static,
+              # vram is x86/x64-only (NVENC needs CUDA, Intel MediaSDK needs __rdtsc);
+              # no NV/Intel/AMD hardware exists on Windows-on-ARM, so vram stays disabled here.
+              build-args: "",
            }
-          # - { target: aarch64-pc-windows-msvc, os: windows-2022, arch: aarch64 }
    steps:
      - name: Export GitHub Actions cache environment variables
        uses: actions/github-script@d7906e4ad0b1822421a7e6a35d5ca353c962f410 # v6
@@ -95,36 +121,91 @@ jobs:
      - name: Restore bridge files
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
-          name: bridge-artifact
+          # arm64 is on Flutter 3.44, so it needs the bridge generated with the same Flutter
+          # (its *.freezed.dart must match the freezed the arm64 build resolves). x64 and every
+          # other platform keep the default 3.22.3-generated bridge.
+          name: ${{ matrix.job.arch == 'aarch64' && 'bridge-artifact-flutter-3.44' || 'bridge-artifact' }}
          path: ./

      - name: Install LLVM and Clang
-        uses: KyleMayes/install-llvm-action@1a3da29f56261a1e1f937ec88f0856a9b8321d7e # v1
+        uses: KyleMayes/install-llvm-action@ebc0426251bc40c7cd31162802432c68818ab8f0 # v2.0.9
        with:
          version: ${{ env.LLVM_VERSION }}

      - name: Install flutter
+        id: flutter
+        # arm64 builds with FLUTTER_WINDOWS_ARM_VERSION (>=3.44); x64 stays on FLUTTER_VERSION.
+        # subosito only ships an x64 Windows SDK (Flutter's release manifest lists x64 only),
+        # so it installs x64 on both arches. The arm64 runner re-bootstraps Dart to arm64 in
+        # the next step.
        uses: subosito/flutter-action@2783a3f08e1baf891508463f8c6653c258246225  # v2.12.0; https://github.com/subosito/flutter-action/issues/277
        with:
          channel: "stable"
-          flutter-version: ${{ env.FLUTTER_VERSION }}
+          flutter-version: ${{ matrix.job.arch == 'aarch64' && env.FLUTTER_WINDOWS_ARM_VERSION || env.FLUTTER_VERSION }}
+          architecture: x64
+
+      - name: Force arm64 Dart SDK + engine
+        # The x64 SDK subosito installs bundles an x64 Dart with a matching engine-dart-sdk.stamp,
+        # so update_dart_sdk.ps1 short-circuits (stamp matches -> return) and keeps x64 Dart;
+        # `flutter build windows` then targets the Dart VM's arch = x64, even on this arm64 host.
+        # On this native-arm64 runner (PROCESSOR_ARCHITECTURE=ARM64), deleting the stamp and
+        # re-running update_dart_sdk.ps1 pulls the arm64 Dart (available since Flutter 3.44.0).
+        # https://github.com/flutter/flutter/issues/186730#issuecomment-4573214964
+        if: ${{ matrix.job.arch == 'aarch64' }}
+        run: |
+          $flutterRoot = "${{ steps.flutter.outputs['CACHE-PATH'] }}"
+          Write-Host "PROCESSOR_ARCHITECTURE=$env:PROCESSOR_ARCHITECTURE"
+          Write-Host "Flutter root: $flutterRoot"
+          Remove-Item -Force "$flutterRoot\bin\cache\engine-dart-sdk.stamp" -ErrorAction SilentlyContinue
+          & "$flutterRoot\bin\internal\update_dart_sdk.ps1"
+          # Confirm the Dart we ended up with is arm64 ("on windows_arm64"); fail loudly if not.
+          $dartVer = & "$flutterRoot\bin\dart.bat" --version 2>&1 | Out-String
+          Write-Host $dartVer
+          if ($dartVer -notmatch "windows_arm64") {
+            Write-Error "Expected an arm64 Dart SDK but got: $dartVer"
+            exit 1
+          }
+          & "$flutterRoot\bin\flutter.bat" precache --windows
+          # Fail fast if precache pulled the wrong-arch Windows engine: an arm64 Dart should
+          # fetch windows-arm64 engine artifacts. Bailing here saves the ~25min Rust build.
+          $engineDir = "$flutterRoot\bin\cache\artifacts\engine"
+          Write-Host "Engine artifacts present:"
+          Get-ChildItem $engineDir -Directory | Select-Object -ExpandProperty Name | Write-Host
+          if (-not (Test-Path "$engineDir\windows-arm64-release")) {
+            Write-Error "Expected windows-arm64-release engine artifacts but they are missing (wrong-arch SDK)."
+            exit 1
+          }

      # https://github.com/flutter/flutter/issues/155685
+      # x64 only: arm64 uses the stock native arm64 Windows engine, and the rustdesk/engine
+      # windows-x64-release.zip is built for the 3.24-era x64 engine (matches FLUTTER_VERSION).
      - name: Replace engine with rustdesk custom flutter engine
+        if: ${{ matrix.job.arch == 'x86_64' }}
        run: |
          flutter doctor -v
          flutter precache --windows
          Invoke-WebRequest -Uri https://github.com/rustdesk/engine/releases/download/main/windows-x64-release.zip -OutFile windows-x64-release.zip
          Expand-Archive -Path windows-x64-release.zip -DestinationPath windows-x64-release
-          mv -Force windows-x64-release/*  C:/hostedtoolcache/windows/flutter/stable-${{ env.FLUTTER_VERSION }}-x64/bin/cache/artifacts/engine/windows-x64-release/
+          mv -Force windows-x64-release/*  C:/hostedtoolcache/windows/flutter/stable-${{ env.FLUTTER_VERSION }}-x64/bin/cache/artifacts/engine/windows-x64-release/

      - name: Patch flutter
+        # x64 stays on Flutter 3.24.5, which needs the dropdown filter patch.
+        # arm64 is on Flutter 3.44 (patched separately below) and does not use this patch.
+        if: ${{ matrix.job.arch == 'x86_64' }}
        shell: bash
        run: |
          cp .github/patches/flutter_3.24.4_dropdown_menu_enableFilter.diff $(dirname $(dirname $(which flutter)))
          cd $(dirname $(dirname $(which flutter)))
          [[ "3.24.5" == ${{env.FLUTTER_VERSION}} ]] && git apply flutter_3.24.4_dropdown_menu_enableFilter.diff

+      - name: Patch RustDesk sources for Flutter 3.44 (arm64)
+        # arm64 is the only target on Flutter 3.44; apply its source/pubspec deltas on the fly
+        # (shared with the 3.44 bridge job) so the committed sources stay on Flutter 3.24.5.
+        # `flutter build` then runs `pub get`, regenerating pubspec.lock for the bumped deps.
+        if: ${{ matrix.job.arch == 'aarch64' }}
+        shell: bash
+        run: bash .github/patches/apply_flutter_3.44_source_patches.sh
+
      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9 # v1
        with:
@@ -163,11 +244,19 @@ jobs:
          head -n 100 "${VCPKG_ROOT}/buildtrees/ffmpeg/build-${{ matrix.job.vcpkg-triplet }}-rel-out.log" || true
        shell: bash

+      - name: Set SODIUM_LIB_DIR (arm64)
+        # libsodium-sys ships no arm64 Windows prebuilt lib; point it at the vcpkg-built one
+        # (only for arm64 — leaving it unset lets x64 use the crate's bundled lib).
+        if: ${{ matrix.job.arch == 'aarch64' }}
+        shell: bash
+        run: echo "SODIUM_LIB_DIR=$VCPKG_ROOT/installed/${{ matrix.job.vcpkg-triplet }}/lib" >> "$GITHUB_ENV"
+
      - name: Build rustdesk
        run: |
          # Windows: build RustDesk
-          python3 .\build.py --portable --hwcodec --flutter --vram --skip-portable-pack
-          mv ./flutter/build/windows/x64/runner/Release ./rustdesk
+          # --hwcodec is shared by all Windows targets; per-target extras (e.g. --vram) come from the matrix
+          python3 .\build.py --portable --flutter --skip-portable-pack --hwcodec ${{ matrix.job.build-args }}
+          mv ./flutter/build/windows/${{ matrix.job.flutter-arch }}/runner/Release ./rustdesk

          # Download usbmmidd_v2.zip and extract it to ./rustdesk
          Invoke-WebRequest -Uri https://github.com/rustdesk-org/rdev/releases/download/usbmmidd_v2/usbmmidd_v2.zip -OutFile usbmmidd_v2.zip
@@ -223,7 +312,7 @@ jobs:
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        if: ${{ inputs.upload-artifact }}
        with:
-          name: topmostwindow-artifacts
+          name: ${{ matrix.job.arch == 'aarch64' && 'topmostwindow-artifacts-ARM64' || 'topmostwindow-artifacts-x64' }}
          path: "./rustdesk"

      - name: Upload unsigned
@@ -256,13 +345,18 @@ jobs:
        uses: microsoft/setup-msbuild@6fb02220983dee41ce7ae257b6f4d8f9bf5ed4ce # v2

      - name: Build msi
+        # Builds the MSI for the matrix arch. res/msi (WiX v4 + native CustomActions) carries
+        # both x64 and ARM64 platform configs; WcaUtil/DUtil ship arm64 libs. msbuild platform
+        # is x64 / ARM64; the produced Package.msi is globbed since its bin/<platform>/ dir varies.
        if: env.UPLOAD_ARTIFACT == 'true'
        run: |
          pushd ./res/msi
          python preprocess.py --arp -d ../../rustdesk
          nuget restore msi.sln
-          msbuild msi.sln -p:Configuration=Release -p:Platform=x64 /p:TargetVersion=Windows10
-          mv ./Package/bin/x64/Release/en-us/Package.msi ../../SignOutput/rustdesk-${{ env.VERSION }}-${{ matrix.job.arch }}.msi
+          $msiPlatform = if ('${{ matrix.job.arch }}' -eq 'aarch64') { 'ARM64' } else { 'x64' }
+          msbuild msi.sln -p:Configuration=Release -p:Platform=$msiPlatform /p:TargetVersion=Windows10
+          $msi = Get-ChildItem ./Package/bin/*/Release/en-us/Package.msi | Select-Object -First 1
+          mv $msi.FullName ../../SignOutput/rustdesk-${{ env.VERSION }}-${{ matrix.job.arch }}.msi
          sha256sum ../../SignOutput/rustdesk-*.msi

      - name: Sign rustdesk self-extracted file
@@ -1890,6 +1984,7 @@ jobs:
          sudo apt-get install -y libarchive-tools libfuse2
          # set-up appimage-builder
          # https://github.com/AppImage/AppImageKit/issues/1395
+          sudo pip3 install "setuptools_scm<10"
          sudo pip3 install git+https://github.com/rustdesk-org/appimage-builder.git
          # run appimage-builder
          pushd appimage
@@ -17,7 +17,7 @@ env:
  TAG_NAME: "nightly"
  VCPKG_BINARY_SOURCES: "clear;x-gha,readwrite"
  VCPKG_COMMIT_ID: "120deac3062162151622ca4860575a33844ba10b"
-  VERSION: "1.4.8"
+  VERSION: "1.4.9"
  NDK_VERSION: "r26d"
  #signing keys env variable checks
  ANDROID_SIGNING_KEY: "${{ secrets.ANDROID_SIGNING_KEY }}"
@@ -45,16 +45,15 @@ jobs:
        run: |
          git clone https://github.com/rustdesk-org/RustDeskTempTopMostWindow RustDeskTempTopMostWindow

-        # Build. commit 53b548a5398624f7149a382000397993542ad796 is tag v0.3
      - name: Build the project
        run: |
-          cd RustDeskTempTopMostWindow && git checkout 53b548a5398624f7149a382000397993542ad796
+          cd RustDeskTempTopMostWindow && git checkout ecd8d6a139eee76845ea66423fb739af450fda90
          msbuild ${{ env.project_path }} -p:Configuration=${{ inputs.configuration }} -p:Platform=${{ inputs.platform }} /p:TargetVersion=${{ inputs.target_version }}

      - name: Archive build artifacts
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        if: ${{ inputs.upload-artifact }}
        with:
-            name: topmostwindow-artifacts
+            name: topmostwindow-artifacts-${{ inputs.platform }}
            path: |
              ./${{ env.build_output_dir }}/WindowInjection.dll
@@ -1,85 +0,0 @@
-name: wf-cliprdr CI
-
-on:
-  workflow_dispatch:
-  pull_request:
-    paths:
-      - "libs/clipboard/src/windows/**"
-      - "tests/test_invariant_wf_cliprdr.c"
-      - ".github/workflows/wf-cliprdr-ci.yml"
-  push:
-    branches:
-      - master
-    paths:
-      - "libs/clipboard/src/windows/**"
-      - "tests/test_invariant_wf_cliprdr.c"
-      - ".github/workflows/wf-cliprdr-ci.yml"
-
-permissions:
-  contents: read
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.ref }}
-  cancel-in-progress: true
-
-jobs:
-  test:
-    name: wf_cliprdr invariant test
-    runs-on: windows-2022
-
-    steps:
-      - name: Checkout source code
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
-        with:
-          persist-credentials: false
-
-      - name: Set up MSVC
-        uses: ilammy/msvc-dev-cmd@0b201ec74fa43914dc39ae48a89fd1d8cb592756
-        with:
-          arch: x64
-
-      - name: Setup vcpkg with GitHub Actions binary cache
-        uses: lukka/run-vcpkg@b1a0dd252f06b9e25b3c022a9a03bd7a427fb6a2 # v11
-        with:
-          vcpkgDirectory: C:\vcpkg
-          doNotCache: false
-
-      - name: Install vcpkg dependency
-        shell: pwsh
-        run: |
-          & "$env:VCPKG_ROOT\vcpkg.exe" install check:x64-windows --classic --x-install-root="$env:VCPKG_ROOT\installed"
-
-      - name: Build test
-        shell: pwsh
-        run: |
-          $testRoot = Join-Path $env:GITHUB_WORKSPACE 'build\wf-cliprdr'
-          New-Item -ItemType Directory -Force $testRoot | Out-Null
-
-          $testSource = (($env:GITHUB_WORKSPACE -replace '\\', '/') + '/tests/test_invariant_wf_cliprdr.c')
-          $cmakeLists = @(
-            'cmake_minimum_required(VERSION 3.20)'
-            'project(test_invariant_wf_cliprdr C)'
-            ''
-            'set(CMAKE_C_STANDARD 11)'
-            'set(CMAKE_C_STANDARD_REQUIRED ON)'
-            'set(CMAKE_C_EXTENSIONS OFF)'
-            ''
-            'find_package(check CONFIG REQUIRED)'
-            ''
-            'add_executable(test_invariant_wf_cliprdr'
-            '  "TEST_SOURCE"'
-            ')'
-            ''
-            'target_link_libraries(test_invariant_wf_cliprdr PRIVATE'
-            '  $<$<TARGET_EXISTS:Check::check>:Check::check>'
-            '  $<$<NOT:$<TARGET_EXISTS:Check::check>>:Check::checkShared>'
-            ')'
-          ) -join [Environment]::NewLine
-          $cmakeLists.Replace('TEST_SOURCE', $testSource) | Set-Content -NoNewline (Join-Path $testRoot 'CMakeLists.txt')
-
-          cmake -S $testRoot -B (Join-Path $testRoot 'out') -G "Visual Studio 17 2022" -A x64 -DCMAKE_TOOLCHAIN_FILE="$env:VCPKG_ROOT\scripts\buildsystems\vcpkg.cmake" -DVCPKG_TARGET_TRIPLET=x64-windows
-          cmake --build (Join-Path $testRoot 'out') --config Release
-
-      - name: Run test
-        shell: pwsh
-        run: .\build\wf-cliprdr\out\Release\test_invariant_wf_cliprdr.exe
@@ -84,3 +84,9 @@ Then translate that source into the file's target language (infer the language f
 * Preserve placeholders (`{}`) and escape sequences (`\n`, `\"`) exactly as in the source.
 * Do not translate brand or technical tokens: `RustDesk`, `Socks5`, `TLS`, `UAC`, `Wayland`, `X11`, `TCP`, `UDP`, `2FA`, `RDP`, `D3D`, etc.
 * Copy URL values (e.g. `doc_*` keys) verbatim from `en.rs`.
+
+### Adding new keys (feature work)
+
+* New English-text keys use sentence case, not Title Case: `Use ID whitelisting`, **not** `Use ID Whitelisting`. Acronyms (ID, IP, 2FA…) stay uppercase. Legacy Title-Case keys (e.g. `Use IP Whitelisting`) stay as-is — do not rename them.
+* Since the key itself is the English display text, a sentence-case key usually needs **no** `en.rs` entry; add one only when the display text must differ from the key (e.g. `*_tip` keys).
+* Append each new key to `template.rs` (with `""`) and to every `src/lang/*.rs` file (translated, or `""` if unsure), at the end of the list.
@@ -1324,7 +1324,7 @@ dependencies = [
 [[package]]
 name = "clipboard-master"
 version = "4.0.0-beta.6"
-source = "git+https://github.com/rustdesk-org/clipboard-master#ddc39f00a6211959489ae683aa6ae6eedf03a809"
+source = "git+https://github.com/rustdesk-org/clipboard-master#7762d74e38db37cfeb6ded88c964b9cdbddfb6db"
 dependencies = [
 "objc",
 "objc-foundation",
@@ -2329,7 +2329,7 @@ version = "0.5.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "330c60081dcc4c72131f8eb70510f1ac07223e5d4163db481a04a0befcffa412"
 dependencies = [
- "libloading 0.8.4",
+ "libloading 0.7.4",
 ]

 [[package]]
@@ -2694,7 +2694,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "39cab71617ae0d63f51a36d69f866391735b51691dbda63cf6f96d042b63efeb"
 dependencies = [
 "libc",
- "windows-sys 0.52.0",
+ "windows-sys 0.60.2",
 ]

 [[package]]
@@ -4494,7 +4494,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e310b3a6b5907f99202fcdb4960ff45b93735d7c7d96b760fcff8db2dc0e103d"
 dependencies = [
 "cfg-if 1.0.0",
- "windows-targets 0.52.6",
+ "windows-targets 0.48.5",
 ]

 [[package]]
@@ -4695,7 +4695,7 @@ dependencies = [
 [[package]]
 name = "magnum-opus"
 version = "0.4.0"
-source = "git+https://github.com/rustdesk-org/magnum-opus#5cd2bf989c148662fa3a2d9d539a71d71fd1d256"
+source = "git+https://github.com/rustdesk-org/magnum-opus#588c6e1f9ed50c3a01fa64f3bd3e7cdb0378a114"
 dependencies = [
 "bindgen 0.59.2",
 "pkg-config",
@@ -6588,7 +6588,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "556af5f5c953a2ee13f45753e581a38f9778e6551bc3ccc56d90b14628fe59d8"
 dependencies = [
 "cfg-if 0.1.10",
- "rpassword 2.1.0",
+ "rpassword",
 "tempfile",
 "termios 0.3.3",
 "winapi 0.3.9",
@@ -6673,7 +6673,7 @@ dependencies = [
 "once_cell",
 "socket2 0.5.10",
 "tracing",
- "windows-sys 0.52.0",
+ "windows-sys 0.60.2",
 ]

 [[package]]
@@ -6920,7 +6920,7 @@ dependencies = [
 [[package]]
 name = "rdev"
 version = "0.5.0-2"
-source = "git+https://github.com/rustdesk-org/rdev#f9b60b1dd0f3300a1b797d7a74c116683cd232c8"
+source = "git+https://github.com/rustdesk-org/rdev#871bf1c856d6a30af2f56ab8848396a025140855"
 dependencies = [
 "cocoa 0.24.1",
 "core-foundation 0.9.4",
@@ -7152,17 +7152,6 @@ dependencies = [
 "winapi 0.2.8",
 ]

-[[package]]
-name = "rpassword"
-version = "7.3.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "80472be3c897911d0137b2d2b9055faf6eeac5b14e324073d83bc17b191d7e3f"
-dependencies = [
- "libc",
- "rtoolbox",
- "windows-sys 0.48.0",
-]
-
 [[package]]
 name = "rtcp"
 version = "0.14.0"
@@ -7174,16 +7163,6 @@ dependencies = [
 "webrtc-util",
 ]

-[[package]]
-name = "rtoolbox"
-version = "0.0.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c247d24e63230cdb56463ae328478bd5eac8b8faa8c69461a77e8e323afac90e"
-dependencies = [
- "libc",
- "windows-sys 0.48.0",
-]
-
 [[package]]
 name = "rtp"
 version = "0.14.0"
@@ -7270,7 +7249,7 @@ dependencies = [

 [[package]]
 name = "rustdesk"
-version = "1.4.8"
+version = "1.4.9"
 dependencies = [
 "android-wakelock",
 "android_logger",
@@ -7283,7 +7262,6 @@ dependencies = [
 "cfg-if 1.0.0",
 "chrono",
 "cidr-utils",
- "clap 4.5.53",
 "clipboard",
 "clipboard-master",
 "cocoa 0.24.1",
@@ -7341,7 +7319,6 @@ dependencies = [
 "repng",
 "reqwest",
 "ringbuf",
- "rpassword 7.3.1",
 "rubato",
 "runas",
 "rust-pulsectl",
@@ -7385,7 +7362,7 @@ dependencies = [

 [[package]]
 name = "rustdesk-portable-packer"
-version = "1.4.8"
+version = "1.4.9"
 dependencies = [
 "brotli",
 "dirs 5.0.1",
@@ -7457,7 +7434,7 @@ dependencies = [
 "errno",
 "libc",
 "linux-raw-sys 0.11.0",
- "windows-sys 0.52.0",
+ "windows-sys 0.60.2",
 ]

 [[package]]
@@ -7514,7 +7491,7 @@ dependencies = [
 "security-framework 3.5.1",
 "security-framework-sys",
 "webpki-root-certs",
- "windows-sys 0.52.0",
+ "windows-sys 0.60.2",
 ]

 [[package]]
@@ -9733,9 +9710,9 @@ dependencies = [

 [[package]]
 name = "wayland-protocols-wlr"
-version = "0.3.3"
+version = "0.3.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fd993de54a40a40fbe5601d9f1fbcaef0aebcc5fda447d7dc8f6dcbaae4f8953"
+checksum = "efd94963ed43cf9938a090ca4f7da58eb55325ec8200c3848963e98dc25b78ec"
 dependencies = [
 "bitflags 2.9.1",
 "wayland-backend",
@@ -10838,16 +10815,15 @@ dependencies = [

 [[package]]
 name = "wl-clipboard-rs"
-version = "0.9.0"
+version = "0.9.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4de22eebb1d1e2bad2d970086e96da0e12cde0b411321e5b0f7b2a1f876aa26f"
+checksum = "e9651471a32e87d96ef3a127715382b2d11cc7c8bb9822ded8a7cc94072eb0a3"
 dependencies = [
 "libc",
 "log",
 "os_pipe",
- "rustix 0.38.34",
- "tempfile",
- "thiserror 1.0.61",
+ "rustix 1.1.2",
+ "thiserror 2.0.17",
 "tree_magic_mini",
 "wayland-backend",
 "wayland-client",
@@ -1,6 +1,6 @@
 [package]
 name = "rustdesk"
-version = "1.4.8"
+version = "1.4.9"
 authors = ["rustdesk <info@rustdesk.com>"]
 edition = "2021"
 build= "build.rs"
@@ -22,7 +22,6 @@ path = "src/service.rs"

 [features]
 inline = []
-cli = []
 use_samplerate = ["samplerate"]
 use_rubato = ["rubato"]
 use_dasp = ["dasp"]
@@ -62,8 +61,6 @@ dasp = { version = "0.11", features = ["signal", "interpolate-linear", "interpol
 rubato = { version = "0.12", optional = true }
 samplerate = { version = "0.2", optional = true }
 uuid = { version = "1.3", features = ["v4"] }
-clap = "4.2"
-rpassword = "7.2"
 num_cpus = "1.15"
 bytes = { version = "1.4", features = ["serde"] }
 default-net = "0.14"
@@ -213,7 +210,7 @@ exclude = ["vdi/host", "examples/custom_plugin"]
 libxdo-sys = { path = "libs/libxdo-sys-stub" }

 [package.metadata.winres]
-LegalCopyright = "Copyright © 2025 Purslane Ltd. All rights reserved."
+LegalCopyright = "Copyright © 2026 Purslane Tech Pte. Ltd. All rights reserved."
 ProductName = "RustDesk"
 FileDescription = "RustDesk Remote Desktop"
 OriginalFilename = "rustdesk.exe"
@@ -18,7 +18,7 @@ AppDir:
    id: rustdesk
    name: rustdesk
    icon: rustdesk
-    version: 1.4.8
+    version: 1.4.9
    exec: usr/share/rustdesk/rustdesk
    exec_args: $@
  apt:
@@ -18,7 +18,7 @@ AppDir:
    id: rustdesk
    name: rustdesk
    icon: rustdesk
-    version: 1.4.8
+    version: 1.4.9
    exec: usr/share/rustdesk/rustdesk
    exec_args: $@
  apt:
@@ -17,7 +17,8 @@ osx = platform.platform().startswith(
 hbb_name = 'rustdesk' + ('.exe' if windows else '')
 exe_path = 'target/release/' + hbb_name
 if windows:
-    flutter_build_dir = 'build/windows/x64/runner/Release/'
+    win_arch = 'arm64' if platform.machine().lower() in ('arm64', 'aarch64') else 'x64'
+    flutter_build_dir = f'build/windows/{win_arch}/runner/Release/'
 elif osx:
    flutter_build_dir = 'build/macos/Build/Products/Release/'
 else:
@@ -410,7 +411,12 @@ def build_flutter_dmg(version, features):
    system2(
        "cp target/release/liblibrustdesk.dylib target/release/librustdesk.dylib")
    os.chdir('flutter')
-    system2('flutter build macos --release')
+    # cargo builds a single-arch dylib for the host; restrict Xcode to the same arch
+    # so the universal-by-default ARCHS_STANDARD doesn't try to link a missing slice.
+    # FLUTTER_XCODE_* env vars are forwarded to xcodebuild as build settings.
+    mac_arch = 'arm64' if platform.machine().lower() in ('arm64', 'aarch64') else 'x86_64'
+    system2(
+        f'FLUTTER_XCODE_ARCHS={mac_arch} FLUTTER_XCODE_ONLY_ACTIVE_ARCH=YES flutter build macos --release')
    system2('cp -rf ../target/release/service ./build/macos/Build/Products/Release/RustDesk.app/Contents/MacOS/')
    '''
    system2(
@@ -506,6 +512,7 @@ def main():
                'target\\release\\rustdesk.exe')
        else:
            print('Not signed')
+        os.makedirs(res_dir, exist_ok=True)
        system2(
            f'cp -rf target/release/RustDesk.exe {res_dir}')
        os.chdir('libs/portable')
@@ -8,6 +8,7 @@ package com.carriez.flutter_hbb

 import android.accessibilityservice.AccessibilityService
 import android.accessibilityservice.GestureDescription
+import android.content.Intent
 import android.graphics.Path
 import android.os.Build
 import android.os.Bundle
@@ -68,6 +69,16 @@ class InputService : AccessibilityService() {
            get() = ctx != null
    }

+    private fun notifyInputState() {
+        val inputState = isOpen.toString()
+        Handler(Looper.getMainLooper()).post {
+            MainActivity.flutterMethodChannel?.invokeMethod(
+                "on_state_changed",
+                mapOf("name" to "input", "value" to inputState)
+            )
+        }
+    }
+
    private val logTag = "input service"
    private var leftIsDown = false
    private var touchPath = Path()
@@ -716,6 +727,7 @@ class InputService : AccessibilityService() {
    override fun onServiceConnected() {
        super.onServiceConnected()
        ctx = this
+        notifyInputState()
        val info = AccessibilityServiceInfo()
        if (Build.VERSION.SDK_INT >= 33) {
            info.flags = FLAG_INPUT_METHOD_EDITOR or FLAG_RETRIEVE_INTERACTIVE_WINDOWS
@@ -734,8 +746,16 @@ class InputService : AccessibilityService() {

    override fun onDestroy() {
        ctx = null
+        // Keep this fallback even though onUnbind usually notifies first.
+        notifyInputState()
        super.onDestroy()
    }

+    override fun onUnbind(intent: Intent?): Boolean {
+        ctx = null
+        notifyInputState()
+        return super.onUnbind(intent)
+    }
+
    override fun onInterrupt() {}
 }
@@ -200,12 +200,13 @@ class MainActivity : FlutterActivity() {
                "stop_input" -> {
                    if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.N) {
                        InputService.ctx?.disableSelf()
+                    } else {
+                        InputService.ctx = null
+                        Companion.flutterMethodChannel?.invokeMethod(
+                            "on_state_changed",
+                            mapOf("name" to "input", "value" to InputService.isOpen.toString())
+                        )
                    }
-                    InputService.ctx = null
-                    Companion.flutterMethodChannel?.invokeMethod(
-                        "on_state_changed",
-                        mapOf("name" to "input", "value" to InputService.isOpen.toString())
-                    )
                    result.success(true)
                }
                "cancel_notification" -> {
@@ -0,0 +1,7 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="32" height="32" viewBox="0 0 32 32">
+  <g fill="#000000" fill-rule="evenodd">
+    <rect x="4" y="6" width="24" height="16" rx="3"/>
+    <rect x="14.5" y="22" width="3" height="2"/>
+    <rect x="9.5" y="24" width="13" height="2.5" rx="1.25"/>
+  </g>
+</svg>
@@ -6,83 +6,82 @@ ANDROID_ABI=$1

 # Build RustDesk dependencies for Android using vcpkg.json
 # Required:
-#   1. set VCPKG_ROOT / ANDROID_NDK path environment variables
+#   1. set VCPKG_ROOT / ANDROID_NDK_HOME path environment variables
 #   2. vcpkg initialized
 #   3. ndk, version: r25c or newer

-if [ -z "$ANDROID_NDK_HOME" ]; then
-  echo "Failed! Please set ANDROID_NDK_HOME"
-  exit 1
+if [ -z "${ANDROID_NDK_HOME}" ]; then
+	echo "ERROR: Please set ANDROID_NDK_HOME environment variable" 1>&2
+	exit 1
 fi

-if [ -z "$VCPKG_ROOT" ]; then
-  echo "Failed! Please set VCPKG_ROOT"
-  exit 1
+if [ -z "${VCPKG_ROOT}" ]; then
+	echo "ERROR: Please set VCPKG_ROOT environment variable" 1>&2
+	exit 1
 fi

-API_LEVEL="21"
+case "${ANDROID_ABI}" in
+arm64-v8a)
+	VCPKG_TARGET=arm64-android
+	;;
+armeabi-v7a)
+	VCPKG_TARGET=arm-neon-android
+	;;
+x86_64)
+	VCPKG_TARGET=x64-android
+	;;
+x86)
+	VCPKG_TARGET=x86-android
+	;;
+*)
+	echo "Usage: build_android_deps.sh <arm64-v8a|armeabi-v7a|x86_64|x86>" 1>&2
+	exit 1
+	;;
+esac

 # Get directory of this script

 SCRIPTDIR="$(readlink -f "$0")"
-SCRIPTDIR="$(dirname "$SCRIPTDIR")"
+SCRIPTDIR="$(dirname "${SCRIPTDIR}")"

 # Check if vcpkg.json is one level up - in root directory of RD

-if [ ! -f "$SCRIPTDIR/../vcpkg.json" ]; then
-  echo "Failed! Please check where vcpkg.json is!"
-  exit 1
+if [ ! -f "${SCRIPTDIR}/../vcpkg.json" ]; then
+	echo "ERROR: Can not find vcpkg.json in RustDesk top-level directory" 1>&2
+	exit 1
 fi

-# NDK llvm toolchain
+echo "INFO: Building and install vcpkg dependencies for Android ${ANDROID_ABI} ..."

-HOST_TAG="linux-x86_64" # current platform, set as `ls $ANDROID_NDK/toolchains/llvm/prebuilt/`
-TOOLCHAIN=$ANDROID_NDK/toolchains/llvm/prebuilt/$HOST_TAG
+pushd "${SCRIPTDIR}/.."

-function build {
-  ANDROID_ABI=$1
+"${VCPKG_ROOT}/vcpkg" install \
+	--triplet "${VCPKG_TARGET}" \
+	--x-install-root="${VCPKG_ROOT}/installed"

-  case "$ANDROID_ABI" in
-  arm64-v8a)
-     ABI=aarch64-linux-android$API_LEVEL
-     VCPKG_TARGET=arm64-android
-     ;;
-  armeabi-v7a)
-     ABI=armv7a-linux-androideabi$API_LEVEL
-     VCPKG_TARGET=arm-neon-android
-     ;;
-  x86_64)
-     ABI=x86_64-linux-android$API_LEVEL
-     VCPKG_TARGET=x64-android
-     ;;
-  x86)
-     ABI=i686-linux-android$API_LEVEL
-     VCPKG_TARGET=x86-android
-     ;;
-  *)
-     echo "ERROR: ANDROID_ABI must be one of: arm64-v8a, armeabi-v7a, x86_64, x86" >&2
-     return 1
-  esac
+popd

-  echo "*** [$ANDROID_ABI][Start] Build and install vcpkg dependencies"
-  pushd "$SCRIPTDIR/.."
-  $VCPKG_ROOT/vcpkg install --triplet $VCPKG_TARGET --x-install-root="$VCPKG_ROOT/installed"
-  popd
-  head -n 100 "${VCPKG_ROOT}/buildtrees/ffmpeg/build-$VCPKG_TARGET-rel-out.log" || true
-  echo "*** [$ANDROID_ABI][Finished] Build and install vcpkg dependencies"
+echo "INFO: Completed building vcpkg dependencies for Android ${ANDROID_ABI}"

-if [ -d "$VCPKG_ROOT/installed/arm-neon-android" ]; then
-  echo "*** [Start] Move arm-neon-android to arm-android"
+if [ "${ANDROID_ABI}" = 'armeabi-v7a' ]; then
+	# Symlink arm-neon-android to arm-android because cargo-ndk does not
+	# understand NEON suffix.

-  mv "$VCPKG_ROOT/installed/arm-neon-android" "$VCPKG_ROOT/installed/arm-android"
+	if [ -d "${VCPKG_ROOT}/installed/arm-neon-android" ]; then
+		echo 'INFO: Symlinking arm-neon-android to arm-android'

-  echo "*** [Finished] Move arm-neon-android to arm-android"
-fi
-}
-
-if [ ! -z "$ANDROID_ABI" ]; then
-  build "$ANDROID_ABI"
-else
-  echo "Usage: build-android-deps.sh <ANDROID-ABI>" >&2
-  exit 1
+		ln -sf \
+			"${VCPKG_ROOT}/installed/arm-neon-android" \
+			"${VCPKG_ROOT}/installed/arm-android"
+
+		echo 'INFO: Symlinked arm-neon-android to arm-android'
+	else
+		cat 0<<.a
+ERROR: 'vcpkg install' seem to complete successfully but
+directory '${VCPKG_ROOT}/installed/arm-neon-android' is missing!
+
+.a
+
+		exit 1
+	fi
 fi
@@ -1185,6 +1185,48 @@ void msgBox(SessionID sessionId, String type, String title, String text,
    VoidCallback? onSubmit,
    int? submitTimeout}) {
  dialogManager.dismissAll();
+  if (type.contains('insecure-connection')) {
+    Future<void> closeSession() async {
+      await bind.sessionSetCommon(
+        sessionId: sessionId,
+        key: 'continue-insecure-connection',
+        value: 'N',
+      );
+      dialogManager.dismissAll();
+      closeConnection();
+    }
+
+    void continueSession() {
+      unawaited(
+        bind.sessionSetCommon(
+          sessionId: sessionId,
+          key: 'continue-insecure-connection',
+          value: 'Y',
+        ),
+      );
+      dialogManager.dismissAll();
+    }
+
+    dialogManager.show(
+      (setState, close, context) => CustomAlertDialog(
+        title: null,
+        content: SelectionArea(child: msgboxContent(type, title, text)),
+        actions: [
+          dialogButton(
+            'Continue',
+            onPressed: continueSession,
+            isOutline: true,
+          ),
+          dialogButton('Disconnect', onPressed: closeSession),
+        ],
+        onSubmit: closeSession,
+        onCancel: closeSession,
+      ),
+      tag: '$sessionId-$type-$title-$text-$link',
+    );
+    return;
+  }
+
  List<Widget> buttons = [];
  bool hasOk = false;
  submit() {
@@ -3350,7 +3392,12 @@ Future<List<Rect>> getScreenRectList() async {
 }

 openMonitorInTheSameTab(int i, FFI ffi, PeerInfo pi,
-    {bool updateCursorPos = true}) {
+    {bool updateCursorPos = true, bool recordSelection = true}) {
+  if (recordSelection) {
+    ffi.ffiModel.lastUserDisplay = i;
+    ffi.ffiModel.cancelPendingRestoreTimer();
+    ffi.ffiModel.pendingMonitorRestore = null;
+  }
  final displays = i == kAllDisplayValue
      ? List.generate(pi.displays.length, (index) => index)
      : [i];
@@ -3957,6 +4004,11 @@ bool whitelistNotEmpty() {
  return v != '' && v != ',';
 }

+bool idWhitelistNotEmpty() {
+  final v = bind.mainGetOptionSync(key: kOptionIdWhitelist);
+  return v != '' && v != ',';
+}
+
 // `setMovable()` is only supported on macOS.
 //
 // On macOS, the window can be dragged by the tab bar by default.
@@ -205,6 +205,10 @@ void changeWhiteList({Function()? callback}) async {
          const SizedBox(
            height: 8.0,
          ),
+          Text(translate("whitelist_cidr_tip")),
+          const SizedBox(
+            height: 8.0,
+          ),
          Row(
            children: [
              Expanded(
@@ -282,6 +286,108 @@ void changeWhiteList({Function()? callback}) async {
  });
 }

+void changeIdWhiteList({Function()? callback}) async {
+  final curIdWhiteList = await bind.mainGetOption(key: kOptionIdWhitelist);
+  var newIdWhiteListField = curIdWhiteList == defaultOptionWhitelist
+      ? ''
+      : curIdWhiteList.split(',').join('\n');
+  var controller = TextEditingController(text: newIdWhiteListField);
+  var msg = "";
+  var isInProgress = false;
+  final isOptFixed = isOptionFixed(kOptionIdWhitelist);
+  gFFI.dialogManager.show((setState, close, context) {
+    return CustomAlertDialog(
+      title: Text(translate("ID whitelisting")),
+      content: Column(
+        crossAxisAlignment: CrossAxisAlignment.start,
+        children: [
+          Text(translate("whitelist_sep")),
+          const SizedBox(
+            height: 8.0,
+          ),
+          Text(translate("id_whitelist_wildcard_tip")),
+          const SizedBox(
+            height: 8.0,
+          ),
+          Text(translate("id_whitelist_caveat_tip")),
+          const SizedBox(
+            height: 8.0,
+          ),
+          Row(
+            children: [
+              Expanded(
+                child: TextField(
+                        maxLines: null,
+                        decoration: InputDecoration(
+                          errorText: msg.isEmpty ? null : translate(msg),
+                        ),
+                        controller: controller,
+                        enabled: !isOptFixed,
+                        autofocus: true)
+                    .workaroundFreezeLinuxMint(),
+              ),
+            ],
+          ),
+          const SizedBox(
+            height: 4.0,
+          ),
+          // NOT use Offstage to wrap LinearProgressIndicator
+          if (isInProgress) const LinearProgressIndicator(),
+        ],
+      ),
+      actions: [
+        dialogButton("Cancel", onPressed: close, isOutline: true),
+        if (!isOptFixed)
+          dialogButton("Clear", onPressed: () async {
+            await bind.mainSetOption(
+                key: kOptionIdWhitelist, value: defaultOptionWhitelist);
+            callback?.call();
+            close();
+          }, isOutline: true),
+        if (!isOptFixed)
+          dialogButton(
+            "OK",
+            onPressed: () async {
+              setState(() {
+                msg = "";
+                isInProgress = true;
+              });
+              newIdWhiteListField = controller.text.trim();
+              var newIdWhiteList = "";
+              if (newIdWhiteListField.isEmpty) {
+                // pass
+              } else {
+                final ids =
+                    newIdWhiteListField.trim().split(RegExp(r"[\s,;\n]+"));
+                // test id, wildcards '*' and '?' are allowed;
+                // '@' '.' ':' occur in cross-server IDs like "123456789@server:port"
+                final idMatch = RegExp(r"^[a-zA-Z0-9\_\-\*\?\@\.\:]+$");
+                for (final id in ids) {
+                  if (!idMatch.hasMatch(id)) {
+                    msg = "${translate("Invalid ID")} $id";
+                    setState(() {
+                      isInProgress = false;
+                    });
+                    return;
+                  }
+                }
+                newIdWhiteList = ids.join(',');
+              }
+              if (newIdWhiteList.trim().isEmpty) {
+                newIdWhiteList = defaultOptionWhitelist;
+              }
+              await bind.mainSetOption(
+                  key: kOptionIdWhitelist, value: newIdWhiteList);
+              callback?.call();
+              close();
+            },
+          ),
+      ],
+      onCancel: close,
+    );
+  });
+}
+
 Future<String> changeDirectAccessPort(
    String currentIP, String currentPort) async {
  final controller = TextEditingController(text: currentPort);
@@ -72,10 +72,24 @@ Widget waylandKeyboardScopeChip(BuildContext context, String text) {
  );
 }

-// macOS privacy mode blacks out all online displays, so switching the remote
-// display does not weaken the local privacy protection.
-bool allowDisplaySwitchInPrivacyMode(PeerInfo pi) {
-  return pi.platform == kPeerPlatformMacOS;
+bool _isWindowsMode1PrivacyImpl(String privacyModeImpl) {
+  return privacyModeImpl == kPrivacyModeImplMag ||
+      privacyModeImpl == kPrivacyModeImplExcludeFromCapture;
+}
+
+// macOS privacy mode blacks out all online displays. Windows Mode 1 also
+// covers every local monitor with privacy overlay windows, so remote display
+// switching does not weaken local privacy protection.
+//
+// Keep this separate from the capture backend capability. The legacy Windows
+// magnifier capturer is not reliable for multi-monitor capture; WebRTC's
+// screen_capturer_win_magnifier also disables it when SM_CMONITORS != 1:
+// https://webrtc.googlesource.com/src/+/1845922d5a1bf9c27deeffb4a8c8daea124434c1/modules/desktop_capture/win/screen_capturer_win_magnifier.cc
+bool allowDisplaySwitchInPrivacyMode(PeerInfo pi, String privacyModeImpl) {
+  return pi.platform == kPeerPlatformMacOS ||
+      (pi.platform == kPeerPlatformWindows &&
+          _isWindowsMode1PrivacyImpl(privacyModeImpl) &&
+          versionCmp(pi.version, '1.4.8') >= 0);
 }

 class TTextMenu {
@@ -592,7 +606,7 @@ List<TTextMenu> toolbarControls(BuildContext context, String id, FFI ffi) {
  // to-do:
  // 1. Web desktop
  // 2. Mobile, copy the image to the clipboard
-  if (isDesktop) {
+  if ((isDefaultConn || ffi.connType == ConnType.viewCamera) && isDesktop) {
    final isScreenshotSupported = bind.sessionGetCommonSync(
        sessionId: sessionId, key: 'is_screenshot_supported', param: '');
    if ('true' == isScreenshotSupported) {
@@ -964,7 +978,8 @@ Future<List<TToggleMenu>> toolbarDisplayToggle(

  final privacyModeState = PrivacyModeState.find(id);
  if (pi.isSupportMultiDisplay &&
-      (privacyModeState.isEmpty || allowDisplaySwitchInPrivacyMode(pi)) &&
+      (privacyModeState.isEmpty ||
+          allowDisplaySwitchInPrivacyMode(pi, privacyModeState.value)) &&
      pi.displaysCount.value > 1 &&
      bind.mainGetUserDefaultOption(key: kKeyShowMonitorsToolbar) == 'Y') {
    final value =
@@ -1048,7 +1063,20 @@ List<TToggleMenu> toolbarPrivacyMode(
    return []; // No permission and not active, hide options.
  }

-  getDefaultMenu(Future<void> Function(SessionID sid, String opt) toggleFunc) {
+  bool checkDisplayAllowedForPrivacyMode(String targetImplKey, bool turnOn) {
+    if (!turnOn ||
+        allowDisplaySwitchInPrivacyMode(pi, targetImplKey) ||
+        (ffiModel.pi.currentDisplay == 0 &&
+            !bind.sessionIsMultiUiSession(sessionId: sessionId))) {
+      return true;
+    }
+    msgBox(sessionId, 'custom-nook-nocancel-hasclose', 'info',
+        'Please switch to Display 1 first', '', ffi.dialogManager);
+    return false;
+  }
+
+  getDefaultMenu(Future<void> Function(SessionID sid, String opt) toggleFunc,
+      String targetImplKey) {
    final enabled = !ffiModel.viewOnly &&
        (hasPrivacyModePermission || privacyModeState.isNotEmpty);
    return TToggleMenu(
@@ -1056,16 +1084,7 @@ List<TToggleMenu> toolbarPrivacyMode(
        onChanged: enabled
            ? (value) {
                if (value == null) return;
-                if (!allowDisplaySwitchInPrivacyMode(pi) &&
-                    ffiModel.pi.currentDisplay != 0 &&
-                    ffiModel.pi.currentDisplay != kAllDisplayValue) {
-                  msgBox(
-                      sessionId,
-                      'custom-nook-nocancel-hasclose',
-                      'info',
-                      'Please switch to Display 1 first',
-                      '',
-                      ffi.dialogManager);
+                if (!checkDisplayAllowedForPrivacyMode(targetImplKey, value)) {
                  return;
                }
                final option = 'privacy-mode';
@@ -1083,7 +1102,7 @@ List<TToggleMenu> toolbarPrivacyMode(
      getDefaultMenu((sid, opt) async {
        bind.sessionToggleOption(sessionId: sid, value: opt);
        togglePrivacyModeTime = DateTime.now();
-      })
+      }, kPrivacyModeImplMag)
    ];
  }
  if (privacyModeImpls.isEmpty) {
@@ -1097,7 +1116,7 @@ List<TToggleMenu> toolbarPrivacyMode(
        bind.sessionTogglePrivacyMode(
            sessionId: sid, implKey: implKey, on: privacyModeState.isEmpty);
        togglePrivacyModeTime = DateTime.now();
-      })
+      }, implKey)
    ];
  } else {
    final visibleImpls = hasPrivacyModePermission
@@ -1118,6 +1137,9 @@ List<TToggleMenu> toolbarPrivacyMode(
              ? (value) {
                  if (value == null) return;
                  if (value && !hasPrivacyModePermission) return;
+                  if (!checkDisplayAllowedForPrivacyMode(implKey, value)) {
+                    return;
+                  }
                  togglePrivacyModeTime = DateTime.now();
                  bind.sessionTogglePrivacyMode(
                      sessionId: sessionId, implKey: implKey, on: value);
@@ -29,6 +29,10 @@ const String kPlatformAdditionsHasFileClipboard = "has_file_clipboard";
 const String kPlatformAdditionsSupportedPrivacyModeImpl =
    "supported_privacy_mode_impl";

+const String kPrivacyModeImplMag = 'privacy_mode_impl_mag';
+const String kPrivacyModeImplExcludeFromCapture =
+    'privacy_mode_impl_exclude_from_capture';
+
 const String kPeerPlatformWindows = "Windows";
 const String kPeerPlatformLinux = "Linux";
 const String kPeerPlatformMacOS = "Mac OS";
@@ -91,6 +95,7 @@ const String kOptionForceAlwaysRelay = "force-always-relay";
 const String kOptionViewOnly = "view_only";
 const String kOptionEnableLanDiscovery = "enable-lan-discovery";
 const String kOptionWhitelist = "whitelist";
+const String kOptionIdWhitelist = "id-whitelist";
 const String kOptionEnableAbr = "enable-abr";
 const String kOptionEnableRecordSession = "enable-record-session";
 const String kOptionDirectServer = "direct-server";
@@ -170,6 +175,8 @@ const String kOptionShowVirtualMouse = "show-virtual-mouse";
 const String kOptionVirtualMouseScale = "virtual-mouse-scale";
 const String kOptionShowVirtualJoystick = "show-virtual-joystick";
 const String kOptionAllowAskForNoteAtEndOfConnection = "allow-ask-for-note";
+const String kOptionAllowMonitorSwitchMainToolbar = "allow-monitor-switch-main-toolbar";
+const String kOptionAllowMonitorSwitchMinToolbar = "allow-monitor-switch-min-toolbar";
 const String kOptionEnableShowTerminalExtraKeys = "enable-show-terminal-extra-keys";

 // network options
@@ -407,6 +407,7 @@ class _GeneralState extends State<_General> {
  final RxBool serviceStop =
      isWeb ? RxBool(false) : Get.find<RxBool>(tag: 'stop-service');
  RxBool serviceBtnEnabled = true.obs;
+  final GlobalKey _minToolbarOptionKey = GlobalKey();

  @override
  Widget build(BuildContext context) {
@@ -482,13 +483,15 @@ class _GeneralState extends State<_General> {
  }

  Widget other() {
+    final incomingOnly = bind.isIncomingOnly();
+    final outgoingOnly = bind.isOutgoingOnly();
    final showAutoUpdate = isWindows && bind.mainIsInstalled();
    final children = <Widget>[
-      if (!isWeb && !bind.isIncomingOnly())
+      if (!isWeb && !incomingOnly)
        _OptionCheckBox(context, 'Confirm before closing multiple tabs',
            kOptionEnableConfirmClosingTabs,
            isServer: false),
-      if (!bind.isIncomingOnly())
+      if (!incomingOnly)
        _OptionCheckBox(
          context,
          'allow-remote-toolbar-docking-any-edge',
@@ -498,9 +501,10 @@ class _GeneralState extends State<_General> {
            reloadAllWindows();
          },
        ),
-      _OptionCheckBox(context, 'Adaptive bitrate', kOptionEnableAbr),
+      if (!isWeb && !outgoingOnly)
+        _OptionCheckBox(context, 'Adaptive bitrate', kOptionEnableAbr),
      if (!isWeb) wallpaper(),
-      if (!isWeb && !bind.isIncomingOnly()) ...[
+      if (!isWeb && !incomingOnly) ...[
        _OptionCheckBox(
          context,
          'Open connection in new tab',
@@ -539,40 +543,40 @@ class _GeneralState extends State<_General> {
              isServer: false,
            ),
          ),
-        if (!isWeb && !bind.isCustomClient())
-          _OptionCheckBox(
-            context,
-            'Check for software update on startup',
-            kOptionEnableCheckUpdate,
-            isServer: false,
-          ),
-        if (showAutoUpdate)
-          _OptionCheckBox(
-            context,
-            'Auto update',
-            kOptionAllowAutoUpdate,
-            isServer: true,
-          ),
-        if (isWindows && !bind.isOutgoingOnly())
-          _OptionCheckBox(
-            context,
-            'Capture screen using DirectX',
-            kOptionDirectxCapture,
-          ),
-        if (!bind.isIncomingOnly()) ...[
-          _OptionCheckBox(
-            context,
-            'Enable UDP hole punching',
-            kOptionEnableUdpPunch,
-            isServer: false,
-          ),
-          _OptionCheckBox(
-            context,
-            'Enable IPv6 P2P connection',
-            kOptionEnableIpv6Punch,
-            isServer: false,
-          ),
-        ],
+      ],
+      if (!isWeb && !bind.isCustomClient())
+        _OptionCheckBox(
+          context,
+          'Check for software update on startup',
+          kOptionEnableCheckUpdate,
+          isServer: false,
+        ),
+      if (showAutoUpdate)
+        _OptionCheckBox(
+          context,
+          'Auto update',
+          kOptionAllowAutoUpdate,
+          isServer: true,
+        ),
+      if (isWindows && !outgoingOnly)
+        _OptionCheckBox(
+          context,
+          'Capture screen using DirectX',
+          kOptionDirectxCapture,
+        ),
+      if (!isWeb && !incomingOnly) ...[
+        _OptionCheckBox(
+          context,
+          'Enable UDP hole punching',
+          kOptionEnableUdpPunch,
+          isServer: false,
+        ),
+        _OptionCheckBox(
+          context,
+          'Enable IPv6 P2P connection',
+          kOptionEnableIpv6Punch,
+          isServer: false,
+        ),
      ],
    ];

@@ -605,6 +609,47 @@ class _GeneralState extends State<_General> {
        },
      ));
    }
+    children.add(_OptionCheckBox(
+      context,
+      'Show monitor switch button on the main toolbar',
+      kOptionAllowMonitorSwitchMainToolbar,
+      isServer: false,
+      update: (enabled) async {
+        if (!enabled) {
+          await mainSetLocalBoolOption(
+              kOptionAllowMonitorSwitchMinToolbar, false);
+        }
+        if (mounted) setState(() {});
+        reloadAllWindows();
+        if (enabled) {
+          WidgetsBinding.instance.addPostFrameCallback((_) {
+            final ctx = _minToolbarOptionKey.currentContext;
+            if (ctx != null) {
+              Scrollable.ensureVisible(
+                ctx,
+                alignment: 0.5,
+                duration: const Duration(milliseconds: 250),
+                curve: Curves.easeInOut,
+              );
+            }
+          });
+        }
+      },
+    ));
+    if (mainGetLocalBoolOptionSync(kOptionAllowMonitorSwitchMainToolbar)) {
+      children.add(KeyedSubtree(
+        key: _minToolbarOptionKey,
+        child: _OptionCheckBox(
+          context,
+          'Show on the minimized toolbar',
+          kOptionAllowMonitorSwitchMinToolbar,
+          isServer: false,
+          update: (_) {
+            reloadAllWindows();
+          },
+        ).marginOnly(left: _kCheckBoxLeftMargin * 3),
+      ));
+    }
    return _Card(title: 'Other', children: children);
  }

@@ -1252,6 +1297,7 @@ class _SafetyState extends State<_Safety> with AutomaticKeepAliveClientMixin {
          reverse: true, enabled: enabled),
      ...directIp(context),
      whitelist(),
+      idWhitelist(),
      ...autoDisconnect(context),
      _OptionCheckBox(context, 'keep-awake-during-incoming-sessions-label',
          kOptionKeepAwakeDuringIncomingSessions,
@@ -1409,6 +1455,52 @@ class _SafetyState extends State<_Safety> with AutomaticKeepAliveClientMixin {
    return tmpWrapper();
  }

+  Widget idWhitelist() {
+    bool enabled = !locked;
+    RxBool hasIdWhitelist = idWhitelistNotEmpty().obs;
+    update() async {
+      hasIdWhitelist.value = idWhitelistNotEmpty();
+    }
+
+    onChanged(bool? checked) async {
+      changeIdWhiteList(callback: update);
+    }
+
+    final isOptFixed = isOptionFixed(kOptionIdWhitelist);
+    return GestureDetector(
+      child: Tooltip(
+        message: translate('id_whitelist_tip'),
+        child: Obx(() => Row(
+              children: [
+                Checkbox(
+                        value: hasIdWhitelist.value,
+                        onChanged: enabled && !isOptFixed ? onChanged : null)
+                    .marginOnly(right: 5),
+                Offstage(
+                  offstage: !hasIdWhitelist.value,
+                  child: MouseRegion(
+                    child: const Icon(Icons.warning_amber_rounded,
+                            color: Color.fromARGB(255, 255, 204, 0))
+                        .marginOnly(right: 5),
+                    cursor: SystemMouseCursors.click,
+                  ),
+                ),
+                Expanded(
+                    child: Text(
+                  translate('Use ID whitelisting'),
+                  style: TextStyle(color: disabledTextColor(context, enabled)),
+                ))
+              ],
+            )),
+      ),
+      onTap: enabled
+          ? () {
+              onChanged(!hasIdWhitelist.value);
+            }
+          : null,
+    ).marginOnly(left: _kCheckBoxLeftMargin);
+  }
+
  Widget hide_cm(bool enabled) {
    return ChangeNotifierProvider.value(
        value: gFFI.serverModel,
@@ -2369,17 +2461,20 @@ class _AboutState extends State<_About> {
      final version = await bind.mainGetVersion();
      final buildDate = await bind.mainGetBuildDate();
      final fingerprint = await bind.mainGetFingerprint();
+      final myId = await bind.mainGetMyId();
      return {
        'license': license,
        'version': version,
        'buildDate': buildDate,
-        'fingerprint': fingerprint
+        'fingerprint': fingerprint,
+        'myId': myId
      };
    }(), hasData: (data) {
      final license = data['license'].toString();
      final version = data['version'].toString();
      final buildDate = data['buildDate'].toString();
      final fingerprint = data['fingerprint'].toString();
+      final myId = data['myId'].toString();
      const linkStyle = TextStyle(decoration: TextDecoration.underline);
      final scrollController = ScrollController();
      return SingleChildScrollView(
@@ -2401,6 +2496,9 @@ class _AboutState extends State<_About> {
                SelectionArea(
                    child: Text('${translate('Fingerprint')}: $fingerprint')
                        .marginSymmetric(vertical: 4.0)),
+              SelectionArea(
+                  child: Text('${translate('ID')}: $myId')
+                      .marginSymmetric(vertical: 4.0)),
              InkWell(
                  onTap: () {
                    launchUrlString('https://rustdesk.com/privacy.html');
@@ -2429,7 +2527,7 @@ class _AboutState extends State<_About> {
                        crossAxisAlignment: CrossAxisAlignment.start,
                        children: [
                          Text(
-                            'Copyright © ${DateTime.now().toString().substring(0, 4)} Purslane Ltd.\n$license',
+                            'Copyright © ${DateTime.now().toString().substring(0, 4)} Purslane Tech Pte. Ltd.\n$license',
                            style: const TextStyle(color: Colors.white),
                          ),
                          Text(
@@ -495,14 +495,14 @@ class _CmHeaderState extends State<_CmHeader>
                if (client.type_() == ClientType.file)
                  FittedBox(
                    child: Text(
-                      translate("File Transfer"),
+                      translate("Transfer file"),
                      style: TextStyle(color: Colors.white70, fontSize: 12),
                    ),
                  ),
                if (client.type_() == ClientType.camera)
                  FittedBox(
                    child: Text(
-                      translate("View Camera"),
+                      translate("View camera"),
                      style: TextStyle(color: Colors.white70, fontSize: 12),
                    ),
                  ),
@@ -95,6 +95,13 @@ class _TerminalPageState extends State<TerminalPage>
    // Register this terminal model with FFI for event routing
    _ffi.registerTerminalModel(widget.terminalId, _terminalModel);

+    // Auto-close tab when shell exits
+    _terminalModel.onClosed = () {
+      if (mounted) {
+        widget.tabController.closeBy(widget.tabKey);
+      }
+    };
+
    // Initialize terminal connection
    WidgetsBinding.instance.addPostFrameCallback((_) {
      widget.tabController.onSelected?.call(widget.id);
@@ -779,6 +779,7 @@ class _RemoteToolbarState extends State<RemoteToolbar> {
          borderRadius: borderRadius,
          child: _DraggableShowHide(
            id: widget.id,
+            ffi: widget.ffi,
            sessionId: widget.ffi.sessionId,
            dragging: _dragging,
            fraction: _fraction,
@@ -805,13 +806,25 @@ class _RemoteToolbarState extends State<RemoteToolbar> {
      BuildContext context, _ToolbarEdge edge, bool isHorizontal) {
    final List<Widget> toolbarItems = [];
    toolbarItems.add(_PinMenu(state: widget.state));
+    toolbarItems.add(Obx(() {
+      final privacyModeState = PrivacyModeState.find(widget.id);
+      if ((privacyModeState.isEmpty ||
+              allowDisplaySwitchInPrivacyMode(pi, privacyModeState.value)) &&
+          pi.displaysCount.value > 1 &&
+          mainGetLocalBoolOptionSync(kOptionAllowMonitorSwitchMainToolbar)) {
+        return _MainMonitorSwitchButton(id: widget.id, ffi: widget.ffi);
+      } else {
+        return const Offstage();
+      }
+    }));
    if (!isWebDesktop) {
      toolbarItems.add(_MobileActionMenu(ffi: widget.ffi));
    }

    toolbarItems.add(Obx(() {
-      if ((PrivacyModeState.find(widget.id).isEmpty ||
-              allowDisplaySwitchInPrivacyMode(pi)) &&
+      final privacyModeState = PrivacyModeState.find(widget.id);
+      if ((privacyModeState.isEmpty ||
+              allowDisplaySwitchInPrivacyMode(pi, privacyModeState.value)) &&
          pi.displaysCount.value > 1) {
        return _MonitorMenu(
            id: widget.id,
@@ -964,6 +977,88 @@ class _MobileActionMenu extends StatelessWidget {
  }
 }

+class _MonitorCycle {
+  final String id;
+  final FFI ffi;
+  const _MonitorCycle(this.id, this.ffi);
+
+  PeerInfo get _pi => ffi.ffiModel.pi;
+  int get total => _pi.displays.length;
+  int get _current => CurrentDisplayState.find(id).value;
+  bool get _inRange => _current >= 0 && _current < total;
+
+  String get label => _inRange ? '${_current + 1}' : '*';
+  String get tooltip => '${translate('Switch display')} ($label/$total)';
+
+  void next() {
+    final t = total;
+    if (t < 2) return;
+    final from = _inRange ? _current : -1;
+    final target = (from + 1) % t;
+    final isChooseDisplayToOpenInNewWindow = _pi.isSupportMultiDisplay &&
+        bind.sessionGetDisplaysAsIndividualWindows(sessionId: ffi.sessionId) ==
+            'Y';
+    if (isChooseDisplayToOpenInNewWindow) {
+      openMonitorInNewTabOrWindow(target, ffi.id, _pi);
+    } else {
+      openMonitorInTheSameTab(target, ffi, _pi, updateCursorPos: false);
+    }
+  }
+}
+
+class _MainMonitorSwitchButton extends StatelessWidget {
+  final String id;
+  final FFI ffi;
+
+  const _MainMonitorSwitchButton({
+    Key? key,
+    required this.id,
+    required this.ffi,
+  }) : super(key: key);
+
+  @override
+  Widget build(BuildContext context) {
+    final cycle = _MonitorCycle(id, ffi);
+    return Obx(() {
+      if (cycle.total < 2) return const Offstage();
+      final label = cycle.label;
+
+      return _IconMenuButton(
+        tooltip: cycle.tooltip,
+        color: _ToolbarTheme.blueColor,
+        hoverColor: _ToolbarTheme.hoverBlueColor,
+        onPressed: cycle.next,
+        icon: SizedBox(
+          width: _ToolbarTheme.buttonSize,
+          height: _ToolbarTheme.buttonSize,
+          child: Stack(
+            alignment: const Alignment(0, -0.125),
+            children: [
+              SvgPicture.asset(
+                'assets/display_switcher.svg',
+                colorFilter:
+                    const ColorFilter.mode(Colors.white, BlendMode.srcIn),
+                width: _ToolbarTheme.buttonSize,
+                height: _ToolbarTheme.buttonSize,
+              ),
+              Text(
+                label,
+                textAlign: TextAlign.center,
+                style: const TextStyle(
+                  color: Colors.black,
+                  fontSize: 11,
+                  height: 1,
+                  fontWeight: FontWeight.bold,
+                ),
+              ),
+            ],
+          ),
+        ),
+      );
+    });
+  }
+}
+
 class _MonitorMenu extends StatelessWidget {
  final String id;
  final FFI ffi;
@@ -1072,8 +1167,8 @@ class _MonitorMenu extends StatelessWidget {
            tooltip: isMulti
                ? ''
                : isAllMonitors
-                    ? 'all monitors'
-                    : '#${i + 1} monitor',
+                    ? 'All monitors'
+                    : '#{${i + 1}} monitor',
            hMargin: isMulti ? null : 6,
            vMargin: isMulti ? null : 12,
            topLevel: false,
@@ -2757,7 +2852,7 @@ class _IconMenuButtonState extends State<_IconMenuButton> {
        horizontal: widget.hMargin ?? _ToolbarTheme.buttonHMargin,
        vertical: widget.vMargin ?? _ToolbarTheme.buttonVMargin);
    button = Tooltip(
-      message: widget.tooltip,
+      message: translate(widget.tooltip),
      child: button,
    );
    if (widget.topLevel) {
@@ -2970,6 +3065,7 @@ class RdoMenuButton<T> extends StatelessWidget {

 class _DraggableShowHide extends StatefulWidget {
  final String id;
+  final FFI ffi;
  final SessionID sessionId;
  final RxDouble fraction;
  final Rx<_ToolbarEdge> edge;
@@ -2993,6 +3089,7 @@ class _DraggableShowHide extends StatefulWidget {
  const _DraggableShowHide({
    Key? key,
    required this.id,
+    required this.ffi,
    required this.sessionId,
    required this.fraction,
    required this.edge,
@@ -3249,6 +3346,9 @@ class _DraggableShowHideState extends State<_DraggableShowHide> {
      mainAxisSize: MainAxisSize.min,
      children: [
        _buildDraggable(context),
+        Obx(() => collapse.isTrue
+            ? _MinimizedMonitorSwitchButton(id: widget.id, ffi: widget.ffi)
+            : const Offstage()),
        Obx(() => buttonWrapper(
              () {
                widget.setFullscreen(!isFullscreen.value);
@@ -3409,3 +3509,73 @@ class EdgeThicknessControl extends StatelessWidget {
    return slider;
  }
 }
+
+class _MinimizedMonitorSwitchButton extends StatelessWidget {
+  final String id;
+  final FFI ffi;
+
+  const _MinimizedMonitorSwitchButton({
+    Key? key,
+    required this.id,
+    required this.ffi,
+  }) : super(key: key);
+
+  @override
+  Widget build(BuildContext context) {
+    const double iconSize = 20;
+    final cycle = _MonitorCycle(id, ffi);
+
+    return Obx(() {
+      final label = cycle.label;
+      if (!mainGetLocalBoolOptionSync(kOptionAllowMonitorSwitchMainToolbar) ||
+          !mainGetLocalBoolOptionSync(kOptionAllowMonitorSwitchMinToolbar)) {
+        return const Offstage();
+      }
+      if (cycle.total < 2) return const Offstage();
+      final privacyModeState = PrivacyModeState.find(id);
+      if (privacyModeState.isNotEmpty &&
+          !allowDisplaySwitchInPrivacyMode(
+              ffi.ffiModel.pi, privacyModeState.value)) {
+        return const Offstage();
+      }
+
+      return Tooltip(
+        message: cycle.tooltip,
+        child: TextButton(
+          onPressed: cycle.next,
+          style: ButtonStyle(
+            minimumSize: MaterialStateProperty.all(const Size(0, 0)),
+            padding: MaterialStateProperty.all(EdgeInsets.zero),
+            backgroundColor: MaterialStateProperty.resolveWith((states) {
+              if (states.contains(MaterialState.hovered)) {
+                return _ToolbarTheme.blueColor.withOpacity(0.15);
+              }
+              return null;
+            }),
+          ),
+          child: Stack(
+            alignment: const Alignment(0, -0.125),
+            children: [
+              SvgPicture.asset(
+                'assets/display_switcher.svg',
+                colorFilter:
+                    ColorFilter.mode(_ToolbarTheme.blueColor, BlendMode.srcIn),
+                width: iconSize,
+                height: iconSize,
+              ),
+              Text(
+                label,
+                style: const TextStyle(
+                  color: Colors.white,
+                  fontSize: 9,
+                  height: 1,
+                  fontWeight: FontWeight.bold,
+                ),
+              ),
+            ],
+          ),
+        ),
+      );
+    });
+  }
+}
@@ -1220,7 +1220,11 @@ void showOptions(
  if (image != null) {
    displays.add(Padding(padding: const EdgeInsets.only(top: 8), child: image));
  }
-  if (pi.displays.length > 1 && pi.currentDisplay != kAllDisplayValue) {
+  final privacyModeState = PrivacyModeState.find(id);
+  if (pi.displays.length > 1 &&
+      pi.currentDisplay != kAllDisplayValue &&
+      (privacyModeState.isEmpty ||
+          allowDisplaySwitchInPrivacyMode(pi, privacyModeState.value))) {
    final cur = pi.currentDisplay;
    final children = <Widget>[];
    final isDarkTheme = MyTheme.currentThemeMode() == ThemeMode.dark;
@@ -1274,8 +1278,6 @@ void showOptions(
      await toolbarDisplayToggle(context, id, gFFI);

  List<TToggleMenu> privacyModeList = [];
-  // privacy mode
-  final privacyModeState = PrivacyModeState.find(id);
  if ((gFFI.ffiModel.pi.features.privacyMode && gFFI.ffiModel.keyboard) ||
      privacyModeState.isNotEmpty) {
    privacyModeList = toolbarPrivacyMode(privacyModeState, context, id, gFFI);
@@ -78,6 +78,7 @@ class _SettingsState extends State<SettingsPage> with WidgetsBindingObserver {
  var _enableAbr = false;
  var _denyLANDiscovery = false;
  var _onlyWhiteList = false;
+  var _onlyIdWhiteList = false;
  var _enableDirectIPAccess = false;
  var _enableRecordSession = false;
  var _enableHardwareCodec = false;
@@ -89,6 +90,7 @@ class _SettingsState extends State<SettingsPage> with WidgetsBindingObserver {
  var _directAccessPort = "";
  var _fingerprint = "";
  var _buildDate = "";
+  var _myId = "";
  var _autoDisconnectTimeout = "";
  var _hideServer = false;
  var _hideProxy = false;
@@ -109,6 +111,7 @@ class _SettingsState extends State<SettingsPage> with WidgetsBindingObserver {
    _denyLANDiscovery = !option2bool(kOptionEnableLanDiscovery,
        bind.mainGetOptionSync(key: kOptionEnableLanDiscovery));
    _onlyWhiteList = whitelistNotEmpty();
+    _onlyIdWhiteList = idWhitelistNotEmpty();
    _enableDirectIPAccess = option2bool(
        kOptionDirectServer, bind.mainGetOptionSync(key: kOptionDirectServer));
    _enableRecordSession = option2bool(kOptionEnableRecordSession,
@@ -217,6 +220,12 @@ class _SettingsState extends State<SettingsPage> with WidgetsBindingObserver {
        _buildDate = buildDate;
      }

+      final myId = await bind.mainGetMyId();
+      if (_myId != myId) {
+        update = true;
+        _myId = myId;
+      }
+
      final isUsingPublicServer = await bind.mainIsUsingPublicServer();
      if (_isUsingPublicServer != isUsingPublicServer) {
        update = true;
@@ -400,6 +409,29 @@ class _SettingsState extends State<SettingsPage> with WidgetsBindingObserver {
          changeWhiteList(callback: update);
        },
      ),
+      SettingsTile.switchTile(
+        title: Row(children: [
+          Expanded(child: Text(translate('Use ID whitelisting'))),
+          Offstage(
+                  offstage: !_onlyIdWhiteList,
+                  child: const Icon(Icons.warning_amber_rounded,
+                      color: Color.fromARGB(255, 255, 204, 0)))
+              .marginOnly(left: 5)
+        ]),
+        initialValue: _onlyIdWhiteList,
+        onToggle: (_) async {
+          update() async {
+            final onlyIdWhiteList = idWhitelistNotEmpty();
+            if (onlyIdWhiteList != _onlyIdWhiteList) {
+              setState(() {
+                _onlyIdWhiteList = onlyIdWhiteList;
+              });
+            }
+          }
+
+          changeIdWhiteList(callback: update);
+        },
+      ),
      SettingsTile.switchTile(
        title: Text(translate('Adaptive bitrate')),
        initialValue: _enableAbr,
@@ -982,6 +1014,14 @@ class _SettingsState extends State<SettingsPage> with WidgetsBindingObserver {
                    child: Text(_fingerprint),
                  ),
                  leading: Icon(Icons.fingerprint)),
+            SettingsTile(
+                onPressed: (context) => onCopyFingerprint(_myId),
+                title: Text(translate("ID")),
+                value: Padding(
+                  padding: EdgeInsets.symmetric(vertical: 8),
+                  child: Text(_myId),
+                ),
+                leading: Icon(Icons.perm_identity)),
            SettingsTile(
              title: Text(translate("Privacy Statement")),
              onPressed: (context) =>
@@ -83,6 +83,13 @@ class _TerminalPageState extends State<TerminalPage>
    // Register this terminal model with FFI for event routing
    _ffi.registerTerminalModel(widget.terminalId, _terminalModel);

+    // Auto-close connection when shell exits
+    _terminalModel.onClosed = () {
+      if (mounted) {
+        closeConnection(id: widget.id);
+      }
+    };
+
    // Web desktop users have full hardware keyboard access, so the on-screen
    // terminal extra keys bar is unnecessary and disabled.
    _showTerminalExtraKeys = !isWebDesktop &&
@@ -142,12 +142,22 @@ class FileModel {
  }

  Future<void> postOverrideFileConfirm(Map<String, dynamic> evt) async {
+    final id = int.tryParse(evt['id']?.toString() ?? '');
+    if (id == null || !jobController.hasTransferConflictJob(id)) {
+      debugPrint("Ignore stale override confirm event: $evt");
+      return;
+    }
    evtLoop.pushEvent(
        _FileDialogEvent(WeakReference(this), FileDialogType.overwrite, evt));
  }

  Future<void> overrideFileConfirm(Map<String, dynamic> evt,
      {bool? overrideConfirm, bool skip = false}) async {
+    final id = int.tryParse(evt['id']?.toString() ?? '') ?? 0;
+    if (id == 0 || !jobController.hasTransferConflictJob(id)) {
+      debugPrint("Ignore override confirm for inactive job: $evt");
+      return;
+    }
    // If `skip == true`, it means to skip this file without showing dialog.
    // Because `resp` may be null after the user operation or the last remembered operation,
    // and we should distinguish them.
@@ -156,15 +166,12 @@ class FileModel {
            ? await showFileConfirmDialog(translate("Overwrite"),
                "${evt['read_path']}", true, evt['is_identical'] == "true")
            : null);
-    final id = int.tryParse(evt['id']) ?? 0;
+    if (!jobController.hasTransferConflictJob(id)) {
+      debugPrint("Ignore override confirm result for inactive job: $evt");
+      return;
+    }
    if (false == resp) {
-      final jobIndex = jobController.getJob(id);
-      if (jobIndex != -1) {
-        await jobController.cancelJob(id);
-        final job = jobController.jobTable[jobIndex];
-        job.state = JobState.done;
-        jobController.jobTable.refresh();
-      }
+      await jobController.cancelTransferConflictBatch(id);
    } else {
      var need_override = false;
      if (resp == null) {
@@ -176,6 +183,7 @@ class FileModel {
      }
      // Update the loop config.
      if (fileConfirmCheckboxRemember) {
+        jobController.rememberTransferConflictBatch(id, resp);
        evtLoop.setSkip(!need_override);
      }
      await bind.sessionSetConfirmOverrideFile(
@@ -285,6 +293,8 @@ class FileModel {
      final isWindows = otherSideData.options.isWindows;
      final showHidden = otherSideData.options.showHidden;
      final jobID = jobController.addTransferJob(entry, false);
+      jobController.registerTransferConflictBatch([jobID],
+          batchId: int.tryParse(obj['batchId']?.toString() ?? ''));
      webSendLocalFiles(
        handleIndex: handleIndex,
        actId: jobID,
@@ -570,8 +580,15 @@ class FileController {
    final toPath = otherSideData.directory.path;
    final isWindows = otherSideData.options.isWindows;
    final showHidden = otherSideData.options.showHidden;
+    final transferJobs = <(Entry, int)>[];
+    final transferJobIds = <int>[];
    for (var from in items.items) {
      final jobID = jobController.addTransferJob(from, isRemoteToLocal);
+      transferJobs.add((from, jobID));
+      transferJobIds.add(jobID);
+    }
+    jobController.registerTransferConflictBatch(transferJobIds);
+    for (final (from, jobID) in transferJobs) {
      bind.sessionSendFiles(
          sessionId: sessionId,
          actId: jobID,
@@ -917,6 +934,10 @@ class JobController {
  static final JobID jobID = JobID();
  final jobTable = List<JobProgress>.empty(growable: true).obs;
  final jobResultListener = JobResultListener<Map<String, dynamic>>();
+  int _nextTransferConflictBatchId = 1;
+  final Map<int, int> _transferConflictJobToBatch = {};
+  int? _transferConflictRememberBatchId;
+  bool? _transferConflictRememberOverrideConfirm;
  final GetSessionID getSessionID;
  final GetDialogManager getDialogManager;
  SessionID get sessionId => getSessionID();
@@ -929,6 +950,57 @@ class JobController {
    return jobTable.indexWhere((element) => element.id == id);
  }

+  void registerTransferConflictBatch(Iterable<int> jobIds, {int? batchId}) {
+    final ids = jobIds.toList(growable: false);
+    if (ids.isEmpty) {
+      return;
+    }
+    batchId ??= _nextTransferConflictBatchId++;
+    if (batchId >= _nextTransferConflictBatchId) {
+      _nextTransferConflictBatchId = batchId + 1;
+    }
+    for (final jobId in ids) {
+      _transferConflictJobToBatch[jobId] = batchId;
+    }
+  }
+
+  int? transferConflictBatchId(int jobId) {
+    return _transferConflictJobToBatch[jobId];
+  }
+
+  bool hasTransferConflictJob(int jobId) {
+    return transferConflictBatchId(jobId) != null;
+  }
+
+  bool isTransferConflictRememberBatch(int? batchId) {
+    return batchId != null && batchId == _transferConflictRememberBatchId;
+  }
+
+  bool? transferConflictRememberOverrideConfirm(int? batchId) {
+    if (!isTransferConflictRememberBatch(batchId)) {
+      return null;
+    }
+    return _transferConflictRememberOverrideConfirm;
+  }
+
+  void rememberTransferConflictBatch(int jobId, bool? overrideConfirm) {
+    _transferConflictRememberBatchId = _transferConflictJobToBatch[jobId];
+    _transferConflictRememberOverrideConfirm = overrideConfirm;
+  }
+
+  void unregisterTransferConflictJob(int jobId) {
+    final batchId = _transferConflictJobToBatch.remove(jobId);
+    if (batchId == null) {
+      return;
+    }
+    if (!_transferConflictJobToBatch.containsValue(batchId)) {
+      if (_transferConflictRememberBatchId == batchId) {
+        _transferConflictRememberBatchId = null;
+        _transferConflictRememberOverrideConfirm = null;
+      }
+    }
+  }
+
  // return jobID
  int addTransferJob(Entry from, bool isRemoteToLocal) {
    final jobID = JobController.jobID.next();
@@ -1000,7 +1072,10 @@ class JobController {
      id = int.parse(evt['id']);
    } catch (_) {}
    final jobIndex = getJob(id);
-    if (jobIndex == -1) return true;
+    if (jobIndex == -1) {
+      unregisterTransferConflictJob(id);
+      return true;
+    }
    final job = jobTable[jobIndex];
    job.recvJobRes = true;
    if (job.type == JobType.deleteFile) {
@@ -1026,6 +1101,9 @@ class JobController {
      job.state = JobState.done;
    }
    jobTable.refresh();
+    if (job.state == JobState.done || job.state == JobState.error) {
+      unregisterTransferConflictJob(id);
+    }
    if (job.type == JobType.deleteDir) {
      return job.state == JobState.done;
    } else {
@@ -1035,9 +1113,15 @@ class JobController {

  void jobError(Map<String, dynamic> evt) {
    final err = evt['err'].toString();
-    int jobIndex = getJob(int.parse(evt['id']));
+    final id = int.tryParse(evt['id']?.toString() ?? '');
+    if (id == null) {
+      debugPrint("Ignore job error with invalid id: $evt");
+      return;
+    }
+    int jobIndex = getJob(id);
    if (jobIndex != -1) {
      final job = jobTable[jobIndex];
+      if (job.state == JobState.done && job.err == "cancel") return;
      job.state = JobState.error;
      job.err = err;
      job.recvJobRes = true;
@@ -1060,6 +1144,11 @@ class JobController {
        }
      }
      jobTable.refresh();
+      if (job.state == JobState.done || job.state == JobState.error) {
+        unregisterTransferConflictJob(job.id);
+      }
+    } else {
+      unregisterTransferConflictJob(id);
    }
    if (err == _kOneWayFileTransferError) {
      if (DateTime.now().millisecondsSinceEpoch - _lastTimeShowMsgbox > 3000) {
@@ -1096,9 +1185,42 @@ class JobController {
  }

  Future<void> cancelJob(int id) async {
+    unregisterTransferConflictJob(id);
    await bind.sessionCancelJob(sessionId: sessionId, actId: id);
  }

+  Future<void> cancelTransferConflictBatch(int jobId) async {
+    final batchId = _transferConflictJobToBatch[jobId];
+    final batchJobIds = batchId == null ? [jobId] : <int>[];
+    if (batchId != null) {
+      for (final entry in _transferConflictJobToBatch.entries) {
+        if (entry.value == batchId) {
+          batchJobIds.add(entry.key);
+        }
+      }
+      for (final id in batchJobIds) {
+        unregisterTransferConflictJob(id);
+      }
+    }
+    final jobIdsToCancel = batchJobIds.toSet();
+    for (final job in jobTable) {
+      if (!jobIdsToCancel.contains(job.id) || job.state == JobState.done) {
+        continue;
+      }
+      job.state = JobState.done;
+      job.err = "cancel";
+      job.recvJobRes = true;
+    }
+    jobTable.refresh();
+    for (final id in batchJobIds) {
+      try {
+        await bind.sessionCancelJob(sessionId: sessionId, actId: id);
+      } catch (e) {
+        debugPrint("Failed to cancel transfer job $id in conflict batch: $e");
+      }
+    }
+  }
+
  Future<void> loadLastJob(Map<String, dynamic> evt) async {
    debugPrint("load last job: $evt");
    Map<String, dynamic> jobDetail = json.decode(evt['value']);
@@ -1145,7 +1267,7 @@ class JobController {
        ..state = JobState.paused;
      jobTable.add(jobProgress);
    }
-
+    registerTransferConflictBatch([currJobId]);
    await bind.sessionAddJob(
      sessionId: sessionId,
      isRemote: isRemote,
@@ -1193,6 +1315,9 @@ class JobController {

  void clear() {
    jobTable.clear();
+    _transferConflictJobToBatch.clear();
+    _transferConflictRememberBatchId = null;
+    _transferConflictRememberOverrideConfirm = null;
    jobResultListener.clear();
  }
 }
@@ -1535,6 +1660,9 @@ class JobProgress {

  String display() {
    if (type == JobType.transfer) {
+      if (state == JobState.done && err == "cancel") {
+        return translate("Cancel");
+      }
      if (state == JobState.done && err == "skipped") {
        return translate("Skipped");
      }
@@ -1844,21 +1972,44 @@ class _FileDialogEvent extends BaseEvent<FileDialogType, Map<String, dynamic>> {

 class FileDialogEventLoop
    extends BaseEventLoop<FileDialogType, Map<String, dynamic>> {
+  int? _batchId;
  bool? _overrideConfirm;
  bool _skip = false;

  @override
  Future<void> onPreConsume(
      BaseEvent<FileDialogType, Map<String, dynamic>> evt) async {
-    var event = evt as _FileDialogEvent;
+    final event = evt as _FileDialogEvent;
+    final model = event.fileModel.target;
+    final jobId = int.tryParse(evt.data['id']?.toString() ?? '');
+    final batchId = model == null || jobId == null
+        ? null
+        : model.jobController.transferConflictBatchId(jobId);
+    final keepRemembered = model != null &&
+        model.jobController.isTransferConflictRememberBatch(batchId);
+    // The loop only preloads the remembered batch choice. The model updates it
+    // after the user answers the current overwrite dialog.
+    if (_batchId != batchId && !keepRemembered) {
+      _batchId = batchId;
+      _overrideConfirm = null;
+      _skip = false;
+    } else {
+      _batchId = batchId;
+    }
+    if (keepRemembered) {
+      _overrideConfirm =
+          model.jobController.transferConflictRememberOverrideConfirm(batchId);
+      _skip = _overrideConfirm == null;
+    }
    event.setOverrideConfirm(_overrideConfirm);
    event.setSkip(_skip);
    debugPrint(
-        "FileDialogEventLoop: consuming<jobId: ${evt.data['id']} overrideConfirm: $_overrideConfirm, skip: $_skip>");
+        "FileDialogEventLoop: consuming<jobId: ${evt.data['id']} batchId: $_batchId overrideConfirm: $_overrideConfirm, skip: $_skip>");
  }

  @override
  Future<void> onEventsClear() {
+    _batchId = null;
    _overrideConfirm = null;
    _skip = false;
    return super.onEventsClear();
@@ -1307,7 +1307,8 @@ class InputModel {
    }
    if (isPhysicalMouse.value) {
      if (!_relativeMouse.handleRelativeMouseMove(e.localPosition)) {
-        handleMouse(_getMouseEvent(e, _kMouseEventMove), e.position,
+        final canvasPosition = _pointerPositionForRemoteCanvas(e);
+        handleMouse(_getMouseEvent(e, _kMouseEventMove), canvasPosition,
            edgeScroll: useEdgeScroll);
      }
    }
@@ -1548,7 +1549,8 @@ class InputModel {
        _relativeMouse
            .sendRelativeMouseButton(_getMouseEvent(e, _kMouseEventDown));
      } else {
-        handleMouse(_getMouseEvent(e, _kMouseEventDown), e.position);
+        final canvasPosition = _pointerPositionForRemoteCanvas(e);
+        handleMouse(_getMouseEvent(e, _kMouseEventDown), canvasPosition);
      }
    }
  }
@@ -1570,7 +1572,8 @@ class InputModel {
        _relativeMouse
            .sendRelativeMouseButton(_getMouseEvent(e, _kMouseEventUp));
      } else {
-        handleMouse(_getMouseEvent(e, _kMouseEventUp), e.position);
+        final canvasPosition = _pointerPositionForRemoteCanvas(e);
+        handleMouse(_getMouseEvent(e, _kMouseEventUp), canvasPosition);
      }
    }
  }
@@ -1592,12 +1595,40 @@ class InputModel {
    }
    if (isPhysicalMouse.value) {
      if (!_relativeMouse.handleRelativeMouseMove(e.localPosition)) {
-        handleMouse(_getMouseEvent(e, _kMouseEventMove), e.position,
+        final canvasPosition = _pointerPositionForRemoteCanvas(e);
+        handleMouse(_getMouseEvent(e, _kMouseEventMove), canvasPosition,
            edgeScroll: useEdgeScroll);
      }
    }
  }

+  /// Convert pointer coordinates into the visible remote canvas space.
+  ///
+  /// On mobile, the remote page body is wrapped in `SafeArea`, but the pointer
+  /// listener that feeds these events sits outside that subtree. As a result,
+  /// `event.localPosition` still includes the top/left safe-area inset.
+  ///
+  /// When the keyboard-visible path shows `KeyHelpTools`, the remote canvas is
+  /// also shifted downward by `CanvasModel.getAdjustY()`. The downstream mouse
+  /// mapping logic expects coordinates relative to the visible canvas area, so
+  /// we subtract both the mobile safe-area padding and the current canvas
+  /// adjustment before passing the position into mouse mapping.
+  ///
+  /// Desktop and web desktop continue to use the global position directly
+  /// because their pointer mapping is window-based.
+  Offset _pointerPositionForRemoteCanvas(PointerEvent event) {
+    if (isDesktop || isWebDesktop) {
+      return event.position;
+    }
+    final mediaData = MediaQueryData.fromView(
+        WidgetsBinding.instance.platformDispatcher.views.first);
+    final adjustY = parent.target?.canvasModel.getAdjustY() ?? 0.0;
+    return Offset(
+      event.localPosition.dx - mediaData.padding.left,
+      event.localPosition.dy - mediaData.padding.top - adjustY,
+    );
+  }
+
  static Future<Rect?> fillRemoteCoordsAndGetCurFrame(
      List<RemoteWindowCoords> remoteWindowCoords) async {
    final coords =
@@ -112,6 +112,9 @@ class CachedPeerData {
 class FfiModel with ChangeNotifier {
  CachedPeerData cachedPeerData = CachedPeerData();
  PeerInfo _pi = PeerInfo();
+  int? lastUserDisplay;
+  int? pendingMonitorRestore;
+  Timer? _pendingRestoreTimer;
  Rect? _rect;

  var _inputBlocked = false;
@@ -248,6 +251,8 @@ class FfiModel with ChangeNotifier {

  clear() {
    _pi = PeerInfo();
+    lastUserDisplay = null;
+    _cancelPendingMonitorRestore();
    _secure = null;
    _direct = null;
    _inputBlocked = false;
@@ -932,6 +937,7 @@ class FfiModel with ChangeNotifier {
      // frame briefly, then shows the Connecting overlay.
      if (_restartReconnectDelayTimer == null) {
        parent.target?.inputModel.setRelativeMouseMode(false);
+        _cancelPendingMonitorRestore();
        bind.sessionReconnect(sessionId: sessionId, forceRelay: false);
        clearPermissions();
        // Retry once more after the silent window so restart reconnect attempts
@@ -1084,10 +1090,22 @@ class FfiModel with ChangeNotifier {
    }
  }

+  void _cancelPendingMonitorRestore() {
+    _pendingRestoreTimer?.cancel();
+    _pendingRestoreTimer = null;
+    pendingMonitorRestore = null;
+  }
+
+  void cancelPendingRestoreTimer() {
+    _pendingRestoreTimer?.cancel();
+    _pendingRestoreTimer = null;
+  }
+
  void reconnect(OverlayDialogManager dialogManager, SessionID sessionId,
      bool forceRelay) {
    // Disable relative mouse mode before reconnecting to ensure cursor is released.
    parent.target?.inputModel.setRelativeMouseMode(false);
+    _cancelPendingMonitorRestore();
    bind.sessionReconnect(sessionId: sessionId, forceRelay: forceRelay);
    clearPermissions();
    dialogManager.dismissAll();
@@ -1401,6 +1419,25 @@ class FfiModel with ChangeNotifier {
        // now replaced to _updateCurDisplay
        updateCurDisplay(sessionId);
      }
+      // After reconnecting, restore the last selected monitor once the canvas is ready.
+      // Switching earlier can offset the view if the monitor sizes differ.
+      final last = lastUserDisplay;
+      pendingMonitorRestore = (!isCache &&
+              last != null &&
+              last != currentDisplay &&
+              bind.sessionGetUseAllMyDisplaysForTheRemoteSession(
+                      sessionId: sessionId) !=
+                  'Y' &&
+              ((last == kAllDisplayValue && _pi.displays.isNotEmpty) ||
+                  (last >= 0 && last < _pi.displays.length)))
+          ? last
+          : null;
+      // Fallback if the first image event never reaches this tab (multi-UI).
+      _pendingRestoreTimer?.cancel();
+      if (pendingMonitorRestore != null) {
+        _pendingRestoreTimer = Timer(const Duration(milliseconds: 1500),
+            () => parent.target?._applyPendingMonitorRestore());
+      }
      if (displays.isNotEmpty) {
        _reconnects = 1;
        _offlineReconnectStartTime = null;
@@ -3911,17 +3948,35 @@ class FFI {
    }
    if (ffiModel.waitForFirstImage.value == true) {
      ffiModel.waitForFirstImage.value = false;
+      ffiModel.cancelPendingRestoreTimer();
      ffiModel.resetRestartReconnectState();
      dialogManager.dismissAll();
-      await canvasModel.updateViewStyle();
-      await canvasModel.updateScrollStyle();
-      await canvasModel.initializeEdgeScrollEdgeThickness();
-      for (final cb in imageModel.callbacksOnFirstImage) {
-        cb(id);
+      try {
+        await canvasModel.updateViewStyle();
+        await canvasModel.updateScrollStyle();
+        await canvasModel.initializeEdgeScrollEdgeThickness();
+        for (final cb in imageModel.callbacksOnFirstImage) {
+          cb(id);
+        }
+      } finally {
+        _applyPendingMonitorRestore();
      }
    }
  }

+  void _applyPendingMonitorRestore() {
+    final restore = ffiModel.pendingMonitorRestore;
+    ffiModel._cancelPendingMonitorRestore();
+    if (restore == null || closed) return;
+    // The display list may have changed since the restore was queued.
+    final displays = ffiModel.pi.displays;
+    if ((restore == kAllDisplayValue && displays.isNotEmpty) ||
+        (restore >= 0 && restore < displays.length)) {
+      openMonitorInTheSameTab(restore, this, ffiModel.pi,
+          recordSelection: false, updateCursorPos: false);
+    }
+  }
+
  /// Login with [password], choose if the client should [remember] it.
  void login(String osUsername, String osPassword, SessionID sessionId,
      String password, bool remember) {
@@ -1,7 +1,6 @@
 import 'dart:async';
 import 'dart:convert';
 import 'package:desktop_multi_window/desktop_multi_window.dart';
-import 'package:flutter/foundation.dart';
 import 'package:flutter/material.dart';
 import 'package:flutter_hbb/common.dart';
 import 'package:flutter_hbb/consts.dart';
@@ -38,6 +37,10 @@ class TerminalModel with ChangeNotifier {

  void Function(int w, int h, int pw, int ph)? onResizeExternal;

+  /// Called when the terminal session ends (shell exits).
+  /// The listener (typically TerminalPage) can use this to auto-close the tab/page.
+  VoidCallback? onClosed;
+
  Future<void> _handleInput(String data) async {
    // Soft keyboards (notably iOS) emit '\n' when Enter is pressed, while a
    // real keyboard's Enter sends '\r'. Some Android keyboards also emit '\n'.
@@ -247,6 +250,33 @@ class TerminalModel with ChangeNotifier {
    }
  }

+  static int getExitCodeFromEvt(Map<String, dynamic> evt) {
+    if (evt.containsKey('exit_code')) {
+      final v = evt['exit_code'];
+      if (v is int) {
+        // Desktop and mobile send exit_code as an int
+        return v;
+      } else if (v is String) {
+        // Web sends exit_code as a string
+        final parsed = int.tryParse(v);
+        if (parsed != null) {
+          return parsed;
+        } else {
+          debugPrint(
+              '[TerminalModel] Failed to parse exit_code as integer: $v. Expected a numeric string.');
+          return 0;
+        }
+      } else {
+        debugPrint(
+            '[TerminalModel] Unexpected exit_code type: ${v.runtimeType}, value: $v. Expected int or String.');
+        return 0;
+      }
+    } else {
+      debugPrint('[TerminalModel] Event does not contain exit_code');
+      return 0;
+    }
+  }
+
  void handleTerminalResponse(Map<String, dynamic> evt) {
    final String? type = evt['type'];
    final int evtTerminalId = getTerminalIdFromEvt(evt);
@@ -469,10 +499,12 @@ class TerminalModel with ChangeNotifier {
  }

  void _handleTerminalClosed(Map<String, dynamic> evt) {
-    final int exitCode = evt['exit_code'] ?? 0;
+    final int exitCode = getExitCodeFromEvt(evt);
    _writeToTerminal('\r\nTerminal closed with exit code: $exitCode\r\n');
    _terminalOpened = false;
    notifyListeners();
+    // Auto-close the tab/page
+    onClosed?.call();
  }

  void _handleTerminalError(Map<String, dynamic> evt) {
@@ -1914,6 +1914,15 @@ class RustdeskImpl {
    throw UnimplementedError("sessionHandleScreenshot");
  }

+  Future<void> sessionSetCommon(
+      {required UuidValue sessionId, required String key, required String value, dynamic hint}) {
+      js.context.callMethod('setByName', [
+        'common',
+        jsonEncode({'name': key, 'value': value})
+      ]);
+      return Future.value();
+  }
+
  String? sessionGetCommonSync(
      {required UuidValue sessionId,
      required String key,
@@ -11,4 +11,4 @@ PRODUCT_NAME = RustDesk
 PRODUCT_BUNDLE_IDENTIFIER = com.carriez.flutterHbb

 // The copyright displayed in application information
-PRODUCT_COPYRIGHT = Copyright © 2025 Purslane Ltd. All rights reserved.
+PRODUCT_COPYRIGHT = Copyright © 2026 Purslane Tech Pte. Ltd. All rights reserved.
@@ -16,7 +16,7 @@ publish_to: "none" # Remove this line if you wish to publish to pub.dev
 # Read more about iOS versioning at
 # https://developer.apple.com/library/archive/documentation/General/Reference/InfoPlistKeyReference/Articles/CoreFoundationKeys.html
 # 1.1.9-1 works for android, but for ios it becomes 1.1.91, need to set it to 1.1.9-a.1 for iOS, will get 1.1.9.1, but iOS store not allow 4 numbers
-version: 1.4.8+66
+version: 1.4.9+67

 environment:
  sdk: '^3.1.0'
@@ -89,11 +89,11 @@ BEGIN
    BEGIN
        BLOCK "040904e4"
        BEGIN
-            VALUE "CompanyName", "Purslane Ltd" "\0"
+            VALUE "CompanyName", "Purslane Tech Pte. Ltd." "\0"
            VALUE "FileDescription", "RustDesk Remote Desktop" "\0"
            VALUE "FileVersion", VERSION_AS_STRING "\0"
            VALUE "InternalName", "rustdesk" "\0"
-            VALUE "LegalCopyright", "Copyright © 2025 Purslane Ltd. All rights reserved." "\0"
+            VALUE "LegalCopyright", "Copyright © 2026 Purslane Tech Pte. Ltd. All rights reserved." "\0"
            VALUE "OriginalFilename", "rustdesk.exe" "\0"
            VALUE "ProductName", "RustDesk" "\0"
            VALUE "ProductVersion", VERSION_AS_STRING "\0"
@@ -533,7 +533,7 @@ impl FuseServer {
        offset: i64,
        size: u32,
    ) -> Result<Vec<u8>, std::io::Error> {
-        // todo: async and concurrent read, generate stream_id per request
+        let request_stream_id = rand::random();
        let cb_requested = unsafe {
            // convert `size` from u32 to i32
            // yet with same bit representation
@@ -543,7 +543,7 @@ impl FuseServer {
        let (n_position_high, n_position_low) =
            ((offset >> 32) as i32, (offset & (u32::MAX as i64)) as i32);
        let request = ClipboardFile::FileContentsRequest {
-            stream_id: node.stream_id,
+            stream_id: request_stream_id,
            list_index: node.index as i32,
            dw_flags: 2,
            n_position_low,
@@ -573,7 +573,7 @@ impl FuseServer {
                    stream_id,
                    requested_data,
                } => {
-                    if stream_id != node.stream_id {
+                    if stream_id != request_stream_id {
                        log::debug!("stream id mismatch, ignore");
                        continue;
                    }
@@ -611,11 +611,6 @@ struct FuseNode {
    /// connection id
    pub conn_id: i32,

-    // todo: use stream_id to identify a FileContents request-reply
-    // instead of a whole file
-    /// stream id
-    pub stream_id: i32,
-
    /// file index in peer's file list
    /// NOTE:
    /// it is NOT the same as inode, this is the index in the file list
@@ -639,7 +634,6 @@ impl FuseNode {
    pub fn from_description(inode: Inode, desc: FileDescription) -> Self {
        Self {
            conn_id: desc.conn_id,
-            stream_id: rand::random(),
            index: inode as usize - 2,
            name: desc
                .name
@@ -656,7 +650,6 @@ impl FuseNode {
    pub fn new_root() -> Self {
        Self {
            conn_id: 0,
-            stream_id: rand::random(),
            index: 0,
            name: String::from("/"),
            parent: None,
@@ -4,7 +4,7 @@ use super::filetype::FileDescription;
 use crate::{ClipboardFile, CliprdrError};
 use cs::FuseServer;
 use fuser::MountOption;
-use hbb_common::{config::APP_NAME, log};
+use hbb_common::{config::Config, log};
 use parking_lot::Mutex;
 use std::{
    io,
@@ -15,13 +15,13 @@ use std::{

 lazy_static::lazy_static! {
    static ref FUSE_MOUNT_POINT_CLIENT: Arc<String> = {
-        let mnt_path = format!("/tmp/{}/{}", APP_NAME.read().unwrap(), "cliprdr-client");
+        let mnt_path = fuse_mount_point("cliprdr-client");
        // No need to run `canonicalize()` here.
        Arc::new(mnt_path)
    };

    static ref FUSE_MOUNT_POINT_SERVER: Arc<String> = {
-        let mnt_path = format!("/tmp/{}/{}", APP_NAME.read().unwrap(), "cliprdr-server");
+        let mnt_path = fuse_mount_point("cliprdr-server");
        // No need to run `canonicalize()` here.
        Arc::new(mnt_path)
    };
@@ -32,6 +32,21 @@ lazy_static::lazy_static! {

 static FUSE_TIMEOUT: Duration = Duration::from_secs(3);

+#[derive(Debug, PartialEq, Eq)]
+enum MountPointState {
+    HealthyMount,
+    NotMounted,
+    StaleMount,
+    Unknown,
+}
+
+fn fuse_mount_point(name: &str) -> String {
+    let mut path = PathBuf::from(Config::ipc_path(""));
+    path.pop();
+    path.push(name);
+    path.to_string_lossy().to_string()
+}
+
 pub fn get_exclude_paths(is_client: bool) -> Arc<String> {
    if is_client {
        FUSE_MOUNT_POINT_CLIENT.clone()
@@ -55,15 +70,26 @@ pub fn init_fuse_context(is_client: bool) -> Result<(), CliprdrError> {
        FUSE_CONTEXT_SERVER.lock()
    };
    if let Some(ctx) = fuse_context_lock.as_ref() {
-        if is_mount_point_healthy(&ctx.mount_point) {
-            return Ok(());
+        match inspect_mount_point_state(&ctx.mount_point) {
+            MountPointState::HealthyMount => return Ok(()),
+            MountPointState::StaleMount | MountPointState::NotMounted => {
+                log::warn!(
+                    "clipboard FUSE mount {} is disconnected, remounting",
+                    ctx.mount_point.display()
+                );
+                let stale_context = fuse_context_lock.take();
+                drop(fuse_context_lock);
+                drop(stale_context);
+                return init_fuse_context(is_client);
+            }
+            MountPointState::Unknown => {
+                log::warn!(
+                    "failed to verify clipboard FUSE mount {}",
+                    ctx.mount_point.display()
+                );
+                return Err(CliprdrError::CliprdrInit);
+            }
        }
-        log::warn!(
-            "clipboard FUSE mount {} is disconnected, remounting",
-            ctx.mount_point.display()
-        );
-        let stale_context = fuse_context_lock.take();
-        drop(stale_context);
    }
    let mount_point = if is_client {
        FUSE_MOUNT_POINT_CLIENT.clone()
@@ -72,10 +98,32 @@ pub fn init_fuse_context(is_client: bool) -> Result<(), CliprdrError> {
    };

    let mount_point = std::path::PathBuf::from(&*mount_point);
+    match inspect_mount_point_state(&mount_point) {
+        MountPointState::HealthyMount => {
+            log::warn!(
+                "clipboard FUSE mount {} is already active in another context",
+                mount_point.display()
+            );
+            return Err(CliprdrError::ClipboardOccupied);
+        }
+        MountPointState::StaleMount => {
+            log::warn!(
+                "clipboard FUSE mount {} is stale, cleaning up before remount",
+                mount_point.display()
+            );
+            unmount_fuse_mount_point(&mount_point);
+            validate_mount_state_after_stale_cleanup(
+                &mount_point,
+                inspect_mount_point_state(&mount_point),
+            )?;
+        }
+        MountPointState::Unknown => return Err(CliprdrError::CliprdrInit),
+        MountPointState::NotMounted => {}
+    }
    let (server, tx) = FuseServer::new(FUSE_TIMEOUT);
    let server = Arc::new(Mutex::new(server));

-    prepare_fuse_mount_point(&mount_point);
+    prepare_fuse_mount_point(&mount_point)?;
    let mnt_opts = [
        MountOption::FSName("rustdesk-cliprdr-fs".to_string()),
        MountOption::NoAtime,
@@ -168,57 +216,201 @@ struct FuseContext {
 }

 // this function must be called after the main IPC is up
-fn prepare_fuse_mount_point(mount_point: &Path) {
+fn prepare_fuse_mount_point(mount_point: &PathBuf) -> Result<(), CliprdrError> {
    use std::{
        fs::{self, Permissions},
        os::unix::prelude::PermissionsExt,
    };

    if let Some(parent) = mount_point.parent() {
+        reject_symlink_path(parent)?;
        if let Err(e) = fs::create_dir_all(parent) {
            log::warn!("failed to create FUSE mount parent {:?}: {:?}", parent, e);
+            return Err(CliprdrError::CliprdrInit);
        }
    }

-    unmount_fuse_mount_point(mount_point);
+    reject_symlink_path(mount_point)?;

-    if let Err(e) = fs::create_dir_all(mount_point) {
+    let recovered_stale_mount = if let Err(e) = fs::create_dir_all(mount_point) {
        log::warn!(
-            "failed to create FUSE mount point {:?}: {:?}",
-            mount_point,
+            "failed to create clipboard FUSE mount point {}, trying stale mount cleanup: {:?}",
+            mount_point.display(),
            e
        );
-    }
+        unmount_fuse_mount_point(mount_point);
+        fs::create_dir_all(mount_point).map_err(|e| {
+            log::error!(
+                "failed to create clipboard FUSE mount point {} after cleanup: {:?}",
+                mount_point.display(),
+                e
+            );
+            CliprdrError::CliprdrInit
+        })?;
+        true
+    } else {
+        false
+    };
    if let Err(e) = fs::set_permissions(mount_point, Permissions::from_mode(0o777)) {
        log::warn!(
-            "failed to set FUSE mount point permissions {:?}: {:?}",
-            mount_point,
+            "failed to set clipboard FUSE mount point permissions {}: {:?}",
+            mount_point.display(),
            e
        );
    }
+
+    if !recovered_stale_mount {
+        unmount_fuse_mount_point(mount_point);
+    }
+    Ok(())
 }

-fn is_mount_point_healthy(mount_point: &Path) -> bool {
-    is_mount_point_healthy_result(std::fs::metadata(mount_point))
+fn inspect_mount_point_state(mount_point: &Path) -> MountPointState {
+    if ensure_mount_point_path_is_safe(mount_point).is_err() {
+        return MountPointState::Unknown;
+    }
+    inspect_mount_point_state_with(
+        mount_point,
+        std::fs::metadata(mount_point),
+        std::fs::read_to_string("/proc/self/mountinfo"),
+    )
 }

-fn is_mount_point_healthy_result<T>(result: io::Result<T>) -> bool {
-    match result {
-        Ok(_) => true,
-        Err(e) => {
-            e.raw_os_error() != Some(libc::ENOTCONN) && e.kind() != io::ErrorKind::NotFound
+fn validate_mount_state_after_stale_cleanup(
+    mount_point: &Path,
+    mount_state: MountPointState,
+) -> Result<(), CliprdrError> {
+    match mount_state {
+        MountPointState::NotMounted => Ok(()),
+        MountPointState::HealthyMount => {
+            log::warn!(
+                "clipboard FUSE mount {} is still active after stale cleanup",
+                mount_point.display()
+            );
+            Err(CliprdrError::ClipboardOccupied)
+        }
+        MountPointState::StaleMount => {
+            log::warn!(
+                "clipboard FUSE mount {} is still stale after cleanup",
+                mount_point.display()
+            );
+            Err(CliprdrError::CliprdrInit)
+        }
+        MountPointState::Unknown => {
+            log::warn!(
+                "failed to verify clipboard FUSE mount {} after cleanup",
+                mount_point.display()
+            );
+            Err(CliprdrError::CliprdrInit)
        }
    }
 }

+fn inspect_mount_point_state_with<T>(
+    mount_point: &Path,
+    metadata_result: io::Result<T>,
+    mountinfo_result: io::Result<String>,
+) -> MountPointState {
+    match metadata_result {
+        Ok(_) => match mountinfo_result {
+            Ok(mountinfo) => {
+                if is_mount_point_listed_in_mountinfo(mount_point, &mountinfo) {
+                    MountPointState::HealthyMount
+                } else {
+                    MountPointState::NotMounted
+                }
+            }
+            Err(e) => {
+                log::warn!("failed to read mountinfo for {:?}: {:?}", mount_point, e);
+                MountPointState::Unknown
+            }
+        },
+        Err(e) if e.raw_os_error() == Some(libc::ENOTCONN) => MountPointState::StaleMount,
+        Err(e) if e.kind() == io::ErrorKind::NotFound => MountPointState::NotMounted,
+        Err(e) => {
+            log::warn!("failed to inspect FUSE mount {:?}: {:?}", mount_point, e);
+            MountPointState::Unknown
+        }
+    }
+}
+
+fn is_mount_point_listed_in_mountinfo(mount_point: &Path, mountinfo: &str) -> bool {
+    let mount_point = mount_point.to_string_lossy();
+    mountinfo.lines().any(|line| {
+        let mut fields = line.split_whitespace();
+        let _mount_id = fields.next();
+        let _parent_id = fields.next();
+        let _major_minor = fields.next();
+        let _root = fields.next();
+        let mount_path = fields.next();
+        mount_path == Some(mount_point.as_ref())
+    })
+}
+
+fn reject_symlink_metadata_result(
+    path: &Path,
+    metadata_result: io::Result<std::fs::Metadata>,
+    allow_disconnected_mount: bool,
+) -> Result<(), CliprdrError> {
+    match metadata_result {
+        Ok(metadata) if metadata.file_type().is_symlink() => {
+            log::warn!("refusing to use symlinked FUSE path {:?}", path);
+            Err(CliprdrError::CliprdrInit)
+        }
+        Ok(_) => Ok(()),
+        Err(e) if allow_disconnected_mount && e.raw_os_error() == Some(libc::ENOTCONN) => Ok(()),
+        Err(e) if e.kind() == io::ErrorKind::NotFound => Ok(()),
+        Err(e) => {
+            log::warn!("failed to inspect FUSE path {:?}: {:?}", path, e);
+            Err(CliprdrError::CliprdrInit)
+        }
+    }
+}
+
+fn reject_symlink_path(path: &Path) -> Result<(), CliprdrError> {
+    reject_symlink_metadata_result(path, std::fs::symlink_metadata(path), false)
+}
+
+fn ensure_mount_point_path_is_safe(mount_point: &Path) -> Result<(), CliprdrError> {
+    if let Some(parent) = mount_point.parent() {
+        reject_symlink_path(parent)?;
+    }
+    reject_symlink_metadata_result(mount_point, std::fs::symlink_metadata(mount_point), true)
+}
+
 fn unmount_fuse_mount_point(mount_point: &Path) {
-    if run_unmount_command("umount", &["-l"], mount_point) {
+    if ensure_mount_point_path_is_safe(mount_point).is_err() {
+        log::warn!(
+            "refusing to unmount unsafe clipboard FUSE mount point {:?}",
+            mount_point
+        );
        return;
    }
-    if run_unmount_command("fusermount3", &["-uz"], mount_point) {
+    if inspect_mount_point_state_with(
+        mount_point,
+        std::fs::metadata(mount_point),
+        std::fs::read_to_string("/proc/self/mountinfo"),
+    ) == MountPointState::NotMounted
+    {
        return;
    }
-    run_unmount_command("fusermount", &["-uz"], mount_point);
+    for (program, args) in unmount_command_candidates() {
+        if run_unmount_command(program, args, mount_point) {
+            return;
+        }
+    }
+    log::warn!(
+        "failed to unmount clipboard FUSE mount point {:?}",
+        mount_point
+    );
+}
+
+fn unmount_command_candidates() -> [(&'static str, &'static [&'static str]); 3] {
+    [
+        ("fusermount3", &["-uz"]),
+        ("fusermount", &["-uz"]),
+        ("umount", &["-l"]),
+    ]
 }

 fn run_unmount_command(program: &str, args: &[&str], mount_point: &Path) -> bool {
@@ -246,22 +438,24 @@ fn run_unmount_command(program: &str, args: &[&str], mount_point: &Path) -> bool
 }

 fn uninit_fuse_context_(is_client: bool) {
-    let mut fuse_context_lock = if is_client {
-        FUSE_CONTEXT_CLIENT.lock()
-    } else {
-        FUSE_CONTEXT_SERVER.lock()
+    let ctx = {
+        let mut fuse_context_lock = if is_client {
+            FUSE_CONTEXT_CLIENT.lock()
+        } else {
+            FUSE_CONTEXT_SERVER.lock()
+        };
+        fuse_context_lock.take()
    };
-    let ctx = fuse_context_lock.take();
    drop(ctx);
 }

 impl Drop for FuseContext {
    fn drop(&mut self) {
-        log::info!("unmounting clipboard FUSE from {}", self.mount_point.display());
-        unmount_fuse_mount_point(&self.mount_point);
-        if let Some(session) = self.session.lock().take() {
-            session.join();
-        }
+        self.session.lock().take().map(|s| s.join());
+        log::info!(
+            "unmounting clipboard FUSE from {}",
+            self.mount_point.display()
+        );
    }
 }

@@ -303,24 +497,60 @@ mod tests {
    use super::*;
    use std::{fs, io};

-    #[test]
-    fn reports_disconnected_fuse_mount_as_unhealthy() {
-        let err = io::Error::from_raw_os_error(libc::ENOTCONN);
+    #[cfg(target_family = "unix")]
+    use std::os::unix::fs::symlink;

-        assert!(!is_mount_point_healthy_result::<()>(Err(err)));
+    #[test]
+    fn classifies_mount_point_state_from_metadata_and_mountinfo() {
+        let mount_point = std::env::temp_dir().join(format!(
+            "rustdesk-fuse-mount-state-test-{}-{}",
+            std::process::id(),
+            line!()
+        ));
+        let mountinfo = format!(
+            "123 1 0:45 / {} rw,nosuid,nodev - fuse.rustdesk rustdesk rw\n",
+            mount_point.display()
+        );
+
+        assert_eq!(
+            inspect_mount_point_state_with(&mount_point, Ok(()), Ok(mountinfo)),
+            MountPointState::HealthyMount
+        );
+        assert_eq!(
+            inspect_mount_point_state_with(&mount_point, Ok(()), Ok(String::new())),
+            MountPointState::NotMounted
+        );
+
+        let disconnected_metadata: io::Result<()> =
+            Err(io::Error::from_raw_os_error(libc::ENOTCONN));
+        assert_eq!(
+            inspect_mount_point_state_with(&mount_point, disconnected_metadata, Ok(String::new())),
+            MountPointState::StaleMount
+        );
    }

    #[test]
-    fn reports_existing_directory_mount_point_as_healthy() {
-        let mount_point = std::env::temp_dir().join(format!(
-            "rustdesk-fuse-mount-health-test-{}",
-            std::process::id()
+    #[cfg(target_family = "unix")]
+    fn rejects_symlink_mount_point() {
+        let base = std::env::temp_dir().join(format!(
+            "rustdesk-fuse-symlink-test-{}-{}",
+            std::process::id(),
+            line!()
        ));
-        let _ = fs::remove_dir_all(&mount_point);
-        fs::create_dir(&mount_point).unwrap();
+        let mount_parent = base.join("parent");
+        let mount_point = mount_parent.join("cliprdr-client");
+        let symlink_target = base.join("symlink-target");
+        let _ = fs::remove_dir_all(&base);
+        fs::create_dir_all(&base).unwrap();
+        fs::create_dir_all(&mount_parent).unwrap();
+        fs::create_dir_all(&symlink_target).unwrap();
+        symlink(&symlink_target, &mount_point).unwrap();

-        assert!(is_mount_point_healthy(&mount_point));
+        assert!(matches!(
+            prepare_fuse_mount_point(&mount_point),
+            Err(CliprdrError::CliprdrInit)
+        ));

-        let _ = fs::remove_dir_all(&mount_point);
+        let _ = fs::remove_dir_all(&base);
    }
 }
@@ -192,20 +192,16 @@ impl LocalFile {
            });
        };

-        if offset != self.offset.load(Ordering::Relaxed) {
+        let read_result = if offset != self.offset.load(Ordering::Relaxed) {
            handle
                .seek(std::io::SeekFrom::Start(offset))
-                .map_err(|e| CliprdrError::FileError {
-                    path: self.path.to_string_lossy().to_string(),
-                    err: e,
-                })?;
+                .and_then(|_| handle.read_exact(buf))
+        } else {
+            handle.read_exact(buf)
+        };
+        if let Err(e) = read_result {
+            return Err(self.invalidate_handle(e));
        }
-        handle
-            .read_exact(buf)
-            .map_err(|e| CliprdrError::FileError {
-                path: self.path.to_string_lossy().to_string(),
-                err: e,
-            })?;
        let new_offset = offset + (buf.len() as u64);
        self.offset.store(new_offset, Ordering::Relaxed);

@@ -217,6 +213,15 @@ impl LocalFile {

        Ok(())
    }
+
+    fn invalidate_handle(&mut self, err: std::io::Error) -> CliprdrError {
+        self.offset.store(0, Ordering::Relaxed);
+        self.handle = None;
+        CliprdrError::FileError {
+            path: self.path.to_string_lossy().to_string(),
+            err,
+        }
+    }
 }

 pub(super) fn construct_file_list(paths: &[PathBuf]) -> Result<Vec<LocalFile>, CliprdrError> {
@@ -278,7 +283,10 @@ pub(super) fn construct_file_list(paths: &[PathBuf]) -> Result<Vec<LocalFile>, C

 #[cfg(test)]
 mod file_list_test {
-    use std::{path::PathBuf, sync::atomic::AtomicU64};
+    use std::{
+        path::PathBuf,
+        sync::atomic::{AtomicU64, Ordering},
+    };

    use hbb_common::bytes::{BufMut, BytesMut};

@@ -384,4 +392,30 @@ mod file_list_test {
        as_bin_parse_test("/test")?;
        Ok(())
    }
+
+    #[test]
+    fn read_exact_at_reopens_after_read_failure() -> Result<(), Box<dyn std::error::Error>> {
+        let file_path = std::env::temp_dir().join(format!(
+            "rustdesk-clipboard-local-file-{}",
+            std::process::id()
+        ));
+        std::fs::write(&file_path, b"")?;
+
+        let mut file = LocalFile::try_open(&std::env::temp_dir(), &file_path)?;
+        file.size = 1;
+
+        let mut buf = [0u8; 1];
+        assert!(file.read_exact_at(&mut buf, 0).is_err());
+        assert!(file.handle.is_none());
+        assert_eq!(file.offset.load(Ordering::Relaxed), 0);
+
+        std::fs::write(&file_path, [42u8])?;
+
+        file.read_exact_at(&mut buf, 0)?;
+        assert_eq!(buf, [42u8]);
+        assert!(file.handle.is_none());
+
+        std::fs::remove_file(file_path)?;
+        Ok(())
+    }
 }
@@ -5,7 +5,7 @@ use hbb_common::{
    log,
 };
 use parking_lot::Mutex;
-use std::{path::PathBuf, sync::Arc, usize};
+use std::{path::PathBuf, sync::Arc, time::SystemTime, usize};

 lazy_static::lazy_static! {
    // local files are cached, this value should not be changed when copying files
@@ -30,9 +30,35 @@ enum FileContentsRequest {
    },
 }

+// Cheap fingerprint of one top-level selected entry. A change in size/mtime --
+// or a directory in the selection -- forces sync_files() to rebuild (see below).
+#[derive(Debug, Default, Clone, PartialEq, Eq)]
+struct FileSig {
+    size: u64,
+    mtime: Option<SystemTime>,
+    is_dir: bool,
+}
+
+// Stat the top-level selected paths only (no recursion), same order as `files`.
+fn fingerprint(files: &[String]) -> Vec<FileSig> {
+    files
+        .iter()
+        .map(|s| match std::fs::metadata(s) {
+            Ok(mt) => FileSig {
+                size: mt.len(),
+                mtime: mt.modified().ok(),
+                is_dir: mt.is_dir(),
+            },
+            Err(_) => FileSig::default(),
+        })
+        .collect()
+}
+
 #[derive(Default)]
 struct ClipFiles {
    files: Vec<String>,
+    // Fingerprint of `files` (same len/order); detects in-place edits on re-copy.
+    sigs: Vec<FileSig>,
    file_list: Vec<LocalFile>,
    first_file_index: usize,
    files_pdu: Vec<u8>,
@@ -41,12 +67,17 @@ struct ClipFiles {
 impl ClipFiles {
    fn clear(&mut self) {
        self.files.clear();
+        self.sigs.clear();
        self.file_list.clear();
        self.first_file_index = usize::MAX;
        self.files_pdu.clear();
    }

-    fn sync_files(&mut self, clipboard_files: &[String]) -> Result<(), CliprdrError> {
+    fn sync_files(
+        &mut self,
+        clipboard_files: &[String],
+        sigs: Vec<FileSig>,
+    ) -> Result<(), CliprdrError> {
        let clipboard_paths = clipboard_files
            .iter()
            .map(|s| PathBuf::from(s))
@@ -58,6 +89,7 @@ impl ClipFiles {
            .position(|f| !f.path.is_dir())
            .unwrap_or(usize::MAX);
        self.files = clipboard_files.to_vec();
+        self.sigs = sigs;
        Ok(())
    }

@@ -258,14 +290,128 @@ pub fn read_file_contents(
 }

 pub fn sync_files(files: &[String]) -> Result<(), CliprdrError> {
+    // Dedup: skip the rebuild only when paths + sizes + mtimes match and no dir is
+    // selected (a dir's own mtime doesn't change when a file inside it is edited).
+    let current = fingerprint(files);
    let mut files_lock = CLIP_FILES.lock();
-    if files_lock.files == files {
+    if files_lock.files == files
+        && files_lock.sigs == current
+        && !current.iter().any(|sig| sig.is_dir)
+    {
        return Ok(());
    }
-    files_lock.sync_files(files)?;
+    files_lock.sync_files(files, current)?;
    Ok(files_lock.build_file_list_pdu())
 }

 pub fn get_file_list_pdu() -> Vec<u8> {
    CLIP_FILES.lock().files_pdu.clone()
 }
+
+#[cfg(test)]
+mod sig_test {
+    use super::*;
+    use std::fs;
+    use std::path::PathBuf;
+    use std::time::{SystemTime, UNIX_EPOCH};
+
+    // Unique temp dir under the system temp dir; removed on drop (no dev-dep).
+    struct TmpDir(PathBuf);
+    impl TmpDir {
+        fn new(tag: &str) -> Self {
+            let nanos = SystemTime::now()
+                .duration_since(UNIX_EPOCH)
+                .map(|d| d.as_nanos())
+                .unwrap_or(0);
+            let mut dir = std::env::temp_dir();
+            dir.push(format!("rustdesk_sig_test_{}_{}", tag, nanos));
+            fs::create_dir_all(&dir).unwrap();
+            TmpDir(dir)
+        }
+        fn join(&self, name: &str) -> PathBuf {
+            self.0.join(name)
+        }
+    }
+    impl Drop for TmpDir {
+        fn drop(&mut self) {
+            let _ = fs::remove_dir_all(&self.0);
+        }
+    }
+
+    fn path_str(p: &PathBuf) -> String {
+        p.to_string_lossy().to_string()
+    }
+
+    #[test]
+    fn fingerprint_missing_path_is_default() {
+        let tmp = TmpDir::new("missing");
+        let missing = path_str(&tmp.join("does_not_exist.bin"));
+        let sigs = fingerprint(&[missing]);
+        assert_eq!(sigs.len(), 1);
+        // A path that can't be stat'd -> default sig, which forces a rebuild.
+        assert_eq!(sigs[0], FileSig::default());
+        assert_eq!(sigs[0].mtime, None);
+    }
+
+    #[test]
+    fn fingerprint_detects_inplace_edit() {
+        let tmp = TmpDir::new("edit");
+        let file = tmp.join("a.bin");
+        fs::write(&file, b"small").unwrap();
+        let p = path_str(&file);
+
+        let before = fingerprint(&[p.clone()]);
+        // Same content, same path: fingerprint must be stable.
+        let again = fingerprint(&[p.clone()]);
+        assert_eq!(before, again);
+        assert_eq!(before[0].size, 5);
+        assert!(!before[0].is_dir);
+
+        // Edit in place so the file grows.
+        fs::write(&file, b"much larger contents than before").unwrap();
+        let after = fingerprint(&[p]);
+        assert_ne!(before, after);
+        assert!(after[0].size > before[0].size);
+    }
+
+    #[test]
+    fn fingerprint_flags_directory() {
+        let tmp = TmpDir::new("dir");
+        let sub = tmp.join("subdir");
+        fs::create_dir_all(&sub).unwrap();
+        let sigs = fingerprint(&[path_str(&sub)]);
+        assert_eq!(sigs.len(), 1);
+        assert!(sigs[0].is_dir);
+    }
+
+    #[test]
+    fn recopy_after_edit_refreshes_cached_size() {
+        let tmp = TmpDir::new("recopy");
+        let file = tmp.join("doc.bin");
+        fs::write(&file, b"v1").unwrap(); // 2 bytes
+        let files = vec![path_str(&file)];
+
+        // Drive the public, guarded `sync_files` over the global CLIP_FILES;
+        // reset first (this is the only test that touches the global).
+        clear_files();
+
+        sync_files(&files).unwrap();
+        {
+            let cache = CLIP_FILES.lock();
+            let idx = cache.first_file_index;
+            assert_eq!(cache.file_list[idx].size, 2);
+        }
+
+        // In-place edit grows the file; the re-copy must rebuild. Pre-fix the
+        // path-only guard early-returned and left the cached size stale at 2.
+        fs::write(&file, b"v2 is bigger").unwrap(); // 12 bytes
+        sync_files(&files).unwrap();
+        {
+            let cache = CLIP_FILES.lock();
+            let idx = cache.first_file_index;
+            assert_eq!(cache.file_list[idx].size, 12);
+        }
+
+        clear_files(); // leave the global clean for other tests
+    }
+}
@@ -41,6 +41,14 @@

 /* Maximum number of clipboard streams accepted from a remote peer (integer overflow / DoS guard) */
 #define WF_CLIPRDR_MAX_STREAMS 16384
+/* Registered clipboard formats use IDs 0xC000 through 0xFFFF.
+ * https://learn.microsoft.com/en-us/windows/win32/api/winuser/nf-winuser-registerclipboardformatw */
+#define WF_CLIPRDR_MAX_FORMATS 0x4000u
+/* Registered format names are string atoms; cap the converted WCHAR name.
+ * https://learn.microsoft.com/en-us/windows/win32/dataxchg/about-atom-tables */
+#define WF_CLIPRDR_MAX_FORMAT_NAME_WCHARS 255u
+/* Bound the peer-provided UTF-8 scan separately from the converted Windows name. */
+#define WF_CLIPRDR_MAX_FORMAT_NAME_UTF8_BYTES (WF_CLIPRDR_MAX_FORMAT_NAME_WCHARS * 4u)

 /* Validates the remote descriptor array size after cItems has been read safely. */
 static BOOL wf_cliprdr_file_group_descriptor_size_valid(SIZE_T size, UINT count)
@@ -61,6 +69,25 @@ static BOOL wf_cliprdr_file_group_descriptor_size_valid(SIZE_T size, UINT count)
 	return size >= descriptors_size;
 }

+static BOOL wf_cliprdr_bounded_strlen(const char *value, size_t max_len, size_t *len)
+{
+	size_t i;
+
+	if (!value || !len)
+		return FALSE;
+
+	for (i = 0; i <= max_len; i++)
+	{
+		if (value[i] == '\0')
+		{
+			*len = i;
+			return TRUE;
+		}
+	}
+
+	return FALSE;
+}
+
 /**
 * Clipboard Formats
 */
@@ -205,6 +232,7 @@ struct _CliprdrStream
 	FILEDESCRIPTORW m_Dsc;
 	void *m_pData;
 	UINT32 m_connID;
+	UINT32 m_streamId;   // unique CLIPRDR streamId; avoids leaking a heap pointer
 };
 typedef struct _CliprdrStream CliprdrStream;

@@ -258,6 +286,9 @@ struct wf_clipboard
 	char *req_fdata;
 	HANDLE req_fevent;
 	BOOL req_f_received;
+	UINT32 req_f_conn_id_expected;     // connID of the outstanding request
+	UINT32 req_f_stream_id_expected;   // streamId of the outstanding request; responses for another are dropped
+	LONG req_f_stream_id_seq;          // source of unique per-stream ids

 	size_t nFiles;
 	size_t file_array_size;
@@ -288,7 +319,7 @@ static UINT32 get_remote_format_id(wfClipboard *clipboard, UINT32 local_format);
 static UINT cliprdr_send_data_request(UINT32 connID, wfClipboard *clipboard, UINT32 format);
 static UINT cliprdr_send_lock(wfClipboard *clipboard);
 static UINT cliprdr_send_unlock(wfClipboard *clipboard);
-static UINT cliprdr_send_request_filecontents(wfClipboard *clipboard, UINT32 connID, const void *streamid,
+static UINT cliprdr_send_request_filecontents(wfClipboard *clipboard, UINT32 connID, UINT32 streamId,
 											  ULONG index, UINT32 flag, DWORD positionhigh,
 											  DWORD positionlow, ULONG request);

@@ -371,7 +402,7 @@ static ULONG STDMETHODCALLTYPE CliprdrStream_Release(IStream *This)
 static HRESULT STDMETHODCALLTYPE CliprdrStream_Read(IStream *This, void *pv, ULONG cb,
 													ULONG *pcbRead)
 {
-	int ret;
+	UINT ret;
 	CliprdrStream *instance = (CliprdrStream *)This;
 	wfClipboard *clipboard;

@@ -384,12 +415,23 @@ static HRESULT STDMETHODCALLTYPE CliprdrStream_Read(IStream *This, void *pv, ULO
 	if (instance->m_lOffset.QuadPart >= instance->m_lSize.QuadPart)
 		return S_FALSE;

-	ret = cliprdr_send_request_filecontents(clipboard, instance->m_connID, (void *)This, instance->m_lIndex,
+	ret = cliprdr_send_request_filecontents(clipboard, instance->m_connID, instance->m_streamId, instance->m_lIndex,
 											FILECONTENTS_RANGE, instance->m_lOffset.HighPart,
 											instance->m_lOffset.LowPart, cb);

-	if (ret < 0)
+	if (ret != CHANNEL_RC_OK)
+	{
+		free(clipboard->req_fdata);
+		clipboard->req_fdata = NULL;
 		return E_FAIL;
+	}
+
+	if (clipboard->req_fsize > cb)
+	{
+		free(clipboard->req_fdata);
+		clipboard->req_fdata = NULL;
+		return STG_E_READFAULT;
+	}

 	if (clipboard->req_fdata)
 	{
@@ -601,6 +643,7 @@ static CliprdrStream *CliprdrStream_New(UINT32 connID, ULONG index, void *pData,
 			instance->m_pData = pData;
 			instance->m_lOffset.QuadPart = 0;
 			instance->m_connID = connID;
+			instance->m_streamId = (UINT32)InterlockedIncrement(&clipboard->req_f_stream_id_seq);

 			if (instance->m_Dsc.dwFlags & FD_ATTRIBUTES)
 			{
@@ -611,16 +654,28 @@ static CliprdrStream *CliprdrStream_New(UINT32 connID, ULONG index, void *pData,
 			if (((instance->m_Dsc.dwFlags & FD_FILESIZE) == 0) && !isDir)
 			{
 				/* get content size of this stream */
-				if (cliprdr_send_request_filecontents(clipboard, instance->m_connID, (void *)instance,
+				if (cliprdr_send_request_filecontents(clipboard, instance->m_connID, instance->m_streamId,
 													  instance->m_lIndex, FILECONTENTS_SIZE, 0, 0,
 													  8) == CHANNEL_RC_OK)
 				{
 					success = TRUE;
 				}

-				if (clipboard->req_fdata != NULL)
+				if (clipboard->req_fdata != NULL && clipboard->req_fsize >= sizeof(LONGLONG))
+				{
+					LONGLONG sz = 0;
+					CopyMemory(&sz, clipboard->req_fdata, sizeof(sz));
+					if (sz < 0)
+						success = FALSE;
+					else
+						instance->m_lSize.QuadPart = sz;
+				}
+				else
+				{
+					success = FALSE;
+				}
+				if (clipboard->req_fdata)
 				{
-					instance->m_lSize.QuadPart = *((LONGLONG *)clipboard->req_fdata);
 					free(clipboard->req_fdata);
 					clipboard->req_fdata = NULL;
 				}
@@ -1406,25 +1461,35 @@ static UINT32 get_remote_format_id(wfClipboard *clipboard, UINT32 local_format)
 	return local_format;
 }

-static void map_ensure_capacity(wfClipboard *clipboard)
+static BOOL map_ensure_capacity(wfClipboard *clipboard, size_t capacity)
 {
+	size_t old_size;
+	formatMapping *new_map;
+
 	if (!clipboard)
-		return;
+		return FALSE;

-	if (clipboard->map_size >= clipboard->map_capacity)
-	{
-		size_t new_size;
-		formatMapping *new_map;
-		new_size = clipboard->map_capacity * 2;
-		new_map =
-			(formatMapping *)realloc(clipboard->format_mappings, sizeof(formatMapping) * new_size);
+	if (!clipboard->format_mappings)
+		return FALSE;

-		if (!new_map)
-			return;
+	if (capacity <= clipboard->map_capacity)
+		return TRUE;

-		clipboard->format_mappings = new_map;
-		clipboard->map_capacity = new_size;
-	}
+	if (capacity > WF_CLIPRDR_MAX_FORMATS ||
+	    capacity > ((size_t)-1) / sizeof(formatMapping))
+		return FALSE;
+
+	old_size = clipboard->map_capacity;
+	new_map =
+		(formatMapping *)realloc(clipboard->format_mappings, sizeof(formatMapping) * capacity);
+
+	if (!new_map)
+		return FALSE;
+
+	memset(new_map + old_size, 0, sizeof(formatMapping) * (capacity - old_size));
+	clipboard->format_mappings = new_map;
+	clipboard->map_capacity = capacity;
+	return TRUE;
 }

 static BOOL clear_format_map(wfClipboard *clipboard)
@@ -1451,6 +1516,13 @@ static BOOL clear_format_map(wfClipboard *clipboard)
 	return TRUE;
 }

+static UINT wf_cliprdr_server_format_list_fail(wfClipboard *clipboard)
+{
+	clear_format_map(clipboard);
+	clipboard->copied = FALSE;
+	return ERROR_INTERNAL_ERROR;
+}
+
 static UINT cliprdr_send_tempdir(wfClipboard *clipboard)
 {
 	CLIPRDR_TEMP_DIRECTORY tempDirectory;
@@ -1729,12 +1801,12 @@ static UINT cliprdr_send_data_request(UINT32 connID, wfClipboard *clipboard, UIN
 	return wait_response_event(connID, clipboard, clipboard->formatDataRespEvent, &clipboard->formatDataRespReceived, &clipboard->hmem);
 }

-UINT cliprdr_send_request_filecontents(wfClipboard *clipboard, UINT32 connID, const void *streamid, ULONG index,
+static UINT cliprdr_send_request_filecontents(wfClipboard *clipboard, UINT32 connID, UINT32 streamId, ULONG index,
 									   UINT32 flag, DWORD positionhigh, DWORD positionlow,
 									   ULONG nreq)
 {
 	UINT rc;
-	CLIPRDR_FILE_CONTENTS_REQUEST fileContentsRequest;
+	CLIPRDR_FILE_CONTENTS_REQUEST fileContentsRequest = { 0 };

 	if (!clipboard || !clipboard->context || !clipboard->context->ClientFileContentsRequest)
 		return ERROR_INTERNAL_ERROR;
@@ -1745,12 +1817,11 @@ UINT cliprdr_send_request_filecontents(wfClipboard *clipboard, UINT32 connID, co
 		return rc;
 	}
 	clipboard->req_f_received = FALSE;
+	clipboard->req_f_conn_id_expected = connID;
+	clipboard->req_f_stream_id_expected = streamId;

 	fileContentsRequest.connID = connID;
-	// streamId is `IStream*` pointer, though it is not very good on a 64-bit system.
-	// But it is OK, because it is only used to check if the stream is the same in
-	// `wf_cliprdr_server_file_contents_request()` function.
-	fileContentsRequest.streamId = (UINT32)(ULONG_PTR)streamid;
+	fileContentsRequest.streamId = streamId;
 	fileContentsRequest.listIndex = index;
 	fileContentsRequest.dwFlags = flag;
 	fileContentsRequest.nPositionLow = positionlow;
@@ -2443,6 +2514,16 @@ static UINT wf_cliprdr_server_format_list(CliprdrClientContext *context,

 	if (!clear_format_map(clipboard))
 		return ERROR_INTERNAL_ERROR;
+	clipboard->copied = FALSE;
+
+	if (formatList->numFormats > WF_CLIPRDR_MAX_FORMATS)
+		return ERROR_INTERNAL_ERROR;
+
+	if (formatList->numFormats > 0 && !formatList->formats)
+		return ERROR_INTERNAL_ERROR;
+
+	if (!map_ensure_capacity(clipboard, formatList->numFormats))
+		return ERROR_INTERNAL_ERROR;

 	clipboard->copied = TRUE;

@@ -2450,19 +2531,58 @@ static UINT wf_cliprdr_server_format_list(CliprdrClientContext *context,
 	{
 		format = &(formatList->formats[i]);
 		mapping = &(clipboard->format_mappings[i]);
+		/* Do not validate the peer-provided formatId as a Windows registered format.
+		 * It is only a remote protocol ID used when requesting data from the peer.
+		 * For named formats, RegisterClipboardFormatW creates the local Windows
+		 * clipboard ID below, and that local ID is checked before publishing. */
 		mapping->remote_format_id = format->formatId;

 		if (format->formatName)
 		{
-			int size = MultiByteToWideChar(CP_UTF8, 0, format->formatName,
-										   strlen(format->formatName), NULL, 0);
-			mapping->name = calloc(size + 1, sizeof(WCHAR));
+			size_t name_len;
+			int size;

-			if (mapping->name)
+			if (!wf_cliprdr_bounded_strlen(format->formatName,
+			                               WF_CLIPRDR_MAX_FORMAT_NAME_UTF8_BYTES, &name_len))
 			{
-				MultiByteToWideChar(CP_UTF8, 0, format->formatName, strlen(format->formatName),
-									mapping->name, size);
-				mapping->local_format_id = RegisterClipboardFormatW((LPWSTR)mapping->name);
+				return wf_cliprdr_server_format_list_fail(clipboard);
+			}
+
+			if (name_len == 0)
+			{
+				return wf_cliprdr_server_format_list_fail(clipboard);
+			}
+
+			size = MultiByteToWideChar(CP_UTF8, 0, format->formatName, (int)name_len,
+			                           NULL, 0);
+			if (size <= 0)
+			{
+				return wf_cliprdr_server_format_list_fail(clipboard);
+			}
+
+			if ((UINT)size > WF_CLIPRDR_MAX_FORMAT_NAME_WCHARS)
+			{
+				return wf_cliprdr_server_format_list_fail(clipboard);
+			}
+
+			mapping->name = calloc((size_t)size + 1, sizeof(WCHAR));
+			if (!mapping->name)
+			{
+				return wf_cliprdr_server_format_list_fail(clipboard);
+			}
+
+			if (MultiByteToWideChar(CP_UTF8, 0, format->formatName, (int)name_len,
+			                        mapping->name, size) != size)
+			{
+				free(mapping->name);
+				mapping->name = NULL;
+				return wf_cliprdr_server_format_list_fail(clipboard);
+			}
+
+			mapping->local_format_id = RegisterClipboardFormatW((LPWSTR)mapping->name);
+			if (mapping->local_format_id == 0)
+			{
+				return wf_cliprdr_server_format_list_fail(clipboard);
 			}
 		}
 		else
@@ -2472,7 +2592,6 @@ static UINT wf_cliprdr_server_format_list(CliprdrClientContext *context,
 		}

 		clipboard->map_size++;
-		map_ensure_capacity(clipboard);
 	}

 	if (file_transferring(clipboard))
@@ -2923,6 +3042,7 @@ wf_cliprdr_server_file_contents_request(CliprdrClientContext *context,
 	BOOL bIsStreamFile = TRUE;
 	static LPSTREAM pStreamStc = NULL;
 	static UINT32 uStreamIdStc = 0;
+	static UINT32 uConnIdStc = 0;
 	wfClipboard *clipboard;
 	UINT rc = ERROR_INTERNAL_ERROR;
 	UINT sRc;
@@ -2996,7 +3116,8 @@ wf_cliprdr_server_file_contents_request(CliprdrClientContext *context,
 	vFormatEtc.lindex = fileContentsRequest->listIndex;
 	vFormatEtc.ptd = NULL;

-	if ((uStreamIdStc != fileContentsRequest->streamId) || !pStreamStc)
+	if ((uStreamIdStc != fileContentsRequest->streamId) ||
+		(uConnIdStc != fileContentsRequest->connID) || !pStreamStc)
 	{
 		LPENUMFORMATETC pEnumFormatEtc;
 		ULONG CeltFetched;
@@ -3027,6 +3148,7 @@ wf_cliprdr_server_file_contents_request(CliprdrClientContext *context,
 						{
 							pStreamStc = vStgMedium.pstm;
 							uStreamIdStc = fileContentsRequest->streamId;
+							uConnIdStc = fileContentsRequest->connID;
 							bIsStreamFile = TRUE;
 						}

@@ -3190,6 +3312,9 @@ wf_cliprdr_server_file_contents_response(CliprdrClientContext *context,
 			rc = ERROR_INTERNAL_ERROR;
 			break;
 		}
+		if (fileContentsResponse->connID != clipboard->req_f_conn_id_expected ||
+			fileContentsResponse->streamId != clipboard->req_f_stream_id_expected)
+			return CHANNEL_RC_OK;
 		clipboard->req_fsize = 0;
 		clipboard->req_fdata = NULL;

@@ -3200,6 +3325,13 @@ wf_cliprdr_server_file_contents_response(CliprdrClientContext *context,
 		}

 		clipboard->req_fsize = fileContentsResponse->cbRequested;
+		/*
+		 * Keep the zero-size allocation: supported Windows builds use the Microsoft
+		 * CRT, where malloc(0) returns a valid pointer. wait_response_event() also
+		 * uses a non-NULL req_fdata to recognize a successful zero-byte response.
+		 * The Rust FFI derives requestedData and cbRequested from the same Vec, so a
+		 * nonzero length cannot have a NULL data pointer on the normal call path.
+		 */
 		clipboard->req_fdata = (char *)malloc(fileContentsResponse->cbRequested);
 		if (!clipboard->req_fdata)
 		{
@@ -113,11 +113,11 @@ pub enum MouseButton {

    /// Scroll up button
    ScrollUp,
-    /// Left right button
+    /// Scroll down button
    ScrollDown,
-    /// Left right button
+    /// Scroll left button
    ScrollLeft,
-    /// Left right button
+    /// Scroll right button
    ScrollRight,
 }

@@ -223,7 +223,7 @@ impl KeyboardControllable for Enigo {
            // Windows uses uft-16 encoding. We need to check
            // for variable length characters. As such some
            // characters can be 32 bit long and those are
-            // encoded in such called hight and low surrogates
+            // encoded in so-called high and low surrogates
            // each 16 bit wide that needs to be send after
            // another to the SendInput function without
            // being interrupted by "keyup"
@@ -1,6 +1,6 @@
 [package]
 name = "rustdesk-portable-packer"
-version = "1.4.8"
+version = "1.4.9"
 edition = "2021"
 description = "RustDesk Remote Desktop"

@@ -26,7 +26,7 @@ windows = { version = "0.61", features = [
 native-windows-gui = {version = "1.0", default-features = false, features = ["animation-timer", "image-decoder"]}

 [package.metadata.winres]
-LegalCopyright = "Copyright © 2025 Purslane Ltd. All rights reserved."
+LegalCopyright = "Copyright © 2026 Purslane Tech Pte. Ltd. All rights reserved."
 ProductName = "RustDesk"
 OriginalFilename = "rustdesk.exe"
 FileDescription = "RustDesk Remote Desktop"
@@ -47,7 +47,7 @@ fn link_vcpkg(mut path: PathBuf, name: &str) -> PathBuf {
            format!("{}-{}", target_arch, target_os)
        }
    } else if target_os == "windows" {
-        "x64-windows-static".to_owned()
+        format!("{}-windows-static", target_arch)
    } else {
        format!("{}-{}", target_arch, target_os)
    };
@@ -79,6 +79,10 @@ mod webrtc {
        }
    }

+    fn tile_log2(threads: u32) -> std::os::raw::c_uint {
+        (threads as f64).log2().ceil() as _
+    }
+
    fn get_super_block_size(width: u32, height: u32, threads: u32) -> aom_superblock_size_t {
        use aom_superblock_size::*;
        let resolution = width * height;
@@ -160,8 +164,7 @@ mod webrtc {
        } else {
            AV1E_SET_TILE_COLUMNS
        };
-        // Failed on android
-        call_ctl!(ctx, tile_set, (cfg.g_threads as f64 * 1.0f64).log2().ceil());
+        call_ctl!(ctx, tile_set, tile_log2(cfg.g_threads));
        call_ctl!(ctx, AV1E_SET_ROW_MT, 1);
        call_ctl!(ctx, AV1E_SET_ENABLE_OBMC, 0);
        call_ctl!(ctx, AV1E_SET_NOISE_SENSITIVITY, 0);
@@ -197,6 +200,23 @@ mod webrtc {

        Ok(())
    }
+
+    #[cfg(test)]
+    mod tests {
+        use super::*;
+        use std::os::raw::c_uint;
+
+        #[test]
+        fn tile_log2_uses_c_uint_and_rounds_up() {
+            let one_thread: c_uint = tile_log2(1);
+            let three_threads: c_uint = tile_log2(3);
+            let max_threads: c_uint = tile_log2(64);
+
+            assert_eq!(one_thread, 0);
+            assert_eq!(three_threads, 2);
+            assert_eq!(max_threads, 6);
+        }
+    }
 }

 impl EncoderApi for AomEncoder {
@@ -52,6 +52,33 @@ lazy_static::lazy_static! {
    static ref MAG_BUFFER: Mutex<(bool, Vec<u8>)> =  Default::default();
 }

+fn find_windows(cls: &str, name: &str) -> Result<Vec<HWND>> {
+    let name_c = CString::new(name)?;
+    let cls_c = if cls.is_empty() {
+        None
+    } else {
+        Some(CString::new(cls)?)
+    };
+    let mut hwnds = Vec::new();
+    unsafe {
+        let mut after = NULL as _;
+        loop {
+            let hwnd = FindWindowExA(
+                NULL as _,
+                after,
+                cls_c.as_ref().map_or(NULL as _, |c| c.as_ptr()),
+                name_c.as_ptr(),
+            );
+            if hwnd.is_null() {
+                break;
+            }
+            hwnds.push(hwnd);
+            after = hwnd;
+        }
+    }
+    Ok(hwnds)
+}
+
 pub type REFWICPixelFormatGUID = *const GUID;
 pub type WICPixelFormatGUID = GUID;

@@ -247,6 +274,8 @@ pub struct CapturerMag {
    rect: RECT,
    width: usize,
    height: usize,
+    excluded_window_target: Option<(String, String)>,
+    excluded_windows: Vec<HWND>,
 }

 impl Drop for CapturerMag {
@@ -261,6 +290,10 @@ impl CapturerMag {
        MagInterface::new().is_ok()
    }

+    // This captures through the legacy Windows Magnification API. Do not infer
+    // multi-monitor capture support from privacy overlay coverage: WebRTC also
+    // disables its magnifier capturer when SM_CMONITORS != 1.
+    // https://webrtc.googlesource.com/src/+/1845922d5a1bf9c27deeffb4a8c8daea124434c1/modules/desktop_capture/win/screen_capturer_win_magnifier.cc
    pub(crate) fn new(origin: (i32, i32), width: usize, height: usize) -> Result<Self> {
        unsafe {
            let x = GetSystemMetrics(SM_XVIRTUALSCREEN);
@@ -305,6 +338,8 @@ impl CapturerMag {
            },
            width,
            height,
+            excluded_window_target: None,
+            excluded_windows: Vec::new(),
        };

        unsafe {
@@ -436,19 +471,41 @@ impl CapturerMag {
    }

    pub(crate) fn exclude(&mut self, cls: &str, name: &str) -> Result<bool> {
-        let name_c = CString::new(name)?;
+        let mut hwnds = find_windows(cls, name)?;
+        hwnds.sort_unstable_by_key(|hwnd| *hwnd as usize);
+        self.excluded_window_target = Some((cls.to_owned(), name.to_owned()));
+        if hwnds.is_empty() {
+            self.excluded_windows.clear();
+            return Ok(false);
+        }
+
+        self.exclude_windows(&mut hwnds)?;
+        self.excluded_windows = hwnds;
+        Ok(true)
+    }
+
+    fn refresh_excluded_windows(&mut self) -> Result<()> {
+        let Some((cls, name)) = self.excluded_window_target.as_ref() else {
+            return Ok(());
+        };
+        let mut hwnds = find_windows(cls, name)?;
+        hwnds.sort_unstable_by_key(|hwnd| *hwnd as usize);
+        // This runs from frame() because refreshed privacy overlays get new
+        // HWNDs. It is only used on the legacy magnifier backend while privacy
+        // mode is active; if it shows up as hot-path cost, throttle this check.
+        // Keep the previous filter list while privacy windows are being recreated.
+        if hwnds.is_empty() || hwnds == self.excluded_windows {
+            return Ok(());
+        }
+
+        self.exclude_windows(&mut hwnds)?;
+        self.excluded_windows = hwnds;
+        Ok(())
+    }
+
+    fn exclude_windows(&mut self, hwnds: &mut [HWND]) -> Result<bool> {
+        let count = hwnds.len() as _;
        unsafe {
-            let mut hwnd = if cls.len() == 0 {
-                FindWindowExA(NULL as _, NULL as _, NULL as _, name_c.as_ptr())
-            } else {
-                let cls_c = CString::new(cls).unwrap();
-                FindWindowExA(NULL as _, NULL as _, cls_c.as_ptr(), name_c.as_ptr())
-            };
-
-            if hwnd.is_null() {
-                return Ok(false);
-            }
-
            if let Some(set_window_filter_list_func) =
                self.mag_interface.set_window_filter_list_func
            {
@@ -456,16 +513,15 @@ impl CapturerMag {
                    == set_window_filter_list_func(
                        self.magnifier_window,
                        MW_FILTERMODE_EXCLUDE,
-                        1,
-                        &mut hwnd,
+                        count,
+                        hwnds.as_mut_ptr(),
                    )
                {
                    return Err(Error::new(
                        ErrorKind::Other,
                        format!(
-                            "Failed MagSetWindowFilterList for cls {} name {}, error {}",
-                            cls,
-                            name,
+                            "Failed MagSetWindowFilterList for {} windows, error {}",
+                            count,
                            Error::last_os_error()
                        ),
                    ));
@@ -496,6 +552,7 @@ impl CapturerMag {
    }

    pub(crate) fn frame(&mut self, data: &mut Vec<u8>) -> Result<()> {
+        self.refresh_excluded_windows()?;
        Self::clear_data();

        unsafe {
@@ -1,5 +1,5 @@
 pkgname=rustdesk
-pkgver=1.4.8
+pkgver=1.4.9
 pkgrel=0
 epoch=
 pkgdesc=""
@@ -7,6 +7,10 @@
      <Configuration>Release</Configuration>
      <Platform>x64</Platform>
    </ProjectConfiguration>
+    <ProjectConfiguration Include="Release|ARM64">
+      <Configuration>Release</Configuration>
+      <Platform>ARM64</Platform>
+    </ProjectConfiguration>
  </ItemGroup>
  <PropertyGroup Label="Globals">
    <Keyword>Win32Proj</Keyword>
@@ -22,6 +26,12 @@
    <WholeProgramOptimization>true</WholeProgramOptimization>
    <CharacterSet>Unicode</CharacterSet>
  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|ARM64'" Label="Configuration">
+    <ConfigurationType>DynamicLibrary</ConfigurationType>
+    <UseDebugLibraries>false</UseDebugLibraries>
+    <WholeProgramOptimization>true</WholeProgramOptimization>
+    <CharacterSet>Unicode</CharacterSet>
+  </PropertyGroup>
  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.props" />
  <ImportGroup Label="ExtensionSettings">
  </ImportGroup>
@@ -30,6 +40,9 @@
  <ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
  </ImportGroup>
+  <ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Release|ARM64'">
+    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
+  </ImportGroup>
  <PropertyGroup Label="UserMacros" />
  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
    <ClCompile>
@@ -53,6 +66,28 @@
      <ModuleDefinitionFile>CustomActions.def</ModuleDefinitionFile>
    </Link>
  </ItemDefinitionGroup>
+  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|ARM64'">
+    <ClCompile>
+      <WarningLevel>Level3</WarningLevel>
+      <FunctionLevelLinking>true</FunctionLevelLinking>
+      <IntrinsicFunctions>true</IntrinsicFunctions>
+      <SDLCheck>true</SDLCheck>
+      <PreprocessorDefinitions>NDEBUG;EXAMPLECADLL_EXPORTS;_WINDOWS;_USRDLL;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <ConformanceMode>true</ConformanceMode>
+      <PrecompiledHeader>Use</PrecompiledHeader>
+      <PrecompiledHeaderFile>pch.h</PrecompiledHeaderFile>
+      <RuntimeLibrary>MultiThreaded</RuntimeLibrary>
+    </ClCompile>
+    <Link>
+      <AdditionalDependencies>msi.lib;version.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <SubSystem>Windows</SubSystem>
+      <EnableCOMDATFolding>true</EnableCOMDATFolding>
+      <OptimizeReferences>true</OptimizeReferences>
+      <GenerateDebugInformation>true</GenerateDebugInformation>
+      <EnableUAC>false</EnableUAC>
+      <ModuleDefinitionFile>CustomActions.def</ModuleDefinitionFile>
+    </Link>
+  </ItemDefinitionGroup>
  <ItemGroup>
    <ClInclude Include="Common.h" />
    <ClInclude Include="framework.h" />
@@ -65,6 +100,7 @@
    <ClCompile Include="FirewallRules.cpp" />
    <ClCompile Include="pch.cpp">
      <PrecompiledHeader Condition="'$(Configuration)|$(Platform)'=='Release|x64'">Create</PrecompiledHeader>
+      <PrecompiledHeader Condition="'$(Configuration)|$(Platform)'=='Release|ARM64'">Create</PrecompiledHeader>
    </ClCompile>
    <ClCompile Include="ReadConfig.cpp" />
    <ClCompile Include="RemotePrinter.cpp" />
@@ -79,7 +79,7 @@ heading 1;}{\s2\ql \li0\ri0\nowidctlpar\wrapdefault\faauto\outlinelevel1\rin0\li
 \ab\af1 \ltrch\fcs0 \b\ul\cf2\lang1033\langfe2052\langnp1033\insrsid1917520 
 \par }\pard \ltrpar\s2\qj \li0\ri0\sb100\sa100\nowidctlpar\wrapdefault\faauto\outlinelevel1\rin0\lin0\itap0\pararsid8979511 {\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \fs18\lang1033\langfe2052\langnp1033\insrsid8979511\charrsid8979511 \hich\af1\dbch\af31505\loch\f1 
 \hich\f1 This Privacy Policy (hereinafter the \'93}{\rtlch\fcs1 \ab\af1\afs21 \ltrch\fcs0 \b\fs21\lang1033\langfe2052\langnp1033\insrsid8979511\charrsid1523795 \hich\af1\dbch\af31505\loch\f1 Policy}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 
-\fs18\lang1033\langfe2052\langnp1033\insrsid8979511\charrsid8979511 \loch\af1\dbch\af31505\hich\f1 \'94\loch\f1 \hich\f1 ) governs the terms and conditions under which Purslane Ltd. (hereinafter \'93}{\rtlch\fcs1 \ab\af1\afs21 \ltrch\fcs0 
+\fs18\lang1033\langfe2052\langnp1033\insrsid8979511\charrsid8979511 \loch\af1\dbch\af31505\hich\f1 \'94\loch\f1 \hich\f1 ) governs the terms and conditions under which Purslane Tech Pte. Ltd. (hereinafter \'93}{\rtlch\fcs1 \ab\af1\afs21 \ltrch\fcs0 
 \b\fs21\lang1033\langfe2052\langnp1033\insrsid8979511\charrsid1523795 \hich\af1\dbch\af31505\loch\f1 us}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 \fs18\lang1033\langfe2052\langnp1033\insrsid8979511\charrsid8979511 \loch\af1\dbch\af31505\hich\f1 \'94\loch\f1 
 \hich\f1  or \'93}{\rtlch\fcs1 \ab\af1\afs21 \ltrch\fcs0 \b\fs21\lang1033\langfe2052\langnp1033\insrsid8979511\charrsid1523795 \hich\af1\dbch\af31505\loch\f1 we}{\rtlch\fcs1 \af1\afs18 \ltrch\fcs0 
 \fs18\lang1033\langfe2052\langnp1033\insrsid8979511\charrsid8979511 \loch\af1\dbch\af31505\hich\f1 \'94\loch\f1 \hich\f1 
@@ -300,4 +300,4 @@ b060828e6f37ed1567914b284d262452282e3198720e274a939cd08a54f980ae38a38f56e422a3a6
 \lsdpriority49 \lsdlocked0 List Table 4 Accent 5;\lsdpriority50 \lsdlocked0 List Table 5 Dark Accent 5;\lsdpriority51 \lsdlocked0 List Table 6 Colorful Accent 5;\lsdpriority52 \lsdlocked0 List Table 7 Colorful Accent 5;
 \lsdpriority46 \lsdlocked0 List Table 1 Light Accent 6;\lsdpriority47 \lsdlocked0 List Table 2 Accent 6;\lsdpriority48 \lsdlocked0 List Table 3 Accent 6;\lsdpriority49 \lsdlocked0 List Table 4 Accent 6;
 \lsdpriority50 \lsdlocked0 List Table 5 Dark Accent 6;\lsdpriority51 \lsdlocked0 List Table 6 Colorful Accent 6;\lsdpriority52 \lsdlocked0 List Table 7 Colorful Accent 6;\lsdsemihidden1 \lsdunhideused1 \lsdlocked0 Mention;
-\lsdsemihidden1 \lsdunhideused1 \lsdlocked0 Smart Hyperlink;\lsdsemihidden1 \lsdunhideused1 \lsdlocked0 Hashtag;\lsdsemihidden1 \lsdunhideused1 \lsdlocked0 Unresolved Mention;\lsdsemihidden1 \lsdunhideused1 \lsdlocked0 Smart Link;}}}
+\lsdsemihidden1 \lsdunhideused1 \lsdlocked0 Smart Hyperlink;\lsdsemihidden1 \lsdunhideused1 \lsdlocked0 Hashtag;\lsdsemihidden1 \lsdunhideused1 \lsdlocked0 Unresolved Mention;\lsdsemihidden1 \lsdunhideused1 \lsdlocked0 Smart Link;}}}
@@ -3,7 +3,7 @@
    <IncludeSearchPaths>
    </IncludeSearchPaths>
    <Configurations>Release</Configurations>
-    <Platforms>x64</Platforms>
+    <Platforms>x64;ARM64</Platforms>
  </PropertyGroup>
  <ItemGroup>
    <Content Include="Includes.wxi" />
@@ -10,12 +10,17 @@ EndProject
 Global
 	GlobalSection(SolutionConfigurationPlatforms) = preSolution
 		Release|x64 = Release|x64
+		Release|ARM64 = Release|ARM64
 	EndGlobalSection
 	GlobalSection(ProjectConfigurationPlatforms) = postSolution
 		{F403A403-CEFF-4399-B51C-CC646C8E98CF}.Release|x64.ActiveCfg = Release|x64
 		{F403A403-CEFF-4399-B51C-CC646C8E98CF}.Release|x64.Build.0 = Release|x64
+		{F403A403-CEFF-4399-B51C-CC646C8E98CF}.Release|ARM64.ActiveCfg = Release|ARM64
+		{F403A403-CEFF-4399-B51C-CC646C8E98CF}.Release|ARM64.Build.0 = Release|ARM64
 		{6B3647E0-B4A3-46AE-8757-A22EE51C1DAC}.Release|x64.ActiveCfg = Release|x64
 		{6B3647E0-B4A3-46AE-8757-A22EE51C1DAC}.Release|x64.Build.0 = Release|x64
+		{6B3647E0-B4A3-46AE-8757-A22EE51C1DAC}.Release|ARM64.ActiveCfg = Release|ARM64
+		{6B3647E0-B4A3-46AE-8757-A22EE51C1DAC}.Release|ARM64.Build.0 = Release|ARM64
 	EndGlobalSection
 	GlobalSection(SolutionProperties) = preSolution
 		HideSolutionNode = FALSE
@@ -85,7 +85,7 @@ def make_parser():
        "-m",
        "--manufacturer",
        type=str,
-        default="PURSLANE",
+        default="Purslane Tech Pte. Ltd.",
        help="The app manufacturer.",
    )
    return parser
@@ -499,7 +499,7 @@ def update_license_file(app_name):
        license_content = f.read()
    license_content = license_content.replace("website rustdesk.com and other ", "")
    license_content = license_content.replace("RustDesk", app_name)
-    license_content = re.sub("Purslane Ltd", app_name, license_content, flags=re.IGNORECASE)
+    license_content = re.sub(r"Purslane(?: Tech Pte\.)? Ltd", app_name, license_content, flags=re.IGNORECASE)
    with open(license_file, "w", encoding="utf-8") as f:
        f.write(license_content)

@@ -1,5 +1,5 @@
 Name:       rustdesk
-Version:    1.4.8
+Version:    1.4.9
 Release:    0
 Summary:    RPM package
 License:    GPL-3.0
@@ -1,5 +1,5 @@
 Name:       rustdesk
-Version:    1.4.8
+Version:    1.4.9
 Release:    0
 Summary:    RPM package
 License:    GPL-3.0
@@ -1,5 +1,5 @@
 Name:       rustdesk
-Version:    1.4.8
+Version:    1.4.9
 Release:    0
 Summary:    RPM package
 License:    GPL-3.0
@@ -45,7 +45,7 @@ pre_start()
  return 0
 }

-# When loging out from the interactive shell, the execution sequence is:
+# When logging out from the interactive shell, the execution sequence is:
 #
 # IF ~/.bash_logout exists THEN
 #     execute ~/.bash_logout
@@ -0,0 +1,7 @@
+set(VCPKG_TARGET_ARCHITECTURE arm)
+set(VCPKG_CRT_LINKAGE dynamic)
+set(VCPKG_LIBRARY_LINKAGE static)
+set(VCPKG_CMAKE_SYSTEM_NAME Android)
+set(VCPKG_CMAKE_SYSTEM_VERSION 21)
+set(VCPKG_MAKE_BUILD_TRIPLET "--host=armv7a-linux-androideabi")
+set(VCPKG_CMAKE_CONFIGURE_OPTIONS -DANDROID_ABI=armeabi-v7a -DANDROID_ARM_NEON=ON)
@@ -0,0 +1,7 @@
+set(VCPKG_TARGET_ARCHITECTURE arm64)
+set(VCPKG_CRT_LINKAGE dynamic)
+set(VCPKG_LIBRARY_LINKAGE static)
+set(VCPKG_CMAKE_SYSTEM_NAME Android)
+set(VCPKG_CMAKE_SYSTEM_VERSION 21)
+set(VCPKG_MAKE_BUILD_TRIPLET "--host=aarch64-linux-android")
+set(VCPKG_CMAKE_CONFIGURE_OPTIONS -DANDROID_ABI=arm64-v8a)
@@ -0,0 +1,7 @@
+set(VCPKG_TARGET_ARCHITECTURE x64)
+set(VCPKG_CRT_LINKAGE dynamic)
+set(VCPKG_LIBRARY_LINKAGE static)
+set(VCPKG_CMAKE_SYSTEM_NAME Android)
+set(VCPKG_CMAKE_SYSTEM_VERSION 21)
+set(VCPKG_MAKE_BUILD_TRIPLET "--host=x86_64-linux-android")
+set(VCPKG_CMAKE_CONFIGURE_OPTIONS -DANDROID_ABI=x86_64)
@@ -0,0 +1,7 @@
+set(VCPKG_TARGET_ARCHITECTURE x86)
+set(VCPKG_CRT_LINKAGE dynamic)
+set(VCPKG_LIBRARY_LINKAGE static)
+set(VCPKG_CMAKE_SYSTEM_NAME Android)
+set(VCPKG_CMAKE_SYSTEM_VERSION 21)
+set(VCPKG_MAKE_BUILD_TRIPLET "--host=i686-linux-android")
+set(VCPKG_CMAKE_CONFIGURE_OPTIONS -DANDROID_ABI=x86)
@@ -130,14 +130,18 @@ elseif(VCPKG_TARGET_IS_WINDOWS)
 --cc=cl \
 --enable-gpl \
 --enable-d3d11va \
--enable-cuda \
--enable-ffnvcodec \
--enable-hwaccel=h264_nvdec \
--enable-hwaccel=hevc_nvdec \
 --enable-hwaccel=h264_d3d11va \
 --enable-hwaccel=hevc_d3d11va \
 --enable-hwaccel=h264_d3d11va2 \
 --enable-hwaccel=hevc_d3d11va2 \
+")
+
+    if(VCPKG_TARGET_ARCHITECTURE STREQUAL "x86" OR VCPKG_TARGET_ARCHITECTURE STREQUAL "x64")
+        string(APPEND OPTIONS "\
+--enable-cuda \
+--enable-ffnvcodec \
+--enable-hwaccel=h264_nvdec \
+--enable-hwaccel=hevc_nvdec \
 --enable-amf \
 --enable-encoder=h264_amf \
 --enable-encoder=hevc_amf \
@@ -147,6 +151,7 @@ elseif(VCPKG_TARGET_IS_WINDOWS)
 --enable-encoder=h264_qsv \
 --enable-encoder=hevc_qsv \
 ")
+    endif()

    if(VCPKG_TARGET_ARCHITECTURE STREQUAL "x86")
        set(LIB_MACHINE_ARG /machine:x86)
@@ -154,6 +159,9 @@ elseif(VCPKG_TARGET_IS_WINDOWS)
    elseif(VCPKG_TARGET_ARCHITECTURE STREQUAL "x64")
        set(LIB_MACHINE_ARG /machine:x64)
        string(APPEND OPTIONS " --arch=x86_64")
+    elseif(VCPKG_TARGET_ARCHITECTURE STREQUAL "arm64")
+        set(LIB_MACHINE_ARG /machine:arm64)
+        string(APPEND OPTIONS " --arch=aarch64 --enable-cross-compile")
    else()
        message(FATAL_ERROR "Unsupported target architecture")
    endif()
@@ -1,199 +0,0 @@
-use crate::client::*;
-use async_trait::async_trait;
-use hbb_common::{
-    config::PeerConfig,
-    config::READ_TIMEOUT,
-    futures::{SinkExt, StreamExt},
-    log,
-    message_proto::*,
-    protobuf::Message as _,
-    rendezvous_proto::ConnType,
-    tokio::{self, sync::mpsc},
-    Stream,
-};
-use std::sync::{Arc, RwLock};
-
-#[derive(Clone)]
-pub struct Session {
-    id: String,
-    lc: Arc<RwLock<LoginConfigHandler>>,
-    sender: mpsc::UnboundedSender<Data>,
-    password: String,
-}
-
-impl Session {
-    pub fn new(id: &str, sender: mpsc::UnboundedSender<Data>) -> Self {
-        let mut password = "".to_owned();
-        if PeerConfig::load(id).password.is_empty() {
-            match rpassword::prompt_password("Enter password: ") {
-                Ok(p) => password = p,
-                Err(e) => {
-                    log::error!("Failed to read password: {:?}", e);
-                    password = "".to_owned();
-                }
-            }
-        }
-        let session = Self {
-            id: id.to_owned(),
-            sender,
-            password,
-            lc: Default::default(),
-        };
-        session.lc.write().unwrap().initialize(
-            id.to_owned(),
-            ConnType::PORT_FORWARD,
-            None,
-            false,
-            None,
-            None,
-        );
-        session
-    }
-}
-
-#[async_trait]
-impl Interface for Session {
-    fn get_login_config_handler(&self) -> Arc<RwLock<LoginConfigHandler>> {
-        return self.lc.clone();
-    }
-
-    fn msgbox(&self, msgtype: &str, title: &str, text: &str, link: &str) {
-        match msgtype {
-            "input-password" => {
-                self.sender
-                    .send(Data::Login((self.password.clone(), true)))
-                    .ok();
-            }
-            "re-input-password" => {
-                log::error!("{}: {}", title, text);
-                match rpassword::prompt_password("Enter password: ") {
-                    Ok(password) => {
-                        let login_data = Data::Login((password, true));
-                        self.sender.send(login_data).ok();
-                    }
-                    Err(e) => {
-                        log::error!("reinput password failed, {:?}", e);
-                    }
-                }
-            }
-            msg if msg.contains("error") => {
-                log::error!("{}: {}: {}", msgtype, title, text);
-            }
-            _ => {
-                log::info!("{}: {}: {}", msgtype, title, text);
-            }
-        }
-    }
-
-    fn handle_login_error(&self, err: &str) -> bool {
-        handle_login_error(self.lc.clone(), err, self)
-    }
-
-    fn handle_peer_info(&self, pi: PeerInfo) {
-        self.lc.write().unwrap().handle_peer_info(&pi);
-    }
-
-    async fn handle_hash(&self, pass: &str, hash: Hash, peer: &mut Stream) {
-        log::info!(
-            "password={}",
-            hbb_common::password_security::temporary_password()
-        );
-        handle_hash(self.lc.clone(), &pass, hash, self, peer).await;
-    }
-
-    async fn handle_login_from_ui(
-        &self,
-        os_username: String,
-        os_password: String,
-        password: String,
-        remember: bool,
-        peer: &mut Stream,
-    ) {
-        handle_login_from_ui(
-            self.lc.clone(),
-            os_username,
-            os_password,
-            password,
-            remember,
-            peer,
-        )
-        .await;
-    }
-
-    async fn handle_test_delay(&self, t: TestDelay, peer: &mut Stream) {
-        handle_test_delay(t, peer).await;
-    }
-
-    fn send(&self, data: Data) {
-        self.sender.send(data).ok();
-    }
-}
-
-#[tokio::main(flavor = "current_thread")]
-pub async fn connect_test(id: &str, key: String, token: String) {
-    let (sender, mut receiver) = mpsc::unbounded_channel::<Data>();
-    let handler = Session::new(&id, sender);
-    match crate::client::Client::start(id, &key, &token, ConnType::PORT_FORWARD, handler).await {
-        Err(err) => {
-            log::error!("Failed to connect {}: {}", &id, err);
-        }
-        Ok((mut stream, direct)) => {
-            log::info!("direct: {}", direct);
-            // rpassword::prompt_password("Input anything to exit").ok();
-            loop {
-                tokio::select! {
-                    res = hbb_common::timeout(READ_TIMEOUT, stream.next()) => match res {
-                        Err(_) => {
-                            log::error!("Timeout");
-                            break;
-                        }
-                        Ok(Some(Ok(bytes))) => {
-                            if let Ok(msg_in) = Message::parse_from_bytes(&bytes) {
-                                match msg_in.union {
-                                    Some(message::Union::Hash(hash)) => {
-                                        log::info!("Got hash");
-                                        break;
-                                    }
-                                    _ => {}
-                                }
-                            }
-                        }
-                        _ => {}
-                    }
-                }
-            }
-        }
-    }
-}
-
-#[tokio::main(flavor = "current_thread")]
-pub async fn start_one_port_forward(
-    id: String,
-    port: i32,
-    remote_host: String,
-    remote_port: i32,
-    key: String,
-    token: String,
-) {
-    crate::common::test_rendezvous_server();
-    crate::common::test_nat_type();
-    let (sender, mut receiver) = mpsc::unbounded_channel::<Data>();
-    let handler = Session::new(&id, sender);
-    if let Err(err) = crate::port_forward::listen(
-        handler.id.clone(),
-        handler.password.clone(),
-        port,
-        handler.clone(),
-        receiver,
-        &key,
-        &token,
-        handler.lc.clone(),
-        remote_host,
-        remote_port,
-    )
-    .await
-    {
-        log::error!("Failed to listen on {}: {}", port, err);
-    }
-    log::info!("port forward (:{}) exit", port);
-}
@@ -941,21 +941,23 @@ impl Client {

    #[cfg(not(target_os = "ios"))]
    fn try_stop_clipboard() {
-        // There's a bug here.
-        // If session is closed by the peer, `has_sessions_running()` will always return true.
-        // It's better to check if the active session number.
-        // But it's not a problem, because the clipboard thread does not consume CPU.
-        //
-        // If we want to fix it, we can add a flag to indicate if session is active.
-        // But I think it's not necessary to introduce complexity at this point.
+        // Disconnected Flutter sessions may keep UI handlers alive, so only connected sessions
+        // should block clipboard cleanup.
        #[cfg(feature = "flutter")]
-        if crate::flutter::sessions::has_sessions_running(ConnType::DEFAULT_CONN) {
+        if crate::flutter::sessions::has_connected_sessions_running(ConnType::DEFAULT_CONN) {
            return;
        }
        #[cfg(not(target_os = "android"))]
        clipboard_listener::unsubscribe(Self::CLIENT_CLIPBOARD_NAME);
        CLIPBOARD_STATE.lock().unwrap().running = false;
        #[cfg(all(feature = "unix-file-copy-paste", target_os = "linux"))]
+        if let Err(e) = crate::clipboard::try_empty_clipboard_files_sync(
+            crate::clipboard::ClipboardSide::Client,
+            0,
+        ) {
+            log::error!("Failed to empty client clipboard files: {}", e);
+        }
+        #[cfg(all(feature = "unix-file-copy-paste", target_os = "linux"))]
        clipboard::platform::unix::fuse::uninit_fuse_context(true);
    }

@@ -3790,6 +3792,7 @@ pub trait Interface: Send + Clone + 'static + Sized {
 #[derive(Clone)]
 pub enum Data {
    Close,
+    RejectInsecureConnection,
    Login((String, String, String, bool)),
    Message(Message),
    SendFiles((i32, JobType, String, String, i32, bool, bool)),
@@ -3813,11 +3816,33 @@ pub enum Data {
    ElevateWithLogon(String, String),
    NewVoiceCall,
    CloseVoiceCall,
+    ContinueInsecureConnection,
    ResetDecoder(Option<usize>),
    RenameFile((i32, String, String, bool)),
    TakeScreenshot((i32, String)),
 }

+pub async fn confirm_insecure_connection(
+    interface: &impl Interface,
+    receiver: &mut UnboundedReceiver<Data>,
+) -> bool {
+    interface.msgbox(
+        "insecure-connection-nocancel-hasclose",
+        "Insecure Connection",
+        "conn-e2ee-unavailable-tip",
+        "",
+    );
+    while let Some(data) = receiver.recv().await {
+        match data {
+            Data::ContinueInsecureConnection => return true,
+            Data::RejectInsecureConnection => return false,
+            Data::Close => return false,
+            _ => {}
+        }
+    }
+    false
+}
+
 /// Keycode for key events.
 #[derive(Clone, Debug)]
 pub enum Key {
@@ -6,7 +6,6 @@ pub trait FileManager: Interface {
    #[cfg(not(any(
        target_os = "android",
        target_os = "ios",
-        feature = "cli",
        feature = "flutter"
    )))]
    fn get_home_dir(&self) -> String {
@@ -16,7 +15,6 @@ pub trait FileManager: Interface {
    #[cfg(not(any(
        target_os = "android",
        target_os = "ios",
-        feature = "cli",
        feature = "flutter"
    )))]
    fn get_next_job_id(&self) -> i32 {
@@ -26,7 +24,6 @@ pub trait FileManager: Interface {
    #[cfg(not(any(
        target_os = "android",
        target_os = "ios",
-        feature = "cli",
        feature = "flutter"
    )))]
    fn update_next_job_id(&self, id: i32) {
@@ -36,7 +33,6 @@ pub trait FileManager: Interface {
    #[cfg(not(any(
        target_os = "android",
        target_os = "ios",
-        feature = "cli",
        feature = "flutter"
    )))]
    fn read_dir(&self, path: String, include_hidden: bool) -> sciter::Value {
@@ -90,7 +86,6 @@ pub trait FileManager: Interface {
    #[cfg(not(any(
        target_os = "android",
        target_os = "ios",
-        feature = "cli",
        feature = "flutter"
    )))]
    fn confirm_delete_files(&self, id: i32, file_num: i32) {
@@ -100,7 +95,6 @@ pub trait FileManager: Interface {
    #[cfg(not(any(
        target_os = "android",
        target_os = "ios",
-        feature = "cli",
        feature = "flutter"
    )))]
    fn set_no_confirm(&self, id: i32) {
@@ -14,6 +14,7 @@ use crate::{
 // Empirical no-data window before exposing the restart reconnect state to the UI.
 // Restart msgbox text is kept as a legacy UI fallback; Flutter handles the type as a control event.
 const RESTART_REMOTE_DEVICE_NO_DATA_TIMEOUT: Duration = Duration::from_secs(5);
+const KCP_CLOSE_REASON_FLUSH_DELAY: Duration = Duration::from_millis(30);
 #[cfg(feature = "unix-file-copy-paste")]
 use crate::{clipboard::try_empty_clipboard_files, clipboard_file::unix_file_clip};
 #[cfg(any(
@@ -183,8 +184,20 @@ impl<T: InvokeUiSession> Remote<T> {
                    .lock()
                    .unwrap()
                    .set_connected();
+                let is_secured = peer.is_secured();
                self.handler
-                    .set_connection_type(peer.is_secured(), direct, stream_type); // flutter -> connection_ready
+                    .set_connection_type(is_secured, direct, stream_type); // flutter -> connection_ready
+                if !is_secured
+                    && !crate::common::is_direct_ip_access(&self.handler.get_id())
+                    && !client::confirm_insecure_connection(&self.handler, &mut self.receiver).await
+                {
+                    self.send_close_reason(&mut peer, "").await;
+                    if kcp.is_some() {
+                        tokio::time::sleep(KCP_CLOSE_REASON_FLUSH_DELAY).await;
+                    }
+                    self.handle_disconnected(round);
+                    return;
+                }
                self.handler.update_direct(Some(direct));
                if conn_type == ConnType::DEFAULT_CONN || conn_type == ConnType::VIEW_CAMERA {
                    self.handler
@@ -338,13 +351,17 @@ impl<T: InvokeUiSession> Remote<T> {
                    self.send_close_reason(&mut peer, "kcp").await;
                    // KCP does not send messages immediately, so wait to ensure the last message is sent.
                    // 1ms works in my test, but 30ms is more reliable.
-                    tokio::time::sleep(Duration::from_millis(30)).await;
+                    tokio::time::sleep(KCP_CLOSE_REASON_FLUSH_DELAY).await;
                }
            }
            Err(err) => {
                self.handler.on_establish_connection_error(err.to_string());
            }
        }
+        self.handle_disconnected(round);
+    }
+
+    fn handle_disconnected(&self, round: u32) {
        // set_disconnected_ok is used to check if new connection round is started.
        let _set_disconnected_ok = self
            .handler
@@ -360,6 +377,8 @@ impl<T: InvokeUiSession> Remote<T> {

        #[cfg(any(target_os = "windows", feature = "unix-file-copy-paste"))]
        if self.handler.is_default() && _set_disconnected_ok {
+            // Linux client cleanup runs synchronously in try_stop_clipboard() before FUSE is
+            // unmounted. Keep this async path for other file-clipboard platforms.
            crate::clipboard::try_empty_clipboard_files(ClipboardSide::Client, self.client_conn_id);
        }
    }
@@ -1088,6 +1107,9 @@ impl<T: InvokeUiSession> Remote<T> {
    }

    async fn send_toggle_virtual_display_msg(&self, peer: &mut Stream) {
+        if self.handler.is_view_camera() {
+            return;
+        }
        if !self.peer_info.is_support_virtual_display() {
            return;
        }
@@ -1109,6 +1131,9 @@ impl<T: InvokeUiSession> Remote<T> {
    }

    async fn send_toggle_privacy_mode_msg(&self, peer: &mut Stream) {
+        if self.handler.is_view_camera() {
+            return;
+        }
        let lc = self.handler.lc.read().unwrap();
        if lc.version >= hbb_common::get_version_number("1.2.4")
            && lc.get_toggle_option("privacy-mode")
@@ -151,41 +151,50 @@ pub fn update_clipboard_files(files: Vec<String>, side: ClipboardSide) {
 #[cfg(feature = "unix-file-copy-paste")]
 pub fn try_empty_clipboard_files(_side: ClipboardSide, _conn_id: i32) {
    std::thread::spawn(move || {
-        let mut ctx = CLIPBOARD_CTX.lock().unwrap();
-        if ctx.is_none() {
-            match ClipboardContext::new() {
-                Ok(x) => {
-                    *ctx = Some(x);
-                }
-                Err(e) => {
-                    log::error!("Failed to create clipboard context: {}", e);
-                    return;
-                }
-            }
-        }
-        #[allow(unused_mut)]
-        if let Some(mut ctx) = ctx.as_mut() {
-            #[cfg(target_os = "linux")]
-            {
-                use clipboard::platform::unix;
-                if unix::fuse::empty_local_files(_side == ClipboardSide::Client, _conn_id) {
-                    ctx.try_empty_clipboard_files(_side);
-                }
-            }
-            #[cfg(target_os = "macos")]
-            {
-                ctx.try_empty_clipboard_files(_side);
-                // No need to make sure the context is enabled.
-                clipboard::ContextSend::proc(|context| -> ResultType<()> {
-                    context.empty_clipboard(_conn_id).ok();
-                    Ok(())
-                })
-                .ok();
-            }
+        if let Err(e) = try_empty_clipboard_files_sync(_side, _conn_id) {
+            log::error!("Failed to empty clipboard files: {}", e);
        }
    });
 }

+#[cfg(feature = "unix-file-copy-paste")]
+pub fn try_empty_clipboard_files_sync(_side: ClipboardSide, _conn_id: i32) -> ResultType<()> {
+    let mut ctx = CLIPBOARD_CTX.lock().unwrap();
+    if ctx.is_none() {
+        match ClipboardContext::new() {
+            Ok(x) => {
+                *ctx = Some(x);
+            }
+            Err(e) => {
+                log::error!("Failed to create clipboard context: {}", e);
+                bail!("Failed to create clipboard context: {}", e);
+            }
+        }
+    }
+    #[allow(unused_mut)]
+    if let Some(mut ctx) = ctx.as_mut() {
+        #[cfg(target_os = "linux")]
+        {
+            use clipboard::platform::unix;
+            if unix::fuse::empty_local_files(_side == ClipboardSide::Client, _conn_id) {
+                ctx.try_empty_clipboard_files(_side);
+            }
+        }
+        #[cfg(target_os = "macos")]
+        {
+            ctx.try_empty_clipboard_files(_side);
+            // No need to make sure the context is enabled.
+            clipboard::ContextSend::proc(|context| -> ResultType<()> {
+                if !context.empty_clipboard(_conn_id)? {
+                    bail!("Failed to empty clipboard files for conn_id {}", _conn_id);
+                }
+                Ok(())
+            })?;
+        }
+    }
+    Ok(())
+}
+
 #[cfg(target_os = "windows")]
 pub fn try_empty_clipboard_files(side: ClipboardSide, conn_id: i32) {
    log::debug!("try to empty {} cliprdr for conn_id {}", side, conn_id);
@@ -868,6 +877,7 @@ pub mod clipboard_listener {
            .unwrap()
            .insert(name.clone(), tx);

+        cleanup_stale_listener(&mut listener_lock);
        if listener_lock.handle.is_none() {
            log::info!("Start clipboard listener thread");
            let handler = Handler {
@@ -893,6 +903,24 @@ pub mod clipboard_listener {
        Ok(())
    }

+    fn cleanup_stale_listener(listener: &mut ClipboardListener) {
+        if !listener
+            .handle
+            .as_ref()
+            .map(|(_, h)| h.is_finished())
+            .unwrap_or(false)
+        {
+            return;
+        }
+        if let Some((shutdown, h)) = listener.handle.take() {
+            log::warn!("Cleaning up stale clipboard listener handle");
+            if let Err(e) = h.join() {
+                log::error!("Clipboard listener thread panicked during stale cleanup: {:?}", e);
+            }
+            drop(shutdown);
+        }
+    }
+
    pub fn unsubscribe(name: &str) {
        log::info!("Unsubscribe clipboard listener: {}", name);
        let mut listener_lock = CLIPBOARD_LISTENER.lock().unwrap();
@@ -332,12 +332,16 @@ pub mod unix_file_clip {
                log::debug!("format data response: msg_flags: {}", msg_flags);

                if msg_flags != 0x1 {
-                    // return failure message?
+                    log::error!(
+                        "peer reported clipboard format data failure: {}",
+                        msg_flags
+                    );
+                    return vec![];
                }

                log::debug!("parsing file descriptors");
-                if fuse::init_fuse_context(true).is_ok() {
-                    match fuse::format_data_response_to_urls(
+                match fuse::init_fuse_context(side == ClipboardSide::Client) {
+                    Ok(()) => match fuse::format_data_response_to_urls(
                        side == ClipboardSide::Client,
                        format_data,
                        conn_id,
@@ -348,9 +352,10 @@ pub mod unix_file_clip {
                        Err(e) => {
                            log::error!("failed to parse file descriptors: {:?}", e);
                        }
+                    },
+                    Err(e) => {
+                        log::error!("failed to initialize clipboard FUSE context: {:?}", e);
                    }
-                } else {
-                    // send error message to server
                }
            }
            ClipboardFile::FileContentsRequest {
@@ -386,6 +391,7 @@ pub mod unix_file_clip {
            ClipboardFile::FileContentsResponse {
                msg_flags,
                stream_id,
+                requested_data,
                ..
            } => {
                log::debug!(
@@ -393,13 +399,15 @@ pub mod unix_file_clip {
                    msg_flags,
                    stream_id,
                );
-                if fuse::init_fuse_context(true).is_ok() {
-                    hbb_common::allow_err!(fuse::handle_file_content_response(
-                        side == ClipboardSide::Client,
-                        clip
-                    ));
-                } else {
-                    // send error message to server
+                let response = ClipboardFile::FileContentsResponse {
+                    msg_flags,
+                    stream_id,
+                    requested_data,
+                };
+                if let Err(e) =
+                    fuse::handle_file_content_response(side == ClipboardSide::Client, response)
+                {
+                    log::error!("failed to handle file contents response: {:?}", e);
                }
            }
            ClipboardFile::NotifyCallback {
@@ -764,15 +764,14 @@ async fn test_rendezvous_server_() {
    Config::reset_online();
 }

-// #[cfg(any(target_os = "android", target_os = "ios", feature = "cli"))]
 pub fn test_rendezvous_server() {
    std::thread::spawn(test_rendezvous_server_);
 }

 pub fn refresh_rendezvous_server() {
-    #[cfg(any(target_os = "android", target_os = "ios", feature = "cli"))]
+    #[cfg(any(target_os = "android", target_os = "ios"))]
    test_rendezvous_server();
-    #[cfg(not(any(target_os = "android", target_os = "ios", feature = "cli")))]
+    #[cfg(not(any(target_os = "android", target_os = "ios")))]
    std::thread::spawn(|| {
        if crate::ipc::test_rendezvous_server().is_err() {
            test_rendezvous_server();
@@ -2620,6 +2619,10 @@ pub fn get_control_permission(
    }
 }

+pub fn is_direct_ip_access(peer: &str) -> bool {
+    hbb_common::is_ip_str(peer) || hbb_common::is_domain_port_str(peer)
+}
+
 #[cfg(test)]
 mod tests {
    use super::*;
@@ -1437,7 +1437,7 @@ fn try_send_close_event(event_stream: &Option<StreamSink<EventToUI>>) {
 pub fn update_text_clipboard_required() {
    let is_required = sessions::get_sessions()
        .iter()
-        .any(|s| s.is_text_clipboard_required());
+        .any(|s| s.is_default() && s.is_text_clipboard_required());
    #[cfg(target_os = "android")]
    let _ = scrap::android::ffi::call_clipboard_manager_enable_client_clipboard(is_required);
    Client::set_is_text_clipboard_required(is_required);
@@ -1447,13 +1447,16 @@ pub fn update_text_clipboard_required() {
 pub fn update_file_clipboard_required() {
    let is_required = sessions::get_sessions()
        .iter()
-        .any(|s| s.is_file_clipboard_required());
+        .any(|s| s.is_default() && s.is_file_clipboard_required());
    Client::set_is_file_clipboard_required(is_required);
 }

 #[cfg(not(target_os = "ios"))]
 pub fn send_clipboard_msg(msg: Message, _is_file: bool) {
    for s in sessions::get_sessions() {
+        if !s.is_default() {
+            continue;
+        }
        #[cfg(feature = "unix-file-copy-paste")]
        if _is_file {
            if crate::is_support_file_copy_paste_num(s.lc.read().unwrap().version)
@@ -2297,6 +2300,16 @@ pub mod sessions {
            *r#type == conn_type && s.session_handlers.read().unwrap().len() != 0
        })
    }
+
+    #[inline]
+    #[cfg(not(target_os = "ios"))]
+    pub fn has_connected_sessions_running(conn_type: ConnType) -> bool {
+        SESSIONS.read().unwrap().iter().any(|((_, r#type), s)| {
+            *r#type == conn_type
+                && s.session_handlers.read().unwrap().len() != 0
+                && s.connection_round_state.lock().unwrap().is_connected()
+        })
+    }
 }

 pub(super) mod async_tasks {
@@ -1026,7 +1026,7 @@ pub fn main_set_option(key: String, value: String) {
        set_option(key, value.clone());
        #[cfg(target_os = "android")]
        crate::rendezvous_mediator::RendezvousMediator::restart();
-        #[cfg(any(target_os = "android", target_os = "ios", feature = "cli"))]
+        #[cfg(any(target_os = "android", target_os = "ios"))]
        crate::common::test_rendezvous_server();
    } else {
        set_option(key, value.clone());
@@ -1224,9 +1224,14 @@ pub fn main_set_local_option(key: String, value: String) {
    let is_texture_render_key = key.eq(config::keys::OPTION_TEXTURE_RENDER);
    let is_d3d_render_key = key.eq(config::keys::OPTION_ALLOW_D3D_RENDER);
    set_local_option(key, value.clone());
+    let is_render_target =
+        |session: &crate::flutter::FlutterSession| session.is_default() || session.is_view_camera();
    if is_texture_render_key {
        let session_event = [("v", &value)];
        for session in sessions::get_sessions() {
+            if !is_render_target(&session) {
+                continue;
+            }
            session.push_event("use_texture_render", &session_event, &[]);
            session.use_texture_render_changed();
            session.ui_handler.update_use_texture_render();
@@ -1234,6 +1239,9 @@ pub fn main_set_local_option(key: String, value: String) {
    }
    if is_d3d_render_key {
        for session in sessions::get_sessions() {
+            if !is_render_target(&session) {
+                continue;
+            }
            session.update_supported_decodings();
        }
    }
@@ -2852,8 +2860,16 @@ pub fn main_get_common(key: String) -> String {
                crate::platform::windows::is_msi_installed(),
                crate::common::is_custom_client(),
            ) {
-                (Ok(true), false) => format!("rustdesk-{_version}-x86_64.msi"),
-                (Ok(true), true) | (Ok(false), _) => format!("rustdesk-{_version}-x86_64.exe"),
+                (Ok(true), false) => match crate::platform::windows::release_arch_suffix() {
+                    Some(arch) => format!("rustdesk-{_version}-{arch}.msi"),
+                    None => "error:unsupported".to_owned(),
+                },
+                (Ok(true), true) | (Ok(false), _) => {
+                    match crate::platform::windows::release_arch_suffix() {
+                        Some(arch) => format!("rustdesk-{_version}-{arch}.exe"),
+                        None => "error:unsupported".to_owned(),
+                    }
+                }
                (Err(e), _) => {
                    log::error!("Failed to check if is msi: {}", e);
                    format!("error:update-failed-check-msi-tip")
@@ -3012,6 +3028,16 @@ pub fn main_set_common(_key: String, _value: String) {
    }
 }

+pub fn session_set_common(session_id: SessionID, key: String, value: String) {
+    if let Some(s) = sessions::get_session_by_session_id(&session_id) {
+        if key == "continue-insecure-connection"
+        {
+            s.continue_insecure_connection(value == "Y");
+            return;
+        }
+    }
+}
+
 pub fn session_get_common_sync(
    session_id: SessionID,
    key: String,
@@ -9,8 +9,8 @@ mod http_client;
 pub mod record_upload;
 pub mod sync;
 pub use http_client::{
-    create_http_client_async, create_http_client_async_with_url, create_http_client_with_url,
-    get_url_for_tls,
+    create_http_client_async, create_http_client_async_with_url_strict,
+    create_http_client_with_url, create_http_client_with_url_strict, get_url_for_tls,
 };

 #[derive(Debug)]
@@ -1,4 +1,4 @@
-use super::create_http_client_async_with_url;
+use super::create_http_client_async_with_url_strict;
 use hbb_common::{
    bail,
    lazy_static::lazy_static,
@@ -167,7 +167,7 @@ async fn do_download(
    auto_del_dur: Option<Duration>,
    mut rx_cancel: UnboundedReceiver<()>,
 ) -> ResultType<bool> {
-    let client = create_http_client_async_with_url(&url).await;
+    let client = create_http_client_async_with_url_strict(&url).await?;

    let mut is_all_downloaded = false;
    tokio::select! {
@@ -1,5 +1,6 @@
 use hbb_common::{
    async_recursion::async_recursion,
+    bail,
    config::{Config, Socks5Server},
    log::{self, info},
    proxy::{Proxy, ProxyScheme},
@@ -7,6 +8,7 @@ use hbb_common::{
        get_cached_tls_accept_invalid_cert, get_cached_tls_type, is_plain, upsert_tls_cache,
        TlsType,
    },
+    ResultType,
 };
 use reqwest::{blocking::Client as SyncClient, Client as AsyncClient};

@@ -137,6 +139,32 @@ pub fn create_http_client_with_url(url: &str) -> SyncClient {
    )
 }

+pub fn create_http_client_with_url_strict(url: &str) -> ResultType<SyncClient> {
+    let parsed_url = url::Url::parse(url)?;
+    if parsed_url.scheme() != "https" {
+        bail!("Strict HTTP client requires HTTPS: {}", url);
+    }
+    let proxy_conf = Config::get_socks();
+    let tls_url = get_url_for_tls(url, &proxy_conf);
+    let cached_tls_type = get_cached_tls_type(tls_url);
+    let cached_danger_accept_invalid_cert = get_cached_tls_accept_invalid_cert(tls_url);
+    let can_reuse_cached_probe =
+        cached_tls_type.is_some() && cached_danger_accept_invalid_cert == Some(false);
+    let tls_type = if can_reuse_cached_probe {
+        cached_tls_type.unwrap_or(TlsType::Rustls)
+    } else {
+        TlsType::Rustls
+    };
+    Ok(create_http_client_with_url_(
+        url,
+        tls_url,
+        tls_type,
+        can_reuse_cached_probe,
+        Some(false),
+        Some(false),
+    ))
+}
+
 fn create_http_client_with_url_(
    url: &str,
    tls_url: &str,
@@ -247,6 +275,33 @@ pub async fn create_http_client_async_with_url(url: &str) -> AsyncClient {
    .await
 }

+pub async fn create_http_client_async_with_url_strict(url: &str) -> ResultType<AsyncClient> {
+    let parsed_url = url::Url::parse(url)?;
+    if parsed_url.scheme() != "https" {
+        bail!("Strict HTTP client requires HTTPS: {}", url);
+    }
+    let proxy_conf = Config::get_socks();
+    let tls_url = get_url_for_tls(url, &proxy_conf);
+    let cached_tls_type = get_cached_tls_type(tls_url);
+    let cached_danger_accept_invalid_cert = get_cached_tls_accept_invalid_cert(tls_url);
+    let can_reuse_cached_probe =
+        cached_tls_type.is_some() && cached_danger_accept_invalid_cert == Some(false);
+    let tls_type = if can_reuse_cached_probe {
+        cached_tls_type.unwrap_or(TlsType::Rustls)
+    } else {
+        TlsType::Rustls
+    };
+    Ok(create_http_client_async_with_url_(
+        url,
+        tls_url,
+        tls_type,
+        can_reuse_cached_probe,
+        Some(false),
+        Some(false),
+    )
+    .await)
+}
+
 #[async_recursion]
 async fn create_http_client_async_with_url_(
    url: &str,
@@ -2,7 +2,7 @@
 use crate::flutter;
 #[cfg(target_os = "windows")]
 use crate::platform::windows::{get_char_from_vk, get_unicode_from_vk};
-#[cfg(not(any(feature = "flutter", feature = "cli")))]
+#[cfg(not(feature = "flutter"))]
 use crate::ui::CUR_SESSION;
 use crate::ui_session_interface::{InvokeUiSession, Session};
 #[cfg(not(any(target_os = "android", target_os = "ios")))]
@@ -469,7 +469,7 @@ static mut IS_LEFT_OPTION_DOWN: bool = false;

 #[cfg(not(any(target_os = "android", target_os = "ios")))]
 fn get_keyboard_mode() -> String {
-    #[cfg(not(any(feature = "flutter", feature = "cli")))]
+    #[cfg(not(feature = "flutter"))]
    if let Some(session) = CUR_SESSION.lock().unwrap().as_ref() {
        return session.get_keyboard_mode();
    }
@@ -991,7 +991,7 @@ pub fn event_to_key_events(
 }

 pub fn send_key_event(key_event: &KeyEvent) {
-    #[cfg(not(any(feature = "flutter", feature = "cli")))]
+    #[cfg(not(feature = "flutter"))]
    if let Some(session) = CUR_SESSION.lock().unwrap().as_ref() {
        session.send_key_event(key_event);
    }
@@ -1003,7 +1003,7 @@ pub fn send_key_event(key_event: &KeyEvent) {
 }

 pub fn get_peer_platform() -> String {
-    #[cfg(not(any(feature = "flutter", feature = "cli")))]
+    #[cfg(not(feature = "flutter"))]
    if let Some(session) = CUR_SESSION.lock().unwrap().as_ref() {
        return session.peer_platform();
    }
@@ -1245,11 +1245,49 @@ pub fn legacy_keyboard_mode(event: &Event, mut key_event: KeyEvent) -> Vec<KeyEv

 #[inline]
 pub fn map_keyboard_mode(_peer: &str, event: &Event, key_event: KeyEvent) -> Vec<KeyEvent> {
+    if let Some(evt) = windows_peer_special_key(_peer, event) {
+        return vec![evt];
+    }
+
    _map_keyboard_mode(_peer, event, key_event)
        .map(|e| vec![e])
        .unwrap_or_default()
 }

+fn windows_peer_special_key(peer: &str, event: &Event) -> Option<KeyEvent> {
+    if peer != OS_LOWER_WINDOWS {
+        return None;
+    }
+
+    let (key, down) = match event.event_type {
+        EventType::KeyPress(key) => (key, true),
+        EventType::KeyRelease(key) => (key, false),
+        _ => return None,
+    };
+
+    // Handle only `Pause` for Windows peers for now.
+    // Windows has no normal scan code for `Pause`, so send it as a legacy control key.
+    #[cfg(target_os = "windows")]
+    let is_pause = {
+        // The Windows scan code can look like `NumLock`; VK_PAUSE distinguishes it.
+        let pause_vk_code = rdev::win_code_from_key(Key::Pause);
+        key == Key::Pause || pause_vk_code == Some(event.platform_code as _)
+    };
+    #[cfg(not(target_os = "windows"))]
+    let is_pause = key == Key::Pause;
+    if !is_pause {
+        return None;
+    }
+
+    let mut key_event = KeyEvent::new();
+    key_event.mode = KeyboardMode::Legacy.into();
+    key_event.down = down;
+    key_event.set_control_key(ControlKey::Pause);
+    let (alt, ctrl, shift, command) = client::get_modifiers_state(false, false, false, false);
+    client::legacy_modifiers(&mut key_event, alt, ctrl, shift, command);
+    Some(key_event)
+}
+
 fn _map_keyboard_mode(_peer: &str, event: &Event, mut key_event: KeyEvent) -> Option<KeyEvent> {
    match event.event_type {
        EventType::KeyPress(..) => {
@@ -1421,6 +1459,11 @@ fn is_press(event: &Event) -> bool {
 pub fn translate_keyboard_mode(peer: &str, event: &Event, key_event: KeyEvent) -> Vec<KeyEvent> {
    let mut events: Vec<KeyEvent> = Vec::new();

+    if let Some(evt) = windows_peer_special_key(peer, event) {
+        events.push(evt);
+        return events;
+    }
+
    if let Some(unicode_info) = &event.unicode {
        if unicode_info.is_dead {
            #[cfg(target_os = "macos")]
@@ -103,15 +103,29 @@ pub const LANGS: &[(&str, &str)] = &[
    ("gu", "ગુજરાતી"),
 ];

-#[cfg(not(any(target_os = "android", target_os = "ios")))]
-pub fn translate(name: String) -> String {
-    let locale = sys_locale::get_locale().unwrap_or_default();
-    translate_locale(name, &locale)
+pub(crate) fn cjk_ui_unavailable() -> bool {
+    cfg!(all(
+        target_os = "linux",
+        target_arch = "aarch64",
+        feature = "flutter"
+    ))
 }

-pub fn translate_locale(name: String, locale: &str) -> String {
+pub(crate) fn is_cjk_lang(lang_or_locale: &str) -> bool {
+    let lang = lang_or_locale
+        .split(|c| c == '-' || c == '_')
+        .next()
+        .unwrap_or_default()
+        .to_lowercase();
+    matches!(lang.as_str(), "zh" | "ja" | "ko")
+}
+
+fn resolve_lang(saved_lang: &str, locale: &str, cjk_fallback: bool) -> String {
    let locale = locale.to_lowercase();
-    let mut lang = hbb_common::config::LocalConfig::get_option("lang").to_lowercase();
+    let mut lang = saved_lang.to_lowercase();
+    if cjk_fallback && is_cjk_lang(&lang) {
+        return "en".to_owned();
+    }
    if lang.is_empty() {
        // zh_CN on Linux, zh-Hans-CN on mac, zh_CN_#Hans on Android
        if locale.starts_with("zh") {
@@ -131,7 +145,25 @@ pub fn translate_locale(name: String, locale: &str) -> String {
            .unwrap_or_default()
            .to_owned();
    }
-    let lang = lang.to_lowercase();
+    if cjk_fallback && is_cjk_lang(&lang) {
+        "en".to_owned()
+    } else {
+        lang
+    }
+}
+
+#[cfg(not(any(target_os = "android", target_os = "ios")))]
+pub fn translate(name: String) -> String {
+    let locale = sys_locale::get_locale().unwrap_or_default();
+    translate_locale(name, &locale)
+}
+
+pub fn translate_locale(name: String, locale: &str) -> String {
+    let lang = resolve_lang(
+        &hbb_common::config::LocalConfig::get_option("lang"),
+        locale,
+        cjk_ui_unavailable(),
+    );
    let m = match lang.as_str() {
        "fr" => fr::T.deref(),
        "zh-cn" => cn::T.deref(),
@@ -275,4 +307,32 @@ mod test {
            ("{} times {4} makes {8}".to_string(), Some("2".to_string()))
        );
    }
+
+    #[test]
+    fn test_resolve_lang_forces_english_for_saved_cjk_when_target_disables_cjk() {
+        use super::resolve_lang as f;
+
+        assert_eq!(f("zh-cn", "en-US", true), "en");
+        assert_eq!(f("zh-tw", "en-US", true), "en");
+        assert_eq!(f("ja", "en-US", true), "en");
+        assert_eq!(f("ko", "en-US", true), "en");
+    }
+
+    #[test]
+    fn test_resolve_lang_forces_english_for_cjk_locale_when_target_disables_cjk() {
+        use super::resolve_lang as f;
+
+        assert_eq!(f("", "zh_CN", true), "en");
+        assert_eq!(f("", "ja-JP", true), "en");
+        assert_eq!(f("", "ko_KR", true), "en");
+    }
+
+    #[test]
+    fn test_resolve_lang_preserves_cjk_when_target_allows_cjk() {
+        use super::resolve_lang as f;
+
+        assert_eq!(f("zh-cn", "en-US", false), "zh-cn");
+        assert_eq!(f("", "zh_TW", false), "zh-tw");
+        assert_eq!(f("", "ja-JP", false), "ja");
+    }
 }
@@ -332,6 +332,7 @@ pub static ref T: std::collections::HashMap<&'static str, &'static str> =
        ("Relay Connection", "اتصال الوسيط"),
        ("Secure Connection", "اتصال آمن"),
        ("Insecure Connection", "اتصال غير آمن"),
+        ("Continue", ""),
        ("Scale original", "المقياس الأصلي"),
        ("Scale adaptive", "مقياس التكيف"),
        ("General", "عام"),
@@ -758,5 +759,20 @@ pub static ref T: std::collections::HashMap<&'static str, &'static str> =
        ("wayland-keyboard-input-reset-choice-tip", "إعادة تعيين اختيار إدخال لوحة المفاتيح"),
        ("remember-wayland-keyboard-choice-tip", "لا تسأل مرة أخرى لهذا الكمبيوتر البعيد"),
        ("Why this happens", "سبب حدوث ذلك"),
+        ("Switch display", "تبديل الشاشة"),
+        ("Show monitor switch button on the main toolbar", "إظهار زر تبديل الشاشة على شريط الأدوات الرئيسي"),
+        ("Show on the minimized toolbar", "الإظهار على شريط الأدوات المُصغّر"),
+        ("All monitors", "جميع الشاشات"),
+        ("#{} monitor", "الشاشة رقم {}"),
+        ("conn-e2ee-unavailable-tip", "تعذر التحقق من التشفير من طرف إلى طرف.\nقد يكون الجهاز البعيد ما يزال قيد الإعداد. حاول مرة أخرى لاحقًا.\nإذا استمر حدوث ذلك، فقد يكون الخادم غير موثوق به.\nهل تريد المتابعة على أي حال؟"),
+        ("ID whitelisting", "القائمة البيضاء للمعرفات"),
+        ("Use ID whitelisting", "استخدام القائمة البيضاء للمعرفات"),
+        ("id_whitelist_tip", "فقط المعرفات في القائمة البيضاء تستطيع الوصول لي"),
+        ("id_whitelist_wildcard_tip", "أحرف البدل مدعومة: '*' يطابق أي عدد من الأحرف، '?' يطابق حرفاً واحداً بالضبط"),
+        ("Invalid ID", "معرف غير صحيح"),
+        ("Your ID is blocked by the peer", "تم حظر معرفك من قبل الطرف الآخر"),
+        ("Your ip is blocked by the peer", "تم حظر عنوان IP الخاص بك من قبل الطرف الآخر"),
+        ("id_whitelist_caveat_tip", "يتم الإبلاغ عن المعرف من قبل العميل المتصل. القائمة البيضاء تقلل من التعرض ولا تغني عن كلمة المرور أو 2FA"),
+        ("whitelist_cidr_tip", "يتم دعم صيغة CIDR، مثال: 192.168.1.0/24"),
    ].iter().cloned().collect();
 }
@@ -332,6 +332,7 @@ pub static ref T: std::collections::HashMap<&'static str, &'static str> =
        ("Relay Connection", "Рэтрансляванае падключэнне"),
        ("Secure Connection", "Бяспечнае падключэнне"),
        ("Insecure Connection", "Нябяспечнае падключэнне"),
+        ("Continue", ""),
        ("Scale original", "Арыгінальны маштаб"),
        ("Scale adaptive", "Адаптыўны маштаб"),
        ("General", "Агульныя"),
@@ -758,5 +759,20 @@ pub static ref T: std::collections::HashMap<&'static str, &'static str> =
        ("wayland-keyboard-input-reset-choice-tip", "Скінуць выбар уводу з клавіятуры"),
        ("remember-wayland-keyboard-choice-tip", "Не пытацца зноў для гэтага аддаленага кампутара"),
        ("Why this happens", "Чаму гэта адбываецца"),
+        ("Switch display", "Пераключыць дысплэй"),
+        ("Show monitor switch button on the main toolbar", "Паказваць кнопку пераключэння манітора на галоўнай панэлі інструментаў"),
+        ("Show on the minimized toolbar", "Паказваць на згорнутай панэлі інструментаў"),
+        ("All monitors", "Усе манітори"),
+        ("#{} monitor", "Манітор {}"),
+        ("conn-e2ee-unavailable-tip", "Не ўдалося праверыць скразное шыфраванне.\nАддаленая прылада, магчыма, яшчэ наладжваецца. Паспрабуйце пазней.\nКалі гэта будзе паўтарацца, сервер можа быць ненадзейным.\nУсё роўна працягнуць?"),
+        ("ID whitelisting", "Спіс дазволеных ID"),
+        ("Use ID whitelisting", "Выкарыстоўваць белы спіс ID"),
+        ("id_whitelist_tip", "Атрымліваць доступ да маёй прылады могуць толькі ID з белага спісу."),
+        ("id_whitelist_wildcard_tip", "Падтрымліваюцца падстаноўныя знакі: '*' адпавядае любой колькасці сімвалаў, '?' — роўна аднаму сімвалу"),
+        ("Invalid ID", "Няправільны ID"),
+        ("Your ID is blocked by the peer", "Ваш ID заблакаваны аддаленай прыладай"),
+        ("Your ip is blocked by the peer", "Ваш IP-адрас заблакаваны аддаленай прыладай"),
+        ("id_whitelist_caveat_tip", "ID паведамляецца кліентам, які падключаецца. Белы спіс памяншае паверхню атакі і не замяняе пароль або 2FA"),
+        ("whitelist_cidr_tip", "Падтрымліваецца натацыя CIDR, напрыклад: 192.168.1.0/24"),
    ].iter().cloned().collect();
 }
@@ -332,6 +332,7 @@ pub static ref T: std::collections::HashMap<&'static str, &'static str> =
        ("Relay Connection", "Релейна връзка"),
        ("Secure Connection", "Сигурна връзка"),
        ("Insecure Connection", "Несигурна връзка"),
+        ("Continue", ""),
        ("Scale original", "Оригинален мащаб"),
        ("Scale adaptive", "Приспособимо мащабиране"),
        ("General", "Основен"),
@@ -758,5 +759,20 @@ pub static ref T: std::collections::HashMap<&'static str, &'static str> =
        ("wayland-keyboard-input-reset-choice-tip", "Нулиране на избора за въвеждане от клавиатура"),
        ("remember-wayland-keyboard-choice-tip", "Не питай отново за този отдалечен компютър"),
        ("Why this happens", "Защо се случва това"),
+        ("Switch display", "Превключване на дисплея"),
+        ("Show monitor switch button on the main toolbar", "Показване на бутона за превключване на монитора в главната лента с инструменти"),
+        ("Show on the minimized toolbar", "Показване в минимизираната лента с инструменти"),
+        ("All monitors", "Всички монитори"),
+        ("#{} monitor", "Монитор {}"),
+        ("conn-e2ee-unavailable-tip", "Шифроването от край до край не може да бъде проверено.\nОтдалеченото устройство може все още да се настройва. Опитайте отново по-късно.\nАко това продължи, сървърът може да не е надежден.\nДа се продължи ли въпреки това?"),
+        ("ID whitelisting", "Позволени ID"),
+        ("Use ID whitelisting", "Използване бял списък с ID"),
+        ("id_whitelist_tip", "Само ID от белия списък имат достъп до мен"),
+        ("id_whitelist_wildcard_tip", "Поддържат се заместващи символи: '*' съответства на произволен брой знаци, '?' — на точно един знак"),
+        ("Invalid ID", "Невалидно ID"),
+        ("Your ID is blocked by the peer", "Вашето ID е блокирано от отсрещната страна"),
+        ("Your ip is blocked by the peer", "Вашият IP адрес е блокиран от отсрещната страна"),
+        ("id_whitelist_caveat_tip", "ID се съобщава от свързващия се клиент. Белият списък намалява изложеността и не замества паролата или 2FA"),
+        ("whitelist_cidr_tip", "Поддържа се CIDR нотация, например: 192.168.1.0/24"),
    ].iter().cloned().collect();
 }
@@ -332,6 +332,7 @@ pub static ref T: std::collections::HashMap<&'static str, &'static str> =
        ("Relay Connection", "Connexió amb repetidor"),
        ("Secure Connection", "Connexió segura"),
        ("Insecure Connection", "Connexió no segura"),
+        ("Continue", ""),
        ("Scale original", "Escala original"),
        ("Scale adaptive", "Escala adaptativa"),
        ("General", "General"),
@@ -758,5 +759,20 @@ pub static ref T: std::collections::HashMap<&'static str, &'static str> =
        ("wayland-keyboard-input-reset-choice-tip", "Restableix l'opció d'entrada de teclat"),
        ("remember-wayland-keyboard-choice-tip", "No tornis a preguntar-ho per a aquest equip remot"),
        ("Why this happens", "Per què passa això"),
+        ("Switch display", "Canvia de pantalla"),
+        ("Show monitor switch button on the main toolbar", "Mostra el botó de canvi de monitor a la barra d’eines principal"),
+        ("Show on the minimized toolbar", "Mostra a la barra d’eines minimitzada"),
+        ("All monitors", "Tots els monitors"),
+        ("#{} monitor", "Monitor {}"),
+        ("conn-e2ee-unavailable-tip", "No s'ha pogut verificar el xifratge d'extrem a extrem.\nEl dispositiu remot encara es pot estar configurant. Torneu-ho a provar més tard.\nSi això continua passant, el servidor pot no ser de confiança.\nVoleu continuar igualment?"),
+        ("ID whitelisting", "ID admesos"),
+        ("Use ID whitelisting", "Utilitza un llistat d'ID admesos"),
+        ("id_whitelist_tip", "Només els ID admesos es podran connectar"),
+        ("id_whitelist_wildcard_tip", "S'admeten comodins: '*' coincideix amb qualsevol nombre de caràcters, '?' amb un sol caràcter"),
+        ("Invalid ID", "ID no vàlid"),
+        ("Your ID is blocked by the peer", "El vostre ID està bloquejat per l'altre extrem"),
+        ("Your ip is blocked by the peer", "La vostra IP està bloquejada per l'altre extrem"),
+        ("id_whitelist_caveat_tip", "L'ID és informat pel client que es connecta. Aquesta llista blanca redueix l'exposició i no substitueix la contrasenya ni la 2FA"),
+        ("whitelist_cidr_tip", "S'admet la notació CIDR, per exemple 192.168.1.0/24"),
    ].iter().cloned().collect();
 }
@@ -332,6 +332,7 @@ pub static ref T: std::collections::HashMap<&'static str, &'static str> =
        ("Relay Connection", "中继连接"),
        ("Secure Connection", "安全连接"),
        ("Insecure Connection", "非安全连接"),
+        ("Continue", ""),
        ("Scale original", "原始尺寸"),
        ("Scale adaptive", "适应窗口"),
        ("General", "常规"),
@@ -758,5 +759,20 @@ pub static ref T: std::collections::HashMap<&'static str, &'static str> =
        ("wayland-keyboard-input-reset-choice-tip", "重置键盘输入选择"),
        ("remember-wayland-keyboard-choice-tip", "以后对这台远程电脑不再询问"),
        ("Why this happens", "了解原因"),
+        ("Switch display", "切换显示器"),
+        ("Show monitor switch button on the main toolbar", "在主工具栏上显示显示器切换按钮"),
+        ("Show on the minimized toolbar", "在最小化工具栏上显示"),
+        ("All monitors", "所有显示器"),
+        ("#{} monitor", "{}号显示器"),
+        ("conn-e2ee-unavailable-tip", "无法验证端到端加密。\n远程设备可能仍在准备中，请稍后重试。\n如果此问题持续出现，服务器可能不受信任。\n仍要继续吗？"),
+        ("ID whitelisting", "ID 白名单"),
+        ("Use ID whitelisting", "只允许白名单上的 ID 访问"),
+        ("id_whitelist_tip", "只有白名单里的 ID 才能访问本机"),
+        ("id_whitelist_wildcard_tip", "支持通配符：'*' 匹配任意数量的字符，'?' 匹配单个字符"),
+        ("Invalid ID", "无效 ID"),
+        ("Your ID is blocked by the peer", "你的 ID 已被对方阻止"),
+        ("Your ip is blocked by the peer", "你的 IP 已被对方阻止"),
+        ("id_whitelist_caveat_tip", "ID 由对端客户端上报，白名单用于减少暴露面，不能替代密码或 2FA"),
+        ("whitelist_cidr_tip", "支持 CIDR 写法，例如 192.168.1.0/24"),
    ].iter().cloned().collect();
 }
@@ -332,6 +332,7 @@ pub static ref T: std::collections::HashMap<&'static str, &'static str> =
        ("Relay Connection", "Připojení předávací server"),
        ("Secure Connection", "Zabezpečené připojení"),
        ("Insecure Connection", "Nezabezpečené připojení"),
+        ("Continue", ""),
        ("Scale original", "Originální měřítko"),
        ("Scale adaptive", "Adaptivní měřítko"),
        ("General", "Obecné"),
@@ -758,5 +759,20 @@ pub static ref T: std::collections::HashMap<&'static str, &'static str> =
        ("wayland-keyboard-input-reset-choice-tip", "Resetovat volbu vstupu z klávesnice"),
        ("remember-wayland-keyboard-choice-tip", "Pro tento vzdálený počítač se již neptat"),
        ("Why this happens", "Proč k tomu dochází"),
+        ("Switch display", "Přepnout obrazovku"),
+        ("Show monitor switch button on the main toolbar", "Zobrazit tlačítko přepnutí monitoru na hlavním panelu nástrojů"),
+        ("Show on the minimized toolbar", "Zobrazit na minimalizovaném panelu nástrojů"),
+        ("All monitors", "Všechny monitory"),
+        ("#{} monitor", "Monitor č. {}"),
+        ("conn-e2ee-unavailable-tip", "Nepodařilo se ověřit koncové šifrování.\nVzdálené zařízení se možná stále nastavuje. Zkuste to znovu později.\nPokud se to bude opakovat, server nemusí být důvěryhodný.\nPřesto pokračovat?"),
+        ("ID whitelisting", "Povolování pouze z daných ID"),
+        ("Use ID whitelisting", "Použít bílou listinu ID"),
+        ("id_whitelist_tip", "Přístup je umožněn pouze z ID, nacházejících se na seznamu povolených"),
+        ("id_whitelist_wildcard_tip", "Jsou podporovány zástupné znaky: '*' odpovídá libovolnému počtu znaků, '?' právě jednomu znaku"),
+        ("Invalid ID", "Neplatné ID"),
+        ("Your ID is blocked by the peer", "Vaše ID je protistranou blokováno"),
+        ("Your ip is blocked by the peer", "Vaše IP adresa je protistranou blokována"),
+        ("id_whitelist_caveat_tip", "ID je hlášeno připojujícím se klientem. Tento seznam snižuje vystavení a nenahrazuje heslo ani 2FA"),
+        ("whitelist_cidr_tip", "Je podporován zápis CIDR, například 192.168.1.0/24"),
    ].iter().cloned().collect();
 }
@@ -332,6 +332,7 @@ pub static ref T: std::collections::HashMap<&'static str, &'static str> =
        ("Relay Connection", "Viderestillingsforbindelse"),
        ("Secure Connection", "Sikker forbindelse"),
        ("Insecure Connection", "Usikker forbindelse"),
+        ("Continue", ""),
        ("Scale original", "Original skalering"),
        ("Scale adaptive", "Adaptiv skalering"),
        ("General", "Generelt"),
@@ -758,5 +759,20 @@ pub static ref T: std::collections::HashMap<&'static str, &'static str> =
        ("wayland-keyboard-input-reset-choice-tip", "Nulstil valg for tastaturinput"),
        ("remember-wayland-keyboard-choice-tip", "Spørg ikke igen for denne fjerncomputer"),
        ("Why this happens", "Hvorfor dette sker"),
+        ("Switch display", "Skift skærm"),
+        ("Show monitor switch button on the main toolbar", "Vis knap til skærmskift på hovedværktøjslinjen"),
+        ("Show on the minimized toolbar", "Vis på den minimerede værktøjslinje"),
+        ("All monitors", "Alle skærme"),
+        ("#{} monitor", "Skærm {}"),
+        ("conn-e2ee-unavailable-tip", "End-to-end-kryptering kunne ikke bekræftes.\nDen eksterne enhed er muligvis stadig ved at blive konfigureret. Prøv igen senere.\nHvis dette fortsætter, er serveren muligvis ikke pålidelig.\nFortsæt alligevel?"),
+        ("ID whitelisting", "ID whitelisting"),
+        ("Use ID whitelisting", "Brug ID whitelisting"),
+        ("id_whitelist_tip", "Kun ID'er på whitelisten kan få adgang til mig"),
+        ("id_whitelist_wildcard_tip", "Jokertegn understøttes: '*' matcher et vilkårligt antal tegn, '?' matcher præcist ét tegn"),
+        ("Invalid ID", "Ugyldigt ID"),
+        ("Your ID is blocked by the peer", "Dit ID er blokeret af modparten"),
+        ("Your ip is blocked by the peer", "Din IP-adresse er blokeret af modparten"),
+        ("id_whitelist_caveat_tip", "ID'et rapporteres af den klient, der opretter forbindelse. Whitelisten reducerer eksponeringen og erstatter ikke adgangskode eller 2FA"),
+        ("whitelist_cidr_tip", "CIDR-notation understøttes, f.eks. 192.168.1.0/24"),
    ].iter().cloned().collect();
 }
@@ -332,6 +332,7 @@ pub static ref T: std::collections::HashMap<&'static str, &'static str> =
        ("Relay Connection", "Relay-Verbindung"),
        ("Secure Connection", "Sichere Verbindung"),
        ("Insecure Connection", "Unsichere Verbindung"),
+        ("Continue", ""),
        ("Scale original", "Keine Skalierung"),
        ("Scale adaptive", "Anpassbare Skalierung"),
        ("General", "Allgemein"),
@@ -758,5 +759,20 @@ pub static ref T: std::collections::HashMap<&'static str, &'static str> =
        ("wayland-keyboard-input-reset-choice-tip", "Auswahl der Tastatureingabe zurücksetzen"),
        ("remember-wayland-keyboard-choice-tip", "Für diesen entfernten Computer nicht erneut fragen"),
        ("Why this happens", "Warum dies passiert"),
+        ("Switch display", "Anzeige wechseln"),
+        ("Show monitor switch button on the main toolbar", "Schaltfläche zum Monitorwechsel in der Haupt-Symbolleiste anzeigen"),
+        ("Show on the minimized toolbar", "In der minimierten Symbolleiste anzeigen"),
+        ("All monitors", "Alle Bildschirme"),
+        ("#{} monitor", "Bildschirm {}"),
+        ("conn-e2ee-unavailable-tip", "Ende-zu-Ende-Verschlüsselung konnte nicht verifiziert werden.\nDas entfernte Gerät wird möglicherweise noch eingerichtet. Versuchen Sie es später erneut.\nWenn dies weiterhin auftritt, ist der Server möglicherweise nicht vertrauenswürdig.\nTrotzdem fortfahren?"),
+        ("ID whitelisting", "ID-Whitelist"),
+        ("Use ID whitelisting", "ID-Whitelist verwenden"),
+        ("id_whitelist_tip", "Nur IDs auf der Whitelist können zugreifen."),
+        ("id_whitelist_wildcard_tip", "Platzhalter werden unterstützt: '*' steht für beliebig viele Zeichen, '?' für genau ein Zeichen"),
+        ("Invalid ID", "Ungültige ID"),
+        ("Your ID is blocked by the peer", "Ihre ID wird von der Gegenstelle blockiert"),
+        ("Your ip is blocked by the peer", "Ihre IP-Adresse wird von der Gegenstelle blockiert"),
+        ("id_whitelist_caveat_tip", "Die ID wird vom verbindenden Client gemeldet. Die Whitelist verringert die Angriffsfläche und ersetzt weder Passwort noch 2FA"),
+        ("whitelist_cidr_tip", "Die CIDR-Notation wird unterstützt, z. B. 192.168.1.0/24"),
    ].iter().cloned().collect();
 }
@@ -332,6 +332,7 @@ pub static ref T: std::collections::HashMap<&'static str, &'static str> =
        ("Relay Connection", "Αναμεταδιδόμενη σύνδεση"),
        ("Secure Connection", "Ασφαλής σύνδεση"),
        ("Insecure Connection", "Μη ασφαλής σύνδεση"),
+        ("Continue", ""),
        ("Scale original", "Κλιμάκωση πρωτότυπου"),
        ("Scale adaptive", "Προσαρμοσμένη κλίμακα"),
        ("General", "Γενικά"),
@@ -758,5 +759,20 @@ pub static ref T: std::collections::HashMap<&'static str, &'static str> =
        ("wayland-keyboard-input-reset-choice-tip", "Επαναφορά επιλογής εισαγωγής από πληκτρολόγιο"),
        ("remember-wayland-keyboard-choice-tip", "Να μην ερωτηθώ ξανά για αυτόν τον απομακρυσμένο υπολογιστή"),
        ("Why this happens", "Γιατί συμβαίνει αυτό"),
+        ("Switch display", "Εναλλαγή οθόνης"),
+        ("Show monitor switch button on the main toolbar", "Εμφάνιση κουμπιού εναλλαγής οθόνης στην κύρια γραμμή εργαλείων"),
+        ("Show on the minimized toolbar", "Εμφάνιση στην ελαχιστοποιημένη γραμμή εργαλείων"),
+        ("All monitors", "Όλες οι οθόνες"),
+        ("#{} monitor", "Οθόνη {}"),
+        ("conn-e2ee-unavailable-tip", "Δεν ήταν δυνατή η επαλήθευση της κρυπτογράφησης από άκρο σε άκρο.\nΗ απομακρυσμένη συσκευή μπορεί να ρυθμίζεται ακόμα. Δοκιμάστε ξανά αργότερα.\nΑν αυτό συνεχιστεί, ο διακομιστής μπορεί να μην είναι αξιόπιστος.\nΣυνέχεια παρ' όλα αυτά;"),
+        ("ID whitelisting", "Λίστα επιτρεπόμενων ID"),
+        ("Use ID whitelisting", "Χρήση λίστας επιτρεπόμενων ID"),
+        ("id_whitelist_tip", "Μόνο τα ID της λίστας επιτρεπόμενων έχουν πρόσβαση σε εμένα"),
+        ("id_whitelist_wildcard_tip", "Υποστηρίζονται χαρακτήρες μπαλαντέρ: το '*' αντιστοιχεί σε οποιονδήποτε αριθμό χαρακτήρων, το '?' σε έναν ακριβώς χαρακτήρα"),
+        ("Invalid ID", "Μη έγκυρο ID"),
+        ("Your ID is blocked by the peer", "Το ID σας έχει αποκλειστεί από τον απομακρυσμένο υπολογιστή"),
+        ("Your ip is blocked by the peer", "Η διεύθυνση IP σας έχει αποκλειστεί από τον απομακρυσμένο υπολογιστή"),
+        ("id_whitelist_caveat_tip", "Το ID αναφέρεται από τον πελάτη που συνδέεται. Η λίστα επιτρεπόμενων μειώνει την έκθεση και δεν αντικαθιστά τον κωδικό πρόσβασης ή το 2FA"),
+        ("whitelist_cidr_tip", "Υποστηρίζεται η σημειογραφία CIDR, π.χ. 192.168.1.0/24"),
    ].iter().cloned().collect();
 }
@@ -279,5 +279,11 @@ pub static ref T: std::collections::HashMap<&'static str, &'static str> =
        ("wayland-soft-keyboard-input-label", "Soft keyboard input"),
        ("wayland-keyboard-input-reset-choice-tip", "Reset keyboard input choice"),
        ("remember-wayland-keyboard-choice-tip", "Don't ask again for this remote computer"),
+        ("conn-e2ee-unavailable-tip", "Could not verify end-to-end encryption.\nThe remote device may still be setting up. Try again later.\nIf this keeps happening, the server may be untrusted.\nContinue anyway?"),
+        ("id_whitelist_tip", "Only whitelisted IDs can access me"),
+        ("id_whitelist_wildcard_tip", "Wildcards are supported: '*' matches any number of characters, '?' matches exactly one character"),
+        ("id_whitelist_caveat_tip", "The ID is reported by the connecting client. This whitelist reduces exposure and does not replace the password or 2FA."),
+        ("whitelist_cidr_tip", "CIDR notation is supported, e.g. 192.168.1.0/24"),
+        ("Your ip is blocked by the peer", "Your IP is blocked by the peer")
    ].iter().cloned().collect();
 }
@@ -332,6 +332,7 @@ pub static ref T: std::collections::HashMap<&'static str, &'static str> =
        ("Relay Connection", "Relajsa Konekto"),
        ("Secure Connection", "Sekura Konekto"),
        ("Insecure Connection", "Nesekura Konekto"),
+        ("Continue", ""),
        ("Scale original", "Skalo originalo"),
        ("Scale adaptive", "Skalo adapta"),
        ("General", "Ĝenerala"),
@@ -758,5 +759,20 @@ pub static ref T: std::collections::HashMap<&'static str, &'static str> =
        ("wayland-keyboard-input-reset-choice-tip", "Restarigi la elekton de klavara enigo"),
        ("remember-wayland-keyboard-choice-tip", "Ne demandi denove por ĉi tiu fora komputilo"),
        ("Why this happens", "Kial ĉi tio okazas"),
+        ("Switch display", "Ŝalti ekranon"),
+        ("Show monitor switch button on the main toolbar", "Montri ekran-ŝaltan butonon en la ĉefa ilobreto"),
+        ("Show on the minimized toolbar", "Montri en la minimumigita ilobreto"),
+        ("All monitors", "Ĉiuj monitoroj"),
+        ("#{} monitor", "Monitoro {}"),
+        ("conn-e2ee-unavailable-tip", "Ne eblis kontroli la fin-al-finan ĉifradon.\nLa fora aparato eble ankoraŭ estas agordata. Provu denove poste.\nSe tio daŭre okazas, la servilo eble estas nefidinda.\nĈu daŭrigi tamen?"),
+        ("ID whitelisting", "Listo de ID akceptataj"),
+        ("Use ID whitelisting", "Uzi liston de ID akceptataj"),
+        ("id_whitelist_tip", "Nur la ID en la blanka listo povas kontroli mian komputilon"),
+        ("id_whitelist_wildcard_tip", "Ĵokeroj estas subtenataj: '*' kongruas kun iu ajn nombro da signoj, '?' kun ekzakte unu signo"),
+        ("Invalid ID", "ID nevalida"),
+        ("Your ID is blocked by the peer", "Via ID estas blokita de la alia flanko"),
+        ("Your ip is blocked by the peer", "Via IP estas blokita de la alia flanko"),
+        ("id_whitelist_caveat_tip", "La ID estas raportata de la konektiĝanta kliento. La blanka listo malpliigas la eksponiĝon kaj ne anstataŭas la pasvorton aŭ 2FA"),
+        ("whitelist_cidr_tip", "La notacio CIDR estas subtenata, ekzemple 192.168.1.0/24"),
    ].iter().cloned().collect();
 }
@@ -332,6 +332,7 @@ pub static ref T: std::collections::HashMap<&'static str, &'static str> =
        ("Relay Connection", "Conexión Relay"),
        ("Secure Connection", "Conexión segura"),
        ("Insecure Connection", "Conexión insegura"),
+        ("Continue", ""),
        ("Scale original", "Escala original"),
        ("Scale adaptive", "Escala adaptativa"),
        ("General", "General"),
@@ -758,5 +759,20 @@ pub static ref T: std::collections::HashMap<&'static str, &'static str> =
        ("wayland-keyboard-input-reset-choice-tip", "Restablecer la opción de entrada del teclado"),
        ("remember-wayland-keyboard-choice-tip", "No volver a preguntar para este equipo remoto"),
        ("Why this happens", "Por qué ocurre esto"),
+        ("Switch display", "Cambiar de pantalla"),
+        ("Show monitor switch button on the main toolbar", "Mostrar el botón de cambio de monitor en la barra de herramientas principal"),
+        ("Show on the minimized toolbar", "Mostrar en la barra de herramientas minimizada"),
+        ("All monitors", "Todos los monitores"),
+        ("#{} monitor", "Monitor {}"),
+        ("conn-e2ee-unavailable-tip", "No se pudo verificar el cifrado de extremo a extremo.\nEs posible que el dispositivo remoto aún se esté configurando. Inténtelo de nuevo más tarde.\nSi esto sigue ocurriendo, es posible que el servidor no sea de confianza.\n¿Continuar de todos modos?"),
+        ("ID whitelisting", "IDs admitidos"),
+        ("Use ID whitelisting", "Usar lista de IDs admitidos"),
+        ("id_whitelist_tip", "Solo los IDs autorizados pueden conectarse a este escritorio"),
+        ("id_whitelist_wildcard_tip", "Se admiten comodines: '*' coincide con cualquier número de caracteres, '?' con exactamente un carácter"),
+        ("Invalid ID", "ID incorrecto"),
+        ("Your ID is blocked by the peer", "Tu ID está bloqueado por el dispositivo remoto"),
+        ("Your ip is blocked by the peer", "Tu IP está bloqueada por el dispositivo remoto"),
+        ("id_whitelist_caveat_tip", "El ID lo comunica el cliente que se conecta. Esta lista blanca reduce la exposición y no sustituye a la contraseña ni al 2FA"),
+        ("whitelist_cidr_tip", "Se admite la notación CIDR, por ejemplo 192.168.1.0/24"),
    ].iter().cloned().collect();
 }
@@ -332,6 +332,7 @@ pub static ref T: std::collections::HashMap<&'static str, &'static str> =
        ("Relay Connection", "Releeühendus"),
        ("Secure Connection", "Turvaline ühendus"),
        ("Insecure Connection", "Ebaturvaline ühendus"),
+        ("Continue", ""),
        ("Scale original", "Originaalskaala"),
        ("Scale adaptive", "Kohanduv skaala"),
        ("General", "Üldine"),
@@ -758,5 +759,20 @@ pub static ref T: std::collections::HashMap<&'static str, &'static str> =
        ("wayland-keyboard-input-reset-choice-tip", "Lähtesta klaviatuurisisestuse valik"),
        ("remember-wayland-keyboard-choice-tip", "Ära küsi selle kaugarvuti puhul uuesti"),
        ("Why this happens", "Miks see juhtub"),
+        ("Switch display", "Vaheta kuva"),
+        ("Show monitor switch button on the main toolbar", "Näita monitori vahetamise nuppu peamisel tööriistaribal"),
+        ("Show on the minimized toolbar", "Näita minimeeritud tööriistaribal"),
+        ("All monitors", "Kõik kuvarid"),
+        ("#{} monitor", "Kuvar {}"),
+        ("conn-e2ee-unavailable-tip", "Otspunktkrüptimist ei saanud kontrollida.\nKaugseade võib olla veel seadistamisel. Proovige hiljem uuesti.\nKui see jätkub, ei pruugi server olla usaldusväärne.\nKas jätkata siiski?"),
+        ("ID whitelisting", "ID lubamisloend"),
+        ("Use ID whitelisting", "Kasuta ID-lubamisloendit"),
+        ("id_whitelist_tip", "Ainult lubamisloendis ID saab mulle ligi"),
+        ("id_whitelist_wildcard_tip", "Metamärgid on toetatud: '*' vastab suvalisele arvule märkidele, '?' täpselt ühele märgile"),
+        ("Invalid ID", "Sobimatu ID"),
+        ("Your ID is blocked by the peer", "Teine pool on sinu ID blokeerinud"),
+        ("Your ip is blocked by the peer", "Teine pool on sinu IP-aadressi blokeerinud"),
+        ("id_whitelist_caveat_tip", "ID edastab ühenduv klient. Lubamisloend vähendab eksponeeritust ega asenda parooli või 2FA-d"),
+        ("whitelist_cidr_tip", "Toetatud on CIDR-tähistus, näiteks 192.168.1.0/24"),
    ].iter().cloned().collect();
 }
@@ -332,6 +332,7 @@ pub static ref T: std::collections::HashMap<&'static str, &'static str> =
        ("Relay Connection", "Konexio igorria"),
        ("Secure Connection", "Konexio segurua"),
        ("Insecure Connection", "Konexio ez-segurua"),
+        ("Continue", ""),
        ("Scale original", "Jatorrizko eskala"),
        ("Scale adaptive", "Eskala moldagarria"),
        ("General", "Orokorra"),
@@ -758,5 +759,20 @@ pub static ref T: std::collections::HashMap<&'static str, &'static str> =
        ("wayland-keyboard-input-reset-choice-tip", "Berrezarri teklatuko sarreraren aukera"),
        ("remember-wayland-keyboard-choice-tip", "Ez galdetu berriro urruneko ordenagailu honetarako"),
        ("Why this happens", "Zergatik gertatzen den hau"),
+        ("Switch display", "Aldatu pantaila"),
+        ("Show monitor switch button on the main toolbar", "Erakutsi monitorea aldatzeko botoia tresna-barra nagusian"),
+        ("Show on the minimized toolbar", "Erakutsi minimizatutako tresna-barran"),
+        ("All monitors", "Monitore guztiak"),
+        ("#{} monitor", "{}. monitorea"),
+        ("conn-e2ee-unavailable-tip", "Ezin izan da muturretik muturrerako enkriptatzea egiaztatu.\nUrruneko gailua oraindik konfiguratzen ari daiteke. Saiatu berriro geroago.\nHonek jarraitzen badu, zerbitzaria fidagaitza izan daiteke.\nHala ere jarraitu?"),
+        ("ID whitelisting", "Onartutako IDak"),
+        ("Use ID whitelisting", "Erabili ID onartuen zerrenda"),
+        ("id_whitelist_tip", "Baimendutako IDak soilik konektatu daitezke mahaigain honetara"),
+        ("id_whitelist_wildcard_tip", "Komodinak onartzen dira: '*' edozein karaktere kopururekin bat dator, '?' karaktere bakar batekin"),
+        ("Invalid ID", "ID baliogabea"),
+        ("Your ID is blocked by the peer", "Beste aldeak zure IDa blokeatu du"),
+        ("Your ip is blocked by the peer", "Beste aldeak zure IP helbidea blokeatu du"),
+        ("id_whitelist_caveat_tip", "IDa konektatzen den bezeroak jakinarazten du. Zerrenda honek esposizioa murrizten du eta ez du pasahitza edo 2FA ordezkatzen"),
+        ("whitelist_cidr_tip", "CIDR notazioa onartzen da, adibidez 192.168.1.0/24"),
    ].iter().cloned().collect();
 }
@@ -332,6 +332,7 @@ pub static ref T: std::collections::HashMap<&'static str, &'static str> =
        ("Relay Connection", "Relay ارتباط"),
        ("Secure Connection", "ارتباط امن"),
        ("Insecure Connection", "ارتباط غیر امن"),
+        ("Continue", ""),
        ("Scale original", "مقیاس اصلی"),
        ("Scale adaptive", "مقیاس تطبیقی"),
        ("General", "عمومی"),
@@ -758,5 +759,20 @@ pub static ref T: std::collections::HashMap<&'static str, &'static str> =
        ("wayland-keyboard-input-reset-choice-tip", "بازنشانی انتخاب ورودی صفحه کلید"),
        ("remember-wayland-keyboard-choice-tip", "برای این رایانه از راه دور دوباره نپرس"),
        ("Why this happens", "چرا این اتفاق می‌افتد"),
+        ("Switch display", "تعویض نمایشگر"),
+        ("Show monitor switch button on the main toolbar", "نمایش دکمه تعویض نمایشگر در نوار ابزار اصلی"),
+        ("Show on the minimized toolbar", "نمایش در نوار ابزار کوچک‌شده"),
+        ("All monitors", "همه نمایشگرها"),
+        ("#{} monitor", "نمایشگر {}"),
+        ("conn-e2ee-unavailable-tip", "رمزنگاری سرتاسری قابل تأیید نیست.\nدستگاه راه دور ممکن است هنوز در حال آماده‌سازی باشد. بعداً دوباره تلاش کنید.\nاگر این مشکل ادامه داشت، سرور ممکن است نامطمئن باشد.\nبا این حال ادامه می‌دهید؟"),
+        ("ID whitelisting", "لیست شناسه های مجاز"),
+        ("Use ID whitelisting", "استفاده از لیست شناسه های مجاز"),
+        ("id_whitelist_tip", "فقط شناسه های مجاز می توانند به این دسکتاپ متصل شوند"),
+        ("id_whitelist_wildcard_tip", "نویسه های عام پشتیبانی می شوند: '*' با هر تعداد نویسه و '?' دقیقا با یک نویسه مطابقت دارد"),
+        ("Invalid ID", "شناسه نامعتبر است"),
+        ("Your ID is blocked by the peer", "شناسه شما توسط طرف مقابل مسدود شده است"),
+        ("Your ip is blocked by the peer", "نشانی IP شما توسط طرف مقابل مسدود شده است"),
+        ("id_whitelist_caveat_tip", "شناسه توسط کلاینت متصل شونده گزارش می شود. لیست مجاز سطح در معرض بودن را کاهش می دهد و جایگزین رمز عبور یا 2FA نیست"),
+        ("whitelist_cidr_tip", "نماد CIDR پشتیبانی می شود، برای مثال 192.168.1.0/24"),
    ].iter().cloned().collect();
 }
@@ -332,6 +332,7 @@ pub static ref T: std::collections::HashMap<&'static str, &'static str> =
        ("Relay Connection", "Välitetty yhteys"),
        ("Secure Connection", "Suojattu yhteys"),
        ("Insecure Connection", "Suojaamaton yhteys"),
+        ("Continue", ""),
        ("Scale original", "Skaalaa alkuperäinen"),
        ("Scale adaptive", "Mukautuva skaalaus"),
        ("General", "Yleiset"),
@@ -758,5 +759,20 @@ pub static ref T: std::collections::HashMap<&'static str, &'static str> =
        ("wayland-keyboard-input-reset-choice-tip", "Nollaa näppäimistösyötteen valinta"),
        ("remember-wayland-keyboard-choice-tip", "Älä kysy uudelleen tältä etätietokoneelta"),
        ("Why this happens", "Miksi näin tapahtuu"),
+        ("Switch display", "Vaihda näyttöä"),
+        ("Show monitor switch button on the main toolbar", "Näytä näytön vaihtopainike päätyökalurivillä"),
+        ("Show on the minimized toolbar", "Näytä pienennetyssä työkalurivissä"),
+        ("All monitors", "Kaikki näytöt"),
+        ("#{} monitor", "Näyttö {}"),
+        ("conn-e2ee-unavailable-tip", "Päästä päähän -salausta ei voitu vahvistaa.\nEtälaite voi olla vielä määritettävänä. Yritä myöhemmin uudelleen.\nJos tämä jatkuu, palvelin ei ehkä ole luotettava.\nJatketaanko silti?"),
+        ("ID whitelisting", "ID sallintalista"),
+        ("Use ID whitelisting", "Käytä ID sallintalistaa"),
+        ("id_whitelist_tip", "Vain sallitut ID:t voivat muodostaa yhteyden"),
+        ("id_whitelist_wildcard_tip", "Jokerimerkit ovat tuettuja: '*' vastaa mitä tahansa määrää merkkejä, '?' täsmälleen yhtä merkkiä"),
+        ("Invalid ID", "Virheellinen ID"),
+        ("Your ID is blocked by the peer", "Vastapuoli on estänyt ID:si"),
+        ("Your ip is blocked by the peer", "Vastapuoli on estänyt IP-osoitteesi"),
+        ("id_whitelist_caveat_tip", "ID on yhdistävän asiakkaan ilmoittama. Sallintalista pienentää altistusta eikä korvaa salasanaa tai 2FA:ta"),
+        ("whitelist_cidr_tip", "CIDR-merkintä on tuettu, esimerkiksi 192.168.1.0/24"),
    ].iter().cloned().collect();
 }
@@ -332,6 +332,7 @@ pub static ref T: std::collections::HashMap<&'static str, &'static str> =
        ("Relay Connection", "Connexion via relais"),
        ("Secure Connection", "Connexion sécurisée"),
        ("Insecure Connection", "Connexion non sécurisée"),
+        ("Continue", ""),
        ("Scale original", "Échelle originale"),
        ("Scale adaptive", "Échelle adaptative"),
        ("General", "Général"),
@@ -758,5 +759,20 @@ pub static ref T: std::collections::HashMap<&'static str, &'static str> =
        ("wayland-keyboard-input-reset-choice-tip", "Réinitialiser le choix de la saisie au clavier"),
        ("remember-wayland-keyboard-choice-tip", "Ne plus demander pour cet appareil distant"),
        ("Why this happens", "Pourquoi cela se produit"),
+        ("Switch display", "Changer d’écran"),
+        ("Show monitor switch button on the main toolbar", "Afficher le bouton de changement d’écran dans la barre d’outils principale"),
+        ("Show on the minimized toolbar", "Afficher dans la barre d’outils réduite"),
+        ("All monitors", "Tous les moniteurs"),
+        ("#{} monitor", "Moniteur {}"),
+        ("conn-e2ee-unavailable-tip", "Impossible de vérifier le chiffrement de bout en bout.\nL'appareil distant est peut-être encore en cours de configuration. Réessayez plus tard.\nSi le problème persiste, le serveur n'est peut-être pas fiable.\nContinuer quand même ?"),
+        ("ID whitelisting", "Liste blanche d’ID"),
+        ("Use ID whitelisting", "Utiliser une liste blanche d’ID"),
+        ("id_whitelist_tip", "Seuls les ID inclus dans la liste blanche pourront accéder à mon appareil"),
+        ("id_whitelist_wildcard_tip", "Les caractères génériques sont pris en charge : '*' correspond à un nombre quelconque de caractères, '?' à un seul caractère"),
+        ("Invalid ID", "ID non valide"),
+        ("Your ID is blocked by the peer", "Votre ID est bloqué par l’appareil distant"),
+        ("Your ip is blocked by the peer", "Votre adresse IP est bloquée par l’appareil distant"),
+        ("id_whitelist_caveat_tip", "L’ID est déclaré par le client qui se connecte. Cette liste blanche réduit l’exposition et ne remplace ni le mot de passe ni la 2FA"),
+        ("whitelist_cidr_tip", "La notation CIDR est prise en charge, par exemple 192.168.1.0/24"),
    ].iter().cloned().collect();
 }
@@ -332,6 +332,7 @@ pub static ref T: std::collections::HashMap<&'static str, &'static str> =
        ("Relay Connection", "რეტრანსლირებული კავშირი"),
        ("Secure Connection", "უსაფრთხო კავშირი"),
        ("Insecure Connection", "არაუსაფრთხო კავშირი"),
+        ("Continue", ""),
        ("Scale original", "ორიგინალური მასშტაბი"),
        ("Scale adaptive", "ადაპტირებადი მასშტაბი"),
        ("General", "ზოგადი"),
@@ -758,5 +759,20 @@ pub static ref T: std::collections::HashMap<&'static str, &'static str> =
        ("wayland-keyboard-input-reset-choice-tip", "კლავიატურის შეყვანის არჩევანის ჩამოყრა"),
        ("remember-wayland-keyboard-choice-tip", "აღარ მკითხო ამ დისტანციური კომპიუტერისთვის"),
        ("Why this happens", "რატომ ხდება ეს"),
+        ("Switch display", "ეკრანის გადართვა"),
+        ("Show monitor switch button on the main toolbar", "მონიტორის გადართვის ღილაკის ჩვენება მთავარ ხელსაწყოთა ზოლზე"),
+        ("Show on the minimized toolbar", "ჩვენება ჩაკეცილ ხელსაწყოთა ზოლზე"),
+        ("All monitors", "ყველა მონიტორი"),
+        ("#{} monitor", "მონიტორი {}"),
+        ("conn-e2ee-unavailable-tip", "ბოლომდე დაშიფვრის გადამოწმება ვერ მოხერხდა.\nდისტანციური მოწყობილობა შესაძლოა ჯერ კიდევ მზადდება. სცადეთ მოგვიანებით.\nთუ ეს კვლავ გაგრძელდება, სერვერი შესაძლოა არასანდო იყოს.\nმაინც გააგრძელებთ?"),
+        ("ID whitelisting", "დაშვებული ID-ების სია"),
+        ("Use ID whitelisting", "ID თეთრი სიის გამოყენება"),
+        ("id_whitelist_tip", "მხოლოდ თეთრ სიაში არსებულ ID-ებს შეუძლიათ ჩემს მოწყობილობაზე წვდომა."),
+        ("id_whitelist_wildcard_tip", "მხარდაჭერილია ვაილდქარდები: '*' ემთხვევა ნებისმიერი რაოდენობის სიმბოლოს, '?' — ზუსტად ერთ სიმბოლოს"),
+        ("Invalid ID", "არასწორი ID"),
+        ("Your ID is blocked by the peer", "თქვენი ID დაბლოკილია მეორე მხარის მიერ"),
+        ("Your ip is blocked by the peer", "თქვენი IP მისამართი დაბლოკილია მეორე მხარის მიერ"),
+        ("id_whitelist_caveat_tip", "ID-ს აცხადებს დამაკავშირებელი კლიენტი. თეთრი სია ამცირებს ექსპოზიციას და ვერ ჩაანაცვლებს პაროლს ან 2FA-ს"),
+        ("whitelist_cidr_tip", "მხარდაჭერილია CIDR ჩანაწერი, მაგალითად 192.168.1.0/24"),
    ].iter().cloned().collect();
 }
@@ -332,6 +332,7 @@ pub static ref T: std::collections::HashMap<&'static str, &'static str> =
        ("Relay Connection", "રિલે કનેક્શન"),
        ("Secure Connection", "સુરક્ષિત કનેક્શન"),
        ("Insecure Connection", "અસુરક્ષિત કનેક્શન"),
+        ("Continue", ""),
        ("Scale original", "મૂળ સ્કેલ"),
        ("Scale adaptive", "એડેપ્ટિવ સ્કેલ"),
        ("General", "સામાન્ય"),
@@ -758,5 +759,20 @@ pub static ref T: std::collections::HashMap<&'static str, &'static str> =
        ("wayland-keyboard-input-reset-choice-tip", "કીબોર્ડ ઇનપુટ પસંદગી રિસેટ કરો"),
        ("remember-wayland-keyboard-choice-tip", "આ રિમોટ કમ્પ્યુટર માટે ફરીથી પૂછશો નહીં"),
        ("Why this happens", "આવું શા માટે થાય છે"),
+        ("Switch display", "ડિસ્પ્લે બદલો"),
+        ("Show monitor switch button on the main toolbar", "મુખ્ય ટૂલબાર પર મોનિટર સ્વિચ બટન બતાવો"),
+        ("Show on the minimized toolbar", "ન્યૂનતમ કરેલા ટૂલબાર પર બતાવો"),
+        ("All monitors", "બધા મોનિટર"),
+        ("#{} monitor", "મોનિટર {}"),
+        ("conn-e2ee-unavailable-tip", "એન્ડ-ટુ-એન્ડ એન્ક્રિપ્શન ચકાસી શકાયું નથી.\nરિમોટ ઉપકરણ હજી સેટ થઈ રહ્યું હોઈ શકે છે. પછીથી ફરી પ્રયાસ કરો.\nજો આ ચાલુ રહે, તો સર્વર અવિશ્વસનીય હોઈ શકે છે.\nશું તેમ છતાં ચાલુ રાખવું?"),
+        ("ID whitelisting", "ID વ્હાઇટલિસ્ટિંગ"),
+        ("Use ID whitelisting", "ID વ્હાઇટલિસ્ટિંગનો ઉપયોગ કરો"),
+        ("id_whitelist_tip", "માત્ર વ્હાઇટલિસ્ટ કરેલ ID જ મને એક્સેસ કરી શકે છે"),
+        ("id_whitelist_wildcard_tip", "વાઇલ્ડકાર્ડ સપોર્ટેડ છે: '*' કોઈપણ સંખ્યાના અક્ષરો સાથે મેળ ખાય છે, '?' બરાબર એક અક્ષર સાથે"),
+        ("Invalid ID", "અમાન્ય ID"),
+        ("Your ID is blocked by the peer", "તમારું ID સામેના પક્ષ દ્વારા બ્લોક કરવામાં આવ્યું છે"),
+        ("Your ip is blocked by the peer", "તમારું IP સામેના પક્ષ દ્વારા બ્લોક કરવામાં આવ્યું છે"),
+        ("id_whitelist_caveat_tip", "ID કનેક્ટ થતા ક્લાયન્ટ દ્વારા જણાવવામાં આવે છે. વ્હાઇટલિસ્ટ એક્સપોઝર ઘટાડે છે અને પાસવર્ડ કે 2FA નો વિકલ્પ નથી"),
+        ("whitelist_cidr_tip", "CIDR નોટેશન સપોર્ટેડ છે, ઉदાહરણ તરીકે 192.168.1.0/24"),
    ].iter().cloned().collect();
 }
@@ -332,6 +332,7 @@ pub static ref T: std::collections::HashMap<&'static str, &'static str> =
        ("Relay Connection", "חיבור באמצעות ממסר"),
        ("Secure Connection", "חיבור מאובטח"),
        ("Insecure Connection", "חיבור לא מאובטח"),
+        ("Continue", ""),
        ("Scale original", "קנה מידה מקורי"),
        ("Scale adaptive", "קנה מידה מותאם"),
        ("General", "כללי"),
@@ -758,5 +759,20 @@ pub static ref T: std::collections::HashMap<&'static str, &'static str> =
        ("wayland-keyboard-input-reset-choice-tip", "אפס את בחירת קלט המקלדת"),
        ("remember-wayland-keyboard-choice-tip", "אל תשאל שוב עבור מחשב מרוחק זה"),
        ("Why this happens", "מדוע זה קורה"),
+        ("Switch display", "החלפת צג"),
+        ("Show monitor switch button on the main toolbar", "הצגת לחצן החלפת צג בסרגל הכלים הראשי"),
+        ("Show on the minimized toolbar", "הצגה בסרגל הכלים הממוזער"),
+        ("All monitors", "כל המסכים"),
+        ("#{} monitor", "מסך {}"),
+        ("conn-e2ee-unavailable-tip", "לא ניתן לאמת הצפנה מקצה לקצה.\nייתכן שהמכשיר המרוחק עדיין בתהליך הגדרה. נסה שוב מאוחר יותר.\nאם זה ממשיך לקרות, ייתכן שהשרת אינו מהימן.\nלהמשיך בכל זאת?"),
+        ("ID whitelisting", "רשימת מזהים מורשים"),
+        ("Use ID whitelisting", "השתמש ברשימה לבנה של מזהים"),
+        ("id_whitelist_tip", "רק מזהים מהרשימה הלבנה יכולים לגשת אלי"),
+        ("id_whitelist_wildcard_tip", "נתמכים תווים כלליים: '*' תואם כל מספר של תווים, '?' תואם תו אחד בדיוק"),
+        ("Invalid ID", "מזהה לא תקין"),
+        ("Your ID is blocked by the peer", "המזהה שלך נחסם על ידי הצד המרוחק"),
+        ("Your ip is blocked by the peer", "כתובת ה-IP שלך נחסמה על ידי הצד המרוחק"),
+        ("id_whitelist_caveat_tip", "המזהה מדווח על ידי הלקוח המתחבר. הרשימה הלבנה מצמצמת חשיפה ואינה מחליפה סיסמה או 2FA"),
+        ("whitelist_cidr_tip", "יש תמיכה בסימון CIDR, לדוגמה 192.168.1.0/24"),
    ].iter().cloned().collect();
 }
@@ -332,6 +332,7 @@ pub static ref T: std::collections::HashMap<&'static str, &'static str> =
        ("Relay Connection", "रिले कनेक्शन"),
        ("Secure Connection", "सुरक्षित कनेक्शन"),
        ("Insecure Connection", "असुरक्षित कनेक्शन"),
+        ("Continue", ""),
        ("Scale original", "मूल पैमाना"),
        ("Scale adaptive", "अनुकूली पैमाना"),
        ("General", "सामान्य"),
@@ -758,5 +759,20 @@ pub static ref T: std::collections::HashMap<&'static str, &'static str> =
        ("wayland-keyboard-input-reset-choice-tip", "कीबोर्ड इनपुट चयन रीसेट करें"),
        ("remember-wayland-keyboard-choice-tip", "इस रिमोट कंप्यूटर के लिए दोबारा न पूछें"),
        ("Why this happens", "ऐसा क्यों होता है"),
+        ("Switch display", "डिस्प्ले बदलें"),
+        ("Show monitor switch button on the main toolbar", "मुख्य टूलबार पर मॉनिटर स्विच बटन दिखाएं"),
+        ("Show on the minimized toolbar", "न्यूनतम किए गए टूलबार पर दिखाएं"),
+        ("All monitors", "सभी मॉनिटर"),
+        ("#{} monitor", "मॉनिटर {}"),
+        ("conn-e2ee-unavailable-tip", "एंड-टू-एंड एन्क्रिप्शन सत्यापित नहीं किया जा सका।\nदूरस्थ डिवाइस अभी भी सेट अप हो रहा हो सकता है। बाद में फिर प्रयास करें।\nयदि यह समस्या बनी रहती है, तो सर्वर अविश्वसनीय हो सकता है।\nफिर भी जारी रखें?"),
+        ("ID whitelisting", "ID श्वेतसूची (Whitelisting)"),
+        ("Use ID whitelisting", "ID श्वेतसूची का उपयोग करें"),
+        ("id_whitelist_tip", "केवल श्वेतसूचीबद्ध ID ही मुझ तक पहुंच सकते हैं"),
+        ("id_whitelist_wildcard_tip", "वाइल्डकार्ड समर्थित हैं: '*' किसी भी संख्या के अक्षरों से मेल खाता है, '?' ठीक एक अक्षर से"),
+        ("Invalid ID", "अमान्य ID"),
+        ("Your ID is blocked by the peer", "आपकी ID दूसरे पक्ष द्वारा अवरुद्ध कर दी गई है"),
+        ("Your ip is blocked by the peer", "आपका IP दूसरे पक्ष द्वारा अवरुद्ध कर दिया गया है"),
+        ("id_whitelist_caveat_tip", "ID कनेक्ट करने वाले क्लाइंट द्वारा बताई जाती है। श्वेतसूची जोखिम कम करती है और पासवर्ड या 2FA का विकल्प नहीं है"),
+        ("whitelist_cidr_tip", "CIDR नोटेशन समर्थित है, उदाहरण के लिए 192.168.1.0/24"),
    ].iter().cloned().collect();
 }
@@ -332,6 +332,7 @@ pub static ref T: std::collections::HashMap<&'static str, &'static str> =
        ("Relay Connection", "Posredna veza"),
        ("Secure Connection", "Sigurna veza"),
        ("Insecure Connection", "Nesigurna veza"),
+        ("Continue", ""),
        ("Scale original", "Skaliraj izvornik"),
        ("Scale adaptive", "Prilagođeno skaliranje"),
        ("General", "Općenito"),
@@ -758,5 +759,20 @@ pub static ref T: std::collections::HashMap<&'static str, &'static str> =
        ("wayland-keyboard-input-reset-choice-tip", "Poništi izbor unosa tipkovnicom"),
        ("remember-wayland-keyboard-choice-tip", "Ne pitaj ponovno za ovo udaljeno računalo"),
        ("Why this happens", "Zašto se ovo događa"),
+        ("Switch display", "Promijeni zaslon"),
+        ("Show monitor switch button on the main toolbar", "Prikaži gumb za prebacivanje monitora na glavnoj alatnoj traci"),
+        ("Show on the minimized toolbar", "Prikaži na minimiziranoj alatnoj traci"),
+        ("All monitors", "Svi monitori"),
+        ("#{} monitor", "Monitor {}"),
+        ("conn-e2ee-unavailable-tip", "End-to-end enkripcija nije mogla biti potvrđena.\nUdaljeni uređaj se možda još postavlja. Pokušajte ponovno kasnije.\nAko se to nastavi događati, poslužitelj možda nije pouzdan.\nIpak nastaviti?"),
+        ("ID whitelisting", "ID pouzdana lista"),
+        ("Use ID whitelisting", "Koristi popis pouzdanih ID-ova"),
+        ("id_whitelist_tip", "Mogu mi pristupiti samo dozvoljeni ID-ovi"),
+        ("id_whitelist_wildcard_tip", "Podržani su zamjenski znakovi: '*' odgovara bilo kojem broju znakova, '?' točno jednom znaku"),
+        ("Invalid ID", "Nevažeći ID"),
+        ("Your ID is blocked by the peer", "Vaš ID je blokiralo udaljeno računalo"),
+        ("Your ip is blocked by the peer", "Vašu IP adresu je blokiralo udaljeno računalo"),
+        ("id_whitelist_caveat_tip", "ID prijavljuje klijent koji se povezuje. Ova lista smanjuje izloženost i ne zamjenjuje lozinku ni 2FA"),
+        ("whitelist_cidr_tip", "Podržan je CIDR zapis, primjerice 192.168.1.0/24"),
    ].iter().cloned().collect();
 }
--- a/Show More
+++ b/Show More